docs: add bilingual onboarding (EN/RU)

fix: clippy let_and_return warning
style: fix formatting
2026-04-12 19:40:31 +00:00 · 2026-01-30 16:19:48 +00:00 · 2026-01-30 16:15:21 +00:00 · 2026-01-30 16:06:40 +00:00 · 2026-01-30 15:52:29 +00:00 · 2026-01-30 10:02:58 +00:00
29 changed files with 3100 additions and 367 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,36 @@ All notable changes to NORA will be documented in this file.

 ---

+## [0.3.0] - 2026-01-30
+
+### Added
+
+#### Configurable Rate Limiting
+- Rate limits now configurable via `config.toml` and environment variables
+- New config section `[rate_limit]` with 6 parameters:
+  - `auth_rps` / `auth_burst` - Authentication endpoints (brute-force protection)
+  - `upload_rps` / `upload_burst` - Upload endpoints (Docker push, etc.)
+  - `general_rps` / `general_burst` - General API endpoints
+- Environment variables: `NORA_RATE_LIMIT_{AUTH|UPLOAD|GENERAL}_{RPS|BURST}`
+- Rate limit configuration logged at startup
+
+#### Secrets Provider Architecture
+- Trait-based secrets management (`SecretsProvider` trait)
+- ENV provider as default (12-Factor App pattern)
+- Protected secrets with `zeroize` (memory zeroed on drop)
+- Redacted Debug impl prevents secret leakage in logs
+- New config section `[secrets]` with `provider` and `clear_env` options
+- Foundation for future AWS Secrets Manager, Vault, K8s integration
+
+### Changed
+- Rate limiting functions now accept `&RateLimitConfig` parameter
+- Improved error messages with `.expect()` instead of `.unwrap()`
+
+### Fixed
+- Rate limiting was hardcoded in v0.2.0, now user-configurable
+
+---
+
 ## [0.2.0] - 2026-01-25

 ### Added
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1185,7 +1185,7 @@ checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"

 [[package]]
 name = "nora-cli"
-version = "0.2.7"
+version = "0.2.12"
 dependencies = [
 "clap",
 "flate2",
@@ -1199,7 +1199,7 @@ dependencies = [

 [[package]]
 name = "nora-registry"
-version = "0.2.7"
+version = "0.2.12"
 dependencies = [
 "async-trait",
 "axum",
@@ -1230,11 +1230,12 @@ dependencies = [
 "utoipa-swagger-ui",
 "uuid",
 "wiremock",
+ "zeroize",
 ]

 [[package]]
 name = "nora-storage"
-version = "0.2.7"
+version = "0.2.12"
 dependencies = [
 "axum",
 "base64",
@@ -2955,6 +2956,20 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]

 [[package]]
 name = "zerotrie"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,7 +7,7 @@ members = [
 ]

 [workspace.package]
-version = "0.2.9"
+version = "0.2.12"
 edition = "2021"
 license = "MIT"
 authors = ["DevITWay <devitway@gmail.com>"]
--- a/README.md
+++ b/README.md
@@ -105,6 +105,14 @@ nora migrate --from local --to s3
 | `NORA_STORAGE_S3_URL` | - | S3 endpoint URL |
 | `NORA_STORAGE_BUCKET` | registry | S3 bucket name |
 | `NORA_AUTH_ENABLED` | false | Enable authentication |
+| `NORA_RATE_LIMIT_AUTH_RPS` | 1 | Auth requests per second |
+| `NORA_RATE_LIMIT_AUTH_BURST` | 5 | Auth burst size |
+| `NORA_RATE_LIMIT_UPLOAD_RPS` | 200 | Upload requests per second |
+| `NORA_RATE_LIMIT_UPLOAD_BURST` | 500 | Upload burst size |
+| `NORA_RATE_LIMIT_GENERAL_RPS` | 100 | General requests per second |
+| `NORA_RATE_LIMIT_GENERAL_BURST` | 200 | General burst size |
+| `NORA_SECRETS_PROVIDER` | env | Secrets provider (`env`) |
+| `NORA_SECRETS_CLEAR_ENV` | false | Clear env vars after reading |

 ### config.toml

@@ -120,6 +128,23 @@ path = "data/storage"
 [auth]
 enabled = false
 htpasswd_file = "users.htpasswd"
+
+[rate_limit]
+# Strict limits for authentication (brute-force protection)
+auth_rps = 1
+auth_burst = 5
+# High limits for CI/CD upload workloads
+upload_rps = 200
+upload_burst = 500
+# Balanced limits for general API endpoints
+general_rps = 100
+general_burst = 200
+
+[secrets]
+# Provider: env (default), aws-secrets, vault, k8s (coming soon)
+provider = "env"
+# Clear environment variables after reading (security hardening)
+clear_env = false
 ```

 ## Endpoints
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -1,57 +1,187 @@
 # NORA Demo Deployment

-## DNS Setup
+[English](#english) | [Русский](#russian)

-Add A record:
-```
-demo.getnora.io → <VPS_IP>
-```
+---

-## Deploy
+<a name="english"></a>
+## English
+
+### Quick Start
+
+```bash
+# Run NORA with Docker
+docker run -d \
+  --name nora \
+  -p 4000:4000 \
+  -v nora-data:/data \
+  ghcr.io/getnora-io/nora:latest
+
+# Check health
+curl http://localhost:4000/health
+```
+
+### Push Docker Images
+
+```bash
+# Tag your image
+docker tag myapp:v1 localhost:4000/myapp:v1
+
+# Push to NORA
+docker push localhost:4000/myapp:v1
+
+# Pull from NORA
+docker pull localhost:4000/myapp:v1
+```
+
+### Use as Maven Repository
+
+```xml
+<!-- pom.xml -->
+<repositories>
+  <repository>
+    <id>nora</id>
+    <url>http://localhost:4000/maven2/</url>
+  </repository>
+</repositories>
+```
+
+### Use as npm Registry
+
+```bash
+npm config set registry http://localhost:4000/npm/
+npm install lodash
+```
+
+### Use as PyPI Index
+
+```bash
+pip install --index-url http://localhost:4000/simple/ requests
+```
+
+### Production Deployment with HTTPS

 ```bash
-# Clone repo
 git clone https://github.com/getnora-io/nora.git
 cd nora/deploy
-
-# Start
 docker compose up -d
-
-# Check logs
-docker compose logs -f
 ```

-## URLs
+### URLs

- **Web UI:** https://demo.getnora.io/ui/
- **API Docs:** https://demo.getnora.io/api-docs
- **Health:** https://demo.getnora.io/health
+| URL | Description |
+|-----|-------------|
+| `/ui/` | Web UI |
+| `/api-docs` | Swagger API Docs |
+| `/health` | Health Check |
+| `/metrics` | Prometheus Metrics |

-## Docker Usage
+### Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `NORA_HOST` | 127.0.0.1 | Bind address |
+| `NORA_PORT` | 4000 | Port |
+| `NORA_STORAGE_PATH` | data/storage | Storage path |
+| `NORA_AUTH_ENABLED` | false | Enable auth |
+
+---
+
+<a name="russian"></a>
+## Русский
+
+### Быстрый старт

 ```bash
-# Tag and push
-docker tag myimage:latest demo.getnora.io/myimage:latest
-docker push demo.getnora.io/myimage:latest
+# Запуск NORA в Docker
+docker run -d \
+  --name nora \
+  -p 4000:4000 \
+  -v nora-data:/data \
+  ghcr.io/getnora-io/nora:latest

-# Pull
-docker pull demo.getnora.io/myimage:latest
+# Проверка работоспособности
+curl http://localhost:4000/health
 ```

-## Management
+### Загрузка Docker образов

 ```bash
-# Stop
+# Тегируем образ
+docker tag myapp:v1 localhost:4000/myapp:v1
+
+# Пушим в NORA
+docker push localhost:4000/myapp:v1
+
+# Скачиваем из NORA
+docker pull localhost:4000/myapp:v1
+```
+
+### Использование как Maven репозиторий
+
+```xml
+<!-- pom.xml -->
+<repositories>
+  <repository>
+    <id>nora</id>
+    <url>http://localhost:4000/maven2/</url>
+  </repository>
+</repositories>
+```
+
+### Использование как npm реестр
+
+```bash
+npm config set registry http://localhost:4000/npm/
+npm install lodash
+```
+
+### Использование как PyPI индекс
+
+```bash
+pip install --index-url http://localhost:4000/simple/ requests
+```
+
+### Продакшен с HTTPS
+
+```bash
+git clone https://github.com/getnora-io/nora.git
+cd nora/deploy
+docker compose up -d
+```
+
+### Эндпоинты
+
+| URL | Описание |
+|-----|----------|
+| `/ui/` | Веб-интерфейс |
+| `/api-docs` | Swagger документация |
+| `/health` | Проверка здоровья |
+| `/metrics` | Метрики Prometheus |
+
+### Переменные окружения
+
+| Переменная | По умолчанию | Описание |
+|------------|--------------|----------|
+| `NORA_HOST` | 127.0.0.1 | Адрес привязки |
+| `NORA_PORT` | 4000 | Порт |
+| `NORA_STORAGE_PATH` | data/storage | Путь хранилища |
+| `NORA_AUTH_ENABLED` | false | Включить авторизацию |
+
+---
+
+### Management / Управление
+
+```bash
+# Stop / Остановить
 docker compose down

-# Restart
+# Restart / Перезапустить
 docker compose restart

-# View logs
+# Logs / Логи
 docker compose logs -f nora
-docker compose logs -f caddy

