Add a Diagnostic Log, ported and generalized from Sloth Manager

Sloth Manager tracked every API call made to DNS providers for
connectivity troubleshooting. Port that here, generalized to cover
every outbound integration this app makes, not just DNS -- Tailscale,
Proxmox, Synology, Semaphore, Gitea, and Dockhand calls now show up
too, since a broken API token or unreachable host on any of them is
just as worth diagnosing.

New services/diagLog.ts: a generic withDiagLogging(source, adapter)
wraps every async method of any adapter object with timing +
success/failure recording, without touching a single adapter's
request/error-handling internals -- every DNS and integration adapter
interface here is already just a flat set of async methods, so this
one wrapper works for all twelve of them. Applied it at each adapter
factory's own return statement (one line each) rather than at the
route layer, so background jobs that construct adapters directly
(the Tailscale key-expiry scheduler, IPAM sync, agent-driven Proxmox
lookups) get logged too, not just requests through routes/integrations.ts.

New diag_log table (ring-buffered to the last 500 rows, mirroring
Sloth Manager's approach -- this is for live troubleshooting, not a
durable record) and admin-only GET/DELETE /api/diag-log routes, source/
result filters, pagination.

New admin-only Diagnostic Log page: filterable, paginated table with a
Clear button. Also introduces the shared useSortable hook + SortableTh
component used here for the first time -- a follow-up commit applies
the same sorting (and CSV export) to the rest of the app's tables, per
the same request.

Verified end-to-end against a temp SQLite DB with real migrations: a
fake wrapped adapter's successful and failing calls both land correctly
in the log with the right source/operation/latency/error, and the
source/ok filters and clear-log operation all behave correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -17,6 +17,13 @@ All modules from the original plan are built:
 
 - Monorepo scaffold, Tabler-themed app shell/navigation
 - Authentik OIDC login, roles (first user to sign in becomes admin), audit log
+- **Diagnostic Log** (admin-only) — every call this app makes to a DNS
+  provider or integration (Tailscale, Proxmox, Synology, Semaphore, Gitea,
+  Dockhand), success or failure, with latency and the error message if it
+  failed — the last 500 calls, filterable by source/result, for
+  troubleshooting connectivity issues (ported from Sloth Manager's
+  provider-diagnostics log, generalized to cover every integration this app
+  has, not just DNS)
 - **Secrets** — expiry tracking for API tokens/certs/passwords
 - **IP Addresses (IPAM)** — inventory of IPs across vendors/locations,
   with "Sync from Tailscale" and "Sync from Proxmox" actions to pull in

server/drizzle/0003_fantastic_randall.sql

@@ -0,0 +1,9 @@
+CREATE TABLE `diag_log` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`source` text NOT NULL,
+	`operation` text NOT NULL,
+	`ok` integer NOT NULL,
+	`latency_ms` integer NOT NULL,
+	`error` text,
+	`created_at` text DEFAULT (current_timestamp) NOT NULL
+);

server/drizzle/meta/_journal.json

@@ -22,6 +22,13 @@
       "when": 1789506601790,
       "tag": "0002_motionless_lord_hawal",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1789673523898,
+      "tag": "0003_fantastic_randall",
+      "breakpoints": true
     }
   ]
 }

server/src/db/schema.ts

@@ -34,6 +34,20 @@ export const auditLog = sqliteTable("audit_log", {
     .default(sql`(current_timestamp)`),
 });
 
+// ─── Diagnostic log — every outbound call to a DNS provider or integration ──
+
+export const diagLog = sqliteTable("diag_log", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  source: text("source").notNull(), // e.g. 'cloudflare' | 'tailscale' | 'proxmox' | ...
+  operation: text("operation").notNull(), // adapter method name, e.g. 'listZones' | 'listDevices'
+  ok: integer("ok", { mode: "boolean" }).notNull(),
+  latencyMs: integer("latency_ms").notNull(),
+  error: text("error"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`(current_timestamp)`),
+});
+
 // ─── Settings (key/value) ───────────────────────────────────────────────────
 
 export const settings = sqliteTable("settings", {

server/src/dns/adapters/azure.ts

@@ -9,6 +9,7 @@
  * resource group to target for record operations.
  */
 import type { DnsAdapter, DnsRecord, DnsRecordInput, DnsZone } from "../types.js";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 const ARM_BASE = "https://management.azure.com";
 const API_VERSION = "2018-05-01";
@@ -326,5 +327,5 @@ export function createAzureAdapter(config: AzureConfig): DnsAdapter {
     }
   }
 
