feat: add unsubscribe and update user page

email/send.go

···
 }
 
 type Mailer struct {
-	cfg SMTPConfig
+	cfg          SMTPConfig
+	unsubBaseURL string
 }
 
-func NewMailer(cfg SMTPConfig) *Mailer {
-	return &Mailer{cfg: cfg}
+func NewMailer(cfg SMTPConfig, unsubBaseURL string) *Mailer {
+	return &Mailer{
+		cfg:          cfg,
+		unsubBaseURL: unsubBaseURL,
+	}
 }
 
-func (m *Mailer) Send(to, subject, htmlBody, textBody string) error {
+func (m *Mailer) Send(to, subject, htmlBody, textBody, unsubToken string) error {
 	addr := net.JoinHostPort(m.cfg.Host, fmt.Sprintf("%d", m.cfg.Port))
 
 	boundary := "==herald-boundary-a1b2c3d4e5f6=="
 
+	// Add unsubscribe footer if token provided
+	if unsubToken != "" {
+		unsubURL := m.unsubBaseURL + "/unsubscribe/" + unsubToken
+		
+		htmlFooter := fmt.Sprintf(`<hr><p style="font-size: 12px; color: #666;"><a href="%s">Unsubscribe</a></p>`, unsubURL)
+		htmlBody = htmlBody + htmlFooter
+		
+		textFooter := fmt.Sprintf("\n\n---\nUnsubscribe: %s\n", unsubURL)
+		textBody = textBody + textFooter
+	}
+
 	headers := make(map[string]string)
 	headers["From"] = m.cfg.From
 	headers["To"] = to
 	headers["Subject"] = mime.QEncoding.Encode("utf-8", subject)
 	headers["MIME-Version"] = "1.0"
 	headers["Content-Type"] = fmt.Sprintf("multipart/alternative; boundary=%q", boundary)
+
+	// Add RFC 8058 unsubscribe headers
+	if unsubToken != "" {
+		unsubURL := m.unsubBaseURL + "/unsubscribe/" + unsubToken
+		headers["List-Unsubscribe"] = fmt.Sprintf("<%s>", unsubURL)
+		headers["List-Unsubscribe-Post"] = "List-Unsubscribe=One-Click"
+	}
 
 	var msg strings.Builder
 	for k, v := range headers {

main.go

···
 		User: cfg.SMTP.User,
 		Pass: cfg.SMTP.Pass,
 		From: cfg.SMTP.From,
-	})
+	}, cfg.Origin)
 
 	sched := scheduler.NewScheduler(db, mailer, logger, 60*time.Second)
 

scheduler/scheduler.go

···
 			return 0, fmt.Errorf("render digest: %w", err)
 		}
 
+		unsubToken, err := s.store.GetOrCreateUnsubscribeToken(ctx, cfg.ID)
+		if err != nil {
+			s.logger.Warn("failed to create unsubscribe token", "err", err)
+			unsubToken = ""
+		}
+
 		subject := "feed digest"
-		if err := s.mailer.Send(cfg.Email, subject, htmlBody, textBody); err != nil {
+		if err := s.mailer.Send(cfg.Email, subject, htmlBody, textBody, unsubToken); err != nil {
 			return 0, fmt.Errorf("send email: %w", err)
 		}
 
···
 			return fmt.Errorf("render digest: %w", err)
 		}
 
+		unsubToken, err := s.store.GetOrCreateUnsubscribeToken(ctx, cfg.ID)
+		if err != nil {
+			s.logger.Warn("failed to create unsubscribe token", "err", err)
+			unsubToken = ""
+		}
+
 		subject := "feed digest"
-		if err := s.mailer.Send(cfg.Email, subject, htmlBody, textBody); err != nil {
+		if err := s.mailer.Send(cfg.Email, subject, htmlBody, textBody, unsubToken); err != nil {
 			return fmt.Errorf("send email: %w", err)
 		}
 

