v0.1.3

The ContextMenu lived in its own popup visual tree, so the menu items'
RelativeSource={RelativeSource AncestorType=Window} couldn't find the
Window and the bindings silently failed - none of Edit / Copy URL /
Toggle / Delete actually fired their commands.

Standard WPF workaround: park MainViewModel on each DataGridRow's Tag
(still in the Window's visual tree, so the row Setter binding resolves)
and reach it from the menu items via PlacementTarget.Tag. The toggle
command parameter likewise comes from PlacementTarget.DataContext (the
EndpointConfig the row represents).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/wiki-sync.yml

@@ -0,0 +1,27 @@
+name: Sync Wiki
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'scripts/sync-wiki.ps1'
+      - '.github/workflows/wiki-sync.yml'
+  workflow_dispatch:
+
+jobs:
+  sync:
+    runs-on: windows-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Sync docs/ to GitHub wiki
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          $repo = '${{ github.repository }}'
+          $wikiUrl = "https://x-access-token:$env:GH_TOKEN@github.com/$repo.wiki.git"
+          ./scripts/sync-wiki.ps1 -WikiUrl $wikiUrl

Directory.Build.props

@@ -1,7 +1,7 @@
 <Project>
 
   <PropertyGroup>
-    <Version>0.1.1</Version>
+    <Version>0.1.3</Version>
     <Authors>Justin Paul</Authors>
     <Company>Justin Paul</Company>
     <Product>Webhook Server</Product>

README.md

@@ -61,11 +61,12 @@ Everything you need to operate the server:
 
 Recipes:
 
-- [Zerto pre/post scripts → AD / DNS update](docs/recipes/zerto-pre-post-scripts.md) ← **canonical use case**
+- [Zerto failover post-script → DNS + service checks](docs/recipes/zerto-pre-post-scripts.md) ← **canonical use case**
 - [GitHub-style HMAC-signed webhook](docs/recipes/github-style-hmac.md)
-- [AD password reset endpoint](docs/recipes/ad-password-reset.md)
 - [Pop UI on the user's desktop](docs/recipes/ui-on-desktop.md)
 
+A ready-to-drop-in Zerto-side script is included at [`scripts/examples/zerto-post-failover.ps1`](scripts/examples/zerto-post-failover.ps1).
+
 ## Requirements
 
 - Windows 10 / 11 / Server 2019+

docs/README.md

@@ -6,7 +6,7 @@ Webhook Server is a Windows service that runs a script (PowerShell, cmd, or any
 
 1. [Concepts](concepts.md) — five-minute read on what a webhook is and how this server uses one
 2. [Installation](installation.md) — download, install, first endpoint
-3. [Recipe: Zerto pre/post scripts → AD / DNS update](recipes/zerto-pre-post-scripts.md) — the canonical reason this exists
+3. [Recipe: Zerto failover post-script → DNS + service checks](recipes/zerto-pre-post-scripts.md) — the canonical reason this exists
 
 ## Topical
 
@@ -19,11 +19,12 @@ Webhook Server is a Windows service that runs a script (PowerShell, cmd, or any
 
 ## Recipes (cookbook style)
 
-- [Zerto pre/post scripts → AD / DNS update](recipes/zerto-pre-post-scripts.md)
+- [Zerto failover post-script → DNS + service checks](recipes/zerto-pre-post-scripts.md) ← canonical use case
 - [GitHub-style HMAC-signed webhook](recipes/github-style-hmac.md)
-- [AD password reset endpoint](recipes/ad-password-reset.md)
 - [Pop UI on the user's desktop](recipes/ui-on-desktop.md)
 
+The flagship Zerto recipe also ships with a **ready-to-use Zerto-side post-script** at [`scripts/examples/zerto-post-failover.ps1`](../scripts/examples/zerto-post-failover.ps1).
+
 ## Reference
 
 - [GitHub repo](https://github.com/recklessop/webhook-server)

docs/recipes/ad-password-reset.md

@@ -1,105 +0,0 @@
-# Recipe: AD password reset endpoint
-
-A self-service password reset URL your help-desk tool can hit. Single endpoint, gMSA-backed, audited.
-
-## Architecture
-
-- The webhook host is domain-joined
-- The service runs as a gMSA with **Reset Password** + **Write pwdLastSet** delegated on the OUs containing target users
-- The endpoint is HMAC-signed, IP-allowlisted to the help-desk app's server
-- Every reset is logged in the daily log file with caller IP, target user, runId, and result
-
-## Prerequisites
-
-- gMSA created and installed on the host. See [Service account & Active Directory](../service-account-and-ad.md).
-- Service installed with `-ServiceAccount 'CONTOSO\svc-webhookserver$'`
-- Delegate the right permissions on the OU(s):
-
-```powershell
-$ou = "OU=Standard Users,DC=contoso,DC=local"
-dsacls $ou /I:S /G "CONTOSO\svc-webhookserver$:CA;Reset Password;user"
-dsacls $ou /I:S /G "CONTOSO\svc-webhookserver$:WP;pwdLastSet;user"
-```
-
-## The script
-
-`C:\Scripts\ad-password-reset.ps1`:
-
-```powershell
-[CmdletBinding()]
-param()
-$ErrorActionPreference = 'Stop'
-Import-Module ActiveDirectory
-
-$body = $input | ConvertFrom-Json
-
-if (-not $body.samAccountName) { throw 'samAccountName is required' }
-if (-not $body.newPassword)    { throw 'newPassword is required' }
-if (-not $body.requestedBy)    { throw 'requestedBy is required (audit field)' }
-
-# Refuse to touch privileged groups
-$user = Get-ADUser -Identity $body.samAccountName -Properties MemberOf
-$denyGroups = @('Domain Admins','Enterprise Admins','Schema Admins')
-foreach ($g in $user.MemberOf) {
-    $name = ($g -split ',')[0] -replace '^CN='
-    if ($denyGroups -contains $name) {
-        throw "refusing to reset password for member of $name"
-    }
-}
-
-$secure = ConvertTo-SecureString $body.newPassword -AsPlainText -Force
-Set-ADAccountPassword -Identity $user -NewPassword $secure -Reset
-Set-ADUser -Identity $user -ChangePasswordAtLogon $true
-
-# Audit line goes to the webhook log automatically (return value becomes stdout).
-"reset $($user.SamAccountName) requested by $($body.requestedBy)"
-```
-
-## Endpoint configuration
-
-| Section | Setting | Value |
-|---|---|---|
-| Identity | Slug | `ad-reset` |
-| Auth | Mode | **HMAC** with a strong secret shared with the help-desk app |
-| Auth | HMAC header | `X-Signature-256` |
-| Auth | HMAC prefix | `sha256=` |
-| Auth | HMAC encoding | hex |
-| Allowed clients | | `10.50.10.20` *(the help-desk app's IP only)* |
-| Executor | Type | Windows PowerShell |
-| Executor | Script path | `C:\Scripts\ad-password-reset.ps1` |
-| Data passing | JSON body to stdin | ✓ |
-| Data passing | Headers/query as env vars | ✗ |
-| Run as | Identity | **Service** *(uses the gMSA)* |
-| Response | Mode | Sync |
-| Response | Timeout (sec) | 30 |
-| Response | Fail on non-zero exit | ✓ |
-
-## Calling it
-
-```powershell
-$body = @{
-    samAccountName = 'jdoe'
-    newPassword    = 'TempP@ssw0rd!2026'
-    requestedBy    = 'helpdesk_user@contoso.local'
-} | ConvertTo-Json
-
-$bytes = [Text.Encoding]::UTF8.GetBytes($body)
-$hmac  = [Security.Cryptography.HMACSHA256]::new(
-    [Text.Encoding]::UTF8.GetBytes('your-shared-secret'))
-$sig   = ([BitConverter]::ToString($hmac.ComputeHash($bytes)) -replace '-','').ToLower()
-
-Invoke-RestMethod -Method POST `
-    -Uri 'http://webhooks.contoso.local:8080/hook/ad-reset' `
-    -Headers @{ 'X-Signature-256' = "sha256=$sig" } `
-    -ContentType 'application/json' -Body $body
-```
-
-## Operational notes
-
-**Audit log**: every call lands in `C:\ProgramData\WebhookServer\logs\webhook-YYYYMMDD.log` with one line per run including the runId, slug, caller IP, exit code, and the script's stdout (the `"reset jdoe requested by helpdesk_user"` line). Ship those logs to your SIEM via the usual file-collector flow.
-
-**Rotating the HMAC secret**: edit the endpoint in the GUI, replace the secret, save. The help-desk app needs the new secret too — coordinate the cutover. There's no overlap window built in; if you need a soft rollover, create a second endpoint with the new secret and switch caller traffic over.
-
-**Privileged-group guard**: the script's `denyGroups` check is a basic guard. If a more sophisticated guard is needed (target user attribute, OU-based logic), add it in the script — that's the right place, not the webhook server.
-
-**Self-service from the user side**: don't expose this endpoint to end users directly. Front it with a help-desk app that authenticates the user (preferably with MFA), then makes the call to the webhook with its bearer/HMAC credentials. The webhook server is the *plumbing*; not the *front door*.

docs/recipes/zerto-pre-post-scripts.md

@@ -1,94 +1,98 @@
-# Recipe: Zerto pre/post scripts → AD / DNS update
+# Recipe: Zerto failover post-script → DNS update + service checks
 
-This is the canonical reason Webhook Server exists. Zerto's failover, move, and clone operations support pre- and post-scripts — but those scripts run on the Zerto Virtual Manager (ZVM), not on the destination domain controller or DNS server. To touch AD or DNS during a failover you need either:
+This is the canonical reason Webhook Server exists.
 
