From 7208d5b2bf8218d78f011b7724f6ab029c228cf8 Mon Sep 17 00:00:00 2001
From: MacRimi <ricoextincion@gmail.com>
Date: Thu, 19 Feb 2026 19:56:20 +0100
Subject: [PATCH] Update notification service

---
 AppImage/components/notification-settings.tsx | 168 ++++++-----
 AppImage/scripts/flask_notification_routes.py | 266 +++++++++++-------
 2 files changed, 262 insertions(+), 172 deletions(-)

diff --git a/AppImage/components/notification-settings.tsx b/AppImage/components/notification-settings.tsx
index 90f8d47d..6e63905e 100644
--- a/AppImage/components/notification-settings.tsx
+++ b/AppImage/components/notification-settings.tsx
@@ -12,7 +12,8 @@ import { fetchApi } from "../lib/api-config"
 import {
   Bell, BellOff, Send, CheckCircle2, XCircle, Loader2,
   AlertTriangle, Info, Settings2, Zap, Eye, EyeOff,
-  Trash2, ChevronDown, ChevronUp, TestTube2, Mail, Webhook
+  Trash2, ChevronDown, ChevronUp, TestTube2, Mail, Webhook,
+  Copy, Server, Shield
 } from "lucide-react"
 
 interface ChannelConfig {
@@ -45,6 +46,9 @@ interface NotificationConfig {
   hostname: string
   webhook_secret: string
   webhook_allowed_ips: string
+  pbs_host: string
+  pve_host: string
+  pbs_trusted_sources: string
 }
 
 interface ServiceStatus {
@@ -109,6 +113,9 @@ const DEFAULT_CONFIG: NotificationConfig = {
   hostname: "",
   webhook_secret: "",
   webhook_allowed_ips: "",
+  pbs_host: "",
+  pve_host: "",
+  pbs_trusted_sources: "",
 }
 