-  return { listZones, listRecords, addRecord, updateRecord, deleteRecord };
+  return withDiagLogging("azure", { listZones, listRecords, addRecord, updateRecord, deleteRecord });
 }

server/src/dns/adapters/cloudflare.ts

@@ -3,6 +3,7 @@
  * Requires config: apiToken
  */
 import type { DnsAdapter, DnsRecord, DnsRecordInput, DnsZone } from "../types.js";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 const BASE = "https://api.cloudflare.com/client/v4";
 
@@ -94,5 +95,5 @@ export function createCloudflareAdapter(config: CloudflareConfig): DnsAdapter {
     await cfFetch(`/zones/${zoneId}/dns_records/${recordId}`, { method: "DELETE" });
   }
 
-  return { listZones, listRecords, addRecord, updateRecord, deleteRecord };
+  return withDiagLogging("cloudflare", { listZones, listRecords, addRecord, updateRecord, deleteRecord });
 }

server/src/dns/adapters/cpanel.ts

@@ -8,6 +8,7 @@
 import * as https from "node:https";
 import * as http from "node:http";
 import type { DnsAdapter, DnsRecord, DnsRecordInput, DnsZone } from "../types.js";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface CpanelConfig {
   url: string;
@@ -273,5 +274,5 @@ export function createCpanelAdapter(config: CpanelConfig): DnsAdapter {
     await api2("remove_zone_record", { domain, line: String(lineIndex) });
   }
 
-  return { listZones, listRecords, addRecord, updateRecord, deleteRecord };
+  return withDiagLogging("cpanel", { listZones, listRecords, addRecord, updateRecord, deleteRecord });
 }

server/src/dns/adapters/loopia.ts

@@ -6,6 +6,7 @@
  */
 import { parseStringPromise } from "xml2js";
 import type { DnsAdapter, DnsRecord, DnsRecordInput, DnsZone } from "../types.js";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 const ENDPOINT = "https://api.loopia.se/RPCSERV";
 
@@ -179,5 +180,5 @@ export function createLoopiaAdapter(config: LoopiaConfig): DnsAdapter {
     }
   }
 
-  return { listZones, listRecords, addRecord, updateRecord, deleteRecord };
+  return withDiagLogging("loopia", { listZones, listRecords, addRecord, updateRecord, deleteRecord });
 }

server/src/dns/adapters/pihole.ts

@@ -7,6 +7,7 @@
  * treated as a single zone. Record types are limited to A, AAAA, CNAME.
  */
 import type { DnsAdapter, DnsRecord, DnsRecordInput, DnsZone } from "../types.js";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface PiholeConfig {
   url: string;
@@ -138,5 +139,5 @@ export function createPiholeAdapter(config: PiholeConfig): DnsAdapter {
     }
   }
 
-  return { listZones, listRecords, addRecord, updateRecord, deleteRecord };
+  return withDiagLogging("pihole", { listZones, listRecords, addRecord, updateRecord, deleteRecord });
 }

server/src/dns/adapters/technitium.ts

@@ -6,6 +6,7 @@
  * Record ID format: "type||name||content||priority"
  */
 import type { DnsAdapter, DnsRecord, DnsRecordInput, DnsZone } from "../types.js";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface TechnitiumConfig {
   url: string;
@@ -148,5 +149,5 @@ export function createTechnitiumAdapter(config: TechnitiumConfig): DnsAdapter {
     await apiPost("/api/zones/records/delete", { domain: name, zone, type, ...typeParams });
   }
 