-- A bastion / utility host with the right modules and credentials installed (and you accept the maintenance burden of keeping its scripts in sync)
+When Zerto fails a VM over from production to DR, the VM boots fine — but **the things around it** often need attention: DNS records still point at the production IP, dependent services need to be checked, on-call needs a heads-up. Zerto pre/post scripts run on the **Zerto Virtual Manager**, not on a domain controller and not necessarily with admin rights to the things that need fixing. So you want a single webhook URL that the post-script hits, and a Windows host on the DR side that does the actual work with the right identity.
-- **A webhook on a Windows host** — Zerto's pre/post calls a single URL, and the webhook server runs the right PowerShell on the right machine with the right identity. This page is about that.
 
 ## What we're building
 
-A Zerto pre/post script POSTs to `http://webhooks.contoso.local:8080/hook/dr-failover-prep` with a JSON body identifying the VPG and target VMs. The webhook server, running on a domain-joined utility host as a gMSA with delegated AD rights, runs PowerShell that:
+Zerto's post-recovery script (a one-shot PowerShell file pointing at curl) calls `http://webhook.dr.contoso.local:8080/hook/post-failover` with a JSON body identifying the VPG and operation. The Webhook Server, running on a DR-side Windows host as a gMSA with delegated AD/DNS rights, runs PowerShell that:
 
-1. Updates AD computer object descriptions to indicate they're now at the DR site
+1. Updates DNS A records to point the failed-over hostnames at their DR IPs
-2. Updates DNS A records to point `app01.contoso.local` and friends at the new (DR) IPs
+2. Waits for the failed-over VM to come up (ping + WinRM probe)
-3. Posts a result line to a Teams channel
+3. Connects to the VM via PowerShell remoting and starts/checks critical services
-4. Returns 200 with the summary so it shows up in Zerto's pre/post script log
+4. Sends a Teams notification with the result
 
-It's about ~30 lines of PowerShell on the server side and 3 lines of script in Zerto.
+The endpoint is **Async** so the Zerto script returns in milliseconds — no risk of timing out Zerto's failover sequence even if the actions take minutes. The script's full output ends up in the webhook log and (optionally) in an outbound callback.
 
-## Prerequisites
+## Why curl and not Invoke-WebRequest?
 
-On the webhook host:
+Zerto's PowerShell runner is intentionally minimal — many environments run an older Windows on the ZVM and don't have full PowerShell modules installed. `curl.exe` ships with Windows 10 1803+ and Server 2019+ and works without any modules. Plus, calling an HTTP endpoint with `curl.exe` doesn't depend on the version of `Invoke-WebRequest` shipped with the host's PowerShell.
 
-- Webhook Server installed (see [Installation](../installation.md))
+## 1. The Zerto post-script (client side)
-- The host is domain-joined
-- The service account has the **AD permissions** it needs. We'll configure this two ways below — the simple way (LocalSystem + delegated rights to the machine account) and the production way (gMSA).
-- DNS PowerShell module installed if you'll modify DNS: `Install-WindowsFeature RSAT-DNS-Server` (Server) or RSAT installed (Win 10/11).
-- AD PowerShell module: `Install-WindowsFeature RSAT-AD-PowerShell` (Server).
 
-On the Zerto side:
+A ready-to-use script ships in this repo at [`scripts/examples/zerto-post-failover.ps1`](../../scripts/examples/zerto-post-failover.ps1). Copy it to the ZVM, edit `$WebhookUrl` and the bearer-token path at the top, and wire it into the VPG:
 
-- ZVM 8.x or 9.x (this works with both)
+> **VPG settings → Recovery → Scripts → Post-Recovery Script**
-- A Virtual Protection Group (VPG) you want to wire up
+> Path: `C:\Scripts\zerto-post-failover.ps1`
+> Parameters: *(leave empty)*
 
-## 1. Plan the script and the inputs
+The script is ~50 lines and only depends on `curl.exe` + a token file readable by the ZVM service account.
 
-What does the script need to know? At minimum:
+The flow:
 
-- **VPG name** — Zerto exposes this as a parameter to the pre/post script
+```
-- **VM names** — likewise
+Zerto VPG failover starts
-- **Target IPs** — depending on your failover topology, these may be static (DR network has known IPs) or known after Zerto reconfigures the IP
+   |
-
+   +-- VM is brought up at DR site
-Decide what travels in the request body and what's hardcoded. A pragmatic split:
+   |
-
+   +-- Zerto post-script fires:
-- Hardcoded (in the PowerShell script on the webhook host): zone name, AD OU, Teams webhook URL, mapping table from VM hostname → target IP
+   |     curl POST http://webhook.dr/hook/post-failover  (async, returns 202 in ~50ms)
-- Sent in the body: VPG name, list of VM names, an "operation" field (`failover`, `move`, `failback`, etc.)
+   |
-
+   +-- Zerto sees success, finishes the failover and reports done
-Example body the Zerto script will send:
+                                                    |
-
+                       (meanwhile, on the webhook server)
-```json
+                                                    |
-{
+                       running PowerShell for several minutes:
-  "operation": "failover",
+                         - update DNS
-  "vpg": "App-Production",
+                         - wait for VM ready
-  "vms": ["app01", "app02", "db01"]
+                         - check services on VM
-}
+                         - notify Teams
 ```
 
-## 2. Write the PowerShell script on the webhook host
+## 2. The server-side script (does the actual work)
 
-Save this as `C:\Scripts\dr-failover-prep.ps1` on the webhook host:
+Save this on the webhook host as `C:\Scripts\post-failover-handler.ps1`:
 
 ```powershell
 [CmdletBinding()]
 param()
-
 $ErrorActionPreference = 'Stop'
 
-# Read the body from stdin (the webhook server pipes the JSON in for us when
-# StdinJson is enabled).
 $body = $input | ConvertFrom-Json
 
-# Hardcoded site config - edit for your environment.
+# ---------- environment specifics; edit for your site ----------
 $dnsServer    = 'dc01.contoso.local'
 $forwardZone  = 'contoso.local'
-$adOu         = 'OU=Servers,DC=contoso,DC=local'
+$teamsWebhook = 'https://contoso.webhook.office.com/...'
-$teamsWebhook = 'https://contoso.webhook.office.com/...'   # one-way, no secret to leak
 $drIpMap      = @{
     'app01' = '10.42.10.11'
     'app02' = '10.42.10.12'
     'db01'  = '10.42.10.21'
 }
+$serviceMap   = @{
+    'app01' = @('W3SVC','MyAppSvc')
+    'app02' = @('W3SVC','MyAppSvc')
+    'db01'  = @('MSSQLSERVER','SQLAgent')
+}
+# ---------------------------------------------------------------
+
+# Default the VM list to "all VMs we know about" if the post-script didn't
+# tell us, so the same handler works without having to embed the VM list in
+# every Zerto post-script.
+$vms = if ($body.vms) { $body.vms } else { $drIpMap.Keys }
 
 $summary = @()
 
-foreach ($vm in $body.vms) {
+foreach ($vm in $vms) {
     if (-not $drIpMap.ContainsKey($vm)) {
-        $summary += "skip $vm - no DR IP mapping"
+        $summary += "skip  $vm  (no DR IP mapping in handler)"
         continue
     }
-    $newIp = $drIpMap[$vm]
+    $ip = $drIpMap[$vm]
 
-    # 1. Update DNS A record (delete + recreate is the simplest reliable path)
+    # 1. DNS - delete + re-add the A record
+    try {
         $existing = Get-DnsServerResourceRecord -ZoneName $forwardZone -Name $vm `
                       -RRType A -ComputerName $dnsServer -ErrorAction SilentlyContinue
         if ($existing) {
@@ -97,124 +101,143 @@ foreach ($vm in $body.vms) {
                 -ComputerName $dnsServer -Force
         }
         Add-DnsServerResourceRecordA -ZoneName $forwardZone -Name $vm `
-        -IPv4Address $newIp -ComputerName $dnsServer -TimeToLive 00:05:00
+            -IPv4Address $ip -ComputerName $dnsServer -TimeToLive 00:05:00
+        $summary += "dns   $vm -> $ip"
+    } catch {
+        $summary += "DNS!  $vm  $($_.Exception.Message)"
+        continue
+    }
 
-    # 2. Update AD computer description so on-call can see at a glance
+    # 2. Wait for the VM to be reachable (up to 5 minutes)
-    Set-ADComputer -Identity $vm -Description "[DR-$($body.operation)] $(Get-Date -Format s)"
+    $deadline = (Get-Date).AddMinutes(5)
+    $reachable = $false
+    while ((Get-Date) -lt $deadline) {
+        if (Test-Connection -ComputerName $ip -Count 1 -Quiet -ErrorAction SilentlyContinue) {
+            try {
+                # Quick WinRM probe; succeeds when the VM has finished booting
+                Invoke-Command -ComputerName $ip -ScriptBlock { $true } -ErrorAction Stop | Out-Null
+                $reachable = $true
+                break
+            } catch { Start-Sleep -Seconds 10 }
+        } else {
+            Start-Sleep -Seconds 10
+        }
+    }
+    if (-not $reachable) {
+        $summary += "wait! $vm  not reachable after 5 minutes"
+        continue
+    }
 