 export function NotificationSettings() {
@@ -198,6 +205,18 @@ export function NotificationSettings() {
   const handleSave = async () => {
     setSaving(true)
     try {
+      // If notifications are being disabled, clean up PVE webhook first
+      const wasEnabled = originalConfig.enabled
+      const isNowDisabled = !config.enabled
+      
+      if (wasEnabled && isNowDisabled) {
+        try {
+          await fetchApi("/api/notifications/proxmox/cleanup-webhook", { method: "POST" })
+        } catch {
+          // Non-fatal: webhook cleanup failed but we still save settings
+        }
+      }
+      
       await fetchApi("/api/notifications/settings", {
         method: "POST",
         body: JSON.stringify(config),
@@ -581,9 +600,8 @@ matcher: proxmenux-pbs
                     <button
                       className={`relative w-9 h-[18px] rounded-full transition-colors ${
                         config.channels.telegram?.enabled ? "bg-blue-600" : "bg-muted-foreground/30"
-                      } ${!editMode ? "opacity-60 cursor-not-allowed" : "cursor-pointer"}`}
-                      onClick={() => editMode && updateChannel("telegram", "enabled", !config.channels.telegram?.enabled)}
-                      disabled={!editMode}
+                      } cursor-pointer`}
+                      onClick={() => updateChannel("telegram", "enabled", !config.channels.telegram?.enabled)}
                       role="switch"
                       aria-checked={config.channels.telegram?.enabled || false}
                     >
@@ -603,7 +621,6 @@ matcher: proxmenux-pbs
                             placeholder="123456:ABC-DEF1234..."
                             value={config.channels.telegram?.bot_token || ""}
                             onChange={e => updateChannel("telegram", "bot_token", e.target.value)}
-                            disabled={!editMode}
                           />
                           <button
                             className="h-7 w-7 flex items-center justify-center rounded-md border border-border hover:bg-muted transition-colors shrink-0"
@@ -620,23 +637,27 @@ matcher: proxmenux-pbs
                           placeholder="-1001234567890"
                           value={config.channels.telegram?.chat_id || ""}
                           onChange={e => updateChannel("telegram", "chat_id", e.target.value)}
-                          disabled={!editMode}
                         />
                       </div>
-                      {!editMode && config.channels.telegram?.bot_token && (
+                      {/* Per-channel action bar */}
+                      <div className="flex items-center gap-2 pt-2 border-t border-border/50">
                         <button
-                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 w-full justify-center"
-                          onClick={() => handleTest("telegram")}
-                          disabled={testing === "telegram"}
+                          className="h-7 px-3 text-xs rounded-md bg-blue-600 hover:bg-blue-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1.5"
+                          onClick={handleSave}
+                          disabled={saving || !hasChanges}
                         >
-                          {testing === "telegram" ? (
-                            <Loader2 className="h-3 w-3 animate-spin" />
-                          ) : (
-                            <TestTube2 className="h-3 w-3" />
-                          )}
-                          Test Telegram
+                          {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <CheckCircle2 className="h-3 w-3" />}
+                          Save
                         </button>
-                      )}
+                        <button
+                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 disabled:opacity-50"
+                          onClick={() => handleTest("telegram")}
+                          disabled={testing === "telegram" || !config.channels.telegram?.bot_token}
+                        >
+                          {testing === "telegram" ? <Loader2 className="h-3 w-3 animate-spin" /> : <TestTube2 className="h-3 w-3" />}
+                          Send Test
+                        </button>
+                      </div>
                     </>
                   )}
                 </TabsContent>
@@ -648,9 +669,8 @@ matcher: proxmenux-pbs
                     <button
                       className={`relative w-9 h-[18px] rounded-full transition-colors ${
                         config.channels.gotify?.enabled ? "bg-green-600" : "bg-muted-foreground/30"
-                      } ${!editMode ? "opacity-60 cursor-not-allowed" : "cursor-pointer"}`}
-                      onClick={() => editMode && updateChannel("gotify", "enabled", !config.channels.gotify?.enabled)}
-                      disabled={!editMode}
+                      } cursor-pointer`}
+                      onClick={() => updateChannel("gotify", "enabled", !config.channels.gotify?.enabled)}
                       role="switch"
                       aria-checked={config.channels.gotify?.enabled || false}
                     >
@@ -668,7 +688,6 @@ matcher: proxmenux-pbs
                           placeholder="https://gotify.example.com"
                           value={config.channels.gotify?.url || ""}
                           onChange={e => updateChannel("gotify", "url", e.target.value)}
-                          disabled={!editMode}
                         />
                       </div>
                       <div className="space-y-1.5">
@@ -680,7 +699,6 @@ matcher: proxmenux-pbs
                             placeholder="A_valid_gotify_token"
                             value={config.channels.gotify?.token || ""}
                             onChange={e => updateChannel("gotify", "token", e.target.value)}
-                            disabled={!editMode}
                           />
                           <button
                             className="h-7 w-7 flex items-center justify-center rounded-md border border-border hover:bg-muted transition-colors shrink-0"
