Admin ui

11 files changed, 722 insertions, 54 deletions

diff --git a/authentication/endpoints.py b/authentication/endpoints.py
index 6877383..3af49fc 100644
--- a/authentication/endpoints.py
+++ b/authentication/endpoints.py
@@ -6,6 +6,7 @@ from uuid import uuid7
 
 from fastapi import FastAPI, Request, Form, Query
 from pydantic import BaseModel, ValidationError, model_validator, EmailStr
+from sqlalchemy import func
 from sqlmodel import select
 from starlette.authentication import requires
 from starlette.middleware.authentication import AuthenticationMiddleware
@@ -106,10 +107,17 @@ class RegisterForm(BaseModel):
         return self
 
 
+def is_first_run() -> bool:
+    with get_session_context() as session:
+        user_count = session.exec(select(func.count(User.id)))
+        return user_count.first() == 0
+
+
 async def base_register(request: Request, form: RegisterForm | None = None, errors: dict[str, str] | None = None):
     return templates.TemplateResponse(request, 'register.html', context={
         'form': form,
         'errors': errors,
+        'is_first_run': is_first_run(),
     })
 
 
@@ -145,7 +153,7 @@ async def post_register(request: Request, email: Annotated[str, Form()] = '', pa
             return RedirectResponse(next, status_code=303)
 
     except ValidationError as exc:
-        errors.update({e['loc'][0]: e['msg'] for e in exc.errors()})
+        errors.update({(e['loc'][0] if e['loc'] else 'verify_password'): e['msg'] for e in exc.errors()})
 
     return await base_register(request, form, errors)
 
diff --git a/authentication/templates/base.html b/authentication/templates/base.html
index 9874313..ae6cb64 100644
--- a/authentication/templates/base.html
+++ b/authentication/templates/base.html
@@ -1,4 +1,20 @@
 {% extends 'global.html' %}
+{% import 'macros.html' as ui %}
 {% block template %}
-    {% block content %}{% endblock %}
+<div class="auth-page">
+    <div class="auth-shell">
+        <div class="auth-hero">
+            <div class="auth-hero__brand">{{ ui.connector_icon(20) }} ttun</div>
+            <div class="auth-hero__diagram">
+                <span class="mono">local:3000</span>
+                <span class="connector">{{ ui.connector_icon(20) }}</span>
+                <span class="mono">your-app.ttun.dev</span>
+            </div>
+            <p class="auth-hero__tagline">Self-hosted tunnel proxy. Expose a local port through a public URL you control.</p>
+        </div>
+        <div class="auth-form">
+            {% block content %}{% endblock %}
+        </div>
+    </div>
+</div>
 {% endblock %}
diff --git a/authentication/templates/login.html b/authentication/templates/login.html
index 2db2512..dcc0efd 100644
--- a/authentication/templates/login.html
+++ b/authentication/templates/login.html
@@ -1,18 +1,13 @@
 {% extends "./base.html" %}
+{% import 'macros.html' as ui %}
 
 {% block content %}
+    <h1>Sign in</h1>
+    <p class="auth-form__intro">Enter your credentials to manage this server.</p>
     <form method="post">
-
-        <input type="text" name="username" {% if form %}value="{{ form.username }}"{% endif %} placeholder="username" />
-        {% if errors and errors.username %}
-            {{ errors.username }}
-        {% endif %}
-
-
-        <input type="password" name="password" />
-        {% if errors and errors.password%}
-            {{ errors.password }}
-        {% endif %}
-        <button type="submit">Login</button>
+        {{ ui.field('username', label='Username', value=form.username if form else '', error=errors.username if errors else '') }}
+        {{ ui.field('password', type='password', label='Password', error=errors.password if errors else '') }}
+        {{ ui.button('Sign in') }}
     </form>
-{%  endblock %}
+    <p class="auth-switch">New here? <a href="/auth/register/">Create an account</a></p>
+{% endblock %}
diff --git a/authentication/templates/register.html b/authentication/templates/register.html
index 576db78..a1959eb 100644
--- a/authentication/templates/register.html
+++ b/authentication/templates/register.html
@@ -1,24 +1,19 @@
 {% extends "./base.html" %}
+{% import 'macros.html' as ui %}
 