-    $summary += "ok   $vm -> $newIp"
+    # 3. Check + start critical services on the VM
+    if ($serviceMap.ContainsKey($vm)) {
+        $svcReport = Invoke-Command -ComputerName $ip -ArgumentList @(,$serviceMap[$vm]) -ScriptBlock {
+            param($services)
+            $report = @()
+            foreach ($s in $services) {
+                $svc = Get-Service -Name $s -ErrorAction SilentlyContinue
+                if (-not $svc) { $report += "$s : missing"; continue }
+                if ($svc.Status -ne 'Running') {
+                    Start-Service $s
+                    Start-Sleep -Seconds 2
+                    $svc.Refresh()
+                }
+                $report += "$s : $($svc.Status)"
+            }
+            return $report
+        }
+        $summary += "svc   $vm : $($svcReport -join ', ')"
+    } else {
+        $summary += "svc   $vm  (no services configured)"
+    }
 }
 
-# 3. Notify Teams
+# 4. Notify Teams
-$msg = @{
+$teamsBody = @{
-    text = "Webhook DR prep for VPG **$($body.vpg)** ($($body.operation)):`n" +
+    text = "Webhook post-failover for VPG **$($body.vpg)**:`n" + ($summary -join "`n")
-           ($summary -join "`n")
 } | ConvertTo-Json
-Invoke-RestMethod -Uri $teamsWebhook -Method POST -ContentType 'application/json' -Body $msg | Out-Null
+try {
+    Invoke-RestMethod -Uri $teamsWebhook -Method POST -ContentType 'application/json' -Body $teamsBody | Out-Null
+} catch {
+    $summary += "teams! notification failed: $($_.Exception.Message)"
+}
 
-# 4. Print the summary so Zerto's pre/post script log captures it
+# Return the summary so it shows up in the webhook log + outbound callback
 $summary -join "`n"
 ```
 
-A few choices worth calling out:
+Two things to call out:
 
-- **`$input | ConvertFrom-Json`** — Webhook Server pipes the request body into the script via stdin when "JSON body to stdin" is ticked. `$input` is PowerShell's automatic variable for pipeline input.
+- **PowerShell remoting to the VM** uses the gMSA's network identity (or whoever the service runs as). Make sure the gMSA / service account can `Invoke-Command` to the failed-over hosts — usually that means the account is a local admin on the target VMs, or you've configured constrained delegation.
-- **`$ErrorActionPreference = 'Stop'`** — turn cmdlet warnings into terminating errors so the script exits non-zero on real problems. Webhook Server then returns 502 (configurable via "Fail on non-zero exit") and Zerto sees the failure.
+- **WinRM** must be enabled on the failed-over VMs for the remoting calls to work. `Enable-PSRemoting` is the simplest, but most prod environments configure WinRM via Group Policy.
-- **Two-way Teams notification but one-way return** — the script's stdout becomes the HTTP response. Zerto logs it. The Teams notification is a separate Invoke-RestMethod.
 
 ## 3. Configure the endpoint in the GUI
 
-In Webhook Server's GUI, **File → New endpoint**:
+**File → New endpoint:**
 
 | Section | Setting | Value |
 |---|---|---|
-| Identity | Slug | `dr-failover-prep` |
+| Identity | Slug | `post-failover` |
-| Identity | Description | "Zerto pre-script: update AD/DNS during failover" |
+| Identity | Description | "Zerto post-recovery: DNS + service checks" |
 | Auth | Mode | **Bearer** |
-| Auth | Bearer secret | generate a 32-byte random string; copy it for the Zerto script |
+| Auth | Bearer secret | generate a 32-byte random string; copy it for the Zerto script's token file |
-| Allowed clients | (one per line) | `10.0.0.0/8` (your ZVM's network) |
+| Allowed clients | (one per line) | `10.0.0.0/8` *(your ZVM's network)* |
 | Executor | Type | **Windows PowerShell** |
-| Executor | Script path | `C:\Scripts\dr-failover-prep.ps1` |
+| Executor | Script path | `C:\Scripts\post-failover-handler.ps1` |
 | Data passing | JSON body to stdin | ✓ |
-| Data passing | Headers/query as env vars | ✗ |
+| Run as | Identity | **Service** if the service runs under a gMSA with the right rights, otherwise **SpecificUser** with a delegated account |
-| Run as | Identity | **Service** if the service is running as a gMSA with AD rights, otherwise **SpecificUser** with a delegated account |
+| Response | Mode | **Async** ← critical: this is what makes the Zerto script non-blocking |
-| Response | Mode | **Sync** |
+| Response | Timeout (sec) | `600` *(this is the cap on the long-running handler script, not the Zerto-facing response)* |
-| Response | Timeout (sec) | `60` |
+| Response | Fail on non-zero exit | unticked *(async hooks have no caller to receive a 502)* |
-| Response | Fail on non-zero exit | ✓ |
 
-Save. Right-click the row → **Copy URL** to grab the full URL, e.g. `http://webhooks.contoso.local:8080/hook/dr-failover-prep`.
+Save. Right-click the row → **Copy URL** to grab `http://webhook.dr.contoso.local:8080/hook/post-failover` and paste it into `$WebhookUrl` at the top of the Zerto-side script.
 
-> **Why Bearer auth and not None?** Even though the IP allowlist limits who can reach this endpoint, the Bearer token is a defense-in-depth layer. If someone managed to spoof or get on the trusted network, they still need the token. Generate it once, store it in a secrets manager (or in Zerto's encrypted script parameters), and never email it.
+> **Why Bearer instead of HMAC?** Both work. Bearer is simpler — drop the token in a file on the ZVM that's readable by the ZVM service account and you're done. HMAC requires the Zerto-side script to compute a signature, which is doable but adds a few lines of code. Pick what fits your environment.
 
-## 4. The Zerto pre/post script
+## 4. Wire up the bearer token
 
-Zerto pre/post scripts are PowerShell files placed on the ZVM. The path varies by Zerto version; in 9.x it's typically `C:\Program Files\Zerto\Zerto Virtual Replication\Scripts\`.
+Place the bearer token in a file the ZVM service account can read (and nobody else):
-
-Create `dr-failover-prep.ps1` on the ZVM:
 
 ```powershell
-# Zerto passes context as parameters/environment - exact names vary by version.
+# on the ZVM, from elevated PowerShell
-# Document yours; this is illustrative.
+$token = (New-Guid).ToString('N')   # or paste the value from the GUI
-param(
+$tokenPath = 'C:\ProgramData\Zerto\webhook-token.txt'
-    [string]$VpgName = $env:ZertoVPGName
+$token | Out-File -LiteralPath $tokenPath -Encoding utf8 -NoNewline
-)
+icacls $tokenPath /inheritance:r /grant 'NT SERVICE\Zerto Online Services:R' 'BUILTIN\Administrators:F' /T
-
-$webhookUrl = 'http://webhooks.contoso.local:8080/hook/dr-failover-prep'
-$bearer     = 'paste-the-bearer-secret-here'  # store via Zerto secret param if available
-
-# Build the body. In a real script, list the VMs by querying Zerto's API or by
-# convention from the VPG name.
-$body = @{
-    operation = 'failover'
-    vpg       = $VpgName
-    vms       = @('app01','app02','db01')
-} | ConvertTo-Json
-
-$response = Invoke-RestMethod -Method POST -Uri $webhookUrl -Body $body `
-              -ContentType 'application/json' -TimeoutSec 90 `
-              -Headers @{ Authorization = "Bearer $bearer" }
-
-# Print whatever the webhook returned to Zerto's log.
-$response.stdout
 ```
 
-Wire this script into your VPG's **Pre-Recovery** or **Post-Recovery** hook in the Zerto UI.
+Adjust the service principal name to whatever Zerto runs as on your version. The script reads from this path automatically; no change needed in the script itself.
 
 ## 5. Test before going live
 
-In a maintenance window, hit the endpoint manually with a fake VPG name to confirm the wiring works:
+In a maintenance window, fire the webhook by hand:
 