@@ -690,20 +708,25 @@ matcher: proxmenux-pbs
                           </button>
                         </div>
                       </div>
-                      {!editMode && config.channels.gotify?.url && (
+                      {/* Per-channel action bar */}
+                      <div className="flex items-center gap-2 pt-2 border-t border-border/50">
                         <button
-                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 w-full justify-center"
-                          onClick={() => handleTest("gotify")}
-                          disabled={testing === "gotify"}
+                          className="h-7 px-3 text-xs rounded-md bg-green-600 hover:bg-green-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1.5"
+                          onClick={handleSave}
+                          disabled={saving || !hasChanges}
                         >
-                          {testing === "gotify" ? (
-                            <Loader2 className="h-3 w-3 animate-spin" />
-                          ) : (
-                            <TestTube2 className="h-3 w-3" />
-                          )}
-                          Test Gotify
+                          {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <CheckCircle2 className="h-3 w-3" />}
+                          Save
                         </button>
-                      )}
+                        <button
+                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 disabled:opacity-50"
+                          onClick={() => handleTest("gotify")}
+                          disabled={testing === "gotify" || !config.channels.gotify?.url}
+                        >
+                          {testing === "gotify" ? <Loader2 className="h-3 w-3 animate-spin" /> : <TestTube2 className="h-3 w-3" />}
+                          Send Test
+                        </button>
+                      </div>
                     </>
                   )}
                 </TabsContent>
@@ -715,9 +738,8 @@ matcher: proxmenux-pbs
                     <button
                       className={`relative w-9 h-[18px] rounded-full transition-colors ${
                         config.channels.discord?.enabled ? "bg-indigo-600" : "bg-muted-foreground/30"
-                      } ${!editMode ? "opacity-60 cursor-not-allowed" : "cursor-pointer"}`}
-                      onClick={() => editMode && updateChannel("discord", "enabled", !config.channels.discord?.enabled)}
-                      disabled={!editMode}
+                      } cursor-pointer`}
+                      onClick={() => updateChannel("discord", "enabled", !config.channels.discord?.enabled)}
                       role="switch"
                       aria-checked={config.channels.discord?.enabled || false}
                     >
@@ -737,7 +759,6 @@ matcher: proxmenux-pbs
                             placeholder="https://discord.com/api/webhooks/..."
                             value={config.channels.discord?.webhook_url || ""}
                             onChange={e => updateChannel("discord", "webhook_url", e.target.value)}
-                            disabled={!editMode}
                           />
                           <button
                             className="h-7 w-7 flex items-center justify-center rounded-md border border-border hover:bg-muted transition-colors shrink-0"
@@ -747,20 +768,25 @@ matcher: proxmenux-pbs
                           </button>
                         </div>
                       </div>
-                      {!editMode && config.channels.discord?.webhook_url && (
+                      {/* Per-channel action bar */}
+                      <div className="flex items-center gap-2 pt-2 border-t border-border/50">
                         <button
-                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 w-full justify-center"
-                          onClick={() => handleTest("discord")}
-                          disabled={testing === "discord"}
+                          className="h-7 px-3 text-xs rounded-md bg-indigo-600 hover:bg-indigo-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1.5"
+                          onClick={handleSave}
+                          disabled={saving || !hasChanges}
                         >
-                          {testing === "discord" ? (
-                            <Loader2 className="h-3 w-3 animate-spin" />
-                          ) : (
-                            <TestTube2 className="h-3 w-3" />
-                          )}
-                          Test Discord
+                          {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <CheckCircle2 className="h-3 w-3" />}
+                          Save
                         </button>
-                      )}
+                        <button
+                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 disabled:opacity-50"
+                          onClick={() => handleTest("discord")}
+                          disabled={testing === "discord" || !config.channels.discord?.webhook_url}
+                        >
+                          {testing === "discord" ? <Loader2 className="h-3 w-3 animate-spin" /> : <TestTube2 className="h-3 w-3" />}
+                          Send Test
+                        </button>
+                      </div>
                     </>
                   )}
                 </TabsContent>
@@ -772,9 +798,8 @@ matcher: proxmenux-pbs
                     <button
                       className={`relative w-9 h-[18px] rounded-full transition-colors ${
                         config.channels.email?.enabled ? "bg-amber-600" : "bg-muted-foreground/30"
-                      } ${!editMode ? "opacity-60 cursor-not-allowed" : "cursor-pointer"}`}
-                      onClick={() => editMode && updateChannel("email", "enabled", !config.channels.email?.enabled)}
-                      disabled={!editMode}
+                      } cursor-pointer`}
+                      onClick={() => updateChannel("email", "enabled", !config.channels.email?.enabled)}