-  return { listZones, listRecords, addRecord, updateRecord, deleteRecord };
+  return withDiagLogging("technitium", { listZones, listRecords, addRecord, updateRecord, deleteRecord });
 }

server/src/index.ts

@@ -12,6 +12,7 @@ import { authRouter } from "./auth/router.js";
 import { meRouter } from "./routes/me.js";
 import { usersRouter } from "./routes/users.js";
 import { auditLogRouter } from "./routes/auditLog.js";
+import { diagLogRouter } from "./routes/diagLog.js";
 import { secretsRouter } from "./routes/secrets.js";
 import { ipamRouter } from "./routes/ipam.js";
 import { dnsRouter } from "./routes/dns.js";
@@ -66,6 +67,7 @@ app.use("/auth", authRouter);
 app.use("/api/me", meRouter);
 app.use("/api/users", usersRouter);
 app.use("/api/audit-log", auditLogRouter);
+app.use("/api/diag-log", diagLogRouter);
 app.use("/api/secrets", secretsRouter);
 app.use("/api/ipam", ipamRouter);
 app.use("/api/dns", dnsRouter);

server/src/integrations/dockhand/adapter.ts

@@ -9,6 +9,7 @@
  * API reference verified against Dockhand's published OpenAPI spec
  * (https://github.com/strausmann/mcp-dockhand/blob/main/docs/dockhand-openapi.json).
  */
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface DockhandConfig {
   url: string;
@@ -122,5 +123,5 @@ export function createDockhandAdapter(config: DockhandConfig): DockhandAdapter {
     }
   }
 
-  return { ping, listContainers, startContainer, stopContainer, restartContainer };
+  return withDiagLogging("dockhand", { ping, listContainers, startContainer, stopContainer, restartContainer });
 }

server/src/integrations/gitea/adapter.ts

@@ -5,6 +5,7 @@
  * API docs: https://gitea.labsconnect.se/api/swagger (or any instance's /api/swagger)
  * Verified against Gitea 1.27.
  */
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface GiteaConfig {
   url: string;
@@ -150,5 +151,5 @@ export function createGiteaAdapter(config: GiteaConfig): GiteaAdapter {
     }
   }
 
-  return { ping, listReposWithStatus, rerunFailedJobs };
+  return withDiagLogging("gitea", { ping, listReposWithStatus, rerunFailedJobs });
 }

server/src/integrations/proxmox/adapter.ts

@@ -16,6 +16,7 @@
  * fetch, to support an "insecure" opt-out of certificate verification.
  */
 import * as https from "node:https";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface ProxmoxConfig {
   url: string;
@@ -398,5 +399,14 @@ export function createProxmoxAdapter(config: ProxmoxConfig): ProxmoxAdapter {
     }
   }
 
-  return { ping, listGuests, getGuestDetail, listNodeStats, startGuest, stopGuest, restartGuest, shutdownGuest };
+  return withDiagLogging("proxmox", {
+    ping,
+    listGuests,
+    getGuestDetail,
+    listNodeStats,
+    startGuest,
+    stopGuest,
+    restartGuest,
+    shutdownGuest,
+  });
 }

server/src/integrations/semaphore/adapter.ts

@@ -7,6 +7,7 @@
  * source (db/Task.go, pkg/task_logger/task_logger.go) for the exact task
  * status enum, since the swagger doc itself doesn't enumerate it.
  */
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface SemaphoreConfig {
   url: string;
@@ -140,5 +141,5 @@ export function createSemaphoreAdapter(config: SemaphoreConfig): SemaphoreAdapte
     }
   }
 
-  return { ping, listTemplatesWithStatus, runTemplate };
+  return withDiagLogging("semaphore", { ping, listTemplatesWithStatus, runTemplate });
 }

server/src/integrations/synology/adapter.ts

@@ -23,6 +23,7 @@
  */
 import * as https from "node:https";
 import * as http from "node:http";
+import { withDiagLogging } from "../../services/diagLog.js";
 
 export interface SynologyConfig {
   url: string;
@@ -280,5 +281,5 @@ export function createSynologyAdapter(config: SynologyConfig): SynologyAdapter {
     };
   }
 
