chore(deps): upgrade golang.org/x/net

feat: subnet router failover
chore: remove pubsub and introduce session manager
2026-04-06 13:02:58 +01:00 · 2022-12-25 07:45:28 +01:00 · 2022-12-25 07:40:19 +01:00 · 2022-12-24 12:00:00 +01:00 · 2022-12-21 06:12:41 +01:00 · 2022-11-30 08:31:41 +01:00
112 changed files with 8119 additions and 2054 deletions
@@ -9,17 +9,27 @@ on:
      - main

 jobs:
+  buf-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Set up Buf
+        uses: bufbuild/buf-setup-action@v1
+      - name: Buf Lint
+        uses: bufbuild/buf-lint-action@v1
+        with:
+          input: proto
+
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
-
      - name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.19
-
      - name: Build
        run: |
          go test ./...
@@ -0,0 +1,23 @@
+name: docs
+
+on:
+  push:
+    branches: ['main']
+    paths: ['mkdocs/**']
+
+permissions:
+  pages: write
+  contents: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-python@v2
+        with:
+          python-version: 3.x
+      - run: pip install mkdocs-material
+      - run: cd mkdocs && mkdocs gh-deploy --force
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -30,7 +30,7 @@ jobs:
        with:
          go-version: 1.19
      - name: Install cosign
-        uses: sigstore/cosign-installer@v2.5.1
+        uses: sigstore/cosign-installer@v2.8.1
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        with:
@@ -33,7 +33,7 @@ jobs:
        with:
          go-version: 1.19
      - name: Install cosign
-        uses: sigstore/cosign-installer@v2.5.1
+        uses: sigstore/cosign-installer@v2.8.1
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        with:
@@ -5,4 +5,13 @@ init:
 	go install github.com/bufbuild/connect-go/cmd/protoc-gen-connect-go@latest

 generate:
-	buf generate proto
+	buf generate proto
+
+format:
+	buf format -w proto
+
+lint:
+	buf lint proto
+
+breaking:
+	buf breaking proto --against https://github.com/jsiebens/ionscale.git#subdir=proto
@@ -1,4 +1,39 @@
 # ionscale

 > **Note**:
-> ionscale is currently alpha quality, actively being developed and so subject to changes
+> ionscale is currently beta quality, actively being developed and so subject to changes
+
+**What is Tailscale?**
+
+[Tailscale](https://tailscale.com) is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly. 
+It enables encrypted point-to-point connections using the open source [WireGuard](https://www.wireguard.com/) protocol, which means only devices on your private network can communicate with each other.
+
+**What is ionscale?**
+
+While the Tailscale software running on each node is open source, their centralized "coordination server" which act as a shared drop box for public keys is not.
+
+_ionscale_ aims to implement such lightweight, open source alternative Tailscale control server.
+
+## Features
+
+- multi [tailnet](https://tailscale.com/kb/1136/tailnet/) support
+- multi user support
+- OIDC integration (not required, although recommended)
+- [Auth keys](https://tailscale.com/kb/1085/auth-keys/)
+- [Access control list](https://tailscale.com/kb/1018/acls/)
+- [DNS](https://tailscale.com/kb/1054/dns/)
+  - nameservers
+  - Split DNS
+  - MagicDNS 
+- [HTTPS Certs](https://tailscale.com/kb/1153/enabling-https/)
+- [Tailscale SSH](https://tailscale.com/kb/1193/tailscale-ssh/) 
+- [Service collection](https://tailscale.com/kb/1100/services/)
+- [Taildrop](https://tailscale.com/kb/1106/taildrop/)
+
+## Documentation
+
+Some documentation can be found [here](https://jsiebens.github.io/ionscale)
+
+## Disclaimer
+
+This is not an official Tailscale or Tailscale Inc. project.
@@ -1,60 +0,0 @@
-package main
-
-import (
-	"database/sql"
-	"fmt"
-	"github.com/muesli/coral"
-	"os"
-	"time"
-
-	"github.com/lib/pq"
-)
-
-func main() {
-	cmd := rootCommand()
-	if err := cmd.Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-
-func rootCommand() *coral.Command {
-	command := &coral.Command{
-		Use: "pg-ionscale-events",
-	}
-
-	var url string
-	command.Flags().StringVar(&url, "url", "", "")
-	_ = command.MarkFlagRequired("url")
-
-	command.RunE = func(cmd *coral.Command, args []string) error {
-		_, err := sql.Open("postgres", url)
-		if err != nil {
-			return err
-		}
-
-		reportProblem := func(ev pq.ListenerEventType, err error) {
-			if err != nil {
-				fmt.Println(err.Error())
-			}
-		}
-
-		minReconn := 10 * time.Second
-		maxReconn := time.Minute
-		listener := pq.NewListener(url, minReconn, maxReconn, reportProblem)
-		err = listener.Listen("ionscale_events")
-		if err != nil {
-			return err
-		}
-
-		fmt.Println("listening for events ...")
