diff --git a/app.go b/app.go
index afde762..8ff9874 100644
--- a/app.go
+++ b/app.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"log/slog"
 	"os"
@@ -8,149 +9,172 @@ import (
 	"strings"
 	"time"
 
+	sshPkg "golang.org/x/crypto/ssh"
+	"workctl/internal/config"
+	"workctl/internal/ssh"
+	"workctl/internal/store"
+
 	"github.com/charmbracelet/huh"
-	"golang.org/x/crypto/ssh"
 )
 
+type Flags struct {
+	ShowWeek          bool
+	ShowMonth         bool
+	ShowExport        bool
+	ExportName        string
+	StartInBackground bool
+	WithoutTimew      bool
+}
+
 type App struct {
-	cfg       Config
-	flags     Flags
-	timeStore *TimeStore
+	cfg   config.Config
+	store *store.Store
+	flags Flags
 }
 
 func NewApp() (*App, error) {
-	cfg, err := loadConfig()
+	cfg, err := config.Load()
 	if err != nil {
 		return nil, fmt.Errorf("error loading config: %w", err)
 	}
 
-	ts, err := NewTimeStore(cfg)
+	st, err := store.NewStore()
 	if err != nil {
 		return nil, fmt.Errorf("error initializing time store: %w", err)
 	}
 
 	return &App{
-		cfg:       cfg,
-		timeStore: ts,
+		cfg:   cfg,
+		store: st,
+		flags: Flags{},
 	}, nil
 }
 
 func (a *App) Close() error {
-	if a.timeStore != nil {
-		return a.timeStore.Close()
+	if a.store != nil {
+		return a.store.Close()
 	}
 	return nil
 }
 
-func (a *App) connect(withoutTimew bool) (*SSHConnection, error) { // Rückgabetyp geändert
-	if err := a.timeStore.StartTracking(TagWork, withoutTimew); err != nil {
-		slog.Warn(fmt.Sprintf("Failed to start time tracking for '%s': %v", TagWork, err))
+func (a *App) Execute(ctx context.Context) error {
+	if len(os.Args) > 1 {
+		return a.setupCommands().ExecuteContext(ctx)
+	}
+	return a.makeChoice(ctx)
+}
+
+func (a *App) StartTracking(ctx context.Context, tag string) error {
+	if err := a.store.StartTracking(ctx, tag); err != nil {
+		return err
+	}
+	if !a.flags.WithoutTimew {
+		_ = a.runCommand("timew", "start", tag)
+	}
+	return nil
+}
+
+func (a *App) StopTracking(ctx context.Context) error {
+	if err := a.store.StopTracking(ctx); err != nil {
+		return err
+	}
+	if !a.flags.WithoutTimew {
+		_ = a.runCommand("timew", "stop")
+	}
+	return nil
+}
+
+func (a *App) connect(ctx context.Context) error {
+	if err := a.StartTracking(ctx, store.TagWork); err != nil {
+		slog.Warn("Failed to start time tracking", "error", err)
 	}
 
 	a.wakeWorkstation()
 
-	sshCon, err := a.newSSHConnection()
+	sshCon, err := ssh.NewConnection(a.cfg.SSHUser, a.cfg.SSHHost, a.cfg.SSHPort, a.getSSHAuth())
 	if err != nil {
-		return nil, fmt.Errorf("failed to establish primary SSH connection: %w", err)
+		return fmt.Errorf("failed to establish primary SSH connection: %w", err)
 	}
-
+	defer sshCon.Close()
 	slog.Info("SSH connection established. Setting up tunnels...")
 
-	sshForwarder := NewPortForwarder(sshCon.client, "2048", "22", a.cfg.WorkstationIP)
+	tunnelCtx, cancelTunnels := context.WithCancel(ctx)
+	defer cancelTunnels()
+
+	sshForwarder := ssh.NewForwarder(sshCon.Client, config.PortLocalSSH, config.PortRemoteSSH, a.cfg.WorkstationIP)
+	rdpForwarder := ssh.NewForwarder(sshCon.Client, config.PortLocalRDP, config.PortRemoteRDP, a.cfg.WorkstationIP)
+
+	sshReady := make(chan struct{})
+	rdpReady := make(chan struct{})
+
 	go func() {
-		slog.Info("Starting SSH forwarder (local :2048 -> remote workstation:22)")
-		if err := sshForwarder.forward(); err != nil {
-			slog.Error(fmt.Sprintf("SSH forwarder failed: %v", err))
+		if err := sshForwarder.Start(tunnelCtx, sshReady); err != nil {
+			slog.Error("SSH forwarder stopped", "error", err)
+		}
+	}()
+	go func() {
+		if err := rdpForwarder.Start(tunnelCtx, rdpReady); err != nil {
+			slog.Error("RDP forwarder stopped", "error", err)
 		}
-		slog.Info("SSH forwarder stopped.")
 	}()
 
-	rdpForwarder := NewPortForwarder(sshCon.client, "6000", "3389", a.cfg.WorkstationIP)
-	go func() {
-		slog.Info("Starting RDP forwarder (local :6000 -> remote workstation:3389)")
-		if err := rdpForwarder.forward(); err != nil {
-			// slog.Error(fmt.Sprintf("RDP forwarder failed: %v", err)
-			slog.Error(fmt.Sprintf("ERROR: RDP forwarder failed: %v", err))
-		}
-		slog.Info("RDP forwarder stopped.")
-	}()
+	slog.Info("Waiting for tunnels to initialize...")
 
-	time.Sleep(500 * time.Millisecond)
+	readyCtx, cancelReady := context.WithTimeout(ctx, 5*time.Second)
+	defer cancelReady()
 
-	return sshCon, nil
+	select {
+	case <-sshReady:
+		slog.Debug("SSH Tunnel ready")
+	case <-readyCtx.Done():
+		return fmt.Errorf("timeout waiting for SSH tunnel readiness")
+	}
+
+	select {
+	case <-rdpReady:
+		slog.Debug("RDP Tunnel ready")
+	case <-readyCtx.Done():
+		return fmt.Errorf("timeout waiting for RDP tunnel readiness")
+	}
+
+	slog.Info("All tunnels established and listening.")
+
+	if a.flags.StartInBackground {
+		fmt.Println("\nINFO: Tunnels are active in background.")
+		fmt.Println("       Connect manually via SSH: ssh -p 2048 <user>@127.0.0.1")
+		fmt.Println("       Connect manually via RDP: xfreerdp /v:127.0.0.1:6000 ...")
+		fmt.Println("INFO: Press Ctrl+C to stop.")
+		<-ctx.Done()
+		slog.Info("Context cancelled, shutting down tunnels...")
+	} else {
+		fmt.Println("Automatically connecting to workstation via SSH tunnel...")
+		a.connectToWorkstation()
+		fmt.Println("Workstation SSH session finished.")
+	}
+
+	if err := a.StopTracking(context.Background()); err != nil {
+		slog.Warn("Failed to stop time tracking", "error", err)
+	} else {
+		slog.Info("Time tracking stopped.")
+	}
+
+	return nil
 }
 
 func (a *App) runCommand(name string, args ...string) error {
-	slog.Info(fmt.Sprintf("Executing command: %s %s", name, strings.Join(args, " ")))
+	slog.Info("Executing command", "cmd", name, "args", args)
 	cmd := exec.Command(name, args...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	cmd.Stdin = os.Stdin
-	err := cmd.Run()
-	if err != nil {
-		slog.Error(fmt.Sprintf("Command failed: %s %s -> %v", name, strings.Join(args, " "), err))
-		return fmt.Errorf("command execution failed: %w", err)
+	if err := cmd.Run(); err != nil {
+		slog.Error("Command failed", "cmd", name, "error", err)
+		return err
 	}
-	slog.Info(fmt.Sprintf("Command finished successfully: %s", name))
 	return nil
 }
 
-func (a *App) wakeWorkstation() {
-	slog.Info("Attempting to wake workstation...")
-	innerSSHCmd := fmt.Sprintf("ssh -tt %s@%s \"wakeonlan %s && echo 'Wake-on-LAN packet sent.' && exit\"",
-		a.cfg.JumpUser,
-		a.cfg.JumpHost,
-		a.cfg.WorkstationMac)
-
-	outerSSHCmd := []string{
-		"-tt",
-		"-p", fmt.Sprintf("%d", a.cfg.SSHPort),
-		fmt.Sprintf("%s@%s", a.cfg.SSHUser, a.cfg.SSHHost),
-		innerSSHCmd,
-	}
-
-	if err := a.runCommand("ssh", outerSSHCmd...); err != nil {
-		slog.Warn("Failed to send Wake-on-LAN packet via SSH jump. Workstation might already be awake or command failed.")
-	} else {
-		slog.Info("Wake-on-LAN command executed.")
-	}
-}
-
-func (a *App) connectToJump() {
-	slog.Info("Connecting to Jump Host with Port Forwarding...")
-	sshArgs := []string{
-		"-tt",
-		"-L", fmt.Sprintf("2048:%s:22", a.cfg.WorkstationHost),
-		"-p", fmt.Sprintf("%d", a.cfg.SSHPort),
-		fmt.Sprintf("%s@%s", a.cfg.SSHUser, a.cfg.SSHHost),
-	}
-	if err := a.runCommand("ssh", sshArgs...); err != nil {
-	}
-}
-
-func (a *App) connectToWorkstation() {
-	slog.Info("Connecting to Workstation via local tunnel (localhost:2048)...")
-	sshArgs := []string{
-		"-tt",
-		"-L", fmt.Sprintf("6000:%s:3389", a.cfg.WorkstationHost),
-		"-p", "2048",
-		fmt.Sprintf("%s@127.0.0.1", a.cfg.WorkstationUser),
-	}
-	if err := a.runCommand("ssh", sshArgs...); err != nil {
-	}
-}
-
-func (a *App) startRDPConnection() {
-	slog.Info("Starting RDP connection to localhost:6000...")
-	rdpCommand := fmt.Sprintf("xfreerdp /u:%s /p:%s /v:127.0.0.1:6000 /size:3000x1350 +clipboard /dynamic-resolution",
-		a.cfg.RDPUser,
-		a.cfg.SSHPassword,
-	)
-	if err := a.runCommand("bash", "-c", rdpCommand); err != nil {
-	}
-}
-
-func (a *App) makeChoice() {
+func (a *App) makeChoice(ctx context.Context) error {
 	var choice string
 
 	form := huh.NewForm(
@@ -166,65 +190,47 @@ func (a *App) makeChoice() {
 					huh.NewOption("Show Week Summary", "show week summary"),
 					huh.NewOption("Show Month Summary", "show month summary"),
 					huh.NewOption("Export Yearly Timetable", "export"),
-					huh.NewOption("Connect to Jump Host (Tunnel to Workstation)", "connect to jump"),
-					huh.NewOption("Connect to Workstation (via Tunnel)", "connect to workstation"),
-					huh.NewOption("Start RDP Connection (via Tunnel)", "start rdp connection"),
+					huh.NewOption("Connect to Jump Host (Tunnel)", "connect to jump"),
+					huh.NewOption("Connect to Workstation (Tunnel)", "connect to workstation"),
+					huh.NewOption("Start RDP Connection", "start rdp connection"),
 					huh.NewOption("Wake Workstation", "wake workstation"),
-					huh.NewOption("Kill Active Tunnels (Ports 2048, 6000)", "kill tunnels"),
+					huh.NewOption("Kill Active Tunnels", "kill tunnels"),
+					huh.NewOption("Config: Set Secrets", "set secrets"),
 					huh.NewOption("Exit", "exit"),
 				).
 				Value(&choice),
 		),
 	)
 
