fix incorrect dns configuration examples

Signed-off-by: Johan Siebens <johan.siebens@gmail.com>

.dockerignore

@@ -0,0 +1,4 @@
+.git
+.idea
+tests
+!tests/config/ca.pem

.github/CONTRIBUTING.md

@@ -0,0 +1,9 @@
+## Contribution Policy
+
+ionscale is open to code contributions for bug fixes only. 
+
+Features carry a long-term maintenance burden so they will not be accepted at this time.
+Please [submit an issue][new-issue] if you have a feature you'd like to
+request.
+
+[new-issue]: https://github.com/jsiebens/ionscale/issues/new

.github/workflows/build.yaml

@@ -4,21 +4,34 @@ on:
   push:
     branches:
       - '*'
+  pull_request:
+    branches:
+      - main
 
 jobs:
+  buf-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Buf
+        uses: bufbuild/buf-setup-action@v1
+      - name: Buf Lint
+        uses: bufbuild/buf-lint-action@v1
+        with:
+          input: proto
+
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-
+        uses: actions/checkout@v4
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
-          go-version: ^1.18
-
+          go-version-file: 'go.mod'
+          cache: true
       - name: Build
         run: |
+          go test -v -short ./...
           go build cmd/ionscale/main.go

.github/workflows/docs.yaml

@@ -0,0 +1,23 @@
+name: docs
+
+on:
+  push:
+    branches: ['main']
+    paths: ['mkdocs/**']
+
+permissions:
+  pages: write
+  contents: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v2
+        with:
+          python-version: 3.x
+      - run: pip install mkdocs-material
+      - run: cd mkdocs && mkdocs gh-deploy --force
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/integration.yaml

@@ -0,0 +1,38 @@
+name: Integration Tests
+
+on:
+  workflow_dispatch: {}
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ts_version:
+          - "v1.80"
+          - "v1.78"
+          - "v1.76"
+          - "v1.74"
+          - "v1.72"
+          - "v1.70"
+          - "v1.68"
+          - "v1.66"
+    env:
+      IONSCALE_TESTS_TS_TARGET_VERSION:  ${{ matrix.ts_version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+      - name: Run Integration Tests
+        run: |
+          go test -v ./tests

.github/workflows/release.yaml

@@ -3,7 +3,7 @@ name: release
 on:
   push:
     tags:
-      - '*'
+      - 'v*'
 
 permissions:
   contents: write
@@ -17,7 +17,7 @@ jobs:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up QEMU
@@ -29,17 +29,17 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
-          go-version: ^1.18
+          go-version-file: 'go.mod'
+          cache: true
       - name: Install cosign
-        uses: sigstore/cosign-installer@v2.0.0
+        uses: sigstore/cosign-installer@v3
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v5
         with:
-          distribution: goreleaser-pro
+          distribution: goreleaser
           version: latest
           args: release --rm-dist
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security-analysis.yml

@@ -0,0 +1,48 @@
+name: "Security Analysis"
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 0'
+
+jobs:
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+
+  trivy:
+    name: Trivy
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@0.19.0
+        with:
+          image-ref: ghcr.io/jsiebens/ionscale:latest
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+      - name: Upload Trivy scan results
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'

.goreleaser.yaml

@@ -1,8 +1,5 @@
 project_name: ionscale
 
-nightly:
-  name_template: '{{ incminor .Version }}-dev'
-
 before:
   hooks:
     - go mod tidy
@@ -23,6 +20,9 @@ builds:
     ldflags:
       - -s -w -X github.com/jsiebens/ionscale/internal/version.Version={{.Version}} -X github.com/jsiebens/ionscale/internal/version.Revision={{.ShortCommit}}
 
+checksum:
+  name_template: "checksums.txt"
+
 dockers:
   - image_templates: [ "ghcr.io/jsiebens/{{ .ProjectName }}:{{ .Version }}-amd64" ]
     dockerfile: Dockerfile
@@ -41,7 +41,7 @@ docker_manifests:
     image_templates:
       - ghcr.io/jsiebens/{{ .ProjectName }}:{{ .Version }}-amd64
       - ghcr.io/jsiebens/{{ .ProjectName }}:{{ .Version }}-arm64
-  - name_template: ghcr.io/jsiebens/{{ .ProjectName }}:{{ if .IsNightly }}dev{{ else }}latest{{ end }}
+  - name_template: ghcr.io/jsiebens/{{ .ProjectName }}:latest
     image_templates:
       - ghcr.io/jsiebens/{{ .ProjectName }}:{{ .Version }}-amd64
       - ghcr.io/jsiebens/{{ .ProjectName }}:{{ .Version }}-arm64
@@ -56,6 +56,7 @@ signs:
       - '--output-certificate=${certificate}'
       - '--output-signature=${signature}'
       - '${artifact}'
+      - '--yes'
     artifacts: checksum
 
 docker_signs:
@@ -67,11 +68,14 @@ docker_signs:
     args:
       - sign
       - '${artifact}'
+      - '--yes'
 
 archives:
-  - format_overrides:
-      - goos: windows
-        format: zip
+  - format: binary
+    name_template: '{{ .Binary }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}'
+
+release:
+  prerelease: auto
 
 changelog:
   sort: asc

Dockerfile

@@ -1,3 +1,8 @@
-FROM alpine:3.15.4
+FROM --platform=${BUILDPLATFORM:-linux/amd64} alpine:3.21.3
+
 COPY ionscale /usr/local/bin/ionscale
-ENTRYPOINT ["ionscale"]
+
+RUN mkdir -p /data/ionscale
+WORKDIR /data/ionscale
+
+ENTRYPOINT ["/usr/local/bin/ionscale"]

Makefile

@@ -1,2 +1,19 @@
+init:
+	go install github.com/a-h/templ/cmd/templ@latest
+	go install github.com/bufbuild/buf/cmd/buf@latest
+	go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest
+	go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
+	go install github.com/bufbuild/connect-go/cmd/protoc-gen-connect-go@latest
+
 generate:
-	buf generate proto
+	templ generate
+	buf generate proto
+
+format:
+	buf format -w proto
+
+lint:
+	buf lint proto
+
+breaking:
+	buf breaking proto --against https://github.com/jsiebens/ionscale.git#subdir=proto

README.md

@@ -1 +1,49 @@
 # ionscale
+
+> **Note**:
+> ionscale is currently beta quality, actively being developed and so subject to changes
+
+**What is Tailscale?**
+
+[Tailscale](https://tailscale.com) is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly. 
+It enables encrypted point-to-point connections using the open source [WireGuard](https://www.wireguard.com/) protocol, which means only devices on your private network can communicate with each other.
+
+**What is ionscale?**
+
+While the Tailscale software running on each node is open source, their centralized "coordination server" which act as a shared drop box for public keys is not.
+
+_ionscale_ aims to implement such lightweight, open source alternative Tailscale control server.
+
+![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/jsiebens/ionscale/build.yaml)
+![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/jsiebens/ionscale?label=go)
+![Go Report Card](https://goreportcard.com/badge/github.com/jsiebens/ionscale)
+![GitHub All Releases](https://img.shields.io/github/downloads/jsiebens/ionscale/total)
+![GitHub Release](https://img.shields.io/github/v/release/jsiebens/ionscale)
+
+⭐ If you find _ionscale_ useful, please consider giving it a star on GitHub, or [drop a note](https://github.com/jsiebens/ionscale/discussions/new?category=show-and-tell) on how you are using _ionscale_.
+
+## Features
+
+- multi [tailnet](https://tailscale.com/kb/1136/tailnet/) support
+- multi user support
+- OIDC integration (not required, although recommended)
+- [Auth keys](https://tailscale.com/kb/1085/auth-keys/)
+- [Access control list](https://tailscale.com/kb/1018/acls/) (with support for `autogroups`, `tagOwners`, `autoApprovers`, `nodeAttrs`, `grants` ...)  
+- [DNS](https://tailscale.com/kb/1054/dns/)
+  - nameservers
+  - Split DNS
+  - MagicDNS
+- [Subnet routers](https://tailscale.com/kb/1019/subnets) and [Exit Nodes](https://tailscale.com/kb/1103/exit-nodes)
+- [HTTPS Certs](https://tailscale.com/kb/1153/enabling-https/)
+- [Tailscale SSH](https://tailscale.com/kb/1193/tailscale-ssh/) 
+- [Tailscale Serve](https://tailscale.com/kb/1312/serve)
+- [Service collection](https://tailscale.com/kb/1100/services/)
+- [Taildrop](https://tailscale.com/kb/1106/taildrop/)
+
+## Documentation
+
+Some documentation can be found [here](https://jsiebens.github.io/ionscale)
+
+## Disclaimer
+
+This is not an official Tailscale or Tailscale Inc. project.

buf.gen.yaml

@@ -1,11 +1,8 @@
-version: v1beta1
+version: v1
 plugins:
   - name: go
     out: pkg/gen
     opt: paths=source_relative
-  - name: go-grpc
+  - name: connect-go
     out: pkg/gen
-    opt: paths=source_relative,require_unimplemented_servers=false
-  - name: grpc-gateway
-    out: pkg/gen
-    opt: paths=source_relative
+    opt: paths=source_relative

go.mod

@@ -1,95 +1,267 @@
 module github.com/jsiebens/ionscale
 
-go 1.18
+go 1.24.2
 
 require (
+	github.com/99designs/keyring v1.2.2
+	github.com/a-h/templ v0.3.857
 	github.com/apparentlymart/go-cidr v1.1.0
-	github.com/caddyserver/certmagic v0.16.1
-	github.com/glebarez/sqlite v1.4.3
-	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2
-	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
-	github.com/hashicorp/go-hclog v1.1.0
-	github.com/improbable-eng/grpc-web v0.15.0
-	github.com/klauspost/compress v1.15.3
-	github.com/labstack/echo-contrib v0.12.0
-	github.com/labstack/echo/v4 v4.6.3
+	github.com/bufbuild/connect-go v1.10.0
+	github.com/caddyserver/certmagic v0.20.0
+	github.com/coreos/go-oidc/v3 v3.14.1
+	github.com/dustinkirkland/golang-petname v0.0.0-20240428194347-eebcea082ee0
+	github.com/glebarez/sqlite v1.11.0
+	github.com/go-gormigrate/gormigrate/v2 v2.1.4
+	github.com/go-jose/go-jose/v3 v3.0.4
+	github.com/golang-jwt/jwt/v4 v4.5.2
+	github.com/hashicorp/go-bexpr v0.1.14
+	github.com/hashicorp/go-getter v1.7.8
+	github.com/hashicorp/go-hclog v1.6.3
+	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hashicorp/go-plugin v1.6.3
+	github.com/jsiebens/go-edit v0.1.0
+	github.com/jsiebens/libdns-plugin v0.1.0
+	github.com/jsiebens/mockoidc v0.1.0-rc2
+	github.com/klauspost/compress v1.18.0
+	github.com/labstack/echo-contrib v0.17.3
+	github.com/labstack/echo/v4 v4.13.3
+	github.com/libdns/azure v0.4.0
+	github.com/libdns/cloudflare v0.1.1
+	github.com/libdns/digitalocean v0.0.0-20230728223659-4f9064657aea
+	github.com/libdns/googleclouddns v1.1.0
+	github.com/libdns/libdns v0.2.3
+	github.com/libdns/route53 v1.3.3
 	github.com/mitchellh/go-homedir v1.1.0
+	github.com/mitchellh/pointerstructure v1.2.1
 	github.com/mr-tron/base58 v1.2.0
-	github.com/muesli/coral v1.0.0
 	github.com/nleeper/goment v1.4.4
-	github.com/patrickmn/go-cache v2.1.0+incompatible
-	github.com/rodaine/table v1.0.1
-	github.com/soheilhy/cmux v0.1.5
-	github.com/sony/sonyflake v1.0.0
-	github.com/xhit/go-str2duration/v2 v2.0.0
-	golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f
-	golang.org/x/net v0.0.0-20220407224826-aac1ed45d8e3
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
-	google.golang.org/grpc v1.44.0
-	google.golang.org/protobuf v1.27.1
+	github.com/ory/dockertest/v3 v3.12.0
+	github.com/prometheus/client_golang v1.22.0
+	github.com/puzpuzpuz/xsync/v3 v3.5.1
+	github.com/rodaine/table v1.3.0
+	github.com/sony/sonyflake v1.2.0
+	github.com/spf13/cobra v1.9.1
+	github.com/stretchr/testify v1.10.0
+	github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a
+	github.com/travisjeffery/certmagic-sqlstorage v1.1.1
+	github.com/xhit/go-str2duration/v2 v2.1.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/crypto v0.38.0
+	golang.org/x/net v0.40.0
+	golang.org/x/oauth2 v0.29.0
+	golang.org/x/sync v0.14.0
+	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v2 v2.4.0
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
-	gorm.io/gorm v1.23.5
-	inet.af/netaddr v0.0.0-20211027220019-c74959edd3b6
-	tailscale.com v1.24.2
+	gopkg.in/yaml.v3 v3.0.1
+	gorm.io/driver/postgres v1.5.11
+	gorm.io/gorm v1.26.0
+	gorm.io/plugin/prometheus v0.1.0
+	inet.af/netaddr v0.0.0-20230525184311-b8eac61e914a
+	sigs.k8s.io/yaml v1.4.0
+	tailscale.com v1.80.0
 )
 
 require (
-	github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 // indirect
+	cel.dev/expr v0.23.1 // indirect
+	cloud.google.com/go v0.120.1 // indirect
+	cloud.google.com/go/auth v0.16.1 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	cloud.google.com/go/iam v1.5.2 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/storage v1.52.0 // indirect
+	dario.cat/mergo v1.0.1 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.6.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.2.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
+	github.com/akutz/memconn v0.1.0 // indirect
+	github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect
+	github.com/aws/aws-sdk-go v1.55.7 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.26.1 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.11 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.40.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 // indirect
+	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.1.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
-	github.com/fatih/color v1.13.0 // indirect
-	github.com/glebarez/go-sqlite v1.16.0 // indirect
+	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
+	github.com/bits-and-blooms/bitset v1.13.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f // indirect
+	github.com/coder/websocket v1.8.12 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
+	github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 // indirect
+	github.com/danieljoos/wincred v1.2.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dblohm7/wingoes v0.0.0-20240123200102-b75a8a7d7eb0 // indirect
+	github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e // indirect
+	github.com/digitalocean/godo v1.113.0 // indirect
+	github.com/docker/cli v27.4.1+incompatible // indirect
+	github.com/docker/docker v27.4.1+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/dvsekhvalnov/jose2go v1.7.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/gaissmai/bart v0.11.1 // indirect
+	github.com/glebarez/go-sqlite v1.22.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.0 // indirect
+	github.com/go-json-experiment/json v0.0.0-20250103232110-6a9a0fde9288 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.1.0 // indirect
+	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
+	github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.7 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/btree v1.1.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
+	github.com/gorilla/csrf v1.7.3-0.20250123201450-9dd6af1f6d30 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-safetemp v1.0.0 // indirect
+	github.com/hashicorp/go-version v1.7.0 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
+	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
+	github.com/illarion/gonotify/v2 v2.0.3 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20231201235250-de7065d80cb9 // indirect
+	github.com/jackc/pgx/v5 v5.5.5 // indirect
+	github.com/jackc/puddle/v2 v2.2.1 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
-	github.com/josharian/native v1.0.0 // indirect
-	github.com/jsimonetti/rtnetlink v1.1.2-0.20220408201609-d380b505068b // indirect
-	github.com/klauspost/cpuid/v2 v2.0.11 // indirect
-	github.com/labstack/gommon v0.3.1 // indirect
-	github.com/libdns/libdns v0.2.1 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mdlayher/netlink v1.6.0 // indirect
-	github.com/mdlayher/socket v0.2.3 // indirect
-	github.com/mholt/acmez v1.0.2 // indirect
-	github.com/miekg/dns v1.1.46 // indirect
-	github.com/prometheus/client_golang v1.11.0 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.32.1 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
-	github.com/rs/cors v1.7.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/tkuchiki/go-timezone v0.2.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.4.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/labstack/gommon v0.4.2 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
+	github.com/mdlayher/sdnotify v1.0.0 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
+	github.com/mholt/acmez v1.2.0 // indirect
+	github.com/miekg/dns v1.1.59 // indirect
+	github.com/mitchellh/go-ps v1.0.0 // indirect
+	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
+	github.com/mtibben/percent v0.2.1 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/oklog/run v1.1.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/runc v1.2.3 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus-community/pro-bing v0.4.0 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
+	github.com/prometheus/procfs v0.16.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/safchain/ethtool v0.3.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
+	github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e // indirect
+	github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
+	github.com/tailscale/golang-x-crypto v0.0.0-20240604161659-3fde5e568aa4 // indirect
+	github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 // indirect
+	github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7 // indirect
+	github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc // indirect
+	github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976 // indirect
+	github.com/tailscale/wireguard-go v0.0.0-20250107165329-0b8b35511f19 // indirect
+	github.com/tkuchiki/go-timezone v0.2.3 // indirect
+	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasttemplate v1.2.1 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
-	go.uber.org/multierr v1.6.0 // indirect
-	go.uber.org/zap v1.21.0 // indirect
-	go4.org/intern v0.0.0-20211027215823-ae77deb06f29 // indirect
-	go4.org/mem v0.0.0-20210711025021-927187094b94 // indirect
-	go4.org/unsafe/assume-no-moving-gc v0.0.0-20211027215541-db492cf91b37 // indirect
-	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
-	golang.org/x/sys v0.0.0-20220422013727-9388b58f7150 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
-	golang.org/x/tools v0.1.11-0.20220413170336-afc6aad76eb1 // indirect
-	golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect
-	golang.zx2c4.com/wireguard/windows v0.4.10 // indirect
-	google.golang.org/genproto v0.0.0-20210126160654-44e461bb6506 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	modernc.org/libc v1.14.12 // indirect
-	modernc.org/mathutil v1.4.1 // indirect
-	modernc.org/memory v1.0.7 // indirect
-	modernc.org/sqlite v1.16.0 // indirect
-	nhooyr.io/websocket v1.8.7 // indirect
+	github.com/valyala/fasttemplate v1.2.2 // indirect
+	github.com/vishvananda/netns v0.0.4 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/zeebo/blake3 v0.2.3 // indirect
+	github.com/zeebo/errs v1.4.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.35.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go4.org/intern v0.0.0-20230525184215-6c62f75575cb // indirect
+	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	go4.org/unsafe/assume-no-moving-gc v0.0.0-20231121144256-b99613f794b6 // indirect
+	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/tools v0.29.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
+	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
+	google.golang.org/api v0.230.0 // indirect
+	google.golang.org/genproto v0.0.0-20250425173222-7b384671a197 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250425173222-7b384671a197 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9 // indirect
+	google.golang.org/grpc v1.72.1 // indirect
+	gvisor.dev/gvisor v0.0.0-20240722211153-64c016c92987 // indirect
+	modernc.org/libc v1.50.3 // indirect
+	modernc.org/mathutil v1.6.0 // indirect
+	modernc.org/memory v1.8.0 // indirect
+	modernc.org/sqlite v1.29.8 // indirect
 )

internal/addr/addr.go

@@ -3,18 +3,34 @@ package addr
 import (
 	"github.com/apparentlymart/go-cidr/cidr"
 	"github.com/jsiebens/ionscale/internal/util"
-	"inet.af/netaddr"
 	"math/big"
 	"net"
+	"net/netip"
 	"tailscale.com/net/tsaddr"
 )
 
-var ipv4Range = tsaddr.CGNATRange().IPNet()
+var (
+	ipv4Range *net.IPNet
+	ipv4Count uint64
+)
 
-type Predicate func(netaddr.IP) (bool, error)
+func init() {
+	ipv4Range, ipv4Count = prepareIP4Range()
+}
 
-func SelectIP(predicate Predicate) (*netaddr.IP, *netaddr.IP, error) {
-	ip4, err := selectIP(ipv4Range, predicate)
+func prepareIP4Range() (*net.IPNet, uint64) {
+	cgnatRange := tsaddr.CGNATRange()
+	_, ipNet, err := net.ParseCIDR(cgnatRange.String())
+	if err != nil {
+		panic(err)
+	}
+	return ipNet, cidr.AddressCount(ipNet)
+}
+
+type Predicate func(netip.Addr) (bool, error)
+
+func SelectIP(predicate Predicate) (*netip.Addr, *netip.Addr, error) {
+	ip4, err := selectIP(predicate)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -22,16 +38,16 @@ func SelectIP(predicate Predicate) (*netaddr.IP, *netaddr.IP, error) {
 	return ip4, &ip6, err
 }
 
-func selectIP(c *net.IPNet, predicate Predicate) (*netaddr.IP, error) {
-	count := cidr.AddressCount(c)
-	var n = util.RandUint64(count)
+func selectIP(predicate Predicate) (*netip.Addr, error) {
+	var n = util.RandUint64(ipv4Count)
 
 	for {
-		stdIP, err := cidr.HostBig(c, big.NewInt(int64(n)))
+		stdIP, err := cidr.HostBig(ipv4Range, big.NewInt(int64(n)))
 		if err != nil {
 			return nil, err
 		}
-		ip, _ := netaddr.FromStdIP(stdIP)
+
+		ip, _ := netip.AddrFromSlice(stdIP)
 		ok, err := validateIP(ip, predicate)
 		if err != nil {
 			return nil, err
@@ -39,11 +55,11 @@ func selectIP(c *net.IPNet, predicate Predicate) (*netaddr.IP, error) {
 		if ok {
 			return &ip, nil
 		}
-		n = (n + 1) % count
+		n = (n + 1) % ipv4Count
 	}
 }
 
-func validateIP(ip netaddr.IP, p Predicate) (bool, error) {
+func validateIP(ip netip.Addr, p Predicate) (bool, error) {
 	if tsaddr.IsTailscaleIP(ip) {
 		if p != nil {
 			return p(ip)

internal/auth/oidc.go

@@ -0,0 +1,137 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/config"
+	"strings"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+)
+
+type OIDCProvider struct {
+	clientID     string
+	clientSecret string
+	scopes       []string
+	provider     *oidc.Provider
+	verifier     *oidc.IDTokenVerifier
+}
+
+func NewOIDCProvider(c *config.AuthProvider) (*OIDCProvider, error) {
+	defaultScopes := []string{oidc.ScopeOpenID, "email", "profile"}
+	provider, err := oidc.NewProvider(context.Background(), c.Issuer)
+	if err != nil {
+		return nil, err
+	}
+
+	verifier := provider.Verifier(&oidc.Config{ClientID: c.ClientID, SkipClientIDCheck: c.ClientID == ""})
+
+	return &OIDCProvider{
+		clientID:     c.ClientID,
+		clientSecret: c.ClientSecret,
+		scopes:       append(defaultScopes, c.Scopes...),
+		provider:     provider,
+		verifier:     verifier,
+	}, nil
+}
+
+func (p *OIDCProvider) GetLoginURL(redirectURI, state string) string {
+	oauth2Config := oauth2.Config{
+		ClientID:     p.clientID,
+		ClientSecret: p.clientSecret,
+		RedirectURL:  redirectURI,
+		Endpoint:     p.provider.Endpoint(),
+		Scopes:       p.scopes,
+	}
+
+	return oauth2Config.AuthCodeURL(state, oauth2.ApprovalForce)
+}
+
+func (p *OIDCProvider) Exchange(redirectURI, code string) (*User, error) {
+	oauth2Config := oauth2.Config{
+		ClientID:     p.clientID,
+		ClientSecret: p.clientSecret,
+		RedirectURL:  redirectURI,
+		Endpoint:     p.provider.Endpoint(),
+		Scopes:       p.scopes,
+	}
+
+	oauth2Token, err := oauth2Config.Exchange(context.Background(), code)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Extract the ID Token from OAuth2 token.
+	rawIdToken, ok := oauth2Token.Extra("id_token").(string)
+	if !ok || strings.TrimSpace(rawIdToken) == "" {
+		return nil, fmt.Errorf("id_token missing")
+	}
+
+	// Parse and verify ID Token payload.
+	idToken, err := p.verifier.Verify(context.Background(), rawIdToken)
+	if err != nil {
+		return nil, err
+	}
+
+	sub, email, tokenClaims, err := p.getTokenClaims(idToken)
+	if err != nil {
+		return nil, err
+	}
+
+	userInfoClaims, err := p.getUserInfoClaims(oauth2Config, oauth2Token)
+	if err != nil {
+		return nil, err
+	}
+
+	domain := strings.Split(email, "@")[1]
+
+	return &User{
+		ID:   sub,
+		Name: email,
+		Attr: map[string]interface{}{
+			"email":    email,
+			"domain":   domain,
+			"token":    tokenClaims,
+			"userinfo": userInfoClaims,
+		},
+	}, nil
+}
+
+func (p *OIDCProvider) getTokenClaims(idToken *oidc.IDToken) (string, string, map[string]interface{}, error) {
+	var raw = make(map[string]interface{})
+	var claims struct {
+		Sub   string `json:"sub"`
+		Email string `json:"email"`
+	}
+
+	// Extract default claims.
+	if err := idToken.Claims(&claims); err != nil {
+		return "", "", nil, fmt.Errorf("failed to parse id_token claims: %v", err)
+	}
+
+	// Extract raw claims.
+	if err := idToken.Claims(&raw); err != nil {
+		return "", "", nil, fmt.Errorf("failed to parse id_token claims: %v", err)
+	}
+
+	return claims.Sub, claims.Email, raw, nil
+}
+
+func (p *OIDCProvider) getUserInfoClaims(config oauth2.Config, token *oauth2.Token) (map[string]interface{}, error) {
+	var raw = make(map[string]interface{})
+
+	source := config.TokenSource(context.Background(), token)
+
+	info, err := p.provider.UserInfo(context.Background(), source)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := info.Claims(&raw); err != nil {
+		return nil, fmt.Errorf("failed to parse user info claims: %v", err)
+	}
+
+	return raw, nil
+}

internal/auth/provider.go

@@ -0,0 +1,12 @@
+package auth
+
+type Provider interface {
+	GetLoginURL(redirectURI, state string) string
+	Exchange(redirectURI, code string) (*User, error)
+}
+
+type User struct {
+	ID   string
+	Name string
+	Attr map[string]interface{}
+}

internal/bind/binder.go

@@ -1,163 +0,0 @@
-package bind
-
-import (
-	"encoding/binary"
-	"encoding/json"
-	"fmt"
-	"github.com/jsiebens/ionscale/internal/util"
-	"github.com/klauspost/compress/zstd"
-	"github.com/labstack/echo/v4"
-	"io/ioutil"
-	"tailscale.com/types/key"
-)
-
-type Factory func(c echo.Context) (Binder, error)
-
-type Binder interface {
-	BindRequest(c echo.Context, v interface{}) error
-	WriteResponse(c echo.Context, code int, v interface{}) error
-	Marshal(compress string, v interface{}) ([]byte, error)
-	Peer() key.MachinePublic
-}
-
-func DefaultBinder(machineKey key.MachinePublic) Factory {
-	return func(c echo.Context) (Binder, error) {
-		return &defaultBinder{machineKey: machineKey}, nil
-	}
-}
-
-func BoxBinder(controlKey key.MachinePrivate) Factory {
-	return func(c echo.Context) (Binder, error) {
-		idParam := c.Param("id")
-
-		id, err := util.ParseMachinePublicKey(idParam)
-
-		if err != nil {
-			return nil, err
-		}
-
-		return &boxBinder{
-			controlKey: controlKey,
-			machineKey: *id,
-		}, nil
-	}
-}
-
-type defaultBinder struct {
-	machineKey key.MachinePublic
-}
-
-func (d *defaultBinder) BindRequest(c echo.Context, v interface{}) error {
-	body, err := ioutil.ReadAll(c.Request().Body)
-	if err != nil {
-		return err
-	}
-
-	return json.Unmarshal(body, v)
-}
-
-func (d *defaultBinder) WriteResponse(c echo.Context, code int, v interface{}) error {
-	marshalled, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	c.Response().WriteHeader(code)
-	_, err = c.Response().Write(marshalled)
-
-	return err
-}
-
-func (d *defaultBinder) Marshal(compress string, v interface{}) ([]byte, error) {
-	var payload []byte
-
-	marshalled, err := json.Marshal(v)
-	if err != nil {
-		return nil, err
-	}
-
-	if compress == "zstd" {
-		encoder, err := zstd.NewWriter(nil)
-		if err != nil {
-			return nil, err
-		}
-
-		payload = encoder.EncodeAll(marshalled, nil)
-	} else {
-		payload = marshalled
-	}
-
-	data := make([]byte, 4)
-	binary.LittleEndian.PutUint32(data, uint32(len(payload)))
-	data = append(data, payload...)
-
-	return data, nil
-}
-
-func (d *defaultBinder) Peer() key.MachinePublic {
-	return d.machineKey
-}
-
-type boxBinder struct {
-	controlKey key.MachinePrivate
-	machineKey key.MachinePublic
-}
-
-func (b *boxBinder) BindRequest(c echo.Context, v interface{}) error {
-	body, err := ioutil.ReadAll(c.Request().Body)
-	if err != nil {
-		return err
-	}
-
-	decrypted, ok := b.controlKey.OpenFrom(b.machineKey, body)
-	if !ok {
-		return fmt.Errorf("unable to decrypt payload")
-	}
-
-	return json.Unmarshal(decrypted, v)
-}
-
-func (b *boxBinder) WriteResponse(c echo.Context, code int, v interface{}) error {
-	marshalled, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	encrypted := b.controlKey.SealTo(b.machineKey, marshalled)
-
-	c.Response().WriteHeader(code)
-	_, err = c.Response().Write(encrypted)
-
-	return err
-}
-
-func (b *boxBinder) Marshal(compress string, v interface{}) ([]byte, error) {
-	var payload []byte
-
-	marshalled, err := json.Marshal(v)
-	if err != nil {
-		return nil, err
-	}
-
-	if compress == "zstd" {
-		encoder, err := zstd.NewWriter(nil)
-		if err != nil {
-			return nil, err
-		}
-
-		encoded := encoder.EncodeAll(marshalled, nil)
-		payload = b.controlKey.SealTo(b.machineKey, encoded)
-	} else {
-		payload = b.controlKey.SealTo(b.machineKey, marshalled)
-	}
-
-	data := make([]byte, 4)
-	binary.LittleEndian.PutUint32(data, uint32(len(payload)))
-	data = append(data, payload...)
-
-	return data, nil
-}
-
-func (b *boxBinder) Peer() key.MachinePublic {
-	return b.machineKey
-}

internal/broker/broker.go

@@ -1,119 +0,0 @@
-package broker
-
-import (
-	"sync"
-	"tailscale.com/types/key"
-)
-
-type BrokerPool struct {
-	lock  sync.Mutex
-	store map[uint64]Broker
-}
-
-type Signal struct {
-	PeerUpdated  *uint64
-	PeersRemoved []uint64
-	ACLUpdated   bool
-	DNSUpdated   bool
-}
-
-type Broker interface {
-	AddClient(*Client)
-	RemoveClient(uint64)
-
-	SignalTailnedDeleted()
-	SignalPeerUpdated(id uint64)
-	SignalPeersRemoved([]uint64)
-	SignalDNSUpdated()
-	SignalACLUpdated()
-
-	IsConnected(uint64) bool
-}
-
-func NewBrokerPool() *BrokerPool {
-	return &BrokerPool{
-		store: make(map[uint64]Broker),
-	}
-}
-
-func (m *BrokerPool) Get(tailnetID uint64) Broker {
-	m.lock.Lock()
-	defer m.lock.Unlock()
-	b, ok := m.store[tailnetID]
-	if !ok {
-		b = newBroker(tailnetID)
-		m.store[tailnetID] = b
-	}
-	return b
-}
-
-func newBroker(tailnetID uint64) Broker {
-	b := &broker{
-		tailnetID:      tailnetID,
-		newClients:     make(chan *Client),
-		closingClients: make(chan uint64),
-		clients:        make(map[uint64]*Client),
-		signalChannel:  make(chan *Signal),
-	}
-
-	go b.listen()
-
-	return b
-}
-
-type broker struct {
-	tailnetID      uint64
-	privateKey     *key.MachinePrivate
-	newClients     chan *Client
-	closingClients chan uint64
-	signalChannel  chan *Signal
-	clients        map[uint64]*Client
-}
-
-func (h *broker) IsConnected(id uint64) (ok bool) {
-	_, ok = h.clients[id]
-	return
-}
-
-func (h *broker) AddClient(client *Client) {
-	h.newClients <- client
-}
-
-func (h *broker) RemoveClient(id uint64) {
-	h.closingClients <- id
-}
-
-func (h *broker) SignalTailnedDeleted() {
-	h.signalChannel <- &Signal{}
-}
-
-func (h *broker) SignalPeerUpdated(id uint64) {
-	h.signalChannel <- &Signal{PeerUpdated: &id}
-}
-
-func (h *broker) SignalPeersRemoved(ids []uint64) {
-	h.signalChannel <- &Signal{PeersRemoved: ids}
-}
-
-func (h *broker) SignalDNSUpdated() {
-	h.signalChannel <- &Signal{DNSUpdated: true}
-}
-
-func (h *broker) SignalACLUpdated() {
-	h.signalChannel <- &Signal{ACLUpdated: true}
-}
-
-func (h *broker) listen() {
-	for {
-		select {
-		case s := <-h.newClients:
-			h.clients[s.id] = s
-		case s := <-h.closingClients:
-			delete(h.clients, s)
-		case s := <-h.signalChannel:
-			for _, c := range h.clients {
-				c.SignalUpdate(s)
-			}
-		}
-	}
-}

internal/broker/client.go

@@ -1,26 +0,0 @@
-package broker
-
-import (
-	"github.com/jsiebens/ionscale/internal/bind"
-	"tailscale.com/tailcfg"
-)
-
-func NewClient(id uint64, channel chan *Signal) Client {
-	return Client{
-		id:      id,
-		channel: channel,
-	}
-}
-
-type Client struct {
-	id     uint64
-	binder bind.Binder
-	node   *tailcfg.Node
-
-	compress string
-	channel  chan *Signal
-}
-
-func (c *Client) SignalUpdate(s *Signal) {
-	c.channel <- s
-}

internal/cmd/acl.go

@@ -1,66 +1,30 @@
 package cmd
 
 import (
-	"context"
-	"encoding/json"
+	"bytes"
 	"fmt"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"github.com/muesli/coral"
-	"gopkg.in/yaml.v2"
-	"io/ioutil"
+	"github.com/bufbuild/connect-go"
+	"github.com/jsiebens/go-edit/editor"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"github.com/spf13/cobra"
+	"github.com/tailscale/hujson"
+	"os"
 )
 
-func getACLConfig() *coral.Command {
-	command := &coral.Command{
-		Use:          "get-acl",
+func getACLConfigCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "get-acl-policy",
 		Short:        "Get the ACL policy",
 		SilenceUsage: true,
-	}
+	})
 
-	var asJson bool
-	var tailnetID uint64
-	var tailnetName string
-	var target = Target{}
-
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-	command.Flags().BoolVar(&asJson, "json", false, "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		resp, err := tc.Client().GetACLPolicy(cmd.Context(), connect.NewRequest(&api.GetACLPolicyRequest{TailnetId: tc.TailnetID()}))
 		if err != nil {
 			return err
 		}
 
-		resp, err := client.GetACLPolicy(context.Background(), &api.GetACLPolicyRequest{TailnetId: tailnet.Id})
-		if err != nil {
-			return err
-		}
-
-		if asJson {
-			marshal, err := json.MarshalIndent(resp.Policy, "", "  ")
-			if err != nil {
-				return err
-			}
-
-			fmt.Println()
-			fmt.Println(string(marshal))
-		} else {
-			marshal, err := yaml.Marshal(resp.Policy)
-			if err != nil {
-				return err
-			}
-
-			fmt.Println()
-			fmt.Println(string(marshal))
-		}
+		fmt.Println(resp.Msg.Policy)
 
 		return nil
 	}
@@ -68,52 +32,68 @@ func getACLConfig() *coral.Command {
 	return command
 }
 
-func setACLConfig() *coral.Command {
-	command := &coral.Command{
-		Use:          "set-acl",
-		Short:        "Set ACL policy",
+func editACLConfigCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "edit-acl-policy",
+		Short:        "Edit the ACL policy",
 		SilenceUsage: true,
-	}
+	})
 
-	var tailnetID uint64
-	var tailnetName string
-	var file string
-	var target = Target{}
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		edit := editor.NewDefaultEditor([]string{"IONSCALE_EDITOR", "EDITOR"})
 
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-	command.Flags().StringVar(&file, "file", "", "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-		rawJson, err := ioutil.ReadFile(file)
+		resp, err := tc.Client().GetACLPolicy(cmd.Context(), connect.NewRequest(&api.GetACLPolicyRequest{TailnetId: tc.TailnetID()}))
 		if err != nil {
 			return err
 		}
 
-		var policy api.Policy
-
-		if err := json.Unmarshal(rawJson, &policy); err != nil {
-			return err
-		}
-
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		next, s, err := edit.LaunchTempFile("ionscale", ".json", bytes.NewReader([]byte(resp.Msg.Policy)))
 		if err != nil {
 			return err
 		}
 
-		_, err = client.SetACLPolicy(context.Background(), &api.SetACLPolicyRequest{TailnetId: tailnet.Id, Policy: &policy})
+		defer os.Remove(s)
+
+		next, err = hujson.Standardize(next)
+		if err != nil {
+			return err
+		}
+
+		_, err = tc.Client().SetACLPolicy(cmd.Context(), connect.NewRequest(&api.SetACLPolicyRequest{TailnetId: tc.TailnetID(), Policy: string(next)}))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println("ACL policy updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
+func setACLConfigCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "set-acl-policy",
+		Short:        "Set ACL policy",
+		SilenceUsage: true,
+	})
+
+	var file string
+
+	command.Flags().StringVar(&file, "file", "", "Path to json file with the acl configuration")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		content, err := os.ReadFile(file)
+		if err != nil {
+			return err
+		}
+
+		_, err = tc.Client().SetACLPolicy(cmd.Context(), connect.NewRequest(&api.SetACLPolicyRequest{TailnetId: tc.TailnetID(), Policy: string(content)}))
 		if err != nil {
 			return err
 		}
 
-		fmt.Println()
 		fmt.Println("ACL policy updated successfully")
 
 		return nil

internal/cmd/auth.go

@@ -0,0 +1,75 @@
+package cmd
+
+import (
+	"fmt"
+	"github.com/bufbuild/connect-go"
+	"github.com/jsiebens/ionscale/pkg/client/ionscale"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"github.com/spf13/cobra"
+)
+
+func authCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use: "auth",
+	}
+
+	command.AddCommand(authLoginCommand())
+
+	return command
+}
+
+func authLoginCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "login",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := &api.AuthenticateRequest{}
+		stream, err := tc.Client().Authenticate(cmd.Context(), connect.NewRequest(req))
+		if err != nil {
+			return err
+		}
+
+		var started = false
+		for stream.Receive() {
+			resp := stream.Msg()
+			if len(resp.Token) != 0 {
+				fmt.Println()
+				fmt.Println("Success.")
+
+				tailnetId := uint64(0)
+				if resp.TailnetId != nil {
+					tailnetId = *resp.TailnetId
+				}
+
+				if err := ionscale.StoreAuthToken(tc.Addr(), resp.Token, tailnetId); err != nil {
+					fmt.Println()
+					fmt.Println("Your api token:")
+					fmt.Println()
+					fmt.Printf("  %s\n", resp.Token)
+					fmt.Println()
+				}
+				return nil
+			}
+
+			if len(resp.AuthUrl) != 0 && !started {
+				started = true
+
+				fmt.Println()
+				fmt.Println("To authenticate, visit:")
+				fmt.Println()
+				fmt.Printf("  %s\n", resp.AuthUrl)
+				fmt.Println()
+			}
+		}
+
+		if err := stream.Err(); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}

internal/cmd/auth_key.go

@@ -1,20 +1,22 @@
 package cmd
 
 import (
-	"context"
 	"fmt"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"github.com/muesli/coral"
+	"github.com/bufbuild/connect-go"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
 	str2dur "github.com/xhit/go-str2duration/v2"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"strings"
 	"time"
 )
 
-func authkeysCommand() *coral.Command {
-	command := &coral.Command{
-		Use: "auth-keys",
+func authkeysCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:     "auth-keys",
+		Aliases: []string{"auth-key"},
+		Short:   "Manage ionscale auth keys",
 	}
 
 	command.AddCommand(createAuthkeysCommand())
@@ -24,38 +26,24 @@ func authkeysCommand() *coral.Command {
 	return command
 }
 
-func createAuthkeysCommand() *coral.Command {
-	command := &coral.Command{
+func createAuthkeysCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
 		Use:          "create",
+		Short:        "Creates a new auth key in the specified tailnet",
 		SilenceUsage: true,
-	}
+	})
 
-	var tailnetID uint64
-	var tailnetName string
 	var ephemeral bool
+	var preAuthorized bool
 	var tags []string
 	var expiry string
-	var target = Target{}
 
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-	command.Flags().BoolVar(&ephemeral, "ephemeral", false, "")
-	command.Flags().StringSliceVar(&tags, "tag", []string{}, "")
-	command.Flags().StringVar(&expiry, "expiry", "180d", "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
+	command.Flags().BoolVar(&ephemeral, "ephemeral", false, "When enabled, machines authenticated by this key will be automatically removed after going offline.")
+	command.Flags().StringSliceVar(&tags, "tag", []string{}, "Machines authenticated by this key will be automatically tagged with these tags")
+	command.Flags().StringVar(&expiry, "expiry", "180d", "Human-readable expiration of the key")
+	command.Flags().BoolVar(&preAuthorized, "pre-authorized", false, "Generate an auth key which is pre-authorized.")
 