-# Update
-docker compose pull
-docker compose up -d
+# Update / Обновить
+docker compose pull && docker compose up -d
 ```
--- a/deploy/demo-traffic.sh
+++ b/deploy/demo-traffic.sh
@@ -0,0 +1,83 @@
+#!/bin/bash
+# Demo traffic simulator for NORA registry
+# Generates random registry activity for dashboard demo
+
+REGISTRY="http://localhost:4000"
+LOG_FILE="/var/log/nora-demo-traffic.log"
+
+# Sample packages to fetch
+NPM_PACKAGES=("lodash" "express" "react" "axios" "moment" "underscore" "chalk" "debug")
+MAVEN_ARTIFACTS=(
+    "org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.pom"
+    "com/google/guava/guava/31.1-jre/guava-31.1-jre.pom"
+    "org/slf4j/slf4j-api/2.0.0/slf4j-api-2.0.0.pom"
+)
+DOCKER_IMAGES=("alpine" "busybox" "hello-world")
+
+log() {
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_FILE"
+}
+
+# Random sleep between min and max seconds
+random_sleep() {
+    local min=$1
+    local max=$2
+    local delay=$((RANDOM % (max - min + 1) + min))
+    sleep $delay
+}
+
+# Fetch random npm package
+fetch_npm() {
+    local pkg=${NPM_PACKAGES[$RANDOM % ${#NPM_PACKAGES[@]}]}
+    log "NPM: fetching $pkg"
+    curl -s "$REGISTRY/npm/$pkg" > /dev/null 2>&1
+}
+
+# Fetch random maven artifact
+fetch_maven() {
+    local artifact=${MAVEN_ARTIFACTS[$RANDOM % ${#MAVEN_ARTIFACTS[@]}]}
+    log "MAVEN: fetching $artifact"
+    curl -s "$REGISTRY/maven2/$artifact" > /dev/null 2>&1
+}
+
+# Docker push/pull cycle
+docker_cycle() {
+    local img=${DOCKER_IMAGES[$RANDOM % ${#DOCKER_IMAGES[@]}]}
+    local tag="demo-$(date +%s)"
+
+    log "DOCKER: push/pull cycle for $img"
+
+    # Tag and push
+    docker tag "$img:latest" "localhost:4000/demo/$img:$tag" 2>/dev/null
+    docker push "localhost:4000/demo/$img:$tag" > /dev/null 2>&1
+
+    # Pull back
+    docker rmi "localhost:4000/demo/$img:$tag" > /dev/null 2>&1
+    docker pull "localhost:4000/demo/$img:$tag" > /dev/null 2>&1
+
+    # Cleanup
+    docker rmi "localhost:4000/demo/$img:$tag" > /dev/null 2>&1
+}
+
+# Main loop
+log "Starting demo traffic simulator"
+
+while true; do
+    # Random operation
+    op=$((RANDOM % 10))
+
+    case $op in
+        0|1|2|3)  # 40% npm
+            fetch_npm
+            ;;
+        4|5|6)    # 30% maven
+            fetch_maven
+            ;;
+        7|8|9)    # 30% docker
+            docker_cycle
+            ;;
+    esac
+
+    # Random delay: 30-120 seconds
+    random_sleep 30 120
+done
--- a/deploy/nora-demo-traffic.service
+++ b/deploy/nora-demo-traffic.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=NORA Demo Traffic Simulator
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+ExecStart=/opt/nora/demo-traffic.sh
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
--- a/nora-registry/Cargo.toml
+++ b/nora-registry/Cargo.toml
@@ -42,6 +42,7 @@ thiserror = "2"
 tower_governor = "0.8"
 governor = "0.10"
 parking_lot = "0.12"
+zeroize = { version = "1.8", features = ["derive"] }

 [dev-dependencies]
 tempfile = "3"
--- a/nora-registry/src/config.rs
+++ b/nora-registry/src/config.rs
@@ -2,6 +2,8 @@ use serde::{Deserialize, Serialize};
 use std::env;
 use std::fs;

+pub use crate::secrets::SecretsConfig;
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Config {
    pub server: ServerConfig,
@@ -11,13 +13,26 @@ pub struct Config {
    #[serde(default)]
    pub npm: NpmConfig,
    #[serde(default)]
+    pub pypi: PypiConfig,
+    #[serde(default)]
+    pub docker: DockerConfig,
+    #[serde(default)]
+    pub raw: RawConfig,
+    #[serde(default)]
    pub auth: AuthConfig,
+    #[serde(default)]
+    pub rate_limit: RateLimitConfig,
+    #[serde(default)]
+    pub secrets: SecretsConfig,
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ServerConfig {
    pub host: String,
    pub port: u16,
+    /// Public URL for generating pull commands (e.g., "registry.example.com")
+    #[serde(default)]
+    pub public_url: Option<String>,
 }

 #[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)]
@@ -68,6 +83,52 @@ pub struct NpmConfig {
    pub proxy_timeout: u64,
 }

+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PypiConfig {
+    #[serde(default)]
+    pub proxy: Option<String>,
+    #[serde(default = "default_timeout")]
+    pub proxy_timeout: u64,
+}
+
+/// Docker registry configuration with upstream proxy support
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DockerConfig {
+    #[serde(default = "default_docker_timeout")]
+    pub proxy_timeout: u64,
+    #[serde(default)]
+    pub upstreams: Vec<DockerUpstream>,
+}
+
+/// Docker upstream registry configuration
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DockerUpstream {
+    pub url: String,
+    #[serde(default)]
+    pub auth: Option<String>, // "user:pass" for basic auth
+}
+
+/// Raw repository configuration for simple file storage
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RawConfig {
+    #[serde(default = "default_raw_enabled")]
+    pub enabled: bool,
+    #[serde(default = "default_max_file_size")]
+    pub max_file_size: u64, // in bytes
+}
+
+fn default_docker_timeout() -> u64 {
+    60
+}
+
+fn default_raw_enabled() -> bool {
+    true
+}
+
+fn default_max_file_size() -> u64 {
+    104_857_600 // 100MB
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AuthConfig {
    #[serde(default)]
@@ -108,6 +169,36 @@ impl Default for NpmConfig {
    }
 }

+impl Default for PypiConfig {
+    fn default() -> Self {
+        Self {
+            proxy: Some("https://pypi.org/simple/".to_string()),
+            proxy_timeout: 30,
+        }
+    }
+}
+
+impl Default for DockerConfig {
+    fn default() -> Self {
+        Self {
+            proxy_timeout: 60,
+            upstreams: vec![DockerUpstream {
+                url: "https://registry-1.docker.io".to_string(),
+                auth: None,
+            }],
+        }
+    }
+}
+
+impl Default for RawConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            max_file_size: 104_857_600, // 100MB
+        }
+    }
+}
+
 impl Default for AuthConfig {
    fn default() -> Self {
        Self {
@@ -118,6 +209,76 @@ impl Default for AuthConfig {
    }
 }

+/// Rate limiting configuration
+///
+/// Controls request rate limits for different endpoint types.
+///
+/// # Example
+/// ```toml
+/// [rate_limit]
+/// auth_rps = 1
+/// auth_burst = 5
+/// upload_rps = 500
+/// upload_burst = 1000
+/// general_rps = 100
+/// general_burst = 200
+/// ```
+///
+/// # Environment Variables
+/// - `NORA_RATE_LIMIT_AUTH_RPS` - Auth requests per second
+/// - `NORA_RATE_LIMIT_AUTH_BURST` - Auth burst size
+/// - `NORA_RATE_LIMIT_UPLOAD_RPS` - Upload requests per second
+/// - `NORA_RATE_LIMIT_UPLOAD_BURST` - Upload burst size
+/// - `NORA_RATE_LIMIT_GENERAL_RPS` - General requests per second
+/// - `NORA_RATE_LIMIT_GENERAL_BURST` - General burst size
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RateLimitConfig {
+    #[serde(default = "default_auth_rps")]
+    pub auth_rps: u64,
+    #[serde(default = "default_auth_burst")]
+    pub auth_burst: u32,
+    #[serde(default = "default_upload_rps")]
+    pub upload_rps: u64,
+    #[serde(default = "default_upload_burst")]
+    pub upload_burst: u32,
+    #[serde(default = "default_general_rps")]
+    pub general_rps: u64,
+    #[serde(default = "default_general_burst")]
+    pub general_burst: u32,
+}
+
+fn default_auth_rps() -> u64 {
+    1
+}
+fn default_auth_burst() -> u32 {
+    5
+}
+fn default_upload_rps() -> u64 {
+    200
+}
+fn default_upload_burst() -> u32 {
+    500
+}
+fn default_general_rps() -> u64 {
+    100
+}
+fn default_general_burst() -> u32 {
+    200
+}
+
+impl Default for RateLimitConfig {
+    fn default() -> Self {
+        Self {
+            auth_rps: default_auth_rps(),
+            auth_burst: default_auth_burst(),
+            upload_rps: default_upload_rps(),
+            upload_burst: default_upload_burst(),
+            general_rps: default_general_rps(),
+            general_burst: default_general_burst(),
+        }
+    }
+}
+
 impl Config {
    /// Load configuration with priority: ENV > config.toml > defaults
    pub fn load() -> Self {
@@ -144,6 +305,9 @@ impl Config {
                self.server.port = port;
            }
        }
+        if let Ok(val) = env::var("NORA_PUBLIC_URL") {
+            self.server.public_url = if val.is_empty() { None } else { Some(val) };
+        }

        // Storage config
        if let Ok(val) = env::var("NORA_STORAGE_MODE") {
@@ -190,10 +354,91 @@ impl Config {
            }
        }

+        // PyPI config
+        if let Ok(val) = env::var("NORA_PYPI_PROXY") {
+            self.pypi.proxy = if val.is_empty() { None } else { Some(val) };
+        }
+        if let Ok(val) = env::var("NORA_PYPI_PROXY_TIMEOUT") {
+            if let Ok(timeout) = val.parse() {
+                self.pypi.proxy_timeout = timeout;
+            }
+        }
+
+        // Docker config
+        if let Ok(val) = env::var("NORA_DOCKER_PROXY_TIMEOUT") {
+            if let Ok(timeout) = val.parse() {
+                self.docker.proxy_timeout = timeout;
+            }
+        }
+        // NORA_DOCKER_UPSTREAMS format: "url1,url2" or "url1|auth1,url2|auth2"
+        if let Ok(val) = env::var("NORA_DOCKER_UPSTREAMS") {
+            self.docker.upstreams = val
+                .split(',')
+                .filter(|s| !s.is_empty())
+                .map(|s| {
+                    let parts: Vec<&str> = s.trim().splitn(2, '|').collect();
+                    DockerUpstream {
+                        url: parts[0].to_string(),
+                        auth: parts.get(1).map(|a| a.to_string()),
+                    }
+                })
+                .collect();
+        }
+
+        // Raw config
+        if let Ok(val) = env::var("NORA_RAW_ENABLED") {
+            self.raw.enabled = val.to_lowercase() == "true" || val == "1";
+        }
+        if let Ok(val) = env::var("NORA_RAW_MAX_FILE_SIZE") {
+            if let Ok(size) = val.parse() {
+                self.raw.max_file_size = size;
+            }
+        }
+
        // Token storage
        if let Ok(val) = env::var("NORA_AUTH_TOKEN_STORAGE") {
            self.auth.token_storage = val;
        }
+
+        // Rate limit config
+        if let Ok(val) = env::var("NORA_RATE_LIMIT_AUTH_RPS") {
+            if let Ok(v) = val.parse::<u64>() {
+                self.rate_limit.auth_rps = v;
+            }
+        }
+        if let Ok(val) = env::var("NORA_RATE_LIMIT_AUTH_BURST") {
+            if let Ok(v) = val.parse::<u32>() {
+                self.rate_limit.auth_burst = v;
+            }
+        }
+        if let Ok(val) = env::var("NORA_RATE_LIMIT_UPLOAD_RPS") {
+            if let Ok(v) = val.parse::<u64>() {
+                self.rate_limit.upload_rps = v;
+            }
+        }
+        if let Ok(val) = env::var("NORA_RATE_LIMIT_UPLOAD_BURST") {
+            if let Ok(v) = val.parse::<u32>() {
+                self.rate_limit.upload_burst = v;
+            }
+        }
+        if let Ok(val) = env::var("NORA_RATE_LIMIT_GENERAL_RPS") {
+            if let Ok(v) = val.parse::<u64>() {
+                self.rate_limit.general_rps = v;
+            }
+        }
+        if let Ok(val) = env::var("NORA_RATE_LIMIT_GENERAL_BURST") {
+            if let Ok(v) = val.parse::<u32>() {
+                self.rate_limit.general_burst = v;
+            }
+        }
+
+        // Secrets config
+        if let Ok(val) = env::var("NORA_SECRETS_PROVIDER") {
+            self.secrets.provider = val;
+        }
+        if let Ok(val) = env::var("NORA_SECRETS_CLEAR_ENV") {
+            self.secrets.clear_env = val.to_lowercase() == "true" || val == "1";
+        }
    }
 }

@@ -203,6 +448,7 @@ impl Default for Config {
            server: ServerConfig {
                host: String::from("127.0.0.1"),
                port: 4000,
+                public_url: None,
            },
            storage: StorageConfig {
                mode: StorageMode::Local,
@@ -212,7 +458,49 @@ impl Default for Config {
            },
            maven: MavenConfig::default(),
            npm: NpmConfig::default(),
+            pypi: PypiConfig::default(),
+            docker: DockerConfig::default(),
+            raw: RawConfig::default(),
            auth: AuthConfig::default(),
+            rate_limit: RateLimitConfig::default(),
+            secrets: SecretsConfig::default(),
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_rate_limit_default() {
+        let config = RateLimitConfig::default();
+        assert_eq!(config.auth_rps, 1);
+        assert_eq!(config.auth_burst, 5);
+        assert_eq!(config.upload_rps, 200);
+        assert_eq!(config.upload_burst, 500);
+        assert_eq!(config.general_rps, 100);
+        assert_eq!(config.general_burst, 200);
+    }
+
+    #[test]
+    fn test_rate_limit_from_toml() {
+        let toml = r#"
+            [server]
+            host = "127.0.0.1"
+            port = 4000
+
+            [storage]
+            mode = "local"
+
+            [rate_limit]
+            auth_rps = 10
+            upload_burst = 1000
+        "#;
+
+        let config: Config = toml::from_str(toml).unwrap();
+        assert_eq!(config.rate_limit.auth_rps, 10);
+        assert_eq!(config.rate_limit.upload_burst, 1000);
+        assert_eq!(config.rate_limit.auth_burst, 5); // default
+    }
+}
--- a/nora-registry/src/dashboard_metrics.rs
+++ b/nora-registry/src/dashboard_metrics.rs
@@ -18,6 +18,8 @@ pub struct DashboardMetrics {
    pub maven_uploads: AtomicU64,
    pub cargo_downloads: AtomicU64,
    pub pypi_downloads: AtomicU64,
+    pub raw_downloads: AtomicU64,
+    pub raw_uploads: AtomicU64,

    pub start_time: Instant,
 }
@@ -36,6 +38,8 @@ impl DashboardMetrics {
            maven_uploads: AtomicU64::new(0),
            cargo_downloads: AtomicU64::new(0),
            pypi_downloads: AtomicU64::new(0),
+            raw_downloads: AtomicU64::new(0),
+            raw_uploads: AtomicU64::new(0),
            start_time: Instant::now(),
        }
    }
@@ -49,6 +53,7 @@ impl DashboardMetrics {
            "maven" => self.maven_downloads.fetch_add(1, Ordering::Relaxed),
            "cargo" => self.cargo_downloads.fetch_add(1, Ordering::Relaxed),
            "pypi" => self.pypi_downloads.fetch_add(1, Ordering::Relaxed),
+            "raw" => self.raw_downloads.fetch_add(1, Ordering::Relaxed),
            _ => 0,
        };
    }
@@ -59,6 +64,7 @@ impl DashboardMetrics {
        match registry {
            "docker" => self.docker_uploads.fetch_add(1, Ordering::Relaxed),
            "maven" => self.maven_uploads.fetch_add(1, Ordering::Relaxed),
+            "raw" => self.raw_uploads.fetch_add(1, Ordering::Relaxed),
            _ => 0,
        };
    }
@@ -93,6 +99,7 @@ impl DashboardMetrics {
            "maven" => self.maven_downloads.load(Ordering::Relaxed),
            "cargo" => self.cargo_downloads.load(Ordering::Relaxed),
            "pypi" => self.pypi_downloads.load(Ordering::Relaxed),
+            "raw" => self.raw_downloads.load(Ordering::Relaxed),
            _ => 0,
        }
    }
@@ -102,6 +109,7 @@ impl DashboardMetrics {
        match registry {
            "docker" => self.docker_uploads.load(Ordering::Relaxed),
            "maven" => self.maven_uploads.load(Ordering::Relaxed),
+            "raw" => self.raw_uploads.load(Ordering::Relaxed),
            _ => 0,
        }
    }
--- a/nora-registry/src/main.rs
+++ b/nora-registry/src/main.rs
@@ -11,6 +11,7 @@ mod openapi;
 mod rate_limit;
 mod registry;
 mod request_id;
+mod secrets;
 mod storage;
 mod tokens;
 mod ui;
@@ -77,6 +78,7 @@ pub struct AppState {
    pub tokens: Option<TokenStore>,
    pub metrics: DashboardMetrics,
    pub activity: ActivityLog,
+    pub docker_auth: registry::DockerAuth,
 }

 #[tokio::main]
@@ -179,6 +181,36 @@ fn init_logging(json_format: bool) {
 async fn run_server(config: Config, storage: Storage) {
    let start_time = Instant::now();

+    // Log rate limiting configuration
+    info!(
+        auth_rps = config.rate_limit.auth_rps,
+        auth_burst = config.rate_limit.auth_burst,
+        upload_rps = config.rate_limit.upload_rps,
+        upload_burst = config.rate_limit.upload_burst,
+        general_rps = config.rate_limit.general_rps,
+        general_burst = config.rate_limit.general_burst,
+        "Rate limiting configured"
+    );
+
+    // Initialize secrets provider
+    let secrets_provider = match secrets::create_secrets_provider(&config.secrets) {
+        Ok(provider) => {
+            info!(
+                provider = provider.provider_name(),
+                clear_env = config.secrets.clear_env,
+                "Secrets provider initialized"
+            );
+            Some(provider)
+        }
+        Err(e) => {
+            warn!(error = %e, "Failed to initialize secrets provider, using defaults");
+            None
+        }
+    };
+
+    // Store secrets provider for future use (S3 credentials, etc.)
+    let _secrets = secrets_provider;
+
    // Load auth if enabled
    let auth = if config.auth.enabled {
        let path = Path::new(&config.auth.htpasswd_file);
@@ -205,6 +237,14 @@ async fn run_server(config: Config, storage: Storage) {
        None
    };

+    // Create rate limiters before moving config to state
+    let auth_limiter = rate_limit::auth_rate_limiter(&config.rate_limit);
+    let upload_limiter = rate_limit::upload_rate_limiter(&config.rate_limit);
+    let general_limiter = rate_limit::general_rate_limiter(&config.rate_limit);
+
+    // Initialize Docker auth with proxy timeout
+    let docker_auth = registry::DockerAuth::new(config.docker.proxy_timeout);
+
    let state = Arc::new(AppState {
        storage,
        config,
@@ -213,10 +253,11 @@ async fn run_server(config: Config, storage: Storage) {
        tokens,
        metrics: DashboardMetrics::new(),
        activity: ActivityLog::new(50),
+        docker_auth,
    });

    // Token routes with strict rate limiting (brute-force protection)
-    let auth_routes = auth::token_routes().layer(rate_limit::auth_rate_limiter());
+    let auth_routes = auth::token_routes().layer(auth_limiter);

    // Registry routes with upload rate limiting
    let registry_routes = Router::new()
@@ -225,7 +266,8 @@ async fn run_server(config: Config, storage: Storage) {
        .merge(registry::npm_routes())
        .merge(registry::cargo_routes())
        .merge(registry::pypi_routes())
-        .layer(rate_limit::upload_rate_limiter());
+        .merge(registry::raw_routes())
+        .layer(upload_limiter);

    // Routes WITHOUT rate limiting (health, metrics, UI)
    let public_routes = Router::new()
@@ -238,7 +280,7 @@ async fn run_server(config: Config, storage: Storage) {
    let rate_limited_routes = Router::new()
        .merge(auth_routes)
        .merge(registry_routes)
-        .layer(rate_limit::general_rate_limiter());
+        .layer(general_limiter);

    let app = Router::new()
        .merge(public_routes)
@@ -276,6 +318,7 @@ async fn run_server(config: Config, storage: Storage) {
        npm = "/npm/",
        cargo = "/cargo/",
        pypi = "/simple/",
+        raw = "/raw/",
        "Available endpoints"
    );

--- a/nora-registry/src/openapi.rs
+++ b/nora-registry/src/openapi.rs
@@ -15,7 +15,7 @@ use crate::AppState;
 #[openapi(
    info(
        title = "Nora",
-        version = "0.2.9",
+        version = "0.2.10",
        description = "Multi-protocol package registry supporting Docker, Maven, npm, Cargo, and PyPI",
        license(name = "MIT"),
        contact(name = "DevITWay", url = "https://github.com/getnora-io/nora")
--- a/nora-registry/src/rate_limit.rs
+++ b/nora-registry/src/rate_limit.rs
@@ -1,4 +1,3 @@
-#![allow(dead_code)]
 //! Rate limiting configuration and middleware
 //!
 //! Provides rate limiting to protect against:
@@ -6,96 +5,69 @@
 //! - DoS attacks on upload endpoints
 //! - General API abuse

+use crate::config::RateLimitConfig;
 use tower_governor::governor::GovernorConfigBuilder;

-/// Rate limit configuration
-#[derive(Debug, Clone)]
-pub struct RateLimitConfig {
-    /// Requests per second for auth endpoints (strict)
-    pub auth_rps: u32,
-    /// Burst size for auth endpoints
-    pub auth_burst: u32,
-    /// Requests per second for upload endpoints
-    pub upload_rps: u32,
-    /// Burst size for upload endpoints
-    pub upload_burst: u32,
-    /// Requests per second for general endpoints (lenient)
-    pub general_rps: u32,
-    /// Burst size for general endpoints
-    pub general_burst: u32,
-}
-
-impl Default for RateLimitConfig {
-    fn default() -> Self {
-        Self {
-            auth_rps: 1,        // 1 req/sec for auth (strict)
-            auth_burst: 5,      // Allow burst of 5
-            upload_rps: 200,    // 200 req/sec for uploads (Docker needs high parallelism)
-            upload_burst: 500,  // Allow burst of 500
-            general_rps: 100,   // 100 req/sec general
-            general_burst: 200, // Allow burst of 200
-        }
-    }
-}
-
 /// Create rate limiter layer for auth endpoints (strict protection against brute-force)
-///
-/// Default: 1 request per second, burst of 5
-pub fn auth_rate_limiter() -> tower_governor::GovernorLayer<
+pub fn auth_rate_limiter(
+    config: &RateLimitConfig,
+) -> tower_governor::GovernorLayer<
    tower_governor::key_extractor::PeerIpKeyExtractor,
    governor::middleware::StateInformationMiddleware,
    axum::body::Body,
 > {
-    let config = GovernorConfigBuilder::default()
-        .per_second(1)
-        .burst_size(5)
+    let gov_config = GovernorConfigBuilder::default()
+        .per_second(config.auth_rps)
+        .burst_size(config.auth_burst)
        .use_headers()
        .finish()
-        .unwrap();
+        .expect("Failed to build auth rate limiter");

-    tower_governor::GovernorLayer::new(config)
+    tower_governor::GovernorLayer::new(gov_config)
 }

 /// Create rate limiter layer for upload endpoints
 ///
-/// Default: 200 requests per second, burst of 500
 /// High limits to accommodate Docker client's aggressive parallel layer uploads
-pub fn upload_rate_limiter() -> tower_governor::GovernorLayer<
+pub fn upload_rate_limiter(
+    config: &RateLimitConfig,
+) -> tower_governor::GovernorLayer<
    tower_governor::key_extractor::PeerIpKeyExtractor,
    governor::middleware::StateInformationMiddleware,
    axum::body::Body,
 > {
-    let config = GovernorConfigBuilder::default()
-        .per_second(200)
-        .burst_size(500)
+    let gov_config = GovernorConfigBuilder::default()
+        .per_second(config.upload_rps)