 ```powershell
-$body = @{ operation='test'; vpg='SmokeTest'; vms=@('app01') } | ConvertTo-Json
+# from any machine that can reach the webhook server
-Invoke-RestMethod -Method POST `
+$body = @{
-    -Uri http://webhooks.contoso.local:8080/hook/dr-failover-prep `
+    operation = 'test'
-    -Headers @{ Authorization = "Bearer paste-the-secret" } `
+    vpg       = 'SmokeTest'
-    -ContentType application/json -Body $body
+    timestamp = (Get-Date).ToUniversalTime().ToString('o')
+} | ConvertTo-Json -Compress
+
+curl.exe --silent --show-error --max-time 10 -X POST `
+    -H "Authorization: Bearer paste-the-token" `
+    -H "Content-Type: application/json" `
+    -d $body `
+    http://webhook.dr.contoso.local:8080/hook/post-failover
 ```
 
-You should see the summary line(s) come back, AD descriptions update, DNS A records update, and a Teams notification. If anything's off:
+You'll get back `{"runId":"…","accepted":true}` immediately. Open the Webhook Server GUI and watch the log panel — within 30 seconds or so you'll see lines for the run. Confirm DNS records updated, services on each VM ended in `Running`, and the Teams notification arrived.
-
-- **No response, hang** → check the GUI's log panel. The auto-poll updates every 3 seconds. Look for the run line with the slug + exit code.
-- **401 Unauthorized** → bearer mismatch
-- **403 Forbidden** → IP allowlist blocking you
-- **502 Bad Gateway** → script ran but exited non-zero. The response body has stderr.
-
-After a real failover triggers it, audit by checking the daily log file at `C:\ProgramData\WebhookServer\logs\webhook-YYYYMMDD.log` for the `Run <id> dr-failover-prep ok exit=0` line.
 
 ## Variations
 
 ### Different actions for failover vs. failback
 
-Pass an `operation` field in the body and branch on it in the PowerShell. The script above already does this — extend the `switch` to handle `failback` (revert DNS to production IPs, clear DR description, etc.).
+Pass an `operation` field in the body and branch on it. The Zerto-side script already sends `operation = 'failover'`. Add a separate post-failback script (or detect from `$env:ZertoOperationType`) that sends `operation = 'failback'` and have the handler revert DNS to production IPs.
 
 ### Per-VPG endpoints
 
-If you want fine-grained access control per VPG, create one endpoint per VPG and give each its own bearer secret. The GUI's grid handles dozens of endpoints fine.
+If you want fine-grained access control or different actions per VPG, create one endpoint per VPG (`post-failover-app`, `post-failover-db`, …) and give each its own bearer token. The GUI handles dozens of endpoints fine.
-
-### Async + callback for long-running work
-
-If your AD/DNS update genuinely takes minutes (e.g., updating thousands of records in a large environment), set the endpoint to **Async** mode. Zerto's pre-script gets `202 Accepted` immediately and continues. Configure the endpoint's **Callback** with a URL that records the result (e.g., another endpoint that logs to a file, or your monitoring system's API).
 
 ### Audit trail to a SIEM
 
-Configure each endpoint's **Callback** with your SIEM's HTTP collector URL + an HMAC secret. Every run produces a JSON record with runId, exit code, duration, stdout, and stderr — perfect for compliance audit logs.
+Each endpoint can have an outbound **Callback** URL. Configure it with your SIEM's HTTP collector + an HMAC secret, and every run produces a JSON record with runId, exit code, duration, stdout, and stderr — perfect for compliance.

installer/webhook-server.iss

@@ -55,6 +55,7 @@ Source: "{#RepoRoot}publish\service\*"; DestDir: "{app}"; Flags: ignoreversion r
 Source: "{#RepoRoot}publish\gui\*";     DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
 Source: "{#RepoRoot}scripts\install-service.ps1";   DestDir: "{app}\scripts"; Flags: ignoreversion
 Source: "{#RepoRoot}scripts\uninstall-service.ps1"; DestDir: "{app}\scripts"; Flags: ignoreversion
+Source: "{#RepoRoot}scripts\examples\*"; DestDir: "{app}\scripts\examples"; Flags: ignoreversion recursesubdirs createallsubdirs
 Source: "{#RepoRoot}README.md"; DestDir: "{app}"; Flags: ignoreversion
 Source: "{#RepoRoot}docs\*"; DestDir: "{app}\docs"; Flags: ignoreversion recursesubdirs createallsubdirs
 Source: "{#RepoRoot}resources\webhook-server.ico"; DestDir: "{app}"; Flags: ignoreversion
@@ -69,9 +70,14 @@ Filename: "powershell.exe"; \
     Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\scripts\install-service.ps1"" -BinaryPath ""{app}\{#ServiceExeName}"""; \
     StatusMsg: "Installing Windows Service..."; \
     Flags: runhidden
+; Post-install GUI launch. The GUI's app.manifest is requireAdministrator,
+; so launching with shellexec (ShellExecute) honors the manifest and triggers
+; a clean UAC prompt. Using plain CreateProcess via the default Run path
+; would skip the manifest and result in an un-elevated GUI that cannot connect
+; to the admin pipe.
 Filename: "{app}\{#AppExeName}"; \
     Description: "Launch {#AppName}"; \
-    Flags: postinstall nowait skipifsilent
+    Flags: postinstall nowait shellexec skipifsilent
 
 [UninstallRun]
 Filename: "powershell.exe"; \

scripts/examples/zerto-post-failover.ps1

@@ -0,0 +1,78 @@
+<#
+.SYNOPSIS
+    Zerto post-failover script. Fires the on-prem Webhook Server which does
+    the real work (DNS updates, service health checks, notifications).
+
+.DESCRIPTION
+    Designed to be dropped into a Zerto VPG's post-recovery script slot. The
+    Zerto Virtual Manager's PowerShell runner has a limited module set and
+    runs scripts synchronously, so this script:
+
+      - uses curl.exe (ships with Windows 10 1803+ / Server 2019+) instead
+        of any module-dependent HTTP client;
+      - calls an ASYNC webhook endpoint - the server returns 202 in
+        milliseconds and runs the actual work in the background;
+      - returns within seconds regardless of how long the post-failover
+        actions take, so Zerto's failover sequence is never blocked.
+
+    Wire this into your VPG via the Zerto UI:
+        VPG settings -> Recovery -> Scripts -> Post-Recovery Script
+        Path: C:\path\to\zerto-post-failover.ps1
+        Parameters: leave empty (we read from $env:ZertoVPGName)
+
+.NOTES
+    Configure $WebhookUrl and either:
+      - paste the bearer token directly into $Bearer (simplest, but the
+        token then lives in this file), or
+      - point $BearerFile at a file readable only by the ZVM service
+        account (better - same threat model as Zerto's own credential
+        storage).
+#>
+
+$ErrorActionPreference = 'Stop'
+
+# ----------------------------- CONFIGURE ---------------------------------
+$WebhookUrl = 'http://webhook.contoso.local:8080/hook/post-failover'
+$Bearer     = ''                              # paste here, or use $BearerFile
+$BearerFile = 'C:\ProgramData\Zerto\webhook-token.txt'   # one line: the token
+# -------------------------------------------------------------------------
+
+if (-not $Bearer -and (Test-Path $BearerFile)) {
+    $Bearer = (Get-Content -LiteralPath $BearerFile -TotalCount 1).Trim()
+}
+if (-not $Bearer) {
+    throw "No bearer token. Set `$Bearer in this script or write the token to $BearerFile."
+}
+
+# Compose the payload. Zerto exposes a few env vars; fall back gracefully.
+$payload = @{
+    operation = 'failover'
+    vpg       = if ($env:ZertoVPGName) { $env:ZertoVPGName } else { 'unknown' }
+    timestamp = (Get-Date).ToUniversalTime().ToString('o')
+} | ConvertTo-Json -Compress
+
+# curl on Windows handles long / quoted JSON better via @file than via -d "...".
+$tempBody = Join-Path $env:TEMP ("zerto-webhook-{0}.json" -f ([guid]::NewGuid()))
+$payload | Out-File -FilePath $tempBody -Encoding utf8 -NoNewline
+
+try {
+    Write-Host "POST $WebhookUrl  (vpg=$($env:ZertoVPGName))"
+    & curl.exe `
+        --silent --show-error --fail-with-body `
+        --max-time 10 `
+        -X POST `
+        -H "Authorization: Bearer $Bearer" `
+        -H "Content-Type: application/json" `
+        -d "@$tempBody" `
+        "$WebhookUrl"
+    if ($LASTEXITCODE -ne 0) {
+        # curl prints its own error to stderr; surface a non-zero exit so Zerto's
+        # script log records the failure but we don't block the failover.
+        Write-Warning "Webhook call failed with curl exit $LASTEXITCODE; continuing."
+    } else {
+        Write-Host "Webhook accepted (run id is in the response above)."
+    }
+}
+finally {
+    Remove-Item $tempBody -ErrorAction SilentlyContinue
+}

scripts/sync-wiki.ps1

@@ -0,0 +1,159 @@
+<#
+.SYNOPSIS
+    Mirrors the in-repo docs/ folder to a GitHub or Gitea wiki repo.
+
+.DESCRIPTION
+    Wikis are separate git repositories (e.g. <repo>.wiki.git) with a flat URL
+    structure. This script:
+
+      1. Clones the wiki repo into a temp directory.
+      2. Wipes its existing .md content.
+      3. Copies each docs/*.md to a flattened wiki-style page name.
+      4. Rewrites in-repo markdown links so they point at the wiki page slugs.
+      5. Generates a _Sidebar.md so every wiki page has a navigation sidebar.
+      6. Commits and pushes back if anything changed.
+
+    Idempotent. Safe to re-run.
+
+.PARAMETER WikiUrl
+    Full HTTPS URL to the wiki repo, including any embedded credentials. Examples:
+      https://github.com/recklessop/webhook-server.wiki.git
+      https://x-access-token:$TOKEN@github.com/recklessop/webhook-server.wiki.git
+      https://justin:$GITEA_TOKEN@git.jpaul.io/justin/webhook-server.wiki.git
+
+.PARAMETER AuthorName
+    git committer name. Defaults to "Webhook Server Wiki Sync".
+
+.PARAMETER AuthorEmail
+    git committer email. Defaults to "noreply@jpaul.me".
+
+.EXAMPLE