-  return { ping, getStorageInfo, getSystemInfo };
+  return withDiagLogging("synology", { ping, getStorageInfo, getSystemInfo });
 }

server/src/integrations/tailscale/adapter.ts

@@ -16,6 +16,7 @@
  * in the same call as the basic fields, so no per-device follow-up is
  * needed.
  */
+import { withDiagLogging } from "../../services/diagLog.js";
 
 const BASE = "https://api.tailscale.com";
 
@@ -129,5 +130,5 @@ export function createTailscaleAdapter(config: TailscaleConfig): TailscaleAdapte
     }
   }
 
-  return { ping, listDevices, setAuthorized, deleteDevice };
+  return withDiagLogging("tailscale", { ping, listDevices, setAuthorized, deleteDevice });
 }

server/src/routes/diagLog.ts

@@ -0,0 +1,26 @@
+import { Router } from "express";
+import { requireAuth, requireRole } from "../auth/middleware.js";
+import { getDiagEntries, clearDiagLog } from "../services/diagLog.js";
+import { recordAudit } from "../services/audit.js";
+import { asyncHandler } from "../utils/asyncHandler.js";
+
+export const diagLogRouter = Router();
+
+diagLogRouter.use(requireAuth, requireRole("admin"));
+
+diagLogRouter.get("/", asyncHandler(async (req, res) => {
+  const { source, ok, limit, offset } = req.query;
+  const result = await getDiagEntries({
+    source: typeof source === "string" && source ? source : undefined,
+    ok: ok === "true" ? true : ok === "false" ? false : undefined,
+    limit: Math.min(Number(limit) || 100, 200),
+    offset: Number(offset) || 0,
+  });
+  res.json(result);
+}));
+
+diagLogRouter.delete("/", asyncHandler(async (req, res) => {
+  await clearDiagLog();
+  await recordAudit({ actor: req.currentUser!, category: "diag_log", action: "clear" });
+  res.status(204).end();
+}));

server/src/services/diagLog.ts

@@ -0,0 +1,87 @@
+import { and, desc, eq, lt, sql } from "drizzle-orm";
+import { db } from "../db/client.js";
+import { diagLog } from "../db/schema.js";
+
+const MAX_ENTRIES = 500;
+
+/** Records one outbound-call result. Never throws — a logging failure must not break the call it's logging. */
+async function recordDiagEntry(entry: { source: string; operation: string; ok: boolean; latencyMs: number; error: string | null }) {
+  try {
+    await db.insert(diagLog).values(entry);
+    // Trim to the most recent MAX_ENTRIES rows (a simple ring buffer, mirroring
+    // Sloth Manager's diagnostic log — this table is for live troubleshooting,
+    // not a durable audit trail, so unbounded growth isn't worth guarding here).
+    const [cutoff] = await db.select({ id: diagLog.id }).from(diagLog).orderBy(desc(diagLog.id)).limit(1).offset(MAX_ENTRIES);
+    if (cutoff) {
+      await db.delete(diagLog).where(lt(diagLog.id, cutoff.id));
+    }
+  } catch (err) {
+    console.error("[diagLog] failed to record entry:", err);
+  }
+}
+
+/**
+ * Wraps every method of an adapter (DNS provider or integration) so each call
+ * is timed and recorded to the diagnostic log, success or failure, without
+ * touching the adapter's own request/error-handling logic. Safe for any
+ * adapter whose interface is entirely async methods (true for every DNS and
+ * integration adapter in this codebase).
+ */
+export function withDiagLogging<T extends object>(source: string, adapter: T): T {
+  const wrapped = {} as T;
+  for (const key of Object.keys(adapter) as (keyof T)[]) {
+    const value = adapter[key];
+    if (typeof value !== "function") {
+      wrapped[key] = value;
+      continue;
+    }
+    const original = value as (...args: unknown[]) => Promise<unknown>;
+    wrapped[key] = (async (...args: unknown[]) => {
+      const start = Date.now();
+      try {
+        const result = await original.apply(adapter, args);
+        recordDiagEntry({ source, operation: String(key), ok: true, latencyMs: Date.now() - start, error: null });
+        return result;
+      } catch (err) {
+        recordDiagEntry({
+          source,
+          operation: String(key),
+          ok: false,
+          latencyMs: Date.now() - start,
+          error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+      }
+    }) as T[keyof T];
+  }
+  return wrapped;
+}
+
+export interface DiagLogQuery {
+  source?: string;
+  ok?: boolean;
+  limit?: number;
+  offset?: number;
+}
+
+export async function getDiagEntries({ source, ok, limit = 100, offset = 0 }: DiagLogQuery) {
+  const conditions = [];
+  if (source) conditions.push(eq(diagLog.source, source));
+  if (ok !== undefined) conditions.push(eq(diagLog.ok, ok));
+  const where = conditions.length > 0 ? and(...conditions) : undefined;
+
+  const [{ total }] = await db.select({ total: sql<number>`count(*)` }).from(diagLog).where(where);
+  const entries = await db
+    .select()
+    .from(diagLog)
+    .where(where)
+    .orderBy(desc(diagLog.id))
+    .limit(Math.min(limit, 200))
+    .offset(offset);
+
+  return { total, entries };
+}
+
+export async function clearDiagLog(): Promise<void> {
+  await db.delete(diagLog);
+}