-		fmt.Println("")
-		for {
-			select {
-			case n, _ := <-listener.Notify:
-				fmt.Println(n.Extra)
-			}
-		}
-	}
-
-	return command
-}
@@ -4,56 +4,93 @@ go 1.19

 require (
 	github.com/apparentlymart/go-cidr v1.1.0
-	github.com/bufbuild/connect-go v0.4.0
+	github.com/bufbuild/connect-go v1.0.0
 	github.com/caarlos0/env/v6 v6.10.1
 	github.com/caddyserver/certmagic v0.17.1
 	github.com/coreos/go-oidc/v3 v3.3.0
-	github.com/glebarez/sqlite v1.4.6
+	github.com/glebarez/sqlite v1.5.0
 	github.com/go-gormigrate/gormigrate/v2 v2.0.2
-	github.com/google/uuid v1.3.0
+	github.com/golang-jwt/jwt/v4 v4.4.2
 	github.com/hashicorp/go-bexpr v0.1.11
 	github.com/hashicorp/go-hclog v1.3.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/imdario/mergo v0.3.12
+	github.com/jsiebens/go-edit v0.1.0
 	github.com/klauspost/compress v1.15.9
 	github.com/labstack/echo-contrib v0.13.0
 	github.com/labstack/echo/v4 v4.9.0
-	github.com/lib/pq v1.10.6
+	github.com/libdns/azure v0.2.0
+	github.com/libdns/cloudflare v0.1.0
+	github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f
+	github.com/libdns/googleclouddns v1.0.2
+	github.com/libdns/libdns v0.2.1
+	github.com/libdns/route53 v1.2.2
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/pointerstructure v1.2.1
 	github.com/mr-tron/base58 v1.2.0
 	github.com/muesli/coral v1.0.0
 	github.com/nleeper/goment v1.4.4
-	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.13.0
 	github.com/rodaine/table v1.0.1
 	github.com/sony/sonyflake v1.1.0
 	github.com/stretchr/testify v1.8.0
 	github.com/xhit/go-str2duration/v2 v2.0.0
-	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
-	golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b
-	golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094
-	golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde
+	golang.org/x/crypto v0.1.0
+	golang.org/x/net v0.4.0
+	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1
+	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0
 	google.golang.org/protobuf v1.28.1
+	gopkg.in/square/go-jose.v2 v2.6.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
-	gorm.io/driver/postgres v1.3.9
-	gorm.io/gorm v1.23.8
+	gorm.io/driver/postgres v1.4.4
+	gorm.io/gorm v1.24.0
 	inet.af/netaddr v0.0.0-20220811202034-502d2d690317
-	tailscale.com v1.30.0
+	tailscale.com v1.32.0
 )

 require (
+	cloud.google.com/go/compute v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go v52.4.0+incompatible // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest v0.11.17 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.11 // indirect
+	github.com/Azure/go-autorest/autorest/azure/auth v0.5.7 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.2 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.0 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.11.2 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.11.0 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.6.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.8.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.0.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.5.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.12.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.6.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.11.1 // indirect
+	github.com/aws/smithy-go v1.9.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/digitalocean/godo v1.41.0 // indirect
+	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/fatih/color v1.13.0 // indirect
-	github.com/glebarez/go-sqlite v1.18.1 // indirect
+	github.com/form3tech-oss/jwt-go v3.2.2+incompatible // indirect
+	github.com/glebarez/go-sqlite v1.19.2 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-querystring v1.0.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa // indirect
+	github.com/googleapis/gax-go/v2 v2.4.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
@@ -66,11 +103,12 @@ require (
 	github.com/jackc/pgx/v4 v4.17.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/native v1.0.0 // indirect
 	github.com/jsimonetti/rtnetlink v1.2.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.1.1 // indirect