                       role="switch"
                       aria-checked={config.channels.email?.enabled || false}
                     >
@@ -793,7 +818,6 @@ matcher: proxmenux-pbs
                             placeholder="smtp.gmail.com"
                             value={config.channels.email?.host || ""}
                             onChange={e => updateChannel("email", "host", e.target.value)}
-                            disabled={!editMode}
                           />
                         </div>
                         <div className="space-y-1.5">
@@ -803,7 +827,6 @@ matcher: proxmenux-pbs
                             placeholder="587"
                             value={config.channels.email?.port || ""}
                             onChange={e => updateChannel("email", "port", e.target.value)}
-                            disabled={!editMode}
                           />
                         </div>
                       </div>
@@ -812,9 +835,8 @@ matcher: proxmenux-pbs
                         <Select
                           value={config.channels.email?.tls_mode || "starttls"}
                           onValueChange={v => updateChannel("email", "tls_mode", v)}
-                          disabled={!editMode}
                         >
-                          <SelectTrigger className={`h-7 text-xs ${!editMode ? "opacity-60" : ""}`}>
+                          <SelectTrigger className="h-7 text-xs">
                             <SelectValue />
                           </SelectTrigger>
                           <SelectContent>
@@ -832,7 +854,6 @@ matcher: proxmenux-pbs
                             placeholder="user@example.com"
                             value={config.channels.email?.username || ""}
                             onChange={e => updateChannel("email", "username", e.target.value)}
-                            disabled={!editMode}
                           />
                         </div>
                         <div className="space-y-1.5">
@@ -844,7 +865,6 @@ matcher: proxmenux-pbs
                               placeholder="App password"
                               value={config.channels.email?.password || ""}
                               onChange={e => updateChannel("email", "password", e.target.value)}
-                              disabled={!editMode}
                             />
                             <button
                               className="h-7 w-7 flex items-center justify-center rounded-md border border-border hover:bg-muted transition-colors shrink-0"
@@ -862,7 +882,6 @@ matcher: proxmenux-pbs
                           placeholder="proxmenux@yourdomain.com"
                           value={config.channels.email?.from_address || ""}
                           onChange={e => updateChannel("email", "from_address", e.target.value)}
-                          disabled={!editMode}
                         />
                       </div>
                       <div className="space-y-1.5">
@@ -872,7 +891,6 @@ matcher: proxmenux-pbs
                           placeholder="admin@example.com, ops@example.com"
                           value={config.channels.email?.to_addresses || ""}
                           onChange={e => updateChannel("email", "to_addresses", e.target.value)}
-                          disabled={!editMode}
                         />
                       </div>
                       <div className="space-y-1.5">
@@ -882,7 +900,6 @@ matcher: proxmenux-pbs
                           placeholder="[ProxMenux]"
                           value={config.channels.email?.subject_prefix || "[ProxMenux]"}
                           onChange={e => updateChannel("email", "subject_prefix", e.target.value)}
-                          disabled={!editMode}
                         />
                       </div>
                       <div className="flex items-start gap-2 p-2 rounded-md bg-amber-500/10 border border-amber-500/20">
@@ -892,20 +909,25 @@ matcher: proxmenux-pbs
                           For Gmail, use an App Password instead of your account password.
                         </p>
                       </div>
-                      {!editMode && config.channels.email?.to_addresses && (
+                      {/* Per-channel action bar */}
+                      <div className="flex items-center gap-2 pt-2 border-t border-border/50">
                         <button
-                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 w-full justify-center"
-                          onClick={() => handleTest("email")}
-                          disabled={testing === "email"}
+                          className="h-7 px-3 text-xs rounded-md bg-amber-600 hover:bg-amber-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1.5"
+                          onClick={handleSave}
+                          disabled={saving || !hasChanges}
                         >
-                          {testing === "email" ? (
-                            <Loader2 className="h-3 w-3 animate-spin" />
-                          ) : (
-                            <TestTube2 className="h-3 w-3" />
-                          )}
-                          Test Email
+                          {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <CheckCircle2 className="h-3 w-3" />}
+                          Save
                         </button>
-                      )}
+                        <button
+                          className="h-7 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1.5 disabled:opacity-50"
+                          onClick={() => handleTest("email")}
+                          disabled={testing === "email" || !config.channels.email?.to_addresses}
+                        >
+                          {testing === "email" ? <Loader2 className="h-3 w-3 animate-spin" /> : <TestTube2 className="h-3 w-3" />}
+                          Send Test
+                        </button>
+                      </div>
                     </>
                   )}
                 </TabsContent>
@@ -929,7 +951,7 @@ matcher: proxmenux-pbs
             </div>
 