web/src/App.tsx

@@ -5,6 +5,7 @@ import Login from "./pages/Login";
 import Dashboard from "./pages/Dashboard";
 import Users from "./pages/Users";
 import AuditLog from "./pages/AuditLog";
+import DiagLog from "./pages/DiagLog";
 import Secrets from "./pages/Secrets";
 import Ipam from "./pages/Ipam";
 import Dns from "./pages/Dns";
@@ -100,6 +101,14 @@ export default function App() {
             </RequireRole>
           }
         />
+        <Route
+          path="/diag-log"
+          element={
+            <RequireRole user={user} minRole="admin">
+              <DiagLog />
+            </RequireRole>
+          }
+        />
         <Route
           path="/settings"
           element={

web/src/api/client.ts

@@ -30,6 +30,21 @@ export interface AuditLogEntry {
   createdAt: string;
 }
 
+export interface DiagLogEntry {
+  id: number;
+  source: string;
+  operation: string;
+  ok: boolean;
+  latencyMs: number;
+  error: string | null;
+  createdAt: string;
+}
+
+export interface DiagLogResponse {
+  total: number;
+  entries: DiagLogEntry[];
+}
+
 export type SecretType = "api_token" | "ssl_certificate" | "password" | "generic";
 export type SecretStatus = "ok" | "expiring" | "expired";
 
@@ -515,6 +530,18 @@ export const api = {
   auditLog: {
     list: (limit = 200) => request<{ entries: AuditLogEntry[] }>(`/api/audit-log?limit=${limit}`),
   },
+  diagLog: {
+    list: (params: { source?: string; ok?: boolean; limit?: number; offset?: number } = {}) => {
+      const qs = new URLSearchParams();
+      if (params.source) qs.set("source", params.source);
+      if (params.ok !== undefined) qs.set("ok", String(params.ok));
+      if (params.limit !== undefined) qs.set("limit", String(params.limit));
+      if (params.offset !== undefined) qs.set("offset", String(params.offset));
+      const query = qs.toString();
+      return request<DiagLogResponse>(`/api/diag-log${query ? `?${query}` : ""}`);
+    },
+    clear: () => request<void>("/api/diag-log", { method: "DELETE" }),
+  },
   secrets: {
     list: () => request<{ secrets: SecretRecord[] }>("/api/secrets"),
     create: (data: SecretInput) =>