 {% block content %}
+    {% if is_first_run %}
+        <h1>Set up your ttun server</h1>
+        <p class="auth-form__intro">This will be the first account, with full access to manage this server.</p>
+    {% else %}
+        <h1>Create your account</h1>
+        <p class="auth-form__intro">This account will be able to sign in and manage this server.</p>
+    {% endif %}
     <form method="post">
-
-        <input type="email" name="email" {% if form %}value="{{ form.email }}"{% endif %} placeholder="email" />
-        {% if errors and errors.email%}
-            {{ errors.email }}
-        {% endif %}
-
-
-        <input type="password" name="password" />
-        {% if errors and errors.password%}
-            {{ errors.password }}
-        {% endif %}
-
-        <input type="password" name="verify_password" />
-        {% if errors and errors.password%}
-            {{ errors.verify_password }}
-        {% endif %}
-
-        <button type="submit">Register</button>
+        {{ ui.field('email', type='email', label='Email', value=form.email if form else '', error=errors.email if errors else '') }}
+        {{ ui.field('password', type='password', label='Password', error=errors.password if errors else '') }}
+        {{ ui.field('verify_password', type='password', label='Confirm password', error=errors.verify_password if errors else '') }}
+        {{ ui.button('Create account') }}
     </form>
-{%  endblock %}
+    <p class="auth-switch">Already have an account? <a href="/auth/login/">Sign in</a></p>
+{% endblock %}
diff --git a/management/endpoints.py b/management/endpoints.py
index 47602d6..ef44114 100644
--- a/management/endpoints.py
+++ b/management/endpoints.py
@@ -1,7 +1,9 @@
+from functools import wraps
+from urllib.parse import urlencode
+
 from fastapi import FastAPI, Request
 from sqlalchemy import func
 from sqlmodel import select
-from starlette.authentication import requires
 from starlette.middleware.authentication import AuthenticationMiddleware
 from starlette.middleware.sessions import SessionMiddleware
 from starlette.responses import RedirectResponse
@@ -21,6 +23,20 @@ templates = Jinja2Templates(directory=[
     'management/templates'
 ])
 
+
+def requires_session(func):
+    """Redirects to an absolute login URL instead of Starlette's `requires(redirect=...)`,
+    which resolves the redirect target via `request.url_for()` against whichever router is
+    bound into `request.scope` -- a lookup that only reaches `authentication`'s routes when
+    `management` happens to be mounted under a shared root app."""
+    @wraps(func)
+    async def wrapper(request: Request, *args, **kwargs):
+        if not {'authenticated', 'session'}.issubset(request.auth.scopes):
+            next_param = urlencode({'next': str(request.url)})
+            return RedirectResponse(f'/auth/login/?{next_param}', status_code=303)
+        return await func(request, *args, **kwargs)
+    return wrapper
+
 @management.get('/')
 async def index(request: Request):
     with get_session_context() as session:
@@ -34,12 +50,12 @@ async def index(request: Request):
 
 
 @management.get('/dashboard/')
-@requires(['authenticated', 'session'], redirect='get_login')
+@requires_session
 async def dashboard(request: Request):
     return templates.TemplateResponse(request, 'dashboard.html')
 