-	github.com/labstack/gommon v0.3.1 // indirect
-	github.com/libdns/libdns v0.2.1 // indirect
+	github.com/labstack/gommon v0.4.0 // indirect
+	github.com/lib/pq v1.10.6 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
@@ -79,15 +117,17 @@ require (
 	github.com/mholt/acmez v1.0.4 // indirect
 	github.com/miekg/dns v1.1.50 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.37.0 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20220927061507-ef77025ab5aa // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/tkuchiki/go-timezone v0.2.2 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.1 // indirect
+	go.opencensus.io v0.23.0 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
 	go.uber.org/zap v1.23.0 // indirect
@@ -95,17 +135,19 @@ require (
 	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
 	go4.org/unsafe/assume-no-moving-gc v0.0.0-20220617031537-928513b29760 // indirect
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/sys v0.0.0-20220829200755-d48e67d00261 // indirect
-	golang.org/x/text v0.3.8-0.20211105212822-18b340fc7af2 // indirect
+	golang.org/x/sys v0.3.0 // indirect
+	golang.org/x/text v0.5.0 // indirect
 	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
 	golang.org/x/tools v0.1.12 // indirect
-	golang.zx2c4.com/wireguard/windows v0.4.10 // indirect
+	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
+	google.golang.org/api v0.84.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90 // indirect
+	google.golang.org/grpc v1.48.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
-	modernc.org/libc v1.18.0 // indirect
+	modernc.org/libc v1.21.1 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/memory v1.3.0 // indirect
-	modernc.org/sqlite v1.18.1 // indirect
+	modernc.org/memory v1.4.0 // indirect
+	modernc.org/sqlite v1.19.2 // indirect
 	nhooyr.io/websocket v1.8.7 // indirect
 )
@@ -27,6 +27,8 @@ cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW
 cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
 cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
 cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
+cloud.google.com/go v0.101.1/go.mod h1:55HwjsGW4CHD3JrNuMdZtSDsgTs0CuCB/bBTugD+7AA=
+cloud.google.com/go v0.102.0 h1:DAq3r8y4mDgyB/ZPJ9v/5VJNqjgJAxTn6ZYLlUywOu8=
 cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
@@ -39,6 +41,7 @@ cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJW
 cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
 cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
+cloud.google.com/go/compute v1.7.0 h1:v/k9Eueb8aAJ0vZuxKMrgm6kPhCLZU9HxFU+AFDs9Uk=
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
@@ -52,9 +55,36 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+cloud.google.com/go/storage v1.22.0/go.mod h1:GbaLEoMqbVm6sx3Z0R++gSiBlgMv6yUi2q1DeGFKQgE=
 cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/edwards25519 v1.0.0-rc.1 h1:m0VOOB23frXZvAOK44usCgLWvtsxIoMCTBGJZlpmGfU=
 filippo.io/mkcert v1.4.3 h1:axpnmtrZMM8u5Hf4N3UXxboGemMOV+Tn+e+pkHM6E3o=
+github.com/Azure/azure-sdk-for-go v52.4.0+incompatible h1:NpkT8MjJJMcgPJ5Q9E66QUgY9QRyxqM8MFx2P29uQZ4=
+github.com/Azure/azure-sdk-for-go v52.4.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
+github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-autorest/autorest v0.11.17 h1:2zCdHwNgRH+St1J+ZMf66xI8aLr/5KMy+wWLH97zwYM=
+github.com/Azure/go-autorest/autorest v0.11.17/go.mod h1:eipySxLmqSyC5s5k1CLupqet0PSENBEDP93LQ9a8QYw=
+github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
+github.com/Azure/go-autorest/autorest/adal v0.9.11 h1:L4/pmq7poLdsy41Bj1FayKvBhayuWRYkx9HU5i4Ybl0=
+github.com/Azure/go-autorest/autorest/adal v0.9.11/go.mod h1:nBKAnTomx8gDtl+3ZCJv2v0KACFHWTB2drffI1B68Pk=
+github.com/Azure/go-autorest/autorest/azure/auth v0.5.7 h1:8DQB8yl7aLQuP+nuR5e2RO6454OvFlSTXXaNHshc16s=
+github.com/Azure/go-autorest/autorest/azure/auth v0.5.7/go.mod h1:AkzUsqkrdmNhfP2i54HqINVQopw0CLDnvHpJ88Zz1eI=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.2 h1:dMOmEJfkLKW/7JsokJqkyoYSgmR08hi9KrhjZb+JALY=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.2/go.mod h1:7qkJkT+j6b+hIpzMOwPChJhTqS8VbsqqgULzMNRugoM=
