Add VPN configuration tools and agent documentation

Created comprehensive VPN setup tooling for Peaceful Spirit L2TP/IPsec connection and enhanced agent documentation framework. VPN Configuration (PST-NW-VPN): - Setup-PST-L2TP-VPN.ps1: Automated L2TP/IPsec setup with split-tunnel and DNS - Connect-PST-VPN.ps1: Connection helper with PPP adapter detection, DNS (192.168.0.2), and route config (192.168.0.0/24) - Connect-PST-VPN-Standalone.ps1: Self-contained connection script for remote deployment - Fix-PST-VPN-Auth.ps1: Authentication troubleshooting for CHAP/MSChapv2 - Diagnose-VPN-Interface.ps1: Comprehensive VPN interface and routing diagnostic - Quick-Test-VPN.ps1: Fast connectivity verification (DNS/router/routes) - Add-PST-VPN-Route-Manual.ps1: Manual route configuration helper - vpn-connect.bat, vpn-disconnect.bat: Simple batch file shortcuts - OpenVPN config files (Windows-compatible, abandoned for L2TP) Key VPN Implementation Details: - L2TP creates PPP adapter with connection name as interface description - UniFi auto-configures DNS (192.168.0.2) but requires manual route to 192.168.0.0/24 - Split-tunnel enabled (only remote traffic through VPN) - All-user connection for pre-login auto-connect via scheduled task - Authentication: CHAP + MSChapv2 for UniFi compatibility Agent Documentation: - AGENT_QUICK_REFERENCE.md: Quick reference for all specialized agents - documentation-squire.md: Documentation and task management specialist agent - Updated all agent markdown files with standardized formatting Project Organization: - Moved conversation logs to dedicated directories (guru-connect-conversation-logs, guru-rmm-conversation-logs) - Cleaned up old session JSONL files from projects/msp-tools/ - Added guru-connect infrastructure (agent, dashboard, proto, scripts, .gitea workflows) - Added guru-rmm server components and deployment configs Technical Notes: - VPN IP pool: 192.168.4.x (client gets 192.168.4.6) - Remote network: 192.168.0.0/24 (router at 192.168.0.10) - PSK: rrClvnmUeXEFo90Ol+z7tfsAZHeSK6w7 - Credentials: pst-admin / 24Hearts$ Files: 15 VPN scripts, 2 agent docs, conversation log reorganization, guru-connect/guru-rmm infrastructure additions Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-18 11:51:47 -07:00
parent b0a68d89bf
commit 6c316aa701
272 changed files with 37068 additions and 2 deletions
--- a/projects/msp-tools/guru-rmm/server/src/db/agents.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/agents.rs
@@ -0,0 +1,375 @@
+//! Agent database operations
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// Agent record from database
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct Agent {
+    pub id: Uuid,
+    pub hostname: String,
+    #[serde(skip_serializing)]
+    pub api_key_hash: Option<String>,  // Nullable: new agents use site's api_key
+    pub os_type: String,
+    pub os_version: Option<String>,
+    pub agent_version: Option<String>,
+    pub last_seen: Option<DateTime<Utc>>,
+    pub status: String,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+    // New fields for site-based registration
+    pub device_id: Option<String>,     // Hardware-derived unique ID
+    pub site_id: Option<Uuid>,         // Which site this agent belongs to
+}
+
+/// Agent without sensitive fields (for API responses)
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AgentResponse {
+    pub id: Uuid,
+    pub hostname: String,
+    pub os_type: String,
+    pub os_version: Option<String>,
+    pub agent_version: Option<String>,
+    pub last_seen: Option<DateTime<Utc>>,
+    pub status: String,
+    pub created_at: DateTime<Utc>,
+    pub device_id: Option<String>,
+    pub site_id: Option<Uuid>,
+    pub site_name: Option<String>,
+    pub client_name: Option<String>,
+}
+
+impl From<Agent> for AgentResponse {
+    fn from(agent: Agent) -> Self {
+        Self {
+            id: agent.id,
+            hostname: agent.hostname,
+            os_type: agent.os_type,
+            os_version: agent.os_version,
+            agent_version: agent.agent_version,
+            last_seen: agent.last_seen,
+            status: agent.status,
+            created_at: agent.created_at,
+            device_id: agent.device_id,
+            site_id: agent.site_id,
+            site_name: None,
+            client_name: None,
+        }
+    }
+}
+
+/// Create a new agent registration
+#[derive(Debug, Clone, Deserialize)]
+pub struct CreateAgent {
+    pub hostname: String,
+    pub api_key_hash: String,
+    pub os_type: String,
+    pub os_version: Option<String>,
+    pub agent_version: Option<String>,
+}
+
+/// Insert a new agent into the database
+pub async fn create_agent(pool: &PgPool, agent: CreateAgent) -> Result<Agent, sqlx::Error> {
+    sqlx::query_as::<_, Agent>(
+        r#"
+        INSERT INTO agents (hostname, api_key_hash, os_type, os_version, agent_version, status)
+        VALUES ($1, $2, $3, $4, $5, 'offline')
+        RETURNING *
+        "#,
+    )
+    .bind(&agent.hostname)
+    .bind(&agent.api_key_hash)
+    .bind(&agent.os_type)
+    .bind(&agent.os_version)
+    .bind(&agent.agent_version)
+    .fetch_one(pool)
+    .await
+}
+
+/// Get an agent by ID
+pub async fn get_agent_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>("SELECT * FROM agents WHERE id = $1")
+        .bind(id)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get an agent by API key hash
+pub async fn get_agent_by_api_key_hash(
+    pool: &PgPool,
+    api_key_hash: &str,
+) -> Result<Option<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>("SELECT * FROM agents WHERE api_key_hash = $1")
+        .bind(api_key_hash)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get all agents
+pub async fn get_all_agents(pool: &PgPool) -> Result<Vec<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>("SELECT * FROM agents ORDER BY hostname")
+        .fetch_all(pool)
+        .await
+}
+
+/// Get agents by status
+pub async fn get_agents_by_status(
+    pool: &PgPool,