-	err := form.Run()
-	if err != nil {
-		if err == huh.ErrUserAborted {
-			fmt.Println("Operation cancelled.")
-			return
-		}
-		slog.Error(fmt.Sprintf("Form execution failed: %v", err))
-		return
+	if err := form.Run(); err != nil {
+		return nil
 	}
 
 	switch choice {
 	case "start work":
-		a.connect(withoutTimew)
+		return a.connect(ctx)
 	case "stop work":
-		if err := a.timeStore.StopTracking(withoutTimew); err != nil {
-			slog.Error(fmt.Sprintf("Failed to stop time tracking: %v", err))
-		}
-		if err := a.killForwardings(); err != nil {
-			slog.Warn(fmt.Sprintf("Could not kill all forwardings: %v", err))
+		if err := a.StopTracking(ctx); err != nil {
+			slog.Error("Failed to stop time tracking", "error", err)
 		}
+		_ = a.killForwardings()
 	case "start break":
-		if err := a.timeStore.StartTracking(TagBreak, withoutTimew); err != nil {
-			slog.Error(fmt.Sprintf("Failed to start break tracking: %v", err))
+		if err := a.StartTracking(ctx, store.TagBreak); err != nil {
+			slog.Error("Failed to start break", "error", err)
 		}
 	case "stop break":
-		if err := a.timeStore.StartTracking(TagWork, withoutTimew); err != nil {
-			slog.Error(fmt.Sprintf("Failed to stop break (start work): %v", err))
+		if err := a.StartTracking(ctx, store.TagWork); err != nil {
+			slog.Error("Failed to stop break", "error", err)
 		}
 	case "show day summary":
-		if err := a.timeStore.ShowSummary("today"); err != nil {
-			slog.Error(fmt.Sprintf("Failed to show day summary: %v", err))
-		}
+		_ = a.store.ShowSummary(ctx, "today")
 	case "show week summary":
-		if err := a.timeStore.ShowSummary("week"); err != nil {
-			slog.Error(fmt.Sprintf("ERROR: Failed to show week summary: %v", err))
-		}
+		_ = a.store.ShowSummary(ctx, "week")
 	case "show month summary":
-		if err := a.timeStore.ShowSummary("month"); err != nil {
-			slog.Error(fmt.Sprintf("Failed to show month summary: %v", err))
-		}
+		_ = a.store.ShowSummary(ctx, "month")
 	case "export":
 		filename := "Arbeitszeiten_" + time.Now().Format("2006") + ".xlsx"
-		if a.flags.ExportName != "" && a.flags.ExportName != "Arbeitszeiten.xlsx" {
-			filename = a.flags.ExportName
-		}
-		if err := a.timeStore.ExportSummary(filename); err != nil {
-			slog.Error(fmt.Sprintf("Failed to export summary to '%s': %v", filename, err))
-		}
+		_ = a.store.ExportSummary(ctx, filename)
 	case "connect to jump":
 		a.connectToJump()
 	case "connect to workstation":
@@ -234,86 +240,90 @@ func (a *App) makeChoice() {
 	case "wake workstation":
 		a.wakeWorkstation()
 	case "kill tunnels":
-		if err := a.killForwardings(); err != nil {
-			slog.Error(fmt.Sprintf("Failed to kill forwardings: %v", err))
-		} else {
-			slog.Info("Attempted to kill processes on ports 2048 and 6000.")
-		}
+		_ = a.killForwardings()
+	case "set secrets":
+		fmt.Println("Please run 'workctl config set-secrets' directly from CLI.")
 	case "exit":
-		fmt.Println("Exiting.")
-		return
-	default:
-		slog.Warn(fmt.Sprintf("Unhandled choice '%s'", choice))
-	}
-
-	if choice != "exit" && choice != "connect to jump" && choice != "connect to workstation" && choice != "start rdp connection" {
-		fmt.Println("\nPress Enter to continue...")
-		fmt.Scanln()
-		a.makeChoice()
-	}
-}
-
-func (a *App) getSSHAuth() ssh.AuthMethod {
-	keyPath := os.ExpandEnv("$HOME/.ssh/hegenberg")
-
-	keyBytes, err := os.ReadFile(keyPath)
-	if err != nil {
-		slog.Error(fmt.Sprintf("Unable to read private key '%s': %v", keyPath, err))
 		return nil
 	}
 
-	var key ssh.Signer
-	key, err = ssh.ParsePrivateKey(keyBytes)
+	if choice != "exit" && choice != "start work" {
+		fmt.Println("\nPress Enter to continue...")
+		fmt.Scanln()
+		return a.makeChoice(ctx)
+	}
+	return nil
+}
+
+func (a *App) getSSHAuth() sshPkg.AuthMethod {
+	keyPath := os.ExpandEnv("$HOME/.ssh/hegenberg")
+	keyBytes, err := os.ReadFile(keyPath)
 	if err != nil {
-		if _, ok := err.(*ssh.PassphraseMissingError); ok {
-			slog.Info(fmt.Sprintf("Private key '%s' requires a passphrase. Trying with RDP password from config.", keyPath))
-			key, err = ssh.ParsePrivateKeyWithPassphrase(keyBytes, []byte(a.cfg.RDPPassword))
+		slog.Error("Unable to read private key", "path", keyPath, "error", err)
+		return nil
+	}
+
+	key, err := sshPkg.ParsePrivateKey(keyBytes)
+	if err != nil {
+		if _, ok := err.(*sshPkg.PassphraseMissingError); ok {
+			slog.Info("Key requires passphrase, trying RDP password from config/keyring")
+			key, err = sshPkg.ParsePrivateKeyWithPassphrase(keyBytes, []byte(a.cfg.RDPPassword))
 			if err != nil {
-				slog.Error(fmt.Sprintf("Unable to parse private key '%s' with passphrase: %v", keyPath, err))
+				slog.Error("Failed to parse key with passphrase", "error", err)
 				return nil
 			}
 		} else {
-			slog.Error(fmt.Sprintf("Unable to parse private key '%s': %v", keyPath, err))
+			slog.Error("Failed to parse private key", "error", err)
 			return nil
 		}
 	}
-
-	slog.Info(fmt.Sprintf("Successfully loaded private key '%s'", keyPath))
-	return ssh.PublicKeys(key)
+	return sshPkg.PublicKeys(key)
 }
 
-func (a *App) newSSHConnection() (*SSHConnection, error) {
-	authMethod := a.getSSHAuth()
-	if authMethod == nil {
-		return nil, fmt.Errorf("SSH authentication method could not be obtained")
+func (a *App) wakeWorkstation() {
+	slog.Info("Attempting to wake workstation...")
+	innerSSHCmd := fmt.Sprintf("ssh -tt %s@%s \"wakeonlan %s && echo 'Packet sent' && exit\"",
+		a.cfg.JumpUser, a.cfg.JumpHost, a.cfg.WorkstationMac)
+
+	args := []string{
+		"-tt",
+		"-p", fmt.Sprintf("%d", a.cfg.SSHPort),
+		fmt.Sprintf("%s@%s", a.cfg.SSHUser, a.cfg.SSHHost),
+		innerSSHCmd,
 	}
+	_ = a.runCommand("ssh", args...)
+}
 
-	sshConfig := &ssh.ClientConfig{
-		User:            a.cfg.SSHUser,
-		Auth:            []ssh.AuthMethod{authMethod},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-		Timeout:         10 * time.Second, // Etwas längerer Timeout
+func (a *App) connectToJump() {
+	args := []string{
+		"-tt",
+		"-L", fmt.Sprintf("%s:%s:%s", config.PortLocalSSH, a.cfg.WorkstationHost, config.PortRemoteSSH),
+		"-p", fmt.Sprintf("%d", a.cfg.SSHPort),
+		fmt.Sprintf("%s@%s", a.cfg.SSHUser, a.cfg.SSHHost),
 	}
+	_ = a.runCommand("ssh", args...)
+}
 
-	target := fmt.Sprintf("%s:%d", a.cfg.SSHHost, a.cfg.SSHPort)
-	slog.Info(fmt.Sprintf("Dialing SSH to %s...", target))
-
-	client, err := ssh.Dial("tcp", target, sshConfig)
-	if err != nil {
-		return nil, fmt.Errorf("SSH dial to %s failed: %w", target, err)
+func (a *App) connectToWorkstation() {
+	args := []string{
+		"-tt",
+		"-L", fmt.Sprintf("%s:%s:%s", config.PortLocalRDP, a.cfg.WorkstationHost, config.PortRemoteRDP),
+		"-p", config.PortLocalSSH,
+		fmt.Sprintf("%s@127.0.0.1", a.cfg.WorkstationUser),
 	}
-	slog.Info(fmt.Sprintf("SSH connection to %s successful.", target))
+	_ = a.runCommand("ssh", args...)
+}
 
-	session, err := client.NewSession()
-	if err != nil {
-		client.Close() // Client schließen, wenn Session fehlschlägt
-		return nil, fmt.Errorf("failed to create SSH session: %w", err)
+func (a *App) startRDPConnection() {
+	args := []string{
+		fmt.Sprintf("/u:%s", a.cfg.RDPUser),
+		fmt.Sprintf("/p:%s", a.cfg.RDPPassword),
+		fmt.Sprintf("/v:127.0.0.1:%s", config.PortLocalRDP),
+		"/size:3000x1350",
+		"+clipboard",
+		"/dynamic-resolution",
 	}
-	session.Close()
-
-	return &SSHConnection{
-		client: client,
-	}, nil
+	_ = a.runCommand("xfreerdp", args...)
 }
 
 func (a *App) killForwardings() error {
diff --git a/cmd.go b/cmd.go
index 7180482..3e344cf 100644
--- a/cmd.go
+++ b/cmd.go
@@ -4,16 +4,16 @@ import (
 	"fmt"
 	"log/slog"
 	"os"
-	"os/signal"
 	"strings"
-	"syscall"
 	"time"
 