+        .burst_size(config.upload_burst)
        .use_headers()
        .finish()
-        .unwrap();
+        .expect("Failed to build upload rate limiter");

-    tower_governor::GovernorLayer::new(config)
+    tower_governor::GovernorLayer::new(gov_config)
 }

 /// Create rate limiter layer for general endpoints (lenient)
-///
-/// Default: 100 requests per second, burst of 200
-pub fn general_rate_limiter() -> tower_governor::GovernorLayer<
+pub fn general_rate_limiter(
+    config: &RateLimitConfig,
+) -> tower_governor::GovernorLayer<
    tower_governor::key_extractor::PeerIpKeyExtractor,
    governor::middleware::StateInformationMiddleware,
    axum::body::Body,
 > {
-    let config = GovernorConfigBuilder::default()
-        .per_second(100)
-        .burst_size(200)
+    let gov_config = GovernorConfigBuilder::default()
+        .per_second(config.general_rps)
+        .burst_size(config.general_burst)
        .use_headers()
        .finish()
-        .unwrap();
+        .expect("Failed to build general rate limiter");

-    tower_governor::GovernorLayer::new(config)
+    tower_governor::GovernorLayer::new(gov_config)
 }

 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::config::RateLimitConfig;

    #[test]
    fn test_default_config() {
@@ -108,16 +80,34 @@ mod tests {

    #[test]
    fn test_auth_rate_limiter_creation() {
-        let _limiter = auth_rate_limiter();
+        let config = RateLimitConfig::default();
+        let _limiter = auth_rate_limiter(&config);
    }

    #[test]
    fn test_upload_rate_limiter_creation() {
-        let _limiter = upload_rate_limiter();
+        let config = RateLimitConfig::default();
+        let _limiter = upload_rate_limiter(&config);
    }

    #[test]
    fn test_general_rate_limiter_creation() {
-        let _limiter = general_rate_limiter();
+        let config = RateLimitConfig::default();
+        let _limiter = general_rate_limiter(&config);
+    }
+
+    #[test]
+    fn test_custom_config() {
+        let config = RateLimitConfig {
+            auth_rps: 10,
+            auth_burst: 20,
+            upload_rps: 500,
+            upload_burst: 1000,
+            general_rps: 200,
+            general_burst: 400,
+        };
+        let _auth = auth_rate_limiter(&config);
+        let _upload = upload_rate_limiter(&config);
+        let _general = general_rate_limiter(&config);
    }
 }
--- a/nora-registry/src/registry/docker.rs
+++ b/nora-registry/src/registry/docker.rs
@@ -1,4 +1,6 @@
 use crate::activity_log::{ActionType, ActivityEntry};
+use crate::registry::docker_auth::DockerAuth;
+use crate::storage::Storage;
 use crate::validation::{validate_digest, validate_docker_name, validate_docker_reference};
 use crate::AppState;
 use axum::{
@@ -10,9 +12,32 @@ use axum::{
    Json, Router,
 };
 use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+/// Metadata for a Docker image stored alongside manifests
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ImageMetadata {
+    pub push_timestamp: u64,
+    pub last_pulled: u64,
+    pub downloads: u64,
+    pub size_bytes: u64,
+    pub os: String,
+    pub arch: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub variant: Option<String>,
+    pub layers: Vec<LayerInfo>,
+}
+
+/// Information about a single layer in a Docker image
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct LayerInfo {
+    pub digest: String,
+    pub size: u64,
+}

 /// In-progress upload sessions for chunked uploads
 /// Maps UUID -> accumulated data
@@ -75,25 +100,63 @@ async fn download_blob(
    }

    let key = format!("docker/{}/blobs/{}", name, digest);
-    match state.storage.get(&key).await {
-        Ok(data) => {
+
+    // Try local storage first
+    if let Ok(data) = state.storage.get(&key).await {
+        state.metrics.record_download("docker");
+        state.metrics.record_cache_hit();
+        state.activity.push(ActivityEntry::new(
+            ActionType::Pull,
+            format!("{}@{}", name, &digest[..19.min(digest.len())]),
+            "docker",
+            "LOCAL",
+        ));
+        return (
+            StatusCode::OK,
+            [(header::CONTENT_TYPE, "application/octet-stream")],
+            data,
+        )
+            .into_response();
+    }
+
+    // Try upstream proxies
+    for upstream in &state.config.docker.upstreams {
+        if let Ok(data) = fetch_blob_from_upstream(
+            &upstream.url,
+            &name,
+            &digest,
+            &state.docker_auth,
+            state.config.docker.proxy_timeout,
+        )
+        .await
+        {
            state.metrics.record_download("docker");
-            state.metrics.record_cache_hit();
+            state.metrics.record_cache_miss();
            state.activity.push(ActivityEntry::new(
-                ActionType::Pull,
+                ActionType::ProxyFetch,
                format!("{}@{}", name, &digest[..19.min(digest.len())]),
                "docker",
-                "LOCAL",
+                "PROXY",
            ));
-            (
+
+            // Cache in storage (fire and forget)
+            let storage = state.storage.clone();
+            let key_clone = key.clone();
+            let data_clone = data.clone();
+            tokio::spawn(async move {
+                let _ = storage.put(&key_clone, &data_clone).await;
+            });
+
+            return (
                StatusCode::OK,
                [(header::CONTENT_TYPE, "application/octet-stream")],
-                data,
+                Bytes::from(data),
            )
-                .into_response()
+                .into_response();
        }
-        Err(_) => StatusCode::NOT_FOUND.into_response(),
    }
+
+    StatusCode::NOT_FOUND.into_response()
 }

 async fn start_upload(Path(name): Path<String>) -> Response {
@@ -213,35 +276,106 @@ async fn get_manifest(
    }

    let key = format!("docker/{}/manifests/{}.json", name, reference);
-    match state.storage.get(&key).await {
-        Ok(data) => {
+
+    // Try local storage first
+    if let Ok(data) = state.storage.get(&key).await {
+        state.metrics.record_download("docker");
+        state.metrics.record_cache_hit();
+        state.activity.push(ActivityEntry::new(
+            ActionType::Pull,
+            format!("{}:{}", name, reference),
+            "docker",
+            "LOCAL",
+        ));
+
+        // Calculate digest for Docker-Content-Digest header
+        use sha2::Digest;
+        let digest = format!("sha256:{:x}", sha2::Sha256::digest(&data));
+
+        // Detect manifest media type from content
+        let content_type = detect_manifest_media_type(&data);
+
+        // Update metadata (downloads, last_pulled) in background
+        let meta_key = format!("docker/{}/manifests/{}.meta.json", name, reference);
+        let storage_clone = state.storage.clone();
+        tokio::spawn(update_metadata_on_pull(storage_clone, meta_key));
+
+        return (
+            StatusCode::OK,
+            [
+                (header::CONTENT_TYPE, content_type),
+                (HeaderName::from_static("docker-content-digest"), digest),
+            ],
+            data,
+        )
+            .into_response();
+    }
+
+    // Try upstream proxies
+    for upstream in &state.config.docker.upstreams {
+        if let Ok((data, content_type)) = fetch_manifest_from_upstream(
+            &upstream.url,
+            &name,
+            &reference,
+            &state.docker_auth,
+            state.config.docker.proxy_timeout,
+        )
+        .await
+        {
            state.metrics.record_download("docker");
-            state.metrics.record_cache_hit();
+            state.metrics.record_cache_miss();
            state.activity.push(ActivityEntry::new(
-                ActionType::Pull,
+                ActionType::ProxyFetch,
                format!("{}:{}", name, reference),
                "docker",
-                "LOCAL",
+                "PROXY",
            ));

            // Calculate digest for Docker-Content-Digest header
            use sha2::Digest;
            let digest = format!("sha256:{:x}", sha2::Sha256::digest(&data));
-            (
+
+            // Cache manifest and create metadata (fire and forget)
+            let storage = state.storage.clone();
+            let key_clone = key.clone();
+            let data_clone = data.clone();
+            let name_clone = name.clone();
+            let reference_clone = reference.clone();
+            let digest_clone = digest.clone();
+            tokio::spawn(async move {
+                // Store manifest by tag and digest
+                let _ = storage.put(&key_clone, &data_clone).await;
+                let digest_key = format!("docker/{}/manifests/{}.json", name_clone, digest_clone);
+                let _ = storage.put(&digest_key, &data_clone).await;
+
+                // Extract and save metadata
+                let metadata = extract_metadata(&data_clone, &storage, &name_clone).await;
+                if let Ok(meta_json) = serde_json::to_vec(&metadata) {
+                    let meta_key = format!(
+                        "docker/{}/manifests/{}.meta.json",
+                        name_clone, reference_clone
+                    );
+                    let _ = storage.put(&meta_key, &meta_json).await;
+
+                    let digest_meta_key =
+                        format!("docker/{}/manifests/{}.meta.json", name_clone, digest_clone);
+                    let _ = storage.put(&digest_meta_key, &meta_json).await;
+                }
+            });
+
+            return (
                StatusCode::OK,
                [
-                    (
-                        header::CONTENT_TYPE,
-                        "application/vnd.docker.distribution.manifest.v2+json".to_string(),
-                    ),
+                    (header::CONTENT_TYPE, content_type),
                    (HeaderName::from_static("docker-content-digest"), digest),
                ],
-                data,
+                Bytes::from(data),
            )
-                .into_response()
+                .into_response();
        }
-        Err(_) => StatusCode::NOT_FOUND.into_response(),
    }
+
+    StatusCode::NOT_FOUND.into_response()
 }

 async fn put_manifest(
@@ -272,6 +406,17 @@ async fn put_manifest(
        return StatusCode::INTERNAL_SERVER_ERROR.into_response();
    }

+    // Extract and save metadata
+    let metadata = extract_metadata(&body, &state.storage, &name).await;
+    let meta_key = format!("docker/{}/manifests/{}.meta.json", name, reference);
+    if let Ok(meta_json) = serde_json::to_vec(&metadata) {
+        let _ = state.storage.put(&meta_key, &meta_json).await;
+
+        // Also save metadata by digest
+        let digest_meta_key = format!("docker/{}/manifests/{}.meta.json", name, digest);
+        let _ = state.storage.put(&digest_meta_key, &meta_json).await;
+    }
+
    state.metrics.record_upload("docker");
    state.activity.push(ActivityEntry::new(
        ActionType::Push,
@@ -308,3 +453,314 @@ async fn list_tags(State(state): State<Arc<AppState>>, Path(name): Path<String>)
        .collect();
    (StatusCode::OK, Json(json!({"name": name, "tags": tags}))).into_response()
 }
+
+/// Fetch a blob from an upstream Docker registry
+async fn fetch_blob_from_upstream(
+    upstream_url: &str,
+    name: &str,
+    digest: &str,
+    docker_auth: &DockerAuth,
+    timeout: u64,
+) -> Result<Vec<u8>, ()> {
+    let url = format!(
+        "{}/v2/{}/blobs/{}",
+        upstream_url.trim_end_matches('/'),
+        name,
+        digest
+    );
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(timeout))
+        .build()
+        .map_err(|_| ())?;
+
+    // First try without auth
+    let response = client.get(&url).send().await.map_err(|_| ())?;
+
+    let response = if response.status() == reqwest::StatusCode::UNAUTHORIZED {
+        // Get Www-Authenticate header and fetch token
+        let www_auth = response
+            .headers()
+            .get("www-authenticate")
+            .and_then(|v| v.to_str().ok())
+            .map(String::from);
+
+        if let Some(token) = docker_auth
+            .get_token(upstream_url, name, www_auth.as_deref())
+            .await
+        {
+            client
+                .get(&url)
+                .header("Authorization", format!("Bearer {}", token))
+                .send()
+                .await
+                .map_err(|_| ())?
+        } else {
+            return Err(());
+        }
+    } else {
+        response
+    };
+
+    if !response.status().is_success() {
+        return Err(());
+    }
+
+    response.bytes().await.map(|b| b.to_vec()).map_err(|_| ())
+}
+
+/// Fetch a manifest from an upstream Docker registry
+/// Returns (manifest_bytes, content_type)
+async fn fetch_manifest_from_upstream(
+    upstream_url: &str,
+    name: &str,
+    reference: &str,
+    docker_auth: &DockerAuth,
+    timeout: u64,
+) -> Result<(Vec<u8>, String), ()> {
+    let url = format!(
+        "{}/v2/{}/manifests/{}",
+        upstream_url.trim_end_matches('/'),
+        name,
+        reference
+    );
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(timeout))
+        .build()
+        .map_err(|_| ())?;
+
+    // Request with Accept header for manifest types
+    let accept_header = "application/vnd.docker.distribution.manifest.v2+json, \
+                         application/vnd.docker.distribution.manifest.list.v2+json, \
+                         application/vnd.oci.image.manifest.v1+json, \
+                         application/vnd.oci.image.index.v1+json";
+
+    // First try without auth
+    let response = client
+        .get(&url)
+        .header("Accept", accept_header)
+        .send()
+        .await
+        .map_err(|_| ())?;
+
+    let response = if response.status() == reqwest::StatusCode::UNAUTHORIZED {
+        // Get Www-Authenticate header and fetch token
+        let www_auth = response
+            .headers()
+            .get("www-authenticate")
+            .and_then(|v| v.to_str().ok())
+            .map(String::from);
+
+        if let Some(token) = docker_auth
+            .get_token(upstream_url, name, www_auth.as_deref())
+            .await
+        {
+            client
+                .get(&url)
+                .header("Accept", accept_header)
+                .header("Authorization", format!("Bearer {}", token))
+                .send()
+                .await
+                .map_err(|_| ())?
+        } else {
+            return Err(());
+        }
+    } else {
+        response
+    };
+
+    if !response.status().is_success() {
+        return Err(());
+    }
+
+    let content_type = response
+        .headers()
+        .get("content-type")
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("application/vnd.docker.distribution.manifest.v2+json")
+        .to_string();
+
+    let bytes = response.bytes().await.map_err(|_| ())?;
+
+    Ok((bytes.to_vec(), content_type))
+}
+
+/// Detect manifest media type from its JSON content
+fn detect_manifest_media_type(data: &[u8]) -> String {
+    // Try to parse as JSON and extract mediaType
+    if let Ok(json) = serde_json::from_slice::<Value>(data) {
+        if let Some(media_type) = json.get("mediaType").and_then(|v| v.as_str()) {
+            return media_type.to_string();
+        }
+
+        // Check schemaVersion for older manifests
+        if let Some(schema_version) = json.get("schemaVersion").and_then(|v| v.as_u64()) {
+            if schema_version == 1 {
+                return "application/vnd.docker.distribution.manifest.v1+json".to_string();
+            }
+            // schemaVersion 2 without mediaType is likely docker manifest v2
+            if json.get("config").is_some() {
+                return "application/vnd.docker.distribution.manifest.v2+json".to_string();
+            }
+            // If it has "manifests" array, it's an index/list
+            if json.get("manifests").is_some() {
+                return "application/vnd.oci.image.index.v1+json".to_string();
+            }
+        }
+    }
+
+    // Default fallback
+    "application/vnd.docker.distribution.manifest.v2+json".to_string()
+}
+
+/// Extract metadata from a Docker manifest
+/// Handles both single-arch manifests and multi-arch indexes
+async fn extract_metadata(manifest: &[u8], storage: &Storage, name: &str) -> ImageMetadata {
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    let mut metadata = ImageMetadata {
+        push_timestamp: now,
+        last_pulled: 0,
+        downloads: 0,
+        ..Default::default()
+    };
+
+    let Ok(json) = serde_json::from_slice::<Value>(manifest) else {
+        return metadata;
+    };
+
+    // Check if this is a manifest list/index (multi-arch)
+    if json.get("manifests").is_some() {
+        // For multi-arch, extract info from the first platform manifest
+        if let Some(manifests) = json.get("manifests").and_then(|m| m.as_array()) {
+            // Sum sizes from all platform manifests
+            let total_size: u64 = manifests
+                .iter()
+                .filter_map(|m| m.get("size").and_then(|s| s.as_u64()))
+                .sum();
+            metadata.size_bytes = total_size;
+
+            // Get OS/arch from first platform (usually linux/amd64)
+            if let Some(first) = manifests.first() {
+                if let Some(platform) = first.get("platform") {
+                    metadata.os = platform
+                        .get("os")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or("multi-arch")
+                        .to_string();
+                    metadata.arch = platform
+                        .get("architecture")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or("multi")
+                        .to_string();
+                    metadata.variant = platform
+                        .get("variant")
+                        .and_then(|v| v.as_str())
+                        .map(String::from);
+                }
+            }
+        }
+        return metadata;
+    }
+
+    // Single-arch manifest - extract layers
+    if let Some(layers) = json.get("layers").and_then(|l| l.as_array()) {
+        let mut total_size: u64 = 0;
+        for layer in layers {
+            let digest = layer
+                .get("digest")
+                .and_then(|d| d.as_str())
+                .unwrap_or("")
+                .to_string();
+            let size = layer.get("size").and_then(|s| s.as_u64()).unwrap_or(0);
+            total_size += size;
+            metadata.layers.push(LayerInfo { digest, size });
+        }
+        metadata.size_bytes = total_size;
+    }
+
+    // Try to get OS/arch from config blob
+    if let Some(config) = json.get("config") {
+        if let Some(config_digest) = config.get("digest").and_then(|d| d.as_str()) {
+            let (os, arch, variant) = get_config_info(storage, name, config_digest).await;
+            metadata.os = os;
+            metadata.arch = arch;
+            metadata.variant = variant;
+        }
+    }
+
+    // If we couldn't get OS/arch, set defaults
+    if metadata.os.is_empty() {
+        metadata.os = "unknown".to_string();
+    }
+    if metadata.arch.is_empty() {
+        metadata.arch = "unknown".to_string();
+    }
+
+    metadata
+}
+
+/// Get OS/arch information from a config blob
+async fn get_config_info(
+    storage: &Storage,
+    name: &str,
+    config_digest: &str,
+) -> (String, String, Option<String>) {
+    let key = format!("docker/{}/blobs/{}", name, config_digest);
+
+    let Ok(data) = storage.get(&key).await else {
+        return ("unknown".to_string(), "unknown".to_string(), None);
+    };
+
+    let Ok(config) = serde_json::from_slice::<Value>(&data) else {
+        return ("unknown".to_string(), "unknown".to_string(), None);
+    };
+
+    let os = config
+        .get("os")
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown")
+        .to_string();
+
+    let arch = config
+        .get("architecture")
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown")
+        .to_string();
+
+    let variant = config
+        .get("variant")
+        .and_then(|v| v.as_str())
+        .map(String::from);
+
+    (os, arch, variant)
+}
+
+/// Update metadata when a manifest is pulled
+/// Increments download counter and updates last_pulled timestamp
+async fn update_metadata_on_pull(storage: Storage, meta_key: String) {
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    // Try to read existing metadata
+    let mut metadata = if let Ok(data) = storage.get(&meta_key).await {
+        serde_json::from_slice::<ImageMetadata>(&data).unwrap_or_default()
+    } else {
+        ImageMetadata::default()
+    };
+
+    // Update pull stats
+    metadata.downloads += 1;
+    metadata.last_pulled = now;
+
+    // Save back
+    if let Ok(json) = serde_json::to_vec(&metadata) {
+        let _ = storage.put(&meta_key, &json).await;
+    }
+}
--- a/nora-registry/src/registry/docker_auth.rs
+++ b/nora-registry/src/registry/docker_auth.rs
@@ -0,0 +1,189 @@
+use parking_lot::RwLock;
+use std::collections::HashMap;
+use std::time::{Duration, Instant};
+
+/// Cached Docker registry token
+struct CachedToken {
+    token: String,
+    expires_at: Instant,
+}
+
+/// Docker registry authentication handler
+/// Manages Bearer token acquisition and caching for upstream registries
+pub struct DockerAuth {
+    tokens: RwLock<HashMap<String, CachedToken>>,
+    client: reqwest::Client,
+}
+
+impl DockerAuth {
+    pub fn new(timeout: u64) -> Self {
+        Self {
+            tokens: RwLock::new(HashMap::new()),
+            client: reqwest::Client::builder()
+                .timeout(Duration::from_secs(timeout))
+                .build()
+                .unwrap_or_default(),
+        }
+    }
+
+    /// Get a valid token for the given registry and repository scope
+    /// Returns cached token if still valid, otherwise fetches a new one
+    pub async fn get_token(
+        &self,
+        registry_url: &str,
+        name: &str,
+        www_authenticate: Option<&str>,
+    ) -> Option<String> {
+        let cache_key = format!("{}:{}", registry_url, name);
+
+        // Check cache first
+        {
+            let tokens = self.tokens.read();
+            if let Some(cached) = tokens.get(&cache_key) {
+                if cached.expires_at > Instant::now() {
+                    return Some(cached.token.clone());
+                }
+            }
+        }
+
+        // Need to fetch a new token
+        let www_auth = www_authenticate?;