+    status: &str,
+) -> Result<Vec<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>("SELECT * FROM agents WHERE status = $1 ORDER BY hostname")
+        .bind(status)
+        .fetch_all(pool)
+        .await
+}
+
+/// Update agent status and last_seen
+pub async fn update_agent_status(
+    pool: &PgPool,
+    id: Uuid,
+    status: &str,
+) -> Result<(), sqlx::Error> {
+    sqlx::query("UPDATE agents SET status = $1, last_seen = NOW() WHERE id = $2")
+        .bind(status)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Update agent info (on connection)
+pub async fn update_agent_info(
+    pool: &PgPool,
+    id: Uuid,
+    hostname: Option<&str>,
+    os_version: Option<&str>,
+    agent_version: Option<&str>,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        r#"
+        UPDATE agents
+        SET hostname = COALESCE($1, hostname),
+            os_version = COALESCE($2, os_version),
+            agent_version = COALESCE($3, agent_version),
+            last_seen = NOW(),
+            status = 'online'
+        WHERE id = $4
+        "#,
+    )
+    .bind(hostname)
+    .bind(os_version)
+    .bind(agent_version)
+    .bind(id)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+/// Delete an agent
+pub async fn delete_agent(pool: &PgPool, id: Uuid) -> Result<bool, sqlx::Error> {
+    let result = sqlx::query("DELETE FROM agents WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+/// Get agent count statistics
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AgentStats {
+    pub total: i64,
+    pub online: i64,
+    pub offline: i64,
+}
+
+pub async fn get_agent_stats(pool: &PgPool) -> Result<AgentStats, sqlx::Error> {
+    let total: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM agents")
+        .fetch_one(pool)
+        .await?;
+
+    let online: (i64,) =
+        sqlx::query_as("SELECT COUNT(*) FROM agents WHERE status = 'online'")
+            .fetch_one(pool)
+            .await?;
+
+    Ok(AgentStats {
+        total: total.0,
+        online: online.0,
+        offline: total.0 - online.0,
+    })
+}
+
+// ============================================================================
+// Site-based agent operations
+// ============================================================================
+
+/// Data for creating an agent via site registration
+#[derive(Debug, Clone)]
+pub struct CreateAgentWithSite {
+    pub site_id: Uuid,
+    pub device_id: String,
+    pub hostname: String,
+    pub os_type: String,
+    pub os_version: Option<String>,
+    pub agent_version: Option<String>,
+}
+
+/// Create a new agent under a site (site-based registration)
+pub async fn create_agent_with_site(
+    pool: &PgPool,
+    agent: CreateAgentWithSite,
+) -> Result<Agent, sqlx::Error> {
+    sqlx::query_as::<_, Agent>(
+        r#"
+        INSERT INTO agents (site_id, device_id, hostname, os_type, os_version, agent_version, status)
+        VALUES ($1, $2, $3, $4, $5, $6, 'offline')
+        RETURNING *
+        "#,
+    )
+    .bind(&agent.site_id)
+    .bind(&agent.device_id)
+    .bind(&agent.hostname)
+    .bind(&agent.os_type)
+    .bind(&agent.os_version)
+    .bind(&agent.agent_version)
+    .fetch_one(pool)
+    .await
+}
+
+/// Get an agent by site_id and device_id (for site-based auth)
+pub async fn get_agent_by_site_and_device(
+    pool: &PgPool,
+    site_id: Uuid,
+    device_id: &str,
+) -> Result<Option<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>(
+        "SELECT * FROM agents WHERE site_id = $1 AND device_id = $2"
+    )
+    .bind(site_id)
+    .bind(device_id)
+    .fetch_optional(pool)
+    .await
+}
+
+/// Get all agents for a site
+pub async fn get_agents_by_site(pool: &PgPool, site_id: Uuid) -> Result<Vec<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>(
+        "SELECT * FROM agents WHERE site_id = $1 ORDER BY hostname"
+    )
+    .bind(site_id)
+    .fetch_all(pool)
+    .await
+}
+
+/// Agent with site and client details for API responses
+#[derive(Debug, Clone, sqlx::FromRow, Serialize)]
+pub struct AgentWithDetails {
+    pub id: Uuid,
+    pub hostname: String,
+    pub os_type: String,
+    pub os_version: Option<String>,
+    pub agent_version: Option<String>,
+    pub last_seen: Option<DateTime<Utc>>,
+    pub status: String,
+    pub created_at: DateTime<Utc>,
+    pub device_id: Option<String>,
+    pub site_id: Option<Uuid>,
+    pub site_name: Option<String>,
+    pub client_id: Option<Uuid>,
+    pub client_name: Option<String>,
+}
+
+/// Get all agents with site/client details
+pub async fn get_all_agents_with_details(pool: &PgPool) -> Result<Vec<AgentWithDetails>, sqlx::Error> {
+    sqlx::query_as::<_, AgentWithDetails>(
+        r#"
+        SELECT
+            a.id, a.hostname, a.os_type, a.os_version, a.agent_version,
+            a.last_seen, a.status, a.created_at, a.device_id, a.site_id,
+            s.name as site_name,
+            c.id as client_id,
+            c.name as client_name
+        FROM agents a
+        LEFT JOIN sites s ON a.site_id = s.id
+        LEFT JOIN clients c ON s.client_id = c.id
+        ORDER BY c.name, s.name, a.hostname
+        "#,
+    )
+    .fetch_all(pool)
+    .await
+}
+
+/// Update agent info including device_id (on connection)
+pub async fn update_agent_info_full(
+    pool: &PgPool,
+    id: Uuid,
+    hostname: Option<&str>,
+    device_id: Option<&str>,
+    os_version: Option<&str>,
+    agent_version: Option<&str>,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        r#"
+        UPDATE agents
+        SET hostname = COALESCE($1, hostname),
+            device_id = COALESCE($2, device_id),
+            os_version = COALESCE($3, os_version),
+            agent_version = COALESCE($4, agent_version),
+            last_seen = NOW(),
+            status = 'online'
+        WHERE id = $5
+        "#,
+    )
+    .bind(hostname)
+    .bind(device_id)
+    .bind(os_version)
+    .bind(agent_version)