 @management.get('/users/')
-@requires(['authenticated', 'session'], redirect='get_login')
+@requires_session
 async def users(request: Request):
     with get_session_context() as session:
         query = select(User)
diff --git a/management/templates/base.html b/management/templates/base.html
index 0b9da11..7ba0adb 100644
--- a/management/templates/base.html
+++ b/management/templates/base.html
@@ -1,7 +1,18 @@
 {% extends 'global.html' %}
+{% import 'macros.html' as ui %}
 {% block template %}
-    <nav>
-        <a href="/auth/logout/">Logout</a>
+    <nav class="nav">
+        <div class="nav__brand">{{ ui.connector_icon(18) }} ttun</div>
+        <div class="nav__links">
+            <a class="nav__link{% if request.url.path == '/management/dashboard/' %} nav__link--active{% endif %}" href="/management/dashboard/">Dashboard</a>
+            <a class="nav__link{% if request.url.path == '/management/users/' %} nav__link--active{% endif %}" href="/management/users/">Users</a>
+        </div>
+        <div class="nav__actions">
+            {{ ui.status_badge('Session active', 'good') }}
+            <a class="nav__link" href="/auth/logout/">Sign out</a>
+        </div>
     </nav>
-    {% block content %}{% endblock %}
+    <div class="content">
+        {% block content %}{% endblock %}
+    </div>
 {% endblock %}
diff --git a/management/templates/dashboard.html b/management/templates/dashboard.html
index 201aa48..4babba9 100644
--- a/management/templates/dashboard.html
+++ b/management/templates/dashboard.html
@@ -1,9 +1,13 @@
 {% extends 'base.html' %}
-
 {% block content %}
-<div>
-    <ul>
-        <li><a href="/management/users/">Users</a></li>
-    </ul>
-</div>
+    <div class="content__header">
+        <span class="eyebrow">Dashboard</span>
+        <h1>Manage this server</h1>
+    </div>
+    <div class="module-grid">
+        <a class="module-card" href="/management/users/">
+            <div class="module-card__title">Users</div>
+            <p class="module-card__desc">Manage who can sign in to this server.</p>
+        </a>
+    </div>
 {% endblock %}
diff --git a/management/templates/users.html b/management/templates/users.html
index 272d2b4..3cf9103 100644
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -1,11 +1,27 @@
 {% extends 'base.html' %}
-
 {% block content %}
-<div>
-    <ul>
-        {% for user in users %}
-            <li>{{ user.username }}</li>
-        {% endfor %}
-    </ul>
-</div>
+    <div class="content__header">
+        <span class="eyebrow">{{ users|length }} account{{ 's' if users|length != 1 else '' }}</span>
+        <h1>Users</h1>
+    </div>
+    <div class="table-wrap">
+        <table>
+            <thead>
+                <tr>
+                    <th>Username</th>
+                    <th>Email</th>
+                    <th>Created</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for user in users %}
+                    <tr>
+                        <td>{{ user.username }}</td>
+                        <td>{{ user.email }}</td>
+                        <td class="muted">{{ user.created.strftime('%Y-%m-%d %H:%M') }}</td>
+                    </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </div>
 {% endblock %}
diff --git a/templates/_styles.html b/templates/_styles.html
new file mode 100644
index 0000000..f68b9c0
--- /dev/null
+++ b/templates/_styles.html
@@ -0,0 +1,539 @@
+:root,
+:root[data-theme="dark"] {
+    --bg: #12161c;
+    --surface: #1a2029;
+    --surface-raised: #212836;
+    --border: #2a323d;
+    --text: #e7ebf1;
+    --text-muted: #8891a0;
+    --accent: #f5a623;
+    --accent-strong: #ffbb47;
+    --accent-ink: #1a1305;
+    --status-good: #3ddc84;
+    --status-bad: #e5484d;
+    color-scheme: dark;
+}
+
+:root[data-theme="light"] {
+    --bg: #eef1f6;
+    --surface: #ffffff;
+    --surface-raised: #f7f9fc;
+    --border: #d7dce3;
+    --text: #12161c;
+    --text-muted: #5b6472;
+    --accent: #b9750f;
+    --accent-strong: #8f5c0c;
+    --accent-ink: #fff8ec;
+    --status-good: #1e9a5a;
+    --status-bad: #c53328;
+    color-scheme: light;
+}
+
+*,
+*::before,
+*::after {
+    box-sizing: border-box;
+}
+
+html {
+    -webkit-text-size-adjust: 100%;
+}
+
+body {
+    background: var(--bg);