ssh/commands.go

···
 			return
 		}
 		handleRm(ctx, sess, user, st, cmd[1])
+	case "activate":
+		if len(cmd) < 2 {
+			fmt.Fprintln(sess, errorStyle.Render("Usage: activate <filename>"))
+			return
+		}
+		handleActivate(ctx, sess, user, st, cmd[1])
+	case "deactivate":
+		if len(cmd) < 2 {
+			fmt.Fprintln(sess, errorStyle.Render("Usage: deactivate <filename>"))
+			return
+		}
+		handleDeactivate(ctx, sess, user, st, cmd[1])
 	case "run":
 		if len(cmd) < 2 {
 			fmt.Fprintln(sess, errorStyle.Render("Usage: run <filename>"))
···
 		handleLogs(ctx, sess, user, st)
 	default:
 		fmt.Fprintf(sess, errorStyle.Render("Unknown command: %s\n"), cmd[0])
-		fmt.Fprintln(sess, "Available commands: ls, cat, rm, run, logs")
+		fmt.Fprintln(sess, "Available commands: ls, cat, rm, activate, deactivate, run, logs")
 	}
 }
 
···
 	}
 
 	fmt.Fprintln(sess, successStyle.Render("Deleted: "+filename))
+}
+
+func handleActivate(ctx context.Context, sess ssh.Session, user *store.User, st *store.DB, filename string) {
+	err := st.ActivateConfig(ctx, user.ID, filename)
+	if err != nil {
+		fmt.Fprintln(sess, errorStyle.Render("Error: "+err.Error()))
+		return
+	}
+
+	fmt.Fprintln(sess, successStyle.Render("Activated: "+filename))
+}
+
+func handleDeactivate(ctx context.Context, sess ssh.Session, user *store.User, st *store.DB, filename string) {
+	err := st.DeactivateConfigByFilename(ctx, user.ID, filename)
+	if err != nil {
+		fmt.Fprintln(sess, errorStyle.Render("Error: "+err.Error()))
+		return
+	}
+
+	fmt.Fprintln(sess, successStyle.Render("Deactivated: "+filename))
 }
 
 func handleRun(ctx context.Context, sess ssh.Session, user *store.User, st *store.DB, sched *scheduler.Scheduler, filename string) {

store/configs.go

···
 	"database/sql"
 	"fmt"
 	"time"
+
+	"github.com/adhocore/gronx"
 )
 
 type Config struct {
···
 	}
 	return configs, rows.Err()
 }
+
+func (db *DB) DeactivateConfig(ctx context.Context, configID int64) error {
+	_, err := db.ExecContext(ctx,
+		`UPDATE configs SET next_run = NULL WHERE id = ?`,
+		configID,
+	)
+	if err != nil {
+		return fmt.Errorf("deactivate config: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) DeactivateConfigByFilename(ctx context.Context, userID int64, filename string) error {
+	cfg, err := db.GetConfig(ctx, userID, filename)
+	if err != nil {
+		return err
+	}
+	return db.DeactivateConfig(ctx, cfg.ID)
+}
+
+func (db *DB) ActivateConfig(ctx context.Context, userID int64, filename string) error {
+	cfg, err := db.GetConfig(ctx, userID, filename)
+	if err != nil {
+		return err
+	}
+
+	nextRun, err := gronx.NextTick(cfg.CronExpr, false)
+	if err != nil {
+		return fmt.Errorf("calculate next run: %w", err)
+	}
+
+	_, err = db.ExecContext(ctx,
+		`UPDATE configs SET next_run = ? WHERE id = ?`,
+		nextRun,
+		cfg.ID,
+	)
+	if err != nil {
+		return fmt.Errorf("activate config: %w", err)
+	}
+	return nil
+}

store/db.go

···
 		created_at DATETIME DEFAULT CURRENT_TIMESTAMP
 	);
 