+    .bind(id)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+/// Move an agent to a different site (or remove from site if site_id is None)
+pub async fn move_agent_to_site(
+    pool: &PgPool,
+    agent_id: Uuid,
+    site_id: Option<Uuid>,
+) -> Result<Option<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>(
+        r#"
+        UPDATE agents
+        SET site_id = $1,
+            updated_at = NOW()
+        WHERE id = $2
+        RETURNING *
+        "#,
+    )
+    .bind(site_id)
+    .bind(agent_id)
+    .fetch_optional(pool)
+    .await
+}
+
+/// Get agents that are not assigned to any site
+pub async fn get_unassigned_agents(pool: &PgPool) -> Result<Vec<Agent>, sqlx::Error> {
+    sqlx::query_as::<_, Agent>(
+        "SELECT * FROM agents WHERE site_id IS NULL ORDER BY hostname"
+    )
+    .fetch_all(pool)
+    .await
+}
+
+/// Update agent last_seen timestamp (for heartbeat)
+pub async fn update_agent_last_seen(
+    pool: &PgPool,
+    id: Uuid,
+) -> Result<(), sqlx::Error> {
+    sqlx::query("UPDATE agents SET last_seen = NOW(), status = 'online' WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
--- a/projects/msp-tools/guru-rmm/server/src/db/clients.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/clients.rs
@@ -0,0 +1,157 @@
+//! Client (organization) database operations
+
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// Client record from database
+#[derive(Debug, Clone, sqlx::FromRow)]
+pub struct Client {
+    pub id: Uuid,
+    pub name: String,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+}
+
+/// Client response for API
+#[derive(Debug, Clone, Serialize)]
+pub struct ClientResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub site_count: Option<i64>,
+    pub agent_count: Option<i64>,
+}
+
+impl From<Client> for ClientResponse {
+    fn from(c: Client) -> Self {
+        ClientResponse {
+            id: c.id,
+            name: c.name,
+            code: c.code,
+            notes: c.notes,
+            is_active: c.is_active,
+            created_at: c.created_at,
+            site_count: None,
+            agent_count: None,
+        }
+    }
+}
+
+/// Data for creating a new client
+#[derive(Debug, Deserialize)]
+pub struct CreateClient {
+    pub name: String,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+}
+
+/// Data for updating a client
+#[derive(Debug, Deserialize)]
+pub struct UpdateClient {
+    pub name: Option<String>,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: Option<bool>,
+}
+
+/// Create a new client
+pub async fn create_client(pool: &PgPool, client: CreateClient) -> Result<Client, sqlx::Error> {
+    sqlx::query_as::<_, Client>(
+        r#"
+        INSERT INTO clients (name, code, notes)
+        VALUES ($1, $2, $3)
+        RETURNING *
+        "#,
+    )
+    .bind(&client.name)
+    .bind(&client.code)
+    .bind(&client.notes)
+    .fetch_one(pool)
+    .await
+}
+
+/// Get a client by ID
+pub async fn get_client_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Client>, sqlx::Error> {
+    sqlx::query_as::<_, Client>("SELECT * FROM clients WHERE id = $1")
+        .bind(id)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get all clients
+pub async fn get_all_clients(pool: &PgPool) -> Result<Vec<Client>, sqlx::Error> {
+    sqlx::query_as::<_, Client>("SELECT * FROM clients ORDER BY name")
+        .fetch_all(pool)
+        .await
+}
+
+/// Get all clients with counts
+#[derive(Debug, Clone, sqlx::FromRow)]
+pub struct ClientWithCounts {
+    pub id: Uuid,
+    pub name: String,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+    pub site_count: i64,
+    pub agent_count: i64,
+}
+
+pub async fn get_all_clients_with_counts(pool: &PgPool) -> Result<Vec<ClientWithCounts>, sqlx::Error> {
+    sqlx::query_as::<_, ClientWithCounts>(
+        r#"
+        SELECT
+            c.*,
+            COALESCE((SELECT COUNT(*) FROM sites WHERE client_id = c.id), 0) as site_count,
+            COALESCE((SELECT COUNT(*) FROM agents a JOIN sites s ON a.site_id = s.id WHERE s.client_id = c.id), 0) as agent_count
+        FROM clients c
+        ORDER BY c.name
+        "#,
+    )
+    .fetch_all(pool)
+    .await
+}
+
+/// Update a client
+pub async fn update_client(
+    pool: &PgPool,
+    id: Uuid,
+    update: UpdateClient,
+) -> Result<Option<Client>, sqlx::Error> {
+    sqlx::query_as::<_, Client>(
+        r#"
+        UPDATE clients
+        SET name = COALESCE($1, name),
+            code = COALESCE($2, code),
+            notes = COALESCE($3, notes),
+            is_active = COALESCE($4, is_active)
+        WHERE id = $5
+        RETURNING *
+        "#,
+    )
+    .bind(&update.name)
+    .bind(&update.code)
+    .bind(&update.notes)
+    .bind(&update.is_active)
+    .bind(id)
+    .fetch_optional(pool)
+    .await
+}
+
+/// Delete a client
+pub async fn delete_client(pool: &PgPool, id: Uuid) -> Result<bool, sqlx::Error> {
+    let result = sqlx::query("DELETE FROM clients WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
--- a/projects/msp-tools/guru-rmm/server/src/db/commands.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/commands.rs
@@ -0,0 +1,163 @@
+//! Commands database operations
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// Command record from database
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct Command {
+    pub id: Uuid,
+    pub agent_id: Uuid,
+    pub command_type: String,
+    pub command_text: String,
+    pub status: String,
+    pub exit_code: Option<i32>,
+    pub stdout: Option<String>,
+    pub stderr: Option<String>,
+    pub created_at: DateTime<Utc>,
+    pub started_at: Option<DateTime<Utc>>,
+    pub completed_at: Option<DateTime<Utc>>,
+    pub created_by: Option<Uuid>,
+}
+
+/// Create a new command
+#[derive(Debug, Clone, Deserialize)]
+pub struct CreateCommand {
+    pub agent_id: Uuid,
+    pub command_type: String,
+    pub command_text: String,
+    pub created_by: Option<Uuid>,
+}
+
+/// Insert a new command