+	"workctl/internal/config"
+	"workctl/internal/store"
+
+	"github.com/charmbracelet/huh"
 	"github.com/spf13/cobra"
 )
 
-var withoutTimew bool
-
 func (a *App) setupCommands() *cobra.Command {
 	rootCmd := &cobra.Command{
 		Use:   "workctl",
@@ -30,75 +30,84 @@ and other utilities.`,
 	rootCmd.AddCommand(a.connectCommands())
 	rootCmd.AddCommand(a.wakeCommand())
 	rootCmd.AddCommand(a.importTimewarriorCommand())
+	rootCmd.AddCommand(a.configCommand())
 
 	rootCmd.CompletionOptions.DisableDefaultCmd = true
 
 	return rootCmd
 }
 
+func (a *App) configCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "config",
+		Short: "Manage configuration and secrets",
+	}
+
+	cmd.AddCommand(&cobra.Command{
+		Use:   "set-secrets",
+		Short: "Interactively set passwords in the system keyring",
+		Long:  "Prompts for SSH and RDP passwords and stores them securely in the operating system's keychain/keyring.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			var sshPw, rdpPw string
+
+			form := huh.NewForm(
+				huh.NewGroup(
+					huh.NewInput().
+						Title("SSH Password").
+						Description("Leave empty to keep existing").
+						EchoMode(huh.EchoModePassword).
+						Value(&sshPw),
+					huh.NewInput().
+						Title("RDP Password").
+						Description("Leave empty to keep existing").
+						EchoMode(huh.EchoModePassword).
+						Value(&rdpPw),
+				),
+			)
+
+			if err := form.Run(); err != nil {
+				return err
+			}
+
+			if sshPw != "" {
+				if err := config.SetSecret(config.KeySSHPassword(), sshPw); err != nil {
+					return fmt.Errorf("failed to save SSH password: %w", err)
+				}
+				fmt.Println("✓ SSH password saved to keyring.")
+			}
+
+			if rdpPw != "" {
+				if err := config.SetSecret(config.KeyRDPPassword(), rdpPw); err != nil {
+					return fmt.Errorf("failed to save RDP password: %w", err)
+				}
+				fmt.Println("✓ RDP password saved to keyring.")
+			}
+
+			if sshPw == "" && rdpPw == "" {
+				fmt.Println("No changes made.")
+			}
+
+			return nil
+		},
+	})
+
+	return cmd
+}
+
 func (a *App) startCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "start",
 		Short: "Start work: Track time, WOL, setup tunnels, optionally connect or run in background",
 		Long: `Starts time tracking, attempts WOL, sets up SSH tunnels.
-Default behavior: Immediately starts an interactive SSH session to the workstation via the tunnel. The command blocks until this session ends.
-Use --background (-b) to keep tunnels running in the background without auto-connecting. Press Ctrl+C to stop background tunnels.`,
+Default behavior: Immediately starts an interactive SSH session to the workstation via the tunnel.
+Use --background (-b) to keep tunnels running in the background without auto-connecting.`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			fmt.Println("Starting workday procedures...")
-
-			sshCon, err := a.connect(withoutTimew)
-			if err != nil {
-				fmt.Printf("ERROR: Failed to start connections: %v\n", err)
-				return fmt.Errorf("connection setup failed: %w", err)
-			}
-
-			defer func() {
-				slog.Info("Closing SSH connection to jump host (defer)...")
-				if err := sshCon.Close(); err != nil {
-					slog.Warn(fmt.Sprintf("Error closing SSH connection in defer: %v", err))
-				} else {
-					slog.Info("SSH connection closed via defer.")
-				}
-			}()
-
-			if a.flags.StartInBackground {
-				fmt.Println("\nINFO: Tunnels are active in background.")
-				fmt.Println("       Connect manually via SSH: ssh -p 2048 <user>@127.0.0.1")
-				fmt.Println("       Connect manually via RDP: xfreerdp /v:127.0.0.1:6000 ...")
-				fmt.Println("INFO: Press Ctrl+C to stop tunnels.")
-
-				sigChan := make(chan os.Signal, 1)
-				signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
-				<-sigChan
-
-				fmt.Println("\nINFO: Received interrupt signal. Shutting down background process...")
-				slog.Info("Received signal, cleanup via defer sshCon.Close() will run.")
-				if err := a.timeStore.StopTracking(withoutTimew); err != nil {
-					slog.Warn(fmt.Sprintf("Failed to stop time tracking: %v", err))
-				} else {
-					slog.Info("Time tracking stopped.")
-				}
-				fmt.Println("INFO: Background shutdown complete.")
-
-			} else {
-				fmt.Println("Automatically connecting to workstation via SSH tunnel...")
-				a.connectToWorkstation()
-
-				fmt.Println("Workstation SSH session finished.")
-				slog.Info("Foreground session ended, cleanup via defer sshCon.Close() will run.")
-				if err := a.timeStore.StopTracking(withoutTimew); err != nil {
-					slog.Warn(fmt.Sprintf("Failed to stop time tracking: %v", err))
-				} else {
-					slog.Info("Time tracking stopped.")
-				}
-			}
-
-			return nil
+			return a.connect(cmd.Context())
 		},
 	}
 
 	cmd.Flags().BoolVarP(&a.flags.StartInBackground, "background", "b", false, "Run tunnels in the background instead of connecting immediately")
-	cmd.Flags().BoolVarP(&withoutTimew, "timew", "t", false, "Set this flag if you dont want to use Timewarrior Timestorage as well")
+	cmd.Flags().BoolVarP(&a.flags.WithoutTimew, "timew", "t", false, "Set this flag if you dont want to use Timewarrior Timestorage as well")
 
 	return cmd
 }
@@ -110,7 +119,7 @@ func (a *App) stopCommand() *cobra.Command {
 		Long:  "Stops the current time tracking entry and attempts to kill active SSH tunnels.",
 		Run: func(cmd *cobra.Command, args []string) {
 			fmt.Println("Stopping workday procedures...")
-			if err := a.timeStore.StopTracking(withoutTimew); err != nil {
+			if err := a.StopTracking(cmd.Context()); err != nil {
 				slog.Error(fmt.Sprintf("Failed to stop time tracking: %v", err))
 			} else {
 				fmt.Println("Time tracking stopped.")
@@ -125,7 +134,7 @@ func (a *App) stopCommand() *cobra.Command {
 			fmt.Println("Workday stop procedures finished.")
 		},
 	}
-	cmd.Flags().BoolVarP(&withoutTimew, "timew", "t", false, "Set this flag if you dont want to use Timewarrior Timestorage as well")
+	cmd.Flags().BoolVarP(&a.flags.WithoutTimew, "timew", "t", false, "Set this flag if you dont want to use Timewarrior Timestorage as well")
 	return cmd
 }
 
@@ -142,7 +151,7 @@ it will mark the *current day* with that tag instead of starting an interval tim
 This also stops any currently running timer.`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			tag := TagWork
+			tag := store.TagWork
 			if len(args) > 0 {
 				tag = args[0]
 			}
@@ -157,14 +166,14 @@ This also stops any currently running timer.`,
 			case "uni", "urlaub", "feiertag", "krank", "free":
 				today := time.Now()
 				fmt.Printf("Logging '%s' for today (%s)...\n", tagLower, today.Format("2006-01-02"))
-				if err := a.timeStore.LogFullDay(tagLower, today); err != nil {
+				if err := a.store.LogFullDay(cmd.Context(), tagLower, today); err != nil {
 					return fmt.Errorf("could not log '%s' for today: %w", tagLower, err)
 				}
 				return nil
 