+github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
+github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1 h1:K0laFcLE6VLTOwNgSxaGbUcLPuGXlNkbVvq4cW4nIHk=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
+github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
+github.com/Azure/go-autorest/logger v0.2.0 h1:e4RVHVZKC5p6UANLJHkM4OfR1UKZPj8Wt8Pcx+3oqrE=
+github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
+github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
+github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
@@ -73,14 +103,47 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
 github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
 github.com/appleboy/gofight/v2 v2.1.2 h1:VOy3jow4vIK8BRQJoC/I9muxyYlJ2yb9ht2hZoS3rf4=
+github.com/aws/aws-sdk-go-v2 v1.10.0/go.mod h1:U/EyyVvKtzmFeQQcca7eBotKdlpcP2zzU6bXBYcf7CE=
+github.com/aws/aws-sdk-go-v2 v1.11.2 h1:SDiCYqxdIYi6HgQfAWRhgdZrdnOuGyLDJVRSWLeHWvs=
+github.com/aws/aws-sdk-go-v2 v1.11.2/go.mod h1:SQfA+m2ltnu1cA0soUkj4dRSsmITiVQUJvBIZjzfPyQ=
+github.com/aws/aws-sdk-go-v2/config v1.9.0/go.mod h1:qhK5NNSgo9/nOSMu3HyE60WHXZTWTHTgd5qtIF44vOQ=
+github.com/aws/aws-sdk-go-v2/config v1.11.0 h1:Czlld5zBB61A3/aoegA9/buZulwL9mHHfizh/Oq+Kqs=
+github.com/aws/aws-sdk-go-v2/config v1.11.0/go.mod h1:VrQDJGFBM5yZe+IOeenNZ/DWoErdny+k2MHEIpwDsEY=
+github.com/aws/aws-sdk-go-v2/credentials v1.5.0/go.mod h1:kvqTkpzQmzri9PbsiTY+LvwFzM0gY19emlAWwBOJMb0=
+github.com/aws/aws-sdk-go-v2/credentials v1.6.4 h1:2hvbUoHufns0lDIsaK8FVCMukT1WngtZPavN+W2FkSw=
+github.com/aws/aws-sdk-go-v2/credentials v1.6.4/go.mod h1:tTrhvBPHyPde4pdIPSba4Nv7RYr4wP9jxXEDa1bKn/8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.7.0/go.mod h1:KqEkRkxm/+1Pd/rENRNbQpfblDBYeg5HDSqjB6ks8hA=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.8.2 h1:KiN5TPOLrEjbGCvdTQR4t0U4T87vVwALZ5Bg3jpMqPY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.8.2/go.mod h1:dF2F6tXEOgmW5X1ZFO/EPtWrcm7XkW07KNcJUGNtt4s=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.2 h1:XJLnluKuUxQG255zPNe+04izXl7GSyUVafIsgfv9aw4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.2/go.mod h1:SgKKNBIoDC/E1ZCDhhMW3yalWjwuLjMcpLzsM/QQnWo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.0.2 h1:EauRoYZVNPlidZSZJDscjJBQ22JhVF2+tdteatax2Ak=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.0.2/go.mod h1:xT4XX6w5Sa3dhg50JrYyy3e4WPYo/+WjY/BXtqXVunU=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.2.5/go.mod h1:6ZBTuDmvpCOD4Sf1i2/I3PgftlEcDGgvi8ocq64oQEg=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.2 h1:IQup8Q6lorXeiA/rK72PeToWoWK8h7VAPgHNWdSrtgE=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.2/go.mod h1:VITe/MdW6EMXPb0o0txu/fsonXbMHUU2OC2Qp7ivU4o=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.4.0/go.mod h1:X5/JuOxPLU/ogICgDTtnpfaQzdQJO0yKDcpoxWLLJ8Y=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.5.2 h1:CKdUNKmuilw/KNmO2Q53Av8u+ZyXMC2M9aX8Z+c/gzg=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.5.2/go.mod h1:FgR1tCsn8C6+Hf+N5qkfrE4IXvUL1RgW87sunJ+5J4I=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.12.0 h1:XNmW6Z/l4NL/Glz76gqAb6WOgdSYC2a1T0YBBEHfQ58=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.12.0/go.mod h1:LbPVLMeOEGLIW54yuMayW70DcTtsb+17ekL5j48deF4=
+github.com/aws/aws-sdk-go-v2/service/sso v1.5.0/go.mod h1:GsqaJOJeOfeYD88/2vHWKXegvDRofDqWwC5i48A2kgs=
+github.com/aws/aws-sdk-go-v2/service/sso v1.6.2 h1:2IDmvSb86KT44lSg1uU4ONpzgWLOuApRl6Tg54mZ6Dk=
+github.com/aws/aws-sdk-go-v2/service/sso v1.6.2/go.mod h1:KnIpszaIdwI33tmc/W/GGXyn22c1USYxA/2KyvoeDY0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.8.0/go.mod h1:dOlm91B439le5y1vtPCk5yJtbx3RdT3hRGYRY8TYKvQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.11.1 h1:QKR7wy5e650q70PFKMfGF9sTo0rZgUevSSJ4wxmyWXk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.11.1/go.mod h1:UV2N5HaPfdbDpkgkz4sRzWCvQswZjdO1FfqCWl0t7RA=
+github.com/aws/smithy-go v1.8.1/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
+github.com/aws/smithy-go v1.9.0 h1:c7FUdEqrQA1/UVKKCNDFQPNKGp4FQg3YW4Ck5SLTG58=