+pub async fn create_command(pool: &PgPool, cmd: CreateCommand) -> Result<Command, sqlx::Error> {
+    sqlx::query_as::<_, Command>(
+        r#"
+        INSERT INTO commands (agent_id, command_type, command_text, status, created_by)
+        VALUES ($1, $2, $3, 'pending', $4)
+        RETURNING *
+        "#,
+    )
+    .bind(cmd.agent_id)
+    .bind(&cmd.command_type)
+    .bind(&cmd.command_text)
+    .bind(cmd.created_by)
+    .fetch_one(pool)
+    .await
+}
+
+/// Get a command by ID
+pub async fn get_command_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Command>, sqlx::Error> {
+    sqlx::query_as::<_, Command>("SELECT * FROM commands WHERE id = $1")
+        .bind(id)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get pending commands for an agent
+pub async fn get_pending_commands(
+    pool: &PgPool,
+    agent_id: Uuid,
+) -> Result<Vec<Command>, sqlx::Error> {
+    sqlx::query_as::<_, Command>(
+        r#"
+        SELECT * FROM commands
+        WHERE agent_id = $1 AND status = 'pending'
+        ORDER BY created_at ASC
+        "#,
+    )
+    .bind(agent_id)
+    .fetch_all(pool)
+    .await
+}
+
+/// Get command history for an agent
+pub async fn get_agent_commands(
+    pool: &PgPool,
+    agent_id: Uuid,
+    limit: i64,
+) -> Result<Vec<Command>, sqlx::Error> {
+    sqlx::query_as::<_, Command>(
+        r#"
+        SELECT * FROM commands
+        WHERE agent_id = $1
+        ORDER BY created_at DESC
+        LIMIT $2
+        "#,
+    )
+    .bind(agent_id)
+    .bind(limit)
+    .fetch_all(pool)
+    .await
+}
+
+/// Get all recent commands
+pub async fn get_recent_commands(pool: &PgPool, limit: i64) -> Result<Vec<Command>, sqlx::Error> {
+    sqlx::query_as::<_, Command>(
+        r#"
+        SELECT * FROM commands
+        ORDER BY created_at DESC
+        LIMIT $1
+        "#,
+    )
+    .bind(limit)
+    .fetch_all(pool)
+    .await
+}
+
+/// Update command status to running
+pub async fn mark_command_running(pool: &PgPool, id: Uuid) -> Result<(), sqlx::Error> {
+    sqlx::query("UPDATE commands SET status = 'running', started_at = NOW() WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Update command result
+#[derive(Debug, Clone, Deserialize)]
+pub struct CommandResult {
+    pub exit_code: i32,
+    pub stdout: String,
+    pub stderr: String,
+}
+
+pub async fn update_command_result(
+    pool: &PgPool,
+    id: Uuid,
+    result: CommandResult,
+) -> Result<(), sqlx::Error> {
+    let status = if result.exit_code == 0 {
+        "completed"
+    } else {
+        "failed"
+    };
+
+    sqlx::query(
+        r#"
+        UPDATE commands
+        SET status = $1, exit_code = $2, stdout = $3, stderr = $4, completed_at = NOW()
+        WHERE id = $5
+        "#,
+    )
+    .bind(status)
+    .bind(result.exit_code)
+    .bind(&result.stdout)
+    .bind(&result.stderr)
+    .bind(id)
+    .execute(pool)
+    .await?;
+
+    Ok(())
+}
+
+/// Delete a command
+pub async fn delete_command(pool: &PgPool, id: Uuid) -> Result<bool, sqlx::Error> {
+    let result = sqlx::query("DELETE FROM commands WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
--- a/projects/msp-tools/guru-rmm/server/src/db/metrics.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/metrics.rs
@@ -0,0 +1,284 @@
+//! Metrics database operations
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// Metrics record from database
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct Metrics {
+    pub id: i64,
+    pub agent_id: Uuid,
+    pub timestamp: DateTime<Utc>,
+    pub cpu_percent: Option<f32>,
+    pub memory_percent: Option<f32>,
+    pub memory_used_bytes: Option<i64>,
+    pub disk_percent: Option<f32>,
+    pub disk_used_bytes: Option<i64>,
+    pub network_rx_bytes: Option<i64>,
+    pub network_tx_bytes: Option<i64>,
+    // Extended metrics
+    pub uptime_seconds: Option<i64>,
+    pub boot_time: Option<i64>,
+    pub logged_in_user: Option<String>,
+    pub user_idle_seconds: Option<i64>,
+    pub public_ip: Option<String>,
+    pub memory_total_bytes: Option<i64>,
+    pub disk_total_bytes: Option<i64>,
+}
+
+/// Create metrics data from agent
+#[derive(Debug, Clone, Deserialize)]
+pub struct CreateMetrics {
+    pub agent_id: Uuid,
+    pub cpu_percent: Option<f32>,
+    pub memory_percent: Option<f32>,
+    pub memory_used_bytes: Option<i64>,
+    pub disk_percent: Option<f32>,
+    pub disk_used_bytes: Option<i64>,
+    pub network_rx_bytes: Option<i64>,
+    pub network_tx_bytes: Option<i64>,
+    // Extended metrics
+    pub uptime_seconds: Option<i64>,
+    pub boot_time: Option<i64>,
+    pub logged_in_user: Option<String>,
+    pub user_idle_seconds: Option<i64>,
+    pub public_ip: Option<String>,
+    pub memory_total_bytes: Option<i64>,
+    pub disk_total_bytes: Option<i64>,
+}
+
+/// Insert metrics into the database
+pub async fn insert_metrics(pool: &PgPool, metrics: CreateMetrics) -> Result<i64, sqlx::Error> {
+    let result: (i64,) = sqlx::query_as(
+        r#"
+        INSERT INTO metrics (
+            agent_id, cpu_percent, memory_percent, memory_used_bytes,
+            disk_percent, disk_used_bytes, network_rx_bytes, network_tx_bytes,
+            uptime_seconds, boot_time, logged_in_user, user_idle_seconds,
+            public_ip, memory_total_bytes, disk_total_bytes
+        )
+        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)
+        RETURNING id
+        "#,
+    )
+    .bind(metrics.agent_id)
+    .bind(metrics.cpu_percent)
+    .bind(metrics.memory_percent)
+    .bind(metrics.memory_used_bytes)
+    .bind(metrics.disk_percent)
+    .bind(metrics.disk_used_bytes)
+    .bind(metrics.network_rx_bytes)
+    .bind(metrics.network_tx_bytes)
+    .bind(metrics.uptime_seconds)
+    .bind(metrics.boot_time)
+    .bind(&metrics.logged_in_user)
+    .bind(metrics.user_idle_seconds)
+    .bind(&metrics.public_ip)
+    .bind(metrics.memory_total_bytes)
+    .bind(metrics.disk_total_bytes)
+    .fetch_one(pool)
+    .await?;
+
+    Ok(result.0)
+}
+
+/// Get recent metrics for an agent