 			default:
 				fmt.Printf("Attempting to start tracking interval '%s'...\n", tag)
-				if err := a.timeStore.StartTracking(tag, withoutTimew); err != nil {
+				if err := a.StartTracking(cmd.Context(), tag); err != nil {
 					slog.Error(fmt.Sprintf("Failed to start tracking '%s': %v", tag, err))
 					return fmt.Errorf("could not start tracking '%s': %w", tag, err)
 				}
@@ -178,7 +187,7 @@ This also stops any currently running timer.`,
 		Short: "Start tracking 'break'",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			fmt.Println("Starting break...")
-			if err := a.timeStore.StartTracking(TagBreak, withoutTimew); err != nil {
+			if err := a.StartTracking(cmd.Context(), store.TagBreak); err != nil {
 				slog.Error(fmt.Sprintf("Failed to start break tracking: %v", err))
 				return fmt.Errorf("could not start break: %w", err)
 			}
@@ -212,23 +221,23 @@ Export: Use the --export flag or the 'export' subcommand.`,
 					slog.Info(fmt.Sprintf("No export name specified, using default: %s", filename))
 				}
 				fmt.Printf("Exporting yearly timetable to '%s'...\n", filename)
-				if err := a.timeStore.ExportSummary(filename); err != nil {
+				if err := a.store.ExportSummary(cmd.Context(), filename); err != nil {
 					slog.Error(fmt.Sprintf("Failed to export summary to '%s': %v", filename, err))
 					fmt.Printf("Error: Could not export to '%s'.\n", filename)
 				}
 			} else if a.flags.ShowWeek {
 				fmt.Println("Showing weekly summary...")
-				if err := a.timeStore.ShowSummary("week"); err != nil {
+				if err := a.store.ShowSummary(cmd.Context(), "week"); err != nil {
 					slog.Error(fmt.Sprintf("Failed to show week summary: %v", err))
 				}
 			} else if a.flags.ShowMonth {
 				fmt.Println("Showing monthly summary...")
-				if err := a.timeStore.ShowSummary("month"); err != nil {
+				if err := a.store.ShowSummary(cmd.Context(), "month"); err != nil {
 					slog.Error(fmt.Sprintf("Failed to show month summary: %v", err))
 				}
 			} else {
 				fmt.Printf("Showing summary for period: %s...\n", period)
-				if err := a.timeStore.ShowSummary(period); err != nil {
+				if err := a.store.ShowSummary(cmd.Context(), period); err != nil {
 					slog.Error(fmt.Sprintf("Failed to show summary for '%s': %v", period, err))
 				}
 			}
@@ -252,7 +261,7 @@ Export: Use the --export flag or the 'export' subcommand.`,
 				filename = args[0]
 			}
 			fmt.Printf("Exporting yearly timetable to '%s'...\n", filename)
-			if err := a.timeStore.ExportSummary(filename); err != nil {
+			if err := a.store.ExportSummary(cmd.Context(), filename); err != nil {
 				slog.Error(fmt.Sprintf("Failed to export summary to '%s': %v", filename, err))
 				fmt.Printf("Error: Could not export to '%s'.\n", filename)
 			}
@@ -284,7 +293,6 @@ func (a *App) connectCommands() *cobra.Command {
 	cmd.AddCommand(&cobra.Command{
 		Use:   "jump",
 		Short: "Connect to Jump Host (with tunnel to workstation)",
-		Long:  "Establishes an SSH connection to the Jump Host and forwards local port 2048 to the workstation's SSH port (22). This command blocks.",
 		Run: func(cmd *cobra.Command, args []string) {
 			a.connectToJump()
 		},
@@ -293,7 +301,6 @@ func (a *App) connectCommands() *cobra.Command {
 	cmd.AddCommand(&cobra.Command{
 		Use:   "workstation",
 		Short: "Connect to Workstation via SSH tunnel",
-		Long:  "Establishes an SSH connection to the Workstation via the local tunnel on port 2048. Also sets up RDP tunnel on local port 6000. Requires the 'jump' tunnel to be active. This command blocks.",
 		Run: func(cmd *cobra.Command, args []string) {
 			a.connectToWorkstation()
 		},
@@ -302,7 +309,6 @@ func (a *App) connectCommands() *cobra.Command {
 	cmd.AddCommand(&cobra.Command{
 		Use:   "rdp",
 		Short: "Start RDP session via tunnel",
-		Long:  "Starts an RDP client (xfreerdp) connecting to localhost:6000. Requires an active tunnel forwarding this port to the workstation's RDP port (3389). This command blocks.",
 		Run: func(cmd *cobra.Command, args []string) {
 			a.startRDPConnection()
 		},
@@ -315,11 +321,7 @@ func (a *App) importTimewarriorCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "import-timew [filepath]",
 		Short: "Import time entries from 'timewarrior summary' output file",
-		Long: `Parses the output of 'timewarrior summary :year' (or similar) stored in a text file
-and inserts the individual time intervals into the workctl SQLite database.
-It expects the standard timewarrior summary format.
-Example: workctl import-timew /path/to/timew-summary.txt`,
-		Args: cobra.ExactArgs(1),
+		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			filepath := args[0]
 			fmt.Printf("Attempting to import timewarrior data from: %s\n", filepath)
@@ -346,7 +348,7 @@ func (a *App) runImport(filepath string) (int, error) {
 	content := string(contentBytes)
 	lines := strings.Split(content, "\n")
 
-	tx, err := a.timeStore.db.Begin()
+	tx, err := a.store.DB().Begin()
 	if err != nil {
 		return 0, fmt.Errorf("could not begin database transaction: %w", err)
 	}
@@ -441,9 +443,9 @@ func (a *App) runImport(filepath string) (int, error) {
 		dbTag := strings.ToLower(tag)
 		switch dbTag {
 		case "work":
-			dbTag = TagWork
+			dbTag = store.TagWork
 		case "break":
-			dbTag = TagBreak
+			dbTag = store.TagBreak
 		}
 
 		_, err = stmt.Exec(dbTag, startTime, endTime)
diff --git a/forwarder.go b/forwarder.go
deleted file mode 100644
index 09764be..0000000
--- a/forwarder.go
+++ /dev/null
@@ -1,108 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"io"
-	"log/slog"
-	"net"
-	"sync"
-
-	"golang.org/x/crypto/ssh"
-)
-
-type PortForwarder struct {
-	sshCon     *ssh.Client
-	localPort  string
-	remotePort string
-	remoteHost string
-	logMutex   sync.Mutex
-}
-
-func NewPortForwarder(sshCon *ssh.Client, localPort, remotePort, remoteHost string) *PortForwarder {
-	return &PortForwarder{
-		sshCon:     sshCon,
-		localPort:  localPort,
-		remotePort: remotePort,
-		remoteHost: remoteHost,
-	}
-}
-
-func (pf *PortForwarder) forward() error {
-	localAddr := "127.0.0.1:" + pf.localPort
-	remoteAddr := net.JoinHostPort(pf.remoteHost, pf.remotePort)
-
-	pf.logf("INFO", "Starting port forwarder: local -> remote (via SSH)", "Local Address", localAddr, "Remote Address", remoteAddr)
-
-	listener, err := net.Listen("tcp", localAddr)
-	if err != nil {
-		pf.logf("ERROR", "Failed to open local listener on %s: %v", localAddr, err)
-		return fmt.Errorf("failed to listen on %s: %w", localAddr, err)
-	}
-	defer listener.Close()
-	pf.logf("INFO", "Listener active", "Local Address", localAddr)
-
-	for {
-		localConn, err := listener.Accept()
-		if err != nil {
-			if opErr, ok := err.(*net.OpError); ok && opErr.Err.Error() == "use of closed network connection" {
-				pf.logf("INFO", "Listener closed, stopping forwarder.", "Local Address", localAddr)
-				return nil
-			}
-			pf.logf("ERROR", "Failed to accept incoming connection:", "Local Address", localAddr, "Error", err)
-			continue
-		}
-
-		pf.logf("INFO", "Accepted connection:", "Remote Address", localConn.RemoteAddr(), "Local Address", localAddr)
-		go pf.handleConnection(localConn, remoteAddr)
-	}
-}
-
-func (pf *PortForwarder) handleConnection(localConn net.Conn, remoteAddr string) {
-	defer localConn.Close()
-
-	pf.logf("INFO", "Dialing remote host via SSH tunnel", "Local Address", remoteAddr, "Remote Address", localConn.RemoteAddr())
-	remoteConn, err := pf.sshCon.Dial("tcp", remoteAddr)
-	if err != nil {
-		pf.logf("ERROR", "Failed to dial remote host via SSH:", "Remote Address", remoteAddr, "Error:", err)
-		return
-	}
-	defer remoteConn.Close()
-	pf.logf("INFO", "Connection established. Starting data copy.", "Remote Address", remoteAddr)
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-
-	go func() {
-		defer wg.Done()
-		defer localConn.Close()
-		bytesCopied, err := io.Copy(localConn, remoteConn)
-		if err != nil {
-		}
-		pf.logf("INFO", "Finished copying remote->local", "Bytes copied", bytesCopied, "Remote Address", localConn.RemoteAddr())
-	}()
-
-	go func() {
-		defer wg.Done()
-		defer remoteConn.Close()
-		bytesCopied, err := io.Copy(remoteConn, localConn)
-		if err != nil {
-		}
-		pf.logf("INFO", "Finished copying local->remote", "Bytes copied", bytesCopied, "Remote Address", localConn.RemoteAddr())
-	}()
-
-	wg.Wait()
-	pf.logf("INFO", "Closing forwarded connection", "Remote Address", localConn.RemoteAddr())
-}
-
-func (pf *PortForwarder) logf(level, format string, v ...any) {
-	pf.logMutex.Lock()
-	defer pf.logMutex.Unlock()
-	switch level {
-	case "INFO":
-		slog.Info(format, v...)
-	case "WARN":
-		slog.Warn(format, v...)
-	case "ERROR":
-		slog.Error(format, v...)
-	}
-}
diff --git a/go.mod b/go.mod
index 7df5042..0bfb4d7 100644
--- a/go.mod
+++ b/go.mod
@@ -13,6 +13,7 @@ require (
 )
 
 require (
+	al.essio.dev/pkg/shellescape v1.5.1 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
@@ -27,10 +28,12 @@ require (
 	github.com/clipperhouse/displaywidth v0.6.2 // indirect
 	github.com/clipperhouse/stringish v0.1.1 // indirect
 	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/danieljoos/wincred v1.2.2 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
@@ -57,6 +60,7 @@ require (
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/xuri/efp v0.0.1 // indirect
 	github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 // indirect
+	github.com/zalando/go-keyring v0.2.6 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
diff --git a/go.sum b/go.sum
index cd54cde..a21dc12 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,5 @@
+al.essio.dev/pkg/shellescape v1.5.1 h1:86HrALUujYS/h+GtqoB26SBEdkWfmMI6FubjXlsXyho=
+al.essio.dev/pkg/shellescape v1.5.1/go.mod h1:6sIqp7X2P6mThCQ7twERpZTuigpr6KbZWtls1U8I890=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
@@ -47,6 +49,8 @@ github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEX
 github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
 github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/danieljoos/wincred v1.2.2 h1:774zMFJrqaeYCK2W57BgAem/MLi6mtSE47MB6BOJ0i0=
+github.com/danieljoos/wincred v1.2.2/go.mod h1:w7w4Utbrz8lqeMbDAK0lkNJUv5sAOkFi7nd/ogr0Uh8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -64,6 +68,8 @@ github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIx
 github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
@@ -173,6 +179,8 @@ github.com/xuri/nfp v0.0.1 h1:MDamSGatIvp8uOmDP8FnmjuQpu90NzdJxo7242ANR9Q=
 github.com/xuri/nfp v0.0.1/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ=
 github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 h1:+C0TIdyyYmzadGaL/HBLbf3WdLgC29pgyhTjAT/0nuE=
 github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ=
+github.com/zalando/go-keyring v0.2.6 h1:r7Yc3+H+Ux0+M72zacZoItR3UDxeWfKTcabvkI8ua9s=
+github.com/zalando/go-keyring v0.2.6/go.mod h1:2TCrxYrbUNYfNS/Kgy/LSrkSQzZ5UPVH85RwfczwvcI=
 go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
diff --git a/helpers.go b/helpers.go
deleted file mode 100644
index c12c05c..0000000
--- a/helpers.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package main
-
-import (
-	"log/slog"
-	"os"
-	"os/exec"
-)
-
-func runCommand(name string, args ...string) {
-	cmd := exec.Command(name, args...)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	cmd.Stdin = os.Stdin
-	err := cmd.Run()
-	if err != nil {
-		slog.Error("Command execution error", "command", name, "args", args, "error", err)
-	}
-}
diff --git a/config.go b/internal/config/config.go
similarity index 61%
rename from config.go
rename to internal/config/config.go
index bae7e01..17c7240 100644
--- a/config.go
+++ b/internal/config/config.go
@@ -1,4 +1,4 @@
-package main
+package config
 
 import (
 	"fmt"
@@ -7,6 +7,18 @@ import (
 	"path/filepath"
 