web/src/components/SortableTh.tsx

@@ -0,0 +1,33 @@
+import type { ReactNode } from "react";
+import type { SortDirection } from "../hooks/useSortable";
+
+export default function SortableTh<T>({
+  label,
+  sortKeyName,
+  activeKey,
+  direction,
+  onSort,
+  className,
+}: {
+  label: ReactNode;
+  sortKeyName: keyof T;
+  activeKey: keyof T | undefined;
+  direction: SortDirection;
+  onSort: (key: keyof T) => void;
+  className?: string;
+}) {
+  const active = activeKey === sortKeyName;
+  return (
+    <th
+      className={className}
+      role="button"
+      style={{ cursor: "pointer", userSelect: "none", whiteSpace: "nowrap" }}
+      onClick={() => onSort(sortKeyName)}
+    >
+      {label}
+      <span className={active ? "" : "text-secondary"} style={{ marginLeft: 4, opacity: active ? 1 : 0.4 }}>
+        {active ? (direction === "asc" ? "▲" : "▼") : "↕"}
+      </span>
+    </th>
+  );
+}

web/src/hooks/useSortable.ts

@@ -0,0 +1,45 @@
+import { useMemo, useState } from "react";
+
+export type SortDirection = "asc" | "desc";
+
+/**
+ * Generic client-side table sort. Sorts on the raw underlying field (numbers
+ * numerically, booleans false-before-true, everything else via a
+ * locale/numeric-aware string compare), not on however a column happens to
+ * render it — so a formatted "1.2 GB" column still sorts by its raw byte
+ * count, and a "5d 15h 2m" column sorts by its raw timestamp/seconds field.
+ * Nulls/undefined always sort to the end regardless of direction.
+ */
+export function useSortable<T>(items: T[] | null | undefined, initialKey?: keyof T, initialDir: SortDirection = "asc") {
+  const [sortKey, setSortKey] = useState<keyof T | undefined>(initialKey);
+  const [sortDir, setSortDir] = useState<SortDirection>(initialDir);
+
+  function requestSort(key: keyof T) {
+    if (sortKey === key) {
+      setSortDir((d) => (d === "asc" ? "desc" : "asc"));
+    } else {
+      setSortKey(key);
+      setSortDir("asc");
+    }
+  }
+
+  const sorted = useMemo(() => {
+    if (!items || !sortKey) return items ?? null;
+    const copy = [...items];
+    copy.sort((a, b) => {
+      const av = a[sortKey] as unknown;
+      const bv = b[sortKey] as unknown;
+      if (av === bv) return 0;
+      if (av === null || av === undefined) return 1;
+      if (bv === null || bv === undefined) return -1;
+      let cmp: number;
+      if (typeof av === "number" && typeof bv === "number") cmp = av - bv;
+      else if (typeof av === "boolean" && typeof bv === "boolean") cmp = av === bv ? 0 : av ? 1 : -1;
+      else cmp = String(av).localeCompare(String(bv), undefined, { numeric: true, sensitivity: "base" });
+      return sortDir === "asc" ? cmp : -cmp;
+    });
+    return copy;
+  }, [items, sortKey, sortDir]);
+
+  return { sorted, sortKey, sortDir, requestSort };
+}

web/src/layout/AppShell.tsx

@@ -15,6 +15,7 @@ import {
   IconDatabase,
   IconUsers,
   IconHistory,
+  IconStethoscope,
   IconSettings,
   IconMenu2,
 } from "@tabler/icons-react";
@@ -42,6 +43,7 @@ const NAV_ITEMS: NavItem[] = [
   { to: "/integrations", label: "Integrations", icon: <IconPlugConnected size={20} /> },
   { to: "/users", label: "Users", icon: <IconUsers size={20} />, minRole: "admin" },
   { to: "/audit-log", label: "Audit Log", icon: <IconHistory size={20} />, minRole: "operator" },
+  { to: "/diag-log", label: "Diagnostic Log", icon: <IconStethoscope size={20} />, minRole: "admin" },
   { to: "/settings", label: "Settings", icon: <IconSettings size={20} />, minRole: "admin" },
 ];
 