+        let token = self.fetch_token(www_auth, name).await?;
+
+        // Cache the token (default 5 minute expiry)
+        {
+            let mut tokens = self.tokens.write();
+            tokens.insert(
+                cache_key,
+                CachedToken {
+                    token: token.clone(),
+                    expires_at: Instant::now() + Duration::from_secs(300),
+                },
+            );
+        }
+
+        Some(token)
+    }
+
+    /// Parse Www-Authenticate header and fetch token from auth server
+    /// Format: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:library/alpine:pull"
+    async fn fetch_token(&self, www_authenticate: &str, name: &str) -> Option<String> {
+        let params = parse_www_authenticate(www_authenticate)?;
+
+        let realm = params.get("realm")?;
+        let service = params.get("service").map(|s| s.as_str()).unwrap_or("");
+
+        // Build token request URL
+        let scope = format!("repository:{}:pull", name);
+        let url = format!("{}?service={}&scope={}", realm, service, scope);
+
+        let response = self.client.get(&url).send().await.ok()?;
+
+        if !response.status().is_success() {
+            return None;
+        }
+
+        let json: serde_json::Value = response.json().await.ok()?;
+
+        // Docker Hub returns "token", some registries return "access_token"
+        json.get("token")
+            .or_else(|| json.get("access_token"))
+            .and_then(|v| v.as_str())
+            .map(String::from)
+    }
+
+    /// Make an authenticated request to an upstream registry
+    pub async fn fetch_with_auth(
+        &self,
+        url: &str,
+        registry_url: &str,
+        name: &str,
+    ) -> Result<reqwest::Response, ()> {
+        // First try without auth
+        let response = self.client.get(url).send().await.map_err(|_| ())?;
+
+        if response.status() == reqwest::StatusCode::UNAUTHORIZED {
+            // Extract Www-Authenticate header
+            let www_auth = response
+                .headers()
+                .get("www-authenticate")
+                .and_then(|v| v.to_str().ok())
+                .map(String::from);
+
+            // Get token and retry
+            if let Some(token) = self
+                .get_token(registry_url, name, www_auth.as_deref())
+                .await
+            {
+                return self
+                    .client
+                    .get(url)
+                    .header("Authorization", format!("Bearer {}", token))
+                    .send()
+                    .await
+                    .map_err(|_| ());
+            }
+
+            return Err(());
+        }
+
+        Ok(response)
+    }
+}
+
+impl Default for DockerAuth {
+    fn default() -> Self {
+        Self::new(60)
+    }
+}
+
+/// Parse Www-Authenticate header into key-value pairs
+/// Example: Bearer realm="https://auth.docker.io/token",service="registry.docker.io"
+fn parse_www_authenticate(header: &str) -> Option<HashMap<String, String>> {
+    let header = header
+        .strip_prefix("Bearer ")
+        .or_else(|| header.strip_prefix("bearer "))?;
+
+    let mut params = HashMap::new();
+
+    for part in header.split(',') {
+        let part = part.trim();
+        if let Some((key, value)) = part.split_once('=') {
+            let value = value.trim_matches('"');
+            params.insert(key.to_string(), value.to_string());
+        }
+    }
+
+    Some(params)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_www_authenticate() {
+        let header = r#"Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:library/alpine:pull""#;
+        let params = parse_www_authenticate(header).unwrap();
+
+        assert_eq!(
+            params.get("realm"),
+            Some(&"https://auth.docker.io/token".to_string())
+        );
+        assert_eq!(
+            params.get("service"),
+            Some(&"registry.docker.io".to_string())
+        );
+    }
+
+    #[test]
+    fn test_parse_www_authenticate_lowercase() {
+        let header = r#"bearer realm="https://ghcr.io/token",service="ghcr.io""#;
+        let params = parse_www_authenticate(header).unwrap();
+
+        assert_eq!(
+            params.get("realm"),
+            Some(&"https://ghcr.io/token".to_string())
+        );
+    }
+}
--- a/nora-registry/src/registry/mod.rs
+++ b/nora-registry/src/registry/mod.rs
@@ -1,11 +1,15 @@
 mod cargo_registry;
-mod docker;
+pub mod docker;
+pub mod docker_auth;
 mod maven;
 mod npm;
 mod pypi;
+mod raw;

 pub use cargo_registry::routes as cargo_routes;
 pub use docker::routes as docker_routes;
+pub use docker_auth::DockerAuth;
 pub use maven::routes as maven_routes;
 pub use npm::routes as npm_routes;
 pub use pypi::routes as pypi_routes;
+pub use raw::routes as raw_routes;
--- a/nora-registry/src/registry/pypi.rs
+++ b/nora-registry/src/registry/pypi.rs
@@ -1,35 +1,309 @@
+use crate::activity_log::{ActionType, ActivityEntry};
 use crate::AppState;
 use axum::{
-    extract::State,
-    http::StatusCode,
-    response::{Html, IntoResponse},
+    extract::{Path, State},
+    http::{header, StatusCode},
+    response::{Html, IntoResponse, Response},
    routing::get,
    Router,
 };
 use std::sync::Arc;
+use std::time::Duration;

 pub fn routes() -> Router<Arc<AppState>> {
-    Router::new().route("/simple/", get(list_packages))
+    Router::new()
+        .route("/simple/", get(list_packages))
+        .route("/simple/{name}/", get(package_versions))
+        .route("/simple/{name}/{filename}", get(download_file))
 }

+/// List all packages (Simple API index)
 async fn list_packages(State(state): State<Arc<AppState>>) -> impl IntoResponse {
    let keys = state.storage.list("pypi/").await;
    let mut packages = std::collections::HashSet::new();

    for key in keys {
        if let Some(pkg) = key.strip_prefix("pypi/").and_then(|k| k.split('/').next()) {
-            packages.insert(pkg.to_string());
+            if !pkg.is_empty() {
+                packages.insert(pkg.to_string());
+            }
        }
    }

-    let mut html = String::from("<html><body><h1>Simple Index</h1>");
+    let mut html = String::from(
+        "<!DOCTYPE html>\n<html><head><title>Simple Index</title></head><body><h1>Simple Index</h1>\n",
+    );
    let mut pkg_list: Vec<_> = packages.into_iter().collect();
    pkg_list.sort();

    for pkg in pkg_list {
-        html.push_str(&format!("<a href=\"/simple/{}/\">{}</a><br>", pkg, pkg));
+        html.push_str(&format!("<a href=\"/simple/{}/\">{}</a><br>\n", pkg, pkg));
    }
    html.push_str("</body></html>");

    (StatusCode::OK, Html(html))
 }
+
+/// List versions/files for a specific package
+async fn package_versions(
+    State(state): State<Arc<AppState>>,
+    Path(name): Path<String>,
+) -> Response {
+    // Normalize package name (PEP 503)
+    let normalized = normalize_name(&name);
+
+    // Try to get local files first
+    let prefix = format!("pypi/{}/", normalized);
+    let keys = state.storage.list(&prefix).await;
+
+    if !keys.is_empty() {
+        // We have local files
+        let mut html = format!(
+            "<!DOCTYPE html>\n<html><head><title>Links for {}</title></head><body><h1>Links for {}</h1>\n",
+            name, name
+        );
+
+        for key in &keys {
+            if let Some(filename) = key.strip_prefix(&prefix) {
+                if !filename.is_empty() {
+                    html.push_str(&format!(
+                        "<a href=\"/simple/{}/{}\">{}</a><br>\n",
+                        normalized, filename, filename
+                    ));
+                }
+            }
+        }
+        html.push_str("</body></html>");
+
+        return (StatusCode::OK, Html(html)).into_response();
+    }
+
+    // Try proxy if configured
+    if let Some(proxy_url) = &state.config.pypi.proxy {
+        let url = format!("{}/{}/", proxy_url.trim_end_matches('/'), normalized);
+
+        if let Ok(html) = fetch_package_page(&url, state.config.pypi.proxy_timeout).await {
+            // Rewrite URLs in the HTML to point to our registry
+            let rewritten = rewrite_pypi_links(&html, &normalized);
+            return (StatusCode::OK, Html(rewritten)).into_response();
+        }
+    }
+
+    StatusCode::NOT_FOUND.into_response()
+}
+
+/// Download a specific file
+async fn download_file(
+    State(state): State<Arc<AppState>>,
+    Path((name, filename)): Path<(String, String)>,
+) -> Response {
+    let normalized = normalize_name(&name);
+    let key = format!("pypi/{}/{}", normalized, filename);
+
+    // Try local storage first
+    if let Ok(data) = state.storage.get(&key).await {
+        state.metrics.record_download("pypi");
+        state.metrics.record_cache_hit();
+        state.activity.push(ActivityEntry::new(
+            ActionType::CacheHit,
+            format!("{}/{}", name, filename),
+            "pypi",
+            "CACHE",
+        ));
+
+        let content_type = if filename.ends_with(".whl") {
+            "application/zip"
+        } else if filename.ends_with(".tar.gz") || filename.ends_with(".tgz") {
+            "application/gzip"
+        } else {
+            "application/octet-stream"
+        };
+
+        return (StatusCode::OK, [(header::CONTENT_TYPE, content_type)], data).into_response();
+    }
+
+    // Try proxy if configured
+    if let Some(proxy_url) = &state.config.pypi.proxy {
+        // First, fetch the package page to find the actual download URL
+        let page_url = format!("{}/{}/", proxy_url.trim_end_matches('/'), normalized);
+
+        if let Ok(html) = fetch_package_page(&page_url, state.config.pypi.proxy_timeout).await {
+            // Find the URL for this specific file
+            if let Some(file_url) = find_file_url(&html, &filename) {
+                if let Ok(data) = fetch_file(&file_url, state.config.pypi.proxy_timeout).await {
+                    state.metrics.record_download("pypi");
+                    state.metrics.record_cache_miss();
+                    state.activity.push(ActivityEntry::new(
+                        ActionType::ProxyFetch,
+                        format!("{}/{}", name, filename),
+                        "pypi",
+                        "PROXY",
+                    ));
+
+                    // Cache in local storage
+                    let storage = state.storage.clone();
+                    let key_clone = key.clone();
+                    let data_clone = data.clone();
+                    tokio::spawn(async move {
+                        let _ = storage.put(&key_clone, &data_clone).await;
+                    });
+
+                    let content_type = if filename.ends_with(".whl") {
+                        "application/zip"
+                    } else if filename.ends_with(".tar.gz") || filename.ends_with(".tgz") {
+                        "application/gzip"
+                    } else {
+                        "application/octet-stream"
+                    };
+
+                    return (StatusCode::OK, [(header::CONTENT_TYPE, content_type)], data)
+                        .into_response();
+                }
+            }
+        }
+    }
+
+    StatusCode::NOT_FOUND.into_response()
+}
+
+/// Normalize package name according to PEP 503
+fn normalize_name(name: &str) -> String {
+    name.to_lowercase().replace(['-', '_', '.'], "-")
+}
+
+/// Fetch package page from upstream
+async fn fetch_package_page(url: &str, timeout_secs: u64) -> Result<String, ()> {
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(timeout_secs))
+        .build()
+        .map_err(|_| ())?;
+
+    let response = client
+        .get(url)
+        .header("Accept", "text/html")
+        .send()
+        .await
+        .map_err(|_| ())?;
+
+    if !response.status().is_success() {
+        return Err(());
+    }
+
+    response.text().await.map_err(|_| ())
+}
+
+/// Fetch file from upstream
+async fn fetch_file(url: &str, timeout_secs: u64) -> Result<Vec<u8>, ()> {
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(timeout_secs))
+        .build()
+        .map_err(|_| ())?;
+
+    let response = client.get(url).send().await.map_err(|_| ())?;
+
+    if !response.status().is_success() {
+        return Err(());
+    }
+
+    response.bytes().await.map(|b| b.to_vec()).map_err(|_| ())
+}
+
+/// Rewrite PyPI links to point to our registry
+fn rewrite_pypi_links(html: &str, package_name: &str) -> String {
+    // Simple regex-free approach: find href="..." and rewrite
+    let mut result = String::with_capacity(html.len());
+    let mut remaining = html;
+
+    while let Some(href_start) = remaining.find("href=\"") {
+        result.push_str(&remaining[..href_start + 6]);
+        remaining = &remaining[href_start + 6..];
+
+        if let Some(href_end) = remaining.find('"') {
+            let url = &remaining[..href_end];
+
+            // Extract filename from URL
+            if let Some(filename) = extract_filename(url) {
+                // Rewrite to our local URL
+                result.push_str(&format!("/simple/{}/{}", package_name, filename));
+            } else {
+                result.push_str(url);
+            }
+
+            remaining = &remaining[href_end..];
+        }
+    }
+    result.push_str(remaining);
+
+    // Remove data-core-metadata and data-dist-info-metadata attributes
+    // as we don't serve .metadata files (PEP 658)
+    let result = remove_attribute(&result, "data-core-metadata");
+    remove_attribute(&result, "data-dist-info-metadata")
+}
+
+/// Remove an HTML attribute from all tags
+fn remove_attribute(html: &str, attr_name: &str) -> String {
+    let mut result = String::with_capacity(html.len());
+    let mut remaining = html;
+    let pattern = format!(" {}=\"", attr_name);
+
+    while let Some(attr_start) = remaining.find(&pattern) {
+        result.push_str(&remaining[..attr_start]);
+        remaining = &remaining[attr_start + pattern.len()..];
+
+        // Skip the attribute value
+        if let Some(attr_end) = remaining.find('"') {
+            remaining = &remaining[attr_end + 1..];
+        }
+    }
+    result.push_str(remaining);
+    result
+}
+
+/// Extract filename from PyPI download URL
+fn extract_filename(url: &str) -> Option<&str> {
+    // PyPI URLs look like:
+    // https://files.pythonhosted.org/packages/.../package-1.0.0.tar.gz#sha256=...
+    // or just the filename directly
+
+    // Remove hash fragment
+    let url = url.split('#').next()?;
+
+    // Get the last path component
+    let filename = url.rsplit('/').next()?;
+
+    // Must be a valid package file
+    if filename.ends_with(".tar.gz")
+        || filename.ends_with(".tgz")
+        || filename.ends_with(".whl")
+        || filename.ends_with(".zip")
+        || filename.ends_with(".egg")
+    {
+        Some(filename)
+    } else {
+        None
+    }
+}
+
+/// Find the download URL for a specific file in the HTML
+fn find_file_url(html: &str, target_filename: &str) -> Option<String> {
+    let mut remaining = html;
+
+    while let Some(href_start) = remaining.find("href=\"") {
+        remaining = &remaining[href_start + 6..];
+
+        if let Some(href_end) = remaining.find('"') {
+            let url = &remaining[..href_end];
+
+            if let Some(filename) = extract_filename(url) {
+                if filename == target_filename {
+                    // Remove hash fragment for actual download
+                    return Some(url.split('#').next().unwrap_or(url).to_string());
+                }
+            }
+
+            remaining = &remaining[href_end..];
+        }
+    }
+
+    None
+}
--- a/nora-registry/src/registry/raw.rs
+++ b/nora-registry/src/registry/raw.rs
@@ -0,0 +1,133 @@
+use crate::activity_log::{ActionType, ActivityEntry};
+use crate::AppState;
+use axum::{
+    body::Bytes,
+    extract::{Path, State},
+    http::{header, StatusCode},
+    response::{IntoResponse, Response},
+    routing::get,
+    Router,
+};
+use std::sync::Arc;
+
+pub fn routes() -> Router<Arc<AppState>> {
+    Router::new().route(
+        "/raw/{*path}",
+        get(download)
+            .put(upload)
+            .delete(delete_file)
+            .head(check_exists),
+    )
+}
+
+async fn download(State(state): State<Arc<AppState>>, Path(path): Path<String>) -> Response {
+    if !state.config.raw.enabled {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+
+    let key = format!("raw/{}", path);
+    match state.storage.get(&key).await {
+        Ok(data) => {
+            state.metrics.record_download("raw");
+            state
+                .activity
+                .push(ActivityEntry::new(ActionType::Pull, path, "raw", "LOCAL"));
+
+            // Guess content type from extension
+            let content_type = guess_content_type(&key);
+            (StatusCode::OK, [(header::CONTENT_TYPE, content_type)], data).into_response()
+        }
+        Err(_) => StatusCode::NOT_FOUND.into_response(),
+    }
+}
+
+async fn upload(
+    State(state): State<Arc<AppState>>,
+    Path(path): Path<String>,
+    body: Bytes,
+) -> Response {
+    if !state.config.raw.enabled {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+
+    // Check file size limit
+    if body.len() as u64 > state.config.raw.max_file_size {
+        return (
+            StatusCode::PAYLOAD_TOO_LARGE,
+            format!(
+                "File too large. Max size: {} bytes",
+                state.config.raw.max_file_size
+            ),
+        )
+            .into_response();
+    }
+
+    let key = format!("raw/{}", path);
+    match state.storage.put(&key, &body).await {
+        Ok(()) => {
+            state.metrics.record_upload("raw");
+            state
+                .activity
+                .push(ActivityEntry::new(ActionType::Push, path, "raw", "LOCAL"));
+            StatusCode::CREATED.into_response()
+        }
+        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+    }
+}
+
+async fn delete_file(State(state): State<Arc<AppState>>, Path(path): Path<String>) -> Response {
+    if !state.config.raw.enabled {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+
+    let key = format!("raw/{}", path);
+    match state.storage.delete(&key).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(crate::storage::StorageError::NotFound) => StatusCode::NOT_FOUND.into_response(),
+        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+    }
+}
+
+async fn check_exists(State(state): State<Arc<AppState>>, Path(path): Path<String>) -> Response {
+    if !state.config.raw.enabled {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+
+    let key = format!("raw/{}", path);
+    match state.storage.stat(&key).await {
+        Some(meta) => (
+            StatusCode::OK,
+            [
+                (header::CONTENT_LENGTH, meta.size.to_string()),
+                (header::CONTENT_TYPE, guess_content_type(&key).to_string()),
+            ],
+        )
+            .into_response(),
+        None => StatusCode::NOT_FOUND.into_response(),
+    }
+}
+
+fn guess_content_type(path: &str) -> &'static str {
+    let ext = path.rsplit('.').next().unwrap_or("");
+    match ext.to_lowercase().as_str() {
+        "json" => "application/json",
+        "xml" => "application/xml",
+        "html" | "htm" => "text/html",
+        "css" => "text/css",
+        "js" => "application/javascript",
+        "txt" => "text/plain",
+        "md" => "text/markdown",
+        "yaml" | "yml" => "application/x-yaml",
+        "toml" => "application/toml",
+        "tar" => "application/x-tar",
+        "gz" | "gzip" => "application/gzip",
+        "zip" => "application/zip",
+        "png" => "image/png",
+        "jpg" | "jpeg" => "image/jpeg",
+        "gif" => "image/gif",
+        "svg" => "image/svg+xml",
+        "pdf" => "application/pdf",
+        "wasm" => "application/wasm",
+        _ => "application/octet-stream",
+    }
+}
--- a/nora-registry/src/secrets/env.rs
+++ b/nora-registry/src/secrets/env.rs
@@ -0,0 +1,127 @@
+//! Environment variables secrets provider
+//!
+//! Reads secrets from environment variables. This is the default provider
+//! following 12-Factor App principles.
+
+use std::env;
+
+use super::{SecretsError, SecretsProvider};
+use crate::secrets::protected::ProtectedString;
+use async_trait::async_trait;
+
+/// Environment variables secrets provider
+///
+/// Reads secrets from environment variables.
+/// Optionally clears variables after reading for extra security.
+#[derive(Debug, Clone)]
+pub struct EnvProvider {
+    /// Clear environment variables after reading
+    clear_after_read: bool,
+}
+
+impl EnvProvider {
+    /// Create a new environment provider
+    pub fn new() -> Self {
+        Self {
+            clear_after_read: false,
+        }
+    }
+
+    /// Create a provider that clears env vars after reading
+    ///
+    /// This prevents secrets from being visible in `/proc/<pid>/environ`
+    pub fn with_clear_after_read(mut self) -> Self {
+        self.clear_after_read = true;
+        self
+    }
+}
+
+impl Default for EnvProvider {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl SecretsProvider for EnvProvider {
+    async fn get_secret(&self, key: &str) -> Result<ProtectedString, SecretsError> {
+        let value = env::var(key).map_err(|_| SecretsError::NotFound(key.to_string()))?;
+
+        if self.clear_after_read {
+            env::remove_var(key);
+        }
+
+        Ok(ProtectedString::new(value))
+    }
+
+    async fn get_secret_optional(&self, key: &str) -> Option<ProtectedString> {
+        env::var(key).ok().map(|v| {
+            if self.clear_after_read {
+                env::remove_var(key);
+            }
+            ProtectedString::new(v)
+        })
+    }
+
+    fn provider_name(&self) -> &'static str {
+        "env"
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_get_secret_exists() {
+        env::set_var("TEST_SECRET_123", "secret-value");
+        let provider = EnvProvider::new();
+        let secret = provider.get_secret("TEST_SECRET_123").await.unwrap();
+        assert_eq!(secret.expose(), "secret-value");
+        env::remove_var("TEST_SECRET_123");
+    }
+
+    #[tokio::test]
+    async fn test_get_secret_not_found() {
+        let provider = EnvProvider::new();
+        let result = provider.get_secret("NONEXISTENT_VAR_XYZ").await;
+        assert!(matches!(result, Err(SecretsError::NotFound(_))));
+    }
+
+    #[tokio::test]
+    async fn test_get_secret_optional_exists() {
+        env::set_var("TEST_OPTIONAL_123", "optional-value");
+        let provider = EnvProvider::new();