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		var expiryDur *durationpb.Duration
 
 		if expiry != "" && expiry != "none" {
@@ -67,12 +55,13 @@ func createAuthkeysCommand() *coral.Command {
 		}
 
 		req := &api.CreateAuthKeyRequest{
-			TailnetId: tailnet.Id,
-			Ephemeral: ephemeral,
-			Tags:      tags,
-			Expiry:    expiryDur,
+			TailnetId:     tc.TailnetID(),
+			Ephemeral:     ephemeral,
+			PreAuthorized: preAuthorized,
+			Tags:          tags,
+			Expiry:        expiryDur,
 		}
-		resp, err := client.CreateAuthKey(context.Background(), req)
+		resp, err := tc.Client().CreateAuthKey(cmd.Context(), connect.NewRequest(req))
 
 		if err != nil {
 			return err
@@ -82,7 +71,7 @@ func createAuthkeysCommand() *coral.Command {
 		fmt.Println("Generated new auth key")
 		fmt.Println("Be sure to copy your new key below. It won't be shown in full again.")
 		fmt.Println("")
-		fmt.Printf("  %s\n", resp.Value)
+		fmt.Printf("  %s\n", resp.Msg.Value)
 		fmt.Println("")
 
 		return nil
@@ -91,26 +80,20 @@ func createAuthkeysCommand() *coral.Command {
 	return command
 }
 
-func deleteAuthKeyCommand() *coral.Command {
-	command := &coral.Command{
+func deleteAuthKeyCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
 		Use:          "delete",
+		Short:        "Delete a specified auth key",
 		SilenceUsage: true,
-	}
+	})
 
 	var authKeyId uint64
-	var target = Target{}
-	target.prepareCommand(command)
-	command.Flags().Uint64Var(&authKeyId, "id", 0, "")
 
-	command.RunE = func(command *coral.Command, args []string) error {
-		grpcClient, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
+	command.Flags().Uint64Var(&authKeyId, "id", 0, "Auth Key ID")
 
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		req := api.DeleteAuthKeyRequest{AuthKeyId: authKeyId}
-		if _, err := grpcClient.DeleteAuthKey(context.Background(), &req); err != nil {
+		if _, err := tc.Client().DeleteAuthKey(cmd.Context(), connect.NewRequest(&req)); err != nil {
 			return err
 		}
 
@@ -122,40 +105,22 @@ func deleteAuthKeyCommand() *coral.Command {
 	return command
 }
 
-func listAuthkeysCommand() *coral.Command {
-	command := &coral.Command{
+func listAuthkeysCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
 		Use:          "list",
+		Short:        "List all auth keys for a given tailnet",
 		SilenceUsage: true,
-	}
+	})
 
-	var tailnetID uint64
-	var tailnetName string
-	var target = Target{}
-
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
-
-		req := &api.ListAuthKeysRequest{TailnetId: tailnet.Id}
-		resp, err := client.ListAuthKeys(context.Background(), req)
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := &api.ListAuthKeysRequest{TailnetId: tc.TailnetID()}
+		resp, err := tc.Client().ListAuthKeys(cmd.Context(), connect.NewRequest(req))
 
 		if err != nil {
 			return err
 		}
 
-		printAuthKeyTable(resp.AuthKeys...)
+		printAuthKeyTable(resp.Msg.AuthKeys...)
 
 		return nil
 	}

internal/cmd/configure.go

@@ -0,0 +1,90 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/key"
+	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v2"
+	"path/filepath"
+)
+
+func configureCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "configure",
+		Short:        "Generate a simple config file to get started.",
+		SilenceUsage: true,
+	}
+
+	var domain string
+	var acme bool
+	var email string
+	var dataDir string
+	var certFile string
+	var keyFile string
+
+	command.Flags().StringVar(&domain, "domain", "", "Public domain name of your ionscale instance.")
+	command.Flags().StringVar(&dataDir, "data-dir", "/var/lib/ionscale", "")
+	command.Flags().BoolVar(&acme, "acme", false, "Get automatic certificate from Letsencrypt.org using ACME.")
+	command.Flags().StringVar(&email, "acme-email", "", "Email to receive updates from Letsencrypt.org.")
+	command.Flags().StringVar(&certFile, "cert-file", "", "Path to a TLS certificate file.")
+	command.Flags().StringVar(&keyFile, "key-file", "", "Path to a TLS key file.")
+
+	command.MarkFlagRequired("domain")
+
+	command.PreRunE = func(cmd *cobra.Command, args []string) error {
+		if domain == "" {
+			return errors.New("required flag 'domain' is missing")
+		}
+
+		if acme && email == "" {
+			return errors.New("flag 'acme-email' is required when acme is enabled")
+		}
+
+		if !acme && (certFile == "" || keyFile == "") {
+			return errors.New("flags 'cert-file' and 'key-file' are required when acme is disabled")
+		}
+
+		return nil
+	}
+
+	command.RunE = func(command *cobra.Command, args []string) error {
+		c := &config.Config{}
+
+		c.ListenAddr = "0.0.0.0:443"
+		c.MetricsListenAddr = "127.0.0.1:9090"
+		c.PublicAddr = fmt.Sprintf("%s:443", domain)
+
+		c.Keys = config.Keys{
+			ControlKey:       key.NewServerKey().String(),
+			LegacyControlKey: key.NewServerKey().String(),
+			SystemAdminKey:   key.NewServerKey().String(),
+		}
+
+		c.Tls = config.Tls{}
+		if acme {
+			c.Tls.AcmeEnabled = true
+			c.Tls.AcmeEmail = email
+		} else {
+			c.Tls.CertFile = certFile
+			c.Tls.KeyFile = keyFile
+		}
+
+		c.Database = config.Database{
+			Type: "sqlite",
+			Url:  filepath.Join(dataDir, "ionscale.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(ON)"),
+		}
+
+		configAsYaml, err := yaml.Marshal(c)
+		if err != nil {
+			return err
+		}
+
+		fmt.Println(string(configAsYaml))
+
+		return nil
+	}
+
+	return command
+}

internal/cmd/derp_map.go

@@ -0,0 +1,70 @@
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/bufbuild/connect-go"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v2"
+	"tailscale.com/tailcfg"
+)
+
+func systemCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:   "system",
+		Short: "Manage global system configurations",
+	}
+
+	command.AddCommand(getDefaultDERPMap())
+
+	return command
+}
+
+func getDefaultDERPMap() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "get-derp-map",
+		Short:        "Get the default DERP Map configuration",
+		SilenceUsage: true,
+	})
+
+	var asJson bool
+
+	command.Flags().BoolVar(&asJson, "json", false, "When enabled, render output as json otherwise yaml")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		resp, err := tc.Client().GetDefaultDERPMap(cmd.Context(), connect.NewRequest(&api.GetDefaultDERPMapRequest{}))
+
+		if err != nil {
+			return err
+		}
+
+		var derpMap struct {
+			Regions map[int]*tailcfg.DERPRegion
+		}
+
+		if err := json.Unmarshal(resp.Msg.Value, &derpMap); err != nil {
+			return err
+		}
+
+		if asJson {
+			marshal, err := json.MarshalIndent(derpMap, "", "  ")
+			if err != nil {
+				return err
+			}
+
+			fmt.Println(string(marshal))
+		} else {
+			marshal, err := yaml.Marshal(derpMap)
+			if err != nil {
+				return err
+			}
+
+			fmt.Println(string(marshal))
+		}
+
+		return nil
+	}
+
+	return command
+}

internal/cmd/dns.go

@@ -1,59 +1,32 @@
 package cmd
 
 import (
-	"context"
 	"fmt"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"github.com/muesli/coral"
+	"github.com/bufbuild/connect-go"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"github.com/spf13/cobra"
+	"os"
 	"strings"
+	"text/tabwriter"
 )
 
-func getDNSConfig() *coral.Command {
-	command := &coral.Command{
+func getDNSConfigCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
 		Use:          "get-dns",
 		Short:        "Get DNS configuration",
 		SilenceUsage: true,
-	}
+	})
 
-	var tailnetID uint64
-	var tailnetName string
-	var target = Target{}
-
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
-
-		req := api.GetDNSConfigRequest{TailnetId: tailnet.Id}
-		resp, err := client.GetDNSConfig(context.Background(), &req)
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.GetDNSConfigRequest{TailnetId: tc.TailnetID()}
+		resp, err := tc.Client().GetDNSConfig(cmd.Context(), connect.NewRequest(&req))
 
 		if err != nil {
 			return err
 		}
-		config := resp.Config
+		config := resp.Msg.Config
 
-		var allNameservers = config.Nameservers
-
-		for i, j := range config.Routes {
-			for _, n := range j.Routes {
-				allNameservers = append(allNameservers, fmt.Sprintf("%s:%s", i, n))
-			}
-		}
-
-		fmt.Printf("%-*v%v\n", 25, "Magic DNS Enabled:", config.MagicDns)
-		fmt.Printf("%-*v%v\n", 25, "Override Local DNS:", config.OverrideLocalDns)
-		fmt.Printf("%-*v%v\n", 25, "Nameservers:", strings.Join(allNameservers, ","))
+		printDnsConfig(config)
 
 		return nil
 	}
@@ -61,39 +34,26 @@ func getDNSConfig() *coral.Command {
 	return command
 }
 
-func setDNSConfig() *coral.Command {
-	command := &coral.Command{
+func setDNSConfigCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
 		Use:          "set-dns",
 		Short:        "Set DNS config",
 		SilenceUsage: true,
-	}
+	})
 
 	var nameservers []string
 	var magicDNS bool
+	var httpsCerts bool
 	var overrideLocalDNS bool
-	var tailnetID uint64
-	var tailnetName string
-	var target = Target{}
+	var searchDomains []string
 
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-	command.Flags().StringSliceVarP(&nameservers, "nameserver", "", []string{}, "")
-	command.Flags().BoolVarP(&magicDNS, "magic-dns", "", false, "")
-	command.Flags().BoolVarP(&overrideLocalDNS, "override-local-dns", "", false, "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
+	command.Flags().StringSliceVarP(&nameservers, "nameserver", "", []string{}, "Machines on your network will use these nameservers to resolve DNS queries.")
+	command.Flags().BoolVarP(&magicDNS, "magic-dns", "", false, "Enable MagicDNS for the specified Tailnet")
+	command.Flags().BoolVarP(&httpsCerts, "https-certs", "", false, "Enable HTTPS Certificates for the specified Tailnet")
+	command.Flags().BoolVarP(&overrideLocalDNS, "override-local-dns", "", false, "When enabled, connected clients ignore local DNS settings and always use the nameservers specified for this Tailnet")
+	command.Flags().StringSliceVarP(&searchDomains, "search-domain", "", []string{}, "Custom DNS search domains.")
 
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		var globalNameservers []string
 		var routes = make(map[string]*api.Routes)
 
@@ -112,36 +72,73 @@ func setDNSConfig() *coral.Command {
 		}
 
 		req := api.SetDNSConfigRequest{
-			TailnetId: tailnet.Id,
+			TailnetId: tc.TailnetID(),
 			Config: &api.DNSConfig{
 				MagicDns:         magicDNS,
 				OverrideLocalDns: overrideLocalDNS,
-				Nameservers:      nameservers,
+				Nameservers:      globalNameservers,
 				Routes:           routes,
+				HttpsCerts:       httpsCerts,
+				SearchDomains:    searchDomains,
 			},
 		}
-		resp, err := client.SetDNSConfig(context.Background(), &req)
+		resp, err := tc.Client().SetDNSConfig(cmd.Context(), connect.NewRequest(&req))
 
 		if err != nil {
 			return err
 		}
 
-		config := resp.Config
+		config := resp.Msg.Config
 
-		var allNameservers = config.Nameservers
-
-		for i, j := range config.Routes {
-			for _, n := range j.Routes {
-				allNameservers = append(allNameservers, fmt.Sprintf("%s:%s", i, n))
-			}
+		if resp.Msg.Message != "" {
+			fmt.Println(resp.Msg.Message)
+			fmt.Println()
 		}
 
-		fmt.Printf("%-*v%v\n", 25, "Magic DNS Enabled:", config.MagicDns)
-		fmt.Printf("%-*v%v\n", 25, "Override Local DNS:", config.OverrideLocalDns)
-		fmt.Printf("%-*v%v\n", 25, "Nameservers:", strings.Join(allNameservers, ","))
+		printDnsConfig(config)
 
 		return nil
 	}
 
 	return command
 }
+
+func printDnsConfig(config *api.DNSConfig) {
+	w := new(tabwriter.Writer)
+	w.Init(os.Stdout, 8, 8, 1, '\t', 0)
+	defer w.Flush()
+
+	fmt.Fprintf(w, "%s\t\t%v\n", "MagicDNS", config.MagicDns)
+	fmt.Fprintf(w, "%s\t\t%v\n", "HTTPS Certs", config.HttpsCerts)
+	fmt.Fprintf(w, "%s\t\t%v\n", "Override Local DNS", config.OverrideLocalDns)
+
+	if config.MagicDns {
+		fmt.Fprintf(w, "MagicDNS\t%s\t%s\n", config.MagicDnsSuffix, "100.100.100.100")
+	}
+
+	for k, r := range config.Routes {
+		for i, t := range r.Routes {
+			if i == 0 {
+				fmt.Fprintf(w, "SplitDNS\t%s\t%s\n", k, t)
+			} else {
+				fmt.Fprintf(w, "%s\t%s\n", "", t)
+			}
+		}
+	}
+
+	for i, t := range config.Nameservers {
+		if i == 0 {
+			fmt.Fprintf(w, "%s\t%s\t%s\n", "Global", "", t)
+		} else {
+			fmt.Fprintf(w, "%s\t%s\t%s\n", "", "", t)
+		}
+	}
+
+	for i, t := range config.SearchDomains {
+		if i == 0 {
+			fmt.Fprintf(w, "%s\t%s\t%s\n", "Search Domains", t, "")
+		} else {
+			fmt.Fprintf(w, "%s\t%s\t%s\n", "", t, "")
+		}
+	}
+}

internal/cmd/funcs.go

@@ -1,33 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"io"
-)
-
-func findTailnet(client api.IonscaleClient, tailnet string, tailnetID uint64) (*api.Tailnet, error) {
-	if tailnetID == 0 && tailnet == "" {
-		return nil, fmt.Errorf("requested tailnet not found or you are not authorized for this tailnet")
-	}
-
-	tailnets, err := client.ListTailnets(context.Background(), &api.ListTailnetRequest{})
-	if err != nil {
-		return nil, err
-	}
-
-	for _, t := range tailnets.Tailnet {
-		if t.Id == tailnetID || t.Name == tailnet {
-			return t, nil
-		}
-	}
-
-	return nil, fmt.Errorf("requested tailnet not found or you are not authorized for this tailnet")
-}
-
-func safeClose(c io.Closer) {
-	if c != nil {
-		_ = c.Close()
-	}
-}

internal/cmd/iam.go

@@ -0,0 +1,97 @@
+package cmd
+
+import (
+	"bytes"
+	"fmt"
+	"github.com/bufbuild/connect-go"
+	"github.com/jsiebens/go-edit/editor"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"github.com/spf13/cobra"
+	"os"
+)
+
+func getIAMPolicyCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "get-iam-policy",
+		Short:        "Get the IAM policy",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		resp, err := tc.Client().GetIAMPolicy(cmd.Context(), connect.NewRequest(&api.GetIAMPolicyRequest{TailnetId: tc.TailnetID()}))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println(resp.Msg.Policy)
+
+		return nil
+	}
+
+	return command
+}
+
+func editIAMPolicyCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "edit-iam-policy",
+		Short:        "Edit the IAM policy",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		edit := editor.NewDefaultEditor([]string{"IONSCALE_EDITOR", "EDITOR"})
+
+		resp, err := tc.Client().GetIAMPolicy(cmd.Context(), connect.NewRequest(&api.GetIAMPolicyRequest{TailnetId: tc.TailnetID()}))
+		if err != nil {
+			return err
+		}
+
+		next, s, err := edit.LaunchTempFile("ionscale", ".json", bytes.NewReader([]byte(resp.Msg.Policy)))
+		if err != nil {
+			return err
+		}
+
+		defer os.Remove(s)
+
+		_, err = tc.Client().SetIAMPolicy(cmd.Context(), connect.NewRequest(&api.SetIAMPolicyRequest{TailnetId: tc.TailnetID(), Policy: string(next)}))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println("IAM policy updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
+func setIAMPolicyCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "set-iam-policy",
+		Short:        "Set IAM policy",
+		SilenceUsage: true,
+	})
+
+	var file string
+
+	command.Flags().StringVar(&file, "file", "", "Path to json file with the acl configuration")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		content, err := os.ReadFile(file)
+		if err != nil {
+			return err
+		}
+
+		_, err = tc.Client().SetIAMPolicy(cmd.Context(), connect.NewRequest(&api.SetIAMPolicyRequest{TailnetId: tc.TailnetID(), Policy: string(content)}))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println("IAM policy updated successfully")
+
+		return nil
+	}
+
+	return command
+}

internal/cmd/key.go

@@ -0,0 +1,30 @@
+package cmd
+
+import (
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/key"
+	"github.com/spf13/cobra"
+)
+
+func keyCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "genkey",
+		SilenceUsage: true,
+	}
+
+	var disableNewLine bool
+
+	command.Flags().BoolVarP(&disableNewLine, "no-newline", "n", false, "do not output a trailing newline")
+
+	command.RunE = func(command *cobra.Command, args []string) error {
+		serverKey := key.NewServerKey()
+		if disableNewLine {
+			fmt.Print(serverKey.String())
+		} else {
+			fmt.Println(serverKey.String())
+		}
+		return nil
+	}
+
+	return command
+}

internal/cmd/machine.go

@@ -1,52 +1,163 @@
 package cmd
 
 import (
-	"context"
 	"fmt"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"github.com/muesli/coral"
+	"github.com/bufbuild/connect-go"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"github.com/nleeper/goment"
 	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
 	"inet.af/netaddr"
+	"os"
 	"strings"
+	"text/tabwriter"
 )
 
-func machineCommands() *coral.Command {
-	command := &coral.Command{
+func machineCommands() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "machines",
+		Aliases:      []string{"machine", "devices", "device"},
 		Short:        "Manage ionscale machines",
 		SilenceUsage: true,
 	}
 
+	command.AddCommand(getMachineCommand())
 	command.AddCommand(deleteMachineCommand())
+	command.AddCommand(expireMachineCommand())
 	command.AddCommand(listMachinesCommand())
 	command.AddCommand(getMachineRoutesCommand())
-	command.AddCommand(setMachineRoutesCommand())
+	command.AddCommand(enableMachineRoutesCommand())
+	command.AddCommand(disableMachineRoutesCommand())
+	command.AddCommand(enableMachineKeyExpiryCommand())
+	command.AddCommand(enableExitNodeCommand())
+	command.AddCommand(disableExitNodeCommand())
+	command.AddCommand(disableMachineKeyExpiryCommand())
+	command.AddCommand(authorizeMachineCommand())
+	command.AddCommand(setMachineNameCommand())
 
 	return command
 }
 
-func deleteMachineCommand() *coral.Command {
-	command := &coral.Command{
-		Use:          "delete",
-		Short:        "Deletes a machine",
+func getMachineCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "get",
+		Short:        "Retrieve detailed information for a machine",
 		SilenceUsage: true,
-	}
+	})
 
 	var machineID uint64
-	var target = Target{}
-	target.prepareCommand(command)
-	command.Flags().Uint64Var(&machineID, "machine-id", 0, "")
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID.")
 
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.GetMachineRequest{MachineId: machineID}
+		resp, err := tc.Client().GetMachine(cmd.Context(), connect.NewRequest(&req))
 		if err != nil {
 			return err
 		}
-		defer safeClose(c)
 
+		m := resp.Msg.Machine
+		var lastSeen = "N/A"
+		var expiresAt = "No expiry"
+
+		if m.LastSeen != nil && !m.LastSeen.AsTime().IsZero() {
+			if mom, err := goment.New(m.LastSeen.AsTime()); err == nil {
+				lastSeen = mom.FromNow()
+			}
+		}
+
+		if !m.KeyExpiryDisabled && m.ExpiresAt != nil && !m.ExpiresAt.AsTime().IsZero() {
+			if mom, err := goment.New(m.ExpiresAt.AsTime()); !m.ExpiresAt.AsTime().IsZero() && err == nil {
+				expiresAt = mom.FromNow()
+			}
+		}
+
+		// initialize tabwriter
+		w := new(tabwriter.Writer)
+
+		// minwidth, tabwidth, padding, padchar, flags
+		w.Init(os.Stdout, 8, 8, 0, '\t', 0)
+
+		defer w.Flush()
+
+		fmt.Fprintf(w, "%s\t%d\n", "ID", m.Id)
+		fmt.Fprintf(w, "%s\t%s\n", "Machine name", m.Name)
+		fmt.Fprintf(w, "%s\t%s\n", "Creator", m.User.Name)
+		fmt.Fprintf(w, "%s\t%s\n", "OS", m.Os)
+		fmt.Fprintf(w, "%s\t%s\n", "Tailscale version", m.ClientVersion)
+		fmt.Fprintf(w, "%s\t%s\n", "Tailscale IPv4", m.Ipv4)
+		fmt.Fprintf(w, "%s\t%s\n", "Tailscale IPv6", m.Ipv6)
+		fmt.Fprintf(w, "%s\t%s\n", "Last seen", lastSeen)
+		fmt.Fprintf(w, "%s\t%v\n", "Ephemeral", m.Ephemeral)
+		if !m.Authorized {
+			fmt.Fprintf(w, "%s\t%v\n", "Authorized", m.Authorized)
+		}
+		fmt.Fprintf(w, "%s\t%s\n", "Key expiry", expiresAt)
+
+		for i, t := range m.Tags {
+			if i == 0 {
+				fmt.Fprintf(w, "%s\t%s\n", "ACL tags", t)
+			} else {
+				fmt.Fprintf(w, "%s\t%s\n", "", t)
+			}
+		}
+
+		for i, e := range m.ClientConnectivity.Endpoints {
+			if i == 0 {
+				fmt.Fprintf(w, "%s\t%s\n", "Endpoints", e)
+			} else {
+				fmt.Fprintf(w, "%s\t%s\n", "", e)
+			}
+		}
+
+		for i, t := range m.AdvertisedRoutes {
+			if i == 0 {
+				fmt.Fprintf(w, "%s\t%s\n", "Advertised routes", t)
+			} else {
+				fmt.Fprintf(w, "%s\t%s\n", "", t)
+			}
+		}
+
+		for i, t := range m.EnabledRoutes {
+			if i == 0 {
+				fmt.Fprintf(w, "%s\t%s\n", "Enabled routes", t)
+			} else {
+				fmt.Fprintf(w, "%s\t%s\n", "", t)
+			}
+		}
+
+		if m.AdvertisedExitNode {
+			if m.EnabledExitNode {
+				fmt.Fprintf(w, "%s\t%s\n", "Exit node", "enabled")
+			} else {
+				fmt.Fprintf(w, "%s\t%s\n", "Exit node", "disabled")
+			}
+		} else {
+			fmt.Fprintf(w, "%s\t%s\n", "Exit node", "no")
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func deleteMachineCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "delete",
+		Short:        "Deletes a machine",
+		SilenceUsage: true,
+	})
+
+	var machineID uint64
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID.")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		req := api.DeleteMachineRequest{MachineId: machineID}
-		if _, err := client.DeleteMachine(context.Background(), &req); err != nil {
+		if _, err := tc.Client().DeleteMachine(cmd.Context(), connect.NewRequest(&req)); err != nil {
 			return err
 		}
 
@@ -58,42 +169,109 @@ func deleteMachineCommand() *coral.Command {
 	return command
 }
 
-func listMachinesCommand() *coral.Command {
-	command := &coral.Command{
+func setMachineNameCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "set-name",
+		Short:        "Set the name of a given machine",
+		SilenceUsage: true,
+	})
+
+	var machineID uint64
+	var useOSHostname bool
+	var name string
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID")
+	command.Flags().StringVar(&name, "name", "", "New name for the machine")
+	command.Flags().BoolVar(&useOSHostname, "use-os-hostname", false, "Auto-generate from the machine OS hostname")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		if !useOSHostname && name == "" {
+			return fmt.Errorf("name is required when not using os hostname")
+		}
+
+		req := api.SetMachineNameRequest{MachineId: machineID, Name: name, UseOsHostname: useOSHostname}
+		if _, err := tc.Client().SetMachineName(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		fmt.Println("Machine name set.")
+
+		return nil
+	}
+
+	return command
+}
+
+func expireMachineCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "expire",
+		Short:        "Expires a machine",
+		SilenceUsage: true,
+	})
+
+	var machineID uint64
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID.")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.ExpireMachineRequest{MachineId: machineID}
+		if _, err := tc.Client().ExpireMachine(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		fmt.Println("Machine key expired.")
+
+		return nil
+	}
+
+	return command
+}
+
+func authorizeMachineCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "authorize",
+		Short:        "Authorizes a machine",
+		SilenceUsage: true,
+	})
+
+	var machineID uint64
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID.")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.AuthorizeMachineRequest{MachineId: machineID}
+		if _, err := tc.Client().AuthorizeMachine(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		fmt.Println("Machine authorized.")
+
+		return nil
+	}
+
+	return command
+}
+
+func listMachinesCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
 		Use:          "list",
 		Short:        "List machines",
 		SilenceUsage: true,
-	}
+	})
 
-	var tailnetID uint64
-	var tailnetName string
-
-	var target = Target{}
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
-
-		req := api.ListMachinesRequest{TailnetId: tailnet.Id}
-		resp, err := client.ListMachines(context.Background(), &req)
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.ListMachinesRequest{TailnetId: tc.TailnetID()}
+		resp, err := tc.Client().ListMachines(cmd.Context(), connect.NewRequest(&req))
 
 		if err != nil {
 			return err
 		}
 
-		tbl := table.New("ID", "TAILNET", "NAME", "IPv4", "IPv6", "EPHEMERAL", "LAST_SEEN", "TAGS")
-		for _, m := range resp.Machines {
+		tbl := table.New("ID", "TAILNET", "NAME", "IPv4", "IPv6", "AUTHORIZED", "EPHEMERAL", "VERSION", "LAST_SEEN", "TAGS")
+		for _, m := range resp.Msg.Machines {
 			var lastSeen = "N/A"
 			if m.Connected {
 				lastSeen = "Connected"
@@ -103,7 +281,7 @@ func listMachinesCommand() *coral.Command {
 					lastSeen = mom.FromNow()
 				}
 			}
-			tbl.AddRow(m.Id, m.Tailnet.Name, m.Name, m.Ipv4, m.Ipv6, m.Ephemeral, lastSeen, strings.Join(m.Tags, ","))
+			tbl.AddRow(m.Id, m.Tailnet.Name, m.Name, m.Ipv4, m.Ipv6, m.Authorized, m.Ephemeral, m.ClientVersion, lastSeen, strings.Join(m.Tags, ","))
 		}
 		tbl.Print()
 
@@ -113,36 +291,26 @@ func listMachinesCommand() *coral.Command {
 	return command
 }
 
-func getMachineRoutesCommand() *coral.Command {
-	command := &coral.Command{
+func getMachineRoutesCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
 		Use:          "get-routes",
-		Short:        "Show the routes of a machine",
+		Short:        "Show routes advertised and enabled by a given machine",
 		SilenceUsage: true,
-	}
+	})
 
 	var machineID uint64
-	var target = Target{}
-	target.prepareCommand(command)
-	command.Flags().Uint64Var(&machineID, "machine-id", 0, "")
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID.")
 
-	command.RunE = func(command *coral.Command, args []string) error {
-		grpcClient, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
+	_ = command.MarkFlagRequired("machine-id")
 
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		req := api.GetMachineRoutesRequest{MachineId: machineID}
-		resp, err := grpcClient.GetMachineRoutes(context.Background(), &req)
+		resp, err := tc.Client().GetMachineRoutes(cmd.Context(), connect.NewRequest(&req))
 		if err != nil {
 			return err
 		}
 
-		tbl := table.New("ROUTE", "ALLOWED")
-		for _, r := range resp.Routes {
-			tbl.AddRow(r.Advertised, r.Allowed)
-		}
-		tbl.Print()
+		printMachinesRoutesResponse(resp.Msg.Routes)
 
 		return nil
 	}
@@ -150,50 +318,205 @@ func getMachineRoutesCommand() *coral.Command {
 	return command
 }
 
-func setMachineRoutesCommand() *coral.Command {
-	command := &coral.Command{
-		Use:          "set-routes",
-		Short:        "Enable routes of a machine",
+func enableMachineRoutesCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "enable-routes",
+		Short:        "Enable routes for a given machine",
 		SilenceUsage: true,
-	}
+	})
 
 	var machineID uint64
-	var allowedIps []string
-	var target = Target{}
-	target.prepareCommand(command)
-	command.Flags().Uint64Var(&machineID, "machine-id", 0, "")
-	command.Flags().StringSliceVar(&allowedIps, "allowed-ips", []string{}, "")
+	var routes []string
+	var replace bool
 
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID")
+	command.Flags().StringSliceVar(&routes, "routes", []string{}, "List of routes to enable")
+	command.Flags().BoolVar(&replace, "replace", false, "Replace current enabled routes with this new list")
 
-		var prefixes []netaddr.IPPrefix
-		for _, r := range allowedIps {
-			p, err := netaddr.ParseIPPrefix(r)
-			if err != nil {
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		for _, r := range routes {
+			if _, err := netaddr.ParseIPPrefix(r); err != nil {
 				return err
 			}
-			prefixes = append(prefixes, p)
 		}
 
-		req := api.SetMachineRoutesRequest{MachineId: machineID, AllowedIps: allowedIps}
-		resp, err := client.SetMachineRoutes(context.Background(), &req)
+		req := api.EnableMachineRoutesRequest{MachineId: machineID, Routes: routes, Replace: replace}
+		resp, err := tc.Client().EnableMachineRoutes(cmd.Context(), connect.NewRequest(&req))
 		if err != nil {
 			return err
 		}
 
-		tbl := table.New("ROUTE", "ALLOWED")
-		for _, r := range resp.Routes {
-			tbl.AddRow(r.Advertised, r.Allowed)
-		}
-		tbl.Print()
+		printMachinesRoutesResponse(resp.Msg.Routes)
 
 		return nil
 	}
 
 	return command
 }
+
+func disableMachineRoutesCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "disable-routes",
+		Short:        "Disable routes for a given machine",
+		SilenceUsage: true,
+	})
+
+	var machineID uint64
+	var routes []string
+
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID")
+	command.Flags().StringSliceVar(&routes, "routes", []string{}, "List of routes to enable")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		for _, r := range routes {
+			if _, err := netaddr.ParseIPPrefix(r); err != nil {
+				return err
+			}
+		}
+
+		req := api.DisableMachineRoutesRequest{MachineId: machineID, Routes: routes}
+		resp, err := tc.Client().DisableMachineRoutes(cmd.Context(), connect.NewRequest(&req))
+		if err != nil {
+			return err
+		}
+
+		printMachinesRoutesResponse(resp.Msg.Routes)
+
+		return nil
+	}
+
+	return command
+}
+
+func enableExitNodeCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "enable-exit-node",
+		Short:        "Enable given machine as an exit node",
+		SilenceUsage: true,
+	})
+
+	var machineID uint64
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.EnableExitNodeRequest{MachineId: machineID}
+		resp, err := tc.Client().EnableExitNode(cmd.Context(), connect.NewRequest(&req))
+		if err != nil {
+			return err
+		}
+
+		printMachinesRoutesResponse(resp.Msg.Routes)
+
+		return nil
+	}
+
+	return command
+}
+
+func disableExitNodeCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "disable-exit-node",
+		Short:        "Disable given machine as an exit node",
+		SilenceUsage: true,
+	})
+
+	var machineID uint64
+
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.DisableExitNodeRequest{MachineId: machineID}
+		resp, err := tc.Client().DisableExitNode(cmd.Context(), connect.NewRequest(&req))
+		if err != nil {
+			return err
+		}
+
+		printMachinesRoutesResponse(resp.Msg.Routes)
+
+		return nil
+	}
+
+	return command
+}
+
+func enableMachineKeyExpiryCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "enable-key-expiry",
+		Short:        "Enable machine key expiry",
+		SilenceUsage: true,
+	}
+
+	return configureSetMachineKeyExpiryCommand(command, false)
+}
+
+func disableMachineKeyExpiryCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "disable-key-expiry",
+		Short:        "Disable machine key expiry",
+		SilenceUsage: true,
+	}
+
+	return configureSetMachineKeyExpiryCommand(command, true)
+}
+
+func configureSetMachineKeyExpiryCommand(cmdTmpl *cobra.Command, disable bool) *cobra.Command {
+	command, tc := prepareCommand(false, cmdTmpl)
+
+	var machineID uint64
+
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.SetMachineKeyExpiryRequest{MachineId: machineID, Disabled: disable}
+		_, err := tc.Client().SetMachineKeyExpiry(cmd.Context(), connect.NewRequest(&req))
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func printMachinesRoutesResponse(msg *api.MachineRoutes) {
+	w := new(tabwriter.Writer)
+	w.Init(os.Stdout, 8, 8, 0, '\t', 0)
+	defer w.Flush()
+
+	for i, t := range msg.AdvertisedRoutes {
+		if i == 0 {
+			fmt.Fprintf(w, "%s\t%s\n", "Advertised routes", t)
+		} else {
+			fmt.Fprintf(w, "%s\t%s\n", "", t)
+		}
+	}
+
+	for i, t := range msg.EnabledRoutes {
+		if i == 0 {
+			fmt.Fprintf(w, "%s\t%s\n", "Enabled routes", t)
+		} else {
+			fmt.Fprintf(w, "%s\t%s\n", "", t)
+		}
+	}
+
+	if msg.AdvertisedExitNode {
+		if msg.EnabledExitNode {
+			fmt.Fprintf(w, "%s\t%s\n", "Exit node", "enabled")
+		} else {
+			fmt.Fprintf(w, "%s\t%s\n", "Exit node", "disabled")
+		}
+	} else {
+		fmt.Fprintf(w, "%s\t%s\n", "Exit node", "no")
+	}
+}

internal/cmd/recorder.go

@@ -0,0 +1,28 @@
+package cmd
+
+import (
+	"github.com/jsiebens/ionscale/pkg/ssh"
+	"github.com/spf13/cobra"
+)
+
+func recorderCommand() *cobra.Command {
+	t := ssh.RecorderConfig{}
+
+	command := &cobra.Command{
+		Use:          "recorder",
+		Short:        "Start an SSH Recorder",
+		SilenceUsage: true,
+	}
+
+	command.Flags().StringVar(&t.LoginServer, "login-server", "", "Base URL of control server")
+	command.Flags().StringVar(&t.StateDir, "statedir", "", "Directory where the recorder should store its internal state")
+	command.Flags().StringVar(&t.Dir, "dst", "", "Directory where recordings will be saved.")
+	command.Flags().StringVar(&t.AuthKey, "auth-key", "", "")
+	command.Flags().StringVar(&t.Hostname, "hostname", "recorder", "")
+
+	command.RunE = func(command *cobra.Command, args []string) error {
+		return ssh.Start(command.Context(), t)
+	}
+
+	return command
+}

internal/cmd/root.go

@@ -1,16 +1,22 @@
 package cmd
 
 import (
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )
 
-func Command() *coral.Command {
+func Command() *cobra.Command {
 	rootCmd := rootCommand()
+	rootCmd.AddCommand(configureCommand())
+	rootCmd.AddCommand(keyCommand())
+	rootCmd.AddCommand(authCommand())
 	rootCmd.AddCommand(serverCommand())
 	rootCmd.AddCommand(versionCommand())
 	rootCmd.AddCommand(tailnetCommand())
 	rootCmd.AddCommand(authkeysCommand())
 	rootCmd.AddCommand(machineCommands())
+	rootCmd.AddCommand(userCommands())
+	rootCmd.AddCommand(systemCommand())
+	rootCmd.AddCommand(recorderCommand())
 
 	return rootCmd
 }
@@ -19,8 +25,8 @@ func Execute() error {
 	return Command().Execute()
 }
 
-func rootCommand() *coral.Command {
-	return &coral.Command{
+func rootCommand() *cobra.Command {
+	return &cobra.Command{
 		Use: "ionscale",
 	}
 }

internal/cmd/server.go

@@ -3,11 +3,11 @@ package cmd
 import (
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/server"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )
 
-func serverCommand() *coral.Command {
-	command := &coral.Command{
+func serverCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "server",
 		Short:        "Start an ionscale server",
 		SilenceUsage: true,
@@ -15,16 +15,16 @@ func serverCommand() *coral.Command {
 
 	var configFile string
 
-	command.Flags().StringVarP(&configFile, "config", "c", "ionscale.yaml", "Path to the configuration file.")
+	command.Flags().StringVarP(&configFile, "config", "c", "", "Path to the configuration file.")
 