+pub async fn get_agent_metrics(
+    pool: &PgPool,
+    agent_id: Uuid,
+    limit: i64,
+) -> Result<Vec<Metrics>, sqlx::Error> {
+    sqlx::query_as::<_, Metrics>(
+        r#"
+        SELECT * FROM metrics
+        WHERE agent_id = $1
+        ORDER BY timestamp DESC
+        LIMIT $2
+        "#,
+    )
+    .bind(agent_id)
+    .bind(limit)
+    .fetch_all(pool)
+    .await
+}
+
+/// Get metrics for an agent within a time range
+pub async fn get_agent_metrics_range(
+    pool: &PgPool,
+    agent_id: Uuid,
+    start: DateTime<Utc>,
+    end: DateTime<Utc>,
+) -> Result<Vec<Metrics>, sqlx::Error> {
+    sqlx::query_as::<_, Metrics>(
+        r#"
+        SELECT * FROM metrics
+        WHERE agent_id = $1 AND timestamp >= $2 AND timestamp <= $3
+        ORDER BY timestamp ASC
+        "#,
+    )
+    .bind(agent_id)
+    .bind(start)
+    .bind(end)
+    .fetch_all(pool)
+    .await
+}
+
+/// Get latest metrics for an agent
+pub async fn get_latest_metrics(
+    pool: &PgPool,
+    agent_id: Uuid,
+) -> Result<Option<Metrics>, sqlx::Error> {
+    sqlx::query_as::<_, Metrics>(
+        r#"
+        SELECT * FROM metrics
+        WHERE agent_id = $1
+        ORDER BY timestamp DESC
+        LIMIT 1
+        "#,
+    )
+    .bind(agent_id)
+    .fetch_optional(pool)
+    .await
+}
+
+/// Delete old metrics (for cleanup jobs)
+pub async fn delete_old_metrics(
+    pool: &PgPool,
+    older_than: DateTime<Utc>,
+) -> Result<u64, sqlx::Error> {
+    let result = sqlx::query("DELETE FROM metrics WHERE timestamp < $1")
+        .bind(older_than)
+        .execute(pool)
+        .await?;
+
+    Ok(result.rows_affected())
+}
+
+/// Summary statistics for dashboard
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MetricsSummary {
+    pub avg_cpu: f32,
+    pub avg_memory: f32,
+    pub avg_disk: f32,
+    pub total_network_rx: i64,
+    pub total_network_tx: i64,
+}
+
+/// Get summary metrics across all agents (last hour)
+pub async fn get_metrics_summary(pool: &PgPool) -> Result<MetricsSummary, sqlx::Error> {
+    let result: (Option<f64>, Option<f64>, Option<f64>, Option<i64>, Option<i64>) = sqlx::query_as(
+        r#"
+        SELECT
+            AVG(cpu_percent)::float8,
+            AVG(memory_percent)::float8,
+            AVG(disk_percent)::float8,
+            SUM(network_rx_bytes),
+            SUM(network_tx_bytes)
+        FROM metrics
+        WHERE timestamp > NOW() - INTERVAL '1 hour'
+        "#,
+    )
+    .fetch_one(pool)
+    .await?;
+
+    Ok(MetricsSummary {
+        avg_cpu: result.0.unwrap_or(0.0) as f32,
+        avg_memory: result.1.unwrap_or(0.0) as f32,
+        avg_disk: result.2.unwrap_or(0.0) as f32,
+        total_network_rx: result.3.unwrap_or(0),
+        total_network_tx: result.4.unwrap_or(0),
+    })
+}
+
+// ============================================================================
+// Agent State (network interfaces, extended info snapshot)
+// ============================================================================
+
+/// Agent state record from database
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct AgentState {
+    pub agent_id: Uuid,
+    pub network_interfaces: Option<serde_json::Value>,
+    pub network_state_hash: Option<String>,
+    pub uptime_seconds: Option<i64>,
+    pub boot_time: Option<i64>,
+    pub logged_in_user: Option<String>,
+    pub user_idle_seconds: Option<i64>,
+    pub public_ip: Option<String>,
+    pub network_updated_at: Option<DateTime<Utc>>,
+    pub metrics_updated_at: Option<DateTime<Utc>>,
+}
+
+/// Update or insert agent state (upsert)
+pub async fn upsert_agent_state(
+    pool: &PgPool,
+    agent_id: Uuid,
+    uptime_seconds: Option<i64>,
+    boot_time: Option<i64>,
+    logged_in_user: Option<&str>,
+    user_idle_seconds: Option<i64>,
+    public_ip: Option<&str>,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        r#"
+        INSERT INTO agent_state (
+            agent_id, uptime_seconds, boot_time, logged_in_user,
+            user_idle_seconds, public_ip, metrics_updated_at
+        )
+        VALUES ($1, $2, $3, $4, $5, $6, NOW())
+        ON CONFLICT (agent_id) DO UPDATE SET
+            uptime_seconds = EXCLUDED.uptime_seconds,
+            boot_time = EXCLUDED.boot_time,
+            logged_in_user = EXCLUDED.logged_in_user,
+            user_idle_seconds = EXCLUDED.user_idle_seconds,
+            public_ip = EXCLUDED.public_ip,
+            metrics_updated_at = NOW()
+        "#,
+    )
+    .bind(agent_id)
+    .bind(uptime_seconds)
+    .bind(boot_time)
+    .bind(logged_in_user)
+    .bind(user_idle_seconds)
+    .bind(public_ip)
+    .execute(pool)
+    .await?;
+
+    Ok(())
+}
+
+/// Update network state for an agent
+pub async fn update_agent_network_state(
+    pool: &PgPool,
+    agent_id: Uuid,
+    interfaces: &serde_json::Value,
+    state_hash: &str,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        r#"
+        INSERT INTO agent_state (agent_id, network_interfaces, network_state_hash, network_updated_at)
+        VALUES ($1, $2, $3, NOW())
+        ON CONFLICT (agent_id) DO UPDATE SET
+            network_interfaces = EXCLUDED.network_interfaces,
+            network_state_hash = EXCLUDED.network_state_hash,
+            network_updated_at = NOW()
+        "#,
+    )
+    .bind(agent_id)
+    .bind(interfaces)
+    .bind(state_hash)
+    .execute(pool)
+    .await?;
+
+    Ok(())
+}
+
+/// Get agent state by agent ID
+pub async fn get_agent_state(pool: &PgPool, agent_id: Uuid) -> Result<Option<AgentState>, sqlx::Error> {
+    sqlx::query_as::<_, AgentState>("SELECT * FROM agent_state WHERE agent_id = $1")
+        .bind(agent_id)
+        .fetch_optional(pool)
+        .await
+}
--- a/projects/msp-tools/guru-rmm/server/src/db/mod.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/mod.rs
@@ -0,0 +1,19 @@
+//! Database models and queries
+//!
+//! Provides database access for clients, sites, agents, metrics, commands, users, and updates.