+        let secret = provider.get_secret_optional("TEST_OPTIONAL_123").await;
+        assert!(secret.is_some());
+        assert_eq!(secret.unwrap().expose(), "optional-value");
+        env::remove_var("TEST_OPTIONAL_123");
+    }
+
+    #[tokio::test]
+    async fn test_get_secret_optional_not_found() {
+        let provider = EnvProvider::new();
+        let secret = provider
+            .get_secret_optional("NONEXISTENT_OPTIONAL_XYZ")
+            .await;
+        assert!(secret.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_clear_after_read() {
+        env::set_var("TEST_CLEAR_123", "to-be-cleared");
+        let provider = EnvProvider::new().with_clear_after_read();
+
+        let secret = provider.get_secret("TEST_CLEAR_123").await.unwrap();
+        assert_eq!(secret.expose(), "to-be-cleared");
+
+        // Variable should be cleared
+        assert!(env::var("TEST_CLEAR_123").is_err());
+    }
+
+    #[test]
+    fn test_provider_name() {
+        let provider = EnvProvider::new();
+        assert_eq!(provider.provider_name(), "env");
+    }
+}
--- a/nora-registry/src/secrets/mod.rs
+++ b/nora-registry/src/secrets/mod.rs
@@ -0,0 +1,166 @@
+#![allow(dead_code)] // Foundational code for future S3/Vault integration
+
+//! Secrets management for NORA
+//!
+//! Provides a trait-based architecture for secrets providers:
+//! - `env` - Environment variables (default, 12-Factor App)
+//! - `aws-secrets` - AWS Secrets Manager (v0.4.0+)
+//! - `vault` - HashiCorp Vault (v0.5.0+)
+//! - `k8s` - Kubernetes Secrets (v0.4.0+)
+//!
+//! # Example
+//!
+//! ```rust,ignore
+//! use nora::secrets::{create_secrets_provider, SecretsConfig};
+//!
+//! let config = SecretsConfig::default(); // Uses ENV provider
+//! let provider = create_secrets_provider(&config)?;
+//!
+//! let api_key = provider.get_secret("API_KEY").await?;
+//! println!("Got secret (redacted): {:?}", api_key);
+//! ```
+
+mod env;
+pub mod protected;
+
+pub use env::EnvProvider;
+#[allow(unused_imports)]
+pub use protected::{ProtectedString, S3Credentials};
+
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+/// Secrets provider error
+#[derive(Debug, Error)]
+pub enum SecretsError {
+    #[error("Secret not found: {0}")]
+    NotFound(String),
+
+    #[error("Provider error: {0}")]
+    Provider(String),
+
+    #[error("Configuration error: {0}")]
+    Config(String),
+
+    #[error("Unsupported provider: {0}")]
+    UnsupportedProvider(String),
+}
+
+/// Secrets provider trait
+///
+/// Implement this trait to add new secrets backends.
+#[async_trait]
+pub trait SecretsProvider: Send + Sync {
+    /// Get a secret by key (required)
+    async fn get_secret(&self, key: &str) -> Result<ProtectedString, SecretsError>;
+
+    /// Get a secret by key (optional, returns None if not found)
+    async fn get_secret_optional(&self, key: &str) -> Option<ProtectedString> {
+        self.get_secret(key).await.ok()
+    }
+
+    /// Get provider name for logging
+    fn provider_name(&self) -> &'static str;
+}
+
+/// Secrets configuration
+///
+/// # Example config.toml
+///
+/// ```toml
+/// [secrets]
+/// provider = "env"
+/// clear_env = false
+/// ```
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SecretsConfig {
+    /// Provider type: "env", "aws-secrets", "vault", "k8s"
+    #[serde(default = "default_provider")]
+    pub provider: String,
+
+    /// Clear environment variables after reading (for env provider)
+    #[serde(default)]
+    pub clear_env: bool,
+}
+
+fn default_provider() -> String {
+    "env".to_string()
+}
+
+impl Default for SecretsConfig {
+    fn default() -> Self {
+        Self {
+            provider: default_provider(),
+            clear_env: false,
+        }
+    }
+}
+
+/// Create a secrets provider based on configuration
+///
+/// Currently supports:
+/// - `env` - Environment variables (default)
+///
+/// Future versions will add:
+/// - `aws-secrets` - AWS Secrets Manager
+/// - `vault` - HashiCorp Vault
+/// - `k8s` - Kubernetes Secrets
+pub fn create_secrets_provider(
+    config: &SecretsConfig,
+) -> Result<Box<dyn SecretsProvider>, SecretsError> {
+    match config.provider.as_str() {
+        "env" => {
+            let mut provider = EnvProvider::new();
+            if config.clear_env {
+                provider = provider.with_clear_after_read();
+            }
+            Ok(Box::new(provider))
+        }
+        // Future providers:
+        // "aws-secrets" => { ... }
+        // "vault" => { ... }
+        // "k8s" => { ... }
+        other => Err(SecretsError::UnsupportedProvider(other.to_string())),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_default_config() {
+        let config = SecretsConfig::default();
+        assert_eq!(config.provider, "env");
+        assert!(!config.clear_env);
+    }
+
+    #[test]
+    fn test_create_env_provider() {
+        let config = SecretsConfig::default();
+        let provider = create_secrets_provider(&config).unwrap();
+        assert_eq!(provider.provider_name(), "env");
+    }
+
+    #[test]
+    fn test_create_unsupported_provider() {
+        let config = SecretsConfig {
+            provider: "unknown".to_string(),
+            clear_env: false,
+        };
+        let result = create_secrets_provider(&config);
+        assert!(matches!(result, Err(SecretsError::UnsupportedProvider(_))));
+    }
+
+    #[test]
+    fn test_config_from_toml() {
+        let toml = r#"
+            provider = "env"
+            clear_env = true
+        "#;
+        let config: SecretsConfig = toml::from_str(toml).unwrap();
+        assert_eq!(config.provider, "env");
+        assert!(config.clear_env);
+    }
+}
--- a/nora-registry/src/secrets/protected.rs
+++ b/nora-registry/src/secrets/protected.rs
@@ -0,0 +1,152 @@
+//! Protected secret types with memory safety
+//!
+//! Secrets are automatically zeroed on drop and redacted in Debug output.
+
+use std::fmt;
+use zeroize::{Zeroize, Zeroizing};
+
+/// A protected secret string that is zeroed on drop
+///
+/// - Implements Zeroize: memory is overwritten with zeros when dropped
+/// - Debug shows `***REDACTED***` instead of actual value
+/// - Clone creates a new protected copy
+#[derive(Clone, Zeroize)]
+#[zeroize(drop)]
+pub struct ProtectedString {
+    inner: String,
+}
+
+impl ProtectedString {
+    /// Create a new protected string
+    pub fn new(value: String) -> Self {
+        Self { inner: value }
+    }
+
+    /// Get the secret value (use sparingly!)
+    pub fn expose(&self) -> &str {
+        &self.inner
+    }
+
+    /// Consume and return the inner value
+    pub fn into_inner(self) -> Zeroizing<String> {
+        Zeroizing::new(self.inner.clone())
+    }
+
+    /// Check if the secret is empty
+    pub fn is_empty(&self) -> bool {
+        self.inner.is_empty()
+    }
+}
+
+impl fmt::Debug for ProtectedString {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ProtectedString")
+            .field("value", &"***REDACTED***")
+            .finish()
+    }
+}
+
+impl fmt::Display for ProtectedString {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "***REDACTED***")
+    }
+}
+
+impl From<String> for ProtectedString {
+    fn from(value: String) -> Self {
+        Self::new(value)
+    }
+}
+
+impl From<&str> for ProtectedString {
+    fn from(value: &str) -> Self {
+        Self::new(value.to_string())
+    }
+}
+
+/// S3 credentials with protected secrets
+#[derive(Clone, Zeroize)]
+#[zeroize(drop)]
+pub struct S3Credentials {
+    pub access_key_id: String,
+    #[zeroize(skip)] // access_key_id is not sensitive
+    pub secret_access_key: ProtectedString,
+    pub region: Option<String>,
+}
+
+impl S3Credentials {
+    pub fn new(access_key_id: String, secret_access_key: String) -> Self {
+        Self {
+            access_key_id,
+            secret_access_key: ProtectedString::new(secret_access_key),
+            region: None,
+        }
+    }
+
+    pub fn with_region(mut self, region: String) -> Self {
+        self.region = Some(region);
+        self
+    }
+}
+
+impl fmt::Debug for S3Credentials {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("S3Credentials")
+            .field("access_key_id", &self.access_key_id)
+            .field("secret_access_key", &"***REDACTED***")
+            .field("region", &self.region)
+            .finish()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_protected_string_redacted_debug() {
+        let secret = ProtectedString::new("super-secret-value".to_string());
+        let debug_output = format!("{:?}", secret);
+        assert!(debug_output.contains("REDACTED"));
+        assert!(!debug_output.contains("super-secret-value"));
+    }
+
+    #[test]
+    fn test_protected_string_redacted_display() {
+        let secret = ProtectedString::new("super-secret-value".to_string());
+        let display_output = format!("{}", secret);
+        assert_eq!(display_output, "***REDACTED***");
+    }
+
+    #[test]
+    fn test_protected_string_expose() {
+        let secret = ProtectedString::new("my-secret".to_string());
+        assert_eq!(secret.expose(), "my-secret");
+    }
+
+    #[test]
+    fn test_s3_credentials_redacted_debug() {
+        let creds = S3Credentials::new(
+            "AKIAIOSFODNN7EXAMPLE".to_string(),
+            "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY".to_string(),
+        );
+        let debug_output = format!("{:?}", creds);
+        assert!(debug_output.contains("AKIAIOSFODNN7EXAMPLE"));
+        assert!(!debug_output.contains("wJalrXUtnFEMI"));
+        assert!(debug_output.contains("REDACTED"));
+    }
+
+    #[test]
+    fn test_protected_string_from_str() {
+        let secret: ProtectedString = "test".into();
+        assert_eq!(secret.expose(), "test");
+    }
+
+    #[test]
+    fn test_protected_string_is_empty() {
+        let empty = ProtectedString::new(String::new());
+        let non_empty = ProtectedString::new("secret".to_string());
+        assert!(empty.is_empty());
+        assert!(!non_empty.is_empty());
+    }
+}
--- a/nora-registry/src/storage/local.rs
+++ b/nora-registry/src/storage/local.rs
@@ -85,6 +85,20 @@ impl StorageBackend for LocalStorage {
        Ok(Bytes::from(buffer))
    }

+    async fn delete(&self, key: &str) -> Result<()> {
+        let path = self.key_to_path(key);
+
+        if !path.exists() {
+            return Err(StorageError::NotFound);
+        }
+
+        fs::remove_file(&path)
+            .await
+            .map_err(|e| StorageError::Io(e.to_string()))?;
+
+        Ok(())
+    }
+
    async fn list(&self, prefix: &str) -> Vec<String> {
        let base = self.base_path.clone();
        let prefix = prefix.to_string();
--- a/nora-registry/src/storage/mod.rs
+++ b/nora-registry/src/storage/mod.rs
@@ -39,6 +39,7 @@ pub type Result<T> = std::result::Result<T, StorageError>;
 pub trait StorageBackend: Send + Sync {
    async fn put(&self, key: &str, data: &[u8]) -> Result<()>;
    async fn get(&self, key: &str) -> Result<Bytes>;
+    async fn delete(&self, key: &str) -> Result<()>;
    async fn list(&self, prefix: &str) -> Vec<String>;
    async fn stat(&self, key: &str) -> Option<FileMeta>;
    async fn health_check(&self) -> bool;
@@ -74,6 +75,11 @@ impl Storage {
        self.inner.get(key).await
    }

+    pub async fn delete(&self, key: &str) -> Result<()> {
+        validate_storage_key(key)?;
+        self.inner.delete(key).await
+    }
+
    pub async fn list(&self, prefix: &str) -> Vec<String> {
        // Empty prefix is valid for listing all
        if !prefix.is_empty() && validate_storage_key(prefix).is_err() {
--- a/nora-registry/src/storage/s3.rs
+++ b/nora-registry/src/storage/s3.rs
@@ -74,6 +74,27 @@ impl StorageBackend for S3Storage {
        }
    }

+    async fn delete(&self, key: &str) -> Result<()> {
+        let url = format!("{}/{}/{}", self.s3_url, self.bucket, key);
+        let response = self
+            .client
+            .delete(&url)
+            .send()
+            .await
+            .map_err(|e| StorageError::Network(e.to_string()))?;
+
+        if response.status().is_success() || response.status().as_u16() == 204 {
+            Ok(())
+        } else if response.status().as_u16() == 404 {
+            Err(StorageError::NotFound)
+        } else {
+            Err(StorageError::Network(format!(
+                "DELETE failed: {}",
+                response.status()
+            )))
+        }
+    }
+
    async fn list(&self, prefix: &str) -> Vec<String> {
        let url = format!("{}/{}", self.s3_url, self.bucket);
        match self.client.get(&url).send().await {
--- a/nora-registry/src/ui/api.rs
+++ b/nora-registry/src/ui/api.rs
@@ -34,6 +34,12 @@ pub struct TagInfo {
    pub name: String,
    pub size: u64,
    pub created: String,
+    pub downloads: u64,
+    pub last_pulled: Option<String>,
+    pub os: String,
+    pub arch: String,
+    pub layers_count: usize,
+    pub pull_command: String,
 }

 #[derive(Serialize)]
@@ -215,7 +221,7 @@ pub async fn api_dashboard(State(state): State<Arc<AppState>>) -> Json<Dashboard
        MountPoint {
            registry: "PyPI".to_string(),
            mount_path: "/simple/".to_string(),
-            proxy_upstream: None,
+            proxy_upstream: state.config.pypi.proxy.clone(),
        },
    ];

@@ -252,7 +258,7 @@ pub async fn api_detail(
 ) -> Json<serde_json::Value> {
    match registry_type.as_str() {
        "docker" => {
-            let detail = get_docker_detail(&state.storage, &name).await;
+            let detail = get_docker_detail(&state, &name).await;
            Json(serde_json::to_value(detail).unwrap_or_default())
        }
        "npm" => {
@@ -425,25 +431,80 @@ pub async fn get_docker_repos(storage: &Storage) -> Vec<RepoInfo> {
    result
 }

-pub async fn get_docker_detail(storage: &Storage, name: &str) -> DockerDetail {
+pub async fn get_docker_detail(state: &AppState, name: &str) -> DockerDetail {
    let prefix = format!("docker/{}/manifests/", name);
-    let keys = storage.list(&prefix).await;
+    let keys = state.storage.list(&prefix).await;
+
+    // Build public URL for pull commands
+    let registry_host =
+        state.config.server.public_url.clone().unwrap_or_else(|| {
+            format!("{}:{}", state.config.server.host, state.config.server.port)
+        });

    let mut tags = Vec::new();
    for key in &keys {
+        // Skip .meta.json files
+        if key.ends_with(".meta.json") {
+            continue;
+        }
+
        if let Some(tag_name) = key
            .strip_prefix(&prefix)
            .and_then(|s| s.strip_suffix(".json"))
        {
-            let (size, created) = if let Some(meta) = storage.stat(key).await {
-                (meta.size, format_timestamp(meta.modified))
+            // Load metadata from .meta.json file
+            let meta_key = format!("{}.meta.json", key.trim_end_matches(".json"));
+            let metadata = if let Ok(meta_data) = state.storage.get(&meta_key).await {
+                serde_json::from_slice::<crate::registry::docker::ImageMetadata>(&meta_data)
+                    .unwrap_or_default()
            } else {
-                (0, "N/A".to_string())
+                crate::registry::docker::ImageMetadata::default()
            };
+
+            // Get file stats for created timestamp if metadata doesn't have push_timestamp
+            let created = if metadata.push_timestamp > 0 {
+                format_timestamp(metadata.push_timestamp)
+            } else if let Some(file_meta) = state.storage.stat(key).await {
+                format_timestamp(file_meta.modified)
+            } else {
+                "N/A".to_string()
+            };
+
+            // Use size from metadata if available, otherwise from file
+            let size = if metadata.size_bytes > 0 {
+                metadata.size_bytes
+            } else {
+                state.storage.stat(key).await.map(|m| m.size).unwrap_or(0)
+            };
+
+            // Format last_pulled
+            let last_pulled = if metadata.last_pulled > 0 {
+                Some(format_timestamp(metadata.last_pulled))
+            } else {
+                None
+            };
+
+            // Build pull command
+            let pull_command = format!("docker pull {}/{}:{}", registry_host, name, tag_name);
+
            tags.push(TagInfo {
                name: tag_name.to_string(),
                size,
                created,
+                downloads: metadata.downloads,
+                last_pulled,
+                os: if metadata.os.is_empty() {
+                    "unknown".to_string()
+                } else {
+                    metadata.os
+                },
+                arch: if metadata.arch.is_empty() {
+                    "unknown".to_string()
+                } else {
+                    metadata.arch
+                },
+                layers_count: metadata.layers.len(),
+                pull_command,
            });
        }
    }
--- a/nora-registry/src/ui/components.rs
+++ b/nora-registry/src/ui/components.rs
@@ -1,78 +1,20 @@
+use super::i18n::{get_translations, Lang, Translations};
+
 /// Application version from Cargo.toml
 const VERSION: &str = env!("CARGO_PKG_VERSION");

-/// Main layout wrapper with header and sidebar
-pub fn layout(title: &str, content: &str, active_page: Option<&str>) -> String {
-    format!(
-        r##"<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>{} - Nora</title>
-    <script src="https://cdn.tailwindcss.com"></script>
-    <script src="https://unpkg.com/htmx.org@1.9.10"></script>
-    <style>
-        [x-cloak] {{ display: none !important; }}
-        .sidebar-open {{ overflow: hidden; }}
-    </style>
-</head>
-<body class="bg-slate-100 min-h-screen">
-    <div class="flex h-screen overflow-hidden">
-        <!-- Mobile sidebar overlay -->
-        <div id="sidebar-overlay" class="fixed inset-0 bg-black/50 z-40 hidden md:hidden" onclick="toggleSidebar()"></div>
-
-        <!-- Sidebar -->
-        {}
-
-        <!-- Main content -->
-        <div class="flex-1 flex flex-col overflow-hidden min-w-0">
-            <!-- Header -->
-            {}
-
-            <!-- Content -->
-            <main class="flex-1 overflow-y-auto p-4 md:p-6">
-                {}
-            </main>
-        </div>
-    </div>
-
-    <script>
-        function toggleSidebar() {{
-            const sidebar = document.getElementById('sidebar');
-            const overlay = document.getElementById('sidebar-overlay');
-            const isOpen = !sidebar.classList.contains('-translate-x-full');
-
-            if (isOpen) {{
-                sidebar.classList.add('-translate-x-full');
-                overlay.classList.add('hidden');
-                document.body.classList.remove('sidebar-open');
-            }} else {{
-                sidebar.classList.remove('-translate-x-full');
-                overlay.classList.remove('hidden');
-                document.body.classList.add('sidebar-open');
-            }}
-        }}
-    </script>
-</body>
-</html>"##,
-        html_escape(title),
-        sidebar(active_page),
-        header(),
-        content
-    )
-}
-
 /// Dark theme layout wrapper for dashboard
 pub fn layout_dark(
    title: &str,
    content: &str,
    active_page: Option<&str>,
    extra_scripts: &str,
+    lang: Lang,
 ) -> String {
+    let t = get_translations(lang);
    format!(
        r##"<!DOCTYPE html>
-<html lang="en">
+<html lang="{}">
 <head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
@@ -120,33 +62,42 @@ pub fn layout_dark(
                document.body.classList.add('sidebar-open');
            }}
        }}
+
+        function setLang(lang) {{
+            document.cookie = 'nora_lang=' + lang + ';path=/;max-age=31536000';
+            window.location.reload();
+        }}
    </script>
    {}
 </body>
 </html>"##,
+        lang.code(),
        html_escape(title),
-        sidebar_dark(active_page),
-        header_dark(),
+        sidebar_dark(active_page, t),
+        header_dark(lang),
        content,
        extra_scripts
    )
 }

 /// Dark theme sidebar
-fn sidebar_dark(active_page: Option<&str>) -> String {
+fn sidebar_dark(active_page: Option<&str>, t: &Translations) -> String {
    let active = active_page.unwrap_or("");

    let docker_icon = r#"<path fill="currentColor" d="M13.983 11.078h2.119a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.119a.185.185 0 00-.185.185v1.888c0 .102.083.185.185.185m-2.954-5.43h2.118a.186.186 0 00.186-.186V3.574a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.186m0 2.716h2.118a.187.187 0 00.186-.186V6.29a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.887c0 .102.082.185.185.186m-2.93 0h2.12a.186.186 0 00.184-.186V6.29a.185.185 0 00-.185-.185H8.1a.185.185 0 00-.185.185v1.887c0 .102.083.185.185.186m-2.964 0h2.119a.186.186 0 00.185-.186V6.29a.185.185 0 00-.185-.185H5.136a.186.186 0 00-.186.185v1.887c0 .102.084.185.186.186m5.893 2.715h2.118a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m-2.93 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.083.185.185.185m-2.964 0h2.119a.185.185 0 00.185-.185V9.006a.185.185 0 00-.185-.186h-2.12a.186.186 0 00-.185.186v1.887c0 .102.084.185.186.185m-2.92 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.082.185.185.185M23.763 9.89c-.065-.051-.672-.51-1.954-.51-.338.001-.676.03-1.01.087-.248-1.7-1.653-2.53-1.716-2.566l-.344-.199-.226.327c-.284.438-.49.922-.612 1.43-.23.97-.09 1.882.403 2.661-.595.332-1.55.413-1.744.42H.751a.751.751 0 00-.75.748 11.376 11.376 0 00.692 4.062c.545 1.428 1.355 2.48 2.41 3.124 1.18.723 3.1 1.137 5.275 1.137.983.003 1.963-.086 2.93-.266a12.248 12.248 0 003.823-1.389c.98-.567 1.86-1.288 2.61-2.136 1.252-1.418 1.998-2.997 2.553-4.4h.221c1.372 0 2.215-.549 2.68-1.009.309-.293.55-.65.707-1.046l.098-.288Z"/>"#;
    let maven_icon = r#"<path fill="currentColor" d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-1 17.93c-3.95-.49-7-3.85-7-7.93 0-.62.08-1.21.21-1.79L9 15v1c0 1.1.9 2 2 2v1.93zm6.9-2.54c-.26-.81-1-1.39-1.9-1.39h-1v-3c0-.55-.45-1-1-1H8v-2h2c.55 0 1-.45 1-1V7h2c1.1 0 2-.9 2-2v-.41c2.93 1.19 5 4.06 5 7.41 0 2.08-.8 3.97-2.1 5.39z"/>"#;
    let npm_icon = r#"<path fill="currentColor" d="M0 7.334v8h6.666v1.332H12v-1.332h12v-8H0zm6.666 6.664H5.334v-4H3.999v4H1.335V8.667h5.331v5.331zm4 0v1.336H8.001V8.667h5.334v5.332h-2.669v-.001zm12.001 0h-1.33v-4h-1.336v4h-1.335v-4h-1.33v4h-2.671V8.667h8.002v5.331zM10.665 10H12v2.667h-1.335V10z"/>"#;