+    color: var(--text);
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    font-size: 15px;
+    line-height: 1.6;
+    min-height: 100vh;
+}
+
+body,
+.pulse-line,
+.theme-toggle,
+.field__input,
+.btn,
+.module-card {
+    transition: background-color 0.2s ease, border-color 0.2s ease, color 0.2s ease;
+}
+
+.mono {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+}
+
+.eyebrow {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 11px;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--text-muted);
+}
+
+.muted {
+    color: var(--text-muted);
+}
+
+.small {
+    font-size: 13px;
+}
+
+a {
+    color: var(--accent);
+    text-decoration: none;
+}
+
+a:hover {
+    text-decoration: underline;
+}
+
+h1 {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 26px;
+    font-weight: 600;
+    letter-spacing: -0.01em;
+}
+
+h2 {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 18px;
+    font-weight: 600;
+}
+
+/* signature element: one-time handshake pulse on load */
+.pulse-line {
+    position: fixed;
+    top: 0;
+    left: 0;
+    right: 0;
+    height: 2px;
+    z-index: 40;
+    background: linear-gradient(90deg, transparent, var(--accent), transparent);
+    background-size: 200% 100%;
+    animation: pulse-sweep 1.4s ease-out 1;
+}
+
+@keyframes pulse-sweep {
+    from { background-position: 160% 0; }
+    to { background-position: -60% 0; }
+}
+
+/* theme toggle */
+.theme-toggle {
+    position: fixed;
+    top: 16px;
+    right: 16px;
+    z-index: 50;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 36px;
+    height: 36px;
+    border-radius: 8px;
+    border: 1px solid var(--border);
+    background: var(--surface);
+    color: var(--text-muted);
+    cursor: pointer;
+}
+
+.theme-toggle:hover {
+    color: var(--accent);
+    border-color: var(--accent);
+}
+
+.theme-toggle:focus-visible {
+    outline: 2px solid var(--accent);
+    outline-offset: 2px;
+}
+
+.theme-toggle .icon-sun { display: none; }
+.theme-toggle .icon-moon { display: block; }
+:root[data-theme="light"] .theme-toggle .icon-sun { display: block; }
+:root[data-theme="light"] .theme-toggle .icon-moon { display: none; }
+
+/* focus ring, used everywhere */
+a:focus-visible,
+button:focus-visible,
+input:focus-visible {
+    outline: 2px solid var(--accent);
+    outline-offset: 2px;
+}
+
+/* buttons */
+.btn {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 14px;
+    font-weight: 600;
+    padding: 10px 18px;
+    border-radius: 8px;
+    border: 1px solid transparent;
+    cursor: pointer;
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+}
+
+.btn--primary {
+    background: var(--accent);
+    color: var(--accent-ink);
+}
+
+.btn--primary:hover {
+    background: var(--accent-strong);
+}
+
+.btn--full {
+    width: 100%;
+    justify-content: center;
+}
+
+/* form fields */
+.field {
+    margin-bottom: 18px;
+}
+
+.field__label {
+    display: block;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 11px;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--text-muted);
+    margin-bottom: 6px;
+}
+
+.field__input {
+    width: 100%;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 14px;
+    padding: 10px 12px;
+    background: var(--bg);
+    color: var(--text);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+}
+
+.field__input:focus {
+    outline: 2px solid var(--accent);
+    outline-offset: 1px;
+    border-color: var(--accent);
+}
+
+.field__input--error {
+    border-color: var(--status-bad);
+}
+
+.field__error {
+    margin-top: 6px;
+    font-size: 13px;
+    color: var(--status-bad);
+}
+
+/* auth split-panel shell */
+.auth-page {
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 32px 16px;
+}
+
+.auth-shell {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    max-width: 880px;
+    width: 100%;
+    border: 1px solid var(--border);
+    border-radius: 16px;
+    overflow: hidden;
+}
+
+.auth-hero {
+    background: var(--surface-raised);
+    padding: 40px 32px;
+    display: flex;
+    flex-direction: column;
+    justify-content: space-between;
+    gap: 32px;
+    border-right: 1px solid var(--border);
+}
+
+.auth-hero__brand {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    color: var(--accent);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 18px;