+	CREATE TABLE IF NOT EXISTS unsubscribe_tokens (
+		id INTEGER PRIMARY KEY,
+		token TEXT UNIQUE NOT NULL,
+		config_id INTEGER NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+		created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+	);
+
 	CREATE INDEX IF NOT EXISTS idx_configs_user_id ON configs(user_id);
 	CREATE INDEX IF NOT EXISTS idx_configs_next_run ON configs(next_run);
 	CREATE INDEX IF NOT EXISTS idx_feeds_config_id ON feeds(config_id);
 	CREATE INDEX IF NOT EXISTS idx_seen_items_feed_id ON seen_items(feed_id);
 	CREATE INDEX IF NOT EXISTS idx_logs_config_id ON logs(config_id);
 	CREATE INDEX IF NOT EXISTS idx_logs_created_at ON logs(created_at);
+	CREATE INDEX IF NOT EXISTS idx_unsubscribe_tokens_token ON unsubscribe_tokens(token);
 	`
 
 	_, err := db.Exec(schema)

store/unsubscribe.go

···
+package store
+
+import (
+	"context"
+	"crypto/rand"
+	"database/sql"
+	"encoding/base64"
+	"fmt"
+)
+
+func (db *DB) CreateUnsubscribeToken(ctx context.Context, configID int64) (string, error) {
+	// Generate random token
+	tokenBytes := make([]byte, 32)
+	if _, err := rand.Read(tokenBytes); err != nil {
+		return "", fmt.Errorf("generate token: %w", err)
+	}
+	token := base64.URLEncoding.EncodeToString(tokenBytes)
+
+	_, err := db.ExecContext(ctx,
+		`INSERT INTO unsubscribe_tokens (token, config_id) VALUES (?, ?)`,
+		token, configID,
+	)
+	if err != nil {
+		return "", fmt.Errorf("insert token: %w", err)
+	}
+
+	return token, nil
+}
+
+func (db *DB) GetConfigByToken(ctx context.Context, token string) (*Config, error) {
+	var configID int64
+	err := db.QueryRowContext(ctx,
+		`SELECT config_id FROM unsubscribe_tokens WHERE token = ?`,
+		token,
+	).Scan(&configID)
+	if err != nil {
+		return nil, err
+	}
+
+	return db.GetConfigByID(ctx, configID)
+}
+
+func (db *DB) DeleteToken(ctx context.Context, token string) error {
+	_, err := db.ExecContext(ctx,
+		`DELETE FROM unsubscribe_tokens WHERE token = ?`,
+		token,
+	)
+	return err
+}
+
+func (db *DB) GetOrCreateUnsubscribeToken(ctx context.Context, configID int64) (string, error) {
+	// Check if token already exists
+	var token string
+	err := db.QueryRowContext(ctx,
+		`SELECT token FROM unsubscribe_tokens WHERE config_id = ? LIMIT 1`,
+		configID,
+	).Scan(&token)
+	
+	if err == nil {
+		return token, nil
+	}
+	
+	if err != sql.ErrNoRows {
+		return "", err
+	}
+
+	// Create new token
+	return db.CreateUnsubscribeToken(ctx, configID)
+}

store/users.go

···
 	}
 	return &user, nil
 }
+
+func (db *DB) GetUserByID(ctx context.Context, userID int64) (*User, error) {
+	var user User
+	err := db.QueryRowContext(ctx,
+		`SELECT id, pubkey_fp, pubkey, created_at FROM users WHERE id = ?`,
+		userID,
+	).Scan(&user.ID, &user.PubkeyFP, &user.Pubkey, &user.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &user, nil
+}
+
+func (db *DB) DeleteUser(ctx context.Context, userID int64) error {
+	_, err := db.ExecContext(ctx, `DELETE FROM users WHERE id = ?`, userID)
+	return err
+}

web/handlers.go

···
 	"encoding/json"
 	"encoding/xml"
 	"errors"
+	"fmt"
 	"net/http"
 	"sort"
+	"strings"
 	"time"
 )
 