             {/* ── Severity Filter ── */}
-            <div className="space-y-2">
+            <div className="space-y-2 border-t border-border pt-4">
               <div className="flex items-center gap-2">
                 <AlertTriangle className="h-3.5 w-3.5 text-muted-foreground" />
                 <span className="text-xs font-medium text-muted-foreground uppercase tracking-wider">Severity Filter</span>
@@ -951,7 +973,7 @@ matcher: proxmenux-pbs
             </div>
 
             {/* ── Event Categories ── */}
-            <div className="space-y-2">
+            <div className="space-y-2 border-t border-border pt-4">
               <div className="flex items-center gap-2">
                 <Send className="h-3.5 w-3.5 text-muted-foreground" />
                 <span className="text-xs font-medium text-muted-foreground uppercase tracking-wider">Event Categories</span>
diff --git a/AppImage/scripts/flask_notification_routes.py b/AppImage/scripts/flask_notification_routes.py
index 3021fa60..e0e1b32e 100644
--- a/AppImage/scripts/flask_notification_routes.py
+++ b/AppImage/scripts/flask_notification_routes.py
@@ -157,6 +157,78 @@ def send_notification():
         return jsonify({'error': str(e)}), 500
 
 
+# ── PVE config constants ──
+_PVE_ENDPOINT_ID = 'proxmenux-webhook'
+_PVE_MATCHER_ID = 'proxmenux-default'
+_PVE_WEBHOOK_URL = 'http://127.0.0.1:8008/api/notifications/webhook'
+_PVE_NOTIFICATIONS_CFG = '/etc/pve/notifications.cfg'
+_PVE_PRIV_CFG = '/etc/pve/priv/notifications.cfg'
+_PVE_OUR_HEADERS = {
+    f'webhook: {_PVE_ENDPOINT_ID}',
+    f'matcher: {_PVE_MATCHER_ID}',
+}
+
+
+def _pve_read_file(path):
+    """Read file, return (content, error). Content is '' if missing."""
+    try:
+        with open(path, 'r') as f:
+            return f.read(), None
+    except FileNotFoundError:
+        return '', None
+    except PermissionError:
+        return None, f'Permission denied reading {path}'
+    except Exception as e:
+        return None, str(e)
+
+
+def _pve_backup_file(path):
+    """Create timestamped backup if file exists. Never fails fatally."""
+    import os, shutil
+    from datetime import datetime
+    try:
+        if os.path.exists(path):
+            ts = datetime.now().strftime('%Y%m%d_%H%M%S')
+            backup = f"{path}.proxmenux_backup_{ts}"
+            shutil.copy2(path, backup)
+    except Exception:
+        pass
+
+
+def _pve_remove_our_blocks(text, headers_to_remove):
+    """Remove only blocks whose header line matches one of ours.
+    
+    Preserves ALL other content byte-for-byte.
+    A block = header line + indented continuation lines + trailing blank line.
+    """
+    lines = text.splitlines(keepends=True)
+    cleaned = []
+    skip_block = False
+    
+    for line in lines:
+        stripped = line.strip()
+        
+        if stripped and not line[0:1].isspace() and ':' in stripped:
+            if stripped in headers_to_remove:
+                skip_block = True
+                continue
+            else:
+                skip_block = False
+        
+        if skip_block:
+            if not stripped:
+                skip_block = False
+                continue
+            elif line[0:1].isspace():
+                continue
+            else:
+                skip_block = False
+        
+        cleaned.append(line)
+    
+    return ''.join(cleaned)
+
+
 @notification_bp.route('/api/notifications/proxmox/setup-webhook', methods=['POST'])
 def setup_proxmox_webhook():
     """Automatically configure PVE notifications to call our webhook.
@@ -168,100 +240,31 @@ def setup_proxmox_webhook():
     Idempotent: safe to call multiple times.
     Only touches blocks named 'proxmenux-webhook' / 'proxmenux-default'.
     """
-    import os
-    import shutil
     import secrets as secrets_mod
-    from datetime import datetime
-    
-    ENDPOINT_ID = 'proxmenux-webhook'
-    MATCHER_ID = 'proxmenux-default'
-    WEBHOOK_URL = 'http://127.0.0.1:8008/api/notifications/webhook'
-    NOTIFICATIONS_CFG = '/etc/pve/notifications.cfg'
-    PRIV_CFG = '/etc/pve/priv/notifications.cfg'
     