+    font-weight: 600;
+}
+
+.auth-hero__diagram {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 13px;
+    color: var(--text);
+}
+
+.auth-hero__diagram .connector {
+    color: var(--accent);
+    flex: 1;
+}
+
+.auth-hero__diagram span.mono {
+    background: var(--surface);
+    border: 1px solid var(--border);
+    padding: 4px 8px;
+    border-radius: 6px;
+    white-space: nowrap;
+}
+
+.auth-hero__tagline {
+    font-size: 14px;
+    color: var(--text-muted);
+    line-height: 1.5;
+}
+
+.auth-form {
+    background: var(--surface);
+    padding: 40px 32px;
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+}
+
+.auth-form h1 {
+    margin-bottom: 4px;
+}
+
+.auth-form__intro {
+    color: var(--text-muted);
+    font-size: 14px;
+    margin-bottom: 24px;
+}
+
+.auth-switch {
+    margin-top: 16px;
+    font-size: 13px;
+    color: var(--text-muted);
+}
+
+/* management top bar */
+.nav {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    padding: 14px 24px;
+    background: var(--surface-raised);
+    border-bottom: 1px solid var(--border);
+    flex-wrap: wrap;
+}
+
+.nav__brand {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    color: var(--accent);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-weight: 600;
+    font-size: 16px;
+}
+
+.nav__links {
+    display: flex;
+    align-items: center;
+    gap: 20px;
+}
+
+.nav__link {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 12px;
+    letter-spacing: 0.05em;
+    text-transform: uppercase;
+    color: var(--text-muted);
+    padding-bottom: 2px;
+    border-bottom: 2px solid transparent;
+}
+
+.nav__link:hover {
+    color: var(--text);
+    text-decoration: none;
+}
+
+.nav__link--active {
+    color: var(--accent);
+    border-bottom-color: var(--accent);
+}
+
+.nav__actions {
+    display: flex;
+    align-items: center;
+    gap: 20px;
+    margin-left: auto;
+}
+
+.nav__status {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+}
+
+.status-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    display: inline-block;
+}
+
+.status-dot--good {
+    background: var(--status-good);
+    box-shadow: 0 0 0 3px color-mix(in srgb, var(--status-good) 25%, transparent);
+}
+
+.status-dot--bad {
+    background: var(--status-bad);
+    box-shadow: 0 0 0 3px color-mix(in srgb, var(--status-bad) 25%, transparent);
+}
+
+/* content area */
+.content {
+    max-width: 960px;
+    margin: 0 auto;
+    padding: 40px 24px;
+}
+
+.content__header {
+    margin-bottom: 28px;
+}
+
+.content__header h1 {
+    margin-top: 4px;
+}
+
+/* dashboard module grid */
+.module-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
+    gap: 16px;
+}
+
+.module-card {
+    display: block;
+    background: var(--surface);
+    border: 1px solid var(--border);
+    border-radius: 12px;
+    padding: 20px;
+}
+
+.module-card:hover {
+    border-color: var(--accent);
+    background: var(--surface-raised);
+    text-decoration: none;
+}
+
+.module-card__title {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 15px;
+    font-weight: 600;
+    color: var(--text);
+    margin-bottom: 6px;
+}
+
+.module-card__desc {
+    font-size: 13px;
+    color: var(--text-muted);
+    line-height: 1.5;
+}
+
+.module-card__meta {
+    margin-top: 12px;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 12px;
+    color: var(--accent);
+}
+
+/* data table */
+.table-wrap {
+    overflow-x: auto;
+    border: 1px solid var(--border);
+    border-radius: 12px;
+}
+
+table {
+    width: 100%;
+    border-collapse: collapse;
+}
+
+thead th {
+    text-align: left;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 11px;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--text-muted);
+    padding: 12px 16px;
+    border-bottom: 1px solid var(--border);
+    background: var(--surface-raised);
+}
+
+tbody td {
+    padding: 12px 16px;
+    border-bottom: 1px solid var(--border);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 13px;
+}
+
+tbody tr:last-child td {
+    border-bottom: none;
+}
+
+tbody tr:hover {
+    background: var(--surface-raised);
+}
+
+@media (max-width: 720px) {
+    .auth-shell {
+        grid-template-columns: 1fr;
+    }
+
+    .auth-hero {
+        border-right: none;