 	"github.com/spf13/viper"
+	"github.com/zalando/go-keyring"
+)
+
+const (
+	serviceName    = "workctl"
+	keySSHPassword = "ssh-password"
+	keyRDPPassword = "rdp-password"
+
+	PortLocalSSH  = "2048"
+	PortLocalRDP  = "6000"
+	PortRemoteSSH = "22"
+	PortRemoteRDP = "3389"
 )
 
 type Config struct {
@@ -22,18 +34,9 @@ type Config struct {
 	RDPPassword     string `mapstructure:"RDP_PASSWORD"`
 	WorkstationIP   string `mapstructure:"WORKSTATION_IP"`
 	SSHPort         int    `mapstructure:"SSH_PORT"`
-	// DatabasePath    string `mapstructure:"DATABASE_PATH"`
 }
 
-type Flags struct {
-	ShowWeek          bool
-	ShowMonth         bool
-	ShowExport        bool
-	ExportName        string
-	StartInBackground bool
-}
-
-func loadConfig() (Config, error) {
+func Load() (Config, error) {
 	var cfg Config
 	configPath, err := os.UserConfigDir()
 	if err != nil {
@@ -55,7 +58,7 @@ func loadConfig() (Config, error) {
 		if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
 			return cfg, fmt.Errorf("error reading config file '%s': %w", configFile, err)
 		}
-		slog.Info(fmt.Sprintf("Config file '%s' not found, using defaults/env vars.", configFile))
+		slog.Debug(fmt.Sprintf("Config file '%s' not found, using defaults/env vars.", configFile))
 	}
 
 	if err := viper.UnmarshalKey("default", &cfg); err != nil {
@@ -68,5 +71,32 @@ func loadConfig() (Config, error) {
 		cfg.SSHPort = 22
 	}
 
+	if cfg.SSHPassword == "" {
+		if secret, err := GetSecret(keySSHPassword); err == nil {
+			cfg.SSHPassword = secret
+			slog.Debug("Loaded SSH password from keyring.")
+		}
+	}
+	if cfg.RDPPassword == "" {
+		if secret, err := GetSecret(keyRDPPassword); err == nil {
+			cfg.RDPPassword = secret
+			slog.Debug("Loaded RDP password from keyring.")
+		}
+	}
+
 	return cfg, nil
 }
+
+func GetSecret(key string) (string, error) {
+	return keyring.Get(serviceName, key)
+}
+
+func SetSecret(key, value string) error {
+	if value == "" {
+		return fmt.Errorf("secret cannot be empty")
+	}
+	return keyring.Set(serviceName, key, value)
+}
+
+func KeySSHPassword() string { return keySSHPassword }
+func KeyRDPPassword() string { return keyRDPPassword }
diff --git a/internal/ssh/client.go b/internal/ssh/client.go
new file mode 100644
index 0000000..2e55c4a
--- /dev/null
+++ b/internal/ssh/client.go
@@ -0,0 +1,55 @@
+package ssh
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/knownhosts"
+)
+
+type Connection struct {
+	Client *ssh.Client
+}
+
+func NewConnection(user, host string, port int, auth ssh.AuthMethod) (*Connection, error) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get home dir: %w", err)
+	}
+	knownHostsPath := filepath.Join(home, ".ssh", "known_hosts")
+
+	hkCallback, err := knownhosts.New(knownHostsPath)
+	if err != nil {
+		slog.Warn("Could not load known_hosts, ensure you connected manually once.", "path", knownHostsPath)
+		return nil, fmt.Errorf("known_hosts error: %w", err)
+	}
+
+	cfg := &ssh.ClientConfig{
+		User:            user,
+		Auth:            []ssh.AuthMethod{auth},
+		HostKeyCallback: hkCallback,
+		Timeout:         10 * time.Second,
+	}
+
+	addr := fmt.Sprintf("%s:%d", host, port)
+	slog.Debug("Dialing SSH", "target", addr)
+
+	client, err := ssh.Dial("tcp", addr, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("ssh dial failed: %w", err)
+	}
+	slog.Debug("SSH connection established", "target", addr)
+
+	return &Connection{Client: client}, nil
+}
+
+func (c *Connection) Close() error {
+	if c.Client != nil {
+		return c.Client.Close()
+	}
+	return nil
+}
diff --git a/internal/ssh/forwarder.go b/internal/ssh/forwarder.go
new file mode 100644
index 0000000..803ca09
--- /dev/null
+++ b/internal/ssh/forwarder.go
@@ -0,0 +1,107 @@
+package ssh
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"sync"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+type Forwarder struct {
+	sshClient  *ssh.Client
+	localPort  string
+	remotePort string
+	remoteHost string
+}
+
+func NewForwarder(client *ssh.Client, localPort, remotePort, remoteHost string) *Forwarder {
+	return &Forwarder{
+		sshClient:  client,
+		localPort:  localPort,
+		remotePort: remotePort,
+		remoteHost: remoteHost,
+	}
+}
+
+func (f *Forwarder) Start(ctx context.Context, ready chan<- struct{}) error {
+	localAddr := "127.0.0.1:" + f.localPort
+	remoteAddr := net.JoinHostPort(f.remoteHost, f.remotePort)
+
+	listener, err := net.Listen("tcp", localAddr)
+	if err != nil {
+		return fmt.Errorf("failed to listen on %s: %w", localAddr, err)
+	}
+
+	if ready != nil {
+		close(ready)
+	}
+
+	go func() {
+		<-ctx.Done()
+		listener.Close()
+	}()
+
+	slog.Info("Port forwarder active", "local", localAddr, "remote", remoteAddr)
+
+	for {
+		localConn, err := listener.Accept()
+		if err != nil {
+			select {
+			case <-ctx.Done():
+				return nil
+			default:
+			}
+			slog.Error("Accept failed", "error", err)
+			time.Sleep(100 * time.Millisecond)
+			continue
+		}
+
+		go f.handleConnection(ctx, localConn, remoteAddr)
+	}
+}
+
+func (f *Forwarder) handleConnection(ctx context.Context, localConn net.Conn, remoteAddr string) {
+	defer localConn.Close()
+
+	_, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	remoteConn, err := f.sshClient.Dial("tcp", remoteAddr)
+	if err != nil {
+		slog.Error("Failed to dial remote via SSH", "target", remoteAddr, "error", err)
+		return
+	}
+	defer remoteConn.Close()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+		_, _ = io.Copy(localConn, remoteConn)
+		// localConn.SetWriteDeadline(time.Now())
+		localConn.Close()
+	}()
+
+	go func() {
+		defer wg.Done()
+		_, _ = io.Copy(remoteConn, localConn)
+		remoteConn.Close()
+	}()
+
+	done := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-ctx.Done():
+	}
+}
diff --git a/export.go b/internal/store/export.go
similarity index 83%
rename from export.go
rename to internal/store/export.go
index 347c3a5..96e395e 100644
--- a/export.go
+++ b/internal/store/export.go
@@ -1,6 +1,7 @@
-package main
+package store
 
 import (
+	"context"
 	"fmt"
 	"log/slog"
 	"sort"
@@ -29,6 +30,63 @@ type ExcelEntry struct {
 	Tag           string
 }
 
+func (s *Store) ExportSummary(ctx context.Context, filename string) error {
+	slog.Info(fmt.Sprintf("Starting export to '%s'...", filename))
+
+	currentYear := time.Now().Year()
+	location := time.Local
+	yearStart := time.Date(currentYear, 1, 1, 0, 0, 0, 0, location)
+	yearEnd := yearStart.AddDate(1, 0, 0)
+	slog.Info(fmt.Sprintf("Exporting data for year %d (%s to %s)", currentYear, yearStart.Format("2006-01-02"), yearEnd.Format("2006-01-02")))
+
+	query := `
+	SELECT id, tag, start_time, end_time
+	FROM time_entries
+	WHERE start_time < ?
+	  AND (end_time IS NULL OR end_time > ?)
+	ORDER BY start_time ASC;`
+
+	rows, err := s.db.QueryContext(ctx, query, yearEnd, yearStart)
+	if err != nil {
+		return fmt.Errorf("failed to query entries for year export: %w", err)
+	}
+	defer rows.Close()
+
+	var entries []TimeEntry
+	for rows.Next() {
+		var entry TimeEntry
+		if err := rows.Scan(&entry.ID, &entry.Tag, &entry.StartTime, &entry.EndTime); err != nil {
+			return fmt.Errorf("failed to scan entry row: %w", err)
+		}
+		entries = append(entries, entry)
+	}
+	if err = rows.Err(); err != nil {
+		return fmt.Errorf("error during export row iteration: %w", err)
+	}
+	slog.Info(fmt.Sprintf("Found %d potentially relevant time entries.", len(entries)))
+
+	dailySummaries, err := aggregateEntriesToDailySummaries(entries, yearStart, yearEnd)
+	if err != nil {
+		return fmt.Errorf("failed to aggregate entries for export: %w", err)
+	}
+
+	excelEntries := convertDailyToExcelEntries(dailySummaries)
+
+	if len(excelEntries) == 0 {
+		slog.Warn("No daily summaries generated for the export period.")
+		fmt.Println("No data available to generate the export for the specified period.")
+		return nil
+	}
+
+	if err := writeExcelSheet(excelEntries, filename); err != nil {
+		return fmt.Errorf("failed to write excel sheet '%s': %w", filename, err)
+	}
+
+	slog.Info(fmt.Sprintf("Successfully exported timetable to %s", filename))
+	fmt.Printf("Successfully exported timetable to %s\n", filename)
+	return nil
+}
+
 func aggregateEntriesToDailySummaries(entries []TimeEntry, yearStart, yearEnd time.Time) (map[string]*DailySummary, error) {
 	dailyMap := make(map[string]*DailySummary)
 	location := yearStart.Location()
@@ -55,14 +113,13 @@ func aggregateEntriesToDailySummaries(entries []TimeEntry, yearStart, yearEnd ti
 
 	for _, entry := range entries {
 		if entry.StartTime.IsZero() {
-			slog.Warn(fmt.Sprintf("Skipping entry with zero start time (ID: %d)", entry.ID))
+			slog.Warn("Skipping entry with zero start time", "ID", entry.ID)
 			continue
 		}
 
 		startTime := entry.StartTime.In(location)
 		endTime := entry.EndTime.Time.In(location)
-		validEndTime := entry.EndTime.Valid
-		if !validEndTime {
+		if !entry.EndTime.Valid {
 			endTime = now
 		}
 