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 
 		c, err := config.LoadConfig(configFile)
 		if err != nil {
 			return err
 		}
 
-		return server.Start(c)
+		return server.Start(command.Context(), c)
 	}
 
 	return command

internal/cmd/tailnet.go

@@ -1,58 +1,70 @@
 package cmd
 
 import (
-	"context"
+	"encoding/json"
 	"fmt"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"github.com/muesli/coral"
+	"github.com/bufbuild/connect-go"
+	idomain "github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/pkg/client/ionscale"
+	"github.com/jsiebens/ionscale/pkg/defaults"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v3"
+	"os"
+	"strings"
+	"tailscale.com/tailcfg"
 )
 
-func tailnetCommand() *coral.Command {
-	command := &coral.Command{
-		Use:   "tailnets",
-		Short: "Manage ionscale tailnets",
-		Long:  "This command allows operations on ionscale tailnet resources.",
+func tailnetCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:     "tailnets",
+		Aliases: []string{"tailnet"},
+		Short:   "Manage ionscale tailnets",
 	}
 
 	command.AddCommand(listTailnetsCommand())
 	command.AddCommand(createTailnetsCommand())
 	command.AddCommand(deleteTailnetCommand())
-	command.AddCommand(getDNSConfig())
-	command.AddCommand(setDNSConfig())
-	command.AddCommand(getACLConfig())
-	command.AddCommand(setACLConfig())
+	command.AddCommand(getDNSConfigCommand())
+	command.AddCommand(setDNSConfigCommand())
+	command.AddCommand(getACLConfigCommand())
+	command.AddCommand(setACLConfigCommand())
+	command.AddCommand(editACLConfigCommand())
+	command.AddCommand(getIAMPolicyCommand())
+	command.AddCommand(setIAMPolicyCommand())
+	command.AddCommand(editIAMPolicyCommand())
+	command.AddCommand(enableServiceCollectionCommand())
+	command.AddCommand(disableServiceCollectionCommand())
+	command.AddCommand(enableFileSharingCommand())
+	command.AddCommand(disableFileSharingCommand())
+	command.AddCommand(enableSSHCommand())
+	command.AddCommand(disableSSHCommand())
+	command.AddCommand(enableMachineAuthorizationCommand())
+	command.AddCommand(disableMachineAuthorizationCommand())
+	command.AddCommand(getDERPMap())
+	command.AddCommand(setDERPMap())
+	command.AddCommand(resetDERPMap())
 
 	return command
 }
 
-func listTailnetsCommand() *coral.Command {
-	command := &coral.Command{
+func listTailnetsCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
 		Use:          "list",
-		Short:        "List tailnets",
-		Long:         `List tailnets in this ionscale instance.`,
+		Short:        "List available Tailnets",
 		SilenceUsage: true,
-	}
+	})
 
-	var target = Target{}
-	target.prepareCommand(command)
-
-	command.RunE = func(command *coral.Command, args []string) error {
-
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		resp, err := client.ListTailnets(context.Background(), &api.ListTailnetRequest{})
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		resp, err := tc.Client().ListTailnets(cmd.Context(), connect.NewRequest(&api.ListTailnetsRequest{}))
 
 		if err != nil {
 			return err
 		}
 
 		tbl := table.New("ID", "NAME")
-		for _, tailnet := range resp.Tailnet {
+		for _, tailnet := range resp.Msg.Tailnet {
 			tbl.AddRow(tailnet.Id, tailnet.Name)
 		}
 		tbl.Print()
@@ -63,36 +75,75 @@ func listTailnetsCommand() *coral.Command {
 	return command
 }
 
-func createTailnetsCommand() *coral.Command {
-	command := &coral.Command{
+func createTailnetsCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
 		Use:          "create",
-		Short:        "Create a new tailnet",
+		Short:        "Create a new Tailnet",
 		SilenceUsage: true,
-	}
+	})
 
 	var name string
-	var target = Target{}
-	target.prepareCommand(command)
+	var domain string
+	var email string
 
 	command.Flags().StringVarP(&name, "name", "n", "", "")
-	_ = command.MarkFlagRequired("name")
+	command.Flags().StringVar(&domain, "domain", "", "")
+	command.Flags().StringVar(&email, "email", "", "")
 
-	command.RunE = func(command *coral.Command, args []string) error {
-
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
+	command.PreRunE = func(cmd *cobra.Command, args []string) error {
+		if name == "" {
+			return fmt.Errorf("flag --name is required")
 		}
-		defer safeClose(c)
+		if domain != "" && email != "" {
+			return fmt.Errorf("flags --email and --domain are mutually exclusive")
+		}
+		return nil
+	}
 
-		resp, err := client.CreateTailnet(context.Background(), &api.CreateTailnetRequest{Name: name})
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+
+		dnsConfig := defaults.DefaultDNSConfig()
+		aclPolicy := defaults.DefaultACLPolicy().Marshal()
+		iamPolicy := "{}"
+
+		if len(domain) != 0 {
+			domainToLower := strings.ToLower(domain)
+			m, err := json.MarshalIndent(&ionscale.IAMPolicy{
+				Filters: []string{fmt.Sprintf("domain == %s", domainToLower)},
+			}, "", "  ")
+			if err != nil {
+				return err
+			}
+			iamPolicy = string(m)
+		}
+
+		if len(email) != 0 {
+			emailToLower := strings.ToLower(email)
+			m, err := json.MarshalIndent(&ionscale.IAMPolicy{
+				Emails: []string{emailToLower},
+				Roles: map[string]string{
+					emailToLower: string(idomain.UserRoleAdmin),
+				},
+			}, "", "  ")
+			if err != nil {
+				return err
+			}
+			iamPolicy = string(m)
+		}
+
+		resp, err := tc.Client().CreateTailnet(cmd.Context(), connect.NewRequest(&api.CreateTailnetRequest{
+			Name:      name,
+			IamPolicy: iamPolicy,
+			AclPolicy: aclPolicy,
+			DnsConfig: dnsConfig,
+		}))
 
 		if err != nil {
 			return err
 		}
 
 		tbl := table.New("ID", "NAME")
-		tbl.AddRow(resp.Tailnet.Id, resp.Tailnet.Name)
+		tbl.AddRow(resp.Msg.Tailnet.Id, resp.Msg.Tailnet.Name)
 		tbl.Print()
 
 		return nil
@@ -101,38 +152,19 @@ func createTailnetsCommand() *coral.Command {
 	return command
 }
 
-func deleteTailnetCommand() *coral.Command {
-	command := &coral.Command{
+func deleteTailnetCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
 		Use:          "delete",
 		Short:        "Delete a tailnet",
 		SilenceUsage: true,
-	}
+	})
 
-	var tailnetID uint64
-	var tailnetName string
 	var force bool
-	var target = Target{}
-	target.prepareCommand(command)
 
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
-	command.Flags().BoolVar(&force, "force", false, "")
-
-	command.RunE = func(command *coral.Command, args []string) error {
-
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-		defer safeClose(c)
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
-
-		_, err = client.DeleteTailnet(context.Background(), &api.DeleteTailnetRequest{TailnetId: tailnet.Id, Force: force})
+	command.Flags().BoolVar(&force, "force", false, "When enabled, force delete the specified Tailnet even when machines are still available.")
 
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		_, err := tc.Client().DeleteTailnet(cmd.Context(), connect.NewRequest(&api.DeleteTailnetRequest{TailnetId: tc.TailnetID(), Force: force}))
 		if err != nil {
 			return err
 		}
@@ -144,3 +176,284 @@ func deleteTailnetCommand() *coral.Command {
 
 	return command
 }
+
+func getDERPMap() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "get-derp-map",
+		Short:        "Get the DERP Map configuration",
+		SilenceUsage: true,
+	})
+
+	var asJson bool
+
+	command.Flags().BoolVar(&asJson, "json", false, "When enabled, render output as json otherwise yaml")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		resp, err := tc.Client().GetDERPMap(cmd.Context(), connect.NewRequest(&api.GetDERPMapRequest{TailnetId: tc.TailnetID()}))
+
+		if err != nil {
+			return err
+		}
+
+		var derpMap struct {
+			Regions map[int]*tailcfg.DERPRegion
+		}
+
+		if err := json.Unmarshal(resp.Msg.Value, &derpMap); err != nil {
+			return err
+		}
+
+		if asJson {
+			marshal, err := json.MarshalIndent(derpMap, "", "  ")
+			if err != nil {
+				return err
+			}
+
+			fmt.Println(string(marshal))
+		} else {
+			marshal, err := yaml.Marshal(derpMap)
+			if err != nil {
+				return err
+			}
+
+			fmt.Println(string(marshal))
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func setDERPMap() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "set-derp-map",
+		Short:        "Set the DERP Map configuration",
+		SilenceUsage: true,
+	})
+
+	var file string
+
+	command.Flags().StringVar(&file, "file", "", "Path to json file with the DERP Map configuration")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		rawJson, err := os.ReadFile(file)
+		if err != nil {
+			return err
+		}
+
+		resp, err := tc.Client().SetDERPMap(cmd.Context(), connect.NewRequest(&api.SetDERPMapRequest{TailnetId: tc.TailnetID(), Value: rawJson}))
+		if err != nil {
+			return err
+		}
+
+		var derpMap tailcfg.DERPMap
+		if err := json.Unmarshal(resp.Msg.Value, &derpMap); err != nil {
+			return err
+		}
+
+		fmt.Println("DERP Map updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
+func resetDERPMap() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "reset-derp-map",
+		Short:        "Reset the DERP Map to the default configuration",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		if _, err := tc.Client().ResetDERPMap(cmd.Context(), connect.NewRequest(&api.ResetDERPMapRequest{TailnetId: tc.TailnetID()})); err != nil {
+			return err
+		}
+
+		fmt.Println("DERP Map updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
+func enableFileSharingCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "enable-file-sharing",
+		Aliases:      []string{"enable-taildrop"},
+		Short:        "Enable Taildrop, the file sharing feature",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.EnableFileSharingRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().EnableFileSharing(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableFileSharingCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "disable-file-sharing",
+		Aliases:      []string{"disable-taildrop"},
+		Short:        "Disable Taildrop, the file sharing feature",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.DisableFileSharingRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().DisableFileSharing(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func enableServiceCollectionCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "enable-service-collection",
+		Short:        "Enable monitoring live services running on your network’s machines.",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.EnableServiceCollectionRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().EnableServiceCollection(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableServiceCollectionCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "disable-service-collection",
+		Short:        "Disable monitoring live services running on your network’s machines.",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.DisableServiceCollectionRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().DisableServiceCollection(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func enableSSHCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "enable-ssh",
+		Short:        "Enable ssh access using tailnet and ACLs.",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.EnableSSHRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().EnableSSH(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableSSHCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "disable-ssh",
+		Short:        "Disable ssh access using tailnet and ACLs.",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.DisableSSHRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().DisableSSH(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func enableMachineAuthorizationCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "enable-machine-authorization",
+		Short:        "Enable machine authorization.",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.EnableMachineAuthorizationRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().EnableMachineAuthorization(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableMachineAuthorizationCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "disable-machine-authorization",
+		Short:        "Disable machine authorization.",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.DisableMachineAuthorizationRequest{
+			TailnetId: tc.TailnetID(),
+		}
+
+		if _, err := tc.Client().DisableMachineAuthorization(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}

internal/cmd/target.go

@@ -1,72 +1,135 @@
 package cmd
 
 import (
+	"fmt"
+	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/pkg/client/ionscale"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"github.com/muesli/coral"
-	"io"
+	ionscalev1 "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1/ionscalev1connect"
+	"github.com/spf13/cobra"
 )
 
 const (
-	ionscaleSystemAdminKey     = "IONSCALE_ADMIN_KEY"
+	ionscaleSystemAdminKey     = "IONSCALE_SYSTEM_ADMIN_KEY"
+	ionscaleKeysSystemAdminKey = "IONSCALE_KEYS_SYSTEM_ADMIN_KEY"
 	ionscaleAddr               = "IONSCALE_ADDR"
 	ionscaleInsecureSkipVerify = "IONSCALE_SKIP_VERIFY"
-	ionscaleUseGrpcWeb         = "IONSCALE_GRPC_WEB"
 )
 
-type Target struct {
+type TargetContext interface {
+	Client() api.IonscaleServiceClient
+	Addr() string
+	TailnetID() uint64
+}
+
+type target struct {
 	addr               string
-	useGrpcWeb         bool
 	insecureSkipVerify bool
 	systemAdminKey     string
+
+	tailnetID   uint64
+	tailnetName string
+
+	client  api.IonscaleServiceClient
+	tailnet *ionscalev1.Tailnet
 }
 
-func (t *Target) prepareCommand(cmd *coral.Command) {
+func prepareCommand(enableTailnetSelector bool, cmd *cobra.Command) (*cobra.Command, TargetContext) {
+	t := &target{}
+
 	cmd.Flags().StringVar(&t.addr, "addr", "", "Addr of the ionscale server, as a complete URL")
 	cmd.Flags().BoolVar(&t.insecureSkipVerify, "tls-skip-verify", false, "Disable verification of TLS certificates")
-	cmd.Flags().BoolVar(&t.useGrpcWeb, "grpc-web", false, "Enables gRPC-web protocol. Useful if ionscale server is behind proxy which does not support GRPC")
-	cmd.Flags().StringVar(&t.systemAdminKey, "admin-key", "", "If specified, the given value will be used as the key to generate a Bearer token for the call. This can also be specified via the IONSCALE_ADMIN_KEY environment variable.")
-}
+	cmd.Flags().StringVar(&t.systemAdminKey, "system-admin-key", "", "If specified, the given value will be used as the key to generate a Bearer token for the call. This can also be specified via the IONSCALE_ADMIN_KEY environment variable.")
 
-func (t *Target) createGRPCClient() (api.IonscaleClient, io.Closer, error) {
-	addr := t.getAddr()
-	useGrpcWeb := t.getUseGrpcWeb()
-	skipVerify := t.getInsecureSkipVerify()
-	systemAdminKey := t.getSystemAdminKey()
-
-	auth, err := ionscale.LoadClientAuth(systemAdminKey)
-	if err != nil {
-		return nil, nil, err
+	if enableTailnetSelector {
+		cmd.Flags().StringVar(&t.tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+		cmd.Flags().Uint64Var(&t.tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
 	}
 
-	return ionscale.NewClient(auth, addr, skipVerify, useGrpcWeb)
+	cmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
+		addr := t.getAddr()
+		skipVerify := t.getInsecureSkipVerify()
+		systemAdminKey := t.getSystemAdminKey()
+
+		auth, err := ionscale.LoadClientAuth(addr, systemAdminKey)
+		if err != nil {
+			return err
+		}
+
+		client, err := ionscale.NewClient(auth, addr, skipVerify)
+		if err != nil {
+			return err
+		}
+
+		t.client = client
+
+		if enableTailnetSelector {
+			savedTailnetID := auth.TailnetID()
+
+			if savedTailnetID == 0 && !cmd.Flags().Changed("tailnet") && !cmd.Flags().Changed("tailnet-id") {
+				return fmt.Errorf("flag --tailnet or --tailnet-id is required")
+			}
+
+			if cmd.Flags().Changed("tailnet") && cmd.Flags().Changed("tailnet-id") {
+				return fmt.Errorf("flags --tailnet and --tailnet-id are mutually exclusive")
+			}
+
+			tailnets, err := t.client.ListTailnets(cmd.Context(), connect.NewRequest(&ionscalev1.ListTailnetsRequest{}))
+			if err != nil {
+				return err
+			}
+
+			for _, tailnet := range tailnets.Msg.Tailnet {
+				if tailnet.Id == savedTailnetID || tailnet.Id == t.tailnetID || tailnet.Name == t.tailnetName {
+					t.tailnet = tailnet
+					break
+				}
+			}
+
+			if t.tailnet == nil {
+				return fmt.Errorf("requested tailnet not found or you are not authorized for this tailnet")
+			}
+		}
+
+		return nil
+	}
+
+	return cmd, t
 }
 
-func (t *Target) getAddr() string {
+func (t *target) getAddr() string {
 	if len(t.addr) != 0 {
 		return t.addr
 	}
-	return config.GetString(ionscaleAddr, "https://localhost:8000")
+	return config.GetString(ionscaleAddr, "https://localhost:8443")
 }
 
-func (t *Target) getInsecureSkipVerify() bool {
+func (t *target) getInsecureSkipVerify() bool {
 	if t.insecureSkipVerify {
 		return true
 	}
 	return config.GetBool(ionscaleInsecureSkipVerify, false)
 }
 
-func (t *Target) getUseGrpcWeb() bool {
-	if t.useGrpcWeb {
-		return true
-	}
-	return config.GetBool(ionscaleUseGrpcWeb, false)
-}
-
-func (t *Target) getSystemAdminKey() string {
+func (t *target) getSystemAdminKey() string {
 	if len(t.systemAdminKey) != 0 {
 		return t.systemAdminKey
 	}
-	return config.GetString(ionscaleSystemAdminKey, "")
+	return config.GetString(ionscaleSystemAdminKey, config.GetString(ionscaleKeysSystemAdminKey, ""))
+}
+
+func (t *target) Addr() string {
+	return t.getAddr()
+}
+
+func (t *target) Client() api.IonscaleServiceClient {
+	return t.client
+}
+
+func (t *target) TailnetID() uint64 {
+	if t.tailnet == nil {
+		return 0
+	}
+	return t.tailnet.Id
 }

internal/cmd/users.go

@@ -0,0 +1,77 @@
+package cmd
+
+import (
+	"fmt"
+	"github.com/bufbuild/connect-go"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
+)
+
+func userCommands() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "users",
+		Aliases:      []string{"user"},
+		Short:        "Manage ionscale users",
+		SilenceUsage: true,
+	}
+
+	command.AddCommand(listUsersCommand())
+	command.AddCommand(deleteUserCommand())
+
+	return command
+}
+
+func listUsersCommand() *cobra.Command {
+	command, tc := prepareCommand(true, &cobra.Command{
+		Use:          "list",
+		Short:        "List users",
+		SilenceUsage: true,
+	})
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.ListUsersRequest{TailnetId: tc.TailnetID()}
+		resp, err := tc.Client().ListUsers(cmd.Context(), connect.NewRequest(&req))
+
+		if err != nil {
+			return err
+		}
+
+		tbl := table.New("ID", "USER", "ROLE")
+		for _, m := range resp.Msg.Users {
+			tbl.AddRow(m.Id, m.Name, m.Role)
+		}
+		tbl.Print()
+
+		return nil
+	}
+
+	return command
+}
+
+func deleteUserCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
+		Use:          "delete",
+		Short:        "Deletes a user",
+		SilenceUsage: true,
+	})
+
+	var userID uint64
+
+	command.Flags().Uint64Var(&userID, "user-id", 0, "User ID.")
+
+	_ = command.MarkFlagRequired("user-id")
+
+	command.RunE = func(cmd *cobra.Command, args []string) error {
+		req := api.DeleteUserRequest{UserId: userID}
+		if _, err := tc.Client().DeleteUser(cmd.Context(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		fmt.Println("User deleted.")
+
+		return nil
+	}
+
+	return command
+}

internal/cmd/version.go

@@ -1,24 +1,21 @@
 package cmd
 
 import (
-	"context"
 	"fmt"
+	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/version"
-	"github.com/jsiebens/ionscale/pkg/gen/api"
-	"github.com/muesli/coral"
+	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"github.com/spf13/cobra"
 )
 
-func versionCommand() *coral.Command {
-	var command = &coral.Command{
+func versionCommand() *cobra.Command {
+	command, tc := prepareCommand(false, &cobra.Command{
 		Use:          "version",
 		Short:        "Display version information",
 		SilenceUsage: true,
-	}
+	})
 
-	var target = Target{}
-	target.prepareCommand(command)
-
-	command.Run = func(cmd *coral.Command, args []string) {
+	command.Run = func(cmd *cobra.Command, args []string) {
 		clientVersion, clientRevision := version.GetReleaseInfo()
 		fmt.Printf(`
 Client:
@@ -26,17 +23,7 @@ Client:
  Git Revision:  %s
 `, clientVersion, clientRevision)
 
-		client, c, err := target.createGRPCClient()
-		if err != nil {
-			fmt.Printf(`
-Server:
- Error:         %s
-`, err)
-			return
-		}
-		defer safeClose(c)
-
-		resp, err := client.GetVersion(context.Background(), &api.GetVersionRequest{})
+		resp, err := tc.Client().GetVersion(cmd.Context(), connect.NewRequest(&api.GetVersionRequest{}))
 		if err != nil {
 			fmt.Printf(`
 Server:
@@ -50,7 +37,7 @@ Server:
  Addr:          %s
  Version:       %s 
  Git Revision:  %s
-`, target.getAddr(), resp.Version, resp.Revision)
+`, tc.Addr(), resp.Msg.Version, resp.Msg.Revision)
 
 	}
 

internal/config/config.go

@@ -1,156 +1,432 @@
 package config
 
 import (
+	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"github.com/caddyserver/certmagic"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/key"
 	"github.com/jsiebens/ionscale/internal/util"
 	"github.com/mitchellh/go-homedir"
-	"gopkg.in/yaml.v3"
-	"io/ioutil"
+	"net/url"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sigs.k8s.io/yaml"
 	"strings"
-	"tailscale.com/types/key"
+	"tailscale.com/tailcfg"
+	tkey "tailscale.com/types/key"
+	"time"
 )
 
+const (
+	defaultKeepAliveInterval = 1 * time.Minute
+	defaultMagicDNSSuffix    = "ionscale.net"
+)
+
+var (
+	keepAliveInterval     = defaultKeepAliveInterval
+	magicDNSSuffix        = defaultMagicDNSSuffix
+	dnsProviderConfigured = false
+)
+
+func KeepAliveInterval() time.Duration {
+	return keepAliveInterval
+}
+
+func MagicDNSSuffix() string {
+	return magicDNSSuffix
+}
+
+func DNSProviderConfigured() bool {
+	return dnsProviderConfigured
+}
+
 func LoadConfig(path string) (*Config, error) {
-	config := defaultConfig()
+	cfg := defaultConfig()
 
 	if len(path) != 0 {
 		expandedPath, err := homedir.Expand(path)
 		if err != nil {
 			return nil, err
 		}
-		b, err := ioutil.ReadFile(expandedPath)
+
+		absPath, err := filepath.Abs(expandedPath)
 		if err != nil {
 			return nil, err
 		}
 
-		if err := yaml.Unmarshal(b, config); err != nil {
+		b, err := os.ReadFile(absPath)
+		if err != nil {
+			return nil, err
+		}
+
+		b, err = expandEnvVars(b)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := yaml.Unmarshal(b, cfg); err != nil {
 			return nil, err
 		}
 	}
 
-	return config, nil
-}
+	envCfgB64 := os.Getenv("IONSCALE_CONFIG_BASE64")
+	if len(envCfgB64) != 0 {
+		b, err := base64.StdEncoding.DecodeString(envCfgB64)
+		if err != nil {
+			return nil, err
+		}
 
-const (
-	httpListenAddrKey       = "IONSCALE_HTTP_LISTEN_ADDR"
-	httpsListenAddrKey      = "IONSCALE_HTTPS_LISTEN_ADDR"
-	serverUrlKey            = "IONSCALE_SERVER_URL"
-	keysSystemAdminKeyKey   = "IONSCALE_SYSTEM_ADMIN_KEY"
-	keysControlKeyKey       = "IONSCALE_CONTROL_KEY"
-	keysLegacyControlKeyKey = "IONSCALE_LEGACY_CONTROL_KEY"
-	databaseUrlKey          = "IONSCALE_DB_URL"
-	tlsDisableKey           = "IONSCALE_TLS_DISABLE"
-	tlsCertFileKey          = "IONSCALE_TLS_CERT_FILE"
-	tlsKeyFileKey           = "IONSCALE_TLS_KEY_FILE"
-	tlsCertMagicCAKey       = "IONSCALE_TLS_CERT_MAGIC_CA"
-	tlsCertMagicDomainKey   = "IONSCALE_TLS_CERT_MAGIC_DOMAIN"
-	tlsCertMagicEmailKey    = "IONSCALE_TLS_CERT_MAGIC_EMAIL"
-	tlsCertMagicStoragePath = "IONSCALE_TLS_CERT_MAGIC_STORAGE_PATH"
-	metricsListenAddrKey    = "IONSCALE_METRICS_LISTEN_ADDR"
-	loggingLevelKey         = "IONSCALE_LOGGING_LEVEL"
-	loggingFormatKey        = "IONSCALE_LOGGING_FORMAT"
-	loggingFileKey          = "IONSCALE_LOGGING_FILE"
-)
+		b, err = expandEnvVars(b)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := yaml.Unmarshal(b, cfg); err != nil {
+			return nil, err
+		}
+	}
+
+	keepAliveInterval = time.Duration(cfg.PollNet.KeepAliveInterval)
+	magicDNSSuffix = cfg.DNS.MagicDNSSuffix
+
+	if cfg.DNS.Provider.Zone != "" {
+		dnsProviderConfigured = true
+	}
+
+	return cfg.Validate()
+}
 
 func defaultConfig() *Config {
 	return &Config{
-		HttpListenAddr:    GetString(httpListenAddrKey, ":8080"),
-		HttpsListenAddr:   GetString(httpsListenAddrKey, ":8443"),
-		MetricsListenAddr: GetString(metricsListenAddrKey, ":8081"),
-		ServerUrl:         GetString(serverUrlKey, "https://localhost:8443"),
-		Keys: Keys{
-			SystemAdminKey:   GetString(keysSystemAdminKeyKey, ""),
-			ControlKey:       GetString(keysControlKeyKey, ""),
-			LegacyControlKey: GetString(keysLegacyControlKeyKey, ""),
-		},
+		ListenAddr:        ":8080",
+		MetricsListenAddr: ":9091",
+		StunListenAddr:    ":3478",
 		Database: Database{
-			Url: GetString(databaseUrlKey, "ionscale.db"),
+			Type:         "sqlite",
+			Url:          "./ionscale.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(ON)",
+			MaxOpenConns: 0,
+			MaxIdleConns: 2,
 		},
 		Tls: Tls{
-			Disable:              GetBool(tlsDisableKey, false),
-			CertFile:             GetString(tlsCertFileKey, ""),
-			KeyFile:              GetString(tlsKeyFileKey, ""),
-			CertMagicCA:          GetString(tlsCertMagicCAKey, certmagic.LetsEncryptProductionCA),
-			CertMagicDomain:      GetString(tlsCertMagicDomainKey, ""),
-			CertMagicEmail:       GetString(tlsCertMagicEmailKey, ""),
-			CertMagicStoragePath: GetString(tlsCertMagicStoragePath, ""),
+			Disable:     false,
+			ForceHttps:  true,
+			AcmeEnabled: false,
+			AcmeCA:      certmagic.LetsEncryptProductionCA,
+		},
+		PollNet: PollNet{
+			KeepAliveInterval: Duration(defaultKeepAliveInterval),
+		},
+		DNS: DNS{
+			MagicDNSSuffix: defaultMagicDNSSuffix,
+		},
+		DERP: DERP{
+			Server: DERPServer{
+				Disabled:   false,
+				RegionID:   1000,
+				RegionCode: "ionscale",
+				RegionName: "ionscale Embedded DERP",
+			},
 		},
 		Logging: Logging{
-			Level:  GetString(loggingLevelKey, "info"),
-			Format: GetString(loggingFormatKey, ""),
-			File:   GetString(loggingFileKey, ""),
+			Level: "info",
 		},
 	}
 }
 
 type ServerKeys struct {
-	SystemAdminKey   key.MachinePrivate
-	ControlKey       key.MachinePrivate
-	LegacyControlKey key.MachinePrivate
+	SystemAdminKey   *key.ServerPrivate
+	ControlKey       tkey.MachinePrivate
+	LegacyControlKey tkey.MachinePrivate
 }
 
 type Config struct {
-	HttpListenAddr    string   `yaml:"http_listen_addr"`
-	HttpsListenAddr   string   `yaml:"https_listen_addr"`
-	MetricsListenAddr string   `yaml:"metrics_listen_addr"`
-	ServerUrl         string   `yaml:"server_url"`
-	Tls               Tls      `yaml:"tls"`
-	Logging           Logging  `yaml:"logging"`
-	Keys              Keys     `yaml:"keys"`
-	Database          Database `yaml:"database"`
+	ListenAddr        string   `json:"listen_addr,omitempty"`
+	StunListenAddr    string   `json:"stun_listen_addr,omitempty"`
+	MetricsListenAddr string   `json:"metrics_listen_addr,omitempty"`
+	PublicAddr        string   `json:"public_addr,omitempty"`
+	StunPublicAddr    string   `json:"stun_public_addr,omitempty"`
+	Tls               Tls      `json:"tls,omitempty"`
+	PollNet           PollNet  `json:"poll_net,omitempty"`
+	Keys              Keys     `json:"keys,omitempty"`
+	Database          Database `json:"database,omitempty"`
+	Auth              Auth     `json:"auth,omitempty"`
+	DNS               DNS      `json:"dns,omitempty"`
+	DERP              DERP     `json:"derp,omitempty"`
+	Logging           Logging  `json:"logging,omitempty"`
+
+	PublicUrl *url.URL `json:"-"`
+
+	stunHost string
+	stunPort int
+	derpHost string
+	derpPort int
 }
 
 type Tls struct {
-	Disable              bool   `yaml:"disable"`
-	CertFile             string `yaml:"cert_file"`
-	KeyFile              string `yaml:"key_file"`
-	CertMagicDomain      string `yaml:"cert_magic_domain"`
-	CertMagicEmail       string `yaml:"cert_magic_email"`
-	CertMagicCA          string `yaml:"cert_magic_ca"`
-	CertMagicStoragePath string `yaml:"cert_magic_storage_path"`
+	Disable     bool   `json:"disable"`
+	ForceHttps  bool   `json:"force_https"`
+	CertFile    string `json:"cert_file,omitempty"`
+	KeyFile     string `json:"key_file,omitempty"`
+	AcmeEnabled bool   `json:"acme,omitempty"`
+	AcmeEmail   string `json:"acme_email,omitempty"`
+	AcmeCA      string `json:"acme_ca,omitempty"`
+}
+
+type PollNet struct {
+	KeepAliveInterval Duration `json:"keep_alive_interval"`
 }
 
 type Logging struct {
-	Level  string `yaml:"level"`
-	Format string `yaml:"format"`
-	File   string `yaml:"file"`
+	Level  string `json:"level,omitempty"`
+	Format string `json:"format,omitempty"`
+	File   string `json:"file,omitempty"`
 }
 
 type Database struct {
-	Url string `yaml:"url"`
+	Type            string   `json:"type,omitempty"`
+	Url             string   `json:"url,omitempty"`
+	MaxOpenConns    int      `json:"max_open_conns,omitempty"`
+	MaxIdleConns    int      `json:"max_idle_conns,omitempty"`
+	ConnMaxLifetime Duration `json:"conn_max_life_time,omitempty"`
+	ConnMaxIdleTime Duration `json:"conn_max_idle_time,omitempty"`
 }
 
 type Keys struct {
-	SystemAdminKey   string `yaml:"system_admin_key"`
-	ControlKey       string `yaml:"control_key"`
-	LegacyControlKey string `yaml:"legacy_control_key"`
+	ControlKey       string `json:"control_key,omitempty"`
+	LegacyControlKey string `json:"legacy_control_key,omitempty"`
+	SystemAdminKey   string `json:"system_admin_key,omitempty"`
+}
+
+type Auth struct {
+	Provider          AuthProvider      `json:"provider,omitempty"`
+	SystemAdminPolicy SystemAdminPolicy `json:"system_admins"`
+}
+
+type AuthProvider struct {
+	Issuer       string   `json:"issuer"`
+	ClientID     string   `json:"client_id"`
+	ClientSecret string   `json:"client_secret"`
+	Scopes       []string `json:"additional_scopes" `
+}
+
+type DNS struct {
+	MagicDNSSuffix string      `json:"magic_dns_suffix"`
+	Provider       DNSProvider `json:"provider,omitempty"`
+}
+
+type DNSProvider struct {
+	Name          string          `json:"name"`
+	PluginPath    string          `json:"plugin_path"`
+	Zone          string          `json:"zone"`
+	Configuration json.RawMessage `json:"config"`
+}
+
+type SystemAdminPolicy struct {
+	Subs    []string `json:"subs,omitempty"`
+	Emails  []string `json:"emails,omitempty"`
+	Filters []string `json:"filters,omitempty"`
+}
+
+type DERP struct {
+	Server  DERPServer `json:"server,omitempty"`
+	Sources []string   `json:"sources,omitempty"`
+}
+
+type DERPServer struct {
+	Disabled   bool   `json:"disabled,omitempty"`
+	RegionID   int    `json:"region_id,omitempty"`
+	RegionCode string `json:"region_code,omitempty"`
+	RegionName string `json:"region_name,omitempty"`
+}
+
+func (c *Config) Validate() (*Config, error) {
+	publicWebUrl, webHost, webPort, err := validatePublicAddr(c.PublicAddr)
+	if err != nil {
+		return nil, fmt.Errorf("web public addr: %w", err)
+	}
+
+	c.PublicUrl = publicWebUrl
+	c.derpHost = webHost
+	c.derpPort = webPort
+
+	if !c.DERP.Server.Disabled {
+		_, stunHost, stunPort, err := validatePublicAddr(c.StunPublicAddr)
+		if err != nil {
+			return nil, fmt.Errorf("stun public addr: %w", err)
+		}
+
+		c.stunHost = stunHost
+		c.stunPort = stunPort
+	}
+
+	return c, nil
 }
 
 func (c *Config) CreateUrl(format string, a ...interface{}) string {
 	path := fmt.Sprintf(format, a...)
-	return strings.TrimSuffix(c.ServerUrl, "/") + "/" + strings.TrimPrefix(path, "/")
+	u := url.URL{
+		Scheme: c.PublicUrl.Scheme,
+		Host:   c.PublicUrl.Host,
+		Path:   path,
+	}
+	return u.String()
 }
 
-func (c *Config) ReadServerKeys() (*ServerKeys, error) {
-	systemAdminKey, err := util.ParseMachinePrivateKey(c.Keys.SystemAdminKey)
-	if err != nil {
-		return nil, fmt.Errorf("error reading system admin key: %v", err)
+func (c *Config) ReadServerKeys(defaultKeys *domain.ControlKeys) (*ServerKeys, error) {
+	keys := &ServerKeys{
+		ControlKey:       defaultKeys.ControlKey,
+		LegacyControlKey: defaultKeys.LegacyControlKey,
 	}
 
-	controlKey, err := util.ParseMachinePrivateKey(c.Keys.ControlKey)
-	if err != nil {
-		return nil, fmt.Errorf("error reading control key: %v", err)
+	if len(c.Keys.SystemAdminKey) != 0 {
+		systemAdminKey, err := key.ParsePrivateKey(c.Keys.SystemAdminKey)
+		if err != nil {
+			return nil, fmt.Errorf("error reading system admin key: %v", err)
+		}
+
+		keys.SystemAdminKey = systemAdminKey
 	}
 
-	legacyControlKey, err := util.ParseMachinePrivateKey(c.Keys.LegacyControlKey)
-	if err != nil {
-		return nil, fmt.Errorf("error reading legacy control key: %v", err)
+	if len(c.Keys.ControlKey) != 0 {
+		controlKey, err := util.ParseMachinePrivateKey(c.Keys.ControlKey)
+		if err != nil {
+			return nil, fmt.Errorf("error reading control key: %v", err)
+		}
+		keys.ControlKey = *controlKey
 	}
 