···
 	Fingerprint      string
 	ShortFingerprint string
 	Configs          []configInfo
+	Status           string
 	NextRun          string
-	FeedXMLURL       string
-	FeedJSONURL      string
 	Origin           string
 }
 
 type configInfo struct {
-	Filename  string
-	FeedCount int
-	URL       string
+	Filename    string
+	FeedCount   int
+	URL         string
+	FeedXMLURL  string
+	FeedJSONURL string
+	IsActive    bool
 }
 
 func (s *Server) handleUser(w http.ResponseWriter, r *http.Request, fingerprint string) {
···
 	user, err := s.store.GetUserByFingerprint(ctx, fingerprint)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "User Not Found", http.StatusNotFound)
+			s.handle404(w, r)
 			return
 		}
 		s.logger.Error("get user", "err", err)
···
 
 	var configInfos []configInfo
 	var earliestNextRun time.Time
+	hasAnyActive := false
 
 	for _, cfg := range configs {
 		feeds, err := s.store.GetFeedsByConfig(ctx, cfg.ID)
···
 			continue
 		}
 
+		isActive := cfg.NextRun.Valid
+		if isActive {
+			hasAnyActive = true
+		}
+
+		// Generate feed URLs - trim .txt extension for cleaner URLs
+		feedBaseName := strings.TrimSuffix(cfg.Filename, ".txt")
+
 		configInfos = append(configInfos, configInfo{
-			Filename:  cfg.Filename,
-			FeedCount: len(feeds),
-			URL:       "/" + fingerprint + "/" + cfg.Filename,
+			Filename:    cfg.Filename,
+			FeedCount:   len(feeds),
+			URL:         "/" + fingerprint + "/" + cfg.Filename,
+			FeedXMLURL:  "/" + fingerprint + "/" + feedBaseName + ".xml",
+			FeedJSONURL: "/" + fingerprint + "/" + feedBaseName + ".json",
+			IsActive:    isActive,
 		})
 
 		if cfg.NextRun.Valid {
···
 	}
 
 	nextRunStr := "—"
-	if !earliestNextRun.IsZero() {
-		nextRunStr = earliestNextRun.Format("2006-01-02 15:04 MST")
+	status := "INACTIVE"
+	if hasAnyActive {
+		if !earliestNextRun.IsZero() {
+			nextRunStr = earliestNextRun.Format("2006-01-02 15:04 MST")
+		}
+		status = "ACTIVE"
 	}
 
 	shortFP := fingerprint
···
 		Fingerprint:      fingerprint,
 		ShortFingerprint: shortFP,
 		Configs:          configInfos,
+		Status:           status,
 		NextRun:          nextRunStr,
-		FeedXMLURL:       "/" + fingerprint + "/feed.xml",
-		FeedJSONURL:      "/" + fingerprint + "/feed.json",
 		Origin:           s.origin,
 	}
 
···
 	Channel rssChannel `xml:"channel"`
 }
 
-func (s *Server) handleFeedXML(w http.ResponseWriter, r *http.Request, fingerprint string) {
+func (s *Server) handleFeedXML(w http.ResponseWriter, r *http.Request, fingerprint, configFilename string) {
 	ctx := r.Context()
 
 	user, err := s.store.GetUserByFingerprint(ctx, fingerprint)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "User Not Found", http.StatusNotFound)
+			s.handle404(w, r)
 			return
 		}
 		s.logger.Error("get user", "err", err)
···
 		return
 	}
 