web/src/pages/DiagLog.tsx

@@ -0,0 +1,213 @@
+import { useEffect, useState } from "react";
+import { api, type DiagLogEntry } from "../api/client";
+import { formatDateTime } from "../utils/date";
+import { useSortable } from "../hooks/useSortable";
+import SortableTh from "../components/SortableTh";
+import { downloadCsv } from "../utils/csv";
+
+const SOURCE_LABELS: Record<string, string> = {
+  cloudflare: "Cloudflare",
+  loopia: "Loopia",
+  pihole: "Pi-hole",
+  azure: "Azure DNS",
+  cpanel: "cPanel",
+  technitium: "Technitium",
+  tailscale: "Tailscale",
+  proxmox: "Proxmox",
+  synology: "Synology",
+  semaphore: "Semaphore",
+  gitea: "Gitea",
+  dockhand: "Dockhand",
+};
+
+const PAGE_SIZE = 100;
+
+export default function DiagLog() {
+  const [entries, setEntries] = useState<DiagLogEntry[] | null>(null);
+  const [total, setTotal] = useState(0);
+  const [page, setPage] = useState(0);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [filterSource, setFilterSource] = useState("");
+  const [filterOk, setFilterOk] = useState("");
+  const [clearing, setClearing] = useState(false);
+
+  function load(pg: number) {
+    setLoading(true);
+    setError(null);
+    api.diagLog
+      .list({
+        source: filterSource || undefined,
+        ok: filterOk === "" ? undefined : filterOk === "true",
+        limit: PAGE_SIZE,
+        offset: pg * PAGE_SIZE,
+      })
+      .then((res) => {
+        setEntries(res.entries);
+        setTotal(res.total);
+      })
+      .catch((err) => setError(err instanceof Error ? err.message : String(err)))
+      .finally(() => setLoading(false));
+  }
+
+  useEffect(() => {
+    setPage(0);
+    load(0);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [filterSource, filterOk]);
+
+  function goToPage(pg: number) {
+    setPage(pg);
+    load(pg);
+  }
+
+  async function handleClear() {
+    if (!confirm("Clear the entire diagnostic log? This cannot be undone.")) return;
+    setClearing(true);
+    try {
+      await api.diagLog.clear();
+      setEntries([]);
+      setTotal(0);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setClearing(false);
+    }
+  }
+
+  const { sorted, sortKey, sortDir, requestSort } = useSortable(entries, "createdAt", "desc");
+  const totalPages = Math.ceil(total / PAGE_SIZE);
+  const errorCount = entries?.filter((e) => !e.ok).length ?? 0;
+
+  function exportCsv() {
+    if (!sorted) return;
+    downloadCsv(
+      "diagnostic-log.csv",
+      ["Time", "Source", "Operation", "OK", "Latency (ms)", "Error"],
+      sorted.map((e) => [formatDateTime(new Date(e.createdAt)), e.source, e.operation, e.ok ? "yes" : "no", e.latencyMs, e.error ?? ""]),
+    );
+  }
+
+  return (
+    <>
+      <div className="d-flex align-items-center mb-3">
+        <div>
+          <h2 className="page-title mb-0">Diagnostic Log</h2>
+          <div className="text-secondary small mt-1">
+            Every call this app makes to a DNS provider or integration — the last 500 calls are kept. Use this to
+            troubleshoot connectivity issues.
+          </div>
+        </div>
+        <button className="btn btn-outline-danger ms-auto" onClick={handleClear} disabled={clearing || total === 0}>
+          {clearing ? "Clearing…" : "Clear log"}
+        </button>
+      </div>
+      {error && <div className="alert alert-danger">{error}</div>}
+
+      <div className="card mb-3">
+        <div className="card-body">
+          <div className="row g-2 align-items-end">
+            <div className="col-md-3">
+              <label className="form-label">Source</label>
+              <select className="form-select" value={filterSource} onChange={(e) => setFilterSource(e.target.value)}>
+                <option value="">All sources</option>
+                {Object.entries(SOURCE_LABELS).map(([value, label]) => (
+                  <option key={value} value={value}>
+                    {label}
+                  </option>
+                ))}
+              </select>
+            </div>
+            <div className="col-md-3">
+              <label className="form-label">Result</label>
+              <select className="form-select" value={filterOk} onChange={(e) => setFilterOk(e.target.value)}>