-	return &ServerKeys{
-		SystemAdminKey:   *systemAdminKey,
-		ControlKey:       *controlKey,
-		LegacyControlKey: *legacyControlKey,
-	}, nil
+	if len(c.Keys.LegacyControlKey) != 0 {
+		legacyControlKey, err := util.ParseMachinePrivateKey(c.Keys.LegacyControlKey)
+		if err != nil {
+			return nil, fmt.Errorf("error reading legacy control key: %v", err)
+		}
+		keys.LegacyControlKey = *legacyControlKey
+	}
+
+	return keys, nil
+}
+
+func (c *Config) DefaultDERPMap() *tailcfg.DERPMap {
+	if c.derpHost == c.stunHost {
+		return &tailcfg.DERPMap{
+			Regions: map[int]*tailcfg.DERPRegion{
+				c.DERP.Server.RegionID: {
+					RegionID:   c.DERP.Server.RegionID,
+					RegionCode: c.DERP.Server.RegionCode,
+					RegionName: c.DERP.Server.RegionName,
+					Nodes: []*tailcfg.DERPNode{
+						{
+							RegionID: c.DERP.Server.RegionID,
+							Name:     "ionscale",
+							HostName: c.derpHost,
+							DERPPort: c.derpPort,
+							STUNPort: c.stunPort,
+						},
+					},
+				},
+			},
+		}
+	}
+
+	return &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{
+			c.DERP.Server.RegionID: {
+				RegionID:   c.DERP.Server.RegionID,
+				RegionCode: c.DERP.Server.RegionCode,
+				RegionName: c.DERP.Server.RegionName,
+				Nodes: []*tailcfg.DERPNode{
+					{
+						RegionID: c.DERP.Server.RegionID,
+						Name:     "stun",
+						HostName: c.stunHost,
+						STUNOnly: true,
+						STUNPort: c.stunPort,
+					},
+					{
+						RegionID: c.DERP.Server.RegionID,
+						Name:     "derp",
+						HostName: c.derpHost,
+						DERPPort: c.derpPort,
+						STUNPort: -1,
+					},
+				},
+			},
+		},
+	}
+}
+
+type Duration time.Duration
+
+func (d Duration) Std() time.Duration {
+	return time.Duration(d)
+}
+
+func (d Duration) MarshalJSON() ([]byte, error) {
+	return json.Marshal(time.Duration(d).String())
+}
+
+func (d *Duration) UnmarshalJSON(b []byte) error {
+	var v interface{}
+	if err := json.Unmarshal(b, &v); err != nil {
+		return err
+	}
+	switch value := v.(type) {
+	case float64:
+		*d = Duration(value)
+		return nil
+	case string:
+		tmp, err := time.ParseDuration(value)
+		if err != nil {
+			return err
+		}
+		*d = Duration(tmp)
+		return nil
+	default:
+		return fmt.Errorf("invalid duration")
+	}
+}
+
+// Match ${VAR:default} syntax for variables with default values
+var optionalEnvRegex = regexp.MustCompile(`\${([a-zA-Z0-9_]+):([^}]*)}`)
+
+// Match ${VAR} syntax (without default) - these are required
+var requiredEnvRegex = regexp.MustCompile(`\${([a-zA-Z0-9_]+)}`)
+
+func expandEnvVars(config []byte) ([]byte, error) {
+	var result = config
+	var missingVars []string
+
+	result = optionalEnvRegex.ReplaceAllFunc(result, func(match []byte) []byte {
+		parts := optionalEnvRegex.FindSubmatch(match)
+		envVar := string(parts[1])
+		defaultValue := parts[2]
+
+		envValue := os.Getenv(envVar)
+		if envValue != "" {
+			return []byte(envValue)
+		}
+		return defaultValue
+	})
+
+	result = requiredEnvRegex.ReplaceAllFunc(result, func(match []byte) []byte {
+		parts := requiredEnvRegex.FindSubmatch(match)
+		envVar := string(parts[1])
+		envValue := os.Getenv(envVar)
+
+		if envValue == "" {
+			missingVars = append(missingVars, envVar)
+			return match
+		}
+
+		return []byte(envValue)
+	})
+
+	if len(missingVars) > 0 {
+		return nil, fmt.Errorf("missing required environment variables: %s", strings.Join(missingVars, ", "))
+	}
+
+	return result, nil
 }

internal/config/config_test.go

@@ -0,0 +1,130 @@
+package config
+
+import (
+	"bytes"
+	"github.com/stretchr/testify/require"
+	"os"
+	"testing"
+)
+
+func TestLoadConfig(t *testing.T) {
+	// Create a temporary config file
+	tempFile, err := os.CreateTemp("", "config-*.yaml")
+	if err != nil {
+		t.Fatalf("Failed to create temp file: %v", err)
+	}
+	defer os.Remove(tempFile.Name())
+
+	// Write test configuration
+	yamlContent := `
+public_addr: "ionscale.localtest.me:443"
+stun_public_addr: "ionscale.localtest.me:3478"
+
+database:
+  type: ${DB_TYPE:sqlite}
+  url: ${DB_URL}
+  max_open_conns: ${DB_MAX_OPEN_CONNS:5}
+  conn_max_life_time: ${DB_CONN_MAX_LIFE_TIME:5s}
+`
+	if _, err := tempFile.Write([]byte(yamlContent)); err != nil {
+		t.Fatalf("Failed to write to temp file: %v", err)
+	}
+	tempFile.Close()
+
+	t.Run("With DB_URL set", func(t *testing.T) {
+		require.NoError(t, os.Setenv("DB_URL", "./ionscale.db"))
+
+		config, err := LoadConfig(tempFile.Name())
+		require.NoError(t, err)
+
+		require.Equal(t, "sqlite", config.Database.Type)
+		require.Equal(t, "./ionscale.db", config.Database.Url)
+		require.Equal(t, 5, config.Database.MaxOpenConns)
+	})
+
+	t.Run("Without required DB_URL", func(t *testing.T) {
+		require.NoError(t, os.Unsetenv("DB_URL"))
+
+		_, err := LoadConfig(tempFile.Name())
+		require.Error(t, err)
+	})
+}
+
+func TestExpandEnvVars(t *testing.T) {
+	// Setup test environment variables
+	require.NoError(t, os.Setenv("TEST_VAR", "test_value"))
+	require.NoError(t, os.Setenv("PORT", "9090"))
+
+	// Ensure TEST_DEFAULT is not set
+	require.NoError(t, os.Unsetenv("TEST_DEFAULT"))
+
+	tests := []struct {
+		name        string
+		input       []byte
+		expected    []byte
+		expectError bool
+	}{
+		{
+			name:        "Braced variable",
+			input:       []byte("Port: ${PORT}"),
+			expected:    []byte("Port: 9090"),
+			expectError: false,
+		},
+		{
+			name:        "Default value used",
+			input:       []byte("Default: ${TEST_DEFAULT:fallback}"),
+			expected:    []byte("Default: fallback"),
+			expectError: false,
+		},
+		{
+			name:        "Default value not used when env var exists",
+			input:       []byte("Not default: ${PORT:8080}"),
+			expected:    []byte("Not default: 9090"),
+			expectError: false,
+		},
+		{
+			name:        "Multiple replacements",
+			input:       []byte("Config: ${TEST_VAR} ${PORT} ${TEST_DEFAULT:default}"),
+			expected:    []byte("Config: test_value 9090 default"),
+			expectError: false,
+		},
+		{
+			name:        "Missing required variable",
+			input:       []byte("Required: ${MISSING_VAR}"),
+			expected:    nil,
+			expectError: true,
+		},
+		{
+			name:        "Mixed variables with one missing",
+			input:       []byte("Mixed: ${TEST_VAR} ${MISSING_VAR} ${TEST_DEFAULT:default}"),
+			expected:    nil,
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := expandEnvVars(tt.input)
+
+			// Check error expectation
+			if tt.expectError && err == nil {
+				t.Errorf("expandEnvVars() expected error but got none")
+				return
+			}
+			if !tt.expectError && err != nil {
+				t.Errorf("expandEnvVars() got unexpected error: %v", err)
+				return
+			}
+
+			// If we expected an error, don't check the result further
+			if tt.expectError {
+				return
+			}
+
+			// Check result
+			if !bytes.Equal(result, tt.expected) {
+				t.Errorf("expandEnvVars() got = %s, want %s", result, tt.expected)
+			}
+		})
+	}
+}

internal/config/funcs.go

@@ -1,7 +1,11 @@
 package config
 
 import (
+	"fmt"
+	"net"
+	"net/url"
 	"os"
+	"strconv"
 	"strings"
 )
 
@@ -20,3 +24,33 @@ func GetString(key, defaultValue string) string {
 	}
 	return defaultValue
 }
+
+func validatePublicAddr(addr string) (*url.URL, string, int, error) {
+	scheme := "https"
+
+	if strings.HasPrefix(addr, "http://") {
+		scheme = "http"
+		addr = strings.TrimPrefix(addr, "http://")
+	}
+
+	if strings.HasPrefix(addr, "https://") {
+		scheme = "https"
+		addr = strings.TrimPrefix(addr, "https://")
+	}
+
+	host, portS, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, "", -1, fmt.Errorf("invalid")
+	}
+
+	port, err := strconv.Atoi(portS)
+	if err != nil {
+		return nil, "", 0, fmt.Errorf("invalid")
+	}
+
+	if (port == 443 && scheme == "https") || (port == 80 && scheme == "http") {
+		return &url.URL{Scheme: scheme, Host: host}, host, port, nil
+	}
+
+	return &url.URL{Scheme: scheme, Host: fmt.Sprintf("%s:%d", host, port)}, host, port, nil
+}

internal/config/funcs_test.go

@@ -0,0 +1,36 @@
+package config
+
+import (
+	"fmt"
+	"github.com/stretchr/testify/require"
+	"net/url"
+	"testing"
+)
+
+func TestPublicAddrToUrl(t *testing.T) {
+	mustParseUrl := func(s string) *url.URL {
+		parse, err := url.Parse(s)
+		require.NoError(t, err)
+		return parse
+	}
+
+	parameters := []struct {
+		input    string
+		expected *url.URL
+		err      error
+	}{
+		{"localtest.me", nil, fmt.Errorf("invalid")},
+		{"localtest.me:443", mustParseUrl("https://localtest.me"), nil},
+		{"localtest.me:80", mustParseUrl("https://localtest.me:80"), nil},
+		{"localtest.me:8080", mustParseUrl("https://localtest.me:8080"), nil},
+		{"http://localtest.me:8080", mustParseUrl("http://localtest.me:8080"), nil},
+	}
+
+	for _, p := range parameters {
+		t.Run(fmt.Sprintf("Testing [%v]", p.input), func(t *testing.T) {
+			url, _, _, err := validatePublicAddr(p.input)
+			require.Equal(t, p.expected, url)
+			require.Equal(t, p.err, err)
+		})
+	}
+}

internal/core/session_manager.go

@@ -0,0 +1,136 @@
+package core
+
+import (
+	"github.com/puzpuzpuz/xsync/v3"
+	"slices"
+	"sync"
+	"time"
+)
+
+type Ping struct{}
+
+type PollMapSessionManager interface {
+	Register(tailnetID uint64, machineID uint64, ch chan<- *Ping)
+	Deregister(tailnetID uint64, machineID uint64, ch chan<- *Ping)
+	HasSession(tailnetID uint64, machineID uint64) bool
+	NotifyAll(tailnetID uint64, ignoreMachineIDs ...uint64)
+}
+
+func NewPollMapSessionManager() PollMapSessionManager {
+	return &pollMapSessionManager{
+		tailnets: xsync.NewMapOf[uint64, *tailnetSessionManager](),
+	}
+}
+
+type pollMapSessionManager struct {
+	tailnets *xsync.MapOf[uint64, *tailnetSessionManager]
+}
+
+func (n *pollMapSessionManager) load(tailnetID uint64) *tailnetSessionManager {
+	m, _ := n.tailnets.LoadOrCompute(tailnetID, func() *tailnetSessionManager {
+		return &tailnetSessionManager{
+			targets:  make(map[uint64]chan<- *Ping),
+			timers:   make(map[uint64]*time.Timer),
+			sessions: xsync.NewMapOf[uint64, bool](),
+		}
+	})
+	return m
+}
+
+func (n *pollMapSessionManager) Register(tailnetID uint64, machineID uint64, ch chan<- *Ping) {
+	n.load(tailnetID).Register(machineID, ch)
+}
+
+func (n *pollMapSessionManager) Deregister(tailnetID uint64, machineID uint64, ch chan<- *Ping) {
+	n.load(tailnetID).Deregister(machineID, ch)
+}
+
+func (n *pollMapSessionManager) HasSession(tailnetID uint64, machineID uint64) bool {
+	return n.load(tailnetID).HasSession(machineID)
+}
+
+func (n *pollMapSessionManager) NotifyAll(tailnetID uint64, ignoreMachineIDs ...uint64) {
+	n.load(tailnetID).NotifyAll(ignoreMachineIDs...)
+}
+
+type tailnetSessionManager struct {
+	sync.RWMutex
+	targets  map[uint64]chan<- *Ping
+	timers   map[uint64]*time.Timer
+	sessions *xsync.MapOf[uint64, bool]
+}
+
+func (n *tailnetSessionManager) NotifyAll(ignoreMachineIDs ...uint64) {
+	n.RLock()
+	defer n.RUnlock()
+
+	for i, p := range n.targets {
+		if !slices.Contains(ignoreMachineIDs, i) {
+			select {
+			case p <- &Ping{}:
+			default: // ignore, channel has a small buffer, failing to insert means there is already a ping pending
+			}
+		}
+	}
+}
+
+func (n *tailnetSessionManager) Register(machineID uint64, ch chan<- *Ping) {
+	n.Lock()
+	defer n.Unlock()
+
+	if curr, ok := n.targets[machineID]; ok {
+		close(curr)
+	}
+
+	n.targets[machineID] = ch
+	n.sessions.Store(machineID, true)
+
+	t, ok := n.timers[machineID]
+	if ok {
+		t.Stop()
+		delete(n.timers, machineID)
+	}
+
+	timer := time.NewTimer(5 * time.Second)
+	go func() {
+		<-timer.C
+		if n.HasSession(machineID) {
+			n.NotifyAll(machineID)
+		}
+	}()
+
+	n.timers[machineID] = timer
+}
+
+func (n *tailnetSessionManager) Deregister(machineID uint64, ch chan<- *Ping) {
+	n.Lock()
+	defer n.Unlock()
+
+	if curr, ok := n.targets[machineID]; ok && curr != ch {
+		return
+	}
+
+	delete(n.targets, machineID)
+	n.sessions.Store(machineID, false)
+
+	t, ok := n.timers[machineID]
+	if ok {
+		t.Stop()
+		delete(n.timers, machineID)
+	}
+
+	timer := time.NewTimer(10 * time.Second)
+	go func() {
+		<-timer.C
+		if !n.HasSession(machineID) {
+			n.NotifyAll()
+		}
+	}()
+
+	n.timers[machineID] = timer
+}
+
+func (n *tailnetSessionManager) HasSession(machineID uint64) bool {
+	v, ok := n.sessions.Load(machineID)
+	return ok && v
+}

internal/core/worker.go

@@ -1,8 +1,7 @@
-package handlers
+package core
 
 import (
 	"context"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"time"
 )
@@ -12,26 +11,29 @@ const (
 	inactivityTimeout = 30 * time.Minute
 )
 
-func NewReaper(brokers *broker.BrokerPool, repository domain.Repository) *Reaper {
-	return &Reaper{
-		brokers:    brokers,
-		repository: repository,
+func StartWorker(repository domain.Repository, sessionManager PollMapSessionManager) {
+	r := &worker{
+		sessionManager: sessionManager,
+		repository:     repository,
 	}
+
+	go r.start()
 }
 
-type Reaper struct {
-	brokers    *broker.BrokerPool
-	repository domain.Repository
+type worker struct {
+	sessionManager PollMapSessionManager
+	repository     domain.Repository
 }
 
-func (r *Reaper) Start() {
+func (r *worker) start() {
+	r.deleteInactiveEphemeralNodes()
 	t := time.NewTicker(ticker)
 	for range t.C {
-		r.reapInactiveEphemeralNodes()
+		r.deleteInactiveEphemeralNodes()
 	}
 }
 
-func (r *Reaper) reapInactiveEphemeralNodes() {
+func (r *worker) deleteInactiveEphemeralNodes() {
 	ctx := context.Background()
 
 	now := time.Now().UTC()
@@ -40,6 +42,7 @@ func (r *Reaper) reapInactiveEphemeralNodes() {
 	if err != nil {
 		return
 	}
+
 	var removedNodes = make(map[uint64][]uint64)
 	for _, m := range machines {
 		if now.After(m.LastSeen.Add(inactivityTimeout)) {
@@ -54,8 +57,8 @@ func (r *Reaper) reapInactiveEphemeralNodes() {
 	}
 
 	if len(removedNodes) != 0 {
-		for i, p := range removedNodes {
-			r.brokers.Get(i).SignalPeersRemoved(p)
+		for i, _ := range removedNodes {
+			r.sessionManager.NotifyAll(i)
 		}
 	}
 }

internal/database/database.go

@@ -2,91 +2,132 @@ package database
 
 import (
 	"context"
-	"encoding/json"
+	"database/sql"
 	"errors"
-	"github.com/glebarez/sqlite"
-	"github.com/hashicorp/go-hclog"
-	"net/http"
-	"tailscale.com/tailcfg"
+	"fmt"
+	"github.com/go-gormigrate/gormigrate/v2"
+	"github.com/jsiebens/ionscale/internal/database/migration"
+	"github.com/jsiebens/ionscale/internal/util"
+	"go.uber.org/zap"
+	"tailscale.com/types/key"
 	"time"
 
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"gorm.io/gorm"
 	"gorm.io/gorm/logger"
+	"gorm.io/plugin/prometheus"
 )
 
-func OpenDB(config *config.Database, logger hclog.Logger) (*gorm.DB, domain.Repository, error) {
-	gormDB, err := createDB(config, logger)
+type dbLock interface {
+	Lock() error
+	UnlockErr(error) error
+}
+
+func OpenDB(config *config.Database, logger *zap.Logger) (*sql.DB, domain.Repository, error) {
+	db, lock, err := createDB(config, logger)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	repository := domain.NewRepository(gormDB)
+	_ = db.Use(prometheus.New(prometheus.Config{StartServer: false}))
 
-	if err := migrate(gormDB, repository); err != nil {
+	sqlDB, err := db.DB()
+	if err != nil {
 		return nil, nil, err
 	}
 
-	return gormDB, repository, nil
+	sqlDB.SetMaxOpenConns(config.MaxOpenConns)
+	sqlDB.SetMaxIdleConns(config.MaxIdleConns)
+	sqlDB.SetConnMaxLifetime(config.ConnMaxLifetime.Std())
+	sqlDB.SetConnMaxIdleTime(config.ConnMaxIdleTime.Std())
+
+	repository := domain.NewRepository(db)
+
+	if err := lock.Lock(); err != nil {
+		return nil, nil, err
+	}
+
+	if err := lock.UnlockErr(migrate(db)); err != nil {
+		return nil, nil, err
+	}
+
+	return sqlDB, repository, nil
 }
 
-func createDB(config *config.Database, logger hclog.Logger) (*gorm.DB, error) {
+func createDB(config *config.Database, logger *zap.Logger) (*gorm.DB, dbLock, error) {
 	gormConfig := &gorm.Config{
-		Logger: &GormLoggerAdapter{logger: logger.Named("db")},
+		Logger: &GormLoggerAdapter{logger: logger.Sugar()},
 	}
 
-	return gorm.Open(sqlite.Open(config.Url), gormConfig)
+	switch config.Type {
+	case "sqlite", "sqlite3":
+		return newSqliteDB(config, gormConfig)
+	case "postgres", "postgresql":
+		return newPostgresDB(config, gormConfig)
+	}
+
+	return nil, nil, fmt.Errorf("invalid database type '%s'", config.Type)
 }
 
-func migrate(db *gorm.DB, repository domain.Repository) error {
-	err := db.AutoMigrate(
-		&domain.ServerConfig{},
-		&domain.Tailnet{},
-		&domain.TailnetConfig{},
-		&domain.User{},
-		&domain.AuthKey{},
-		&domain.Machine{},
-	)
+func migrate(db *gorm.DB) error {
+	m := gormigrate.New(db, gormigrate.DefaultOptions, migration.Migrations())
 
-	if err != nil {
+	if err := m.Migrate(); err != nil {
 		return err
 	}
 
-	if err := initializeDERPMap(repository); err != nil {
+	ctx := context.Background()
+	repository := domain.NewRepository(db)
+
+	if err := createServerKey(ctx, repository); err != nil {
+		return err
+	}
+
+	if err := createJSONWebKeySet(ctx, repository); err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func initializeDERPMap(repository domain.Repository) error {
-	ctx := context.Background()
-	derpMap, err := repository.GetDERPMap(ctx)
+func createServerKey(ctx context.Context, repository domain.Repository) error {
+	serverKey, err := repository.GetControlKeys(ctx)
 	if err != nil {
 		return err
 	}
-	if derpMap != nil {
+	if serverKey != nil {
 		return nil
 	}
 
-	getJson := func(url string, target interface{}) error {
-		c := http.Client{Timeout: 5 * time.Second}
-		r, err := c.Get(url)
-		if err != nil {
-			return err
-		}
-		defer r.Body.Close()
-
-		return json.NewDecoder(r.Body).Decode(target)
+	keys := domain.ControlKeys{
+		ControlKey:       key.NewMachine(),
+		LegacyControlKey: key.NewMachine(),
 	}
-
-	m := &tailcfg.DERPMap{}
-	if err := getJson("https://controlplane.tailscale.com/derpmap/default", m); err != nil {
+	if err := repository.SetControlKeys(ctx, &keys); err != nil {
 		return err
 	}
 
-	if err := repository.SetDERPMap(ctx, m); err != nil {
+	return nil
+}
+
+func createJSONWebKeySet(ctx context.Context, repository domain.Repository) error {
+	jwks, err := repository.GetJSONWebKeySet(ctx)
+	if err != nil {
+		return err
+	}
+	if jwks != nil {
+		return nil
+	}
+
+	privateKey, id, err := util.NewPrivateKey()
+	if err != nil {
+		return err
+	}
+
+	jsonWebKey := domain.JSONWebKey{Id: id, PrivateKey: *privateKey}
+
+	if err := repository.SetJSONWebKeySet(ctx, &domain.JSONWebKeys{Key: jsonWebKey}); err != nil {
 		return err
 	}
 
@@ -94,7 +135,7 @@ func initializeDERPMap(repository domain.Repository) error {
 }
 
 type GormLoggerAdapter struct {
-	logger hclog.Logger
+	logger *zap.SugaredLogger
 }
 
 func (g *GormLoggerAdapter) LogMode(level logger.LogLevel) logger.Interface {
@@ -102,11 +143,11 @@ func (g *GormLoggerAdapter) LogMode(level logger.LogLevel) logger.Interface {
 }
 
 func (g *GormLoggerAdapter) Info(ctx context.Context, s string, i ...interface{}) {
-	g.logger.Info(s, i)
+	g.logger.Infow(s, i)
 }
 
 func (g *GormLoggerAdapter) Warn(ctx context.Context, s string, i ...interface{}) {
-	g.logger.Warn(s, i)
+	g.logger.Warnw(s, i)
 }
 
 func (g *GormLoggerAdapter) Error(ctx context.Context, s string, i ...interface{}) {
@@ -114,21 +155,23 @@ func (g *GormLoggerAdapter) Error(ctx context.Context, s string, i ...interface{
 }
 
 func (g *GormLoggerAdapter) Trace(ctx context.Context, begin time.Time, fc func() (sql string, rowsAffected int64), err error) {
-	elapsed := time.Since(begin)
-	switch {
-	case err != nil && !errors.Is(err, gorm.ErrRecordNotFound):
-		sql, rows := fc()
-		if rows == -1 {
-			g.logger.Error("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "err", err)
-		} else {
-			g.logger.Error("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows, "err", err)
-		}
-	case g.logger.IsTrace():
-		sql, rows := fc()
-		if rows == -1 {
-			g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed)
-		} else {
-			g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows)
+	if g.logger.Level().Enabled(zap.DebugLevel) {
+		elapsed := time.Since(begin)
+		switch {
+		case err != nil && !errors.Is(err, gorm.ErrRecordNotFound):
+			sql, rows := fc()
+			if rows == -1 {
+				g.logger.Debugw("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "err", err)
+			} else {
+				g.logger.Debugw("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows, "err", err)
+			}
+		default:
+			sql, rows := fc()
+			if rows == -1 {
+				g.logger.Debugw("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed)
+			} else {
+				g.logger.Debugw("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows)
+			}
 		}
 	}
 }

internal/database/migration/m202209070900_initial_schema.go

@@ -0,0 +1,151 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"gorm.io/gorm"
+	"time"
+)
+
+func m202209070900_initial_schema() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202209070900",
+		Migrate: func(db *gorm.DB) error {
+			// it's a good practice to copy the struct inside the function,
+			// so side effects are prevented if the original struct changes during the time
+			type ServerConfig struct {
+				Key   string `gorm:"primaryKey"`
+				Value []byte
+			}
+
+			type Tailnet struct {
+				ID        uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Name      string `gorm:"type:varchar(64);uniqueIndex"`
+				DNSConfig domain.DNSConfig
+				IAMPolicy domain.IAMPolicy
+				ACLPolicy domain.ACLPolicy
+			}
+
+			type Account struct {
+				ID         uint64 `gorm:"primaryKey;autoIncrement:false"`
+				ExternalID string
+				LoginName  string
+			}
+
+			type User struct {
+				ID        uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Name      string
+				UserType  domain.UserType
+				TailnetID uint64
+				Tailnet   Tailnet
+				AccountID *uint64
+				Account   *Account
+			}
+
+			type SystemApiKey struct {
+				ID   uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Key  string `gorm:"type:varchar(64);uniqueIndex"`
+				Hash string
+
+				CreatedAt time.Time
+				ExpiresAt *time.Time
+
+				AccountID uint64
+				Account   Account
+			}
+
+			type ApiKey struct {
+				ID   uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Key  string `gorm:"type:varchar(64);uniqueIndex"`
+				Hash string
+
+				CreatedAt time.Time
+				ExpiresAt *time.Time
+
+				TailnetID uint64
+				Tailnet   Tailnet
+
+				UserID uint64
+				User   User
+			}
+
+			type AuthKey struct {
+				ID        uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Key       string `gorm:"type:varchar(64);uniqueIndex"`
+				Hash      string
+				Ephemeral bool
+				Tags      domain.Tags
+
+				CreatedAt time.Time
+				ExpiresAt *time.Time
+
+				TailnetID uint64
+				Tailnet   Tailnet
+
+				UserID uint64
+				User   User
+			}
+
+			type Machine struct {
+				ID                uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Name              string
+				NameIdx           uint64
+				MachineKey        string
+				NodeKey           string
+				DiscoKey          string
+				Ephemeral         bool
+				RegisteredTags    domain.Tags
+				Tags              domain.Tags
+				KeyExpiryDisabled bool
+
+				HostInfo  domain.HostInfo
+				Endpoints domain.Endpoints
+				AllowIPs  domain.AllowIPs
+
+				IPv4 domain.IP
+				IPv6 domain.IP
+
+				CreatedAt time.Time
+				ExpiresAt time.Time
+				LastSeen  *time.Time
+
+				UserID uint64
+				User   User
+
+				TailnetID uint64
+				Tailnet   Tailnet
+			}
+
+			type RegistrationRequest struct {
+				MachineKey    string `gorm:"primaryKey;autoIncrement:false"`
+				Key           string `gorm:"type:varchar(64);uniqueIndex"`
+				Data          domain.RegistrationRequestData
+				CreatedAt     time.Time
+				Authenticated bool
+				Error         string
+			}
+
+			type AuthenticationRequest struct {
+				Key       string `gorm:"primaryKey;autoIncrement:false"`
+				Token     string
+				TailnetID *uint64
+				Error     string
+				CreatedAt time.Time
+			}
+
+			return db.AutoMigrate(
+				&ServerConfig{},
+				&Tailnet{},
+				&Account{},
+				&User{},
+				&SystemApiKey{},
+				&ApiKey{},
+				&AuthKey{},
+				&Machine{},
+				&RegistrationRequest{},
+				&AuthenticationRequest{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202209251530_add_autoallowips_column.go

@@ -0,0 +1,23 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"gorm.io/gorm"
+)
+
+func m202209251530_add_autoallowips_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202209251530",
+		Migrate: func(db *gorm.DB) error {
+			type Machine struct {
+				AutoAllowIPs domain.AllowIPs
+			}
+
+			return db.AutoMigrate(
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202209251532_add_alias_column.go

@@ -0,0 +1,39 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202209251532_add_alias_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202209251532a",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Alias *string `gorm:"type:varchar(64)"`
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}
+
+func m202229251530_add_alias_column_constraint() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202209251532b",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name  string  `gorm:"uniqueIndex"`
+				Alias *string `gorm:"uniqueIndex"`
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202210040828_add_derpmap_colum.go

@@ -0,0 +1,25 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"gorm.io/gorm"
+)
+
+func m202210040828_add_derpmap_colum() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202210040828",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name    string  `gorm:"uniqueIndex"`
+				Alias   *string `gorm:"uniqueIndex"`
+				DERPMap domain.DERPMap
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202210070814_add_filesharing_and_servicecollection_columns.go

@@ -0,0 +1,25 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202210070814_add_filesharing_and_servicecollection_columns() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202210070814",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name                     string  `gorm:"uniqueIndex"`
+				Alias                    *string `gorm:"uniqueIndex"`
+				ServiceCollectionEnabled bool
+				FileSharingEnabled       bool
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202210080700_ssh_action_request.go

@@ -0,0 +1,34 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+	"time"
+)
+
+func m202210080700_ssh_action_request() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202210080700",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name       string  `gorm:"uniqueIndex"`
+				Alias      *string `gorm:"uniqueIndex"`
+				SSHEnabled bool
+			}
+
+			type SSHActionRequest struct {
+				Key          string `gorm:"primary_key"`
+				Action       string
+				SrcMachineID uint64
+				DstMachineID uint64
+				CreatedAt    time.Time
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+				&SSHActionRequest{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202211031100_add_authorized_column.go

@@ -0,0 +1,33 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202211031100_add_authorized_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202211031100",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name                        string `gorm:"uniqueIndex"`
+				MachineAuthorizationEnabled bool
+			}
+
+			type AuthKey struct {
+				PreAuthorized bool
+			}
+
+			type Machine struct {
+				Authorized bool `gorm:"default:true"`
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+				&AuthKey{},
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202212201300_add_user_id_column.go

@@ -0,0 +1,23 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202212201300_add_user_id_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202212201300",
+		Migrate: func(db *gorm.DB) error {
+			type RegistrationRequest struct {
+				Key    string `gorm:"type:varchar(64);uniqueIndex"`
+				UserID uint64
+			}
+
+			return db.AutoMigrate(
+				&RegistrationRequest{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202212270800_machine_indeces.go

@@ -0,0 +1,32 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"gorm.io/gorm"
+)
+
+func m202212270800_machine_indeces() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202212270800",
+		Migrate: func(db *gorm.DB) error {
+			type Machine struct {
+				ID         uint64 `gorm:"primaryKey;autoIncrement:false;index:idx_tailnet_id_id,priority:2"`
+				MachineKey string `gorm:"index:idx_machine_keys"`
+				NodeKey    string `gorm:"index:idx_machine_keys"`
+
+				Name    string `gorm:"index:idx_tailnet_id_name,priority:2"`
+				NameIdx uint64 `gorm:"index:idx_tailnet_id_name,sort:desc,priority:3"`
+
+				TailnetID uint64 `gorm:"index:idx_tailnet_id_id,priority:1;index:idx_tailnet_id_name,priority:1"`
+
+				IPv4 domain.IP `gorm:"index:idx_ipv4"`
+			}
+
+			return db.AutoMigrate(
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202312271200_account_last_authenticated.go

@@ -0,0 +1,23 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+	"time"
+)
+
+func m202312271200_account_last_authenticated() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202312271200",
+		Migrate: func(db *gorm.DB) error {
+			type Account struct {
+				LastAuthenticated *time.Time
+			}
+
+			return db.AutoMigrate(
+				&Account{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202312290900_machine_indeces.go

@@ -0,0 +1,25 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202312290900_machine_indeces() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202312290900",
+		Migrate: func(db *gorm.DB) error {
+			type Machine struct {
+				Name    string `gorm:"index:idx_tailnet_id_name,unique,priority:2"`
+				NameIdx uint64 `gorm:"index:idx_tailnet_id_name,unique,sort:desc,priority:3"`
+			}
+
+			db.Migrator().DropIndex(&Machine{}, "idx_tailnet_id_name")
+
+			return db.AutoMigrate(
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202401061400_machine_indeces.go

@@ -0,0 +1,27 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202401061400_machine_indeces() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202401061400",
+		Migrate: func(db *gorm.DB) error {
+			type Machine struct {
+				ID        uint64 `gorm:"primaryKey;autoIncrement:false;index:idx_tailnet_id_id,priority:2"`
+				Name      string `gorm:"index:idx_tailnet_id_name,unique,priority:2"`
+				NameIdx   uint64 `gorm:"index:idx_tailnet_id_name,unique,sort:desc,priority:3"`
+				TailnetID uint64 `gorm:"index:idx_tailnet_id_id,priority:1;index:idx_tailnet_id_name,priority:1"`
+			}
+
+			db.Migrator().DropIndex(&Machine{}, "idx_tailnet_id_name")
+
+			return db.AutoMigrate(
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202402120800_user_last_authenticated.go

@@ -0,0 +1,23 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+	"time"
+)
+
+func m202402120800_user_last_authenticated() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202402120800",
+		Migrate: func(db *gorm.DB) error {
+			type User struct {
+				LastAuthenticated *time.Time
+			}
+
+			return db.AutoMigrate(
+				&User{},
+			)
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202403130830_json_to_text.go

@@ -0,0 +1,29 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202403130830_json_to_text() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202403130830",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				IAMPolicy string
+				ACLPolicy string
+			}
+
+			if err := db.Migrator().AlterColumn(&Tailnet{}, "IAMPolicy"); err != nil {
+				return err
+			}
+
+			if err := db.Migrator().AlterColumn(&Tailnet{}, "ACLPolicy"); err != nil {
+				return err
+			}
+
+			return nil
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/m202502150830_use_hostname.go

@@ -0,0 +1,24 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202502150830_use_hostname() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202502150830",
+		Migrate: func(db *gorm.DB) error {
+			type Machine struct {
+				UseOSHostname bool `gorm:"default:true"`
+			}
+
+			if err := db.Migrator().AddColumn(&Machine{}, "UseOSHostname"); err != nil {
+				return err
+			}
+
+			return nil
+		},
+		Rollback: nil,
+	}
+}

internal/database/migration/migrations.go

@@ -0,0 +1,27 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+)
+
+func Migrations() []*gormigrate.Migration {
+	var migrations = []*gormigrate.Migration{
+		m202209070900_initial_schema(),
+		m202209251530_add_autoallowips_column(),
+		m202209251532_add_alias_column(),
+		m202229251530_add_alias_column_constraint(),
+		m202210040828_add_derpmap_colum(),
+		m202210070814_add_filesharing_and_servicecollection_columns(),
+		m202210080700_ssh_action_request(),
+		m202211031100_add_authorized_column(),
+		m202212201300_add_user_id_column(),
+		m202212270800_machine_indeces(),
+		m202312271200_account_last_authenticated(),
+		m202312290900_machine_indeces(),
+		m202401061400_machine_indeces(),
+		m202402120800_user_last_authenticated(),
+		m202403130830_json_to_text(),
+		m202502150830_use_hostname(),
+	}
+	return migrations
+}

internal/database/postgres.go

@@ -0,0 +1,63 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"hash/crc32"
+
+	"github.com/hashicorp/go-multierror"
+	"github.com/jsiebens/ionscale/internal/config"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+func newPostgresDB(config *config.Database, g *gorm.Config) (*gorm.DB, dbLock, error) {
+	db, err := gorm.Open(postgres.Open(config.Url), g)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return db, &pgLock{db: db}, nil
+}
+
+type pgLock struct {
+	db *gorm.DB
+}
+
+func (s *pgLock) Lock() error {
+	d, _ := s.db.DB()
+
+	query := `SELECT pg_advisory_lock($1)`
+	id := s.generateAdvisoryLockId()
+	if _, err := d.ExecContext(context.Background(), query, id); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *pgLock) UnlockErr(prevErr error) error {
+	if err := s.unlock(); err != nil {
+		return multierror.Append(prevErr, err)
+	}
+	return prevErr
+}
+
+func (s *pgLock) unlock() error {
+	d, _ := s.db.DB()
+
+	query := `SELECT pg_advisory_unlock($1)`
+	if _, err := d.ExecContext(context.Background(), query, s.generateAdvisoryLockId()); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+const advisoryLockIDSalt uint = 1486364155
+
+func (s *pgLock) generateAdvisoryLockId() string {
+	sum := crc32.ChecksumIEEE([]byte("ionscale_migration"))
+	sum = sum * uint32(advisoryLockIDSalt)
+	return fmt.Sprint(sum)
+}

internal/database/sqlite.go

@@ -0,0 +1,26 @@
+package database
+
+import (
+	"github.com/glebarez/sqlite"
+	"github.com/jsiebens/ionscale/internal/config"
+	"gorm.io/gorm"
+)
+
+func newSqliteDB(config *config.Database, g *gorm.Config) (*gorm.DB, dbLock, error) {
+	db, err := gorm.Open(sqlite.Open(config.Url), g)
+	if err != nil {
+		return nil, nil, err
+	}
+	return db, &sqliteLock{}, nil
+}
+
+type sqliteLock struct {
+}
+
+func (s *sqliteLock) Lock() error {
+	return nil
+}
+
+func (s *sqliteLock) UnlockErr(prevErr error) error {
+	return prevErr
+}

internal/derp/derp.go

@@ -0,0 +1,63 @@
+package derp
+
+import (
+	"encoding/json"
+	"github.com/hashicorp/go-getter"
+	"github.com/hashicorp/go-multierror"
+	"github.com/jsiebens/ionscale/internal/config"
+	"os"
+	"tailscale.com/tailcfg"
+)
+
+func LoadDERPSources(c *config.Config) (*tailcfg.DERPMap, error) {
+	derpMap := &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{},
+	}
+
+	var merr *multierror.Error
+	for _, src := range c.DERP.Sources {
+		dm, err := loadDERPSource(src)
+		if err != nil {
+			merr = multierror.Append(merr, err)
+			continue
+		}
+
+		for id, r := range dm.Regions {
+			derpMap.Regions[id] = r
+		}
+	}
+
+	if !c.DERP.Server.Disabled {
+		dm := c.DefaultDERPMap()
+		for id, r := range dm.Regions {
+			derpMap.Regions[id] = r
+		}
+	}
+
+	return derpMap, merr.ErrorOrNil()
+}
+
+func loadDERPSource(src string) (*tailcfg.DERPMap, error) {
+	temp, err := os.CreateTemp(os.TempDir(), "derp-*.json")
+	if err != nil {
+		return nil, err
+	}
+	defer os.Remove(temp.Name())
+
+	if err := getter.Get(temp.Name(), src, getter.WithMode(getter.ClientModeFile)); err != nil {
+		return nil, err
+	}
+
+	content, err := os.ReadFile(temp.Name())
+	if err != nil {
+		return nil, err
+	}
+
+	var dm tailcfg.DERPMap
+
+	if err := json.Unmarshal(content, &dm); err != nil {
+		return nil, err
+	}
+
+	return &dm, nil
+}

internal/dns/plugin.go

@@ -0,0 +1,124 @@
+package dns
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"github.com/hashicorp/go-plugin"
+	"github.com/jsiebens/ionscale/internal/util"
+	dnsplugin "github.com/jsiebens/libdns-plugin"
+	"github.com/libdns/libdns"
+	"go.uber.org/zap"
+	"os/exec"
+	"sync"
+	"time"
+)
+
+// pluginManager handles plugin lifecycle and resilience
+type pluginManager struct {
+	pluginPath string
+	client     *plugin.Client
+	instance   dnsplugin.Provider
+	lock       sync.RWMutex
+	logger     *zap.Logger
+
+	zone   string
+	config json.RawMessage
+}
+
+// NewPluginManager creates a new plugin manager
+func newPluginManager(pluginPath string, zone string, config json.RawMessage) (*pluginManager, error) {
+	logger := zap.L().Named("dns").With(zap.String("plugin_path", pluginPath))
+
+	p := &pluginManager{
+		pluginPath: pluginPath,
+		logger:     logger,
+		zone:       zone,
+		config:     config,
+	}
+
+	if err := p.ensureRunning(true); err != nil {
+		return nil, err
+	}
+
+	return p, nil
+}
+
+// ensureRunning makes sure the plugin is running
+func (pm *pluginManager) ensureRunning(start bool) error {
+	pm.lock.RLock()
+	running := pm.client != nil && !pm.client.Exited()
+	instance := pm.instance
+	pm.lock.RUnlock()
+
+	if running && instance != nil {
+		return nil
+	}
+
+	// Need to restart
+	pm.lock.Lock()
+	defer pm.lock.Unlock()
+
+	if !start {
+		pm.logger.Info("Restarting DNS plugin")
+	}
+
+	if pm.client != nil {
+		pm.client.Kill()
+	}
+
+	// Create a new client
+	cmd := exec.Command(pm.pluginPath)
+	pm.client = plugin.NewClient(&plugin.ClientConfig{
+		HandshakeConfig: dnsplugin.Handshake,
+		Plugins:         dnsplugin.PluginMap,
+		Cmd:             cmd,
+		AllowedProtocols: []plugin.Protocol{
+			plugin.ProtocolNetRPC,
+			plugin.ProtocolGRPC,
+		},
+		Managed: true,
+		Logger:  util.NewZapAdapter(pm.logger, "dns"),
+	})
+
+	// Connect via RPC
+	rpcClient, err := pm.client.Client()
+	if err != nil {
+		return fmt.Errorf("error creating plugin client: %w", err)
+	}
+
+	// Request the plugin
+	raw, err := rpcClient.Dispense(dnsplugin.ProviderPluginName)
+	if err != nil {
+		return fmt.Errorf("error dispensing plugin: %w", err)
+	}
+
+	// Convert to the interface
+	pm.instance = raw.(dnsplugin.Provider)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	defer cancel()
+
+	if err := pm.instance.Configure(ctx, pm.config); err != nil {
+		return fmt.Errorf("error configuring plugin: %w", err)
+	}
+
+	pm.logger.Info("DNS plugin started")
+
+	return nil
+}
+
+func (pm *pluginManager) SetRecord(ctx context.Context, recordType, recordName, value string) error {
+	if err := pm.ensureRunning(false); err != nil {
+		return err
+	}
+
+	_, err := pm.instance.SetRecords(ctx, pm.zone, []libdns.Record{{
+		Type:  recordType,
+		Name:  libdns.RelativeName(recordName, pm.zone),
+		Value: value,
+		TTL:   1 * time.Minute,
+	}})
+
+	return err
+}