-	configs, err := s.store.ListConfigs(ctx, user.ID)
+	cfg, err := s.store.GetConfig(ctx, user.ID, configFilename)
 	if err != nil {
-		s.logger.Error("list configs", "err", err)
+		if errors.Is(err, sql.ErrNoRows) {
+			s.handle404(w, r)
+			return
+		}
+		s.logger.Error("get config", "err", err)
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return
 	}
 
 	var items []rssItem
-	for _, cfg := range configs {
-		feeds, err := s.store.GetFeedsByConfig(ctx, cfg.ID)
+	feeds, err := s.store.GetFeedsByConfig(ctx, cfg.ID)
+	if err != nil {
+		s.logger.Error("get feeds", "err", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	
+	for _, feed := range feeds {
+		seenItems, err := s.store.GetSeenItems(ctx, feed.ID, 50)
 		if err != nil {
 			continue
 		}
-		for _, feed := range feeds {
-			seenItems, err := s.store.GetSeenItems(ctx, feed.ID, 50)
-			if err != nil {
-				continue
+		for _, item := range seenItems {
+			rItem := rssItem{
+				GUID:    item.GUID,
+				PubDate: item.SeenAt.Format(time.RFC1123Z),
 			}
-			for _, item := range seenItems {
-				rItem := rssItem{
-					GUID:    item.GUID,
-					PubDate: item.SeenAt.Format(time.RFC1123Z),
-				}
-				if item.Title.Valid {
-					rItem.Title = item.Title.String
-				}
-				if item.Link.Valid {
-					rItem.Link = item.Link.String
-				}
-				items = append(items, rItem)
+			if item.Title.Valid {
+				rItem.Title = item.Title.String
+			}
+			if item.Link.Valid {
+				rItem.Link = item.Link.String
 			}
+			items = append(items, rItem)
 		}
 	}
 
···
 	feed := rssFeed{
 		Version: "2.0",
 		Channel: rssChannel{
-			Title:       "Herald - " + fingerprint[:12],
-			Link:        s.origin + "/" + fingerprint,
-			Description: "Aggregated feed for " + fingerprint[:12],
+			Title:       "Herald - " + configFilename,
+			Link:        s.origin + "/" + fingerprint + "/" + configFilename,
+			Description: "Feed for " + configFilename,
 			Items:       items,
 		},
 	}
···
 	DatePublished string `json:"date_published"`
 }
 
-func (s *Server) handleFeedJSON(w http.ResponseWriter, r *http.Request, fingerprint string) {
+func (s *Server) handleFeedJSON(w http.ResponseWriter, r *http.Request, fingerprint, configFilename string) {
 	ctx := r.Context()
 
 	user, err := s.store.GetUserByFingerprint(ctx, fingerprint)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "User Not Found", http.StatusNotFound)
+			s.handle404(w, r)
 			return
 		}
 		s.logger.Error("get user", "err", err)
···
 		return
 	}
 
-	configs, err := s.store.ListConfigs(ctx, user.ID)
+	cfg, err := s.store.GetConfig(ctx, user.ID, configFilename)
 	if err != nil {
-		s.logger.Error("list configs", "err", err)
+		if errors.Is(err, sql.ErrNoRows) {
+			s.handle404(w, r)
+			return
+		}
+		s.logger.Error("get config", "err", err)
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return
 	}
 
 	var items []jsonFeedItem
-	for _, cfg := range configs {
-		feeds, err := s.store.GetFeedsByConfig(ctx, cfg.ID)
+	feeds, err := s.store.GetFeedsByConfig(ctx, cfg.ID)
+	if err != nil {
+		s.logger.Error("get feeds", "err", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	
+	for _, feed := range feeds {
+		seenItems, err := s.store.GetSeenItems(ctx, feed.ID, 50)
 		if err != nil {
 			continue
 		}
-		for _, feed := range feeds {
-			seenItems, err := s.store.GetSeenItems(ctx, feed.ID, 50)
-			if err != nil {
-				continue
+		for _, item := range seenItems {
+			jItem := jsonFeedItem{
+				ID:            item.GUID,
+				DatePublished: item.SeenAt.Format(time.RFC3339),
 			}
-			for _, item := range seenItems {
-				jItem := jsonFeedItem{
-					ID:            item.GUID,
-					DatePublished: item.SeenAt.Format(time.RFC3339),
-				}
-				if item.Title.Valid {
-					jItem.Title = item.Title.String
-				}
-				if item.Link.Valid {
-					jItem.URL = item.Link.String
-				}
-				items = append(items, jItem)
+			if item.Title.Valid {
+				jItem.Title = item.Title.String
 			}
+			if item.Link.Valid {
+				jItem.URL = item.Link.String
+			}
+			items = append(items, jItem)
 		}
 	}
 