+        border-bottom: 1px solid var(--border);
+        padding: 24px;
+    }
+
+    .auth-hero__diagram {
+        display: none;
+    }
+
+    .auth-form {
+        padding: 24px;
+    }
+
+    .nav {
+        gap: 12px;
+    }
+
+    .nav__actions {
+        margin-left: 0;
+    }
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .pulse-line {
+        animation: none;
+        background: var(--accent);
+        opacity: 0.6;
+    }
+
+    body,
+    .pulse-line,
+    .theme-toggle,
+    .field__input,
+    .btn,
+    .module-card {
+        transition: none;
+    }
+}
diff --git a/templates/global.html b/templates/global.html
index d9bd29d..97212df 100644
--- a/templates/global.html
+++ b/templates/global.html
@@ -1,8 +1,17 @@
+{% import 'macros.html' as ui %}
 <!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>TTUN</title>
+    <script>
+        (function () {
+            var stored = localStorage.getItem('ttun-theme');
+            var theme = stored || (window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
+            document.documentElement.setAttribute('data-theme', theme);
+        })();
+    </script>
     <style>
 /* http://meyerweb.com/eric/tools/css/reset/
    v2.0 | 20110126
@@ -52,9 +61,19 @@ table {
         border-collapse: collapse;
         border-spacing: 0;
 }
+{% include '_styles.html' %}
     </style>
 </head>
 <body>
+    <div class="pulse-line" aria-hidden="true"></div>
+    <button class="theme-toggle" type="button" aria-label="Toggle color theme" onclick="
+        var next = document.documentElement.getAttribute('data-theme') === 'dark' ? 'light' : 'dark';
+        document.documentElement.setAttribute('data-theme', next);
+        localStorage.setItem('ttun-theme', next);
+    ">
+        {{ ui.sun_icon() }}
+        {{ ui.moon_icon() }}
+    </button>
     {% block template %}{% endblock %}
 </body>
 </html>
diff --git a/templates/macros.html b/templates/macros.html
new file mode 100644
index 0000000..7c35f5e
--- /dev/null
+++ b/templates/macros.html
@@ -0,0 +1,49 @@
+{% macro connector_icon(size=16) %}
+<svg width="{{ size }}" height="{{ size }}" viewBox="0 0 24 24" fill="none" aria-hidden="true">
+    <circle cx="4" cy="12" r="3" fill="currentColor" />
+    <line x1="7" y1="12" x2="17" y2="12" stroke="currentColor" stroke-width="2" stroke-dasharray="1 4" stroke-linecap="round" />
+    <circle cx="20" cy="12" r="3" fill="currentColor" />
+</svg>
+{% endmacro %}
+
+{% macro sun_icon(size=16) %}
+<svg class="icon-sun" width="{{ size }}" height="{{ size }}" viewBox="0 0 24 24" fill="none" aria-hidden="true">
+    <circle cx="12" cy="12" r="4" stroke="currentColor" stroke-width="2" />
+    <path d="M12 2v3M12 19v3M4.2 4.2l2.1 2.1M17.7 17.7l2.1 2.1M2 12h3M19 12h3M4.2 19.8l2.1-2.1M17.7 6.3l2.1-2.1" stroke="currentColor" stroke-width="2" stroke-linecap="round" />
+</svg>
+{% endmacro %}
+
+{% macro moon_icon(size=16) %}
+<svg class="icon-moon" width="{{ size }}" height="{{ size }}" viewBox="0 0 24 24" fill="none" aria-hidden="true">
+    <path d="M20 14.5A8.5 8.5 0 1 1 9.5 4a6.5 6.5 0 0 0 10.5 10.5Z" stroke="currentColor" stroke-width="2" stroke-linejoin="round" />
+</svg>
+{% endmacro %}
+
+{% macro field(name, type='text', label='', value='', error='', placeholder='') %}
+<div class="field">
+    <label class="field__label" for="field-{{ name }}">{{ label }}</label>
+    <input
+        class="field__input{% if error %} field__input--error{% endif %}"
+        type="{{ type }}"
+        id="field-{{ name }}"
+        name="{{ name }}"
+        value="{{ value or '' }}"
+        placeholder="{{ placeholder }}"
+        {% if error %}aria-invalid="true" aria-describedby="field-{{ name }}-error"{% endif %}
+    />
+    {% if error %}
+        <p class="field__error" id="field-{{ name }}-error">{{ error }}</p>
+    {% endif %}
+</div>
+{% endmacro %}
+
+{% macro button(text, variant='primary', type='submit') %}
+<button class="btn btn--{{ variant }} btn--full" type="{{ type }}">{{ text }}</button>
+{% endmacro %}
+
+{% macro status_badge(label, variant='good') %}
+<span class="nav__status">
+    <span class="status-dot status-dot--{{ variant }}" aria-hidden="true"></span>
+    <span class="mono small muted">{{ label }}</span>
+</span>
+{% endmacro %}