internal/dns/provider.go

@@ -0,0 +1,110 @@
+package dns
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/libdns/azure"
+	"github.com/libdns/cloudflare"
+	"github.com/libdns/digitalocean"
+	"github.com/libdns/googleclouddns"
+	"github.com/libdns/libdns"
+	"github.com/libdns/route53"
+	"go.uber.org/zap"
+	"strings"
+	"time"
+)
+
+var factories = map[string]func() libdns.RecordSetter{
+	"azure":          azureProvider,
+	"cloudflare":     cloudflareProvider,
+	"digitalocean":   digitalOceanProvider,
+	"googleclouddns": googleCloudDNSProvider,
+	"route53":        route53Provider,
+}
+
+type Provider interface {
+	SetRecord(ctx context.Context, recordType, recordName, value string) error
+}
+
+func NewProvider(config config.DNS) (Provider, error) {
+	p := config.Provider
+	if len(p.Zone) == 0 {
+		return nil, nil
+	}
+
+	if p.Name == "" && p.PluginPath == "" {
+		return nil, fmt.Errorf("invalid dns provider configuration, either name or plugin_path should be set")
+	}
+
+	if p.Name != "" && p.PluginPath != "" {
+		return nil, fmt.Errorf("invalid dns provider configuration, only one of name or plugin_path should be set")
+	}
+
+	if !strings.HasSuffix(config.MagicDNSSuffix, p.Zone) {
+		return nil, fmt.Errorf("invalid MagicDNS suffix [%s], not part of zone [%s]", config.MagicDNSSuffix, p.Zone)
+	}
+
+	factory, ok := factories[p.Name]
+	if ok {
+		return newProvider(p.Zone, p.Configuration, factory)
+	}
+
+	return newPluginManager(p.PluginPath, fqdn(p.Zone), p.Configuration)
+}
+
+func newProvider(zone string, values json.RawMessage, factory func() libdns.RecordSetter) (Provider, error) {
+	p := factory()
+	if err := json.Unmarshal(values, p); err != nil {
+		return nil, err
+	}
+	return &externalProvider{zone: fqdn(zone), setter: p}, nil
+}
+
+func azureProvider() libdns.RecordSetter {
+	zap.L().Warn("Builtin azure DNS plugin is deprecated and will be removed in a future release.")
+	return &azure.Provider{}
+}
+
+func cloudflareProvider() libdns.RecordSetter {
+	zap.L().Warn("Builtin cloudflare DNS plugin is deprecated and will be removed in a future release.")
+	return &cloudflare.Provider{}
+}
+
+func digitalOceanProvider() libdns.RecordSetter {
+	zap.L().Warn("Builtin digitalocean DNS plugin is deprecated and will be removed in a future release.")
+	return &digitalocean.Provider{}
+}
+
+func googleCloudDNSProvider() libdns.RecordSetter {
+	zap.L().Warn("Builtin googleclouddns DNS plugin is deprecated and will be removed in a future release.")
+	return &googleclouddns.Provider{}
+}
+
+func route53Provider() libdns.RecordSetter {
+	zap.L().Warn("Builtin route53 DNS plugin is deprecated and will be removed in a future release.")
+	return &route53.Provider{}
+}
+
+type externalProvider struct {
+	zone   string
+	setter libdns.RecordSetter
+}
+
+func (p *externalProvider) SetRecord(ctx context.Context, recordType, recordName, value string) error {
+	_, err := p.setter.SetRecords(ctx, p.zone, []libdns.Record{{
+		Type:  recordType,
+		Name:  libdns.RelativeName(recordName, p.zone),
+		Value: value,
+		TTL:   1 * time.Minute,
+	}})
+	return err
+}
+
+func fqdn(v string) string {
+	if strings.HasSuffix(v, ".") {
+		return v
+	}
+	return fmt.Sprintf("%s.", v)
+}

internal/domain/account.go

@@ -0,0 +1,66 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"github.com/jsiebens/ionscale/internal/util"
+	"gorm.io/gorm"
+	"time"
+)
+
+type AccountRepository interface {
+	GetAccount(ctx context.Context, accountID uint64) (*Account, error)
+	GetOrCreateAccount(ctx context.Context, externalID, loginName string) (*Account, bool, error)
+	SetAccountLastAuthenticated(ctx context.Context, accountID uint64) error
+}
+
+type Account struct {
+	ID         uint64 `gorm:"primary_key"`
+	ExternalID string
+	LoginName  string
+}
+
+func (r *repository) GetOrCreateAccount(ctx context.Context, externalID, loginName string) (*Account, bool, error) {
+	account := &Account{}
+	id := util.NextID()
+
+	tx := r.withContext(ctx).
+		Where(Account{ExternalID: externalID}).
+		Attrs(Account{ID: id, LoginName: loginName}).
+		FirstOrCreate(account)
+
+	if tx.Error != nil {
+		return nil, false, tx.Error
+	}
+
+	return account, account.ID == id, nil
+}
+
+func (r *repository) GetAccount(ctx context.Context, id uint64) (*Account, error) {
+	var account Account
+	tx := r.withContext(ctx).Take(&account, "id = ?", id)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &account, nil
+}
+
+func (r *repository) SetAccountLastAuthenticated(ctx context.Context, accountID uint64) error {
+	now := time.Now().UTC()
+	tx := r.withContext(ctx).
+		Model(Account{}).
+		Where("id = ?", accountID).
+		Updates(map[string]interface{}{"last_authenticated": &now})
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}

internal/domain/acl.go

@@ -1,194 +1,199 @@
 package domain
 
 import (
+	"database/sql/driver"
+	"encoding/json"
 	"fmt"
-	"inet.af/netaddr"
+	"github.com/hashicorp/go-multierror"
+	"github.com/jsiebens/ionscale/pkg/client/ionscale"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+	"net/netip"
+	"reflect"
+	"slices"
+	"sort"
 	"strconv"
 	"strings"
 	"tailscale.com/tailcfg"
 )
 
+const (
+	AutoGroupSelf      = "autogroup:self"
+	AutoGroupMember    = "autogroup:member"
+	AutoGroupMembers   = "autogroup:members"
+	AutoGroupTagged    = "autogroup:tagged"
+	AutoGroupInternet  = "autogroup:internet"
+	AutoGroupDangerAll = "autogroup:danger-all"
+)
+
+type AutoApprovers struct {
+	Routes   map[string][]string `json:"routes,omitempty"`
+	ExitNode []string            `json:"exitNode,omitempty"`
+}
+
 type ACLPolicy struct {
-	Hosts map[string]string `json:"hosts,omitempty"`
-	ACLs  []ACL             `json:"acls"`
+	ionscale.ACLPolicy
 }
 
-type ACL struct {
-	Action string   `json:"action"`
-	Src    []string `json:"src"`
-	Dst    []string `json:"dst"`
-}
-
-func defaultPolicy() ACLPolicy {
-	return ACLPolicy{
-		ACLs: []ACL{
-			{
-				Action: "accept",
-				Src:    []string{"*"},
-				Dst:    []string{"*:*"},
-			},
-		},
+func (a *ACLPolicy) Equal(x *ACLPolicy) bool {
+	if a == nil && x == nil {
+		return true
 	}
-}
-
-type aclEngine struct {
-	policy       *ACLPolicy
-	expandedTags map[string][]string
-}
-
-func IsValidPeer(policy *ACLPolicy, src *Machine, dest *Machine) bool {
-	f := &aclEngine{
-		policy: policy,
+	if (a == nil) != (x == nil) {
+		return false
 	}
-	return f.isValidPeer(src, dest)
+	return reflect.DeepEqual(a, x)
 }
 
-func BuildFilterRules(policy *ACLPolicy, dst *Machine, peers []Machine) []tailcfg.FilterRule {
-	f := &aclEngine{
-		policy: policy,
+func (a ACLPolicy) FindAutoApprovedIPs(routableIPs []netip.Prefix, tags []string, u *User) []netip.Prefix {
+	if a.AutoApprovers == nil || len(routableIPs) == 0 {
+		return nil
 	}
-	return f.build(dst, peers)
-}
 
-func (a *aclEngine) isValidPeer(src *Machine, dest *Machine) bool {
-	for _, acl := range a.policy.ACLs {
-		allDestPorts := a.expandMachineToDstPorts(dest, acl.Dst)
-		if len(allDestPorts) == 0 {
-			continue
+	matches := func(values []string) bool {
+		for _, alias := range values {
+			if alias == u.Name {
+				return true
+			}
+
+			group, ok := a.Groups[alias]
+			if ok {
+				for _, g := range group {
+					if g == u.Name {
+						return true
+					}
+				}
+			}
+
+			if strings.HasPrefix(alias, "tag:") {
+				for _, tag := range tags {
+					if alias == tag {
+						return true
+					}
+				}
+			}
+		}
+		return false
+	}
+
+	isAutoApproved := func(candidate netip.Prefix, approvedIPs []netip.Prefix) bool {
+		for _, approvedIP := range approvedIPs {
+			if candidate.Bits() >= approvedIP.Bits() && approvedIP.Contains(candidate.Masked().Addr()) {
+				return true
+			}
+		}
+		return false
+	}
+
+	var autoApprovedIPs []netip.Prefix
+	for route, autoApprovers := range a.AutoApprovers.Routes {
+		candidate, err := netip.ParsePrefix(route)
+		if err != nil {
+			return nil
 		}
 
-		for _, alias := range acl.Src {
-			if len(a.expandMachineAlias(src, alias, true)) != 0 {
-				return true
+		if matches(autoApprovers) {
+			autoApprovedIPs = append(autoApprovedIPs, candidate)
+		}
+	}
+
+	var result []netip.Prefix
+	for _, c := range routableIPs {
+		if c.Bits() == 0 && matches(a.AutoApprovers.ExitNode) {
+			result = append(result, c)
+		}
+		if isAutoApproved(c, autoApprovedIPs) {
+			result = append(result, c)
+		}
+	}
+
+	return result
+}
+
+func (a ACLPolicy) CheckTagOwners(tags []string, p *User) error {
+	var result *multierror.Error
+	for _, t := range tags {
+		if ok := a.isTagOwner(t, p); !ok {
+			result = multierror.Append(result, fmt.Errorf("tag [%s] is invalid or not permitted", t))
+		}
+	}
+	return result.ErrorOrNil()
+}
+
+func (a ACLPolicy) isTagOwner(tag string, p *User) bool {
+	if p.UserType == UserTypeService {
+		return true
+	}
+	if tagOwners, ok := a.TagOwners[tag]; ok {
+		for _, alias := range tagOwners {
+			if strings.HasPrefix(alias, "group:") {
+				if group, ok := a.Groups[alias]; ok {
+					return slices.Contains(group, p.Name)
+				}
+			} else {
+				if alias == p.Name {
+					return true
+				}
 			}
 		}
 	}
 	return false
 }
 
-func (a *aclEngine) build(dst *Machine, peers []Machine) []tailcfg.FilterRule {
-	var rules []tailcfg.FilterRule
+func (a ACLPolicy) NodeCapabilities(m *Machine) []tailcfg.NodeCapability {
+	var result = &StringSet{}
 
-	for _, acl := range a.policy.ACLs {
-		allDestPorts := a.expandMachineToDstPorts(dst, acl.Dst)
-		if len(allDestPorts) == 0 {
-			continue
-		}
+	matches := func(targets []string) bool {
+		for _, alias := range targets {
+			if alias == "*" {
+				return true
+			}
 
-		var allSrcIPs []string
-		for _, src := range acl.Src {
-			for _, peer := range peers {
-				srcIPs := a.expandMachineAlias(&peer, src, true)
-				allSrcIPs = append(allSrcIPs, srcIPs...)
+			if strings.Contains(alias, "@") && !m.HasTags() && m.HasUser(alias) {
+				return true
+			}
+
+			if strings.HasPrefix(alias, "tag:") && m.HasTag(alias) {
+				return true
+			}
+
+			if strings.HasPrefix(alias, "group:") && !m.HasTags() {
+				for _, u := range a.Groups[alias] {
+					if m.HasUser(u) {
+						return true
+					}
+				}
+			}
+
+			if (alias == AutoGroupMember || alias == AutoGroupMembers) && !m.HasTags() {
+				return true
 			}
 		}
 
-		if len(allSrcIPs) == 0 {
-			allSrcIPs = nil
-		}
-
-		rule := tailcfg.FilterRule{
-			SrcIPs:   allSrcIPs,
-			DstPorts: allDestPorts,
-		}
-
-		rules = append(rules, rule)
+		return false
 	}
 
-	if len(rules) == 0 {
-		return []tailcfg.FilterRule{{}}
+	for _, nodeAddr := range a.NodeAttrs {
+		if matches(nodeAddr.Target) {
+			result.Add(nodeAddr.Attr...)
+		}
 	}
 
-	return rules
+	items := result.Items()
+	caps := make([]tailcfg.NodeCapability, len(items))
+	for i, c := range items {
+		caps[i] = tailcfg.NodeCapability(c)
+	}
+
+	return caps
 }
 
-func (a *aclEngine) expandMachineToDstPorts(m *Machine, ports []string) []tailcfg.NetPortRange {
-	allDestRanges := []tailcfg.NetPortRange{}
-	for _, d := range ports {
-		ranges := a.expandMachineDestToNetPortRanges(m, d)
-		allDestRanges = append(allDestRanges, ranges...)
-	}
-	return allDestRanges
-}
-
-func (a *aclEngine) expandMachineDestToNetPortRanges(m *Machine, dest string) []tailcfg.NetPortRange {
-	tokens := strings.Split(dest, ":")
-	if len(tokens) < 2 || len(tokens) > 3 {
-		return nil
-	}
-
-	var alias string
-	if len(tokens) == 2 {
-		alias = tokens[0]
-	} else {
-		alias = fmt.Sprintf("%s:%s", tokens[0], tokens[1])
-	}
-
-	ports, err := a.expandValuePortToPortRange(tokens[len(tokens)-1])
-	if err != nil {
-		return nil
-	}
-
-	ips := a.expandMachineAlias(m, alias, false)
-	if len(ips) == 0 {
-		return nil
-	}
-
-	dests := []tailcfg.NetPortRange{}
-	for _, d := range ips {
-		for _, p := range ports {
-			pr := tailcfg.NetPortRange{
-				IP:    d,
-				Ports: p,
-			}
-			dests = append(dests, pr)
-		}
-	}
-
-	return dests
-}
-
-func (a *aclEngine) expandMachineAlias(m *Machine, alias string, src bool) []string {
-	if alias == "*" {
-		if alias == "*" {
-			return []string{"*"}
-		}
-	}
-
-	if strings.HasPrefix(alias, "tag:") && m.HasTag(alias[4:]) {
-		return []string{m.IPv4.String(), m.IPv6.String()}
-	}
-
-	if h, ok := a.policy.Hosts[alias]; ok {
-		alias = h
-	}
-
-	if src {
-		ip, err := netaddr.ParseIP(alias)
-		if err == nil && m.HasIP(ip) {
-			return []string{ip.String()}
-		}
-	} else {
-		ip, err := netaddr.ParseIP(alias)
-		if err == nil && m.IsAllowedIP(ip) {
-			return []string{ip.String()}
-		}
-
-		prefix, err := netaddr.ParseIPPrefix(alias)
-		if err == nil && m.IsAllowedIPPrefix(prefix) {
-			return []string{prefix.String()}
-		}
-	}
-
-	return []string{}
-}
-
-func (a *aclEngine) expandValuePortToPortRange(s string) ([]tailcfg.PortRange, error) {
+func (a ACLPolicy) parsePortRanges(s string) ([]tailcfg.PortRange, error) {
 	if s == "*" {
-		return []tailcfg.PortRange{{First: 0, Last: 65535}}, nil
+		return []tailcfg.PortRange{tailcfg.PortRangeAny}, nil
 	}
 
-	ports := []tailcfg.PortRange{}
+	var ports []tailcfg.PortRange
 	for _, p := range strings.Split(s, ",") {
 		rang := strings.Split(p, "-")
 		if len(rang) == 1 {
@@ -219,3 +224,183 @@ func (a *aclEngine) expandValuePortToPortRange(s string) ([]tailcfg.PortRange, e
 	}
 	return ports, nil
 }
+
+func (a ACLPolicy) isGroupMember(group string, m *Machine) bool {
+	if m.HasTags() {
+		return false
+	}
+
+	users, ok := a.Groups[group]
+	if !ok {
+		return false
+	}
+
+	for _, u := range users {
+		if m.HasUser(u) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (i *ACLPolicy) Scan(destination interface{}) error {
+	switch value := destination.(type) {
+	case []byte:
+		return json.Unmarshal(value, i)
+	default:
+		return fmt.Errorf("unexpected data type %T", destination)
+	}
+}
+
+func (i ACLPolicy) Value() (driver.Value, error) {
+	bytes, err := json.Marshal(i)
+	return bytes, err
+}
+
+// GormDataType gorm common data type
+func (ACLPolicy) GormDataType() string {
+	return "json"
+}
+
+// GormDBDataType gorm db data type
+func (ACLPolicy) GormDBDataType(db *gorm.DB, field *schema.Field) string {
+	switch db.Dialector.Name() {
+	case "sqlite":
+		return "JSON"
+	}
+	return ""
+}
+
+const (
+	protocolICMP     = 1   // Internet Control Message
+	protocolIGMP     = 2   // Internet Group Management
+	protocolIPv4     = 4   // IPv4 encapsulation
+	protocolTCP      = 6   // Transmission Control
+	protocolEGP      = 8   // Exterior Gateway Protocol
+	protocolIGP      = 9   // any private interior gateway (used by Cisco for their IGRP)
+	protocolUDP      = 17  // User Datagram
+	protocolGRE      = 47  // Generic Routing Encapsulation
+	protocolESP      = 50  // Encap Security Payload
+	protocolAH       = 51  // Authentication Header
+	protocolIPv6ICMP = 58  // ICMP for IPv6
+	protocolSCTP     = 132 // Stream Control Transmission Protocol
+)
+
+func parseProtocol(protocol string) []int {
+	switch protocol {
+	case "":
+		return nil
+	case "igmp":
+		return []int{protocolIGMP}
+	case "ipv4", "ip-in-ip":
+		return []int{protocolIPv4}
+	case "tcp":
+		return []int{protocolTCP}
+	case "egp":
+		return []int{protocolEGP}
+	case "igp":
+		return []int{protocolIGP}
+	case "udp":
+		return []int{protocolUDP}
+	case "gre":
+		return []int{protocolGRE}
+	case "esp":
+		return []int{protocolESP}
+	case "ah":
+		return []int{protocolAH}
+	case "sctp":
+		return []int{protocolSCTP}
+	case "icmp":
+		return []int{protocolICMP, protocolIPv6ICMP}
+
+	default:
+		n, err := strconv.Atoi(protocol)
+		if err != nil {
+			return nil
+		}
+		return []int{n}
+	}
+}
+
+type StringSet struct {
+	items map[string]bool
+}
+
+func (s *StringSet) Add(t ...string) *StringSet {
+	if s.items == nil {
+		s.items = make(map[string]bool)
+	}
+
+	for _, v := range t {
+		s.items[v] = true
+	}
+
+	return s
+}
+
+func (s *StringSet) Items() []string {
+	items := []string{}
+	for i := range s.items {
+		items = append(items, i)
+	}
+	sort.Strings(items)
+	return items
+}
+
+func (s *StringSet) Empty() bool {
+	return len(s.items) == 0
+}
+
+func autogroupInternetRanges() []string {
+	return []string{
+		"0.0.0.0/5",
+		"8.0.0.0/7",
+		"11.0.0.0/8",
+		"12.0.0.0/6",
+		"16.0.0.0/4",
+		"32.0.0.0/3",
+		"64.0.0.0/3",
+		"96.0.0.0/6",
+		"100.0.0.0/10",
+		"100.128.0.0/9",
+		"101.0.0.0/8",
+		"102.0.0.0/7",
+		"104.0.0.0/5",
+		"112.0.0.0/4",
+		"128.0.0.0/3",
+		"160.0.0.0/5",
+		"168.0.0.0/8",
+		"169.0.0.0/9",
+		"169.128.0.0/10",
+		"169.192.0.0/11",
+		"169.224.0.0/12",
+		"169.240.0.0/13",
+		"169.248.0.0/14",
+		"169.252.0.0/15",
+		"169.255.0.0/16",
+		"170.0.0.0/7",
+		"172.0.0.0/12",
+		"172.32.0.0/11",
+		"172.64.0.0/10",
+		"172.128.0.0/9",
+		"173.0.0.0/8",
+		"174.0.0.0/7",
+		"176.0.0.0/4",
+		"192.0.0.0/9",
+		"192.128.0.0/11",
+		"192.160.0.0/13",
+		"192.169.0.0/16",
+		"192.170.0.0/15",
+		"192.172.0.0/14",
+		"192.176.0.0/12",
+		"192.192.0.0/10",
+		"193.0.0.0/8",
+		"194.0.0.0/7",
+		"196.0.0.0/6",
+		"200.0.0.0/5",
+		"208.0.0.0/4",
+		"224.0.0.0/3",
+		"2000::/3",
+	}
+}

internal/domain/acl_filter_rules.go

@@ -0,0 +1,397 @@
+package domain
+
+import (
+	"fmt"
+	"github.com/jsiebens/ionscale/pkg/client/ionscale"
+	"net/netip"
+	"strings"
+	"tailscale.com/tailcfg"
+)
+
+func (a ACLPolicy) IsValidPeer(src *Machine, dest *Machine) bool {
+	if !src.HasTags() && !dest.HasTags() && dest.HasUser(src.User.Name) {
+		return true
+	}
+
+	for _, acl := range a.ACLs {
+		selfDestPorts, allDestPorts := a.translateDestinationAliasesToMachineNetPortRanges(acl.Destination, dest)
+		if len(selfDestPorts) != 0 {
+			for _, alias := range acl.Source {
+				if len(a.translateSourceAliasToMachineIPs(alias, src, &dest.User)) != 0 {
+					return true
+				}
+			}
+		}
+		if len(allDestPorts) != 0 {
+			for _, alias := range acl.Source {
+				if len(a.translateSourceAliasToMachineIPs(alias, src, nil)) != 0 {
+					return true
+				}
+			}
+		}
+	}
+
+	for _, grant := range a.Grants {
+		selfIps, otherIps := a.translateDestinationAliasesToMachineIPs(grant.Destination, dest)
+		if len(selfIps) != 0 {
+			for _, alias := range grant.Source {
+				if len(a.translateSourceAliasToMachineIPs(alias, src, &dest.User)) != 0 {
+					return true
+				}
+			}
+		}
+		if len(otherIps) != 0 {
+			for _, alias := range grant.Source {
+				if len(a.translateSourceAliasToMachineIPs(alias, src, nil)) != 0 {
+					return true
+				}
+			}
+		}
+	}
+
+	for _, ssh := range a.SSH {
+		selfIps, otherIps := a.translateDestinationAliasesToMachineIPs(ssh.Recorder, dest)
+		if len(selfIps) != 0 {
+			for _, alias := range ssh.Destination {
+				if len(a.translateSourceAliasToMachineIPs(alias, src, &dest.User)) != 0 {
+					return true
+				}
+			}
+		}
+		if len(otherIps) != 0 {
+			for _, alias := range ssh.Destination {
+				if len(a.translateSourceAliasToMachineIPs(alias, src, nil)) != 0 {
+					return true
+				}
+			}
+		}
+	}
+
+	return false
+}
+
+func (a ACLPolicy) BuildFilterRules(peers []Machine, dst *Machine) []tailcfg.FilterRule {
+	var rules = make([]tailcfg.FilterRule, 0)
+
+	matchSourceAndAppendRule := func(rules []tailcfg.FilterRule, aliases []string, preparedRules []tailcfg.FilterRule, u *User) []tailcfg.FilterRule {
+		if len(preparedRules) == 0 {
+			return rules
+		}
+
+		var allSrcIPsSet = &StringSet{}
+		for _, alias := range aliases {
+			for _, peer := range peers {
+				allSrcIPsSet.Add(a.translateSourceAliasToMachineIPs(alias, &peer, u)...)
+			}
+		}
+
+		if allSrcIPsSet.Empty() {
+			return rules
+		}
+
+		allSrcIPs := allSrcIPsSet.Items()
+
+		if len(allSrcIPs) == 0 {
+			return rules
+		}
+
+		for _, pr := range preparedRules {
+			rules = append(rules, tailcfg.FilterRule{
+				SrcIPs:   allSrcIPs,
+				DstPorts: pr.DstPorts,
+				IPProto:  pr.IPProto,
+				CapGrant: pr.CapGrant,
+			})
+		}
+
+		return rules
+	}
+
+	for _, acl := range a.ACLs {
+		self, other := a.prepareFilterRulesFromACL(dst, acl)
+		rules = matchSourceAndAppendRule(rules, acl.Source, self, &dst.User)
+		rules = matchSourceAndAppendRule(rules, acl.Source, other, nil)
+	}
+
+	for _, acl := range a.Grants {
+		self, other := a.prepareFilterRulesFromGrant(dst, acl)
+		rules = matchSourceAndAppendRule(rules, acl.Source, self, &dst.User)
+		rules = matchSourceAndAppendRule(rules, acl.Source, other, nil)
+	}
+
+	for _, acl := range a.SSH {
+		ssh := a.prepareFilterRulesFromSSH(dst, acl)
+		rules = matchSourceAndAppendRule(rules, acl.Destination, ssh, nil)
+	}
+
+	return rules
+}
+
+func normalizeSSHRecordersToDestinationAliases(recorders []string) []string {
+	recorderAliases := make([]string, 0)
+	for _, alias := range recorders {
+		if strings.HasPrefix(alias, "tag:") {
+			recorderAliases = append(recorderAliases, fmt.Sprintf("%s:80", alias))
+		}
+	}
+	return recorderAliases
+}
+
+func (a ACLPolicy) prepareFilterRulesFromSSH(candidate *Machine, entry ionscale.ACLSSH) []tailcfg.FilterRule {
+	_, otherDstPorts := a.translateDestinationAliasesToMachineNetPortRanges(normalizeSSHRecordersToDestinationAliases(entry.Recorder), candidate)
+
+	var otherFilterRules []tailcfg.FilterRule
+
+	if len(otherDstPorts) != 0 {
+		otherFilterRules = append(otherFilterRules, tailcfg.FilterRule{IPProto: []int{protocolTCP}, DstPorts: otherDstPorts})
+	}
+
+	return otherFilterRules
+}
+
+func (a ACLPolicy) prepareFilterRulesFromACL(candidate *Machine, acl ionscale.ACLEntry) ([]tailcfg.FilterRule, []tailcfg.FilterRule) {
+	proto := parseProtocol(acl.Protocol)
+
+	selfDstPorts, otherDstPorts := a.translateDestinationAliasesToMachineNetPortRanges(acl.Destination, candidate)
+
+	var selfFilterRules []tailcfg.FilterRule
+	var otherFilterRules []tailcfg.FilterRule
+
+	if len(selfDstPorts) != 0 {
+		selfFilterRules = append(selfFilterRules, tailcfg.FilterRule{IPProto: proto, DstPorts: selfDstPorts})
+	}
+
+	if len(otherDstPorts) != 0 {
+		otherFilterRules = append(otherFilterRules, tailcfg.FilterRule{IPProto: proto, DstPorts: otherDstPorts})
+	}
+
+	return selfFilterRules, otherFilterRules
+}
+
+func (a ACLPolicy) prepareFilterRulesFromGrant(candidate *Machine, grant ionscale.ACLGrant) ([]tailcfg.FilterRule, []tailcfg.FilterRule) {
+	selfIPs, otherIPs := a.translateDestinationAliasesToMachineIPs(grant.Destination, candidate)
+
+	var selfFilterRules []tailcfg.FilterRule
+	var otherFilterRules []tailcfg.FilterRule
+
+	for _, ip := range grant.IP {
+		if len(selfIPs) != 0 {
+			ranges := make([]tailcfg.NetPortRange, len(selfIPs))
+			for i, s := range selfIPs {
+				ranges[i] = tailcfg.NetPortRange{IP: s, Ports: ip.Ports}
+			}
+
+			rule := tailcfg.FilterRule{DstPorts: ranges}
+			if ip.Proto != 0 {
+				rule.IPProto = []int{ip.Proto}
+			}
+
+			selfFilterRules = append(selfFilterRules, rule)
+		}
+
+		if len(otherIPs) != 0 {
+			ranges := make([]tailcfg.NetPortRange, len(otherIPs))
+			for i, s := range otherIPs {
+				ranges[i] = tailcfg.NetPortRange{IP: s, Ports: ip.Ports}
+			}
+
+			rule := tailcfg.FilterRule{DstPorts: ranges}
+			if ip.Proto != 0 {
+				rule.IPProto = []int{ip.Proto}
+			}
+
+			otherFilterRules = append(otherFilterRules, rule)
+		}
+	}
+
+	if len(grant.App) != 0 {
+		selfPrefixes, otherPrefixes := appGrantDstIpsToPrefixes(candidate, selfIPs, otherIPs)
+		if len(selfPrefixes) != 0 {
+			rule := tailcfg.FilterRule{CapGrant: []tailcfg.CapGrant{{Dsts: selfPrefixes, CapMap: grant.App}}}
+			selfFilterRules = append(selfFilterRules, rule)
+		}
+
+		if len(otherPrefixes) != 0 {
+			rule := tailcfg.FilterRule{CapGrant: []tailcfg.CapGrant{{Dsts: otherPrefixes, CapMap: grant.App}}}
+			otherFilterRules = append(otherFilterRules, rule)
+		}
+	}
+
+	return selfFilterRules, otherFilterRules
+}
+
+func appGrantDstIpsToPrefixes(m *Machine, self []string, other []string) ([]netip.Prefix, []netip.Prefix) {
+	translate := func(ips []string) []netip.Prefix {
+		var prefixes []netip.Prefix
+		for _, ip := range ips {
+			if ip == "*" {
+				prefixes = append(prefixes, netip.PrefixFrom(*m.IPv4.Addr, 32))
+				prefixes = append(prefixes, netip.PrefixFrom(*m.IPv6.Addr, 128))
+			} else {
+				addr, err := netip.ParseAddr(ip)
+				if err == nil && m.HasIP(addr) {
+					if addr.Is4() {
+						prefixes = append(prefixes, netip.PrefixFrom(addr, 32))
+					} else {
+						prefixes = append(prefixes, netip.PrefixFrom(addr, 128))
+					}
+				}
+			}
+		}
+		return prefixes
+	}
+
+	return translate(self), translate(other)
+}
+
+func (a ACLPolicy) translateDestinationAliasesToMachineIPs(aliases []string, m *Machine) ([]string, []string) {
+	var self = &StringSet{}
+	var other = &StringSet{}
+	for _, alias := range aliases {
+		ips := a.translateDestinationAliasToMachineIPs(alias, m)
+		if alias == AutoGroupSelf {
+			self.Add(ips...)
+		} else {
+			other.Add(ips...)
+		}
+	}
+	return self.Items(), other.Items()
+}
+
+func (a ACLPolicy) translateDestinationAliasesToMachineNetPortRanges(aliases []string, m *Machine) ([]tailcfg.NetPortRange, []tailcfg.NetPortRange) {
+	var self []tailcfg.NetPortRange
+	var other []tailcfg.NetPortRange
+	for _, alias := range aliases {
+		ranges := a.translationDestinationAliasToMachineNetPortRanges(alias, m)
+		if strings.HasPrefix(alias, AutoGroupSelf) {
+			self = append(self, ranges...)
+		} else {
+			other = append(other, ranges...)
+		}
+	}
+	return self, other
+}
+
+func (a ACLPolicy) translationDestinationAliasToMachineNetPortRanges(alias string, m *Machine) []tailcfg.NetPortRange {
+	lastInd := strings.LastIndex(alias, ":")
+	if lastInd == -1 {
+		return nil
+	}
+
+	ports := alias[lastInd+1:]
+	alias = alias[:lastInd]
+
+	portRanges, err := a.parsePortRanges(ports)
+	if err != nil {
+		return nil
+	}
+
+	ips := a.translateDestinationAliasToMachineIPs(alias, m)
+	if len(ips) == 0 {
+		return nil
+	}
+
+	var netPortRanges []tailcfg.NetPortRange
+	for _, d := range ips {
+		for _, p := range portRanges {
+			pr := tailcfg.NetPortRange{
+				IP:    d,
+				Ports: p,
+			}
+			netPortRanges = append(netPortRanges, pr)
+		}
+	}
+
+	return netPortRanges
+}
+
+func (a ACLPolicy) translateDestinationAliasToMachineIPs(alias string, m *Machine) []string {
+	f := func(alias string, m *Machine) []string {
+		ip, err := netip.ParseAddr(alias)
+		if err == nil && m.IsAllowedIP(ip) {
+			return []string{ip.String()}
+		}
+
+		prefix, err := netip.ParsePrefix(alias)
+		if err == nil && m.IsAllowedIPPrefix(prefix) {
+			return []string{prefix.String()}
+		}
+
+		return make([]string, 0)
+	}
+
+	if alias == "*" {
+		return []string{"*"}
+	}
+
+	return a.translateAliasToMachineIPs(alias, m, f)
+}
+
+func (a ACLPolicy) translateSourceAliasToMachineIPs(alias string, m *Machine, u *User) []string {
+	f := func(alias string, m *Machine) []string {
+		ip, err := netip.ParseAddr(alias)
+		if err == nil && m.HasIP(ip) {
+			return []string{ip.String()}
+		}
+
+		return make([]string, 0)
+	}
+
+	if u != nil && m.HasTags() {
+		return []string{}
+	}
+
+	if u != nil && !m.HasUser(u.Name) {
+		return []string{}
+	}
+
+	if alias == "*" {
+		return append(m.IPs(), m.AllowedPrefixes()...)
+	}
+
+	if alias == AutoGroupDangerAll {
+		return []string{"0.0.0.0/0", "::/0"}
+	}
+
+	return a.translateAliasToMachineIPs(alias, m, f)
+}
+
+func (a ACLPolicy) translateAliasToMachineIPs(alias string, m *Machine, f func(string, *Machine) []string) []string {
+	if alias == AutoGroupMember || alias == AutoGroupMembers || alias == AutoGroupSelf {
+		if !m.HasTags() {
+			return m.IPs()
+		} else {
+			return []string{}
+		}
+	}
+
+	if alias == AutoGroupTagged {
+		if m.HasTags() {
+			return m.IPs()
+		} else {
+			return []string{}
+		}
+	}
+
+	if alias == AutoGroupInternet && m.IsExitNode() {
+		return autogroupInternetRanges()
+	}
+
+	if strings.Contains(alias, "@") && !m.HasTags() && m.HasUser(alias) {
+		return m.IPs()
+	}
+
+	if strings.HasPrefix(alias, "group:") && !m.HasTags() && a.isGroupMember(alias, m) {
+		return m.IPs()
+	}
+
+	if strings.HasPrefix(alias, "tag:") && m.HasTag(alias) {
+		return m.IPs()
+	}
+
+	if h, ok := a.Hosts[alias]; ok {
+		alias = h
+	}
+
+	return f(alias, m)
+}