+    # Manual sync to Gitea (token in env)
+    $env:GITEA_TOKEN = '...'
+    ./scripts/sync-wiki.ps1 -WikiUrl "https://justin:$env:GITEA_TOKEN@git.jpaul.io/justin/webhook-server.wiki.git"
+
+.EXAMPLE
+    # Manual sync to GitHub (gh-issued token)
+    $token = & gh auth token
+    ./scripts/sync-wiki.ps1 -WikiUrl "https://x-access-token:$token@github.com/recklessop/webhook-server.wiki.git"
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$WikiUrl,
+    [string]$AuthorName  = 'Webhook Server Wiki Sync',
+    [string]$AuthorEmail = 'noreply@jpaul.me'
+)
+
+# Continue (not Stop) because git writes informational messages to stderr
+# (CRLF warnings, "remote: Processed N references" etc.) which PowerShell 5.1
+# escalates to a script-fatal error under Stop. We check $LASTEXITCODE
+# manually after each git call instead.
+$ErrorActionPreference = 'Continue'
+
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$docsDir  = Join-Path $repoRoot 'docs'
+$workDir  = Join-Path $env:TEMP ("webhook-wiki-{0}" -f ([guid]::NewGuid().ToString('N').Substring(0, 8)))
+
+# Source path (relative to docs/) -> wiki page slug. Order matters for the sidebar.
+$mapping = [ordered]@{}
+$mapping.Add('README.md',                         'Home')
+$mapping.Add('concepts.md',                       'Concepts')
+$mapping.Add('installation.md',                   'Installation')
+$mapping.Add('upgrading.md',                      'Upgrading')
+$mapping.Add('uninstalling.md',                   'Uninstalling')
+$mapping.Add('runas-modes.md',                    'Run-As-Modes')
+$mapping.Add('service-account-and-ad.md',         'Service-Account-and-AD')
+$mapping.Add('network-and-security.md',           'Network-and-Security')
+$mapping.Add('troubleshooting.md',                'Troubleshooting')
+$mapping.Add('recipes/zerto-pre-post-scripts.md', 'Recipe-Zerto-Failover')
+$mapping.Add('recipes/github-style-hmac.md',      'Recipe-GitHub-HMAC')
+$mapping.Add('recipes/ui-on-desktop.md',          'Recipe-UI-on-Desktop')
+
+function Rewrite-Links([string]$content) {
+    foreach ($m in $mapping.GetEnumerator()) {
+        # Match (path/to/file.md) and (path/to/file.md#anchor) inside markdown
+        # link parens. The lookbehind ensures we're consuming a real link target.
+        $escaped = [regex]::Escape($m.Key)
+        $content = [regex]::Replace($content,
+            "\(\.?\.?/?$escaped(\#[^)\s]*)?\)",
+            "($($m.Value)`$1)")
+    }
+    # Also clean up doubled prefixes like "../../docs/" or "../" pointers that
+    # sometimes appear in cross-folder relative links from docs/recipes/.
+    return $content
+}
+
+function New-Sidebar() {
+    $lines = @()
+    $lines += "[Home](Home)"
+    $lines += ""
+    $lines += "## Topical"
+    foreach ($key in @('concepts.md','installation.md','upgrading.md','uninstalling.md','runas-modes.md','service-account-and-ad.md','network-and-security.md','troubleshooting.md')) {
+        $slug = $mapping[$key]
+        $lines += "- [$($slug -replace '-', ' ')]($slug)"
+    }
+    $lines += ""
+    $lines += "## Recipes"
+    foreach ($key in @('recipes/zerto-pre-post-scripts.md','recipes/github-style-hmac.md','recipes/ui-on-desktop.md')) {
+        $slug = $mapping[$key]
+        $lines += "- [$($slug -replace '^Recipe-' -replace '-', ' ')]($slug)"
+    }
+    return ($lines -join "`n")
+}
+
+# 1. Clone the wiki.
+Write-Host "Cloning wiki to $workDir..."
+& git clone --quiet $WikiUrl $workDir 2>&1 | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "git clone failed. Has the wiki been initialized? Visit the repo's Wiki tab and create the first page via the UI before running this script."
+}
+# Suppress git's CRLF nags for this throwaway clone so they don't become
+# "errors" via PowerShell's native-command stderr handling.
+& git -C $workDir config core.autocrlf false 2>&1 | Out-Null
+& git -C $workDir config core.safecrlf false 2>&1 | Out-Null
+
+try {
+    Push-Location $workDir
+    try {
+        # 2. Wipe existing markdown so removed source files vanish from the wiki.
+        Get-ChildItem -Filter "*.md" -Force | Remove-Item -Force
+
+        # 3. Copy + transform each source file.
+        $written = 0
+        foreach ($entry in $mapping.GetEnumerator()) {
+            $src = Join-Path $docsDir $entry.Key
+            $dst = Join-Path $workDir "$($entry.Value).md"
+            if (-not (Test-Path $src)) {
+                Write-Warning "Source missing, skipping: $src"
+                continue
+            }
+            $content = Get-Content -LiteralPath $src -Raw
+            $content = Rewrite-Links $content
+            Set-Content -LiteralPath $dst -Value $content -Encoding utf8 -NoNewline
+            $written++
+        }
+        Write-Host "Wrote $written markdown pages."
+
+        # 4. Sidebar
+        Set-Content -LiteralPath (Join-Path $workDir '_Sidebar.md') -Value (New-Sidebar) -Encoding utf8 -NoNewline
+
+        # 5. Commit + push if anything actually changed. Drain stderr from each
+        # git invocation so PowerShell doesn't treat warnings as errors.
+        & git add -A 2>&1 | Out-Null
+        $changes = & git status --porcelain 2>&1
+        if (-not $changes) {
+            Write-Host "Wiki already up to date."
+            return
+        }
+        $sha = & git -C $repoRoot rev-parse --short HEAD 2>&1
+        & git -c "user.name=$AuthorName" -c "user.email=$AuthorEmail" commit -q -m "Sync from docs/ at $sha" 2>&1 | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "git commit failed (exit $LASTEXITCODE)" }
+        & git push --quiet 2>&1 | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "git push failed (exit $LASTEXITCODE)" }
+        Write-Host "Pushed updated wiki."
+    }
+    finally { Pop-Location }
+}
+finally {
+    Remove-Item -Recurse -Force $workDir -ErrorAction SilentlyContinue
+}

src/WebhookServer.Core/Ipc/AdminProtocol.cs

@@ -26,6 +26,7 @@ public static class AdminOps
     public const string ListBackups = "list-backups";
     public const string RestoreBackup = "restore-backup";
     public const string ImportConfig = "import-config";
+    public const string CreateCheckpoint = "create-checkpoint";
 }
 
 public sealed class BackupEntry
@@ -33,6 +34,7 @@ public sealed class BackupEntry
     public string FileName { get; set; } = "";
     public DateTimeOffset SavedAt { get; set; }
     public long SizeBytes { get; set; }
+    public string? Description { get; set; }
 }
 
 public sealed class RestoreBackupArgs
@@ -40,6 +42,11 @@ public sealed class RestoreBackupArgs
     public string FileName { get; set; } = "";
 }
 
+public sealed class CreateCheckpointArgs
+{
+    public string? Description { get; set; }
+}
+
 public sealed class AdminRequest
 {
     [JsonPropertyName("op")] public string Op { get; set; } = "";

src/WebhookServer.Core/Storage/ConfigStore.cs

@@ -48,8 +48,15 @@ public sealed class ConfigStore
                 Directory.CreateDirectory(backupsDir);
                 var stamp = DateTime.UtcNow.ToString("yyyyMMdd-HHmmss");
                 var backupPath = System.IO.Path.Combine(backupsDir, $"config-{stamp}.json");
+                if (!File.Exists(backupPath))
+                {
                     File.Copy(Path, backupPath, overwrite: false);
-                PruneBackups(backupsDir, retain: 30);
+                    var sidecar = new { description = "Before save", reason = "before-save" };
+                    File.WriteAllText(
+                        System.IO.Path.ChangeExtension(backupPath, ".meta.json"),
+                        JsonSerializer.Serialize(sidecar, ConfigJson.Compact));
+                }
+                PruneBackups(backupsDir, retain: 90);
             }
             catch
             {
@@ -71,11 +78,18 @@ public sealed class ConfigStore
     private static void PruneBackups(string backupsDir, int retain)
     {
         var stale = new DirectoryInfo(backupsDir).GetFiles("config-*.json")
+            .Where(f => !f.Name.EndsWith(".meta.json", StringComparison.OrdinalIgnoreCase))
             .OrderByDescending(f => f.Name)
             .Skip(retain);
         foreach (var f in stale)
         {
-            try { f.Delete(); } catch { }
+            try
+            {
+                f.Delete();
+                var sidecar = System.IO.Path.ChangeExtension(f.FullName, ".meta.json");
+                if (File.Exists(sidecar)) File.Delete(sidecar);
+            }
+            catch { }
         }
     }
 

src/WebhookServer.Gui/MainWindow.xaml

@@ -29,25 +29,12 @@
                 <Separator/>
                 <MenuItem Header="_Import config…" Command="{Binding ImportConfigCommand}"/>
                 <MenuItem Header="_Export config…" Command="{Binding ExportConfigCommand}"/>
-                <MenuItem Header="Config _Checkpoints"
+                <MenuItem Header="Config _Checkpoints…" Command="{Binding ShowConfigCheckpointsCommand}"/>
-                          ItemsSource="{Binding Backups}"
+                <Separator/>
-                          ToolTip="Snapshots taken automatically before each save. Click one to restore."
+                <MenuItem Header="_Minimize to tray"
-                          SubmenuOpened="OnBackupsSubmenuOpened">
+                          IsCheckable="True"
-                    <MenuItem.ItemContainerStyle>
+                          IsChecked="{Binding MinimizeToTrayEnabled, Mode=TwoWay}"
-                        <Style TargetType="MenuItem">
+                          ToolTip="When ticked, closing or minimizing the window hides it to the tray and keeps the GUI process alive. Untick to make the X button quit the app."/>
-                            <Setter Property="Header">
-                                <Setter.Value>