     result = {
         'configured': False,
-        'endpoint_id': ENDPOINT_ID,
-        'matcher_id': MATCHER_ID,
-        'url': WEBHOOK_URL,
+        'endpoint_id': _PVE_ENDPOINT_ID,
+        'matcher_id': _PVE_MATCHER_ID,
+        'url': _PVE_WEBHOOK_URL,
         'fallback_commands': [],
         'error': None,
     }
     
     def _build_fallback():
-        """Build manual instructions as fallback."""
         return [
             "# Append to END of /etc/pve/notifications.cfg",
             "# (do NOT delete existing content):",
             "",
-            f"webhook: {ENDPOINT_ID}",
+            f"webhook: {_PVE_ENDPOINT_ID}",
             f"\tmethod post",
-            f"\turl {WEBHOOK_URL}",
+            f"\turl {_PVE_WEBHOOK_URL}",
             "",
-            f"matcher: {MATCHER_ID}",
-            f"\ttarget {ENDPOINT_ID}",
+            f"matcher: {_PVE_MATCHER_ID}",
+            f"\ttarget {_PVE_ENDPOINT_ID}",
             "\tmatch-severity warning,error",
         ]
     
-    def _read_file(path):
-        """Read file, return (content, error). Content is '' if missing."""
-        try:
-            with open(path, 'r') as f:
-                return f.read(), None
-        except FileNotFoundError:
-            return '', None
-        except PermissionError:
-            return None, f'Permission denied reading {path}'
-        except Exception as e:
-            return None, str(e)
-    
-    def _backup_file(path):
-        """Create timestamped backup if file exists. Never fails fatally."""
-        try:
-            if os.path.exists(path):
-                ts = datetime.now().strftime('%Y%m%d_%H%M%S')
-                backup = f"{path}.proxmenux_backup_{ts}"
-                shutil.copy2(path, backup)
-        except Exception:
-            pass  # Best-effort backup
-    
-    def _remove_our_blocks(text, headers_to_remove):
-        """Remove only blocks whose header line matches one of ours.
-        
-        Preserves ALL other content byte-for-byte.
-        A block = header line + indented continuation lines + trailing blank line.
-        """
-        lines = text.splitlines(keepends=True)
-        cleaned = []
-        skip_block = False
-        
-        for line in lines:
-            stripped = line.strip()
-            
-            # Non-whitespace line with ':' => block header
-            if stripped and not line[0:1].isspace() and ':' in stripped:
-                if stripped in headers_to_remove:
-                    skip_block = True
-                    continue
-                else:
-                    skip_block = False
-            
-            if skip_block:
-                if not stripped:
-                    # Blank line = block separator, consume it and stop skipping
-                    skip_block = False
-                    continue
-                elif line[0:1].isspace():
-                    # Indented = continuation of our block
-                    continue
-                else:
-                    # New block started
-                    skip_block = False
-            
-            cleaned.append(line)
-        
-        return ''.join(cleaned)
-    
     try:
         # ── Step 1: Ensure webhook secret exists (for our own internal use) ──
         secret = notification_manager.get_webhook_secret()
@@ -270,32 +273,27 @@ def setup_proxmox_webhook():
             notification_manager._save_setting('webhook_secret', secret)
         