···
 
 	feed := jsonFeed{
 		Version:     "https://jsonfeed.org/version/1.1",
-		Title:       "Herald - " + fingerprint[:12],
-		HomePageURL: s.origin + "/" + fingerprint,
-		FeedURL:     s.origin + "/" + fingerprint + "/feed.json",
+		Title:       "Herald - " + configFilename,
+		HomePageURL: s.origin + "/" + fingerprint + "/" + configFilename,
+		FeedURL:     s.origin + "/" + fingerprint + "/" + configFilename + ".json",
 		Items:       items,
 	}
 
···
 	user, err := s.store.GetUserByFingerprint(ctx, fingerprint)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "User Not Found", http.StatusNotFound)
+			s.handle404(w, r)
 			return
 		}
 		s.logger.Error("get user", "err", err)
···
 	cfg, err := s.store.GetConfig(ctx, user.ID, filename)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "Config Not Found", http.StatusNotFound)
+			s.handle404(w, r)
 			return
 		}
 		s.logger.Error("get config", "err", err)
···
 	w.Write([]byte(cfg.RawText))
 }
 
+type unsubscribePageData struct {
+	Token            string
+	ShortFingerprint string
+	Filename         string
+	Success          bool
+	Message          string
+	Error            string
+}
+
+func (s *Server) handleUnsubscribeGET(w http.ResponseWriter, r *http.Request, token string) {
+	ctx := r.Context()
+
+	cfg, err := s.store.GetConfigByToken(ctx, token)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			s.handle404WithMessage(w, r, "Invalid Link", "This unsubscribe link is invalid or has expired.")
+			return
+		}
+		s.logger.Error("get config by token", "err", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	user, err := s.store.GetUserByID(ctx, cfg.UserID)
+	if err != nil {
+		s.logger.Error("get user", "err", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	shortFP := user.PubkeyFP
+	if len(shortFP) > 12 {
+		shortFP = shortFP[:12]
+	}
+
+	data := unsubscribePageData{
+		Token:            token,
+		ShortFingerprint: shortFP,
+		Filename:         cfg.Filename,
+	}
+
+	if err := s.tmpl.ExecuteTemplate(w, "unsubscribe.html", data); err != nil {
+		s.logger.Error("render unsubscribe", "err", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	}
+}
+
+func (s *Server) handleUnsubscribePOST(w http.ResponseWriter, r *http.Request, token string) {
+	ctx := r.Context()
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "Bad Request", http.StatusBadRequest)
+		return
+	}
+
+	action := r.FormValue("action")
+	if action != "deactivate" && action != "delete" {
+		http.Error(w, "Invalid action", http.StatusBadRequest)
+		return
+	}
+
+	cfg, err := s.store.GetConfigByToken(ctx, token)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			s.handle404WithMessage(w, r, "Invalid Link", "This unsubscribe link is invalid or has expired.")
+			return
+		}
+		s.logger.Error("get config by token", "err", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	var message string
+
+	if action == "deactivate" {
+		if err := s.store.DeactivateConfig(ctx, cfg.ID); err != nil {
+			s.logger.Error("deactivate config", "err", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+			return
+		}
+		message = fmt.Sprintf("Config '%s' deactivated. You will no longer receive emails for this config. Other configs remain active. Files remain accessible via SSH/SCP.", cfg.Filename)
+		s.logger.Info("config deactivated", "config_id", cfg.ID, "filename", cfg.Filename)
+	} else {
+		if err := s.store.DeleteUser(ctx, cfg.UserID); err != nil {
+			s.logger.Error("delete user", "err", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+			return
+		}
+		message = "All data deleted. You have been completely removed from Herald."
+		s.logger.Info("user deleted", "user_id", cfg.UserID)
+	}
+
+	if err := s.store.DeleteToken(ctx, token); err != nil {
+		s.logger.Error("delete token", "err", err)
+	}
+
+	data := unsubscribePageData{
+		Success: true,
+		Message: message,
+	}
+
+	if err := s.tmpl.ExecuteTemplate(w, "unsubscribe.html", data); err != nil {
+		s.logger.Error("render unsubscribe", "err", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	}
+}
+
+func (s *Server) handleUnsubscribe(w http.ResponseWriter, r *http.Request, token string) {
+	if r.Method == http.MethodGet {
+		s.handleUnsubscribeGET(w, r, token)
+	} else if r.Method == http.MethodPost {
+		s.handleUnsubscribePOST(w, r, token)
+	} else {
+		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
+	}
+}
+
 func stripProtocol(origin string) string {
 	if len(origin) == 0 {
 		return origin
···
 	