+                <option value="">All results</option>
+                <option value="false">Errors only</option>
+                <option value="true">Success only</option>
+              </select>
+            </div>
+            <div className="col-md-6 d-flex justify-content-end gap-2">
+              <button className="btn btn-outline-secondary" onClick={() => load(page)} disabled={loading}>
+                {loading ? "Refreshing…" : "Refresh"}
+              </button>
+              <button className="btn btn-outline-secondary" onClick={exportCsv} disabled={!sorted || sorted.length === 0}>
+                Export CSV
+              </button>
+            </div>
+          </div>
+        </div>
+      </div>
+
+      <div className="card">
+        <div className="card-header">
+          <h3 className="card-title">
+            {total} entries
+            {errorCount > 0 && <span className="text-red fw-normal ms-2">{errorCount} errors on this page</span>}
+          </h3>
+        </div>
+        <div className="table-responsive">
+          <table className="table table-vcenter card-table">
+            <thead>
+              <tr>
+                <SortableTh<DiagLogEntry> label="Time" sortKeyName="createdAt" activeKey={sortKey} direction={sortDir} onSort={requestSort} />
+                <SortableTh<DiagLogEntry> label="Source" sortKeyName="source" activeKey={sortKey} direction={sortDir} onSort={requestSort} />
+                <SortableTh<DiagLogEntry> label="Operation" sortKeyName="operation" activeKey={sortKey} direction={sortDir} onSort={requestSort} />
+                <SortableTh<DiagLogEntry> label="Result" sortKeyName="ok" activeKey={sortKey} direction={sortDir} onSort={requestSort} />
+                <SortableTh<DiagLogEntry>
+                  label="Latency"
+                  sortKeyName="latencyMs"
+                  activeKey={sortKey}
+                  direction={sortDir}
+                  onSort={requestSort}
+                />
+                <th>Error</th>
+              </tr>
+            </thead>
+            <tbody>
+              {sorted?.map((e) => (
+                <tr key={e.id}>
+                  <td className="text-secondary" style={{ whiteSpace: "nowrap" }}>
+                    {formatDateTime(new Date(e.createdAt))}
+                  </td>
+                  <td>{SOURCE_LABELS[e.source] ?? e.source}</td>
+                  <td className="text-secondary">{e.operation}</td>
+                  <td>
+                    {e.ok ? (
+                      <span className="badge bg-green-lt text-green">OK</span>
+                    ) : (
+                      <span className="badge bg-red-lt text-red">Error</span>
+                    )}
+                  </td>
+                  <td className={`text-secondary ${e.latencyMs > 2000 ? "text-yellow" : ""}`}>{e.latencyMs}ms</td>
+                  <td className="text-red small" title={e.error ?? ""} style={{ maxWidth: 320, overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }}>
+                    {e.error ?? ""}
+                  </td>
+                </tr>
+              ))}
+              {sorted?.length === 0 && (
+                <tr>
+                  <td colSpan={6} className="text-secondary text-center">
+                    No diagnostic entries{filterSource || filterOk ? " match these filters" : " yet"}.
+                  </td>
+                </tr>
+              )}
+            </tbody>
+          </table>
+        </div>
+        {totalPages > 1 && (
+          <div className="card-footer d-flex align-items-center justify-content-between">
+            <button className="btn btn-outline-secondary" onClick={() => goToPage(page - 1)} disabled={page === 0}>
+              ← Prev
+            </button>
+            <span className="text-secondary">
+              Page {page + 1} of {totalPages}
+            </span>
+            <button className="btn btn-outline-secondary" onClick={() => goToPage(page + 1)} disabled={page >= totalPages - 1}>
+              Next →
+            </button>
+          </div>
+        )}
+      </div>
+    </>
+  );
+}