         # ── Step 2: Read main config ──
-        cfg_text, err = _read_file(NOTIFICATIONS_CFG)
+        cfg_text, err = _pve_read_file(_PVE_NOTIFICATIONS_CFG)
         if err:
             result['error'] = err
             result['fallback_commands'] = _build_fallback()
             return jsonify(result), 200
         
         # ── Step 3: Read priv config (to clean up any broken blocks we wrote before) ──
-        priv_text, err = _read_file(PRIV_CFG)
+        priv_text, err = _pve_read_file(_PVE_PRIV_CFG)
         if err:
-            priv_text = None  # Non-fatal, we just won't clean it
+            priv_text = None
         
         # ── Step 4: Create backups before ANY modification ──
-        _backup_file(NOTIFICATIONS_CFG)
+        _pve_backup_file(_PVE_NOTIFICATIONS_CFG)
         if priv_text is not None:
-            _backup_file(PRIV_CFG)
+            _pve_backup_file(_PVE_PRIV_CFG)
         
         # ── Step 5: Remove any previous proxmenux blocks from BOTH files ──
-        our_headers = {
-            f'webhook: {ENDPOINT_ID}',
-            f'matcher: {MATCHER_ID}',
-        }
-        
-        cleaned_cfg = _remove_our_blocks(cfg_text, our_headers)
+        cleaned_cfg = _pve_remove_our_blocks(cfg_text, _PVE_OUR_HEADERS)
         
         if priv_text is not None:
-            cleaned_priv = _remove_our_blocks(priv_text, our_headers)
+            cleaned_priv = _pve_remove_our_blocks(priv_text, _PVE_OUR_HEADERS)
         
         # ── Step 6: Build new blocks ──
         # Exact format from a real working PVE server:
@@ -309,19 +307,18 @@ def setup_proxmox_webhook():
         # Neither is needed for localhost calls.
         
         endpoint_block = (
-            f"webhook: {ENDPOINT_ID}\n"
+            f"webhook: {_PVE_ENDPOINT_ID}\n"
             f"\tmethod post\n"
-            f"\turl {WEBHOOK_URL}\n"
+            f"\turl {_PVE_WEBHOOK_URL}\n"
         )
         
         matcher_block = (
-            f"matcher: {MATCHER_ID}\n"
-            f"\ttarget {ENDPOINT_ID}\n"
+            f"matcher: {_PVE_MATCHER_ID}\n"
+            f"\ttarget {_PVE_ENDPOINT_ID}\n"
             f"\tmatch-severity warning,error\n"
         )
         
         # ── Step 7: Append our blocks to cleaned main config ──
-        # Ensure existing content ends cleanly
         if cleaned_cfg and not cleaned_cfg.endswith('\n'):
             cleaned_cfg += '\n'
         if cleaned_cfg and not cleaned_cfg.endswith('\n\n'):
@@ -331,16 +328,15 @@ def setup_proxmox_webhook():
         