+github.com/aws/smithy-go v1.9.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bufbuild/connect-go v0.4.0 h1:fIMyUYG8mXSTH+nnlOx9KmRUf3mBF0R2uKK+BQBoOHE=
-github.com/bufbuild/connect-go v0.4.0/go.mod h1:ZEtBnQ7J/m7bvWOW+H8T/+hKQCzPVfhhhICuvtcnjlI=
+github.com/bufbuild/connect-go v1.0.0 h1:htSflKUT8y1jxhoPhPYTZMrsY3ipUXjjrbcZR5O2cVo=
+github.com/bufbuild/connect-go v1.0.0/go.mod h1:9iNvh/NOsfhNBUH5CtvXeVUskQO1xsrEviH7ZArwZ3I=
 github.com/caarlos0/env/v6 v6.10.1 h1:t1mPSxNpei6M5yAeu1qtRdPAK29Nbcf/n3G7x+b3/II=
 github.com/caarlos0/env/v6 v6.10.1/go.mod h1:hvp/ryKXKipEkcuYjs9mI4bBCg+UI0Yhgm5Zu0ddvwc=
 github.com/caddyserver/certmagic v0.17.1 h1:VrWANhQAj3brK7jAUKyN6XBHg56WsyorI/84Ilq1tCQ=
@@ -114,10 +177,17 @@ github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denisenkom/go-mssqldb v0.12.0 h1:VtrkII767ttSPNRfFekePK3sctr+joXgO58stqQbtUA=
+github.com/digitalocean/godo v1.41.0 h1:WYy7MIVVhTMZUNB+UA3irl2V9FyDJeDttsifYyn7jYA=
+github.com/digitalocean/godo v1.41.0/go.mod h1:p7dOjjtSBqCTUksqtA5Fd3uaKs9kyTq2xcz76ulEJRU=
+github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
+github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
+github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dvyukov/go-fuzz v0.0.0-20210103155950-6a8e9d1f2415/go.mod h1:11Gm+ccJnvAhCNLlf5+cS9KjtbaD5I5zaZpFMsTHWTw=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -132,18 +202,21 @@ github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible h1:TcekIExNqud5crz4xD2pavyTgWiPvpYe4Xau31I0PRk=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/frankban/quicktest v1.14.0 h1:+cqqvzZV87b4adx/5ayVOaYZ2CrvM4ejQvUdBzPPUss=
 github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
+github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.6.3 h1:ahKqKTFpO5KTPHxWZjEdPScmYaGtLo8Y4DMHoEsnp14=
 github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
-github.com/glebarez/go-sqlite v1.17.3/go.mod h1:Hg+PQuhUy98XCxWEJEaWob8x7lhJzhNYF1nZbUiRGIY=
-github.com/glebarez/go-sqlite v1.18.1 h1:w0xtxKWktqYsUsXg//SQK+l1IcpKb3rGOQHmMptvL2U=
-github.com/glebarez/go-sqlite v1.18.1/go.mod h1:ydXIGq2M4OzF4YyNhH129SPp7jWoVvgkEgb6pldmS0s=
-github.com/glebarez/sqlite v1.4.6 h1:D5uxD2f6UJ82cHnVtO2TZ9pqsLyto3fpDKHIk2OsR8A=
-github.com/glebarez/sqlite v1.4.6/go.mod h1:WYEtEFjhADPaPJqL/PGlbQQGINBA3eUAfDNbKFJf/zA=
+github.com/glebarez/go-sqlite v1.19.1/go.mod h1:9AykawGIyIcxoSfpYWiX1SgTNHTNsa/FVc75cDkbp4M=
+github.com/glebarez/go-sqlite v1.19.2 h1:mTtntWN3wk9UNjIf6F7Upqnfq96p+cjhfgCsupUd1hY=
+github.com/glebarez/go-sqlite v1.19.2/go.mod h1:DoubC3Kn5X6EBvDa2iaxAdIJqPNmY7M/sOCpfa8fus0=
+github.com/glebarez/sqlite v1.5.0 h1:+8LAEpmywqresSoGlqjjT+I9m4PseIM3NcerIJ/V7mk=
+github.com/glebarez/sqlite v1.5.0/go.mod h1:0wzXzTvfVJIN2GqRhCdMbnYd+m+aH5/QV7B30rM6NgY=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -177,6 +250,8 @@ github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRx
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
+github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
+github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
 github.com/golang-sql/sqlexp v0.0.0-20170517235910-f1bb20e5a188 h1:+eHOFJl1BaXrQxKX+T06f78590z4qA2ZzBTqahsKSE4=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -228,13 +303,19 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
+github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
+github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -253,6 +334,7 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa h1:7MYGT2XEMam7Mtzv1yDUYXANedWvwk3HKkR3MyGowy8=
 github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
@@ -260,6 +342,7 @@ github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pf
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
 github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
 github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM=
+github.com/googleapis/gax-go/v2 v2.4.0 h1:dS9eYAjhrE2RjmzYw2XAPvcXfmcQLtFEQWn0CR82awk=
 github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
 github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
 github.com/gorilla/websocket v1.4.1 h1:q7AeDBpnBk8AogcD4DSag/Ukw/KV+YhzLj2bP5HvKCM=