@@ -99,7 +156,6 @@ func aggregateEntriesToDailySummaries(entries []TimeEntry, yearStart, yearEnd ti
 
 			summary, exists := dailyMap[dayStr]
 			if !exists {
-				slog.Warn(fmt.Sprintf("Day %s not found in initial map during entry processing (ID: %d)", dayStr, entry.ID))
 				loopTime = dayEnd
 				continue
 			}
@@ -132,7 +188,6 @@ func aggregateEntriesToDailySummaries(entries []TimeEntry, yearStart, yearEnd ti
 				if summary.WorkEnd == "" || entryEndTimeOnThisDayStr > summary.WorkEnd {
 					summary.WorkEnd = entryEndTimeOnThisDayStr
 				}
-
 				if summary.Tag == "" || summary.Tag == "free" {
 					summary.Tag = TagWork
 				}
@@ -140,7 +195,6 @@ func aggregateEntriesToDailySummaries(entries []TimeEntry, yearStart, yearEnd ti
 			case TagBreak:
 				summary.BreakDuration += segmentDuration
 			default:
-				slog.Info(fmt.Sprintf("Encountered unknown tag '%s' during interval processing for entry ID %d on %s. Counting duration as 'work'.", entry.Tag, entry.ID, dayStr))
 				summary.WorkDuration += segmentDuration
 				if summary.WorkStart == "" || timeStr < summary.WorkStart {
 					summary.WorkStart = timeStr
@@ -157,7 +211,6 @@ func aggregateEntriesToDailySummaries(entries []TimeEntry, yearStart, yearEnd ti
 					summary.Tag = TagWork
 				}
 			}
-
 			loopTime = dayEnd
 		}
 	}
@@ -230,23 +283,6 @@ func convertDailyToExcelEntries(dailySummaries map[string]*DailySummary) []Excel
 	return excelEntries
 }
 
-func formatDuration(d time.Duration) string {
-	if d < 0 {
-		d = -d
-		sign := "-"
-		d = d.Round(time.Second)
-		h := int64(d.Hours())
-		m := int64(d.Minutes()) % 60
-		s := int64(d.Seconds()) % 60
-		return fmt.Sprintf("%s%02d:%02d:%02d", sign, h, m, s)
-	}
-	d = d.Round(time.Second)
-	h := int64(d.Hours())
-	m := int64(d.Minutes()) % 60
-	s := int64(d.Seconds()) % 60
-	return fmt.Sprintf("%02d:%02d:%02d", h, m, s)
-}
-
 func getSollExcelTime(dayOfWeek string) any {
 	var sollString string
 	switch dayOfWeek {
@@ -270,7 +306,7 @@ func writeExcelSheet(entries []ExcelEntry, name string) error {
 	f := excelize.NewFile()
 	defer func() {
 		if err := f.Close(); err != nil {
-			slog.Error(fmt.Sprintf("Failed to close excel file handle: %v", err))
+			slog.Error("Failed to close excel file handle", "error", err)
 		}
 	}()
 
@@ -288,7 +324,7 @@ func writeExcelSheet(entries []ExcelEntry, name string) error {
 			sheetName = "Sheet1"
 			index, _ = f.GetSheetIndex(sheetName)
 			if index == -1 {
-				return fmt.Errorf("could not create or find sheet '%s' or 'Sheet1': %w", sheetName, err)
+				return fmt.Errorf("could not create sheet '%s': %w", sheetName, err)
 			}
 		} else {
 			index = existingIndex
@@ -327,6 +363,10 @@ func writeExcelSheet(entries []ExcelEntry, name string) error {
 	f.SetCellValue(sheetName, "N4", "Total")
 	f.SetCellValue(sheetName, "O4", "")
 
+	toExcelTime := func(t time.Time) float64 {
+		return float64(t.Hour())/24.0 + float64(t.Minute())/(24.0*60.0) + float64(t.Second())/(24.0*60.0*60.0)
+	}
+
 	timeStyleCode := "hh:mm"
 	timeStyle, _ := f.NewStyle(&excelize.Style{CustomNumFmt: &timeStyleCode})
 	dateStyleCode := "dd.mm.yyyy"
@@ -370,8 +410,8 @@ func writeExcelSheet(entries []ExcelEntry, name string) error {
 			if entry.WorkStart != "" && entry.WorkEnd != "" {
 				startTime, _ := time.Parse("15:04:05", entry.WorkStart)
 				endTime, _ := time.Parse("15:04:05", entry.WorkEnd)
-				startExcelTime := float64(startTime.Hour())/24.0 + float64(startTime.Minute())/(24.0*60.0) + float64(startTime.Second())/(24.0*60.0*60.0)
-				endExcelTime := float64(endTime.Hour())/24.0 + float64(endTime.Minute())/(24.0*60.0) + float64(endTime.Second())/(24.0*60.0*60.0)
+				startExcelTime := toExcelTime(startTime)
+				endExcelTime := toExcelTime(endTime)
 				if endExcelTime < startExcelTime {
 					endExcelTime += 1.0
 				}
@@ -382,10 +422,10 @@ func writeExcelSheet(entries []ExcelEntry, name string) error {
 				f.SetCellStyle(sheetName, "E"+rowStr, "E"+rowStr, timeStyle)
 
 				f.SetCellFormula(sheetName, "G"+rowStr, fmt.Sprintf("E%d-D%d", row, row))
-				f.SetCellStyle(sheetName, "G"+rowStr, "H"+rowStr, saldoStyle) // Saldo-Style für Dauer
+				f.SetCellStyle(sheetName, "G"+rowStr, "H"+rowStr, saldoStyle)
 
 				breakDur, _ := time.Parse("15:04:05", entry.BreakDuration)
-				breakExcelTime := float64(breakDur.Hour())/24.0 + float64(breakDur.Minute())/(24.0*60.0) + float64(breakDur.Second())/(24.0*60.0*60.0)
+				breakExcelTime := toExcelTime(breakDur)
 				thirtyMinBreak := float64(30) / (24 * 60)
 				if breakExcelTime < thirtyMinBreak {
 					breakExcelTime = thirtyMinBreak
diff --git a/store.go b/internal/store/store.go
similarity index 50%
rename from store.go
rename to internal/store/store.go
index 00565c4..0fc656f 100644
--- a/store.go
+++ b/internal/store/store.go
@@ -1,6 +1,7 @@
-package main
+package store
 
 import (
+	"context"
 	"database/sql"
 	"fmt"
 	"log/slog"
@@ -26,18 +27,18 @@ type TimeEntry struct {
 	EndTime   sql.NullTime
 }
 
-type TimeStore struct {
+type Store struct {
 	db     *sql.DB
 	dbPath string
 }
 
-func NewTimeStore(cfg Config) (*TimeStore, error) {
-	dbPath, err := ensureDatabasePath(cfg)
+func NewStore() (*Store, error) {
+	dbPath, err := ensureDatabasePath()
 	if err != nil {
 		return nil, fmt.Errorf("could not determine database path: %w", err)
 	}
 
-	slog.Info("Using database at:", "Database Path", dbPath)
+	slog.Debug("Using database at:", "path", dbPath)
 
 	db, err := sql.Open("sqlite", fmt.Sprintf("%s?_pragma=journal_mode(WAL)", dbPath))
 	if err != nil {
@@ -49,105 +50,97 @@ func NewTimeStore(cfg Config) (*TimeStore, error) {
 		return nil, fmt.Errorf("failed to connect to database '%s': %w", dbPath, err)
 	}
 
+	if err := migrate(db); err != nil {
+		db.Close()
+		return nil, fmt.Errorf("migration failed: %w", err)
+	}
+
+	return &Store{db: db, dbPath: dbPath}, nil
+}
+
+func migrate(db *sql.DB) error {
 	createTableSQL := `
 	CREATE TABLE IF NOT EXISTS time_entries (
 		id INTEGER PRIMARY KEY AUTOINCREMENT,
-		tag TEXT NOT NULL CHECK(tag <> ''), -- Stelle sicher, dass Tag nicht leer ist
+		tag TEXT NOT NULL CHECK(tag <> ''),
 		start_time DATETIME NOT NULL,
 		end_time DATETIME NULL,
-		-- Optional: Stelle sicher, dass nur ein Eintrag NULL end_time haben kann (falls DB unterstützt)
-		-- UNIQUE (end_time) WHERE end_time IS NULL -- SQLite unterstützt dies nicht direkt
-		CHECK (end_time IS NULL OR end_time >= start_time) -- Endzeit muss nach Startzeit liegen
+		CHECK (end_time IS NULL OR end_time >= start_time)
 	);`
-	if _, err = db.Exec(createTableSQL); err != nil {
-		db.Close()
-		return nil, fmt.Errorf("failed to create table 'time_entries': %w", err)
+	if _, err := db.Exec(createTableSQL); err != nil {
+		return fmt.Errorf("failed to create table 'time_entries': %w", err)
 	}
 
 	createIndexSQL := `CREATE INDEX IF NOT EXISTS idx_time_entries_start_time ON time_entries (start_time);`
-	if _, err = db.Exec(createIndexSQL); err != nil {
-		slog.Warn("Failed to create index on start_time:", "Error:", err)
+	if _, err := db.Exec(createIndexSQL); err != nil {
+		slog.Warn("Failed to create index on start_time:", "error", err)
 	}
-
-	return &TimeStore{db: db, dbPath: dbPath}, nil
+	return nil
 }
 
-func ensureDatabasePath(_ Config) (string, error) {
+func ensureDatabasePath() (string, error) {
 	configDir, err := os.UserConfigDir()
 	if err != nil {
 		return "", fmt.Errorf("could not get user config dir: %w", err)
 	}
 	workConfigDir := filepath.Join(configDir, "work")
-	dbPath := filepath.Join(workConfigDir, "worktime.sqlite")
-
 	if err := os.MkdirAll(workConfigDir, 0o750); err != nil {
 		return "", fmt.Errorf("failed to create config directory '%s': %w", workConfigDir, err)
 	}
-
-	return dbPath, nil
+	return filepath.Join(workConfigDir, "worktime.sqlite"), nil
 }
 
-func (ts *TimeStore) Close() error {
-	if ts.db != nil {
-		slog.Info("Closing database connection", "Database Path", ts.dbPath)
-		return ts.db.Close()
+func (s *Store) Close() error {
+	if s.db != nil {
+		slog.Debug("Closing database connection", "path", s.dbPath)
+		return s.db.Close()
 	}
 	return nil
 }
 