+
+pub mod agents;
+pub mod clients;
+pub mod commands;
+pub mod metrics;
+pub mod sites;
+pub mod updates;
+pub mod users;
+
+pub use agents::*;
+pub use clients::*;
+pub use commands::*;
+pub use metrics::*;
+pub use sites::*;
+pub use updates::*;
+pub use users::*;
--- a/projects/msp-tools/guru-rmm/server/src/db/sites.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/sites.rs
@@ -0,0 +1,264 @@
+//! Site database operations
+
+use rand::Rng;
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// Word lists for generating site codes
+const ADJECTIVES: &[&str] = &[
+    "BLUE", "GREEN", "RED", "GOLD", "SILVER", "IRON", "COPPER", "BRONZE",
+    "SWIFT", "BRIGHT", "DARK", "LIGHT", "BOLD", "CALM", "WILD", "WARM",
+    "NORTH", "SOUTH", "EAST", "WEST", "UPPER", "LOWER", "INNER", "OUTER",
+];
+
+const NOUNS: &[&str] = &[
+    "HAWK", "EAGLE", "TIGER", "LION", "WOLF", "BEAR", "FALCON", "PHOENIX",
+    "PEAK", "VALLEY", "RIVER", "OCEAN", "STORM", "CLOUD", "STAR", "MOON",
+    "TOWER", "BRIDGE", "GATE", "FORGE", "CASTLE", "HARBOR", "MEADOW", "GROVE",
+];
+
+/// Generate a human-friendly site code (e.g., "BLUE-TIGER-4829")
+pub fn generate_site_code() -> String {
+    let mut rng = rand::thread_rng();
+    let adj = ADJECTIVES[rng.gen_range(0..ADJECTIVES.len())];
+    let noun = NOUNS[rng.gen_range(0..NOUNS.len())];
+    let num: u16 = rng.gen_range(1000..9999);
+    format!("{}-{}-{}", adj, noun, num)
+}
+
+/// Site record from database
+#[derive(Debug, Clone, sqlx::FromRow)]
+pub struct Site {
+    pub id: Uuid,
+    pub client_id: Uuid,
+    pub name: String,
+    pub site_code: String,
+    pub api_key_hash: String,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+}
+
+/// Site response for API
+#[derive(Debug, Clone, Serialize)]
+pub struct SiteResponse {
+    pub id: Uuid,
+    pub client_id: Uuid,
+    pub client_name: Option<String>,
+    pub name: String,
+    pub site_code: String,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub agent_count: Option<i64>,
+}
+
+impl From<Site> for SiteResponse {
+    fn from(s: Site) -> Self {
+        SiteResponse {
+            id: s.id,
+            client_id: s.client_id,
+            client_name: None,
+            name: s.name,
+            site_code: s.site_code,
+            address: s.address,
+            notes: s.notes,
+            is_active: s.is_active,
+            created_at: s.created_at,
+            agent_count: None,
+        }
+    }
+}
+
+/// Data for creating a new site
+#[derive(Debug, Deserialize)]
+pub struct CreateSite {
+    pub client_id: Uuid,
+    pub name: String,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+}
+
+/// Internal create with all fields
+pub struct CreateSiteInternal {
+    pub client_id: Uuid,
+    pub name: String,
+    pub site_code: String,
+    pub api_key_hash: String,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+}
+
+/// Data for updating a site
+#[derive(Debug, Deserialize)]
+pub struct UpdateSite {
+    pub name: Option<String>,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: Option<bool>,
+}
+
+/// Create a new site
+pub async fn create_site(pool: &PgPool, site: CreateSiteInternal) -> Result<Site, sqlx::Error> {
+    sqlx::query_as::<_, Site>(
+        r#"
+        INSERT INTO sites (client_id, name, site_code, api_key_hash, address, notes)
+        VALUES ($1, $2, $3, $4, $5, $6)
+        RETURNING *
+        "#,
+    )
+    .bind(&site.client_id)
+    .bind(&site.name)
+    .bind(&site.site_code)
+    .bind(&site.api_key_hash)
+    .bind(&site.address)
+    .bind(&site.notes)
+    .fetch_one(pool)
+    .await
+}
+
+/// Get a site by ID
+pub async fn get_site_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Site>, sqlx::Error> {
+    sqlx::query_as::<_, Site>("SELECT * FROM sites WHERE id = $1")
+        .bind(id)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get a site by site code
+pub async fn get_site_by_code(pool: &PgPool, site_code: &str) -> Result<Option<Site>, sqlx::Error> {
+    sqlx::query_as::<_, Site>("SELECT * FROM sites WHERE site_code = $1 AND is_active = true")
+        .bind(site_code.to_uppercase())
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get a site by API key hash
+pub async fn get_site_by_api_key_hash(pool: &PgPool, api_key_hash: &str) -> Result<Option<Site>, sqlx::Error> {
+    sqlx::query_as::<_, Site>("SELECT * FROM sites WHERE api_key_hash = $1 AND is_active = true")
+        .bind(api_key_hash)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get all sites for a client
+pub async fn get_sites_by_client(pool: &PgPool, client_id: Uuid) -> Result<Vec<Site>, sqlx::Error> {
+    sqlx::query_as::<_, Site>("SELECT * FROM sites WHERE client_id = $1 ORDER BY name")
+        .bind(client_id)
+        .fetch_all(pool)
+        .await
+}
+
+/// Get all sites
+pub async fn get_all_sites(pool: &PgPool) -> Result<Vec<Site>, sqlx::Error> {
+    sqlx::query_as::<_, Site>("SELECT * FROM sites ORDER BY name")
+        .fetch_all(pool)
+        .await
+}
+
+/// Site with client name and agent count
+#[derive(Debug, Clone, sqlx::FromRow)]
+pub struct SiteWithDetails {
+    pub id: Uuid,
+    pub client_id: Uuid,
+    pub name: String,
+    pub site_code: String,
+    pub api_key_hash: String,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+    pub client_name: String,
+    pub agent_count: i64,
+}
+
+pub async fn get_all_sites_with_details(pool: &PgPool) -> Result<Vec<SiteWithDetails>, sqlx::Error> {
+    sqlx::query_as::<_, SiteWithDetails>(
+        r#"
+        SELECT
+            s.*,
+            c.name as client_name,
+            COALESCE((SELECT COUNT(*) FROM agents WHERE site_id = s.id), 0) as agent_count
+        FROM sites s
+        JOIN clients c ON s.client_id = c.id
+        ORDER BY c.name, s.name
+        "#,
+    )
+    .fetch_all(pool)
+    .await
+}
+
+/// Update a site
+pub async fn update_site(
+    pool: &PgPool,
+    id: Uuid,
+    update: UpdateSite,
+) -> Result<Option<Site>, sqlx::Error> {
+    sqlx::query_as::<_, Site>(
+        r#"
+        UPDATE sites
+        SET name = COALESCE($1, name),
+            address = COALESCE($2, address),
+            notes = COALESCE($3, notes),