-    let cargo_icon = r#"<path fill="currentColor" d="M23.834 8.101a13.912 13.912 0 0 1-13.643 11.72 10.105 10.105 0 0 1-1.994-.12 6.111 6.111 0 0 1-5.082-5.761 5.934 5.934 0 0 1 11.867-.084c.025.983-.401 1.846-1.277 1.871-.936 0-1.374-.668-1.374-1.567v-2.5a1.531 1.531 0 0 0-1.52-1.533H8.715a3.648 3.648 0 1 0 2.695 6.08l.073-.11.074.121a2.58 2.58 0 0 0 2.2 1.048 2.909 2.909 0 0 0 2.695-3.04 7.912 7.912 0 0 0-.217-1.933 7.404 7.404 0 0 0-14.64 1.603 7.497 7.497 0 0 0 7.308 7.405 12.822 12.822 0 0 0 2.14-.12 11.927 11.927 0 0 0 9.98-10.023.117.117 0 0 0-.043-.117.115.115 0 0 0-.084-.023l-.09.024a.116.116 0 0 1-.147-.085.116.116 0 0 1 .054-.133zm-14.49 7.072a2.162 2.162 0 1 1 0-4.324 2.162 2.162 0 0 1 0 4.324z"/>"#;
+    let cargo_icon = r#"<path fill="currentColor" d="M20 8h-3V4H3c-1.1 0-2 .9-2 2v11h2c0 1.66 1.34 3 3 3s3-1.34 3-3h6c0 1.66 1.34 3 3 3s3-1.34 3-3h2v-5l-3-4zM6 18.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5zm13.5-9l1.96 2.5H17V9.5h2.5zm-1.5 9c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5z"/>"#;
    let pypi_icon = r#"<path fill="currentColor" d="M14.25.18l.9.2.73.26.59.3.45.32.34.34.25.34.16.33.1.3.04.26.02.2-.01.13V8.5l-.05.63-.13.55-.21.46-.26.38-.3.31-.33.25-.35.19-.35.14-.33.1-.3.07-.26.04-.21.02H8.83l-.69.05-.59.14-.5.22-.41.27-.33.32-.27.35-.2.36-.15.37-.1.35-.07.32-.04.27-.02.21v3.06H3.23l-.21-.03-.28-.07-.32-.12-.35-.18-.36-.26-.36-.36-.35-.46-.32-.59-.28-.73-.21-.88-.14-1.05L0 11.97l.06-1.22.16-1.04.24-.87.32-.71.36-.57.4-.44.42-.33.42-.24.4-.16.36-.1.32-.05.24-.01h.16l.06.01h8.16v-.83H6.24l-.01-2.75-.02-.37.05-.34.11-.31.17-.28.25-.26.31-.23.38-.2.44-.18.51-.15.58-.12.64-.1.71-.06.77-.04.84-.02 1.27.05 1.07.13zm-6.3 1.98l-.23.33-.08.41.08.41.23.34.33.22.41.09.41-.09.33-.22.23-.34.08-.41-.08-.41-.23-.33-.33-.22-.41-.09-.41.09-.33.22zM21.1 6.11l.28.06.32.12.35.18.36.27.36.35.35.47.32.59.28.73.21.88.14 1.04.05 1.23-.06 1.23-.16 1.04-.24.86-.32.71-.36.57-.4.45-.42.33-.42.24-.4.16-.36.09-.32.05-.24.02-.16-.01h-8.22v.82h5.84l.01 2.76.02.36-.05.34-.11.31-.17.29-.25.25-.31.24-.38.2-.44.17-.51.15-.58.13-.64.09-.71.07-.77.04-.84.01-1.27-.04-1.07-.14-.9-.2-.73-.25-.59-.3-.45-.33-.34-.34-.25-.34-.16-.33-.1-.3-.04-.25-.02-.2.01-.13v-5.34l.05-.64.13-.54.21-.46.26-.38.3-.32.33-.24.35-.2.35-.14.33-.1.3-.06.26-.04.21-.02.13-.01h5.84l.69-.05.59-.14.5-.21.41-.28.33-.32.27-.35.2-.36.15-.36.1-.35.07-.32.04-.28.02-.21V6.07h2.09l.14.01.21.03zm-6.47 14.25l-.23.33-.08.41.08.41.23.33.33.23.41.08.41-.08.33-.23.23-.33.08-.41-.08-.41-.23-.33-.33-.23-.41-.08-.41.08-.33.23z"/>"#;

+    // Dashboard label is translated, registry names stay as-is
+    let dashboard_label = t.nav_dashboard;
+
    let nav_items = [
        (
            "dashboard",
            "/ui/",
-            "Dashboard",
+            dashboard_label,
            r#"<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6"/>"#,
            true,
        ),
@@ -186,7 +137,7 @@ fn sidebar_dark(active_page: Option<&str>) -> String {
        <div id="sidebar" class="fixed md:static inset-y-0 left-0 z-50 w-64 bg-slate-800 text-white flex flex-col transform -translate-x-full md:translate-x-0 transition-transform duration-200 ease-in-out">
            <div class="h-16 flex items-center justify-between px-6 border-b border-slate-700">
                <div class="flex items-center">
-                    <img src="{}" alt="NORA" class="h-8" />
+                    <span class="text-2xl font-bold tracking-tight">N<span class="inline-block w-5 h-5 rounded-full border-2 border-current align-middle relative -top-0.5 mx-0.5"></span>RA</span>
                </div>
                <button onclick="toggleSidebar()" class="md:hidden p-1 rounded-lg hover:bg-slate-700">
                    <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -195,12 +146,9 @@ fn sidebar_dark(active_page: Option<&str>) -> String {
                </button>
            </div>
            <nav class="flex-1 px-4 py-6 space-y-1 overflow-y-auto">
-                <div class="text-xs font-semibold text-slate-400 uppercase tracking-wider px-4 mb-3">
-                    Navigation
-                </div>
                {}
-                <div class="text-xs font-semibold text-slate-400 uppercase tracking-wider px-4 mt-8 mb-3">
-                    Registries
+                <div class="text-xs font-semibold text-slate-400 uppercase tracking-wider px-4 mt-6 mb-3">
+                    {}
                </div>
            </nav>
            <div class="px-4 py-4 border-t border-slate-700">
@@ -210,15 +158,25 @@ fn sidebar_dark(active_page: Option<&str>) -> String {
            </div>
        </div>
    "#,
-        super::logo::LOGO_BASE64,
-        nav_html,
-        VERSION
+        nav_html, t.nav_registries, VERSION
    )
 }

-/// Dark theme header
-fn header_dark() -> String {
-    r##"
+/// Dark theme header with language switcher
+fn header_dark(lang: Lang) -> String {
+    let (en_class, ru_class) = match lang {
+        Lang::En => (
+            "text-white font-semibold",
+            "text-slate-400 hover:text-slate-200",
+        ),
+        Lang::Ru => (
+            "text-slate-400 hover:text-slate-200",
+            "text-white font-semibold",
+        ),
+    };
+
+    format!(
+        r##"
        <header class="h-16 bg-[#1e293b] border-b border-slate-700 flex items-center justify-between px-4 md:px-6">
            <div class="flex items-center">
                <button onclick="toggleSidebar()" class="md:hidden p-2 -ml-2 mr-2 rounded-lg hover:bg-slate-700">
@@ -231,6 +189,12 @@ fn header_dark() -> String {
                </div>
            </div>
            <div class="flex items-center space-x-2 md:space-x-4">
+                <!-- Language switcher -->
+                <div class="flex items-center border border-slate-600 rounded-lg overflow-hidden text-sm">
+                    <button onclick="setLang('en')" class="px-3 py-1.5 {} transition-colors">EN</button>
+                    <span class="text-slate-600">|</span>
+                    <button onclick="setLang('ru')" class="px-3 py-1.5 {} transition-colors">RU</button>
+                </div>
                <a href="https://github.com/getnora-io/nora" target="_blank" class="p-2 text-slate-400 hover:text-slate-200 hover:bg-slate-700 rounded-lg">
                    <svg class="w-5 h-5" fill="currentColor" viewBox="0 0 24 24">
                        <path fill-rule="evenodd" d="M12 2C6.477 2 2 6.484 2 12.017c0 4.425 2.865 8.18 6.839 9.504.5.092.682-.217.682-.483 0-.237-.008-.868-.013-1.703-2.782.605-3.369-1.343-3.369-1.343-.454-1.158-1.11-1.466-1.11-1.466-.908-.62.069-.608.069-.608 1.003.07 1.531 1.032 1.531 1.032.892 1.53 2.341 1.088 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.113-4.555-4.951 0-1.093.39-1.988 1.029-2.688-.103-.253-.446-1.272.098-2.65 0 0 .84-.27 2.75 1.026A9.564 9.564 0 0112 6.844c.85.004 1.705.115 2.504.337 1.909-1.296 2.747-1.027 2.747-1.027.546 1.379.202 2.398.1 2.651.64.7 1.028 1.595 1.028 2.688 0 3.848-2.339 4.695-4.566 4.943.359.309.678.92.678 1.855 0 1.338-.012 2.419-.012 2.747 0 .268.18.58.688.482A10.019 10.019 0 0022 12.017C22 6.484 17.522 2 12 2z" clip-rule="evenodd"/>
@@ -243,7 +207,9 @@ fn header_dark() -> String {
                </a>
            </div>
        </header>
-    "##.to_string()
+    "##,
+        en_class, ru_class
+    )
 }

 /// Render global stats row (5-column grid)
@@ -253,41 +219,49 @@ pub fn render_global_stats(
    artifacts: u64,
    cache_hit_percent: f64,
    storage_bytes: u64,
+    lang: Lang,
 ) -> String {
+    let t = get_translations(lang);
    format!(
        r##"
        <div class="grid grid-cols-2 md:grid-cols-3 lg:grid-cols-5 gap-4 mb-6">
            <div class="bg-[#1e293b] rounded-lg p-4 border border-slate-700">
-                <div class="text-slate-400 text-sm mb-1">Downloads</div>
+                <div class="text-slate-400 text-sm mb-1">{}</div>
                <div id="stat-downloads" class="text-2xl font-bold text-slate-200">{}</div>
            </div>
            <div class="bg-[#1e293b] rounded-lg p-4 border border-slate-700">
-                <div class="text-slate-400 text-sm mb-1">Uploads</div>
+                <div class="text-slate-400 text-sm mb-1">{}</div>
                <div id="stat-uploads" class="text-2xl font-bold text-slate-200">{}</div>
            </div>
            <div class="bg-[#1e293b] rounded-lg p-4 border border-slate-700">
-                <div class="text-slate-400 text-sm mb-1">Artifacts</div>
+                <div class="text-slate-400 text-sm mb-1">{}</div>
                <div id="stat-artifacts" class="text-2xl font-bold text-slate-200">{}</div>
            </div>
            <div class="bg-[#1e293b] rounded-lg p-4 border border-slate-700">
-                <div class="text-slate-400 text-sm mb-1">Cache Hit</div>
+                <div class="text-slate-400 text-sm mb-1">{}</div>
                <div id="stat-cache-hit" class="text-2xl font-bold text-slate-200">{:.1}%</div>
            </div>
            <div class="bg-[#1e293b] rounded-lg p-4 border border-slate-700">
-                <div class="text-slate-400 text-sm mb-1">Storage</div>
+                <div class="text-slate-400 text-sm mb-1">{}</div>
                <div id="stat-storage" class="text-2xl font-bold text-slate-200">{}</div>
            </div>
        </div>
        "##,
+        t.stat_downloads,
        downloads,
+        t.stat_uploads,
        uploads,
+        t.stat_artifacts,
        artifacts,
+        t.stat_cache_hit,
        cache_hit_percent,
+        t.stat_storage,
        format_size(storage_bytes)
    )
 }

 /// Render registry card with extended metrics
+#[allow(clippy::too_many_arguments)]
 pub fn render_registry_card(
    name: &str,
    icon_path: &str,
@@ -296,6 +270,7 @@ pub fn render_registry_card(
    uploads: u64,
    size_bytes: u64,
    href: &str,
+    t: &Translations,
 ) -> String {
    format!(
        r##"
@@ -304,24 +279,24 @@ pub fn render_registry_card(
                <svg class="w-8 h-8 text-slate-400" fill="currentColor" viewBox="0 0 24 24">
                    {}
                </svg>
-                <span class="text-xs font-medium text-green-400 bg-green-400/10 px-2 py-1 rounded-full">ACTIVE</span>
+                <span class="text-xs font-medium text-green-400 bg-green-400/10 px-2 py-1 rounded-full">{}</span>
            </div>
            <div class="text-lg font-semibold text-slate-200 mb-2">{}</div>
            <div class="grid grid-cols-2 gap-2 text-sm">
                <div>
-                    <span class="text-slate-500">Artifacts</span>
+                    <span class="text-slate-500">{}</span>
                    <div class="text-slate-300 font-medium">{}</div>
                </div>
                <div>
-                    <span class="text-slate-500">Size</span>
+                    <span class="text-slate-500">{}</span>
                    <div class="text-slate-300 font-medium">{}</div>
                </div>
                <div>
-                    <span class="text-slate-500">Downloads</span>
+                    <span class="text-slate-500">{}</span>
                    <div class="text-slate-300 font-medium">{}</div>
                </div>
                <div>
-                    <span class="text-slate-500">Uploads</span>
+                    <span class="text-slate-500">{}</span>
                    <div class="text-slate-300 font-medium">{}</div>
                </div>
            </div>
@@ -330,16 +305,24 @@ pub fn render_registry_card(
        href,
        name.to_lowercase(),
        icon_path,
+        t.active,
        name,
+        t.artifacts,
        artifact_count,
+        t.size,
        format_size(size_bytes),
+        t.downloads,
        downloads,
+        t.uploads,
        uploads
    )
 }

 /// Render mount points table
-pub fn render_mount_points_table(mount_points: &[(String, String, Option<String>)]) -> String {
+pub fn render_mount_points_table(
+    mount_points: &[(String, String, Option<String>)],
+    t: &Translations,
+) -> String {
    let rows: String = mount_points
        .iter()
        .map(|(registry, mount_path, proxy)| {
@@ -361,23 +344,25 @@ pub fn render_mount_points_table(mount_points: &[(String, String, Option<String>
        r##"
        <div class="bg-[#1e293b] rounded-lg border border-slate-700 overflow-hidden">
            <div class="px-4 py-3 border-b border-slate-700">
-                <h3 class="text-slate-200 font-semibold">Mount Points</h3>
+                <h3 class="text-slate-200 font-semibold">{}</h3>
+            </div>
+            <div class="overflow-auto max-h-80">
+                <table class="w-full">
+                    <thead class="sticky top-0 bg-slate-800">
+                        <tr class="text-left text-xs text-slate-500 uppercase border-b border-slate-700">
+                            <th class="px-4 py-2">{}</th>
+                            <th class="px-4 py-2">{}</th>
+                            <th class="px-4 py-2">{}</th>
+                        </tr>
+                    </thead>
+                    <tbody class="px-4">
+                        {}
+                    </tbody>
+                </table>
            </div>
-            <table class="w-full">
-                <thead>
-                    <tr class="text-left text-xs text-slate-500 uppercase border-b border-slate-700">
-                        <th class="px-4 py-2">Registry</th>
-                        <th class="px-4 py-2">Mount Path</th>
-                        <th class="px-4 py-2">Proxy Upstream</th>
-                    </tr>
-                </thead>
-                <tbody class="px-4">
-                    {}
-                </tbody>
-            </table>
        </div>
        "##,
-        rows
+        t.mount_points, t.registry, t.mount_path, t.proxy_upstream, rows
    )
 }

@@ -417,22 +402,23 @@ pub fn render_activity_row(
 }

 /// Render the activity log container
-pub fn render_activity_log(rows: &str) -> String {
+pub fn render_activity_log(rows: &str, t: &Translations) -> String {
    format!(
        r##"
        <div class="bg-[#1e293b] rounded-lg border border-slate-700 overflow-hidden">
-            <div class="px-4 py-3 border-b border-slate-700">
-                <h3 class="text-slate-200 font-semibold">Recent Activity</h3>
+            <div class="px-4 py-3 border-b border-slate-700 flex items-center justify-between">
+                <h3 class="text-slate-200 font-semibold">{}</h3>
+                <span class="text-xs text-slate-500">{}</span>
            </div>
-            <div class="overflow-x-auto">
+            <div class="overflow-auto max-h-80">
                <table class="w-full" id="activity-log">
-                    <thead>
+                    <thead class="sticky top-0 bg-slate-800">
                        <tr class="text-left text-xs text-slate-500 uppercase border-b border-slate-700">
-                            <th class="px-4 py-2">Time</th>
-                            <th class="px-4 py-2">Action</th>
-                            <th class="px-4 py-2">Artifact</th>
-                            <th class="px-4 py-2">Registry</th>
-                            <th class="px-4 py-2">Source</th>
+                            <th class="px-4 py-2">{}</th>
+                            <th class="px-4 py-2">{}</th>
+                            <th class="px-4 py-2">{}</th>
+                            <th class="px-4 py-2">{}</th>
+                            <th class="px-4 py-2">{}</th>
                        </tr>
                    </thead>
                    <tbody class="px-4">
@@ -442,6 +428,13 @@ pub fn render_activity_log(rows: &str) -> String {
            </div>
        </div>
        "##,
+        t.recent_activity,
+        t.last_n_events,
+        t.time,
+        t.action,
+        t.artifact,
+        t.registry,
+        t.source,
        rows
    )
 }
@@ -485,7 +478,8 @@ pub fn render_polling_script() -> String {
    "##.to_string()
 }

-/// Sidebar navigation component
+/// Sidebar navigation component (light theme, unused)
+#[allow(dead_code)]
 fn sidebar(active_page: Option<&str>) -> String {
    let active = active_page.unwrap_or("");

@@ -493,7 +487,7 @@ fn sidebar(active_page: Option<&str>) -> String {
    let docker_icon = r#"<path fill="currentColor" d="M13.983 11.078h2.119a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.119a.185.185 0 00-.185.185v1.888c0 .102.083.185.185.185m-2.954-5.43h2.118a.186.186 0 00.186-.186V3.574a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.186m0 2.716h2.118a.187.187 0 00.186-.186V6.29a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.887c0 .102.082.185.185.186m-2.93 0h2.12a.186.186 0 00.184-.186V6.29a.185.185 0 00-.185-.185H8.1a.185.185 0 00-.185.185v1.887c0 .102.083.185.185.186m-2.964 0h2.119a.186.186 0 00.185-.186V6.29a.185.185 0 00-.185-.185H5.136a.186.186 0 00-.186.185v1.887c0 .102.084.185.186.186m5.893 2.715h2.118a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m-2.93 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.083.185.185.185m-2.964 0h2.119a.185.185 0 00.185-.185V9.006a.185.185 0 00-.185-.186h-2.12a.186.186 0 00-.185.186v1.887c0 .102.084.185.186.185m-2.92 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.082.185.185.185M23.763 9.89c-.065-.051-.672-.51-1.954-.51-.338.001-.676.03-1.01.087-.248-1.7-1.653-2.53-1.716-2.566l-.344-.199-.226.327c-.284.438-.49.922-.612 1.43-.23.97-.09 1.882.403 2.661-.595.332-1.55.413-1.744.42H.751a.751.751 0 00-.75.748 11.376 11.376 0 00.692 4.062c.545 1.428 1.355 2.48 2.41 3.124 1.18.723 3.1 1.137 5.275 1.137.983.003 1.963-.086 2.93-.266a12.248 12.248 0 003.823-1.389c.98-.567 1.86-1.288 2.61-2.136 1.252-1.418 1.998-2.997 2.553-4.4h.221c1.372 0 2.215-.549 2.68-1.009.309-.293.55-.65.707-1.046l.098-.288Z"/>"#;
    let maven_icon = r#"<path fill="currentColor" d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-1 17.93c-3.95-.49-7-3.85-7-7.93 0-.62.08-1.21.21-1.79L9 15v1c0 1.1.9 2 2 2v1.93zm6.9-2.54c-.26-.81-1-1.39-1.9-1.39h-1v-3c0-.55-.45-1-1-1H8v-2h2c.55 0 1-.45 1-1V7h2c1.1 0 2-.9 2-2v-.41c2.93 1.19 5 4.06 5 7.41 0 2.08-.8 3.97-2.1 5.39z"/>"#;
    let npm_icon = r#"<path fill="currentColor" d="M0 7.334v8h6.666v1.332H12v-1.332h12v-8H0zm6.666 6.664H5.334v-4H3.999v4H1.335V8.667h5.331v5.331zm4 0v1.336H8.001V8.667h5.334v5.332h-2.669v-.001zm12.001 0h-1.33v-4h-1.336v4h-1.335v-4h-1.33v4h-2.671V8.667h8.002v5.331zM10.665 10H12v2.667h-1.335V10z"/>"#;
-    let cargo_icon = r#"<path fill="currentColor" d="M23.834 8.101a13.912 13.912 0 0 1-13.643 11.72 10.105 10.105 0 0 1-1.994-.12 6.111 6.111 0 0 1-5.082-5.761 5.934 5.934 0 0 1 11.867-.084c.025.983-.401 1.846-1.277 1.871-.936 0-1.374-.668-1.374-1.567v-2.5a1.531 1.531 0 0 0-1.52-1.533H8.715a3.648 3.648 0 1 0 2.695 6.08l.073-.11.074.121a2.58 2.58 0 0 0 2.2 1.048 2.909 2.909 0 0 0 2.695-3.04 7.912 7.912 0 0 0-.217-1.933 7.404 7.404 0 0 0-14.64 1.603 7.497 7.497 0 0 0 7.308 7.405 12.822 12.822 0 0 0 2.14-.12 11.927 11.927 0 0 0 9.98-10.023.117.117 0 0 0-.043-.117.115.115 0 0 0-.084-.023l-.09.024a.116.116 0 0 1-.147-.085.116.116 0 0 1 .054-.133zm-14.49 7.072a2.162 2.162 0 1 1 0-4.324 2.162 2.162 0 0 1 0 4.324z"/>"#;
+    let cargo_icon = r#"<path fill="currentColor" d="M20 8h-3V4H3c-1.1 0-2 .9-2 2v11h2c0 1.66 1.34 3 3 3s3-1.34 3-3h6c0 1.66 1.34 3 3 3s3-1.34 3-3h2v-5l-3-4zM6 18.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5zm13.5-9l1.96 2.5H17V9.5h2.5zm-1.5 9c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5z"/>"#;
    let pypi_icon = r#"<path fill="currentColor" d="M14.25.18l.9.2.73.26.59.3.45.32.34.34.25.34.16.33.1.3.04.26.02.2-.01.13V8.5l-.05.63-.13.55-.21.46-.26.38-.3.31-.33.25-.35.19-.35.14-.33.1-.3.07-.26.04-.21.02H8.83l-.69.05-.59.14-.5.22-.41.27-.33.32-.27.35-.2.36-.15.37-.1.35-.07.32-.04.27-.02.21v3.06H3.23l-.21-.03-.28-.07-.32-.12-.35-.18-.36-.26-.36-.36-.35-.46-.32-.59-.28-.73-.21-.88-.14-1.05L0 11.97l.06-1.22.16-1.04.24-.87.32-.71.36-.57.4-.44.42-.33.42-.24.4-.16.36-.1.32-.05.24-.01h.16l.06.01h8.16v-.83H6.24l-.01-2.75-.02-.37.05-.34.11-.31.17-.28.25-.26.31-.23.38-.2.44-.18.51-.15.58-.12.64-.1.71-.06.77-.04.84-.02 1.27.05 1.07.13zm-6.3 1.98l-.23.33-.08.41.08.41.23.34.33.22.41.09.41-.09.33-.22.23-.34.08-.41-.08-.41-.23-.33-.33-.22-.41-.09-.41.09-.33.22zM21.1 6.11l.28.06.32.12.35.18.36.27.36.35.35.47.32.59.28.73.21.88.14 1.04.05 1.23-.06 1.23-.16 1.04-.24.86-.32.71-.36.57-.4.45-.42.33-.42.24-.4.16-.36.09-.32.05-.24.02-.16-.01h-8.22v.82h5.84l.01 2.76.02.36-.05.34-.11.31-.17.29-.25.25-.31.24-.38.2-.44.17-.51.15-.58.13-.64.09-.71.07-.77.04-.84.01-1.27-.04-1.07-.14-.9-.2-.73-.25-.59-.3-.45-.33-.34-.34-.25-.34-.16-.33-.1-.3-.04-.25-.02-.2.01-.13v-5.34l.05-.64.13-.54.21-.46.26-.38.3-.32.33-.24.35-.2.35-.14.33-.1.3-.06.26-.04.21-.02.13-.01h5.84l.69-.05.59-.14.5-.21.41-.28.33-.32.27-.35.2-.36.15-.36.1-.35.07-.32.04-.28.02-.21V6.07h2.09l.14.01.21.03zm-6.47 14.25l-.23.33-.08.41.08.41.23.33.33.23.41.08.41-.08.33-.23.23-.33.08-.41-.08-.41-.23-.33-.33-.23-.41-.08-.41.08-.33.23z"/>"#;

    let nav_items = [
@@ -578,7 +572,8 @@ fn sidebar(active_page: Option<&str>) -> String {
    )
 }

-/// Header component
+/// Header component (light theme, unused)
+#[allow(dead_code)]
 fn header() -> String {
    r##"
        <header class="h-16 bg-white border-b border-slate-200 flex items-center justify-between px-4 md:px-6">
@@ -615,7 +610,7 @@ pub mod icons {
    pub const DOCKER: &str = r#"<path fill="currentColor" d="M13.983 11.078h2.119a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.119a.185.185 0 00-.185.185v1.888c0 .102.083.185.185.185m-2.954-5.43h2.118a.186.186 0 00.186-.186V3.574a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.186m0 2.716h2.118a.187.187 0 00.186-.186V6.29a.186.186 0 00-.186-.185h-2.118a.185.185 0 00-.185.185v1.887c0 .102.082.185.185.186m-2.93 0h2.12a.186.186 0 00.184-.186V6.29a.185.185 0 00-.185-.185H8.1a.185.185 0 00-.185.185v1.887c0 .102.083.185.185.186m-2.964 0h2.119a.186.186 0 00.185-.186V6.29a.185.185 0 00-.185-.185H5.136a.186.186 0 00-.186.185v1.887c0 .102.084.185.186.186m5.893 2.715h2.118a.186.186 0 00.186-.185V9.006a.186.186 0 00-.186-.186h-2.118a.185.185 0 00-.185.185v1.888c0 .102.082.185.185.185m-2.93 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.083.185.185.185m-2.964 0h2.119a.185.185 0 00.185-.185V9.006a.185.185 0 00-.185-.186h-2.12a.186.186 0 00-.185.186v1.887c0 .102.084.185.186.185m-2.92 0h2.12a.185.185 0 00.184-.185V9.006a.185.185 0 00-.184-.186h-2.12a.185.185 0 00-.184.185v1.888c0 .102.082.185.185.185M23.763 9.89c-.065-.051-.672-.51-1.954-.51-.338.001-.676.03-1.01.087-.248-1.7-1.653-2.53-1.716-2.566l-.344-.199-.226.327c-.284.438-.49.922-.612 1.43-.23.97-.09 1.882.403 2.661-.595.332-1.55.413-1.744.42H.751a.751.751 0 00-.75.748 11.376 11.376 0 00.692 4.062c.545 1.428 1.355 2.48 2.41 3.124 1.18.723 3.1 1.137 5.275 1.137.983.003 1.963-.086 2.93-.266a12.248 12.248 0 003.823-1.389c.98-.567 1.86-1.288 2.61-2.136 1.252-1.418 1.998-2.997 2.553-4.4h.221c1.372 0 2.215-.549 2.68-1.009.309-.293.55-.65.707-1.046l.098-.288Z"/>"#;