-func (ts *TimeStore) stopCurrentEntry(now time.Time) (bool, error) {
+func (s *Store) stopCurrentEntry(ctx context.Context, now time.Time) (bool, error) {
 	query := `UPDATE time_entries SET end_time = ? WHERE end_time IS NULL;`
-	result, err := ts.db.Exec(query, now)
+	result, err := s.db.ExecContext(ctx, query, now)
 	if err != nil {
 		return false, fmt.Errorf("failed to execute stop current entry query: %w", err)
 	}
 
 	rowsAffected, err := result.RowsAffected()
 	if err != nil {
-		return false, fmt.Errorf("failed to get affected rows after stopping entry: %w", err)
-	}
-
-	if rowsAffected > 1 {
-		slog.Warn(fmt.Sprintf("Stopped %d entries. Expected 0 or 1. Manual DB check might be needed.", rowsAffected))
+		return false, fmt.Errorf("failed to get affected rows: %w", err)
 	}
 	return rowsAffected > 0, nil
 }
 
-func (ts *TimeStore) StartTracking(tag string, withoutTimew bool) error {
+func (s *Store) StartTracking(ctx context.Context, tag string) error {
 	if tag == "" {
 		return fmt.Errorf("cannot start tracking with an empty tag")
 	}
 
 	now := time.Now()
-	stopped, err := ts.stopCurrentEntry(now)
+	stopped, err := s.stopCurrentEntry(ctx, now)
 	if err != nil {
 		return err
 	}
 	if stopped {
 		slog.Info("Stopped previous time entry.")
 	}
-	if !withoutTimew {
-		runCommand("timew", "start", "work")
-	}
 
 	query := `INSERT INTO time_entries (tag, start_time, end_time) VALUES (?, ?, NULL);`
-	_, err = ts.db.Exec(query, tag, now)
+	_, err = s.db.ExecContext(ctx, query, tag, now)
 	if err != nil {
 		return fmt.Errorf("failed to start tracking tag '%s': %w", tag, err)
 	}
-	slog.Info(fmt.Sprintf("Started tracking: %s at %s", tag, now.Format(time.RFC3339)))
+	slog.Info(fmt.Sprintf("Started tracking: %s", tag))
 	return nil
 }
 
-func (ts *TimeStore) StopTracking(withoutTimew bool) error {
+func (s *Store) StopTracking(ctx context.Context) error {
 	now := time.Now()
-	stopped, err := ts.stopCurrentEntry(now)
+	stopped, err := s.stopCurrentEntry(ctx, now)
 	if err != nil {
 		return err
 	}
-	if !withoutTimew {
-		runCommand("timew", "stop", "work")
-	}
 	if stopped {
 		slog.Info(fmt.Sprintf("Stopped tracking at %s", now.Format(time.RFC3339)))
 	} else {
@@ -156,7 +149,42 @@ func (ts *TimeStore) StopTracking(withoutTimew bool) error {
 	return nil
 }
 
-func (ts *TimeStore) GetEntriesInRange(start, end time.Time) ([]TimeEntry, error) {
+func (s *Store) LogFullDay(ctx context.Context, tag string, date time.Time) error {
+	if tag == "" {
+		return fmt.Errorf("cannot log full day with an empty tag")
+	}
+	tag = strings.ToLower(tag)
+	location := date.Location()
+	dayStart := time.Date(date.Year(), date.Month(), date.Day(), 0, 0, 0, 0, location)
+	dayEnd := dayStart.Add(24 * time.Hour)
+
+	_, err := s.stopCurrentEntry(ctx, dayStart)
+	if err != nil {
+		slog.Warn("Failed to stop current entry before logging full day", "error", err)
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+
+	query := `INSERT INTO time_entries (tag, start_time, end_time) VALUES (?, ?, ?);`
+	if _, err := tx.ExecContext(ctx, query, tag, dayStart, dayEnd); err != nil {
+		return fmt.Errorf("failed to insert full-day entry: %w", err)
+	}
+
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("failed to commit transaction: %w", err)
+	}
+
+	titleCaser := cases.Title(language.English)
+	slog.Info(fmt.Sprintf("Successfully logged full day entry: Tag='%s', Date='%s'", tag, dayStart.Format("2006-01-02")))
+	fmt.Printf("Successfully logged '%s' for %s.\n", titleCaser.String(tag), dayStart.Format("2006-01-02"))
+	return nil
+}
+
+func (s *Store) GetEntriesInRange(ctx context.Context, start, end time.Time) ([]TimeEntry, error) {
 	if start.IsZero() || end.IsZero() || end.Before(start) {
 		return nil, fmt.Errorf("invalid time range: start=%v, end=%v", start, end)
 	}
@@ -167,7 +195,7 @@ func (ts *TimeStore) GetEntriesInRange(start, end time.Time) ([]TimeEntry, error
 	WHERE start_time >= ? AND start_time < ?
 	ORDER BY start_time ASC;`
 
-	rows, err := ts.db.Query(query, start, end)
+	rows, err := s.db.QueryContext(ctx, query, start, end)
 	if err != nil {
 		return nil, fmt.Errorf("failed to query entries in range [%v, %v): %w", start, end, err)
 	}
@@ -189,8 +217,8 @@ func (ts *TimeStore) GetEntriesInRange(start, end time.Time) ([]TimeEntry, error
 	return entries, nil
 }
 
-func (ts *TimeStore) CalculateSummary(period string) (map[string]time.Duration, error) {
-	start, end := getTimeRangeFromPeriod(period)
+func (s *Store) CalculateSummary(ctx context.Context, period string) (map[string]time.Duration, error) {
+	start, end := GetTimeRangeFromPeriod(period)
 	if start.IsZero() {
 		return nil, fmt.Errorf("invalid period string: '%s'", period)
 	}
@@ -198,13 +226,13 @@ func (ts *TimeStore) CalculateSummary(period string) (map[string]time.Duration,
 	query := `
 	SELECT id, tag, start_time, end_time
 	FROM time_entries
-	WHERE (end_time IS NULL OR end_time > ?) -- Endet nach dem Start des Zeitraums
-	  AND start_time < ?                   -- Beginnt vor dem Ende des Zeitraums
+	WHERE (end_time IS NULL OR end_time > ?)
+	  AND start_time < ?
 	ORDER BY start_time ASC;`
 
-	rows, err := ts.db.Query(query, start, end)
+	rows, err := s.db.QueryContext(ctx, query, start, end)
 	if err != nil {
-		return nil, fmt.Errorf("failed to query overlapping entries for range [%v, %v): %w", start, end, err)
+		return nil, fmt.Errorf("failed to query entries: %w", err)
 	}
 	defer rows.Close()
 
@@ -214,86 +242,38 @@ func (ts *TimeStore) CalculateSummary(period string) (map[string]time.Duration,
 	for rows.Next() {
 		var entry TimeEntry
 		if err := rows.Scan(&entry.ID, &entry.Tag, &entry.StartTime, &entry.EndTime); err != nil {
-			return nil, fmt.Errorf("failed to scan overlapping entry row: %w", err)
+			return nil, fmt.Errorf("failed to scan entry: %w", err)
 		}
 
-		effectiveStart := entry.StartTime
-		if effectiveStart.Before(start) {
-			effectiveStart = start
+		effStart := entry.StartTime
+		if effStart.Before(start) {
+			effStart = start
+		}
+		effEnd := now
+		if entry.EndTime.Valid {
+			effEnd = entry.EndTime.Time
+		}
+		if effEnd.After(end) {
+			effEnd = end
 		}
 
-		effectiveEnd := entry.EndTime.Time
-		if !entry.EndTime.Valid {
-			effectiveEnd = now
-		}
-
-		if effectiveEnd.After(end) {
-			effectiveEnd = end
-		}
-
-		if effectiveEnd.After(effectiveStart) {
-			duration := effectiveEnd.Sub(effectiveStart)
-			summary[entry.Tag] += duration
+		if effEnd.After(effStart) {
+			summary[entry.Tag] += effEnd.Sub(effStart)
 		}
 	}
-
-	if err = rows.Err(); err != nil {
-		return nil, fmt.Errorf("error during overlapping row iteration: %w", err)
-	}
-
-	return summary, nil
+	return summary, rows.Err()
 }
 
-func getTimeRangeFromPeriod(period string) (time.Time, time.Time) {
-	now := time.Now()
-	year, month, day := now.Date()
-	loc := now.Location()
-
-	normalizedPeriod := strings.ToLower(strings.TrimPrefix(period, ":"))
-
-	switch normalizedPeriod {
-	case "week":
-		weekday := now.Weekday()
-		daysToMonday := time.Duration(weekday - time.Monday)
-		if weekday == time.Sunday {
-			daysToMonday = 6
-		}
-		start := time.Date(year, month, day, 0, 0, 0, 0, loc).Add(-daysToMonday * 24 * time.Hour)
-		end := start.Add(7 * 24 * time.Hour)
-		return start, end
-	case "month":
-		start := time.Date(year, month, 1, 0, 0, 0, 0, loc)
-		end := start.AddDate(0, 1, 0)
-		return start, end
-	case "year":
-		start := time.Date(year, 1, 1, 0, 0, 0, 0, loc)
-		end := start.AddDate(1, 0, 0)
-		return start, end
-	case "day", "today":
-		start := time.Date(year, month, day, 0, 0, 0, 0, loc)
-		end := start.AddDate(0, 0, 1)
-		return start, end
-	default:
-		if t, err := time.ParseInLocation("2006-01-02", period, loc); err == nil {
-			start := time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, loc)
-			end := start.AddDate(0, 0, 1)
-			return start, end
-		}
-		slog.Warn(fmt.Sprintf("Unrecognized period string '%s'. Cannot calculate time range.", period))
-		return time.Time{}, time.Time{}
-	}
-}
-
-func (ts *TimeStore) ShowSummary(period string) error {
-	summary, err := ts.CalculateSummary(period)
+func (s *Store) ShowSummary(ctx context.Context, period string) error {
+	summary, err := s.CalculateSummary(ctx, period)
 	if err != nil {
-		return fmt.Errorf("error calculating summary for '%s': %w", period, err)
+		return err
 	}
 
-	start, _ := getTimeRangeFromPeriod(period)
+	start, _ := GetTimeRangeFromPeriod(period)
 	titlePeriod := period
 	if !start.IsZero() {
-		_, end := getTimeRangeFromPeriod(period)
+		_, end := GetTimeRangeFromPeriod(period)
 		if period == ":day" || period == "today" {
 			titlePeriod = fmt.Sprintf("Today (%s)", start.Format("2006-01-02"))
 		} else if period == ":week" {
@@ -334,109 +314,63 @@ func (ts *TimeStore) ShowSummary(period string) error {
 	return nil
 }
 