-                                    <MultiBinding StringFormat="{}{0:yyyy-MM-dd HH:mm:ss}  ({1:n0} bytes)">
-                                        <Binding Path="SavedAt"/>
-                                        <Binding Path="SizeBytes"/>
-                                    </MultiBinding>
-                                </Setter.Value>
-                            </Setter>
-                            <Setter Property="Command" Value="{Binding DataContext.RestoreBackupCommand, RelativeSource={RelativeSource AncestorType=Window}}"/>
-                            <Setter Property="CommandParameter" Value="{Binding}"/>
-                        </Style>
-                    </MenuItem.ItemContainerStyle>
-                </MenuItem>
                 <Separator/>
                 <MenuItem Header="E_xit" Command="{Binding ExitCommand}"/>
             </MenuItem>
@@ -81,17 +68,26 @@
                 <DataGrid.RowStyle>
                     <Style TargetType="DataGridRow">
                         <EventSetter Event="MouseDoubleClick" Handler="OnRowDoubleClick"/>
+                        <!-- The ContextMenu lives in its own visual tree (a popup), so
+                             AncestorType=Window doesn't resolve from inside menu items.
+                             Stash MainViewModel on the row's Tag here (still in the
+                             Window's tree), then reach it from the menu via
+                             PlacementTarget.Tag. -->
+                        <Setter Property="Tag" Value="{Binding DataContext, RelativeSource={RelativeSource AncestorType=Window}}"/>
                         <Setter Property="ContextMenu">
                             <Setter.Value>
                                 <ContextMenu>
-                                    <MenuItem Header="_Edit…" Command="{Binding DataContext.EditEndpointCommand, RelativeSource={RelativeSource AncestorType=Window}}"/>
+                                    <MenuItem Header="_Edit…"
-                                    <MenuItem Header="_Copy URL" Command="{Binding DataContext.CopyEndpointUrlCommand, RelativeSource={RelativeSource AncestorType=Window}}"/>
+                                              Command="{Binding PlacementTarget.Tag.EditEndpointCommand, RelativeSource={RelativeSource AncestorType=ContextMenu}}"/>
+                                    <MenuItem Header="_Copy URL"
+                                              Command="{Binding PlacementTarget.Tag.CopyEndpointUrlCommand, RelativeSource={RelativeSource AncestorType=ContextMenu}}"/>
                                     <Separator/>
                                     <MenuItem Header="Toggle _enabled"
-                                              Command="{Binding DataContext.ToggleEnabledCommand, RelativeSource={RelativeSource AncestorType=Window}}"
+                                              Command="{Binding PlacementTarget.Tag.ToggleEnabledCommand, RelativeSource={RelativeSource AncestorType=ContextMenu}}"
-                                              CommandParameter="{Binding}"/>
+                                              CommandParameter="{Binding PlacementTarget.DataContext, RelativeSource={RelativeSource AncestorType=ContextMenu}}"/>
                                     <Separator/>
-                                    <MenuItem Header="_Delete…" Command="{Binding DataContext.DeleteEndpointCommand, RelativeSource={RelativeSource AncestorType=Window}}"/>
+                                    <MenuItem Header="_Delete…"
+                                              Command="{Binding PlacementTarget.Tag.DeleteEndpointCommand, RelativeSource={RelativeSource AncestorType=ContextMenu}}"/>
                                 </ContextMenu>
                             </Setter.Value>
                         </Setter>

src/WebhookServer.Gui/MainWindow.xaml.cs

@@ -1,3 +1,4 @@
+using System.ComponentModel;
 using System.Windows;
 using System.Windows.Controls;
 using System.Windows.Input;
@@ -11,26 +12,56 @@ public partial class MainWindow : Window
     private readonly TrayIcon _tray;
     private readonly MainViewModel _vm;
 
+    /// <summary>
+    /// Set to true when the user has explicitly asked to quit (File -> Exit or
+    /// Tray -> Exit). The OnClosing handler reads this to decide whether to
+    /// actually let the window close or hide it to the tray.
+    /// </summary>
+    public bool ExitForReal { get; set; }
+
     public MainWindow()
     {
         InitializeComponent();
         _vm = new MainViewModel(new AdminPipeClient());
         DataContext = _vm;
+        _vm.RealExitRequested += OnRealExitRequested;
 
         _tray = new TrayIcon(
             resolveMainWindow: () => Application.Current.MainWindow,
-            restartServiceAsync: async () => await new AdminPipeClient().RestartListenerAsync());
+            restartServiceAsync: async () => await new AdminPipeClient().RestartListenerAsync(),
+            onExit: OnRealExitRequested);
 
         Loaded += async (_, _) => await _vm.RefreshCommand.ExecuteAsync(null);
         StateChanged += OnStateChanged;
-        Closed += (_, _) => _tray.Dispose();
+        Closing += OnClosing;
+    }
+
+    private void OnClosing(object? sender, CancelEventArgs e)
+    {
+        if (ExitForReal || !_vm.MinimizeToTrayEnabled)
+        {
+            _tray.Dispose();
+            return;
+        }
+        // Treat the X button / Alt+F4 like a minimize: hide to tray, keep the
+        // process alive so the tray icon persists.
+        e.Cancel = true;
+        Hide();
+        ShowInTaskbar = false;
+    }
+
+    private void OnRealExitRequested()
+    {
+        ExitForReal = true;
+        Application.Current.Shutdown();
     }
 
     private void OnStateChanged(object? sender, EventArgs e)
     {
-        // Minimize-to-tray: hide the window when the user minimizes; restoring is
+        // Minimize-to-tray: hide the window when the user minimizes IF they've
-        // via the tray icon's double-click or context menu.
+        // opted in via File -> Minimize to tray. Otherwise behave like a normal
-        if (WindowState == WindowState.Minimized)
+        // Windows minimize.
+        if (WindowState == WindowState.Minimized && _vm.MinimizeToTrayEnabled)
         {
             Hide();
             ShowInTaskbar = false;
@@ -53,9 +84,4 @@ public partial class MainWindow : Window
             vm.EditEndpointCommand.Execute(null);
     }
 
-    private async void OnBackupsSubmenuOpened(object sender, RoutedEventArgs e)
-    {
-        if (DataContext is MainViewModel vm)
-            await vm.RefreshBackupsCommand.ExecuteAsync(null);
-    }
 }

src/WebhookServer.Gui/Services/AdminPipeClient.cs

@@ -100,4 +100,7 @@ public sealed class AdminPipeClient
 
     public Task<AdminResponse> ImportConfigAsync(ServerConfig config, CancellationToken ct = default) =>
         InvokeAsync(AdminOps.ImportConfig, config, ct);
+
+    public Task<BackupEntry?> CreateCheckpointAsync(string? description, CancellationToken ct = default) =>
+        InvokeAsync<BackupEntry>(AdminOps.CreateCheckpoint, new CreateCheckpointArgs { Description = description }, ct);
 }

src/WebhookServer.Gui/Services/GuiSettings.cs

@@ -0,0 +1,50 @@
+using System.IO;
+using System.Text.Json;
+
+namespace WebhookServer.Gui.Services;
+
+/// <summary>
+/// Per-user GUI preferences that don't belong in the service-side ServerConfig.
+/// Persisted to %APPDATA%\WebhookServer\gui.json. Best-effort: failures to read
+/// or write fall back silently to defaults.
+/// </summary>
+public sealed class GuiSettings
+{
+    /// <summary>
+    /// When true, the X / Alt+F4 / minimize buttons hide the window to the tray
+    /// and keep the GUI process alive. When false, X exits the app and minimize
+    /// behaves like a normal Windows minimize.
+    /// </summary>
+    public bool MinimizeToTrayEnabled { get; set; } = true;
+
+    private static string FilePath => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
+        "WebhookServer",
+        "gui.json");
+
+    public static GuiSettings Load()
+    {
+        try
+        {
+            if (File.Exists(FilePath))
+            {
+                var json = File.ReadAllText(FilePath);
+                if (!string.IsNullOrWhiteSpace(json))
+                    return JsonSerializer.Deserialize<GuiSettings>(json) ?? new GuiSettings();
+            }
+        }
+        catch { /* fall through to defaults */ }
+        return new GuiSettings();
+    }
+
+    public void Save()
+    {
+        try
+        {
+            var dir = Path.GetDirectoryName(FilePath);
+            if (!string.IsNullOrEmpty(dir)) Directory.CreateDirectory(dir);
+            File.WriteAllText(FilePath, JsonSerializer.Serialize(this, new JsonSerializerOptions { WriteIndented = true }));
+        }
+        catch { /* best effort */ }
+    }
+}

src/WebhookServer.Gui/Services/TrayIcon.cs

@@ -16,11 +16,13 @@ public sealed class TrayIcon : IDisposable
     private readonly NotifyIcon _icon;
     private readonly Func<Window?> _resolveMainWindow;
     private readonly Func<Task> _restartServiceAsync;
+    private readonly Action _onExit;
 
-    public TrayIcon(Func<Window?> resolveMainWindow, Func<Task> restartServiceAsync)
+    public TrayIcon(Func<Window?> resolveMainWindow, Func<Task> restartServiceAsync, Action onExit)
     {
         _resolveMainWindow = resolveMainWindow;
         _restartServiceAsync = restartServiceAsync;
+        _onExit = onExit;
 
         _icon = new NotifyIcon
         {
@@ -39,7 +41,7 @@ public sealed class TrayIcon : IDisposable
         menu.Items.Add(new ToolStripSeparator());
         menu.Items.Add("&Restart service", null, async (_, _) => await _restartServiceAsync().ConfigureAwait(false));