         # ── Step 8: Write main config ──
         try:
-            with open(NOTIFICATIONS_CFG, 'w') as f:
+            with open(_PVE_NOTIFICATIONS_CFG, 'w') as f:
                 f.write(new_cfg)
         except PermissionError:
-            result['error'] = f'Permission denied writing {NOTIFICATIONS_CFG}'
+            result['error'] = f'Permission denied writing {_PVE_NOTIFICATIONS_CFG}'
             result['fallback_commands'] = _build_fallback()
             return jsonify(result), 200
         except Exception as e:
-            # Rollback
             try:
-                with open(NOTIFICATIONS_CFG, 'w') as f:
+                with open(_PVE_NOTIFICATIONS_CFG, 'w') as f:
                     f.write(cfg_text)
             except Exception:
                 pass
@@ -351,10 +347,10 @@ def setup_proxmox_webhook():
         # ── Step 9: Clean priv config (remove our broken blocks, write nothing new) ──
         if priv_text is not None and cleaned_priv != priv_text:
             try:
-                with open(PRIV_CFG, 'w') as f:
+                with open(_PVE_PRIV_CFG, 'w') as f:
                     f.write(cleaned_priv)
             except Exception:
-                pass  # Non-fatal, priv cleanup is best-effort
+                pass
         
         result['configured'] = True
         result['secret'] = secret
@@ -366,6 +362,78 @@ def setup_proxmox_webhook():
         return jsonify(result), 200
 
 
+@notification_bp.route('/api/notifications/proxmox/cleanup-webhook', methods=['POST'])
+def cleanup_proxmox_webhook():
+    """Remove ProxMenux webhook blocks from PVE notification config.
+    
+    Called when the notification service is disabled.
+    Only removes blocks named 'proxmenux-webhook' / 'proxmenux-default'.
+    All other blocks are preserved byte-for-byte.
+    Creates backups before modification.
+    """
+    result = {'cleaned': False, 'error': None}
+    
+    try:
+        # Read both files
+        cfg_text, err = _pve_read_file(_PVE_NOTIFICATIONS_CFG)
+        if err:
+            result['error'] = err
+            return jsonify(result), 200
+        
+        priv_text, err = _pve_read_file(_PVE_PRIV_CFG)
+        if err:
+            priv_text = None
+        
+        # Check if our blocks actually exist before doing anything
+        has_our_blocks = any(
+            h in cfg_text for h in [f'webhook: {_PVE_ENDPOINT_ID}', f'matcher: {_PVE_MATCHER_ID}']
+        )
+        has_priv_blocks = priv_text and f'webhook: {_PVE_ENDPOINT_ID}' in priv_text
+        
+        if not has_our_blocks and not has_priv_blocks:
+            result['cleaned'] = True
+            return jsonify(result), 200
+        
+        # Backup before modification
+        _pve_backup_file(_PVE_NOTIFICATIONS_CFG)
+        if priv_text is not None:
+            _pve_backup_file(_PVE_PRIV_CFG)
+        
+        # Remove our blocks
+        if has_our_blocks:
+            cleaned_cfg = _pve_remove_our_blocks(cfg_text, _PVE_OUR_HEADERS)
+            try:
+                with open(_PVE_NOTIFICATIONS_CFG, 'w') as f:
+                    f.write(cleaned_cfg)
+            except PermissionError:
+                result['error'] = f'Permission denied writing {_PVE_NOTIFICATIONS_CFG}'
+                return jsonify(result), 200
+            except Exception as e:
+                # Rollback
+                try:
+                    with open(_PVE_NOTIFICATIONS_CFG, 'w') as f:
+                        f.write(cfg_text)
+                except Exception:
+                    pass
+                result['error'] = str(e)
+                return jsonify(result), 200
+        
+        if has_priv_blocks and priv_text is not None:
+            cleaned_priv = _pve_remove_our_blocks(priv_text, _PVE_OUR_HEADERS)
+            try:
+                with open(_PVE_PRIV_CFG, 'w') as f:
+                    f.write(cleaned_priv)
+            except Exception:
+                pass  # Best-effort
+        
+        result['cleaned'] = True
+        return jsonify(result), 200
+    
+    except Exception as e:
+        result['error'] = str(e)
+        return jsonify(result), 200
+
+
 @notification_bp.route('/api/notifications/proxmox/read-cfg', methods=['GET'])
 def read_pve_notification_cfg():
     """Diagnostic: return raw content of PVE notification config files.