internal/domain/acl_ssh_policy.go

@@ -0,0 +1,187 @@
+package domain
+
+import (
+	"github.com/jsiebens/ionscale/pkg/client/ionscale"
+	"net/netip"
+	"strings"
+	"tailscale.com/tailcfg"
+)
+
+func (a ACLPolicy) BuildSSHPolicy(srcs []Machine, dst *Machine) *tailcfg.SSHPolicy {
+	var rules []*tailcfg.SSHRule
+
+	expandSrcAliases := func(aliases []string, action string, u *User) []*tailcfg.SSHPrincipal {
+		var allSrcIPsSet = &StringSet{}
+		for _, alias := range aliases {
+			if strings.HasPrefix(alias, "tag:") && action == "check" {
+				continue
+			}
+			for _, src := range srcs {
+				srcIPs := a.expandSSHSrcAlias(&src, alias, u)
+				allSrcIPsSet.Add(srcIPs...)
+			}
+		}
+
+		var result = []*tailcfg.SSHPrincipal{}
+		for _, i := range allSrcIPsSet.Items() {
+			result = append(result, &tailcfg.SSHPrincipal{NodeIP: i})
+		}
+
+		return result
+	}
+
+	expandRecorderAliases := func(aliases []string) []netip.AddrPort {
+		result := make([]netip.AddrPort, 0)
+
+		for _, alias := range aliases {
+			for _, src := range append(srcs, *dst) {
+				if src.HasTag(alias) {
+					result = append(result, netip.AddrPortFrom(*src.IPv4.Addr, 80))
+				}
+			}
+		}
+
+		return result
+	}
+
+	for _, rule := range a.SSH {
+		if rule.Action != "accept" && rule.Action != "check" {
+			continue
+		}
+
+		var action = &tailcfg.SSHAction{
+			Accept:                   true,
+			AllowAgentForwarding:     true,
+			AllowLocalPortForwarding: true,
+		}
+
+		if rule.Action == "check" {
+			action = &tailcfg.SSHAction{
+				HoldAndDelegate: "https://unused/machine/ssh/action/$SRC_NODE_ID/to/$DST_NODE_ID/" + safeCheckPeriod(rule.CheckPeriod),
+			}
+		}
+
+		if len(rule.Recorder) != 0 {
+			action.Recorders = expandRecorderAliases(rule.Recorder)
+			action.Message = "# This session is being recorded.\n"
+			if rule.EnforceRecorder {
+				action.OnRecordingFailure = &tailcfg.SSHRecorderFailureAction{
+					RejectSessionWithMessage:    "# Session rejected: failed to start session recording.",
+					TerminateSessionWithMessage: "# Session terminated: failed to record session.",
+				}
+			}
+		}
+
+		selfUsers, otherUsers := a.expandSSHDstToSSHUsers(dst, rule)
+
+		if len(selfUsers) != 0 {
+			principals := expandSrcAliases(rule.Source, rule.Action, &dst.User)
+			if len(principals) != 0 {
+				rules = append(rules, &tailcfg.SSHRule{
+					Principals: principals,
+					SSHUsers:   selfUsers,
+					Action:     action,
+				})
+			}
+		}
+
+		if len(otherUsers) != 0 {
+			principals := expandSrcAliases(rule.Source, rule.Action, nil)
+			if len(principals) != 0 {
+				rules = append(rules, &tailcfg.SSHRule{
+					Principals: principals,
+					SSHUsers:   otherUsers,
+					Action:     action,
+				})
+			}
+		}
+	}
+
+	return &tailcfg.SSHPolicy{Rules: rules}
+}
+
+func (a ACLPolicy) expandSSHSrcAlias(m *Machine, alias string, dstUser *User) []string {
+	if dstUser != nil {
+		if !m.HasUser(dstUser.Name) || m.HasTags() {
+			return []string{}
+		}
+
+		if alias == AutoGroupMember || alias == AutoGroupMembers {
+			return m.IPs()
+		}
+
+		if strings.Contains(alias, "@") && m.HasUser(alias) {
+			return m.IPs()
+		}
+
+		if strings.HasPrefix(alias, "group:") && a.isGroupMember(alias, m) {
+			return m.IPs()
+		}
+
+		return []string{}
+	}
+
+	if (alias == AutoGroupMember || alias == AutoGroupMembers) && !m.HasTags() {
+		return m.IPs()
+	}
+
+	if strings.Contains(alias, "@") && !m.HasTags() && m.HasUser(alias) {
+		return m.IPs()
+	}
+
+	if strings.HasPrefix(alias, "group:") && !m.HasTags() && a.isGroupMember(alias, m) {
+		return m.IPs()
+	}
+
+	if strings.HasPrefix(alias, "tag:") && m.HasTag(alias) {
+		return m.IPs()
+	}
+
+	return []string{}
+}
+
+func (a ACLPolicy) expandSSHDstToSSHUsers(m *Machine, rule ionscale.ACLSSH) (map[string]string, map[string]string) {
+	users := buildSSHUsers(rule.Users)
+
+	var selfUsers map[string]string
+	var otherUsers map[string]string
+
+	for _, d := range rule.Destination {
+		if strings.HasPrefix(d, "tag:") && m.HasTag(d) {
+			otherUsers = users
+		}
+
+		if m.HasUser(d) || d == AutoGroupSelf {
+			selfUsers = users
+		}
+	}
+
+	return selfUsers, otherUsers
+}
+
+func buildSSHUsers(users []string) map[string]string {
+	var autogroupNonRoot = false
+	m := make(map[string]string)
+	for _, u := range users {
+		if u == "autogroup:nonroot" {
+			m["*"] = "="
+			autogroupNonRoot = true
+		} else {
+			m[u] = u
+		}
+	}
+
+	// disable root when autogroup:nonroot is used and root is not explicitly enabled
+	if _, exists := m["root"]; !exists && autogroupNonRoot {
+		m["root"] = ""
+	}
+
+	return m
+}
+
+func safeCheckPeriod(period string) string {
+	if period == "" {
+		return "always"
+	}
+	return period
+}

internal/domain/acl_ssh_policy_test.go

@@ -0,0 +1,399 @@
+package domain
+
+import (
+	"github.com/jsiebens/ionscale/pkg/client/ionscale"
+	"github.com/stretchr/testify/assert"
+	"tailscale.com/tailcfg"
+	"testing"
+)
+
+func TestACLPolicy_BuildSSHPolicy_(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"autogroup:members"},
+					Destination: []string{"autogroup:self"},
+					Users:       []string{"autogroup:nonroot"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: []*tailcfg.SSHPrincipal{
+				{NodeIP: p1.IPv4.String()},
+				{NodeIP: p1.IPv6.String()},
+			},
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithGroup(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			Groups: map[string][]string{
+				"group:sre": {
+					"john@example.com",
+				},
+			},
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"group:sre"},
+					Destination: []string{"tag:web"},
+					Users:       []string{"autogroup:nonroot", "root"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: []*tailcfg.SSHPrincipal{
+				{NodeIP: p1.IPv4.String()},
+				{NodeIP: p1.IPv6.String()},
+			},
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "root",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithMatchingUsers(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"john@example.com"},
+					Destination: []string{"john@example.com"},
+					Users:       []string{"autogroup:nonroot", "root"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1),
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "root",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithMatchingUsersInGroup(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			Groups: map[string][]string{
+				"group:sre": {"jane@example.com", "john@example.com"},
+			},
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"group:sre"},
+					Destination: []string{"john@example.com"},
+					Users:       []string{"autogroup:nonroot", "root"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1),
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "root",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithNoMatchingUsers(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"jane@example.com"},
+					Destination: []string{"john@example.com"},
+					Users:       []string{"autogroup:nonroot", "root"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithTags(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("nick@example.com")
+	p3 := createMachine("nick@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"john@example.com", "tag:web"},
+					Destination: []string{"tag:web"},
+					Users:       []string{"ubuntu"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2, *p3}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1, *p3),
+			SSHUsers: map[string]string{
+				"ubuntu": "ubuntu",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithTagsInDstAndAutogroupMemberInSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("nick@example.com")
+	p3 := createMachine("nick@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"autogroup:members"},
+					Destination: []string{"tag:web"},
+					Users:       []string{"ubuntu"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2, *p3}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1, *p2),
+			SSHUsers: map[string]string{
+				"ubuntu": "ubuntu",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithUserInDstAndNonMatchingSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"jane@example.com"},
+					Destination: []string{"john@example.com"},
+					Users:       []string{"autogroup:nonroot"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithUserInDstAndAutogroupMembersSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"autogroup:members"},
+					Destination: []string{"john@example.com"},
+					Users:       []string{"autogroup:nonroot"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1),
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithAutogroupSelfAndTagSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "accept",
+					Source:      []string{"tag:web"},
+					Destination: []string{"autogroup:self"},
+					Users:       []string{"autogroup:nonroot"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithTagsAndActionCheck(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		ionscale.ACLPolicy{
+			SSH: []ionscale.ACLSSH{
+				{
+					Action:      "check",
+					Source:      []string{"tag:web"},
+					Destination: []string{"tag:web"},
+					Users:       []string{"autogroup:nonroot"},
+				},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func sshPrincipalsFromMachines(machines ...Machine) []*tailcfg.SSHPrincipal {
+	x := StringSet{}
+	for _, m := range machines {
+		x.Add(m.IPv4.String(), m.IPv6.String())
+	}
+
+	var result = []*tailcfg.SSHPrincipal{}
+
+	for _, i := range x.Items() {
+		result = append(result, &tailcfg.SSHPrincipal{NodeIP: i})
+	}
+
+	return result
+}

internal/domain/api_key.go

@@ -0,0 +1,110 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/util"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"strings"
+	"time"
+)
+
+func CreateApiKey(tailnet *Tailnet, user *User, expiresAt *time.Time) (string, *ApiKey) {
+	key := util.RandStringBytes(12)
+	pwd := util.RandStringBytes(22)
+	value := fmt.Sprintf("%s_%s", key, pwd)
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
+	if err != nil {
+		panic(err)
+	}
+
+	return value, &ApiKey{
+		ID:        util.NextID(),
+		Key:       key,
+		Hash:      string(hash),
+		CreatedAt: time.Now().UTC(),
+		ExpiresAt: expiresAt,
+
+		TailnetID: tailnet.ID,
+		UserID:    user.ID,
+	}
+}
+
+type ApiKeyRepository interface {
+	SaveApiKey(ctx context.Context, key *ApiKey) error
+	LoadApiKey(ctx context.Context, key string) (*ApiKey, error)
+	DeleteApiKeysByTailnet(ctx context.Context, tailnetID uint64) error
+	DeleteApiKeysByUser(ctx context.Context, userID uint64) error
+}
+
+type ApiKey struct {
+	ID   uint64 `gorm:"primary_key"`
+	Key  string
+	Hash string
+
+	CreatedAt time.Time
+	ExpiresAt *time.Time
+
+	TailnetID uint64
+	Tailnet   Tailnet
+
+	UserID uint64
+	User   User
+}
+
+func (r *repository) SaveApiKey(ctx context.Context, key *ApiKey) error {
+	tx := r.withContext(ctx).Save(key)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}
+
+func (r *repository) LoadApiKey(ctx context.Context, key string) (*ApiKey, error) {
+	split := strings.Split(key, "_")
+	if len(split) != 2 {
+		return nil, nil
+	}
+
+	var m ApiKey
+	tx := r.withContext(ctx).Preload("User").Preload("Tailnet").Take(&m, "key = ?", split[0])
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(m.Hash), []byte(split[1])); err != nil {
+		return nil, nil
+	}
+
+	if m.ExpiresAt != nil && !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
+		return nil, nil
+	}
+
+	return &m, nil
+}
+
+func (r *repository) DeleteApiKeysByTailnet(ctx context.Context, tailnetID uint64) error {
+	tx := r.withContext(ctx).
+		Where("tailnet_id = ?", tailnetID).
+		Delete(&ApiKey{TailnetID: tailnetID})
+
+	return tx.Error
+}
+
+func (r *repository) DeleteApiKeysByUser(ctx context.Context, userID uint64) error {
+	tx := r.withContext(ctx).
+		Where("user_id = ?", userID).
+		Delete(&ApiKey{UserID: userID})
+
+	return tx.Error
+}

internal/domain/auth_key.go

@@ -11,7 +11,7 @@ import (
 	"time"
 )
 
-func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expiresAt *time.Time) (string, *AuthKey) {
+func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, preAuthorized bool, tags Tags, expiresAt *time.Time) (string, *AuthKey) {
 	key := util.RandStringBytes(12)
 	pwd := util.RandStringBytes(22)
 	value := fmt.Sprintf("%s_%s", key, pwd)
@@ -22,25 +22,38 @@ func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expi
 	}
 
 	return value, &AuthKey{
-		ID:        util.NextID(),
-		Key:       key,
-		Hash:      string(hash),
-		Ephemeral: ephemeral,
-		Tags:      tags,
-		CreatedAt: time.Now().UTC(),
-		ExpiresAt: expiresAt,
+		ID:            util.NextID(),
+		Key:           key,
+		Hash:          string(hash),
+		Ephemeral:     ephemeral,
+		PreAuthorized: preAuthorized,
+		Tags:          tags,
+		CreatedAt:     time.Now().UTC(),
+		ExpiresAt:     expiresAt,
 
 		TailnetID: tailnet.ID,
 		UserID:    user.ID,
 	}
 }
 
+type AuthKeyRepository interface {
+	GetAuthKey(ctx context.Context, id uint64) (*AuthKey, error)
+	SaveAuthKey(ctx context.Context, key *AuthKey) error
+	DeleteAuthKey(ctx context.Context, id uint64) (bool, error)
+	DeleteAuthKeysByTailnet(ctx context.Context, tailnetID uint64) error
+	DeleteAuthKeysByUser(ctx context.Context, userID uint64) error
+	ListAuthKeys(ctx context.Context, tailnetID uint64) ([]AuthKey, error)
+	ListAuthKeysByTailnetAndUser(ctx context.Context, tailnetID, userID uint64) ([]AuthKey, error)
+	LoadAuthKey(ctx context.Context, key string) (*AuthKey, error)
+}
+
 type AuthKey struct {
-	ID        uint64 `gorm:"primary_key;autoIncrement:false"`
-	Key       string `gorm:"type:varchar(64);unique_index"`
-	Hash      string
-	Ephemeral bool
-	Tags      Tags
+	ID            uint64 `gorm:"primary_key"`
+	Key           string
+	Hash          string
+	Ephemeral     bool
+	PreAuthorized bool
+	Tags          Tags
 
 	CreatedAt time.Time
 	ExpiresAt *time.Time
@@ -52,6 +65,24 @@ type AuthKey struct {
 	User   User
 }
 
+func (r *repository) GetAuthKey(ctx context.Context, authKeyId uint64) (*AuthKey, error) {
+	var t AuthKey
+	tx := r.withContext(ctx).
+		Preload("User").
+		Preload("Tailnet").
+		Take(&t, "id = ?", authKeyId)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &t, nil
+}
+
 func (r *repository) SaveAuthKey(ctx context.Context, key *AuthKey) error {
 	tx := r.withContext(ctx).Save(key)
 
@@ -75,6 +106,14 @@ func (r *repository) DeleteAuthKeysByTailnet(ctx context.Context, tailnetID uint
 	return tx.Error
 }
 
+func (r *repository) DeleteAuthKeysByUser(ctx context.Context, userID uint64) error {
+	tx := r.withContext(ctx).
+		Where("user_id = ?", userID).
+		Delete(&AuthKey{UserID: userID})
+
+	return tx.Error
+}
+
 func (r *repository) ListAuthKeys(ctx context.Context, tailnetID uint64) ([]AuthKey, error) {
 	var authKeys = []AuthKey{}
 	tx := (r.withContext(ctx).
@@ -88,6 +127,19 @@ func (r *repository) ListAuthKeys(ctx context.Context, tailnetID uint64) ([]Auth
 	return authKeys, nil
 }
 
+func (r *repository) ListAuthKeysByTailnetAndUser(ctx context.Context, tailnetID, userID uint64) ([]AuthKey, error) {
+	var authKeys = []AuthKey{}
+	tx := (r.withContext(ctx).
+		Preload("User").
+		Preload("Tailnet")).
+		Where("tailnet_id = ? and user_id = ?", tailnetID, userID).
+		Find(&authKeys)
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+	return authKeys, nil
+}
+
 func (r *repository) LoadAuthKey(ctx context.Context, key string) (*AuthKey, error) {
 	split := strings.Split(key, "_")
 	if len(split) != 2 {
@@ -95,7 +147,7 @@ func (r *repository) LoadAuthKey(ctx context.Context, key string) (*AuthKey, err
 	}
 
 	var m AuthKey
-	tx := r.withContext(ctx).Preload("User").Preload("Tailnet").First(&m, "key = ?", split[0])
+	tx := r.withContext(ctx).Preload("User").Preload("Tailnet").Take(&m, "key = ?", split[0])
 
 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -109,7 +161,7 @@ func (r *repository) LoadAuthKey(ctx context.Context, key string) (*AuthKey, err
 		return nil, nil
 	}
 
-	if !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
+	if m.ExpiresAt != nil && !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
 		return nil, nil
 	}
 

internal/domain/authentication_request.go

@@ -0,0 +1,52 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"gorm.io/gorm"
+	"time"
+)
+
+type AuthenticationRequestRepository interface {
+	SaveAuthenticationRequest(ctx context.Context, session *AuthenticationRequest) error
+	GetAuthenticationRequest(ctx context.Context, key string) (*AuthenticationRequest, error)
+	DeleteAuthenticationRequest(ctx context.Context, key string) error
+}
+
+type AuthenticationRequest struct {
+	Key       string `gorm:"primary_key"`
+	Token     string
+	TailnetID *uint64
+	Error     string
+	CreatedAt time.Time
+}
+
+func (r *repository) SaveAuthenticationRequest(ctx context.Context, session *AuthenticationRequest) error {
+	tx := r.withContext(ctx).Save(session)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}
+
+func (r *repository) GetAuthenticationRequest(ctx context.Context, key string) (*AuthenticationRequest, error) {
+	var m AuthenticationRequest
+	tx := r.withContext(ctx).Take(&m, "key = ?", key)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &m, nil
+}
+
+func (r *repository) DeleteAuthenticationRequest(ctx context.Context, key string) error {
+	tx := r.withContext(ctx).Delete(&AuthenticationRequest{Key: key})
+	return tx.Error
+}

internal/domain/datatypes.go

@@ -0,0 +1,87 @@
+package domain
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+	"github.com/tailscale/hujson"
+)
+
+func NewHuJSON[T any](t *T) HuJSON[T] {
+	marshal, _ := json.Marshal(t)
+	return HuJSON[T]{
+		v: string(marshal),
+		t: t,
+	}
+}
+
+func ParseHuJson[T any](v string) (*HuJSON[T], error) {
+	ast, err := hujson.Parse([]byte(v))
+	if err != nil {
+		return nil, err
+	}
+
+	ast.Format()
+	formatted := string(ast.Pack())
+	ast.Standardize()
+
+	t := new(T)
+	if err := json.Unmarshal(ast.Pack(), t); err != nil {
+		return nil, err
+	}
+	return &HuJSON[T]{v: formatted, t: t}, nil
+}
+
+type HuJSON[T any] struct {
+	v string
+	t *T
+}
+
+func (h *HuJSON[T]) Get() *T {
+	return h.t
+}
+
+func (h *HuJSON[T]) String() string {
+	return h.v
+}
+
+func (i *HuJSON[T]) Equal(x *HuJSON[T]) bool {
+	if i == nil && x == nil {
+		return true
+	}
+	if (i == nil) != (x == nil) {
+		return false
+	}
+	return i.v == x.v
+}
+
+func (h HuJSON[T]) Value() (driver.Value, error) {
+	if len(h.v) == 0 {
+		return nil, nil
+	}
+	return h.v, nil
+}
+
+func (h *HuJSON[T]) Scan(destination interface{}) error {
+	var v string
+	switch value := destination.(type) {
+	case string:
+		v = value
+	case []byte:
+		v = string(value)
+	default:
+		return fmt.Errorf("unexpected data type %T", destination)
+	}
+
+	next, err := hujson.Standardize([]byte(v))
+	if err != nil {
+		return err
+	}
+	var n = new(T)
+	if err := json.Unmarshal(next, n); err != nil {
+		return err
+	}
+	h.v = v
+	h.t = n
+	return nil
+}

internal/domain/derpmap.go

@@ -0,0 +1,82 @@
+package domain
+
+import (
+	"context"
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/util"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+	"sync"
+	"tailscale.com/tailcfg"
+)
+
+var (
+	_defaultDERPMapMu sync.RWMutex
+	_defaultDERPMap   = WrapDERPMap(tailcfg.DERPMap{})
+)
+
+func SetDefaultDERPMap(v *tailcfg.DERPMap) {
+	if v == nil {
+		return
+	}
+
+	_defaultDERPMapMu.Lock()
+	defer _defaultDERPMapMu.Unlock()
+	_defaultDERPMap = WrapDERPMap(*v)
+}
+
+func GetDefaultDERPMap() DERPMap {
+	_defaultDERPMapMu.RLock()
+	defer _defaultDERPMapMu.RUnlock()
+	return _defaultDERPMap
+}
+
+type DERPMap struct {
+	Checksum string
+	DERPMap  tailcfg.DERPMap
+}
+
+func (d DERPMap) GetDERPMap(_ context.Context) (*DERPMap, error) {
+	return &d, nil
+}
+
+func WrapDERPMap(d tailcfg.DERPMap) DERPMap {
+	return DERPMap{
+		Checksum: util.Checksum(d),
+		DERPMap:  d,
+	}
+}
+
+func (hi *DERPMap) Scan(destination interface{}) error {
+	switch value := destination.(type) {
+	case []byte:
+		return json.Unmarshal(value, hi)
+	default:
+		return fmt.Errorf("unexpected data type %T", destination)
+	}
+}
+
+func (hi DERPMap) Value() (driver.Value, error) {
+	bytes, err := json.Marshal(hi)
+	return bytes, err
+}
+
+// GormDataType gorm common data type
+func (DERPMap) GormDataType() string {
+	return "json"
+}
+
+// GormDBDataType gorm db data type
+func (DERPMap) GormDBDataType(db *gorm.DB, field *schema.Field) string {
+	switch db.Dialector.Name() {
+	case "sqlite":
+		return "JSON"
+	}
+	return ""
+}
+
+type DefaultDERPMap interface {
+	GetDERPMap(ctx context.Context) (*DERPMap, error)
+}

internal/domain/dns_config.go

@@ -0,0 +1,63 @@
+package domain
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+	"reflect"
+)
+
+type DNSConfig struct {
+	HttpsCertsEnabled bool                `json:"http_certs"`
+	MagicDNS          bool                `json:"magic_dns"`
+	OverrideLocalDNS  bool                `json:"override_local_dns"`
+	Nameservers       []string            `json:"nameservers"`
+	Routes            map[string][]string `json:"routes"`
+	SearchDomains     []string            `json:"search_domains"`
+}
+
+func (i *DNSConfig) Equal(x *DNSConfig) bool {
+	if i == nil && x == nil {
+		return true
+	}
+	if (i == nil) != (x == nil) {
+		return false
+	}
+
+	return i.MagicDNS == x.MagicDNS &&
+		i.HttpsCertsEnabled == x.HttpsCertsEnabled &&
+		i.OverrideLocalDNS == x.OverrideLocalDNS &&
+		reflect.DeepEqual(i.Nameservers, x.Nameservers) &&
+		reflect.DeepEqual(i.Routes, x.Routes) &&
+		reflect.DeepEqual(i.SearchDomains, x.SearchDomains)
+}
+
+func (i *DNSConfig) Scan(destination interface{}) error {
+	switch value := destination.(type) {
+	case []byte:
+		return json.Unmarshal(value, i)
+	default:
+		return fmt.Errorf("unexpected data type %T", destination)
+	}
+}
+
+func (i DNSConfig) Value() (driver.Value, error) {
+	bytes, err := json.Marshal(i)
+	return bytes, err
+}
+
+// GormDataType gorm common data type
+func (DNSConfig) GormDataType() string {
+	return "json"
+}
+
+// GormDBDataType gorm db data type
+func (DNSConfig) GormDBDataType(db *gorm.DB, field *schema.Field) string {
+	switch db.Dialector.Name() {
+	case "sqlite":
+		return "JSON"
+	}
+	return ""
+}

internal/domain/iam.go

@@ -0,0 +1,108 @@
+package domain
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"github.com/hashicorp/go-bexpr"
+	"github.com/mitchellh/pointerstructure"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+	"reflect"
+)
+
+type Identity struct {
+	UserID   string
+	Username string
+	Email    string
+	Attr     map[string]interface{}
+}
+
+type IAMPolicy struct {
+	Subs    []string            `json:"subs,omitempty"`
+	Emails  []string            `json:"emails,omitempty"`
+	Filters []string            `json:"filters,omitempty"`
+	Roles   map[string]UserRole `json:"roles,omitempty"`
+}
+
+func (i *IAMPolicy) GetRole(user User) UserRole {
+	if val, ok := i.Roles[user.Name]; ok {
+		return val
+	}
+	return UserRoleMember
+}
+
+func (i *IAMPolicy) EvaluatePolicy(identity *Identity) (bool, error) {
+	for _, sub := range i.Subs {
+		if identity.UserID == sub {
+			return true, nil
+		}
+	}
+
+	for _, email := range i.Emails {
+		if identity.Email == email {
+			return true, nil
+		}
+	}
+
+	for _, f := range i.Filters {
+		if f == "*" {
+			return true, nil
+		}
+
+		evaluator, err := bexpr.CreateEvaluator(f)
+		if err != nil {
+			return false, err
+		}
+
+		result, err := evaluator.Evaluate(identity.Attr)
+		if err != nil && !errors.Is(err, pointerstructure.ErrNotFound) {
+			return false, err
+		}
+
+		if result {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func (i *IAMPolicy) Equal(x *IAMPolicy) bool {
+	if i == nil && x == nil {
+		return true
+	}
+	if (i == nil) != (x == nil) {
+		return false
+	}
+	return reflect.DeepEqual(i, x)
+}
+
+func (i *IAMPolicy) Scan(destination interface{}) error {
+	switch value := destination.(type) {
+	case []byte:
+		return json.Unmarshal(value, i)
+	default:
+		return fmt.Errorf("unexpected data type %T", destination)
+	}
+}
+
+func (i IAMPolicy) Value() (driver.Value, error) {
+	bytes, err := json.Marshal(i)
+	return bytes, err
+}
+
+// GormDataType gorm common data type
+func (IAMPolicy) GormDataType() string {
+	return "json"
+}
+
+// GormDBDataType gorm db data type
+func (IAMPolicy) GormDBDataType(db *gorm.DB, field *schema.Field) string {
+	switch db.Dialector.Name() {
+	case "sqlite":
+		return "JSON"
+	}
+	return ""
+}

internal/domain/machine.go

@@ -8,31 +8,52 @@ import (
 	"fmt"
 	"gorm.io/gorm"
 	"gorm.io/gorm/schema"
-	"inet.af/netaddr"
+	"net/netip"
 	"tailscale.com/tailcfg"
 	"time"
 )
 
-type Machine struct {
-	ID             uint64 `gorm:"primary_key;autoIncrement:false"`
-	Name           string
-	NameIdx        uint64
-	MachineKey     string
-	NodeKey        string
-	DiscoKey       string
-	Ephemeral      bool
-	RegisteredTags Tags
-	Tags           Tags
+type MachineRepository interface {
+	SaveMachine(ctx context.Context, m *Machine) error
+	DeleteMachine(ctx context.Context, id uint64) (bool, error)
+	GetMachine(ctx context.Context, id uint64) (*Machine, error)
+	GetMachineByKeyAndUser(ctx context.Context, key string, userID uint64) (*Machine, error)
+	GetMachineByKeys(ctx context.Context, machineKey string, nodeKey string) (*Machine, error)
+	CountMachinesWithIPv4(ctx context.Context, ip string) (int64, error)
+	GetNextMachineNameIndex(ctx context.Context, tailnetID uint64, name string) (uint64, error)
+	ListMachineByTailnet(ctx context.Context, tailnetID uint64) (Machines, error)
+	CountMachineByTailnet(ctx context.Context, tailnetID uint64) (int64, error)
+	DeleteMachineByTailnet(ctx context.Context, tailnetID uint64) error
+	DeleteMachineByUser(ctx context.Context, userID uint64) error
+	ListMachinePeers(ctx context.Context, tailnetID uint64, machineID uint64) (Machines, error)
+	ListInactiveEphemeralMachines(ctx context.Context, checkpoint time.Time) (Machines, error)
+	SetMachineLastSeen(ctx context.Context, machineID uint64) error
+}
 
-	HostInfo  HostInfo
-	Endpoints Endpoints
-	AllowIPs  AllowIPs
+type Machine struct {
+	ID                uint64 `gorm:"primary_key"`
+	Name              string
+	NameIdx           uint64
+	MachineKey        string
+	NodeKey           string
+	DiscoKey          string
+	Ephemeral         bool
+	RegisteredTags    Tags
+	Tags              Tags
+	KeyExpiryDisabled bool
+	Authorized        bool
+	UseOSHostname     bool `gorm:"default:true"`
+
+	HostInfo     HostInfo
+	Endpoints    Endpoints
+	AllowIPs     AllowIPs
+	AutoAllowIPs AllowIPs
 
 	IPv4 IP
 	IPv6 IP
 
 	CreatedAt time.Time
-	ExpiresAt *time.Time
+	ExpiresAt time.Time
 	LastSeen  *time.Time
 
 	UserID uint64
@@ -44,8 +65,23 @@ type Machine struct {
 
 type Machines []Machine
 
-func (m *Machine) HasIP(v netaddr.IP) bool {
-	return v.Compare(*m.IPv4.IP) == 0 || v.Compare(*m.IPv6.IP) == 0
+func (m *Machine) CompleteName() string {
+	if m.NameIdx != 0 {
+		return fmt.Sprintf("%s-%d", m.Name, m.NameIdx)
+	}
+	return m.Name
+}
+
+func (m *Machine) IPs() []string {
+	return []string{m.IPv4.String(), m.IPv6.String()}
+}
+
+func (m *Machine) IsExpired() bool {
+	return !m.KeyExpiryDisabled && !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now())
+}
+
+func (m *Machine) HasIP(v netip.Addr) bool {
+	return v.Compare(*m.IPv4.Addr) == 0 || v.Compare(*m.IPv6.Addr) == 0
 }
 
 func (m *Machine) HasTag(tag string) bool {
@@ -57,7 +93,63 @@ func (m *Machine) HasTag(tag string) bool {
 	return false
 }
 
-func (m *Machine) IsAllowedIP(i netaddr.IP) bool {
+func (m *Machine) HasUser(loginName string) bool {
+	return m.User.Name == loginName
+}
+
+func (m *Machine) HasTags() bool {
+	return len(m.Tags) != 0
+}
+
+func (m *Machine) IsAdvertisedExitNode() bool {
+	for _, r := range m.HostInfo.RoutableIPs {
+		if r.Bits() == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func (m *Machine) IsAllowedExitNode() bool {
+	for _, r := range m.AllowIPs {
+		if r.Bits() == 0 {
+			return true
+		}
+	}
+	for _, r := range m.AutoAllowIPs {
+		if r.Bits() == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func (m *Machine) AdvertisedPrefixes() []string {
+	var result []string
+	for _, r := range m.HostInfo.RoutableIPs {
+		if r.Bits() != 0 {
+			result = append(result, r.String())
+		}
+	}
+	return result
+}
+
+func (m *Machine) AllowedPrefixes() []string {
+	result := StringSet{}
+	for _, r := range m.AllowIPs {
+		if r.Bits() != 0 {
+			result.Add(r.String())
+		}
+	}
+	for _, r := range m.AutoAllowIPs {
+		if r.Bits() != 0 {
+			result.Add(r.String())
+		}
+	}
+	return result.Items()
+}
+
+func (m *Machine) IsAllowedIP(i netip.Addr) bool {
 	if m.HasIP(i) {
 		return true
 	}
@@ -66,26 +158,50 @@ func (m *Machine) IsAllowedIP(i netaddr.IP) bool {
 			return true
 		}
 	}
+	for _, t := range m.AutoAllowIPs {
+		if t.Contains(i) {
+			return true
+		}
+	}
 	return false
 }
 
-func (m *Machine) IsAllowedIPPrefix(i netaddr.IPPrefix) bool {
+func (m *Machine) IsAllowedIPPrefix(i netip.Prefix) bool {
 	for _, t := range m.AllowIPs {
 		if t.Overlaps(i) {
 			return true
 		}
 	}
+	for _, t := range m.AutoAllowIPs {
+		if t.Overlaps(i) {
+			return true
+		}
+	}
+	return false
+}
+
+func (m *Machine) IsExitNode() bool {
+	for _, t := range m.AllowIPs {
+		if t.Bits() == 0 {
+			return true
+		}
+	}
+	for _, t := range m.AutoAllowIPs {
+		if t.Bits() == 0 {
+			return true
+		}
+	}
 	return false
 }
 
 type IP struct {
-	*netaddr.IP
+	*netip.Addr
 }
 
 func (i *IP) Scan(destination interface{}) error {
 	switch value := destination.(type) {
 	case string:
-		ip, err := netaddr.ParseIP(value)
+		ip, err := netip.ParseAddr(value)
 		if err != nil {
 			return err
 		}
@@ -97,13 +213,62 @@ func (i *IP) Scan(destination interface{}) error {
 }
 
 func (i IP) Value() (driver.Value, error) {
-	if i.IP == nil {
+	if i.Addr == nil {
 		return nil, nil
 	}
 	return i.String(), nil
 }
 
-type AllowIPs []netaddr.IPPrefix
+func (IP) GormDBDataType(db *gorm.DB, field *schema.Field) string {
+	switch db.Dialector.Name() {
+	case "postgres":
+		return "TEXT"
+	}
+	return ""
+}
+
+type AllowIPs []netip.Prefix
+
+type AllowIPsSet struct {
+	items map[netip.Prefix]bool
+}
+
+func NewAllowIPsSet(t AllowIPs) *AllowIPsSet {
+	s := &AllowIPsSet{}
+	return s.Add(t...)
+}
+
+func (s *AllowIPsSet) Add(t ...netip.Prefix) *AllowIPsSet {
+	if s.items == nil {
+		s.items = make(map[netip.Prefix]bool)
+	}
+
+	for _, v := range t {
+		s.items[v] = true
+	}
+
+	return s
+}
+
+func (s *AllowIPsSet) Remove(t ...netip.Prefix) *AllowIPsSet {
+	if s.items == nil {
+		return s
+	}
+
+	for _, v := range t {
+		delete(s.items, v)
+	}
+
+	return s
+}
+
+func (s *AllowIPsSet) Items() []netip.Prefix {
+	items := []netip.Prefix{}
+	for i := range s.items {
+		items = append(items, i)
+	}
+	return items
+}
 
 func (hi *AllowIPs) Scan(destination interface{}) error {
 	switch value := destination.(type) {
@@ -163,7 +328,7 @@ func (HostInfo) GormDBDataType(db *gorm.DB, field *schema.Field) string {
 	return ""
 }
 
-type Endpoints []string
+type Endpoints []netip.AddrPort
 
 func (hi *Endpoints) Scan(destination interface{}) error {
 	switch value := destination.(type) {
@@ -210,7 +375,7 @@ func (r *repository) DeleteMachine(ctx context.Context, id uint64) (bool, error)
 
 func (r *repository) GetMachine(ctx context.Context, machineID uint64) (*Machine, error) {
 	var m Machine
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").First(&m, "id = ?", machineID)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").Preload("User.Account").Take(&m, machineID)
 
 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -229,7 +394,7 @@ func (r *repository) GetNextMachineNameIndex(ctx context.Context, tailnetID uint
 	tx := r.withContext(ctx).
 		Where("name = ? AND tailnet_id = ?", name, tailnetID).
 		Order("name_idx desc").
-		First(&m)
+		Take(&m)
 
 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return 0, nil
@@ -242,9 +407,9 @@ func (r *repository) GetNextMachineNameIndex(ctx context.Context, tailnetID uint
 	return m.NameIdx + 1, nil
 }
 
-func (r *repository) GetMachineByKey(ctx context.Context, tailnetID uint64, machineKey string) (*Machine, error) {
+func (r *repository) GetMachineByKeyAndUser(ctx context.Context, machineKey string, userID uint64) (*Machine, error) {
 	var m Machine
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").First(&m, "tailnet_id = ? AND machine_key = ?", tailnetID, machineKey)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").Take(&m, "machine_key = ? AND user_id = ?", machineKey, userID)
 
 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -259,7 +424,7 @@ func (r *repository) GetMachineByKey(ctx context.Context, tailnetID uint64, mach
 
 func (r *repository) GetMachineByKeys(ctx context.Context, machineKey string, nodeKey string) (*Machine, error) {
 	var m Machine
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").First(&m, "machine_key = ? AND node_key = ?", machineKey, nodeKey)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").Take(&m, "machine_key = ? AND node_key = ?", machineKey, nodeKey)
 
 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -301,14 +466,20 @@ func (r *repository) DeleteMachineByTailnet(ctx context.Context, tailnetID uint6
 	return tx.Error
 }
 
+func (r *repository) DeleteMachineByUser(ctx context.Context, userID uint64) error {
+	tx := r.withContext(ctx).Model(&Machine{}).Where("user_id = ?", userID).Delete(&Machine{})
+	return tx.Error
+}
+
 func (r *repository) ListMachineByTailnet(ctx context.Context, tailnetID uint64) (Machines, error) {
 	var machines = []Machine{}
 
 	tx := r.withContext(ctx).
 		Preload("Tailnet").
-		Preload("User").
-		Where("tailnet_id = ?", tailnetID).
-		Order("name asc, name_idx asc").
+		Joins("User").
+		Joins("User.Account").
+		Where("machines.tailnet_id = ?", tailnetID).
+		Order("machines.name asc, machines.name_idx asc").
 		Find(&machines)
 
 	if tx.Error != nil {
@@ -318,14 +489,15 @@ func (r *repository) ListMachineByTailnet(ctx context.Context, tailnetID uint64)
 	return machines, nil
 }
 
-func (r *repository) ListMachinePeers(ctx context.Context, tailnetID uint64, key string) (Machines, error) {
-	var machines = []Machine{}
+func (r *repository) ListMachinePeers(ctx context.Context, tailnetID uint64, machineID uint64) (Machines, error) {
+	var machines []Machine
 
 	tx := r.withContext(ctx).
 		Preload("Tailnet").
-		Preload("User").
-		Where("tailnet_id = ? AND machine_key <> ?", tailnetID, key).
-		Order("id asc").
+		Joins("User").
+		Joins("User.Account").
+		Where("machines.tailnet_id = ? AND machines.id <> ?", tailnetID, machineID).
+		Order("machines.id asc").
 		Find(&machines)
 
 	if tx.Error != nil {
@@ -351,7 +523,10 @@ func (r *repository) ListInactiveEphemeralMachines(ctx context.Context, t time.T
 
 func (r *repository) SetMachineLastSeen(ctx context.Context, machineID uint64) error {
 	now := time.Now().UTC()
-	tx := r.withContext(ctx).Model(Machine{}).Where("id = ?", machineID).Updates(map[string]interface{}{"last_seen": &now})
+	tx := r.withContext(ctx).
+		Model(Machine{}).
+		Where("id = ?", machineID).
+		Updates(map[string]interface{}{"last_seen": &now})
 
 	if tx.Error != nil {
 		return tx.Error

internal/domain/principal.go

@@ -0,0 +1,23 @@
+package domain
+
+type Principal struct {
+	SystemRole SystemRole
+	User       *User
+	UserRole   UserRole
+}
+
+func (p Principal) IsSystemAdmin() bool {
+	return p.SystemRole.IsAdmin()
+}
+
+func (p Principal) IsTailnetAdmin(tailnetID uint64) bool {
+	return p.User.TailnetID == tailnetID && p.UserRole.IsAdmin()
+}
+
+func (p Principal) IsTailnetMember(tailnetID uint64) bool {
+	return p.User.TailnetID == tailnetID
+}
+
+func (p Principal) UserMatches(userID uint64) bool {
+	return p.User.ID == userID
+}

internal/domain/registration_request.go

@@ -0,0 +1,99 @@
+package domain
+
+import (
+	"context"
+	"database/sql/driver"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+	"tailscale.com/tailcfg"
+	"time"
+)
+
+type RegistrationRequestRepository interface {
+	SaveRegistrationRequest(ctx context.Context, request *RegistrationRequest) error
+	GetRegistrationRequestByKey(ctx context.Context, key string) (*RegistrationRequest, error)
+	GetRegistrationRequestByMachineKey(ctx context.Context, key string) (*RegistrationRequest, error)
+}
+
+type RegistrationRequest struct {
+	MachineKey    string `gorm:"primary_key"`
+	Key           string
+	Data          RegistrationRequestData
+	CreatedAt     time.Time
+	Authenticated bool
+	Error         string
+	UserID        uint64
+}
+
+type RegistrationRequestData tailcfg.RegisterRequest
+
+func (hi *RegistrationRequestData) Scan(destination interface{}) error {
+	switch value := destination.(type) {
+	case []byte:
+		return json.Unmarshal(value, hi)
+	default:
+		return fmt.Errorf("unexpected data type %T", destination)
+	}
+}
+
+func (hi RegistrationRequestData) Value() (driver.Value, error) {
+	bytes, err := json.Marshal(hi)
+	return bytes, err
+}
+
+// GormDataType gorm common data type
+func (RegistrationRequestData) GormDataType() string {
+	return "json"
+}
+
+// GormDBDataType gorm db data type
+func (RegistrationRequestData) GormDBDataType(db *gorm.DB, field *schema.Field) string {
+	switch db.Dialector.Name() {
+	case "sqlite":
+		return "JSON"
+	}
+	return ""
+}
+
+func (r *repository) SaveRegistrationRequest(ctx context.Context, request *RegistrationRequest) error {
+	tx := r.withContext(ctx).Save(request)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}
+
+func (r *repository) GetRegistrationRequestByKey(ctx context.Context, key string) (*RegistrationRequest, error) {
+	var m RegistrationRequest
+	tx := r.withContext(ctx).Take(&m, "key = ?", key)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &m, nil
+}
+
+func (r *repository) GetRegistrationRequestByMachineKey(ctx context.Context, key string) (*RegistrationRequest, error) {
+	var m RegistrationRequest
+	tx := r.withContext(ctx).Take(&m, "machine_key = ?", key)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &m, nil
+}

internal/domain/repository.go

@@ -3,49 +3,26 @@ package domain
 import (
 	"context"
 	"gorm.io/gorm"
-	"tailscale.com/tailcfg"
-	"time"
+	"gorm.io/gorm/clause"
 )
 
 type Repository interface {
-	GetDERPMap(ctx context.Context) (*tailcfg.DERPMap, error)
-	SetDERPMap(ctx context.Context, v *tailcfg.DERPMap) error
+	AccountRepository
+	ApiKeyRepository
+	SystemApiKeyRepository
+	AuthKeyRepository
+	MachineRepository
+	TailnetRepository
+	UserRepository
+	AuthenticationRequestRepository
+	RegistrationRequestRepository
+	SSHActionRequestRepository
 