         menu.Items.Add(new ToolStripSeparator());
-        menu.Items.Add("E&xit", null, (_, _) => Application.Current.Shutdown());
+        menu.Items.Add("E&xit", null, (_, _) => _onExit());
         return menu;
     }
 

src/WebhookServer.Gui/ViewModels/ConfigCheckpointsViewModel.cs

@@ -0,0 +1,105 @@
+using System.Collections.ObjectModel;
+using System.Runtime.Versioning;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using WebhookServer.Core.Ipc;
+using WebhookServer.Gui.Services;
+
+namespace WebhookServer.Gui.ViewModels;
+
+[SupportedOSPlatform("windows")]
+public sealed partial class ConfigCheckpointsViewModel : ObservableObject
+{
+    private readonly AdminPipeClient _client;
+
+    public ObservableCollection<BackupEntry> Checkpoints { get; } = new();
+
+    [ObservableProperty] private BackupEntry? _selected;
+    [ObservableProperty] private string _statusMessage = "";
+
+    public ConfigCheckpointsViewModel(AdminPipeClient client)
+    {
+        _client = client;
+    }
+
+    [RelayCommand]
+    public async Task RefreshAsync()
+    {
+        try
+        {
+            var list = await _client.ListBackupsAsync().ConfigureAwait(false);
+            Application.Current.Dispatcher.Invoke(() =>
+            {
+                Checkpoints.Clear();
+                foreach (var b in list) Checkpoints.Add(b);
+                StatusMessage = list.Count == 0
+                    ? "No checkpoints yet. Save the config or click Take Checkpoint Now."
+                    : $"{list.Count} checkpoint{(list.Count == 1 ? "" : "s")}.";
+            });
+        }
+        catch (Exception ex)
+        {
+            Application.Current.Dispatcher.Invoke(() => StatusMessage = $"Could not load: {ex.Message}");
+        }
+    }
+
+    [RelayCommand]
+    private async Task TakeCheckpointAsync()
+    {
+        // Prompt for an optional description on the UI thread.
+        string? description = null;
+        var prompted = Application.Current.Dispatcher.Invoke(() =>
+        {
+            var dlg = new Views.TakeCheckpointDialog { Owner = Application.Current.MainWindow };
+            if (dlg.ShowDialog() != true) return false;
+            description = string.IsNullOrWhiteSpace(dlg.Description) ? null : dlg.Description;
+            return true;
+        });
+        if (!prompted) return;
+
+        try
+        {
+            var entry = await _client.CreateCheckpointAsync(description).ConfigureAwait(false);
+            await RefreshAsync().ConfigureAwait(false);
+            if (entry is not null)
+            {
+                Application.Current.Dispatcher.Invoke(() =>
+                {
+                    Selected = Checkpoints.FirstOrDefault(c => c.FileName == entry.FileName);
+                    StatusMessage = $"Created {entry.FileName}";
+                });
+            }
+        }
+        catch (Exception ex)
+        {
+            Application.Current.Dispatcher.Invoke(() =>
+                MessageBox.Show(ex.Message, "Take checkpoint failed", MessageBoxButton.OK, MessageBoxImage.Error));
+        }
+    }
+
+    [RelayCommand]
+    private async Task RollbackAsync()
+    {
+        if (Selected is null) return;
+
+        var ok = MessageBox.Show(
+            $"Roll the configuration back to the checkpoint from {Selected.SavedAt.ToLocalTime():yyyy-MM-dd HH:mm:ss}?\n\nThe current configuration is automatically saved as a new checkpoint first, so you can roll forward again.",
+            "Confirm rollback",
+            MessageBoxButton.OKCancel,
+            MessageBoxImage.Warning);
+        if (ok != MessageBoxResult.OK) return;
+
+        try
+        {
+            await _client.RestoreBackupAsync(Selected.FileName).ConfigureAwait(false);
+            await RefreshAsync().ConfigureAwait(false);
+            Application.Current.Dispatcher.Invoke(() =>
+                StatusMessage = $"Rolled back to {Selected!.FileName}.");
+        }
+        catch (Exception ex)
+        {
+            Application.Current.Dispatcher.Invoke(() =>
+                MessageBox.Show(ex.Message, "Rollback failed", MessageBoxButton.OK, MessageBoxImage.Error));
+        }
+    }
+}

src/WebhookServer.Gui/ViewModels/MainViewModel.cs

@@ -29,17 +29,28 @@ public sealed partial class MainViewModel : ObservableObject
     [ObservableProperty] private ServerConfig _serverConfig = new();
     [ObservableProperty] private string _httpBaseUrl = "http://localhost:8080";
     [ObservableProperty] private string? _httpsBaseUrl;
+    [ObservableProperty] private bool _minimizeToTrayEnabled;
 
     private readonly DispatcherTimer _logTimer;
+    private readonly GuiSettings _settings;
 
     public MainViewModel(AdminPipeClient client)
     {
         _client = client;
+        _settings = GuiSettings.Load();
+        _minimizeToTrayEnabled = _settings.MinimizeToTrayEnabled;
+
         _logTimer = new DispatcherTimer(DispatcherPriority.Background) { Interval = TimeSpan.FromSeconds(3) };
         _logTimer.Tick += async (_, _) => await RefreshLogTailAsync();
         _logTimer.Start();
     }
 
+    partial void OnMinimizeToTrayEnabledChanged(bool value)
+    {
+        _settings.MinimizeToTrayEnabled = value;
+        _settings.Save();
+    }
+
     [RelayCommand]
     private async Task RefreshAsync()
     {
@@ -175,39 +186,18 @@ public sealed partial class MainViewModel : ObservableObject
         }
     }
 
-    [ObservableProperty] private System.Collections.ObjectModel.ObservableCollection<BackupEntry> _backups = new();
-
     [RelayCommand]
-    private async Task RefreshBackupsAsync()
+    private void ShowConfigCheckpoints()
     {
-        try
+        var dlg = new Views.ConfigCheckpointsDialog
         {
-            var list = await _client.ListBackupsAsync().ConfigureAwait(false);
+            Owner = Application.Current.MainWindow,
-            Application.Current.Dispatcher.Invoke(() =>
+            DataContext = new ConfigCheckpointsViewModel(_client),
-            {
+        };
-                Backups.Clear();
+        dlg.ShowDialog();
-                foreach (var b in list) Backups.Add(b);
+        // After the dialog closes, the live config may have changed via rollback,
-            });
+        // so refresh the main grid.
-        }
+        _ = RefreshAsync();
-        catch { /* ignore - checkpoint listing isn't critical */ }
-    }
-
-    [RelayCommand]
-    private async Task RestoreBackupAsync(BackupEntry? entry)
-    {
-        if (entry is null) return;
-        var ok = MessageBox.Show(
-            $"Restore the configuration from the checkpoint taken at {entry.SavedAt:yyyy-MM-dd HH:mm}?\n\nThe current configuration is automatically saved as a new checkpoint first, so you can roll forward again.",
-            "Restore checkpoint",
-            MessageBoxButton.OKCancel,
-            MessageBoxImage.Question);
-        if (ok != MessageBoxResult.OK) return;
-        try
-        {
-            await _client.RestoreBackupAsync(entry.FileName).ConfigureAwait(false);
-            await RefreshAsync().ConfigureAwait(false);
-        }
-        catch (Exception ex) { ShowError("Restore failed", ex); }
     }
 
     [RelayCommand]
@@ -307,10 +297,14 @@ public sealed partial class MainViewModel : ObservableObject
         }
     }
 
+    /// <summary>Raised when the user picks File -> Exit. MainWindow flips its
+    /// ExitForReal flag and shuts down, bypassing the X-hides-to-tray logic.</summary>
+    public event Action? RealExitRequested;
+
     [RelayCommand]
     private void Exit()
     {
-        Application.Current.Shutdown();
+        RealExitRequested?.Invoke();
     }
 
     [RelayCommand]

src/WebhookServer.Gui/Views/ConfigCheckpointsDialog.xaml

@@ -0,0 +1,53 @@
+<Window x:Class="WebhookServer.Gui.Views.ConfigCheckpointsDialog"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
+        xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
+        xmlns:vm="clr-namespace:WebhookServer.Gui.ViewModels"
+        mc:Ignorable="d"
+        Title="Config Checkpoints"
+        Height="500" Width="640"
+        Icon="/webhook-server.ico"
+        WindowStartupLocation="CenterOwner"
+        d:DataContext="{d:DesignInstance Type=vm:ConfigCheckpointsViewModel}">
+    <DockPanel Margin="12">
+        <TextBlock DockPanel.Dock="Top" TextWrapping="Wrap" Margin="0,0,0,8" Foreground="#444">
+            A checkpoint is a snapshot of <Bold>config.json</Bold> taken before each save and once a day at midnight.
+            Pick one and click <Bold>Roll Back</Bold> to restore it. The current configuration is automatically saved
+            as a new checkpoint before any rollback, so you can always roll forward again.
+        </TextBlock>
+
+        <StackPanel DockPanel.Dock="Bottom" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,8,0,0">
+            <Button Content="Take Checkpoint Now" Command="{Binding TakeCheckpointCommand}" Margin="0,0,8,0" Padding="10,4"/>
+            <Button Content="Roll Back" Command="{Binding RollbackCommand}"
+                    IsEnabled="{Binding Selected, Converter={StaticResource NotNull}}"
+                    Margin="0,0,8,0" Padding="10,4"/>
+            <Button Content="Close" IsCancel="True" Click="OnClose" Padding="10,4"/>
+        </StackPanel>
+
+        <StackPanel DockPanel.Dock="Bottom" Orientation="Horizontal" Margin="0,4,0,0">
+            <Button Content="Refresh" Command="{Binding RefreshCommand}" Padding="8,2"/>
+            <TextBlock Text="{Binding StatusMessage}" Foreground="Gray" FontStyle="Italic" VerticalAlignment="Center" Margin="12,0,0,0"/>
+        </StackPanel>
+
+        <DataGrid ItemsSource="{Binding Checkpoints}"