+            is_active = COALESCE($4, is_active)
+        WHERE id = $5
+        RETURNING *
+        "#,
+    )
+    .bind(&update.name)
+    .bind(&update.address)
+    .bind(&update.notes)
+    .bind(&update.is_active)
+    .bind(id)
+    .fetch_optional(pool)
+    .await
+}
+
+/// Regenerate API key for a site
+pub async fn regenerate_site_api_key(
+    pool: &PgPool,
+    id: Uuid,
+    new_api_key_hash: &str,
+) -> Result<bool, sqlx::Error> {
+    let result = sqlx::query("UPDATE sites SET api_key_hash = $1 WHERE id = $2")
+        .bind(new_api_key_hash)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+/// Delete a site
+pub async fn delete_site(pool: &PgPool, id: Uuid) -> Result<bool, sqlx::Error> {
+    let result = sqlx::query("DELETE FROM sites WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+/// Check if a site code is unique
+pub async fn is_site_code_unique(pool: &PgPool, site_code: &str) -> Result<bool, sqlx::Error> {
+    let result: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM sites WHERE site_code = $1")
+        .bind(site_code.to_uppercase())
+        .fetch_one(pool)
+        .await?;
+    Ok(result.0 == 0)
+}
+
+/// Generate a unique site code (tries up to 10 times)
+pub async fn generate_unique_site_code(pool: &PgPool) -> Result<String, sqlx::Error> {
+    for _ in 0..10 {
+        let code = generate_site_code();
+        if is_site_code_unique(pool, &code).await? {
+            return Ok(code);
+        }
+    }
+    // Fallback: add random suffix
+    Ok(format!("{}-{}", generate_site_code(), rand::thread_rng().gen_range(100..999)))
+}
--- a/projects/msp-tools/guru-rmm/server/src/db/updates.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/updates.rs
@@ -0,0 +1,217 @@
+//! Database operations for agent updates
+
+use anyhow::Result;
+use sqlx::{PgPool, Row};
+use uuid::Uuid;
+
+/// Agent update record
+#[derive(Debug, Clone, sqlx::FromRow)]
+pub struct AgentUpdateRecord {
+    pub id: Uuid,
+    pub agent_id: Uuid,
+    pub update_id: Uuid,
+    pub old_version: String,
+    pub target_version: String,
+    pub download_url: Option<String>,
+    pub checksum_sha256: Option<String>,
+    pub status: Option<String>,
+    pub started_at: Option<chrono::DateTime<chrono::Utc>>,
+    pub completed_at: Option<chrono::DateTime<chrono::Utc>>,
+    pub error_message: Option<String>,
+}
+
+/// Create a new agent update record
+pub async fn create_agent_update(
+    pool: &PgPool,
+    agent_id: Uuid,
+    update_id: Uuid,
+    old_version: &str,
+    target_version: &str,
+    download_url: &str,
+    checksum_sha256: &str,
+) -> Result<()> {
+    sqlx::query(
+        r#"
+        INSERT INTO agent_updates (agent_id, update_id, old_version, target_version, download_url, checksum_sha256, status)
+        VALUES ($1, $2, $3, $4, $5, $6, 'pending')
+        "#,
+    )
+    .bind(agent_id)
+    .bind(update_id)
+    .bind(old_version)
+    .bind(target_version)
+    .bind(download_url)
+    .bind(checksum_sha256)
+    .execute(pool)
+    .await?;
+
+    Ok(())
+}
+
+/// Mark an agent update as completed
+pub async fn complete_agent_update(
+    pool: &PgPool,
+    update_id: Uuid,
+    new_version: Option<&str>,
+) -> Result<()> {
+    sqlx::query(
+        r#"
+        UPDATE agent_updates
+        SET status = 'completed', completed_at = NOW()
+        WHERE update_id = $1
+        "#,
+    )
+    .bind(update_id)
+    .execute(pool)
+    .await?;
+
+    // If new_version provided, update the agent's version
+    if let Some(version) = new_version {
+        sqlx::query(
+            r#"
+            UPDATE agents
+            SET agent_version = $2, updated_at = NOW()
+            WHERE id = (SELECT agent_id FROM agent_updates WHERE update_id = $1)
+            "#,
+        )
+        .bind(update_id)
+        .bind(version)
+        .execute(pool)
+        .await?;
+    }
+
+    Ok(())
+}
+
+/// Mark an agent update as failed
+pub async fn fail_agent_update(
+    pool: &PgPool,
+    update_id: Uuid,
+    error_message: Option<&str>,
+) -> Result<()> {
+    sqlx::query(
+        r#"
+        UPDATE agent_updates
+        SET status = 'failed', completed_at = NOW(), error_message = $2
+        WHERE update_id = $1
+        "#,
+    )
+    .bind(update_id)
+    .bind(error_message)
+    .execute(pool)
+    .await?;
+
+    Ok(())
+}
+
+/// Update the status of an agent update (for progress tracking)
+pub async fn update_agent_update_status(
+    pool: &PgPool,
+    update_id: Uuid,
+    status: &str,
+) -> Result<()> {
+    sqlx::query(
+        r#"
+        UPDATE agent_updates
+        SET status = $2
+        WHERE update_id = $1
+        "#,
+    )
+    .bind(update_id)
+    .bind(status)
+    .execute(pool)
+    .await?;
+
+    Ok(())
+}
+
+/// Get pending update for an agent (if any)
+pub async fn get_pending_update(
+    pool: &PgPool,
+    agent_id: Uuid,
+) -> Result<Option<AgentUpdateRecord>> {
+    let record = sqlx::query_as::<_, AgentUpdateRecord>(
+        r#"
+        SELECT id, agent_id, update_id, old_version, target_version,
+               download_url, checksum_sha256, status, started_at, completed_at, error_message
+        FROM agent_updates
+        WHERE agent_id = $1 AND status IN ('pending', 'downloading', 'installing')
+        ORDER BY started_at DESC
+        LIMIT 1
+        "#,
+    )
+    .bind(agent_id)
+    .fetch_optional(pool)
+    .await?;
+
+    Ok(record)
+}
+
+/// Get stale updates (started but not completed within timeout)
+pub async fn get_stale_updates(
+    pool: &PgPool,
+    timeout_secs: i64,
+) -> Result<Vec<AgentUpdateRecord>> {
+    let records = sqlx::query_as::<_, AgentUpdateRecord>(
+        r#"
+        SELECT id, agent_id, update_id, old_version, target_version,
+               download_url, checksum_sha256, status, started_at, completed_at, error_message
+        FROM agent_updates
+        WHERE status IN ('pending', 'downloading', 'installing')
+          AND started_at < NOW() - INTERVAL '1 second' * $1
+        "#,
+    )
+    .bind(timeout_secs as f64)
+    .fetch_all(pool)
+    .await?;
+
+    Ok(records)
+}
+
+/// Complete a pending update by matching agent reconnection