-	GetOrCreateTailnet(ctx context.Context, name string) (*Tailnet, bool, error)
-	GetTailnet(ctx context.Context, id uint64) (*Tailnet, error)
-	ListTailnets(ctx context.Context) ([]Tailnet, error)
-	DeleteTailnet(ctx context.Context, id uint64) error
+	GetControlKeys(ctx context.Context) (*ControlKeys, error)
+	SetControlKeys(ctx context.Context, keys *ControlKeys) error
 
-	GetDNSConfig(ctx context.Context, tailnetID uint64) (*DNSConfig, error)
-	SetDNSConfig(ctx context.Context, tailnetID uint64, config *DNSConfig) error
-	DeleteDNSConfig(ctx context.Context, tailnetID uint64) error
-	GetACLPolicy(ctx context.Context, tailnetID uint64) (*ACLPolicy, error)
-	SetACLPolicy(ctx context.Context, tailnetID uint64, policy *ACLPolicy) error
-	DeleteACLPolicy(ctx context.Context, tailnetID uint64) error
-
-	SaveAuthKey(ctx context.Context, key *AuthKey) error
-	DeleteAuthKey(ctx context.Context, id uint64) (bool, error)
-	DeleteAuthKeysByTailnet(ctx context.Context, tailnetID uint64) error
-	ListAuthKeys(ctx context.Context, tailnetID uint64) ([]AuthKey, error)
-	LoadAuthKey(ctx context.Context, key string) (*AuthKey, error)
-
-	GetOrCreateServiceUser(ctx context.Context, tailnet *Tailnet) (*User, bool, error)
-	ListUsers(ctx context.Context, tailnetID uint64) (Users, error)
-	DeleteUsersByTailnet(ctx context.Context, tailnetID uint64) error
-
-	SaveMachine(ctx context.Context, m *Machine) error
-	DeleteMachine(ctx context.Context, id uint64) (bool, error)
-	GetMachine(ctx context.Context, id uint64) (*Machine, error)
-	GetMachineByKey(ctx context.Context, tailnetID uint64, key string) (*Machine, error)
-	GetMachineByKeys(ctx context.Context, machineKey string, nodeKey string) (*Machine, error)
-	CountMachinesWithIPv4(ctx context.Context, ip string) (int64, error)
-	GetNextMachineNameIndex(ctx context.Context, tailnetID uint64, name string) (uint64, error)
-	ListMachineByTailnet(ctx context.Context, tailnetID uint64) (Machines, error)
-	CountMachineByTailnet(ctx context.Context, tailnetID uint64) (int64, error)
-	DeleteMachineByTailnet(ctx context.Context, tailnetID uint64) error
-	ListMachinePeers(ctx context.Context, tailnetID uint64, key string) (Machines, error)
-	ListInactiveEphemeralMachines(ctx context.Context, checkpoint time.Time) (Machines, error)
-	SetMachineLastSeen(ctx context.Context, machineID uint64) error
+	GetJSONWebKeySet(ctx context.Context) (*JSONWebKeys, error)
+	SetJSONWebKeySet(ctx context.Context, keys *JSONWebKeys) error
 
 	Transaction(func(rp Repository) error) error
 }
@@ -61,7 +38,7 @@ type repository struct {
 }
 
 func (r *repository) withContext(ctx context.Context) *gorm.DB {
-	return r.db.WithContext(ctx)
+	return r.db.WithContext(ctx).Omit(clause.Associations)
 }
 
 func (r *repository) Transaction(action func(Repository) error) error {

internal/domain/server_config.go

@@ -2,20 +2,50 @@ package domain
 
 import (
 	"context"
+	"crypto"
+	"crypto/rsa"
 	"encoding/json"
 	"errors"
 	"gorm.io/gorm"
-	"tailscale.com/tailcfg"
+	tkey "tailscale.com/types/key"
+	"time"
 )
 
+type configKey string
+
+const (
+	derpMapConfigKey     configKey = "derp_map"
+	controlKeysConfigKey configKey = "control_keys"
+	jwksConfigKey        configKey = "jwks"
+)
+
+type JSONWebKeys struct {
+	Key JSONWebKey
+}
+
+type JSONWebKey struct {
+	Id         string
+	PrivateKey rsa.PrivateKey
+	CreatedAt  time.Time
+}
+
+func (j JSONWebKey) Public() crypto.PublicKey {
+	return j.PrivateKey.Public()
+}
+
 type ServerConfig struct {
-	Key   string `gorm:"primary_key"`
+	Key   configKey `gorm:"primary_key"`
 	Value []byte
 }
 
-func (r *repository) GetDERPMap(ctx context.Context) (*tailcfg.DERPMap, error) {
-	var m tailcfg.DERPMap
-	err := r.getServerConfig(ctx, "derp_map", &m)
+type ControlKeys struct {
+	ControlKey       tkey.MachinePrivate
+	LegacyControlKey tkey.MachinePrivate
+}
+
+func (r *repository) GetControlKeys(ctx context.Context) (*ControlKeys, error) {
+	var m ControlKeys
+	err := r.getServerConfig(ctx, controlKeysConfigKey, &m)
 
 	if errors.Is(err, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -28,11 +58,30 @@ func (r *repository) GetDERPMap(ctx context.Context) (*tailcfg.DERPMap, error) {
 	return &m, nil
 }
 
-func (r *repository) SetDERPMap(ctx context.Context, v *tailcfg.DERPMap) error {
-	return r.setServerConfig(ctx, "derp_map", v)
+func (r *repository) SetControlKeys(ctx context.Context, v *ControlKeys) error {
+	return r.setServerConfig(ctx, controlKeysConfigKey, v)
 }
 
-func (r *repository) getServerConfig(ctx context.Context, s string, v interface{}) error {
+func (r *repository) GetJSONWebKeySet(ctx context.Context) (*JSONWebKeys, error) {
+	var m JSONWebKeys
+	err := r.getServerConfig(ctx, jwksConfigKey, &m)
+
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &m, nil
+}
+
+func (r *repository) SetJSONWebKeySet(ctx context.Context, v *JSONWebKeys) error {
+	return r.setServerConfig(ctx, jwksConfigKey, v)
+}
+
+func (r *repository) getServerConfig(ctx context.Context, s configKey, v interface{}) error {
 	var m ServerConfig
 	tx := r.withContext(ctx).Take(&m, "key = ?", s)
 
@@ -48,7 +97,7 @@ func (r *repository) getServerConfig(ctx context.Context, s string, v interface{
 	return nil
 }
 
-func (r *repository) setServerConfig(ctx context.Context, s string, v interface{}) error {
+func (r *repository) setServerConfig(ctx context.Context, s configKey, v interface{}) error {
 	marshal, err := json.Marshal(v)
 	if err != nil {
 		return err

internal/domain/ssh_action_request.go

@@ -0,0 +1,52 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"gorm.io/gorm"
+	"time"
+)
+
+type SSHActionRequestRepository interface {
+	SaveSSHActionRequest(ctx context.Context, session *SSHActionRequest) error
+	GetSSHActionRequest(ctx context.Context, key string) (*SSHActionRequest, error)
+	DeleteSSHActionRequest(ctx context.Context, key string) error
+}
+
+type SSHActionRequest struct {
+	Key          string `gorm:"primary_key"`
+	Action       string
+	SrcMachineID uint64
+	DstMachineID uint64
+	CreatedAt    time.Time
+}
+
+func (r *repository) SaveSSHActionRequest(ctx context.Context, session *SSHActionRequest) error {
+	tx := r.withContext(ctx).Save(session)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}
+
+func (r *repository) GetSSHActionRequest(ctx context.Context, key string) (*SSHActionRequest, error) {
+	var m SSHActionRequest
+	tx := r.withContext(ctx).Take(&m, "key = ?", key)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &m, nil
+}
+
+func (r *repository) DeleteSSHActionRequest(ctx context.Context, key string) error {
+	tx := r.withContext(ctx).Delete(&SSHActionRequest{Key: key})
+	return tx.Error
+}

internal/domain/system_api_key.go

@@ -0,0 +1,96 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/util"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"strings"
+	"time"
+)
+
+func CreateSystemApiKey(account *Account, expiresAt *time.Time) (string, *SystemApiKey) {
+	key := util.RandStringBytes(12)
+	pwd := util.RandStringBytes(22)
+	value := fmt.Sprintf("sk_%s_%s", key, pwd)
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
+	if err != nil {
+		panic(err)
+	}
+
+	return value, &SystemApiKey{
+		ID:        util.NextID(),
+		Key:       key,
+		Hash:      string(hash),
+		CreatedAt: time.Now().UTC(),
+		ExpiresAt: expiresAt,
+
+		AccountID: account.ID,
+	}
+}
+
+type SystemApiKeyRepository interface {
+	SaveSystemApiKey(ctx context.Context, key *SystemApiKey) error
+	LoadSystemApiKey(ctx context.Context, key string) (*SystemApiKey, error)
+}
+
+type SystemApiKey struct {
+	ID   uint64 `gorm:"primary_key"`
+	Key  string
+	Hash string
+
+	CreatedAt time.Time
+	ExpiresAt *time.Time
+
+	AccountID uint64
+	Account   Account
+}
+
+func (r *repository) SaveSystemApiKey(ctx context.Context, key *SystemApiKey) error {
+	tx := r.withContext(ctx).Save(key)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}
+
+func (r *repository) LoadSystemApiKey(ctx context.Context, token string) (*SystemApiKey, error) {
+	split := strings.Split(token, "_")
+	if len(split) != 3 {
+		return nil, nil
+	}
+
+	prefix := split[0]
+	key := split[1]
+	value := split[2]
+
+	if prefix != "sk" {
+		return nil, nil
+	}
+
+	var m SystemApiKey
+	tx := r.withContext(ctx).Preload("Account").Take(&m, "key = ?", key)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(m.Hash), []byte(value)); err != nil {
+		return nil, nil
+	}
+
+	if !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
+		return nil, nil
+	}
+
+	return &m, nil
+}

internal/domain/tags.go

@@ -3,7 +3,9 @@ package domain
 import (
 	"database/sql/driver"
 	"fmt"
+	"github.com/hashicorp/go-multierror"
 	"strings"
+	"tailscale.com/tailcfg"
 )
 
 type Tags []string
@@ -24,25 +26,28 @@ func (i *Tags) Scan(destination interface{}) error {
 }
 
 func (i Tags) Value() (driver.Value, error) {
+	if len(i) == 0 {
+		return "", nil
+	}
 	v := "|" + strings.Join(i, "|") + "|"
 	return v, nil
 }
 
-func SanitizeTags(input []string) Tags {
-	keys := make(map[string]bool)
-	var tags []string
-	for _, v := range input {
-		var entry string
-		if strings.HasPrefix(v, "tag:") {
-			entry = v[4:]
-		} else {
-			entry = v
-		}
+func CheckTag(tag string) error {
+	return tailcfg.CheckTag(tag)
+}
 
-		if _, value := keys[entry]; !value {
-			keys[entry] = true
-			tags = append(tags, entry)
+func CheckTags(tags []string) error {
+	var result *multierror.Error
+	for _, t := range tags {
+		if err := CheckTag(t); err != nil {
+			result = multierror.Append(result, err)
 		}
 	}
-	return tags
+	return result.ErrorOrNil()
+}
+
+func SanitizeTags(input []string) Tags {
+	s := StringSet{}
+	return s.Add(input...).Items()
 }

internal/domain/tailnet.go

@@ -3,26 +3,66 @@ package domain
 import (
 	"context"
 	"errors"
-	"github.com/jsiebens/ionscale/internal/util"
 	"gorm.io/gorm"
+	"net/mail"
+	"strings"
+	"tailscale.com/util/dnsname"
 )
 
 type Tailnet struct {
-	ID   uint64 `gorm:"primary_key;autoIncrement:false"`
-	Name string `gorm:"type:varchar(64);unique_index"`
+	ID                          uint64 `gorm:"primary_key"`
+	Name                        string
+	DNSConfig                   DNSConfig
+	IAMPolicy                   HuJSON[IAMPolicy]
+	ACLPolicy                   HuJSON[ACLPolicy]
+	DERPMap                     DERPMap
+	ServiceCollectionEnabled    bool
+	FileSharingEnabled          bool
+	SSHEnabled                  bool
+	MachineAuthorizationEnabled bool
 }
 
-func (r *repository) GetOrCreateTailnet(ctx context.Context, name string) (*Tailnet, bool, error) {
-	tailnet := &Tailnet{}
-	id := util.NextID()
+type TailnetRepository interface {
+	SaveTailnet(ctx context.Context, tailnet *Tailnet) error
+	GetTailnet(ctx context.Context, id uint64) (*Tailnet, error)
+	GetTailnetByName(ctx context.Context, name string) (*Tailnet, error)
+	ListTailnets(ctx context.Context) ([]Tailnet, error)
+	DeleteTailnet(ctx context.Context, id uint64) error
+}
 
-	tx := r.withContext(ctx).Where(Tailnet{Name: name}).Attrs(Tailnet{ID: id}).FirstOrCreate(tailnet)
+func (t Tailnet) GetDERPMap(ctx context.Context, fallback DefaultDERPMap) (*DERPMap, error) {
+	if t.DERPMap.Checksum == "" {
+		return fallback.GetDERPMap(ctx)
+	} else {
+		return &t.DERPMap, nil
+	}
+}
 
-	if tx.Error != nil {
-		return nil, false, tx.Error
+func SanitizeTailnetName(name string) string {
+	name = strings.ToLower(name)
+
+	a, err := mail.ParseAddress(name)
+	if err == nil && a.Address == name {
+		s := strings.Split(name, "@")
+		return strings.Join([]string{dnsname.SanitizeLabel(s[0]), s[1]}, ".")
 	}
 
-	return tailnet, tailnet.ID == id, nil
+	labels := strings.Split(name, ".")
+	for i, s := range labels {
+		labels[i] = dnsname.SanitizeLabel(s)
+	}
+
+	return strings.Join(labels, ".")
+}
+
+func (r *repository) SaveTailnet(ctx context.Context, tailnet *Tailnet) error {
+	tx := r.withContext(ctx).Save(tailnet)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
 }
 
 func (r *repository) GetTailnet(ctx context.Context, id uint64) (*Tailnet, error) {
@@ -40,6 +80,21 @@ func (r *repository) GetTailnet(ctx context.Context, id uint64) (*Tailnet, error
 	return &t, nil
 }
 
+func (r *repository) GetTailnetByName(ctx context.Context, name string) (*Tailnet, error) {
+	var t Tailnet
+	tx := r.withContext(ctx).Take(&t, "name = ?", name)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &t, nil
+}
+
 func (r *repository) ListTailnets(ctx context.Context) ([]Tailnet, error) {
 	var tailnets = []Tailnet{}
 	tx := r.withContext(ctx).Find(&tailnets)

internal/domain/tailnet_config.go

@@ -1,103 +0,0 @@
-package domain
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"gorm.io/gorm"
-)
-
-type TailnetConfig struct {
-	Key       string `gorm:"primary_key"`
-	TailnetID uint64 `gorm:"primary_key;autoIncrement:false"`
-	Value     []byte
-}
-
-type DNSConfig struct {
-	MagicDNS         bool
-	OverrideLocalDNS bool
-	Nameservers      []string
-	Routes           map[string][]string
-}
-
-func (r *repository) GetDNSConfig(ctx context.Context, tailnetID uint64) (*DNSConfig, error) {
-	var m DNSConfig
-	err := r.getConfig(ctx, "dns_config", tailnetID, &m)
-	if err != nil {
-		return nil, err
-	}
-	return &m, nil
-}
-
-func (r *repository) SetDNSConfig(ctx context.Context, tailnetID uint64, config *DNSConfig) error {
-	return r.setConfig(ctx, "dns_config", tailnetID, config)
-}
-
-func (r *repository) DeleteDNSConfig(ctx context.Context, tailnetID uint64) error {
-	return r.deleteConfig(ctx, "dns_config", tailnetID)
-}
-
-func (r *repository) SetACLPolicy(ctx context.Context, tailnetID uint64, policy *ACLPolicy) error {
-	if err := r.setConfig(ctx, "acl_policy", tailnetID, policy); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (r *repository) GetACLPolicy(ctx context.Context, tailnetID uint64) (*ACLPolicy, error) {
-	var p = defaultPolicy()
-	err := r.getConfig(ctx, "acl_policy", tailnetID, &p)
-	if err != nil {
-		return nil, err
-	}
-	return &p, nil
-}
-
-func (r *repository) DeleteACLPolicy(ctx context.Context, tailnetID uint64) error {
-	return r.deleteConfig(ctx, "acl_policy", tailnetID)
-}
-
-func (r *repository) getConfig(ctx context.Context, s string, tailnetID uint64, v interface{}) error {
-	var m TailnetConfig
-	tx := r.withContext(ctx).Take(&m, "key = ? AND tailnet_id = ?", s, tailnetID)
-
-	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
-		return nil
-	}
-
-	if tx.Error != nil {
-		return tx.Error
-	}
-
-	err := json.Unmarshal(m.Value, v)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *repository) setConfig(ctx context.Context, s string, tailnetID uint64, v interface{}) error {
-	marshal, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-	c := &TailnetConfig{
-		Key:       s,
-		Value:     marshal,
-		TailnetID: tailnetID,
-	}
-	tx := r.withContext(ctx).Save(c)
-
-	return tx.Error
-}
-
-func (r *repository) deleteConfig(ctx context.Context, s string, tailnetID uint64) error {
-	c := &TailnetConfig{
-		Key:       s,
-		TailnetID: tailnetID,
-	}
-	tx := r.withContext(ctx).Delete(c)
-
-	return tx.Error
-}

internal/domain/tailnet_test.go

@@ -0,0 +1,15 @@
+package domain
+
+import (
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestSanitizeTailnetName(t *testing.T) {
+	assert.Equal(t, "john.example.com", SanitizeTailnetName("john@example.com"))
+	assert.Equal(t, "john.example.com", SanitizeTailnetName("john@examPle.Com"))
+	assert.Equal(t, "john-doe.example.com", SanitizeTailnetName("john.doe@example.com"))
+	assert.Equal(t, "johns-network", SanitizeTailnetName("John's Network"))
+	assert.Equal(t, "example.com", SanitizeTailnetName("example.com"))
+	assert.Equal(t, "johns-example.com", SanitizeTailnetName("John's example.com"))
+}

internal/domain/user.go

@@ -2,22 +2,61 @@ package domain
 
 import (
 	"context"
+	"errors"
 	"github.com/jsiebens/ionscale/internal/util"
+	"gorm.io/gorm"
+	"time"
 )
 
-type TailnetRole string
+type SystemRole string
 
 const (
-	TailnetRoleService TailnetRole = "service"
+	SystemRoleNone  SystemRole = ""
+	SystemRoleAdmin SystemRole = "admin"
 )
 
-type User struct {
-	ID   uint64 `gorm:"primary_key;autoIncrement:false"`
-	Name string
+func (s SystemRole) IsAdmin() bool {
+	return s == SystemRoleAdmin
+}
 
-	TailnetRole TailnetRole
-	TailnetID   uint64
-	Tailnet     Tailnet
+type UserType string
+
+const (
+	UserTypeService UserType = "service"
+	UserTypePerson  UserType = "person"
+)
+
+type UserRole string
+
+const (
+	UserRoleNone   UserRole = ""
+	UserRoleMember UserRole = "member"
+	UserRoleAdmin  UserRole = "admin"
+)
+
+func (s UserRole) IsAdmin() bool {
+	return s == UserRoleAdmin
+}
+
+type UserRepository interface {
+	GetOrCreateServiceUser(ctx context.Context, tailnet *Tailnet) (*User, bool, error)
+	GetOrCreateUserWithAccount(ctx context.Context, tailnet *Tailnet, account *Account) (*User, bool, error)
+	GetUser(ctx context.Context, userID uint64) (*User, error)
+	DeleteUser(ctx context.Context, userID uint64) error
+	ListUsers(ctx context.Context, tailnetID uint64) (Users, error)
+	DeleteUsersByTailnet(ctx context.Context, tailnetID uint64) error
+	SetUserLastAuthenticated(ctx context.Context, userID uint64, timestamp time.Time) error
+}
+
+type User struct {
+	ID                uint64 `gorm:"primary_key"`
+	Name              string
+	UserType          UserType
+	LastAuthenticated *time.Time
+	TailnetID         uint64
+	Tailnet           Tailnet
+	AccountID         *uint64
+	Account           *Account
 }
 
 type Users []User
@@ -26,8 +65,8 @@ func (r *repository) GetOrCreateServiceUser(ctx context.Context, tailnet *Tailne
 	user := &User{}
 	id := util.NextID()
 
-	query := User{Name: tailnet.Name, TailnetID: tailnet.ID, TailnetRole: TailnetRoleService}
-	attrs := User{ID: id, Name: tailnet.Name, TailnetID: tailnet.ID, TailnetRole: TailnetRoleService}
+	query := User{Name: tailnet.Name, TailnetID: tailnet.ID, UserType: UserTypeService}
+	attrs := User{ID: id, Name: tailnet.Name, TailnetID: tailnet.ID, UserType: UserTypeService}
 
 	tx := r.withContext(ctx).Where(query).Attrs(attrs).FirstOrCreate(user)
 
@@ -41,7 +80,7 @@ func (r *repository) GetOrCreateServiceUser(ctx context.Context, tailnet *Tailne
 func (r *repository) ListUsers(ctx context.Context, tailnetID uint64) (Users, error) {
 	var users = []User{}
 
-	tx := r.withContext(ctx).Where("tailnet_id = ?", tailnetID).Find(&users)
+	tx := r.withContext(ctx).Where("tailnet_id = ? AND user_type = ?", tailnetID, UserTypePerson).Find(&users)
 
 	if tx.Error != nil {
 		return nil, tx.Error
@@ -54,3 +93,52 @@ func (r *repository) DeleteUsersByTailnet(ctx context.Context, tailnetID uint64)
 	tx := r.withContext(ctx).Where("tailnet_id = ?", tailnetID).Delete(&User{})
 	return tx.Error
 }
+
+func (r *repository) GetOrCreateUserWithAccount(ctx context.Context, tailnet *Tailnet, account *Account) (*User, bool, error) {
+	user := &User{}
+	id := util.NextID()
+
+	query := User{AccountID: &account.ID, TailnetID: tailnet.ID}
+	attrs := User{ID: id, Name: account.LoginName, TailnetID: tailnet.ID, AccountID: &account.ID, UserType: UserTypePerson}
+
+	tx := r.withContext(ctx).Where(query).Attrs(attrs).FirstOrCreate(user)
+
+	if tx.Error != nil {
+		return nil, false, tx.Error
+	}
+
+	return user, user.ID == id, nil
+}
+
+func (r *repository) GetUser(ctx context.Context, userID uint64) (*User, error) {
+	var m User
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("Account").Take(&m, "id = ?", userID)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &m, nil
+}
+
+func (r *repository) DeleteUser(ctx context.Context, userID uint64) error {
+	tx := r.withContext(ctx).Delete(&User{ID: userID})
+	return tx.Error
+}
+
+func (r *repository) SetUserLastAuthenticated(ctx context.Context, userID uint64, timestamp time.Time) error {
+	tx := r.withContext(ctx).
+		Model(User{}).
+		Where("id = ?", userID).
+		Updates(map[string]interface{}{"last_authenticated": &timestamp})
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}

internal/handlers/authentication.go

@@ -1,163 +1,619 @@
 package handlers
 
 import (
+	"context"
+	"encoding/json"
+	"fmt"
 	"github.com/jsiebens/ionscale/internal/addr"
+	"github.com/jsiebens/ionscale/internal/auth"
+	tpl "github.com/jsiebens/ionscale/internal/templates"
+	"github.com/labstack/echo/v4/middleware"
+	"github.com/mr-tron/base58"
 	"net/http"
+	"tailscale.com/tailcfg"
 	"time"
 
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/util"
 	"github.com/labstack/echo/v4"
-	"github.com/patrickmn/go-cache"
 	"tailscale.com/util/dnsname"
 )
 
 func NewAuthenticationHandlers(
 	config *config.Config,
-	repository domain.Repository,
-	pendingMachineRegistrationRequests *cache.Cache) *AuthenticationHandlers {
+	authProvider auth.Provider,
+	systemIAMPolicy *domain.IAMPolicy,
+	repository domain.Repository) *AuthenticationHandlers {
+
 	return &AuthenticationHandlers{
-		config:                             config,
-		repository:                         repository,
-		pendingMachineRegistrationRequests: pendingMachineRegistrationRequests,
+		config:          config,
+		authProvider:    authProvider,
+		repository:      repository,
+		systemIAMPolicy: systemIAMPolicy,
 	}
 }
 
 type AuthenticationHandlers struct {
-	repository                         domain.Repository
-	config                             *config.Config
-	pendingMachineRegistrationRequests *cache.Cache
+	repository      domain.Repository
+	authProvider    auth.Provider
+	config          *config.Config
+	systemIAMPolicy *domain.IAMPolicy
 }
 
+type AuthInput struct {
+	Key     string   `param:"key"`
+	Flow    AuthFlow `param:"flow"`
+	AuthKey string   `query:"ak" form:"ak"`
+	Oidc    bool     `query:"oidc" form:"oidc"`
+}
+
+type EndAuthForm struct {
+	AccountID     uint64 `form:"aid"`
+	TailnetID     uint64 `form:"tid"`
+	AsSystemAdmin bool   `form:"sad"`
+	AuthKey       string `form:"ak"`
+	State         string `form:"state"`
+}
+
+type oauthState struct {
+	Key  string
+	Flow AuthFlow
+}
+
+type AuthFlow string
+
+const (
+	AuthFlowMachineRegistration = "r"
+	AuthFlowClient              = "c"
+	AuthFlowSSHCheckFlow        = "s"
+)
+
 func (h *AuthenticationHandlers) StartAuth(c echo.Context) error {
-	key := c.Param("key")
-	authKey := c.FormValue("ak")
+	ctx := c.Request().Context()
 
-	if _, ok := h.pendingMachineRegistrationRequests.Get(key); !ok {
-		return c.Redirect(http.StatusFound, "/a/error")
+	var input AuthInput
+	if err := c.Bind(&input); err != nil {
+		return logError(err)
 	}
 
-	if authKey != "" {
-		return h.endMachineRegistrationFlow(c, key, authKey)
+	// machine registration auth flow
+	if input.Flow == AuthFlowMachineRegistration {
+		req, err := h.repository.GetRegistrationRequestByKey(ctx, input.Key)
+		if err != nil || req == nil {
+			return logError(err)
+		}
+
+		if input.Oidc && h.authProvider != nil {
+			goto startOidc
+		}
+
+		if input.AuthKey != "" {
+			return h.endMachineRegistrationFlow(c, EndAuthForm{AuthKey: input.AuthKey}, req)
+		}
+
+		csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
+		return c.Render(http.StatusOK, "", tpl.Auth(h.authProvider != nil, csrf))
 	}
 
-	return c.Render(http.StatusOK, "auth.html", nil)
+	// cli auth flow
+	if input.Flow == AuthFlowClient {
+		if s, err := h.repository.GetAuthenticationRequest(ctx, input.Key); err != nil || s == nil {
+			return logError(err)
+		}
+	}
+
+	// ssh check auth flow
+	if input.Flow == AuthFlowSSHCheckFlow {
+		if s, err := h.repository.GetSSHActionRequest(ctx, input.Key); err != nil || s == nil {
+			return logError(err)
+		}
+	}
+
+	if h.authProvider == nil {
+		return logError(fmt.Errorf("unable to start auth flow as no auth provider is configured"))
+	}
+
+startOidc:
+
+	state, err := h.createState(input.Flow, input.Key)
+	if err != nil {
+		return logError(err)
+	}
+
+	redirectUrl := h.authProvider.GetLoginURL(h.config.CreateUrl("/a/callback"), state)
+
+	return c.Redirect(http.StatusFound, redirectUrl)
+}
+
+func (h *AuthenticationHandlers) ProcessAuth(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	var input AuthInput
+	if err := c.Bind(&input); err != nil {
+		return logError(err)
+	}
+
+	req, err := h.repository.GetRegistrationRequestByKey(ctx, input.Key)
+	if err != nil || req == nil {
+		return logError(err)
+	}
+
+	if input.AuthKey != "" {
+		return h.endMachineRegistrationFlow(c, EndAuthForm{AuthKey: input.AuthKey}, req)
+	}
+
+	if input.Oidc {
+		state, err := h.createState(input.Flow, input.Key)
+		if err != nil {
+			return logError(err)
+		}
+
+		redirectUrl := h.authProvider.GetLoginURL(h.config.CreateUrl("/a/callback"), state)
+
+		return c.Redirect(http.StatusFound, redirectUrl)
+	}
+
+	return c.Redirect(http.StatusFound, fmt.Sprintf("/a/%s/%s", input.Flow, input.Key))
+}
+
+func (h *AuthenticationHandlers) Callback(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	code := c.QueryParam("code")
+	state, err := h.readState(c.QueryParam("state"))
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid state parameter")
+	}
+
+	user, err := h.exchangeUser(code)
+	if err != nil {
+		return logError(err)
+	}
+
+	account, _, err := h.repository.GetOrCreateAccount(ctx, user.ID, user.Name)
+	if err != nil {
+		return logError(err)
+	}
+
+	if err := h.repository.SetAccountLastAuthenticated(ctx, account.ID); err != nil {
+		return logError(err)
+	}
+
+	if state.Flow == AuthFlowSSHCheckFlow {
+		sshActionReq, err := h.repository.GetSSHActionRequest(ctx, state.Key)
+		if err != nil || sshActionReq == nil {
+			return c.Redirect(http.StatusFound, "/a/error?e=ua")
+		}
+
+		machine, err := h.repository.GetMachine(ctx, sshActionReq.SrcMachineID)
+		if err != nil || sshActionReq == nil {
+			return logError(err)
+		}
+
+		if !machine.HasTags() && machine.User.AccountID != nil && *machine.User.AccountID == account.ID {
+			sshActionReq.Action = "accept"
+
+			err := h.repository.Transaction(func(rp domain.Repository) error {
+				if err := rp.SetUserLastAuthenticated(ctx, machine.UserID, time.Now().UTC()); err != nil {
+					return err
+				}
+				if err := rp.SaveSSHActionRequest(ctx, sshActionReq); err != nil {
+					return err
+				}
+				return nil
+			})
+			if err != nil {
+				return logError(err)
+			}
+
+			return c.Redirect(http.StatusFound, "/a/success")
+		}
+
+		sshActionReq.Action = "reject"
+		if err := h.repository.SaveSSHActionRequest(ctx, sshActionReq); err != nil {
+			return logError(err)
+		}
+		return c.Redirect(http.StatusFound, "/a/error?e=nmo")
+	}
+
+	tailnets, err := h.listAvailableTailnets(ctx, user)
+	if err != nil {
+		return logError(err)
+	}
+
+	csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
+
+	if state.Flow == AuthFlowMachineRegistration {
+		if len(tailnets) == 0 {
+			registrationRequest, err := h.repository.GetRegistrationRequestByKey(ctx, state.Key)
+			if err == nil && registrationRequest != nil {
+				registrationRequest.Error = "unauthorized"
+				_ = h.repository.SaveRegistrationRequest(ctx, registrationRequest)
+			}
+			return c.Redirect(http.StatusFound, "/a/error?e=ua")
+		}
+
+		if len(tailnets) == 1 {
+			req, err := h.repository.GetRegistrationRequestByKey(ctx, state.Key)
+			if err != nil {
+				return logError(err)
+			}
+			if req == nil {
+				return logError(fmt.Errorf("invalid registration key"))
+			}
+			return h.endMachineRegistrationFlow(c, EndAuthForm{AccountID: account.ID, TailnetID: tailnets[0].ID}, req)
+		}
+
+		return c.Render(http.StatusOK, "", tpl.Tailnets(account.ID, false, tailnets, csrf))
+	}
+
+	if state.Flow == AuthFlowClient {
+		isSystemAdmin, err := h.isSystemAdmin(user)
+		if err != nil {
+			return logError(err)
+		}
+
+		if !isSystemAdmin && len(tailnets) == 0 {
+			req, err := h.repository.GetAuthenticationRequest(ctx, state.Key)
+			if err == nil && req != nil {
+				req.Error = "unauthorized"
+				_ = h.repository.SaveAuthenticationRequest(ctx, req)
+			}
+			return c.Redirect(http.StatusFound, "/a/error?e=ua")
+		}
+
+		return c.Render(http.StatusOK, "", tpl.Tailnets(account.ID, isSystemAdmin, tailnets, csrf))
+	}
+
+	return echo.NewHTTPError(http.StatusNotFound)
+}
+
+func (h *AuthenticationHandlers) EndAuth(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	var form EndAuthForm
+	if err := c.Bind(&form); err != nil {
+		return logError(err)
+	}
+
+	state, err := h.readState(form.State)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid state parameter")
+	}
+
+	if state.Flow == AuthFlowMachineRegistration {
+		req, err := h.repository.GetRegistrationRequestByKey(ctx, state.Key)
+		if err != nil || req == nil {
+			return logError(err)
+		}
+
+		return h.endMachineRegistrationFlow(c, form, req)
+	}
+
+	if state.Flow == AuthFlowClient {
+		req, err := h.repository.GetAuthenticationRequest(ctx, state.Key)
+		if err != nil || req == nil {
+			return logError(err)
+		}
+
+		return h.endCliAuthenticationFlow(c, form, req)
+	}
+
+	return echo.NewHTTPError(http.StatusBadRequest, "Invalid state parameter")
 }
 
 func (h *AuthenticationHandlers) Success(c echo.Context) error {
-	return c.Render(http.StatusOK, "success.html", nil)
+	s := c.QueryParam("s")
+	switch s {
+	case "nma":
+		return c.Render(http.StatusOK, "", tpl.NewMachine())
+	}
+	return c.Render(http.StatusOK, "", tpl.Success())
 }
 
 func (h *AuthenticationHandlers) Error(c echo.Context) error {
 	e := c.QueryParam("e")
 	switch e {
 	case "iak":
-		return c.Render(http.StatusForbidden, "invalidauthkey.html", nil)
+		return c.Render(http.StatusForbidden, "", tpl.InvalidAuthKey())
+	case "ua":
+		return c.Render(http.StatusForbidden, "", tpl.Unauthorized())
+	case "nto":
+		return c.Render(http.StatusForbidden, "", tpl.NotTagOwner())
+	case "nmo":
+		return c.Render(http.StatusForbidden, "", tpl.NotMachineOwner())
 	}
-	return c.Render(http.StatusOK, "error.html", nil)
+	return c.Render(http.StatusOK, "", tpl.Error())
 }
 
-func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, registrationKey, authKeyParam string) error {
+func (h *AuthenticationHandlers) endCliAuthenticationFlow(c echo.Context, form EndAuthForm, req *domain.AuthenticationRequest) error {
 	ctx := c.Request().Context()
 
-	defer h.pendingMachineRegistrationRequests.Delete(registrationKey)
-
-	preqItem, preqOK := h.pendingMachineRegistrationRequests.Get(registrationKey)
-	if !preqOK {
-		return c.Redirect(http.StatusFound, "/a/error")
+	account, err := h.repository.GetAccount(ctx, form.AccountID)
+	if err != nil {
+		return logError(err)
 	}
 
-	preq := preqItem.(*pendingMachineRegistrationRequest)
-	req := preq.request
-	machineKey := preq.machineKey
+	// continue as system admin?
+	if form.AsSystemAdmin {
+		expiresAt := time.Now().Add(24 * time.Hour)
+		token, apiKey := domain.CreateSystemApiKey(account, &expiresAt)
+		req.Token = token
+
+		err := h.repository.Transaction(func(rp domain.Repository) error {
+			if err := rp.SaveSystemApiKey(ctx, apiKey); err != nil {
+				return logError(err)
+			}
+			if err := rp.SaveAuthenticationRequest(ctx, req); err != nil {
+				return logError(err)
+			}
+			return nil
+		})
+		if err != nil {
+			return logError(err)
+		}
+		return c.Redirect(http.StatusFound, "/a/success")
+	}
+
+	tailnet, err := h.repository.GetTailnet(ctx, form.TailnetID)
+	if err != nil {
+		return logError(err)
+	}
+
+	user, _, err := h.repository.GetOrCreateUserWithAccount(ctx, tailnet, account)
+	if err != nil {
+		return logError(err)
+	}
+
+	expiresAt := time.Now().Add(24 * time.Hour)
+	token, apiKey := domain.CreateApiKey(tailnet, user, &expiresAt)
+	req.Token = token
+	req.TailnetID = &tailnet.ID
+
+	err = h.repository.Transaction(func(rp domain.Repository) error {
+		if err := rp.SetUserLastAuthenticated(ctx, user.ID, time.Now().UTC()); err != nil {
+			return err
+		}
+		if err := rp.SaveApiKey(ctx, apiKey); err != nil {
+			return err
+		}
+		if err := rp.SaveAuthenticationRequest(ctx, req); err != nil {
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		return logError(err)
+	}
+
+	return c.Redirect(http.StatusFound, "/a/success")
+}
+
+func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, form EndAuthForm, registrationRequest *domain.RegistrationRequest) error {
+	ctx := c.Request().Context()
+
+	req := tailcfg.RegisterRequest(registrationRequest.Data)
+	machineKey := registrationRequest.MachineKey
 	nodeKey := req.NodeKey.String()
 