 	return hostPort
 }
+
+func (s *Server) handle404(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusNotFound)
+	data := struct {
+		Title   string
+		Message string
+	}{}
+	if err := s.tmpl.ExecuteTemplate(w, "404.html", data); err != nil {
+		s.logger.Error("render 404", "err", err)
+		http.Error(w, "Not Found", http.StatusNotFound)
+	}
+}
+
+func (s *Server) handle404WithMessage(w http.ResponseWriter, r *http.Request, title, message string) {
+	w.WriteHeader(http.StatusNotFound)
+	data := struct {
+		Title   string
+		Message string
+	}{
+		Title:   title,
+		Message: message,
+	}
+	if err := s.tmpl.ExecuteTemplate(w, "404.html", data); err != nil {
+		s.logger.Error("render 404", "err", err)
+		http.Error(w, "Not Found", http.StatusNotFound)
+	}
+}

web/server.go

···
 
 	parts := strings.Split(path, "/")
 
+	if len(parts) == 2 && parts[0] == "unsubscribe" {
+		s.handleUnsubscribe(w, r, parts[1])
+		return
+	}
+
 	switch len(parts) {
 	case 1:
 		s.handleUser(w, r, parts[0])
 	case 2:
-		switch parts[1] {
-		case "feed.xml":
-			s.handleFeedXML(w, r, parts[0])
-		case "feed.json":
-			s.handleFeedJSON(w, r, parts[0])
-		default:
+		// Check if it's a feed file (ends with .xml or .json)
+		if strings.HasSuffix(parts[1], ".xml") {
+			// Extract base name by removing .xml extension, then append .txt to find config
+			baseName := strings.TrimSuffix(parts[1], ".xml")
+			configFile := baseName + ".txt"
+			s.handleFeedXML(w, r, parts[0], configFile)
+		} else if strings.HasSuffix(parts[1], ".json") {
+			// Extract base name by removing .json extension, then append .txt to find config
+			baseName := strings.TrimSuffix(parts[1], ".json")
+			configFile := baseName + ".txt"
+			s.handleFeedJSON(w, r, parts[0], configFile)
+		} else {
+			// Raw config file
 			s.handleConfig(w, r, parts[0], parts[1])
 		}
 	default:
-		http.NotFound(w, r)
+		s.handle404(w, r)
 	}
 }