@@ -276,6 +359,7 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hdevalence/ed25519consensus v0.0.0-20220222234857-c00d1f31bab3 h1:aSVUgRRRtOrZOC1fYmY9gV0e9z/Iu+xNVSASWjsuyGU=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
@@ -293,7 +377,6 @@ github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsU
 github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
 github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
 github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.12.1/go.mod h1:ZkhRC59Llhrq3oSfrikvwQ5NaxYExr6twkdkMLaKono=
 github.com/jackc/pgconn v1.13.0 h1:3L1XMNV2Zvca/8BYhzcRFS70Lr0WlDg16Di6SFGAbys=
 github.com/jackc/pgconn v1.13.0/go.mod h1:AnowpAqO4CMIIJNZl2VJp+KrkAZciAkhEl0W0JIobpI=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
@@ -311,7 +394,6 @@ github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvW
 github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
 github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.3.0/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.3.1 h1:nwj7qwf0S+Q7ISFfBndqeLwSwxs+4DPsbRFjECT1Y4Y=
 github.com/jackc/pgproto3/v2 v2.3.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b h1:C8S2+VttkHFdOOCXJe+YGfa4vHYwlt4Zx+IVXQ97jYg=
@@ -320,30 +402,33 @@ github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01C
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
 github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.11.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
 github.com/jackc/pgtype v1.12.0 h1:Dlq8Qvcch7kiehm8wPGIW0W3KsCCHJnRacKW0UM8n5w=
 github.com/jackc/pgtype v1.12.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
 github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
 github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.16.1/go.mod h1:SIhx0D5hoADaiXZVyv+3gSm3LCIIINTVO0PficsvWGQ=
 github.com/jackc/pgx/v4 v4.17.2 h1:0Ut0rpeKwvIVbMQ1KbMBU4h6wxehBI535LK6Flheh8E=
 github.com/jackc/pgx/v4 v4.17.2/go.mod h1:lcxIZN44yMIrWI78a5CpucdD14hX0SBDbNRvjDBItsw=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.2.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/joho/godotenv v1.4.0 h1:3l4+N6zfMWnkbPEXKng2o2/MR5mSwTrBih4ZEkkz1lg=
 github.com/josharian/native v1.0.0 h1:Ts/E8zCSEsG17dUqv7joXJFybuMLjQfWE04tsBODTxk=
 github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
+github.com/jsiebens/go-edit v0.1.0 h1:62SSGW8Qc2zoBcJx7gV86ImPHmQzlU/DQhwCOR4uilE=
+github.com/jsiebens/go-edit v0.1.0/go.mod h1:m/wuWMv8sNhSl+M2qA35gP/K5jX2J7Aa+g16VwyfxrI=
 github.com/jsimonetti/rtnetlink v1.2.2 h1:Ok9vYMcpxfHyF/iRqNTYJPDLxVaVItvPamAhtzttDBY=
 github.com/jsimonetti/rtnetlink v1.2.2/go.mod h1:T3BJ2qI9ZJFkUYWLrzECdcXhCvaGRfnMFmoYF0X8w2A=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -380,8 +465,8 @@ github.com/labstack/echo-contrib v0.13.0 h1:bzSG0SpuZZd7BmJLvsWtPfU23W0Enh3K0tok
 github.com/labstack/echo-contrib v0.13.0/go.mod h1:IF9+MJu22ADOZEHD+bAV67XMIO3vNXUy7Naz/ABPHEs=
 github.com/labstack/echo/v4 v4.9.0 h1:wPOF1CE6gvt/kmbMR4dGzWvHMPT+sAEUJOwOTtvITVY=
 github.com/labstack/echo/v4 v4.9.0/go.mod h1:xkCDAdFCIf8jsFQ5NnbK7oqaF/yU1A1X20Ltm0OvSks=
-github.com/labstack/gommon v0.3.1 h1:OomWaJXm7xR6L1HmEtGyQf26TEn7V6X88mktX9kee9o=
-github.com/labstack/gommon v0.3.1/go.mod h1:uW6kP17uPlLJsD3ijUYn3/M5bAxtlZhMI6m3MFxTMTM=
+github.com/labstack/gommon v0.4.0 h1:y7cvthEAEbU0yHOf4axH8ZG2NH8knB9iNSoTO8dyIk8=
+github.com/labstack/gommon v0.4.0/go.mod h1:uW6kP17uPlLJsD3ijUYn3/M5bAxtlZhMI6m3MFxTMTM=
 github.com/leodido/go-urn v1.2.0 h1:hpXL4XnriNwQ/ABnpepYM/1vCLWNDfUNts8dX3xTG6Y=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -390,10 +475,19 @@ github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
 github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/libdns/azure v0.2.0 h1:SVYG+iMKtSpSJZBZ0hjETAMNscPoWRMJI7nnlLonwD4=
+github.com/libdns/azure v0.2.0/go.mod h1:vu7sD/dXAExlzdne/OTPKTEOXOpDUxPuAKQwqzUT8nk=
+github.com/libdns/cloudflare v0.1.0 h1:93WkJaGaiXCe353LHEP36kAWCUw0YjFqwhkBkU2/iic=
+github.com/libdns/cloudflare v0.1.0/go.mod h1:a44IP6J1YH6nvcNl1PverfJviADgXUnsozR3a7vBKN8=
+github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f h1:Y0JkwI0Uip+Zrh71aHLmNz150cKnWuC+535v/zLS8zo=