    pub const MAVEN: &str = r#"<path fill="currentColor" d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-1 17.93c-3.95-.49-7-3.85-7-7.93 0-.62.08-1.21.21-1.79L9 15v1c0 1.1.9 2 2 2v1.93zm6.9-2.54c-.26-.81-1-1.39-1.9-1.39h-1v-3c0-.55-.45-1-1-1H8v-2h2c.55 0 1-.45 1-1V7h2c1.1 0 2-.9 2-2v-.41c2.93 1.19 5 4.06 5 7.41 0 2.08-.8 3.97-2.1 5.39z"/>"#;
    pub const NPM: &str = r#"<path fill="currentColor" d="M0 7.334v8h6.666v1.332H12v-1.332h12v-8H0zm6.666 6.664H5.334v-4H3.999v4H1.335V8.667h5.331v5.331zm4 0v1.336H8.001V8.667h5.334v5.332h-2.669v-.001zm12.001 0h-1.33v-4h-1.336v4h-1.335v-4h-1.33v4h-2.671V8.667h8.002v5.331zM10.665 10H12v2.667h-1.335V10z"/>"#;
-    pub const CARGO: &str = r#"<path fill="currentColor" d="M23.834 8.101a13.912 13.912 0 0 1-13.643 11.72 10.105 10.105 0 0 1-1.994-.12 6.111 6.111 0 0 1-5.082-5.761 5.934 5.934 0 0 1 11.867-.084c.025.983-.401 1.846-1.277 1.871-.936 0-1.374-.668-1.374-1.567v-2.5a1.531 1.531 0 0 0-1.52-1.533H8.715a3.648 3.648 0 1 0 2.695 6.08l.073-.11.074.121a2.58 2.58 0 0 0 2.2 1.048 2.909 2.909 0 0 0 2.695-3.04 7.912 7.912 0 0 0-.217-1.933 7.404 7.404 0 0 0-14.64 1.603 7.497 7.497 0 0 0 7.308 7.405 12.822 12.822 0 0 0 2.14-.12 11.927 11.927 0 0 0 9.98-10.023.117.117 0 0 0-.043-.117.115.115 0 0 0-.084-.023l-.09.024a.116.116 0 0 1-.147-.085.116.116 0 0 1 .054-.133zm-14.49 7.072a2.162 2.162 0 1 1 0-4.324 2.162 2.162 0 0 1 0 4.324z"/>"#;
+    pub const CARGO: &str = r#"<path fill="currentColor" d="M20 8h-3V4H3c-1.1 0-2 .9-2 2v11h2c0 1.66 1.34 3 3 3s3-1.34 3-3h6c0 1.66 1.34 3 3 3s3-1.34 3-3h2v-5l-3-4zM6 18.5c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5zm13.5-9l1.96 2.5H17V9.5h2.5zm-1.5 9c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5z"/>"#;
    pub const PYPI: &str = r#"<path fill="currentColor" d="M14.25.18l.9.2.73.26.59.3.45.32.34.34.25.34.16.33.1.3.04.26.02.2-.01.13V8.5l-.05.63-.13.55-.21.46-.26.38-.3.31-.33.25-.35.19-.35.14-.33.1-.3.07-.26.04-.21.02H8.83l-.69.05-.59.14-.5.22-.41.27-.33.32-.27.35-.2.36-.15.37-.1.35-.07.32-.04.27-.02.21v3.06H3.23l-.21-.03-.28-.07-.32-.12-.35-.18-.36-.26-.36-.36-.35-.46-.32-.59-.28-.73-.21-.88-.14-1.05L0 11.97l.06-1.22.16-1.04.24-.87.32-.71.36-.57.4-.44.42-.33.42-.24.4-.16.36-.1.32-.05.24-.01h.16l.06.01h8.16v-.83H6.24l-.01-2.75-.02-.37.05-.34.11-.31.17-.28.25-.26.31-.23.38-.2.44-.18.51-.15.58-.12.64-.1.71-.06.77-.04.84-.02 1.27.05 1.07.13zm-6.3 1.98l-.23.33-.08.41.08.41.23.34.33.22.41.09.41-.09.33-.22.23-.34.08-.41-.08-.41-.23-.33-.33-.22-.41-.09-.41.09-.33.22zM21.1 6.11l.28.06.32.12.35.18.36.27.36.35.35.47.32.59.28.73.21.88.14 1.04.05 1.23-.06 1.23-.16 1.04-.24.86-.32.71-.36.57-.4.45-.42.33-.42.24-.4.16-.36.09-.32.05-.24.02-.16-.01h-8.22v.82h5.84l.01 2.76.02.36-.05.34-.11.31-.17.29-.25.25-.31.24-.38.2-.44.17-.51.15-.58.13-.64.09-.71.07-.77.04-.84.01-1.27-.04-1.07-.14-.9-.2-.73-.25-.59-.3-.45-.33-.34-.34-.25-.34-.16-.33-.1-.3-.04-.25-.02-.2.01-.13v-5.34l.05-.64.13-.54.21-.46.26-.38.3-.32.33-.24.35-.2.35-.14.33-.1.3-.06.26-.04.21-.02.13-.01h5.84l.69-.05.59-.14.5-.21.41-.28.33-.32.27-.35.2-.36.15-.36.1-.35.07-.32.04-.28.02-.21V6.07h2.09l.14.01.21.03zm-6.47 14.25l-.23.33-.08.41.08.41.23.33.33.23.41.08.41-.08.33-.23.23-.33.08-.41-.08-.41-.23-.33-.33-.23-.41-.08-.41.08-.33.23z"/>"#;
 }

@@ -666,6 +661,57 @@ pub fn html_escape(s: &str) -> String {
        .replace('\'', "&#39;")
 }

+/// Render the "bragging" footer with NORA stats
+pub fn render_bragging_footer(lang: Lang) -> String {
+    let t = get_translations(lang);
+    format!(
+        r##"
+    <div class="mt-8 bg-gradient-to-r from-slate-800 to-slate-900 rounded-lg border border-slate-700 p-6">
+        <div class="text-center mb-4">
+            <span class="text-slate-400 text-sm uppercase tracking-wider">{}</span>
+        </div>
+        <div class="grid grid-cols-2 md:grid-cols-3 lg:grid-cols-6 gap-4 text-center">
+            <div class="p-3">
+                <div class="text-2xl font-bold text-blue-400">34 MB</div>
+                <div class="text-xs text-slate-500 mt-1">{}</div>
+            </div>
+            <div class="p-3">
+                <div class="text-2xl font-bold text-green-400">&lt;1s</div>
+                <div class="text-xs text-slate-500 mt-1">{}</div>
+            </div>
+            <div class="p-3">
+                <div class="text-2xl font-bold text-purple-400">~30 MB</div>
+                <div class="text-xs text-slate-500 mt-1">{}</div>
+            </div>
+            <div class="p-3">
+                <div class="text-2xl font-bold text-yellow-400">5</div>
+                <div class="text-xs text-slate-500 mt-1">{}</div>
+            </div>
+            <div class="p-3">
+                <div class="text-2xl font-bold text-pink-400">{}</div>
+                <div class="text-xs text-slate-500 mt-1">amd64 / arm64</div>
+            </div>
+            <div class="p-3">
+                <div class="text-2xl font-bold text-cyan-400">{}</div>
+                <div class="text-xs text-slate-500 mt-1">Config</div>
+            </div>
+        </div>
+        <div class="text-center mt-4">
+            <span class="text-slate-500 text-xs">{}</span>
+        </div>
+    </div>
+    "##,
+        t.built_for_speed,
+        t.docker_image,
+        t.cold_start,
+        t.memory,
+        t.registries_count,
+        t.multi_arch,
+        t.zero_config,
+        t.tagline
+    )
+}
+
 /// Format Unix timestamp as relative time
 pub fn format_timestamp(ts: u64) -> String {
    if ts == 0 {
--- a/nora-registry/src/ui/i18n.rs
+++ b/nora-registry/src/ui/i18n.rs
@@ -0,0 +1,272 @@
+/// Internationalization support for the UI
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Lang {
+    #[default]
+    En,
+    Ru,
+}
+
+impl Lang {
+    pub fn from_str(s: &str) -> Self {
+        match s.to_lowercase().as_str() {
+            "ru" | "rus" | "russian" => Lang::Ru,
+            _ => Lang::En,
+        }
+    }
+
+    pub fn code(&self) -> &'static str {
+        match self {
+            Lang::En => "en",
+            Lang::Ru => "ru",
+        }
+    }
+}
+
+/// All translatable strings
+#[allow(dead_code)]
+pub struct Translations {
+    // Navigation
+    pub nav_dashboard: &'static str,
+    pub nav_registries: &'static str,
+
+    // Dashboard
+    pub dashboard_title: &'static str,
+    pub dashboard_subtitle: &'static str,
+    pub uptime: &'static str,
+
+    // Stats
+    pub stat_downloads: &'static str,
+    pub stat_uploads: &'static str,
+    pub stat_artifacts: &'static str,
+    pub stat_cache_hit: &'static str,
+    pub stat_storage: &'static str,
+
+    // Registry cards
+    pub active: &'static str,
+    pub artifacts: &'static str,
+    pub size: &'static str,
+    pub downloads: &'static str,
+    pub uploads: &'static str,
+
+    // Mount points
+    pub mount_points: &'static str,
+    pub registry: &'static str,
+    pub mount_path: &'static str,
+    pub proxy_upstream: &'static str,
+
+    // Activity
+    pub recent_activity: &'static str,
+    pub last_n_events: &'static str,
+    pub time: &'static str,
+    pub action: &'static str,
+    pub artifact: &'static str,
+    pub source: &'static str,
+    pub no_activity: &'static str,
+
+    // Relative time
+    pub just_now: &'static str,
+    pub min_ago: &'static str,
+    pub mins_ago: &'static str,
+    pub hour_ago: &'static str,
+    pub hours_ago: &'static str,
+    pub day_ago: &'static str,
+    pub days_ago: &'static str,
+
+    // Registry pages
+    pub repositories: &'static str,
+    pub search_placeholder: &'static str,
+    pub no_repos_found: &'static str,
+    pub push_first_artifact: &'static str,
+    pub name: &'static str,
+    pub tags: &'static str,
+    pub versions: &'static str,
+    pub updated: &'static str,
+
+    // Detail pages
+    pub pull_command: &'static str,
+    pub install_command: &'static str,
+    pub maven_dependency: &'static str,
+    pub total: &'static str,
+    pub created: &'static str,
+    pub published: &'static str,
+    pub filename: &'static str,
+    pub files: &'static str,
+
+    // Bragging footer
+    pub built_for_speed: &'static str,
+    pub docker_image: &'static str,
+    pub cold_start: &'static str,
+    pub memory: &'static str,
+    pub registries_count: &'static str,
+    pub multi_arch: &'static str,
+    pub zero_config: &'static str,
+    pub tagline: &'static str,
+}
+
+pub fn get_translations(lang: Lang) -> &'static Translations {
+    match lang {
+        Lang::En => &TRANSLATIONS_EN,
+        Lang::Ru => &TRANSLATIONS_RU,
+    }
+}
+
+pub static TRANSLATIONS_EN: Translations = Translations {
+    // Navigation
+    nav_dashboard: "Dashboard",
+    nav_registries: "Registries",
+
+    // Dashboard
+    dashboard_title: "Dashboard",
+    dashboard_subtitle: "Overview of all registries",
+    uptime: "Uptime",
+
+    // Stats
+    stat_downloads: "Downloads",
+    stat_uploads: "Uploads",
+    stat_artifacts: "Artifacts",
+    stat_cache_hit: "Cache Hit",
+    stat_storage: "Storage",
+
+    // Registry cards
+    active: "ACTIVE",
+    artifacts: "Artifacts",
+    size: "Size",
+    downloads: "Downloads",
+    uploads: "Uploads",
+
+    // Mount points
+    mount_points: "Mount Points",
+    registry: "Registry",
+    mount_path: "Mount Path",
+    proxy_upstream: "Proxy Upstream",
+
+    // Activity
+    recent_activity: "Recent Activity",
+    last_n_events: "Last 20 events",
+    time: "Time",
+    action: "Action",
+    artifact: "Artifact",
+    source: "Source",
+    no_activity: "No recent activity",
+
+    // Relative time
+    just_now: "just now",
+    min_ago: "min ago",
+    mins_ago: "mins ago",
+    hour_ago: "hour ago",
+    hours_ago: "hours ago",
+    day_ago: "day ago",
+    days_ago: "days ago",
+
+    // Registry pages
+    repositories: "repositories",
+    search_placeholder: "Search repositories...",
+    no_repos_found: "No repositories found",
+    push_first_artifact: "Push your first artifact to see it here",
+    name: "Name",
+    tags: "Tags",
+    versions: "Versions",
+    updated: "Updated",
+
+    // Detail pages
+    pull_command: "Pull Command",
+    install_command: "Install Command",
+    maven_dependency: "Maven Dependency",
+    total: "total",
+    created: "Created",
+    published: "Published",
+    filename: "Filename",
+    files: "files",
+
+    // Bragging footer
+    built_for_speed: "Built for speed",
+    docker_image: "Docker Image",
+    cold_start: "Cold Start",
+    memory: "Memory",
+    registries_count: "Registries",
+    multi_arch: "Multi-arch",
+    zero_config: "Zero",
+    tagline: "Pure Rust. Single binary. OCI compatible.",
+};
+
+pub static TRANSLATIONS_RU: Translations = Translations {
+    // Navigation
+    nav_dashboard: "Панель",
+    nav_registries: "Реестры",
+
+    // Dashboard
+    dashboard_title: "Панель управления",
+    dashboard_subtitle: "Обзор всех реестров",
+    uptime: "Аптайм",
+
+    // Stats
+    stat_downloads: "Загрузки",
+    stat_uploads: "Публикации",
+    stat_artifacts: "Артефакты",
+    stat_cache_hit: "Кэш",
+    stat_storage: "Хранилище",
+
+    // Registry cards
+    active: "АКТИВЕН",
+    artifacts: "Артефакты",
+    size: "Размер",
+    downloads: "Загрузки",
+    uploads: "Публикации",
+
+    // Mount points
+    mount_points: "Точки монтирования",
+    registry: "Реестр",
+    mount_path: "Путь",
+    proxy_upstream: "Прокси",
+
+    // Activity
+    recent_activity: "Последняя активность",
+    last_n_events: "Последние 20 событий",
+    time: "Время",
+    action: "Действие",
+    artifact: "Артефакт",
+    source: "Источник",
+    no_activity: "Нет активности",
+
+    // Relative time
+    just_now: "только что",
+    min_ago: "мин назад",
+    mins_ago: "мин назад",
+    hour_ago: "час назад",
+    hours_ago: "ч назад",
+    day_ago: "день назад",
+    days_ago: "дн назад",
+
+    // Registry pages
+    repositories: "репозиториев",
+    search_placeholder: "Поиск репозиториев...",
+    no_repos_found: "Репозитории не найдены",
+    push_first_artifact: "Загрузите первый артефакт, чтобы увидеть его здесь",
+    name: "Название",
+    tags: "Теги",
+    versions: "Версии",
+    updated: "Обновлено",
+
+    // Detail pages
+    pull_command: "Команда загрузки",
+    install_command: "Команда установки",
+    maven_dependency: "Maven зависимость",
+    total: "всего",
+    created: "Создан",
+    published: "Опубликован",
+    filename: "Файл",
+    files: "файлов",
+
+    // Bragging footer
+    built_for_speed: "Создан для скорости",
+    docker_image: "Docker образ",
+    cold_start: "Холодный старт",
+    memory: "Память",
+    registries_count: "Реестров",
+    multi_arch: "Мульти-арх",
+    zero_config: "Без",
+    tagline: "Чистый Rust. Один бинарник. OCI совместимый.",
+};
--- a/nora-registry/src/ui/mod.rs
+++ b/nora-registry/src/ui/mod.rs
@@ -1,11 +1,12 @@
 mod api;
 mod components;
+pub mod i18n;
 mod logo;
 mod templates;

 use crate::AppState;
 use axum::{
-    extract::{Path, State},
+    extract::{Path, Query, State},
    response::{Html, IntoResponse, Redirect},
    routing::get,
    Router,
@@ -13,8 +14,33 @@ use axum::{
 use std::sync::Arc;

 use api::*;
+use i18n::Lang;
 use templates::*;

+#[derive(Debug, serde::Deserialize)]
+struct LangQuery {
+    lang: Option<String>,
+}
+
+fn extract_lang(query: &Query<LangQuery>, cookie_header: Option<&str>) -> Lang {
+    // Priority: query param > cookie > default
+    if let Some(ref lang) = query.lang {
+        return Lang::from_str(lang);
+    }
+
+    // Try cookie
+    if let Some(cookies) = cookie_header {
+        for part in cookies.split(';') {
+            let part = part.trim();
+            if let Some(value) = part.strip_prefix("nora_lang=") {
+                return Lang::from_str(value);
+            }
+        }
+    }
+
+    Lang::default()
+}
+
 pub fn routes() -> Router<Arc<AppState>> {
    Router::new()
        // UI Pages
@@ -40,77 +66,175 @@ pub fn routes() -> Router<Arc<AppState>> {
 }

 // Dashboard page
-async fn dashboard(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+async fn dashboard(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let response = api_dashboard(State(state)).await.0;
-    Html(render_dashboard(&response))
+    Html(render_dashboard(&response, lang))
 }

 // Docker pages
-async fn docker_list(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+async fn docker_list(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let repos = get_docker_repos(&state.storage).await;
-    Html(render_registry_list("docker", "Docker Registry", &repos))
+    Html(render_registry_list(
+        "docker",
+        "Docker Registry",
+        &repos,
+        lang,
+    ))
 }

 async fn docker_detail(
    State(state): State<Arc<AppState>>,
    Path(name): Path<String>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
 ) -> impl IntoResponse {
-    let detail = get_docker_detail(&state.storage, &name).await;
-    Html(render_docker_detail(&name, &detail))
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
+    let detail = get_docker_detail(&state, &name).await;
+    Html(render_docker_detail(&name, &detail, lang))
 }

 // Maven pages
-async fn maven_list(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+async fn maven_list(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let repos = get_maven_repos(&state.storage).await;
-    Html(render_registry_list("maven", "Maven Repository", &repos))
+    Html(render_registry_list(
+        "maven",
+        "Maven Repository",
+        &repos,
+        lang,
+    ))
 }

 async fn maven_detail(
    State(state): State<Arc<AppState>>,
    Path(path): Path<String>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
 ) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let detail = get_maven_detail(&state.storage, &path).await;
-    Html(render_maven_detail(&path, &detail))
+    Html(render_maven_detail(&path, &detail, lang))
 }

 // npm pages
-async fn npm_list(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+async fn npm_list(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let packages = get_npm_packages(&state.storage).await;
-    Html(render_registry_list("npm", "npm Registry", &packages))
+    Html(render_registry_list("npm", "npm Registry", &packages, lang))
 }

 async fn npm_detail(
    State(state): State<Arc<AppState>>,
    Path(name): Path<String>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
 ) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let detail = get_npm_detail(&state.storage, &name).await;
-    Html(render_package_detail("npm", &name, &detail))
+    Html(render_package_detail("npm", &name, &detail, lang))
 }

 // Cargo pages
-async fn cargo_list(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+async fn cargo_list(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let crates = get_cargo_crates(&state.storage).await;
-    Html(render_registry_list("cargo", "Cargo Registry", &crates))
+    Html(render_registry_list(
+        "cargo",
+        "Cargo Registry",
+        &crates,
+        lang,
+    ))
 }

 async fn cargo_detail(
    State(state): State<Arc<AppState>>,
    Path(name): Path<String>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
 ) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let detail = get_cargo_detail(&state.storage, &name).await;
-    Html(render_package_detail("cargo", &name, &detail))
+    Html(render_package_detail("cargo", &name, &detail, lang))
 }

 // PyPI pages
-async fn pypi_list(State(state): State<Arc<AppState>>) -> impl IntoResponse {
+async fn pypi_list(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
+) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let packages = get_pypi_packages(&state.storage).await;
-    Html(render_registry_list("pypi", "PyPI Repository", &packages))
+    Html(render_registry_list(
+        "pypi",
+        "PyPI Repository",
+        &packages,
+        lang,
+    ))
 }

 async fn pypi_detail(
    State(state): State<Arc<AppState>>,
    Path(name): Path<String>,
+    Query(query): Query<LangQuery>,
+    headers: axum::http::HeaderMap,
 ) -> impl IntoResponse {
+    let lang = extract_lang(
+        &Query(query),
+        headers.get("cookie").and_then(|v| v.to_str().ok()),
+    );
    let detail = get_pypi_detail(&state.storage, &name).await;
-    Html(render_package_detail("pypi", &name, &detail))
+    Html(render_package_detail("pypi", &name, &detail, lang))
 }
--- a/nora-registry/src/ui/templates.rs
+++ b/nora-registry/src/ui/templates.rs
@@ -1,8 +1,10 @@
 use super::api::{DashboardResponse, DockerDetail, MavenDetail, PackageDetail, RepoInfo};
 use super::components::*;
+use super::i18n::{get_translations, Lang};

 /// Renders the main dashboard page with dark theme
-pub fn render_dashboard(data: &DashboardResponse) -> String {
+pub fn render_dashboard(data: &DashboardResponse, lang: Lang) -> String {
+    let t = get_translations(lang);
    // Render global stats
    let global_stats = render_global_stats(
        data.global_stats.downloads,
@@ -10,6 +12,7 @@ pub fn render_dashboard(data: &DashboardResponse) -> String {
        data.global_stats.artifacts,
        data.global_stats.cache_hit_percent,
        data.global_stats.storage_bytes,
+        lang,
    );

    // Render registry cards
@@ -41,6 +44,7 @@ pub fn render_dashboard(data: &DashboardResponse) -> String {
                r.uploads,
                r.size_bytes,
                &format!("/ui/{}", r.name),
+                t,
            )
        })
        .collect();
@@ -57,11 +61,14 @@ pub fn render_dashboard(data: &DashboardResponse) -> String {
            )
        })
        .collect();
-    let mount_points = render_mount_points_table(&mount_data);
+    let mount_points = render_mount_points_table(&mount_data, t);

    // Render activity log
    let activity_rows: String = if data.activity.is_empty() {
-        r##"<tr><td colspan="5" class="py-8 text-center text-slate-500">No recent activity</td></tr>"##.to_string()
+        format!(
+            r##"<tr><td colspan="5" class="py-8 text-center text-slate-500">{}</td></tr>"##,
+            t.no_activity
+        )
    } else {
        data.activity
            .iter()
@@ -77,23 +84,26 @@ pub fn render_dashboard(data: &DashboardResponse) -> String {
            })
            .collect()
    };
-    let activity_log = render_activity_log(&activity_rows);
+    let activity_log = render_activity_log(&activity_rows, t);

    // Format uptime
    let hours = data.uptime_seconds / 3600;
    let mins = (data.uptime_seconds % 3600) / 60;
    let uptime_str = format!("{}h {}m", hours, mins);

+    // Render bragging footer
+    let bragging_footer = render_bragging_footer(lang);
+
    let content = format!(
        r##"
        <div class="mb-6">
            <div class="flex items-center justify-between">
                <div>
-                    <h1 class="text-2xl font-bold text-slate-200 mb-1">Dashboard</h1>
-                    <p class="text-slate-400">Overview of all registries</p>
+                    <h1 class="text-2xl font-bold text-slate-200 mb-1">{}</h1>
+                    <p class="text-slate-400">{}</p>
                </div>
                <div class="text-right">
-                    <div class="text-sm text-slate-500">Uptime</div>
+                    <div class="text-sm text-slate-500">{}</div>
                    <div id="uptime" class="text-lg font-semibold text-slate-300">{}</div>
                </div>
            </div>
@@ -105,16 +115,32 @@ pub fn render_dashboard(data: &DashboardResponse) -> String {
            {}
        </div>

-        <div class="grid grid-cols-1 lg:grid-cols-2 gap-6">
+        <div class="grid grid-cols-1 lg:grid-cols-2 gap-6 mb-6">
            {}
            {}
        </div>
+
+        {}
    "##,
-        uptime_str, global_stats, registry_cards, mount_points, activity_log,
+        t.dashboard_title,
+        t.dashboard_subtitle,
+        t.uptime,
+        uptime_str,
+        global_stats,
+        registry_cards,
+        mount_points,
+        activity_log,
+        bragging_footer,
    );

    let polling_script = render_polling_script();
-    layout_dark("Dashboard", &content, Some("dashboard"), &polling_script)
+    layout_dark(
+        t.dashboard_title,
+        &content,
+        Some("dashboard"),
+        &polling_script,
+        lang,
+    )
 }