web/templates/404.html

···
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>HERALD - {{if .Title}}{{.Title}}{{else}}404{{end}}</title>
+    <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🎏</text></svg>">
+    <link rel="stylesheet" href="/style.css">
+</head>
+<body>
+<h1>HERALD</h1>
+<h2>{{if .Title}}{{.Title}}{{else}}404 NOT FOUND{{end}}</h2>
+<p>{{if .Message}}{{.Message}}{{else}}The requested resource does not exist.{{end}}</p>
+<p><a href="/">Return to home</a></p>
+</body>
+</html>

web/templates/index.html

···
 
 <h2>COMMANDS</h2>
 <pre>
-    ls              List uploaded feed configs
-    cat &lt;file&gt;      Display config file contents
-    rm &lt;file&gt;       Delete a config file
-    run &lt;file&gt;      Manually trigger feed fetch and email
-    logs            View recent delivery logs
+    ls                  List uploaded feed configs
+    cat &lt;file&gt;          Display config file contents
+    rm &lt;file&gt;           Delete a config file
+    activate &lt;file&gt;     Reactivate a deactivated config
+    deactivate &lt;file&gt;   Stop emails for a config
+    run &lt;file&gt;          Manually trigger feed fetch and email
+    logs                View recent delivery logs
 </pre>
 
 <h2>EXAMPLES</h2>

web/templates/style.css

···
 strong {
     font-weight: bold;
 }
+.inactive {
+    text-decoration: line-through;
+    opacity: 0.6;
+}

web/templates/unsubscribe.html

···
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>HERALD - Unsubscribe</title>
+    <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🎏</text></svg>">
+    <link rel="stylesheet" href="/style.css">
+</head>
+<body>
+<h1>HERALD</h1>
+
+{{if .Success}}
+    <h2>SUCCESS</h2>
+    <p>{{.Message}}</p>
+    <p><a href="/">Return to home</a></p>
+{{else}}
+    <h2>UNSUBSCRIBE</h2>
+    <p><strong>USER:</strong> {{.ShortFingerprint}}</p>
+    <p><strong>CONFIG:</strong> {{.Filename}}</p>
+    
+    <h2>OPTIONS</h2>
+    <ul>
+        <li>
+            <form method="POST" style="display: inline;">
+                <input type="hidden" name="action" value="deactivate">
+                <a href="#" onclick="this.closest('form').submit(); return false;">Deactivate this config</a>
+            </form>
+            - Stop emails for {{.Filename}} only. Other configs remain active. Files remain accessible via SSH/SCP.
+        </li>
+        <li>
+            <form method="POST" style="display: inline;">
+                <input type="hidden" name="action" value="delete">
+                <a href="#" onclick="this.closest('form').submit(); return false;">Delete Forever</a>
+            </form>
+            - Permanently remove ALL configs and data for this user from Herald.
+        </li>
+    </ul>
+{{end}}
+
+</body>
+</html>

web/templates/user.html

···
 <body>
 <h1>HERALD</h1>
 <p><strong>USER:</strong> {{.ShortFingerprint}}</p>
-<p><strong>STATUS:</strong> ONLINE</p>
+<p><strong>STATUS:</strong> {{.Status}}</p>
 <p><strong>NEXT RUN:</strong> {{.NextRun}}</p>
 <h2>CONFIGS</h2>
 <ul>
 {{range .Configs}}
-    <li><a href="{{.URL}}">{{.Filename}}</a> ({{.FeedCount}} feeds)</li>
+    <li{{if not .IsActive}} class="inactive"{{end}}>
+        <a href="{{.URL}}">{{.Filename}}</a> ({{.FeedCount}} feeds)
+        - <a href="{{.FeedXMLURL}}">RSS</a>
+        - <a href="{{.FeedJSONURL}}">JSON</a>
+    </li>
 {{else}}
     <li>No configs uploaded</li>
 {{end}}
-</ul>
-<h2>FEEDS</h2>
-<ul>
-    <li><a href="{{.FeedXMLURL}}">RSS 2.0</a></li>
-    <li><a href="{{.FeedJSONURL}}">JSON Feed</a></li>
 </ul>
 </body>
 </html>