+                  SelectedItem="{Binding Selected, Mode=TwoWay}"
+                  AutoGenerateColumns="False"
+                  CanUserAddRows="False"
+                  CanUserDeleteRows="False"
+                  IsReadOnly="True"
+                  HeadersVisibility="Column"
+                  GridLinesVisibility="Horizontal">
+            <DataGrid.Columns>
+                <DataGridTextColumn Header="When (local)" Width="170"
+                                    Binding="{Binding SavedAt, StringFormat='{}{0:yyyy-MM-dd HH:mm:ss}', ConverterCulture=en-US}"/>
+                <DataGridTextColumn Header="Description" Width="*"
+                                    Binding="{Binding Description}"/>
+                <DataGridTextColumn Header="Size" Width="100"
+                                    Binding="{Binding SizeBytes, StringFormat='{}{0:n0} bytes'}"/>
+                <DataGridTextColumn Header="File name" Width="200"
+                                    Binding="{Binding FileName}" FontFamily="Consolas"/>
+            </DataGrid.Columns>
+        </DataGrid>
+    </DockPanel>
+</Window>

src/WebhookServer.Gui/Views/ConfigCheckpointsDialog.xaml.cs

@@ -0,0 +1,19 @@
+using System.Windows;
+using WebhookServer.Gui.ViewModels;
+
+namespace WebhookServer.Gui.Views;
+
+public partial class ConfigCheckpointsDialog : Window
+{
+    public ConfigCheckpointsDialog()
+    {
+        InitializeComponent();
+        Loaded += async (_, _) =>
+        {
+            if (DataContext is ConfigCheckpointsViewModel vm)
+                await vm.RefreshAsync();
+        };
+    }
+
+    private void OnClose(object sender, RoutedEventArgs e) => Close();
+}

src/WebhookServer.Gui/Views/TakeCheckpointDialog.xaml

@@ -0,0 +1,34 @@
+<Window x:Class="WebhookServer.Gui.Views.TakeCheckpointDialog"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        Title="Take checkpoint"
+        Height="180" Width="440"
+        ResizeMode="NoResize"
+        WindowStartupLocation="CenterOwner"
+        Icon="/webhook-server.ico"
+        ShowInTaskbar="False">
+    <Grid Margin="16">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="*"/>
+            <RowDefinition Height="Auto"/>
+        </Grid.RowDefinitions>
+
+        <TextBlock Grid.Row="0" TextWrapping="Wrap"
+                   Text="Description for this checkpoint (optional):"/>
+        <TextBox x:Name="DescriptionBox" Grid.Row="1" Margin="0,8,0,0" MaxLength="120">
+            <TextBox.InputBindings>
+                <KeyBinding Key="Enter" Command="{Binding OkCommand, ElementName=Self, FallbackValue={x:Null}}"/>
+            </TextBox.InputBindings>
+        </TextBox>
+        <TextBlock Grid.Row="2" Foreground="Gray" FontStyle="Italic" FontSize="11" Margin="0,4,0,0"
+                   Text="Examples: 'Before adding new endpoint', 'Pre-AD-policy-change'. Leave blank to use 'Manual checkpoint'."/>
+
+        <StackPanel Grid.Row="4" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,12,0,0">
+            <Button Content="OK" Width="80" IsDefault="True" Click="OnOk" Margin="0,0,8,0"/>
+            <Button Content="Cancel" Width="80" IsCancel="True" Click="OnCancel"/>
+        </StackPanel>
+    </Grid>
+</Window>

src/WebhookServer.Gui/Views/TakeCheckpointDialog.xaml.cs

@@ -0,0 +1,27 @@
+using System.Windows;
+
+namespace WebhookServer.Gui.Views;
+
+public partial class TakeCheckpointDialog : Window
+{
+    public string Description { get; private set; } = "";
+
+    public TakeCheckpointDialog()
+    {
+        InitializeComponent();
+        Loaded += (_, _) => DescriptionBox.Focus();
+    }
+
+    private void OnOk(object sender, RoutedEventArgs e)
+    {
+        Description = DescriptionBox.Text?.Trim() ?? "";
+        DialogResult = true;
+        Close();
+    }
+
+    private void OnCancel(object sender, RoutedEventArgs e)
+    {
+        DialogResult = false;
+        Close();
+    }
+}

src/WebhookServer.Service/AdminPipeServer.cs

@@ -225,16 +225,65 @@ internal sealed class AdminPipeServer : BackgroundService
                 return AdminResponse.Success(SafeSnapshotForWire(_state.Snapshot()));
             }
 
+            case AdminOps.CreateCheckpoint:
+            {
+                var args = DeserializeData<CreateCheckpointArgs>(request);
+                var description = args?.Description;
+                if (string.IsNullOrWhiteSpace(description)) description = "Manual checkpoint";
+                var entry = CreateCheckpoint("manual", description);
+                _logger.LogInformation("Manual checkpoint created: {File} ({Desc})", entry.FileName, description);
+                return AdminResponse.Success(entry);
+            }
+
             default:
                 return AdminResponse.Failure($"unknown op '{request.Op}'");
         }
     }
 
+    /// <summary>
+    /// Snapshot the current config.json into the backups folder. Used by the
+    /// "Take checkpoint now" GUI action, the midnight scheduler, and the
+    /// auto-on-save hook in ConfigStore. Description is stored in a sidecar
+    /// .meta.json file next to the snapshot so it survives restarts and can
+    /// be rendered in the GUI.
+    /// </summary>
+    public static BackupEntry CreateCheckpoint(string reason, string description)
+    {
+        var configPath = ServicePaths.ConfigPath;
+        if (!File.Exists(configPath))
+            throw new FileNotFoundException("no config.json exists yet to snapshot");
+
+        var dir = Path.Combine(ServicePaths.DataRoot, "backups");
+        Directory.CreateDirectory(dir);
+
+        var stamp = DateTime.UtcNow.ToString("yyyyMMdd-HHmmss");
+        var dest = Path.Combine(dir, $"config-{stamp}.json");
+        if (File.Exists(dest))
+            dest = Path.Combine(dir, $"config-{stamp}-{reason}.json");
+
+        File.Copy(configPath, dest);
+
+        // Write the sidecar metadata.
+        var sidecarPath = Path.ChangeExtension(dest, ".meta.json");
+        var sidecar = new { description, reason };
+        File.WriteAllText(sidecarPath, JsonSerializer.Serialize(sidecar, ConfigJson.Compact));
+
+        var info = new FileInfo(dest);
+        return new BackupEntry
+        {
+            FileName = info.Name,
+            SavedAt = info.LastWriteTimeUtc,
+            SizeBytes = info.Length,
+            Description = description,
+        };
+    }
+
     private static List<BackupEntry> ListBackups()
     {
         var dir = Path.Combine(ServicePaths.DataRoot, "backups");
         if (!Directory.Exists(dir)) return new List<BackupEntry>();
         return new DirectoryInfo(dir).GetFiles("config-*.json")
+            .Where(f => !f.Name.EndsWith(".meta.json", StringComparison.OrdinalIgnoreCase))
             .OrderByDescending(f => f.Name)
             .Take(50)
             .Select(f => new BackupEntry
@@ -242,10 +291,23 @@ internal sealed class AdminPipeServer : BackgroundService
                 FileName = f.Name,
                 SavedAt = f.LastWriteTimeUtc,
                 SizeBytes = f.Length,
+                Description = ReadSidecarDescription(f.FullName),
             })
             .ToList();
     }
 
+    private static string? ReadSidecarDescription(string snapshotPath)
+    {
+        try
+        {
+            var sidecarPath = Path.ChangeExtension(snapshotPath, ".meta.json");
+            if (!File.Exists(sidecarPath)) return null;
+            using var doc = JsonDocument.Parse(File.ReadAllText(sidecarPath));
+            return doc.RootElement.TryGetProperty("description", out var d) ? d.GetString() : null;
+        }
+        catch { return null; }
+    }
+
     private async Task<ServerConfig> RestoreBackupAsync(string fileName, CancellationToken ct)
     {
         // Refuse anything that tries to escape the backups directory.

src/WebhookServer.Service/CheckpointScheduler.cs

@@ -0,0 +1,50 @@
+using System.Runtime.Versioning;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace WebhookServer.Service;
+
+/// <summary>
+/// Creates a daily config checkpoint at midnight (local time). Combined with
+/// the auto-on-save snapshots in ConfigStore.SaveAsync, this guarantees a
+/// rollback point for every day even if the user makes no changes.
+/// </summary>
+[SupportedOSPlatform("windows")]
+internal sealed class CheckpointScheduler : BackgroundService
+{
+    private readonly ILogger<CheckpointScheduler> _logger;
+
+    public CheckpointScheduler(ILogger<CheckpointScheduler> logger)
+    {
+        _logger = logger;
+    }
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        _logger.LogInformation("Daily checkpoint scheduler running");
+
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            var now = DateTime.Now;
+            var nextMidnight = now.Date.AddDays(1);
+            var delay = nextMidnight - now;
+
+            try { await Task.Delay(delay, stoppingToken).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return; }
+
+            try
+            {
+                var entry = AdminPipeServer.CreateCheckpoint("daily", "Nightly auto-checkpoint");
+                _logger.LogInformation("Daily checkpoint created: {File}", entry.FileName);
+            }
+            catch (FileNotFoundException)
+            {
+                // No config.json yet (fresh install, GUI never opened) - skip silently.
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Daily checkpoint creation failed");
+            }
+        }
+    }
+}

src/WebhookServer.Service/Program.cs

@@ -49,6 +49,7 @@ try
     builder.Services.AddSingleton<WebhookRouter>();
     builder.Services.AddHostedService<CallbackBackgroundService>();
     builder.Services.AddHostedService<AdminPipeServer>();
+    builder.Services.AddHostedService<CheckpointScheduler>();
 
     var app = builder.Build();