 /// Format timestamp as relative time (e.g., "2 min ago")
@@ -137,16 +163,24 @@ fn format_relative_time(timestamp: &chrono::DateTime<chrono::Utc>) -> String {
 }

 /// Renders a registry list page (docker, maven, npm, cargo, pypi)
-pub fn render_registry_list(registry_type: &str, title: &str, repos: &[RepoInfo]) -> String {
+pub fn render_registry_list(
+    registry_type: &str,
+    title: &str,
+    repos: &[RepoInfo],
+    lang: Lang,
+) -> String {
+    let t = get_translations(lang);
    let icon = get_registry_icon(registry_type);

    let table_rows = if repos.is_empty() {
-        r##"<tr><td colspan="4" class="px-6 py-12 text-center text-slate-500">
+        format!(
+            r##"<tr><td colspan="4" class="px-6 py-12 text-center text-slate-500">
            <div class="text-4xl mb-2">📭</div>
-            <div>No repositories found</div>
-            <div class="text-sm mt-1">Push your first artifact to see it here</div>
-        </td></tr>"##
-            .to_string()
+            <div>{}</div>
+            <div class="text-sm mt-1">{}</div>
+        </td></tr>"##,
+            t.no_repos_found, t.push_first_artifact
+        )
    } else {
        repos
            .iter()
@@ -155,12 +189,12 @@ pub fn render_registry_list(registry_type: &str, title: &str, repos: &[RepoInfo]
                    format!("/ui/{}/{}", registry_type, encode_uri_component(&repo.name));
                format!(
                    r##"
-                <tr class="hover:bg-slate-50 cursor-pointer" onclick="window.location='{}'">
+                <tr class="hover:bg-slate-700 cursor-pointer" onclick="window.location='{}'">
                    <td class="px-6 py-4">
-                        <a href="{}" class="text-blue-600 hover:text-blue-800 font-medium">{}</a>
+                        <a href="{}" class="text-blue-400 hover:text-blue-300 font-medium">{}</a>
                    </td>
-                    <td class="px-6 py-4 text-slate-600">{}</td>
-                    <td class="px-6 py-4 text-slate-600">{}</td>
+                    <td class="px-6 py-4 text-slate-400">{}</td>
+                    <td class="px-6 py-4 text-slate-400">{}</td>
                    <td class="px-6 py-4 text-slate-500 text-sm">{}</td>
                </tr>
            "##,
@@ -177,48 +211,47 @@ pub fn render_registry_list(registry_type: &str, title: &str, repos: &[RepoInfo]
    };

    let version_label = match registry_type {
-        "docker" => "Tags",
-        "maven" => "Versions",
-        _ => "Versions",
+        "docker" => t.tags,
+        _ => t.versions,
    };

    let content = format!(
        r##"
        <div class="mb-6 flex items-center justify-between">
            <div class="flex items-center">
-                <svg class="w-10 h-10 mr-3 text-slate-600" fill="currentColor" viewBox="0 0 24 24">{}</svg>
+                <svg class="w-10 h-10 mr-3 text-slate-400" fill="currentColor" viewBox="0 0 24 24">{}</svg>
                <div>
-                    <h1 class="text-2xl font-bold text-slate-800">{}</h1>
-                    <p class="text-slate-500">{} repositories</p>
+                    <h1 class="text-2xl font-bold text-slate-200">{}</h1>
+                    <p class="text-slate-500">{} {}</p>
                </div>
            </div>
            <div class="flex items-center gap-4">
                <div class="relative">
                    <input type="text"
-                           placeholder="Search repositories..."
-                           class="pl-10 pr-4 py-2 border border-slate-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-transparent"
+                           placeholder="{}"
+                           class="pl-10 pr-4 py-2 bg-slate-800 border border-slate-600 text-slate-200 rounded-lg focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-transparent placeholder-slate-500"
                           hx-get="/api/ui/{}/search"
                           hx-trigger="keyup changed delay:300ms"
                           hx-target="#repo-table-body"
                           name="q">
-                    <svg class="absolute left-3 top-2.5 h-5 w-5 text-slate-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <svg class="absolute left-3 top-2.5 h-5 w-5 text-slate-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"/>
                    </svg>
                </div>
            </div>
        </div>

-        <div class="bg-white rounded-lg shadow-sm border border-slate-200 overflow-hidden">
+        <div class="bg-[#1e293b] rounded-lg shadow-sm border border-slate-700 overflow-hidden">
            <table class="w-full">
-                <thead class="bg-slate-50 border-b border-slate-200">
+                <thead class="bg-slate-800 border-b border-slate-700">
                    <tr>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Name</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">{}</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Size</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Updated</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">{}</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">{}</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">{}</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">{}</th>
                    </tr>
                </thead>
-                <tbody id="repo-table-body" class="divide-y divide-slate-200">
+                <tbody id="repo-table-body" class="divide-y divide-slate-700">
                    {}
                </tbody>
            </table>
@@ -227,16 +260,22 @@ pub fn render_registry_list(registry_type: &str, title: &str, repos: &[RepoInfo]
        icon,
        title,
        repos.len(),
+        t.repositories,
+        t.search_placeholder,
        registry_type,
+        t.name,
        version_label,
+        t.size,
+        t.updated,
        table_rows
    );

-    layout(title, &content, Some(registry_type))
+    layout_dark(title, &content, Some(registry_type), "", lang)
 }

 /// Renders Docker image detail page
-pub fn render_docker_detail(name: &str, detail: &DockerDetail) -> String {
+pub fn render_docker_detail(name: &str, detail: &DockerDetail, lang: Lang) -> String {
+    let _t = get_translations(lang);
    let tags_rows = if detail.tags.is_empty() {
        r##"<tr><td colspan="3" class="px-6 py-8 text-center text-slate-500">No tags found</td></tr>"##.to_string()
    } else {
@@ -246,11 +285,11 @@ pub fn render_docker_detail(name: &str, detail: &DockerDetail) -> String {
            .map(|tag| {
                format!(
                    r##"
-                <tr class="hover:bg-slate-50">
+                <tr class="hover:bg-slate-700">
                    <td class="px-6 py-4">
-                        <span class="font-mono text-sm bg-slate-100 px-2 py-1 rounded">{}</span>
+                        <span class="font-mono text-sm bg-slate-700 text-slate-200 px-2 py-1 rounded">{}</span>
                    </td>
-                    <td class="px-6 py-4 text-slate-600">{}</td>
+                    <td class="px-6 py-4 text-slate-400">{}</td>
                    <td class="px-6 py-4 text-slate-500 text-sm">{}</td>
                </tr>
            "##,
@@ -269,18 +308,18 @@ pub fn render_docker_detail(name: &str, detail: &DockerDetail) -> String {
        r##"
        <div class="mb-6">
            <div class="flex items-center mb-2">
-                <a href="/ui/docker" class="text-blue-600 hover:text-blue-800">Docker Registry</a>
-                <span class="mx-2 text-slate-400">/</span>
-                <span class="text-slate-800 font-medium">{}</span>
+                <a href="/ui/docker" class="text-blue-400 hover:text-blue-300">Docker Registry</a>
+                <span class="mx-2 text-slate-500">/</span>
+                <span class="text-slate-200 font-medium">{}</span>
            </div>
            <div class="flex items-center">
-                <svg class="w-10 h-10 mr-3 text-slate-600" fill="currentColor" viewBox="0 0 24 24">{}</svg>
-                <h1 class="text-2xl font-bold text-slate-800">{}</h1>
+                <svg class="w-10 h-10 mr-3 text-slate-400" fill="currentColor" viewBox="0 0 24 24">{}</svg>
+                <h1 class="text-2xl font-bold text-slate-200">{}</h1>
            </div>
        </div>

-        <div class="bg-white rounded-lg shadow-sm border border-slate-200 p-6 mb-6">
-            <h2 class="text-lg font-semibold text-slate-800 mb-3">Pull Command</h2>
+        <div class="bg-[#1e293b] rounded-lg shadow-sm border border-slate-700 p-6 mb-6">
+            <h2 class="text-lg font-semibold text-slate-200 mb-3">Pull Command</h2>
            <div class="flex items-center bg-slate-900 text-green-400 rounded-lg p-4 font-mono text-sm">
                <code class="flex-1">{}</code>
                <button onclick="navigator.clipboard.writeText('{}')" class="ml-4 text-slate-400 hover:text-white transition-colors" title="Copy to clipboard">
@@ -291,19 +330,19 @@ pub fn render_docker_detail(name: &str, detail: &DockerDetail) -> String {
            </div>
        </div>

-        <div class="bg-white rounded-lg shadow-sm border border-slate-200 overflow-hidden">
-            <div class="px-6 py-4 border-b border-slate-200">
-                <h2 class="text-lg font-semibold text-slate-800">Tags ({} total)</h2>
+        <div class="bg-[#1e293b] rounded-lg shadow-sm border border-slate-700 overflow-hidden">
+            <div class="px-6 py-4 border-b border-slate-700">
+                <h2 class="text-lg font-semibold text-slate-200">Tags ({} total)</h2>
            </div>
            <table class="w-full">
-                <thead class="bg-slate-50 border-b border-slate-200">
+                <thead class="bg-slate-800 border-b border-slate-700">
                    <tr>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Tag</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Size</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Created</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Tag</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Size</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Created</th>
                    </tr>
                </thead>
-                <tbody class="divide-y divide-slate-200">
+                <tbody class="divide-y divide-slate-700">
                    {}
                </tbody>
            </table>
@@ -318,11 +357,23 @@ pub fn render_docker_detail(name: &str, detail: &DockerDetail) -> String {
        tags_rows
    );

-    layout(&format!("{} - Docker", name), &content, Some("docker"))
+    layout_dark(
+        &format!("{} - Docker", name),
+        &content,
+        Some("docker"),
+        "",
+        lang,
+    )
 }

 /// Renders package detail page (npm, cargo, pypi)
-pub fn render_package_detail(registry_type: &str, name: &str, detail: &PackageDetail) -> String {
+pub fn render_package_detail(
+    registry_type: &str,
+    name: &str,
+    detail: &PackageDetail,
+    lang: Lang,
+) -> String {
+    let _t = get_translations(lang);
    let icon = get_registry_icon(registry_type);
    let registry_title = get_registry_title(registry_type);

@@ -335,11 +386,11 @@ pub fn render_package_detail(registry_type: &str, name: &str, detail: &PackageDe
            .map(|v| {
                format!(
                    r##"
-                <tr class="hover:bg-slate-50">
+                <tr class="hover:bg-slate-700">
                    <td class="px-6 py-4">
-                        <span class="font-mono text-sm bg-slate-100 px-2 py-1 rounded">{}</span>
+                        <span class="font-mono text-sm bg-slate-700 text-slate-200 px-2 py-1 rounded">{}</span>
                    </td>
-                    <td class="px-6 py-4 text-slate-600">{}</td>
+                    <td class="px-6 py-4 text-slate-400">{}</td>
                    <td class="px-6 py-4 text-slate-500 text-sm">{}</td>
                </tr>
            "##,
@@ -366,18 +417,18 @@ pub fn render_package_detail(registry_type: &str, name: &str, detail: &PackageDe
        r##"
        <div class="mb-6">
            <div class="flex items-center mb-2">
-                <a href="/ui/{}" class="text-blue-600 hover:text-blue-800">{}</a>
-                <span class="mx-2 text-slate-400">/</span>
-                <span class="text-slate-800 font-medium">{}</span>
+                <a href="/ui/{}" class="text-blue-400 hover:text-blue-300">{}</a>
+                <span class="mx-2 text-slate-500">/</span>
+                <span class="text-slate-200 font-medium">{}</span>
            </div>
            <div class="flex items-center">
-                <svg class="w-10 h-10 mr-3 text-slate-600" fill="currentColor" viewBox="0 0 24 24">{}</svg>
-                <h1 class="text-2xl font-bold text-slate-800">{}</h1>
+                <svg class="w-10 h-10 mr-3 text-slate-400" fill="currentColor" viewBox="0 0 24 24">{}</svg>
+                <h1 class="text-2xl font-bold text-slate-200">{}</h1>
            </div>
        </div>

-        <div class="bg-white rounded-lg shadow-sm border border-slate-200 p-6 mb-6">
-            <h2 class="text-lg font-semibold text-slate-800 mb-3">Install Command</h2>
+        <div class="bg-[#1e293b] rounded-lg shadow-sm border border-slate-700 p-6 mb-6">
+            <h2 class="text-lg font-semibold text-slate-200 mb-3">Install Command</h2>
            <div class="flex items-center bg-slate-900 text-green-400 rounded-lg p-4 font-mono text-sm">
                <code class="flex-1">{}</code>
                <button onclick="navigator.clipboard.writeText('{}')" class="ml-4 text-slate-400 hover:text-white transition-colors" title="Copy to clipboard">
@@ -388,19 +439,19 @@ pub fn render_package_detail(registry_type: &str, name: &str, detail: &PackageDe
            </div>
        </div>

-        <div class="bg-white rounded-lg shadow-sm border border-slate-200 overflow-hidden">
-            <div class="px-6 py-4 border-b border-slate-200">
-                <h2 class="text-lg font-semibold text-slate-800">Versions ({} total)</h2>
+        <div class="bg-[#1e293b] rounded-lg shadow-sm border border-slate-700 overflow-hidden">
+            <div class="px-6 py-4 border-b border-slate-700">
+                <h2 class="text-lg font-semibold text-slate-200">Versions ({} total)</h2>
            </div>
            <table class="w-full">
-                <thead class="bg-slate-50 border-b border-slate-200">
+                <thead class="bg-slate-800 border-b border-slate-700">
                    <tr>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Version</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Size</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Published</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Version</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Size</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Published</th>
                    </tr>
                </thead>
-                <tbody class="divide-y divide-slate-200">
+                <tbody class="divide-y divide-slate-700">
                    {}
                </tbody>
            </table>
@@ -417,26 +468,29 @@ pub fn render_package_detail(registry_type: &str, name: &str, detail: &PackageDe
        versions_rows
    );

-    layout(
+    layout_dark(
        &format!("{} - {}", name, registry_title),
        &content,
        Some(registry_type),
+        "",
+        lang,
    )
 }

 /// Renders Maven artifact detail page
-pub fn render_maven_detail(path: &str, detail: &MavenDetail) -> String {
+pub fn render_maven_detail(path: &str, detail: &MavenDetail, lang: Lang) -> String {
+    let _t = get_translations(lang);
    let artifact_rows = if detail.artifacts.is_empty() {
        r##"<tr><td colspan="2" class="px-6 py-8 text-center text-slate-500">No artifacts found</td></tr>"##.to_string()
    } else {
        detail.artifacts.iter().map(|a| {
            let download_url = format!("/maven2/{}/{}", path, a.filename);
            format!(r##"
-                <tr class="hover:bg-slate-50">
+                <tr class="hover:bg-slate-700">
                    <td class="px-6 py-4">
-                        <a href="{}" class="text-blue-600 hover:text-blue-800 font-mono text-sm">{}</a>
+                        <a href="{}" class="text-blue-400 hover:text-blue-300 font-mono text-sm">{}</a>
                    </td>
-                    <td class="px-6 py-4 text-slate-600">{}</td>
+                    <td class="px-6 py-4 text-slate-400">{}</td>
                </tr>
            "##, download_url, html_escape(&a.filename), format_size(a.size))
        }).collect::<Vec<_>>().join("")
@@ -465,33 +519,33 @@ pub fn render_maven_detail(path: &str, detail: &MavenDetail) -> String {
        r##"
        <div class="mb-6">
            <div class="flex items-center mb-2">
-                <a href="/ui/maven" class="text-blue-600 hover:text-blue-800">Maven Repository</a>
-                <span class="mx-2 text-slate-400">/</span>
-                <span class="text-slate-800 font-medium">{}</span>
+                <a href="/ui/maven" class="text-blue-400 hover:text-blue-300">Maven Repository</a>
+                <span class="mx-2 text-slate-500">/</span>
+                <span class="text-slate-200 font-medium">{}</span>
            </div>
            <div class="flex items-center">
-                <svg class="w-10 h-10 mr-3 text-slate-600" fill="currentColor" viewBox="0 0 24 24">{}</svg>
-                <h1 class="text-2xl font-bold text-slate-800">{}</h1>
+                <svg class="w-10 h-10 mr-3 text-slate-400" fill="currentColor" viewBox="0 0 24 24">{}</svg>
+                <h1 class="text-2xl font-bold text-slate-200">{}</h1>
            </div>
        </div>

-        <div class="bg-white rounded-lg shadow-sm border border-slate-200 p-6 mb-6">
-            <h2 class="text-lg font-semibold text-slate-800 mb-3">Maven Dependency</h2>
+        <div class="bg-[#1e293b] rounded-lg shadow-sm border border-slate-700 p-6 mb-6">
+            <h2 class="text-lg font-semibold text-slate-200 mb-3">Maven Dependency</h2>
            <pre class="bg-slate-900 text-green-400 rounded-lg p-4 font-mono text-sm overflow-x-auto">{}</pre>
        </div>

-        <div class="bg-white rounded-lg shadow-sm border border-slate-200 overflow-hidden">
-            <div class="px-6 py-4 border-b border-slate-200">
-                <h2 class="text-lg font-semibold text-slate-800">Artifacts ({} files)</h2>
+        <div class="bg-[#1e293b] rounded-lg shadow-sm border border-slate-700 overflow-hidden">
+            <div class="px-6 py-4 border-b border-slate-700">
+                <h2 class="text-lg font-semibold text-slate-200">Artifacts ({} files)</h2>
            </div>
            <table class="w-full">
-                <thead class="bg-slate-50 border-b border-slate-200">
+                <thead class="bg-slate-800 border-b border-slate-700">
                    <tr>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Filename</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-600 uppercase tracking-wider">Size</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Filename</th>
+                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-400 uppercase tracking-wider">Size</th>
                    </tr>
                </thead>
-                <tbody class="divide-y divide-slate-200">
+                <tbody class="divide-y divide-slate-700">
                    {}
                </tbody>
            </table>
@@ -505,7 +559,13 @@ pub fn render_maven_detail(path: &str, detail: &MavenDetail) -> String {
        artifact_rows
    );

-    layout(&format!("{} - Maven", path), &content, Some("maven"))
+    layout_dark(
+        &format!("{} - Maven", path),
+        &content,
+        Some("maven"),
+        "",
+        lang,
+    )
 }

 /// Returns SVG icon path for the registry type
Author	SHA1	Message	Date
DevITWay	833b3e376d	docs: add bilingual onboarding (EN/RU)	2026-01-30 16:19:48 +00:00
DevITWay	783464acac	fix: clippy let_and_return warning	2026-01-30 16:15:21 +00:00
DevITWay	8ac1e2c0c3	style: fix formatting	2026-01-30 16:06:40 +00:00
DevITWay	8c525bb5c2	feat: add Docker image metadata support - Store metadata (.meta.json) alongside manifests with: - push_timestamp, last_pulled, downloads counter - size_bytes, os, arch, variant - layers list with digest and size - Update metadata on manifest pull (increment downloads, update last_pulled) - Extract OS/arch from config blob on push - Extend UI API TagInfo with metadata fields - Add public_url config option for pull commands - Add Docker upstream proxy with auth support - Add raw repository support - Bump version to 0.2.12	2026-01-30 15:52:29 +00:00
DevITWay	5c53611cfd	feat: add secrets provider architecture Trait-based secrets management for secure credential handling: - SecretsProvider trait for pluggable backends - EnvProvider as default (12-Factor App pattern) - ProtectedString with zeroize (memory zeroed on drop) - Redacted Debug impl prevents secret leakage in logs - S3Credentials struct for future AWS S3 integration - Config: [secrets] section with provider and clear_env options Foundation for AWS Secrets Manager, Vault, K8s (v0.4.0+)	2026-01-30 10:02:58 +00:00
DevITWay	73d28ea80b	feat: add configurable rate limiting Rate limits now configurable via config.toml and ENV variables: - New [rate_limit] config section with auth/upload/general settings - ENV: NORA_RATE_LIMIT_{AUTH\|UPLOAD\|GENERAL}_{RPS\|BURST} - Rate limit configuration logged at startup - Functions accept &RateLimitConfig instead of hardcoded values	2026-01-30 08:20:50 +00:00
DevITWay	278275978c	Fix clippy warnings	2026-01-26 19:43:51 +00:00
DevITWay	c1019238cb	Fix code formatting	2026-01-26 19:42:20 +00:00
DevITWay	73e7e525a3	Add i18n support, PyPI proxy, and UI improvements - Add Russian/English language switcher with cookie persistence - Add PyPI proxy support with caching (like npm) - Add height limits to Activity Log and Mount Points tables - Change Cargo icon to delivery truck - Replace graphical logo with styled text "NORA" - Bump version to 0.2.11	2026-01-26 19:31:28 +00:00
DevITWay	0a5f267374	Bump version to 0.2.10	2026-01-26 18:43:21 +00:00
DevITWay	5353faef88	Apply dark theme to all UI pages - Convert registry list, docker detail, package detail, maven detail pages to dark theme - Use layout_dark instead of layout for all pages - Update colors: bg-[#1e293b] cards, slate-700 borders, slate-200/400 text - Mark unused light theme functions with #[allow(dead_code)]	2026-01-26 18:43:11 +00:00