+/// Called when an agent reconnects with a previous_version different from agent_version
+pub async fn complete_update_by_agent(
+    pool: &PgPool,
+    agent_id: Uuid,
+    pending_update_id: Option<Uuid>,
+    old_version: &str,
+    new_version: &str,
+) -> Result<bool> {
+    // First try by update_id if provided
+    if let Some(update_id) = pending_update_id {
+        let result = sqlx::query(
+            r#"
+            UPDATE agent_updates
+            SET status = 'completed', completed_at = NOW()
+            WHERE update_id = $1 AND agent_id = $2 AND status IN ('pending', 'downloading', 'installing')
+            "#,
+        )
+        .bind(update_id)
+        .bind(agent_id)
+        .execute(pool)
+        .await?;
+
+        if result.rows_affected() > 0 {
+            return Ok(true);
+        }
+    }
+
+    // Fall back to finding by old_version match
+    let result = sqlx::query(
+        r#"
+        UPDATE agent_updates
+        SET status = 'completed', completed_at = NOW()
+        WHERE agent_id = $1
+          AND old_version = $2
+          AND target_version = $3
+          AND status IN ('pending', 'downloading', 'installing')
+        "#,
+    )
+    .bind(agent_id)
+    .bind(old_version)
+    .bind(new_version)
+    .execute(pool)
+    .await?;
+
+    Ok(result.rows_affected() > 0)
+}
--- a/projects/msp-tools/guru-rmm/server/src/db/users.rs
+++ b/projects/msp-tools/guru-rmm/server/src/db/users.rs
@@ -0,0 +1,177 @@
+//! Users database operations
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use uuid::Uuid;
+
+/// User record from database
+#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
+pub struct User {
+    pub id: Uuid,
+    pub email: String,
+    #[serde(skip_serializing)]
+    pub password_hash: Option<String>,
+    pub name: Option<String>,
+    pub role: String,
+    pub sso_provider: Option<String>,
+    pub sso_id: Option<String>,
+    pub created_at: DateTime<Utc>,
+    pub last_login: Option<DateTime<Utc>>,
+}
+
+/// User response without sensitive fields
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UserResponse {
+    pub id: Uuid,
+    pub email: String,
+    pub name: Option<String>,
+    pub role: String,
+    pub sso_provider: Option<String>,
+    pub created_at: DateTime<Utc>,
+    pub last_login: Option<DateTime<Utc>>,
+}
+
+impl From<User> for UserResponse {
+    fn from(user: User) -> Self {
+        Self {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            role: user.role,
+            sso_provider: user.sso_provider,
+            created_at: user.created_at,
+            last_login: user.last_login,
+        }
+    }
+}
+
+/// Create a new user (local auth)
+#[derive(Debug, Clone, Deserialize)]
+pub struct CreateUser {
+    pub email: String,
+    pub password_hash: String,
+    pub name: Option<String>,
+    pub role: Option<String>,
+}
+
+/// Create a new local user
+pub async fn create_user(pool: &PgPool, user: CreateUser) -> Result<User, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        r#"
+        INSERT INTO users (email, password_hash, name, role)
+        VALUES ($1, $2, $3, COALESCE($4, 'user'))
+        RETURNING *
+        "#,
+    )
+    .bind(&user.email)
+    .bind(&user.password_hash)
+    .bind(&user.name)
+    .bind(&user.role)
+    .fetch_one(pool)
+    .await
+}
+
+/// Create or update SSO user
+#[derive(Debug, Clone, Deserialize)]
+pub struct UpsertSsoUser {
+    pub email: String,
+    pub name: Option<String>,
+    pub sso_provider: String,
+    pub sso_id: String,
+}
+
+pub async fn upsert_sso_user(pool: &PgPool, user: UpsertSsoUser) -> Result<User, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        r#"
+        INSERT INTO users (email, name, sso_provider, sso_id, role)
+        VALUES ($1, $2, $3, $4, 'user')
+        ON CONFLICT (email)
+        DO UPDATE SET
+            name = COALESCE(EXCLUDED.name, users.name),
+            sso_provider = EXCLUDED.sso_provider,
+            sso_id = EXCLUDED.sso_id,
+            last_login = NOW()
+        RETURNING *
+        "#,
+    )
+    .bind(&user.email)
+    .bind(&user.name)
+    .bind(&user.sso_provider)
+    .bind(&user.sso_id)
+    .fetch_one(pool)
+    .await
+}
+
+/// Get user by ID
+pub async fn get_user_by_id(pool: &PgPool, id: Uuid) -> Result<Option<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>("SELECT * FROM users WHERE id = $1")
+        .bind(id)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get user by email
+pub async fn get_user_by_email(pool: &PgPool, email: &str) -> Result<Option<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>("SELECT * FROM users WHERE email = $1")
+        .bind(email)
+        .fetch_optional(pool)
+        .await
+}
+
+/// Get all users
+pub async fn get_all_users(pool: &PgPool) -> Result<Vec<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>("SELECT * FROM users ORDER BY email")
+        .fetch_all(pool)
+        .await
+}
+
+/// Update last login timestamp
+pub async fn update_last_login(pool: &PgPool, id: Uuid) -> Result<(), sqlx::Error> {
+    sqlx::query("UPDATE users SET last_login = NOW() WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Update user role
+pub async fn update_user_role(pool: &PgPool, id: Uuid, role: &str) -> Result<(), sqlx::Error> {
+    sqlx::query("UPDATE users SET role = $1 WHERE id = $2")
+        .bind(role)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Update user password
+pub async fn update_user_password(
+    pool: &PgPool,
+    id: Uuid,
+    password_hash: &str,
+) -> Result<(), sqlx::Error> {
+    sqlx::query("UPDATE users SET password_hash = $1 WHERE id = $2")
+        .bind(password_hash)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Delete a user
+pub async fn delete_user(pool: &PgPool, id: Uuid) -> Result<bool, sqlx::Error> {
+    let result = sqlx::query("DELETE FROM users WHERE id = $1")
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+/// Check if any users exist (for initial setup)
+pub async fn has_users(pool: &PgPool) -> Result<bool, sqlx::Error> {
+    let result: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM users")
+        .fetch_one(pool)
+        .await?;
+    Ok(result.0 > 0)
+}