-	authKey, err := h.repository.LoadAuthKey(ctx, authKeyParam)
-	if err != nil {
-		return err
+	var tailnet *domain.Tailnet
+	var user *domain.User
+	var ephemeral bool
+	var tags = []string{}
+	var authorized = false
+
+	if form.AuthKey != "" {
+		authKey, err := h.repository.LoadAuthKey(ctx, form.AuthKey)
+		if err != nil {
+			return logError(err)
+		}
+
+		if authKey == nil {
+
+			registrationRequest.Authenticated = false
+			registrationRequest.Error = "invalid auth key"
+
+			if err := h.repository.SaveRegistrationRequest(ctx, registrationRequest); err != nil {
+				return logError(err)
+			}
+
+			return c.Redirect(http.StatusFound, "/a/error?e=iak")
+		}
+
+		tailnet = &authKey.Tailnet
+		user = &authKey.User
+		tags = authKey.Tags
+		ephemeral = authKey.Ephemeral
+		authorized = authKey.PreAuthorized
+	} else {
+		selectedTailnet, err := h.repository.GetTailnet(ctx, form.TailnetID)
+		if err != nil {
+			return logError(err)
+		}
+
+		account, err := h.repository.GetAccount(ctx, form.AccountID)
+		if err != nil {
+			return logError(err)
+		}
+
+		selectedUser, _, err := h.repository.GetOrCreateUserWithAccount(ctx, selectedTailnet, account)
+		if err != nil {
+			return logError(err)
+		}
+
+		user = selectedUser
+		tailnet = selectedTailnet
+		ephemeral = false
 	}
 
-	if authKey == nil {
-		return c.Redirect(http.StatusFound, "/a/error?e=iak")
+	if err := tailnet.ACLPolicy.Get().CheckTagOwners(registrationRequest.Data.Hostinfo.RequestTags, user); err != nil {
+		registrationRequest.Authenticated = false
+		registrationRequest.Error = err.Error()
+		if err := h.repository.SaveRegistrationRequest(ctx, registrationRequest); err != nil {
+			return logError(err)
+		}
+		return c.Redirect(http.StatusFound, "/a/error?e=nto")
 	}
 
-	tailnet := authKey.Tailnet
-	user := authKey.User
+	autoAllowIPs := tailnet.ACLPolicy.Get().FindAutoApprovedIPs(req.Hostinfo.RoutableIPs, tags, user)
 
 	var m *domain.Machine
 
-	m, err = h.repository.GetMachineByKey(ctx, tailnet.ID, machineKey)
+	m, err := h.repository.GetMachineByKeyAndUser(ctx, machineKey, user.ID)
 	if err != nil {
-		return err
+		return logError(err)
 	}
 
-	if m == nil {
-		now := time.Now().UTC()
+	now := time.Now().UTC()
 
-		registeredTags := authKey.Tags
+	if m == nil {
+		registeredTags := tags
 		advertisedTags := domain.SanitizeTags(req.Hostinfo.RequestTags)
 		tags := append(registeredTags, advertisedTags...)
 
 		sanitizeHostname := dnsname.SanitizeHostname(req.Hostinfo.Hostname)
 		nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 		if err != nil {
-			return err
+			return logError(err)
 		}
 
 		m = &domain.Machine{
-			ID:             util.NextID(),
-			Name:           sanitizeHostname,
-			NameIdx:        nameIdx,
-			MachineKey:     machineKey,
-			NodeKey:        nodeKey,
-			Ephemeral:      authKey.Ephemeral,
-			RegisteredTags: registeredTags,
-			Tags:           domain.SanitizeTags(tags),
-			CreatedAt:      now,
+			ID:                util.NextID(),
+			Name:              sanitizeHostname,
+			NameIdx:           nameIdx,
+			UseOSHostname:     true,
+			MachineKey:        machineKey,
+			NodeKey:           nodeKey,
+			Ephemeral:         ephemeral || req.Ephemeral,
+			RegisteredTags:    registeredTags,
+			Tags:              domain.SanitizeTags(tags),
+			AutoAllowIPs:      autoAllowIPs,
+			CreatedAt:         now,
+			ExpiresAt:         now.Add(180 * 24 * time.Hour).UTC(),
+			KeyExpiryDisabled: len(tags) != 0,
+			Authorized:        !tailnet.MachineAuthorizationEnabled || authorized,
 
-			User:    user,
-			Tailnet: tailnet,
-		}
-
-		if !req.Expiry.IsZero() {
-			m.ExpiresAt = &req.Expiry
+			User:      *user,
+			UserID:    user.ID,
+			Tailnet:   *tailnet,
+			TailnetID: tailnet.ID,
 		}
 
 		ipv4, ipv6, err := addr.SelectIP(checkIP(ctx, h.repository.CountMachinesWithIPv4))
 		if err != nil {
-			return err
+			return logError(err)
 		}
-		m.IPv4 = domain.IP{IP: ipv4}
-		m.IPv6 = domain.IP{IP: ipv6}
+		m.IPv4 = domain.IP{Addr: ipv4}
+		m.IPv6 = domain.IP{Addr: ipv6}
 	} else {
-		registeredTags := authKey.Tags
+		registeredTags := tags
 		advertisedTags := domain.SanitizeTags(req.Hostinfo.RequestTags)
 		tags := append(registeredTags, advertisedTags...)
 
 		sanitizeHostname := dnsname.SanitizeHostname(req.Hostinfo.Hostname)
-		if m.Name != sanitizeHostname {
+		if m.UseOSHostname && m.Name != sanitizeHostname {
 			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 			if err != nil {
-				return err
+				return logError(err)
 			}
 			m.Name = sanitizeHostname
 			m.NameIdx = nameIdx
 		}
 		m.NodeKey = nodeKey
-		m.Ephemeral = authKey.Ephemeral
+		m.Ephemeral = ephemeral || req.Ephemeral
 		m.RegisteredTags = registeredTags
 		m.Tags = domain.SanitizeTags(tags)
+		m.AutoAllowIPs = autoAllowIPs
 		m.UserID = user.ID
-		m.User = user
+		m.User = *user
 		m.TailnetID = tailnet.ID
-		m.Tailnet = tailnet
-		m.ExpiresAt = nil
+		m.Tailnet = *tailnet
+		m.ExpiresAt = now.Add(180 * 24 * time.Hour).UTC()
 	}
 
-	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
+	err = h.repository.Transaction(func(rp domain.Repository) error {
+		registrationRequest.Authenticated = true
+		registrationRequest.Error = ""
+		registrationRequest.UserID = user.ID
+
+		if err := rp.SetUserLastAuthenticated(ctx, m.UserID, time.Now().UTC()); err != nil {
+			return err
+		}
+
+		if err := rp.SaveMachine(ctx, m); err != nil {
+			return err
+		}
+
+		if err := rp.SaveRegistrationRequest(ctx, registrationRequest); err != nil {
+			return err
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return logError(err)
 	}
 
-	return c.Redirect(http.StatusFound, "/a/success")
+	if m.Authorized {
+		return c.Redirect(http.StatusFound, "/a/success")
+	} else {
+		return c.Redirect(http.StatusFound, "/a/success?s=nma")
+	}
+}
+
+func (h *AuthenticationHandlers) isSystemAdmin(u *auth.User) (bool, error) {
+	return h.systemIAMPolicy.EvaluatePolicy(&domain.Identity{UserID: u.ID, Email: u.Name, Attr: u.Attr})
+}
+
+func (h *AuthenticationHandlers) listAvailableTailnets(ctx context.Context, u *auth.User) ([]domain.Tailnet, error) {
+	var result = []domain.Tailnet{}
+	tailnets, err := h.repository.ListTailnets(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, t := range tailnets {
+		approved, err := t.IAMPolicy.Get().EvaluatePolicy(&domain.Identity{UserID: u.ID, Email: u.Name, Attr: u.Attr})
+		if err != nil {
+			return nil, err
+		}
+		if approved {
+			result = append(result, t)
+		}
+	}
+	return result, nil
+}
+
+func (h *AuthenticationHandlers) exchangeUser(code string) (*auth.User, error) {
+	redirectUrl := h.config.CreateUrl("/a/callback")
+
+	user, err := h.authProvider.Exchange(redirectUrl, code)
+	if err != nil {
+		return nil, err
+	}
+
+	return user, nil
+}
+
+func (h *AuthenticationHandlers) createState(flow AuthFlow, key string) (string, error) {
+	stateMap := oauthState{Key: key, Flow: flow}
+	marshal, err := json.Marshal(&stateMap)
+	if err != nil {
+		return "", err
+	}
+	return base58.FastBase58Encoding(marshal), nil
+}
+
+func (h *AuthenticationHandlers) readState(s string) (*oauthState, error) {
+	decodedState, err := base58.FastBase58Decoding(s)
+	if err != nil {
+		return nil, err
+	}
+
+	var state = &oauthState{}
+	if err := json.Unmarshal(decodedState, state); err != nil {
+		return nil, err
+	}
+	return state, nil
 }

internal/handlers/derp.go

@@ -0,0 +1,46 @@
+package handlers
+
+import (
+	"fmt"
+	"github.com/labstack/echo/v4"
+	"go.uber.org/zap"
+	"net/http"
+	"tailscale.com/derp"
+	"tailscale.com/derp/derphttp"
+	"tailscale.com/types/key"
+)
+
+func NewDERPHandler() *DERPHandlers {
+	logger := zap.L().Named("derp")
+	return &DERPHandlers{
+		s: derp.NewServer(key.NewNode(), func(format string, args ...any) {
+			logger.Debug(fmt.Sprintf(format, args...))
+		}),
+	}
+}
+
+type DERPHandlers struct {
+	s *derp.Server
+}
+
+func (h *DERPHandlers) Handler(c echo.Context) error {
+	derphttp.Handler(h.s).ServeHTTP(c.Response(), c.Request())
+	return nil
+}
+
+func (h *DERPHandlers) LatencyCheck(c echo.Context) error {
+	return c.String(http.StatusOK, "")
+}
+
+func (h *DERPHandlers) DebugTraffic(c echo.Context) error {
+	h.s.ServeDebugTraffic(c.Response(), c.Request())
+	return nil
+}
+
+func (h *DERPHandlers) DebugCheck(c echo.Context) error {
+	if err := h.s.ConsistencyCheck(); err != nil {
+		return err
+	}
+
+	return c.String(http.StatusOK, "DERP Server ConsistencyCheck okay")
+}

internal/handlers/dns.go

@@ -0,0 +1,70 @@
+package handlers
+
+import (
+	"github.com/jsiebens/ionscale/internal/dns"
+	"github.com/labstack/echo/v4"
+	"net"
+	"net/http"
+	"strings"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+	"time"
+)
+
+func NewDNSHandlers(_ key.MachinePublic, provider dns.Provider) *DNSHandlers {
+	return &DNSHandlers{
+		provider: provider,
+	}
+}
+
+type DNSHandlers struct {
+	provider dns.Provider
+}
+
+func (h *DNSHandlers) SetDNS(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	req := &tailcfg.SetDNSRequest{}
+	if err := c.Bind(req); err != nil {
+		return logError(err)
+	}
+
+	if req.Version < SupportedCapabilityVersion {
+		return UnsupportedClientVersionError
+	}
+
+	if h.provider == nil {
+		return echo.NewHTTPError(http.StatusNotFound)
+	}
+
+	if err := h.provider.SetRecord(ctx, req.Type, req.Name, req.Value); err != nil {
+		return logError(err)
+	}
+
+	if strings.HasPrefix(req.Name, "_acme-challenge") && req.Type == "TXT" {
+		// Listen to connection close
+		notify := ctx.Done()
+		timeout := time.After(5 * time.Minute)
+		tick := time.NewTicker(5 * time.Second)
+
+		defer func() { tick.Stop() }()
+
+		for {
+			select {
+			case <-tick.C:
+				txtrecords, _ := net.LookupTXT(req.Name)
+				for _, txt := range txtrecords {
+					if txt == req.Value {
+						return c.JSON(http.StatusOK, tailcfg.SetDNSResponse{})
+					}
+				}
+			case <-timeout:
+				return c.JSON(http.StatusOK, tailcfg.SetDNSResponse{})
+			case <-notify:
+				return nil
+			}
+		}
+	}
+
+	return c.JSON(http.StatusOK, tailcfg.SetDNSResponse{})
+}

internal/handlers/http_redirect.go

@@ -1,44 +1,22 @@
 package handlers
 
 import (
-	"github.com/caddyserver/certmagic"
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/labstack/echo/v4"
-	"net"
-	"net/http"
+	"github.com/labstack/echo/v4/middleware"
 )
 
-func HttpRedirectHandler(tls config.Tls) echo.HandlerFunc {
-	if tls.CertMagicDomain != "" {
-		cfg := certmagic.NewDefault()
-		if len(cfg.Issuers) > 0 {
-			if am, ok := cfg.Issuers[0].(*certmagic.ACMEIssuer); ok {
-				handler := am.HTTPChallengeHandler(http.HandlerFunc(httpRedirectHandler))
-				return echo.WrapHandler(handler)
-			}
+func httpsRedirectSkipper(c config.Tls) func(ctx echo.Context) bool {
+	return func(ctx echo.Context) bool {
+		if ctx.Request().Method == "POST" && ctx.Request().RequestURI == "/ts2021" {
+			return true
 		}
+		return !c.ForceHttps
 	}
-
-	if tls.Disable {
-		return IndexHandler(http.StatusNotFound)
-	}
-
-	return echo.WrapHandler(http.HandlerFunc(httpRedirectHandler))
 }
 
-func httpRedirectHandler(w http.ResponseWriter, r *http.Request) {
-	toURL := "https://"
-	requestHost := hostOnly(r.Host)
-	toURL += requestHost
-	toURL += r.URL.RequestURI()
-	w.Header().Set("Connection", "close")
-	http.Redirect(w, r, toURL, http.StatusMovedPermanently)
-}
-
-func hostOnly(hostport string) string {
-	host, _, err := net.SplitHostPort(hostport)
-	if err != nil {
-		return hostport
-	}
-	return host
+func HttpsRedirect(c config.Tls) echo.MiddlewareFunc {
+	return middleware.HTTPSRedirectWithConfig(middleware.RedirectConfig{
+		Skipper: httpsRedirectSkipper(c),
+	})
 }

internal/handlers/id_token.go

@@ -0,0 +1,159 @@
+package handlers
+
+import (
+	"fmt"
+	"github.com/go-jose/go-jose/v3"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/util"
+	"github.com/labstack/echo/v4"
+	"net/http"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+	"time"
+)
+
+func NewIDTokenHandlers(machineKey key.MachinePublic, config *config.Config, repository domain.Repository) *IDTokenHandlers {
+	return &IDTokenHandlers{
+		machineKey: machineKey,
+		issuer:     config.PublicUrl.String(),
+		repository: repository,
+	}
+}
+
+func NewOIDCConfigHandlers(config *config.Config, repository domain.Repository) *OIDCConfigHandlers {
+	return &OIDCConfigHandlers{
+		issuer:     config.PublicUrl.String(),
+		jwksUri:    config.CreateUrl("/.well-known/jwks"),
+		repository: repository,
+	}
+}
+
+type IDTokenHandlers struct {
+	machineKey key.MachinePublic
+	issuer     string
+	repository domain.Repository
+}
+
+func (h *IDTokenHandlers) FetchToken(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	req := &tailcfg.TokenRequest{}
+	if err := c.Bind(req); err != nil {
+		return logError(err)
+	}
+
+	if req.CapVersion < SupportedCapabilityVersion {
+		return UnsupportedClientVersionError
+	}
+
+	keySet, err := h.repository.GetJSONWebKeySet(c.Request().Context())
+	if err != nil {
+		return logError(err)
+	}
+
+	machineKey := h.machineKey.String()
+	nodeKey := req.NodeKey.String()
+
+	var m *domain.Machine
+	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)
+	if err != nil {
+		return logError(err)
+	}
+
+	if m == nil {
+		return echo.NewHTTPError(http.StatusBadRequest)
+	}
+
+	_, tailnetDomain, sub := h.names(m)
+
+	now := time.Now()
+
+	claims := jwt.MapClaims{
+		"jit": fmt.Sprintf("%d", util.NextID()),
+		"iss": h.issuer,
+		"sub": sub,
+		"aud": []string{req.Audience},
+		"exp": jwt.NewNumericDate(now.Add(5 * time.Minute)),
+		"nbf": jwt.NewNumericDate(now),
+		"iat": jwt.NewNumericDate(now),
+
+		"key":       m.NodeKey,
+		"addresses": []string{m.IPv4.String(), m.IPv6.String()},
+		"nid":       m.ID,
+		"node":      sub,
+		"domain":    tailnetDomain,
+	}
+
+	if m.HasTags() {
+		tags := []string{}
+		for _, t := range m.Tags {
+			tags = append(tags, fmt.Sprintf("%s:%s", tailnetDomain, t))
+		}
+		claims["tags"] = tags
+	} else {
+		claims["user"] = fmt.Sprintf("%s:%s", tailnetDomain, m.User.Name)
+		claims["uid"] = m.UserID
+	}
+
+	unsignedToken := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	unsignedToken.Header["kid"] = keySet.Key.Id
+
+	jwtB64, err := unsignedToken.SignedString(&keySet.Key.PrivateKey)
+	if err != nil {
+		return logError(err)
+	}
+
+	resp := tailcfg.TokenResponse{IDToken: jwtB64}
+	return c.JSON(http.StatusOK, resp)
+}
+
+type OIDCConfigHandlers struct {
+	issuer     string
+	jwksUri    string
+	repository domain.Repository
+}
+
+func (h *OIDCConfigHandlers) OpenIDConfig(c echo.Context) error {
+	v := map[string]interface{}{}
+
+	v["issuer"] = h.issuer
+	v["jwks_uri"] = h.jwksUri
+	v["subject_types_supported"] = []string{"public"}
+	v["response_types_supported"] = []string{"id_token"}
+	v["scopes_supported"] = []string{"openid"}
+	v["id_token_signing_alg_values_supported"] = []string{"RS256"}
+	v["claims_supported"] = []string{
+		"sub",
+		"aud",
+		"exp",
+		"iat",
+		"iss",
+		"jti",
+		"nbf",
+	}
+
+	return c.JSON(http.StatusOK, v)
+}
+
+func (h *OIDCConfigHandlers) Jwks(c echo.Context) error {
+	keySet, err := h.repository.GetJSONWebKeySet(c.Request().Context())
+	if err != nil {
+		return logError(err)
+	}
+
+	pub := jose.JSONWebKey{Key: keySet.Key.Public(), KeyID: keySet.Key.Id, Algorithm: "RS256", Use: "sig"}
+	set := jose.JSONWebKeySet{Keys: []jose.JSONWebKey{pub}}
+	return c.JSON(http.StatusOK, set)
+}
+
+func (h *IDTokenHandlers) names(m *domain.Machine) (string, string, string) {
+	var name = m.Name
+	if m.NameIdx != 0 {
+		name = fmt.Sprintf("%s-%d", m.Name, m.NameIdx)
+	}
+
+	sanitizedTailnetName := domain.SanitizeTailnetName(m.Tailnet.Name)
+	return name, sanitizedTailnetName, fmt.Sprintf("%s.%s", name, sanitizedTailnetName)
+}

internal/handlers/index.go

@@ -1,17 +1,13 @@
 package handlers
 
 import (
-	"fmt"
+	tpl "github.com/jsiebens/ionscale/internal/templates"
 	"github.com/jsiebens/ionscale/internal/version"
 	"github.com/labstack/echo/v4"
 )
 
 func IndexHandler(code int) echo.HandlerFunc {
 	return func(c echo.Context) error {
-		info, s := version.GetReleaseInfo()
-		data := map[string]interface{}{
-			"Version": fmt.Sprintf("%s - %s", info, s),
-		}
-		return c.Render(code, "index.html", data)
+		return c.Render(code, "", tpl.Index(version.GetReleaseInfo()))
 	}
 }

internal/handlers/key.go

@@ -9,9 +9,13 @@ import (
 )
 
 const (
-	NoiseCapabilityVersion = 28
+	SupportedCapabilityVersion      = 68
+	NoiseCapabilityVersion          = 28
+	UnsupportedClientVersionMessage = "ionscale only support client version >= 1.48.0, please upgrade your client"
 )
 
+var UnsupportedClientVersionError = echo.NewHTTPError(http.StatusBadRequest, UnsupportedClientVersionMessage)
+
 func KeyHandler(keys *config.ServerKeys) echo.HandlerFunc {
 	legacyPublicKey := keys.LegacyControlKey.Public()
 	publicKey := keys.ControlKey.Public()
@@ -22,7 +26,7 @@ func KeyHandler(keys *config.ServerKeys) echo.HandlerFunc {
 		if v != "" {
 			clientCapabilityVersion, err := strconv.Atoi(v)
 			if err != nil {
-				return c.String(http.StatusBadRequest, "Invalid version")
+				return echo.NewHTTPError(http.StatusBadRequest, "Invalid version")
 			}
 
 			if clientCapabilityVersion >= NoiseCapabilityVersion {

internal/handlers/metrics.go

@@ -0,0 +1,16 @@
+package handlers
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+const prometheusNamespace = "ionscale"
+
+var (
+	connectedDevices = promauto.NewGaugeVec(prometheus.GaugeOpts{
+		Namespace: prometheusNamespace,
+		Name:      "connected_machines_total",
+		Help:      "Total amount of connected machines",
+	}, []string{"tailnet"})
+)

internal/handlers/noise.go

@@ -1,12 +1,13 @@
 package handlers
 
 import (
-	"context"
+	stderrors "errors"
 	"github.com/labstack/echo/v4"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
+	"io"
 	"net/http"
-	"tailscale.com/control/controlhttp"
+	"tailscale.com/control/controlhttp/controlhttpserver"
 	"tailscale.com/net/netutil"
 	"tailscale.com/types/key"
 )
@@ -26,14 +27,49 @@ func NewNoiseHandlers(controlKey key.MachinePrivate, createPeerHandler CreatePee
 }
 
 func (h *NoiseHandlers) Upgrade(c echo.Context) error {
-	conn, err := controlhttp.AcceptHTTP(context.Background(), c.Response(), c.Request(), h.controlKey)
+	conn, err := controlhttpserver.AcceptHTTP(c.Request().Context(), c.Response(), c.Request(), h.controlKey, nil)
 	if err != nil {
-		return err
+		return logError(err)
 	}
 
 	handler := h.createPeerHandler(conn.Peer())
 
 	server := http.Server{}
 	server.Handler = h2c.NewHandler(handler, &http2.Server{})
-	return server.Serve(netutil.NewOneConnListener(conn, nil))
+	if err := server.Serve(netutil.NewOneConnListener(conn, nil)); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+	return nil
+}
+
+type JsonBinder struct {
+	echo.DefaultBinder
+}
+
+func (b JsonBinder) Bind(i interface{}, c echo.Context) error {
+	if err := b.BindPathParams(c, i); err != nil {
+		return err
+	}
+
+	method := c.Request().Method
+	if method == http.MethodGet || method == http.MethodDelete || method == http.MethodHead {
+		if err := b.BindQueryParams(c, i); err != nil {
+			return err
+		}
+	}
+
+	if c.Request().ContentLength == 0 {
+		return nil
+	}
+
+	if err := c.Echo().JSONSerializer.Deserialize(c, i); err != nil {
+		switch err.(type) {
+		case *echo.HTTPError:
+			return err
+		default:
+			return echo.NewHTTPError(http.StatusBadRequest, err.Error()).SetInternal(err)
+		}
+	}
+
+	return nil
 }

internal/handlers/poll_net_map.go

@@ -2,160 +2,168 @@ package handlers
 
 import (
 	"context"
-	"github.com/jsiebens/ionscale/internal/bind"
-	"github.com/jsiebens/ionscale/internal/broker"
+	"encoding/binary"
+	"encoding/json"
+	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/mapping"
+	"github.com/klauspost/compress/zstd"
 	"github.com/labstack/echo/v4"
 	"net/http"
+	"slices"
+	"sync"
+	"tailscale.com/smallzstd"
 	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
 	"tailscale.com/util/dnsname"
 	"time"
 )
 
-const (
-	keepAliveInterval = 1 * time.Minute
-)
-
 func NewPollNetMapHandler(
-	createBinder bind.Factory,
-	brokers *broker.BrokerPool,
-	repository domain.Repository,
-	offlineTimers *OfflineTimers) *PollNetMapHandler {
+	machineKey key.MachinePublic,
+	sessionManager core.PollMapSessionManager,
+	repository domain.Repository) *PollNetMapHandler {
 
 	handler := &PollNetMapHandler{
-		createBinder:  createBinder,
-		brokers:       brokers.Get,
-		repository:    repository,
-		offlineTimers: offlineTimers,
+		machineKey:     machineKey,
+		sessionManager: sessionManager,
+		repository:     repository,
 	}
 
 	return handler
 }
 
 type PollNetMapHandler struct {
-	createBinder  bind.Factory
-	repository    domain.Repository
-	brokers       func(uint64) broker.Broker
-	offlineTimers *OfflineTimers
+	machineKey     key.MachinePublic
+	repository     domain.Repository
+	sessionManager core.PollMapSessionManager
 }
 
 func (h *PollNetMapHandler) PollNetMap(c echo.Context) error {
 	ctx := c.Request().Context()
-	binder, err := h.createBinder(c)
-	if err != nil {
-		return err
-	}
 
 	req := &tailcfg.MapRequest{}
-	if err := binder.BindRequest(c, req); err != nil {
-		return err
+	if err := c.Bind(req); err != nil {
+		return logError(err)
 	}
 
-	machineKey := binder.Peer().String()
+	if req.Version < SupportedCapabilityVersion {
+		return UnsupportedClientVersionError
+	}
+
+	machineKey := h.machineKey.String()
 	nodeKey := req.NodeKey.String()
 
 	var m *domain.Machine
-	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)
+	m, err := h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)
 	if err != nil {
-		return err
+		return logError(err)
 	}
 
 	if m == nil {
 		return echo.NewHTTPError(http.StatusNotFound)
 	}
 
-	if req.ReadOnly {
-		return h.handleReadOnly(c, binder, m, req)
-	} else {
-		return h.handleUpdate(c, binder, m, req)
-	}
+	return h.handlePollNetMap(c, m, req)
 }
 
-func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *domain.Machine, mapRequest *tailcfg.MapRequest) error {
+func (h *PollNetMapHandler) handlePollNetMap(c echo.Context, m *domain.Machine, mapRequest *tailcfg.MapRequest) error {
 	ctx := c.Request().Context()
 
 	now := time.Now().UTC()
-
-	m.HostInfo = domain.HostInfo(*mapRequest.Hostinfo)
-	m.DiscoKey = mapRequest.DiscoKey.String()
-	m.Endpoints = mapRequest.Endpoints
-	m.LastSeen = &now
-
-	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
-	}
-
 	tailnetID := m.TailnetID
 	machineID := m.ID
 
-	tailnetBroker := h.brokers(tailnetID)
-	tailnetBroker.SignalPeerUpdated(machineID)
+	mapper := mapping.NewPollNetMapper(mapRequest, m.ID, h.repository, h.sessionManager)
+
+	response, err := h.createMapResponse(mapper, false, mapRequest.Compress)
+	if err != nil {
+		return logError(err)
+	}
 
 	if !mapRequest.Stream {
-		return c.String(http.StatusOK, "")
+		if !slices.Equal(m.HostInfo.RoutableIPs, mapRequest.Hostinfo.RoutableIPs) {
+			m.AutoAllowIPs = m.Tailnet.ACLPolicy.Get().FindAutoApprovedIPs(mapRequest.Hostinfo.RoutableIPs, m.Tags, &m.User)
+		}
+
+		m.HostInfo = domain.HostInfo(*mapRequest.Hostinfo)
+		m.DiscoKey = mapRequest.DiscoKey.String()
+		m.Endpoints = mapRequest.Endpoints
+		m.LastSeen = &now
+
+		sanitizeHostname := dnsname.SanitizeHostname(m.HostInfo.Hostname)
+		if m.UseOSHostname && m.Name != sanitizeHostname {
+			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, m.TailnetID, sanitizeHostname)
+			if err != nil {
+				return logError(err)
+			}
+			m.Name = sanitizeHostname
+			m.NameIdx = nameIdx
+		}
+
+		if err := h.repository.SaveMachine(ctx, m); err != nil {
+			return logError(err)
+		}
+
+		h.sessionManager.NotifyAll(tailnetID)
+
+		return c.JSONBlob(http.StatusOK, response)
 	}
 
-	var syncedPeers = make(map[uint64]bool)
+	updateChan := make(chan *core.Ping, 20)
+	h.sessionManager.Register(m.TailnetID, m.ID, updateChan)
 
-	response, syncedPeers, err := h.createMapResponse(m, binder, mapRequest, false, make(map[uint64]bool))
+	// Listen to connection close
+	notify := ctx.Done()
+
+	keepAliveResponse, err := h.createKeepAliveResponse(mapRequest)
 	if err != nil {
-		return err
+		return logError(err)
 	}
 
-	updateChan := make(chan *broker.Signal, 20)
-	client := broker.NewClient(machineID, updateChan)
-
-	tailnetBroker.AddClient(&client)
-	h.cancelOfflineMessage(machineID)
-
-	// Listen to connection close and un-register messageChan
-	notify := c.Request().Context().Done()
-
-	keepAliveResponse, err := h.createKeepAliveResponse(binder, mapRequest)
-	if err != nil {
-		return err
-	}
-	keepAliveTicker := time.NewTicker(keepAliveInterval)
-	syncTicker := time.NewTicker(5 * time.Second)
-
-	var latestSync = time.Now()
-	var latestUpdate = latestSync
-
 	c.Response().WriteHeader(http.StatusOK)
 
 	if _, err := c.Response().Write(response); err != nil {
-		return err
+		return logError(err)
 	}
 	c.Response().Flush()
 
+	connectedDevices.WithLabelValues(m.Tailnet.Name).Inc()
+
+	keepAliveTicker := time.NewTicker(config.KeepAliveInterval())
+	syncTicker := time.NewTicker(5 * time.Second)
+
 	defer func() {
-		tailnetBroker.RemoveClient(machineID)
+		connectedDevices.WithLabelValues(m.Tailnet.Name).Dec()
+		h.sessionManager.Deregister(m.TailnetID, m.ID, updateChan)
 		keepAliveTicker.Stop()
 		syncTicker.Stop()
 		_ = h.repository.SetMachineLastSeen(ctx, machineID)
-		h.scheduleOfflineMessage(tailnetID, machineID)
 	}()
 
+	var shouldUpdate bool = false
+
 	for {
 		select {
-		case s := <-updateChan:
-			if s.PeerUpdated == nil || *s.PeerUpdated != machineID {
-				latestUpdate = time.Now()
+		case _, ok := <-updateChan:
+			if !ok {
+				return nil
 			}
+			shouldUpdate = true
 		case <-keepAliveTicker.C:
 			if mapRequest.KeepAlive {
 				if _, err := c.Response().Write(keepAliveResponse); err != nil {
-					return err
+					return logError(err)
 				}
 				_ = h.repository.SetMachineLastSeen(ctx, machineID)
 				c.Response().Flush()
 			}
 		case <-syncTicker.C:
-			if latestSync.Before(latestUpdate) {
+			if shouldUpdate {
 				machine, err := h.repository.GetMachine(ctx, machineID)
 				if err != nil {
-					return err
+					return logError(err)
 				}
 				if machine == nil {
 					return nil
@@ -164,18 +172,18 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 				var payload []byte
 				var payloadErr error
 
-				payload, syncedPeers, payloadErr = h.createMapResponse(machine, binder, mapRequest, true, syncedPeers)
+				payload, payloadErr = h.createMapResponse(mapper, true, mapRequest.Compress)
 
 				if payloadErr != nil {
 					return payloadErr
 				}
 
 				if _, err := c.Response().Write(payload); err != nil {
-					return err
+					return logError(err)
 				}
 				c.Response().Flush()
 
-				latestSync = latestUpdate
+				shouldUpdate = false
 			}
 		case <-notify:
 			return nil
@@ -183,185 +191,57 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 	}
 }
 
-func (h *PollNetMapHandler) handleReadOnly(c echo.Context, binder bind.Binder, m *domain.Machine, request *tailcfg.MapRequest) error {
-	ctx := c.Request().Context()
-
-	m.HostInfo = domain.HostInfo(*request.Hostinfo)
-	m.DiscoKey = request.DiscoKey.String()
-
-	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
-	}
-
-	response, _, err := h.createMapResponse(m, binder, request, false, map[uint64]bool{})
-	if err != nil {
-		return err
-	}
-
-	_, err = c.Response().Write(response)
-	return err
-}
-
-func (h *PollNetMapHandler) scheduleOfflineMessage(tailnetID, machineID uint64) {
-	h.offlineTimers.startCh <- [2]uint64{tailnetID, machineID}
-}
-
-func (h *PollNetMapHandler) cancelOfflineMessage(machineID uint64) {
-	h.offlineTimers.stopCh <- machineID
-}
-
-func (h *PollNetMapHandler) createKeepAliveResponse(binder bind.Binder, request *tailcfg.MapRequest) ([]byte, error) {
+func (h *PollNetMapHandler) createKeepAliveResponse(request *tailcfg.MapRequest) ([]byte, error) {
 	mapResponse := &tailcfg.MapResponse{
 		KeepAlive: true,
 	}
 
-	return binder.Marshal(request.Compress, mapResponse)
+	return h.marshalResponse(request.Compress, mapResponse)
 }
 
-func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Binder, request *tailcfg.MapRequest, delta bool, prevSyncedPeerIDs map[uint64]bool) ([]byte, map[uint64]bool, error) {
-	ctx := context.TODO()
-
-	node, err := mapping.ToNode(m, true)
+func (h *PollNetMapHandler) createMapResponse(m *mapping.PollNetMapper, delta bool, compress string) ([]byte, error) {
+	response, err := m.CreateMapResponse(context.Background(), delta)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
+	return h.marshalResponse(compress, response)
+}
 
-	policies, err := h.repository.GetACLPolicy(ctx, m.TailnetID)
+func (h *PollNetMapHandler) marshalResponse(compress string, v interface{}) ([]byte, error) {
+	var payload []byte
+
+	marshalled, err := json.Marshal(v)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 
-	users, err := h.repository.ListUsers(ctx, m.TailnetID)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	var changedPeers []*tailcfg.Node
-	var removedPeers []tailcfg.NodeID
-
-	candidatePeers, err := h.repository.ListMachinePeers(ctx, m.TailnetID, m.MachineKey)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	syncedPeerIDs := map[uint64]bool{}
-
-	for _, peer := range candidatePeers {
-		if domain.IsValidPeer(policies, m, &peer) || domain.IsValidPeer(policies, &peer, m) {
-			n, err := mapping.ToNode(&peer, h.brokers(peer.TailnetID).IsConnected(peer.ID))
-			if err != nil {
-				return nil, nil, err
-			}
-			changedPeers = append(changedPeers, n)
-			syncedPeerIDs[peer.ID] = true
-			delete(prevSyncedPeerIDs, peer.ID)
-		}
-	}
-
-	for p, _ := range prevSyncedPeerIDs {
-		removedPeers = append(removedPeers, tailcfg.NodeID(p))
-	}
-
-	dnsConfig, err := h.repository.GetDNSConfig(ctx, m.TailnetID)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	derpMap, err := h.repository.GetDERPMap(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	rules := domain.BuildFilterRules(policies, m, candidatePeers)
-
-	controlTime := time.Now().UTC()
-	var mapResponse *tailcfg.MapResponse
-
-	if !delta {
-		mapResponse = &tailcfg.MapResponse{
-			KeepAlive:    false,
-			Node:         node,
-			DNSConfig:    mapping.ToDNSConfig(&m.Tailnet, dnsConfig),
-			PacketFilter: rules,
-			DERPMap:      derpMap,
-			Domain:       dnsname.SanitizeHostname(m.Tailnet.Name),
-			Peers:        changedPeers,
-			UserProfiles: mapping.ToUserProfiles(users),
-			ControlTime:  &controlTime,
-		}
+	if compress == "zstd" {
+		payload = zstdEncode(marshalled)
 	} else {
-		mapResponse = &tailcfg.MapResponse{
-			PacketFilter: rules,
-			PeersChanged: changedPeers,
-			PeersRemoved: removedPeers,
-			UserProfiles: mapping.ToUserProfiles(users),
-			ControlTime:  &controlTime,
+		payload = marshalled
+	}
+
+	data := make([]byte, 4)
+	binary.LittleEndian.PutUint32(data, uint32(len(payload)))
+	data = append(data, payload...)
+
+	return data, nil
+}
+
+func zstdEncode(in []byte) []byte {
+	encoder := zstdEncoderPool.Get().(*zstd.Encoder)
+	out := encoder.EncodeAll(in, nil)
+	_ = encoder.Close()
+	zstdEncoderPool.Put(encoder)
+	return out
+}
+
+var zstdEncoderPool = &sync.Pool{
+	New: func() any {
+		encoder, err := smallzstd.NewEncoder(nil, zstd.WithEncoderLevel(zstd.SpeedFastest))
+		if err != nil {
+			panic(err)
 		}
-	}
-
-	if request.OmitPeers {
-		mapResponse.PeersChanged = nil
-		mapResponse.PeersRemoved = nil
-		mapResponse.Peers = nil
-	}
-
-	payload, err := binder.Marshal(request.Compress, mapResponse)
-
-	return payload, syncedPeerIDs, nil
-}
-
-func NewOfflineTimers(repository domain.Repository, brokers *broker.BrokerPool) *OfflineTimers {
-	return &OfflineTimers{
-		repository: repository,
-		brokers:    brokers.Get,
-		data:       make(map[uint64]*time.Timer),
-		startCh:    make(chan [2]uint64),
-		stopCh:     make(chan uint64),
-	}
-}
-
-type OfflineTimers struct {
-	repository domain.Repository
-	brokers    func(uint64) broker.Broker
-	data       map[uint64]*time.Timer
-	stopCh     chan uint64
-	startCh    chan [2]uint64
-}
-
-func (o *OfflineTimers) Start() {
-	for {
-		select {
-		case i := <-o.startCh:
-			o.scheduleOfflineMessage(i[0], i[1])
-		case m := <-o.stopCh:
-			o.cancelOfflineMessage(m)
-		}
-	}
-}
-
-func (o *OfflineTimers) scheduleOfflineMessage(tailnetID, machineID uint64) {
-	t, ok := o.data[machineID]
-	if ok {
-		t.Stop()
-		delete(o.data, machineID)
-	}
-
-	timer := time.NewTimer(10 * time.Second)
-	go func() {
-		<-timer.C
-		if !o.brokers(tailnetID).IsConnected(machineID) {
-			o.brokers(tailnetID).SignalPeerUpdated(machineID)
-			o.stopCh <- machineID
-		}
-	}()
-
-	o.data[machineID] = timer
-}
-
-func (o *OfflineTimers) cancelOfflineMessage(machineID uint64) {
-	t, ok := o.data[machineID]
-	if ok {
-		t.Stop()
-		delete(o.data, machineID)
-	}
+		return encoder
+	},
 }