From b755eaf3fe5a6df617fddbbba55ee659c39f45c5 Mon Sep 17 00:00:00 2001
From: Pulse Monitor <pulse@pulse-monitor.dev>
Date: Thu, 14 Aug 2025 10:04:15 +0000
Subject: [PATCH] docs: update export/import documentation

- Clarify that session auth (password login) is sufficient for export/import
- Document that guest metadata and custom console URLs are included
- Update FAQ with clearer backup instructions
- Add UI-first approach to README backup section
---
 README.md        | 9 +++++++--
 docs/API.md      | 9 +++++++--
 docs/FAQ.md      | 5 ++++-
 docs/SECURITY.md | 2 +-
 4 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 0e1ec0979..dc3f64140 100644
--- a/README.md
+++ b/README.md
@@ -198,6 +198,13 @@ Environment="FRONTEND_PORT=8080"
 
 ### Backup/Restore
 
+**Via UI (recommended):**
+- Settings → Security → Backup & Restore
+- Export: Choose login password or custom passphrase for encryption
+- Import: Upload backup file with passphrase
+- Includes all settings, nodes, and custom console URLs
+
+**Via CLI:**
 ```bash
 # Export (v4.0.3+)
 pulse config export -o backup.enc
@@ -206,8 +213,6 @@ pulse config export -o backup.enc
 pulse config import -i backup.enc
 ```
 
-Or use Settings → Security tab in UI.
-
 ## Updates
 
 ### Docker
diff --git a/docs/API.md b/docs/API.md
index 1ba110b11..9df5c7f76 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -219,14 +219,19 @@ DELETE /api/system/api-token/delete # Remove token
 ```
 
 ### Export/Import Configuration
-Backup and restore Pulse configuration.
+Backup and restore Pulse configuration with encryption.
 
 ```bash
 POST /api/config/export  # Export encrypted config
 POST /api/config/import  # Import encrypted config
 ```
 
-**Note**: Requires API_TOKEN or ALLOW_UNPROTECTED_EXPORT=true
+**Authentication**: Requires one of:
+- Active session (when logged in with password)
+- API token via X-API-Token header
+- ALLOW_UNPROTECTED_EXPORT=true (for unprotected instances)
+
+**Export includes**: All nodes, credentials (encrypted), alerts, webhooks, email config, system settings, and guest metadata (custom console URLs)
 
 ## Notifications
 
diff --git a/docs/FAQ.md b/docs/FAQ.md
index 086971207..b4871d815 100644
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@@ -32,7 +32,10 @@ API tokens are more secure. Create in Proxmox: Datacenter → Permissions → AP
 See [Configuration Guide](CONFIGURATION.md) for details
 
 ### How do I backup my configuration?
-Settings → Security → Export Configuration (requires API token or ALLOW_UNPROTECTED_EXPORT=true)
+Settings → Security → Backup & Restore → Export Backup
+- If logged in with password: Just enter your password or a custom passphrase
+- If using API token only: Provide the API token when prompted
+- Includes all settings, nodes, credentials (encrypted), and custom console URLs
 
 ### Can Pulse detect Proxmox clusters?
 Yes! When you add one cluster node, Pulse automatically discovers and monitors all nodes
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index dbd7f85d4..d628fdd1a 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -282,7 +282,7 @@ This checks:
 
 ## Troubleshooting
 
-**Export blocked?** Set API_TOKEN or ALLOW_UNPROTECTED_EXPORT=true
+**Export blocked?** Login with password, set API_TOKEN, or set ALLOW_UNPROTECTED_EXPORT=true
 **Rate limited?** Wait 1 minute and try again
 **Can't login?** Check PULSE_AUTH_USER and PULSE_AUTH_PASS environment variables
 **API access denied?** Verify API_TOKEN is correct (use original token, not hash)