-func (ts *TimeStore) ExportSummary(filename string) error {
-	slog.Info(fmt.Sprintf("Starting export to '%s'...", filename))
-
-	currentYear := time.Now().Year()
-
-	location := time.Local
-	yearStart := time.Date(currentYear, 1, 1, 0, 0, 0, 0, location)
-	yearEnd := yearStart.AddDate(1, 0, 0)
-	slog.Info(fmt.Sprintf("Exporting data for year %d (%s to %s)", currentYear, yearStart.Format("2006-01-02"), yearEnd.Format("2006-01-02")))
-
-	query := `
-	SELECT id, tag, start_time, end_time
-	FROM time_entries
-	WHERE start_time < ? -- Beginnt vor Anfang des nächsten Jahres
-	  AND (end_time IS NULL OR end_time > ?) -- Endet nach Anfang des Jahres
-	ORDER BY start_time ASC;`
-
-	rows, err := ts.db.Query(query, yearEnd, yearStart)
-	if err != nil {
-		return fmt.Errorf("failed to query entries for year export [%v, %v): %w", yearStart, yearEnd, err)
+func formatDuration(d time.Duration) string {
+	if d < 0 {
+		d = -d
+		sign := "-"
+		d = d.Round(time.Second)
+		h := int64(d.Hours())
+		m := int64(d.Minutes()) % 60
+		s := int64(d.Seconds()) % 60
+		return fmt.Sprintf("%s%02d:%02d:%02d", sign, h, m, s)
 	}
-	defer rows.Close()
+	d = d.Round(time.Second)
+	h := int64(d.Hours())
+	m := int64(d.Minutes()) % 60
+	s := int64(d.Seconds()) % 60
+	return fmt.Sprintf("%02d:%02d:%02d", h, m, s)
+}
 
-	var entries []TimeEntry
-	for rows.Next() {
-		var entry TimeEntry
-		if err := rows.Scan(&entry.ID, &entry.Tag, &entry.StartTime, &entry.EndTime); err != nil {
-			return fmt.Errorf("failed to scan entry row (ID: %d) for export: %w", entry.ID, err)
+func GetTimeRangeFromPeriod(period string) (time.Time, time.Time) {
+	now := time.Now()
+	year, month, day := now.Date()
+	loc := now.Location()
+
+	normalizedPeriod := strings.ToLower(strings.TrimPrefix(period, ":"))
+
+	switch normalizedPeriod {
+	case "week":
+		weekday := now.Weekday()
+		daysToMonday := time.Duration(weekday - time.Monday)
+		if weekday == time.Sunday {
+			daysToMonday = 6
 		}
-		entries = append(entries, entry)
+		start := time.Date(year, month, day, 0, 0, 0, 0, loc).Add(-daysToMonday * 24 * time.Hour)
+		end := start.Add(7 * 24 * time.Hour)
+		return start, end
+	case "month":
+		start := time.Date(year, month, 1, 0, 0, 0, 0, loc)
+		end := start.AddDate(0, 1, 0)
+		return start, end
+	case "year":
+		start := time.Date(year, 1, 1, 0, 0, 0, 0, loc)
+		end := start.AddDate(1, 0, 0)
+		return start, end
+	case "day", "today":
+		start := time.Date(year, month, day, 0, 0, 0, 0, loc)
+		end := start.AddDate(0, 0, 1)
+		return start, end
+	default:
+		if t, err := time.ParseInLocation("2006-01-02", period, loc); err == nil {
+			start := time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, loc)
+			end := start.AddDate(0, 0, 1)
+			return start, end
+		}
+		slog.Warn(fmt.Sprintf("Unrecognized period string '%s'. Cannot calculate time range.", period))
+		return time.Time{}, time.Time{}
 	}
-	if err = rows.Err(); err != nil {
-		return fmt.Errorf("error during export row iteration: %w", err)
-	}
-	slog.Info(fmt.Sprintf("Found %d potentially relevant time entries for year %d.", len(entries), currentYear))
-
-	dailySummaries, err := aggregateEntriesToDailySummaries(entries, yearStart, yearEnd)
-	if err != nil {
-		return fmt.Errorf("failed to aggregate entries for export: %w", err)
-	}
-
-	excelEntries := convertDailyToExcelEntries(dailySummaries)
-
-	if len(excelEntries) == 0 {
-		slog.Warn("No daily summaries generated for the export period.")
-		fmt.Println("No data available to generate the export for the specified period.")
-		return nil
-	}
-	slog.Info(fmt.Sprintf("Generated %d daily entries for the Excel export.", len(excelEntries)))
-
-	if err := writeExcelSheet(excelEntries, filename); err != nil {
-		return fmt.Errorf("failed to write excel sheet '%s': %w", filename, err)
-	}
-
-	slog.Info(fmt.Sprintf("Successfully exported timetable to %s", filename))
-	fmt.Printf("Successfully exported timetable to %s\n", filename)
-	return nil
 }
 
-func (ts *TimeStore) LogFullDay(tag string, date time.Time) error {
-	if tag == "" {
-		return fmt.Errorf("cannot log full day with an empty tag")
-	}
-	tag = strings.ToLower(tag)
-
-	location := date.Location()
-	dayStart := time.Date(date.Year(), date.Month(), date.Day(), 0, 0, 0, 0, location)
-	dayEnd := dayStart.Add(24 * time.Hour)
-	dayStr := dayStart.Format("2006-01-02")
-
-	slog.Info(fmt.Sprintf("Attempting to log '%s' for the full day %s", tag, dayStr))
-
-	stopped, err := ts.stopCurrentEntry(dayStart)
-	if err != nil {
-		slog.Warn(fmt.Sprintf("Failed to stop current entry before logging full day '%s': %v", tag, err))
-	} else if stopped {
-		slog.Info(fmt.Sprintf("Stopped active timer before logging '%s' for %s.", tag, dayStr))
-	}
-
-	tx, err := ts.db.Begin()
-	if err != nil {
-		return fmt.Errorf("could not begin transaction to log full day: %w", err)
-	}
-	defer tx.Rollback()
-
-	query := `INSERT INTO time_entries (tag, start_time, end_time) VALUES (?, ?, ?);`
-	stmt, err := tx.Prepare(query)
-	if err != nil {
-		return fmt.Errorf("could not prepare statement to log full day: %w", err)
-	}
-	defer stmt.Close()
-
-	_, err = stmt.Exec(tag, dayStart, dayEnd)
-	if err != nil {
-		return fmt.Errorf("failed to insert full-day entry for tag '%s' on %s: %w", tag, dayStr, err)
-	}
-
-	if err = tx.Commit(); err != nil {
-		return fmt.Errorf("failed to commit transaction for full-day entry: %w", err)
-	}
-
-	titleCaser := cases.Title(language.English)
-	slog.Info(fmt.Sprintf("Successfully logged full day entry: Tag='%s', Start='%s', End='%s'", tag, dayStart.Format(time.RFC3339), dayEnd.Format(time.RFC3339)))
-	fmt.Printf("Successfully logged '%s' for %s.\n", titleCaser.String(tag), dayStr)
-	return nil
+func (s *Store) DB() *sql.DB {
+	return s.db
 }
diff --git a/main.go b/main.go
index 8067e3c..4d4140b 100644
--- a/main.go
+++ b/main.go
@@ -1,43 +1,50 @@
 package main
 
 import (
+	"context"
+	"fmt"
 	"log/slog"
 	"os"
+	"os/signal"
 	"path/filepath"
+	"syscall"
 )
 
 func main() {
 	configDir, err := os.UserConfigDir()
 	if err != nil {
-		slog.Error("Cant get user config dir")
-		panic(err)
+		fmt.Fprintf(os.Stderr, "Error getting config dir: %v\n", err)
+		os.Exit(1)
 	}
+	logFile := filepath.Join(configDir, "work", "workctl.log")
+	_ = os.MkdirAll(filepath.Dir(logFile), 0750)
 
-	file, err := os.OpenFile(filepath.Join(configDir, "work", "workctl.log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0666)
+	file, err := os.OpenFile(logFile, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0666)
 	if err != nil {
-		panic(err)
+		fmt.Fprintf(os.Stderr, "Failed to open log file: %v\n", err)
+		os.Exit(1)
 	}
 	defer file.Close()
 
 	logger := slog.New(slog.NewTextHandler(file, nil))
 	slog.SetDefault(logger)
 
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer cancel()
+
 	app, err := NewApp()
 	if err != nil {
-		slog.Error("Unable to setup application", "Error", err)
+		slog.Error("Unable to setup application", "error", err)
+		fmt.Fprintf(os.Stderr, "Error setting up application: %v\n", err)
 		os.Exit(1)
 	}
 	defer func() {
 		if err := app.Close(); err != nil {
-			slog.Error("Failed to close application resources", "Error", err)
+			slog.Error("Failed to close application resources", "error", err)
 		}
 	}()
 
-	if len(os.Args) > 1 {
-		if err := app.setupCommands().Execute(); err != nil {
-			os.Exit(1)
-		}
-	} else {
-		app.makeChoice()
+	if err := app.Execute(ctx); err != nil {
+		os.Exit(1)
 	}
 }
diff --git a/secrets.go b/secrets.go
new file mode 100644
index 0000000..5cc1584
--- /dev/null
+++ b/secrets.go
@@ -0,0 +1,28 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/zalando/go-keyring"
+)
+
+const (
+	serviceName    = "workctl"
+	keySSHPassword = "ssh-password"
+	keyRDPPassword = "rdp-password"
+)
+
+func getSecret(key string) (string, error) {
+	val, err := keyring.Get(serviceName, key)
+	if err != nil {
+		return "", err
+	}
+	return val, nil
+}
+
+func setSecret(key, value string) error {
+	if value == "" {
+		return fmt.Errorf("secret cannot be empty")
+	}
+	return keyring.Set(serviceName, key, value)
+}
diff --git a/ssh.go b/ssh.go
deleted file mode 100644
index c1d6a05..0000000
--- a/ssh.go
+++ /dev/null
@@ -1,19 +0,0 @@
-package main
-
-import (
-	"log/slog"
-
-	"golang.org/x/crypto/ssh"
-)
-
-type SSHConnection struct {
-	client *ssh.Client
-}
-
-func (s *SSHConnection) Close() error {
-	if s.client != nil {
-		slog.Debug("Closing SSH client connection.")
-		return s.client.Close()
-	}
-	return nil
-}