+github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f/go.mod h1:B2TChhOTxvBflpRTHlguXWtwa1Ha5WI6JkB6aCViM+0=
+github.com/libdns/googleclouddns v1.0.2 h1:r7zZKDlMUglvOT6hmpZuMmxld8KpddbsVhEETEHRjjg=
+github.com/libdns/googleclouddns v1.0.2/go.mod h1:Qogt1qOp5teTZAyiKfkhBzI5Ri+6Z/XA16y6eJz2veA=
+github.com/libdns/libdns v0.2.0/go.mod h1:yQCXzk1lEZmmCPa857bnk4TsOiqYasqpyOEeSObbb40=
 github.com/libdns/libdns v0.2.1 h1:Wu59T7wSHRgtA0cfxC+n1c/e+O3upJGWytknkmFEDis=
 github.com/libdns/libdns v0.2.1/go.mod h1:yQCXzk1lEZmmCPa857bnk4TsOiqYasqpyOEeSObbb40=
-github.com/lxn/walk v0.0.0-20210112085537-c389da54e794/go.mod h1:E23UucZGqpuUANJooIbHWCufXvOcT6E7Stq81gU+CSQ=
-github.com/lxn/win v0.0.0-20210218163916-a377121e959e/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
+github.com/libdns/route53 v1.2.2 h1:ZnlxO2w8ftO/aR0PNRRB8lrG6AcKPOl/H0vU8mb/Ixo=
+github.com/libdns/route53 v1.2.2/go.mod h1:Vu827KwORxYR2I6iGsu8IKh4MESliECL7VA4pAsn95o=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
@@ -409,9 +503,8 @@ github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peK
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
-github.com/mattn/go-sqlite3 v1.14.12/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.14 h1:qZgc/Rwetq+MtyE18WhzjokPD93dNqLGNT3QJuLvBGw=
-github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.15 h1:vfoHhTN1af61xCRSWzFIWzx2YskyMTwHLrExkBOjvxI=
+github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mdlayher/netlink v1.6.0 h1:rOHX5yl7qnlpiVkFWoqccueppMtXzeziFjWAjLg6sz0=
@@ -430,6 +523,8 @@ github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyua
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
 github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
+github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae h1:O4SWKdcHVCvYqyDV+9CJA1fcDN2L11Bule0iFy3YlAI=
+github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -476,8 +571,9 @@ github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
-github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 h1:OdAsTTz6OkFY5QxjkYwrChwuRruF69c169dPK26NUlk=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/remyoudompheng/bigfft v0.0.0-20220927061507-ef77025ab5aa h1:tEkEyxYeZ43TR55QU/hsIt9aRGBxbgGuz9CGykjvogY=
+github.com/remyoudompheng/bigfft v0.0.0-20220927061507-ef77025ab5aa/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rodaine/table v1.0.1 h1:U/VwCnUxlVYxw8+NJiLIuCxA/xa6jL38MY3FYysVWWQ=
 github.com/rodaine/table v1.0.1/go.mod h1:UVEtfBsflpeEcD56nF4F5AocNFta0ZuolpSVdPtlmP4=
@@ -500,6 +596,7 @@ github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrf
 github.com/sony/sonyflake v1.1.0 h1:wnrEcL3aOkWmPlhScLEGAXKkLAIslnBteNUq4Bw6MM4=
 github.com/sony/sonyflake v1.1.0/go.mod h1:LORtCywH/cq10ZbyfhKrHYgAUGH7mOBa76enV9txy/Y=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -527,6 +624,7 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasttemplate v1.2.1 h1:TVEnxayobAdVkhQfrfes2IzOB6o+z4roRkPF52WA1u4=
 github.com/valyala/fasttemplate v1.2.1/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/xhit/go-str2duration/v2 v2.0.0 h1:uFtk6FWB375bP7ewQl+/1wBcn840GPhnySOdcz/okPE=
 github.com/xhit/go-str2duration/v2 v2.0.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -541,6 +639,7 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -582,15 +681,14 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90 h1:Y/gsMcFOcR+6S6f3YeMKl5g+dZMEWqcz5Czj/GWYbkM=
-golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
+golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -670,7 +768,6 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210903162142-ad29c8ab022f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -681,8 +778,9 @@ golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220630215102-69896b714898/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b h1:ZmngSVLe/wycRns9MKikG9OWIEjGcGAkacif7oYQaUY=
 golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.4.0 h1:Q5QPcMlvfxFTAPV0+07Xz/MpK9NTXu2VDUuy0FeMfaU=
+golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -703,8 +801,9 @@ golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j
 golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094 h1:2o1E+E8TpNLklK9nHiPiK1uzIYrIHt+cQx3ynCwq9V8=
 golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
+golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 h1:3VPzK7eqH25j7GYw5w6g/GzNRc0/fYtrxz27z1gD4W0=
+golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -717,8 +816,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde h1:ejfdSekXMDxDLbRrJMwUk6KnSLZ2McaUCVcIKM+N6jc=
-golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 h1:cu5kTvlzcw1Q5S9f5ip1/cpiB4nXvw1XYzFPGgzLUOY=
+golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -757,7 +856,6 @@ golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -768,7 +866,6 @@ golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -792,7 +889,6 @@ golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220405052023-b1e9470b6e64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -802,8 +898,8 @@ golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220829200755-d48e67d00261 h1:v6hYoSR9T5oet+pMXwUWkbiVqx/63mlHjefrHmxwfeY=
-golang.org/x/sys v0.0.0-20220829200755-d48e67d00261/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -816,8 +912,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8-0.20211105212822-18b340fc7af2 h1:GLw7MR8AfAG2GmGcmVgObFOHXYypgGjnGno25RDwn3Y=
-golang.org/x/text v0.3.8-0.20211105212822-18b340fc7af2/go.mod h1:EFNZuWvGYxIRUEX+K8UmCFwYmZjqcrnq15ZuVldZkZ0=
+golang.org/x/text v0.5.0 h1:OLmvp0KP+FVG99Ct/qFiL/Fhk4zp4QQnZ7b2U+5piUM=
+golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -835,6 +931,7 @@ golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -891,10 +988,10 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f h1:uF6paiQQebLeSXkrTqHqz0MXhXXS1KgF41eUdBNvxK0=
 golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.zx2c4.com/wireguard v0.0.0-20210905140043-2ef39d47540c/go.mod h1:laHzsbfMhGSobUmruXWAyMKKHSqvIcrqZJMyHD+/3O8=
-golang.zx2c4.com/wireguard/windows v0.4.10 h1:HmjzJnb+G4NCdX+sfjsQlsxGPuYaThxRbZUZFLyR0/s=
-golang.zx2c4.com/wireguard/windows v0.4.10/go.mod h1:v7w/8FC48tTBm1IzScDVPEEb0/GjLta+T0ybpP9UWRg=
+golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
+golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -931,8 +1028,10 @@ google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/S
 google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
 google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
 google.golang.org/api v0.75.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
+google.golang.org/api v0.77.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
 google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
 google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
+google.golang.org/api v0.84.0 h1:NMB9J4cCxs9xEm+1Z9QiO3eFvn7EnQj3Eo3hN6ugVlg=
 google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1010,15 +1109,18 @@ google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2
 google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
+google.golang.org/genproto v0.0.0-20220405205423-9d709892a2bf/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220407144326-9054f6ed7bac/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220413183235-5e96e2839df9/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220414192740-2d67ff6cf2b4/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
+google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
+google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90 h1:4SPz2GL2CXJt28MTF8V6Ap/9ZiVbQlJeGSd9qtA7DLs=
 google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -1051,6 +1153,8 @@ google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11
 google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
+google.golang.org/grpc v1.48.0 h1:rQOsyJ/8+ufEDJd/Gdsz7HG220Mh9HAhFHRGnIjda0w=
+google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1092,13 +1196,15 @@ gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gorm.io/driver/mysql v1.3.3 h1:jXG9ANrwBc4+bMvBcSl8zCfPBaVoPyBEBshA8dA93X8=
-gorm.io/driver/postgres v1.3.9 h1:lWGiVt5CijhQAg0PWB7Od1RNcBw/jS4d2cAScBcSDXg=
-gorm.io/driver/postgres v1.3.9/go.mod h1:qw/FeqjxmYqW5dBcYNBsnhQULIApQdk7YuuDPktVi1U=
+gorm.io/driver/postgres v1.4.4 h1:zt1fxJ+C+ajparn0SteEnkoPg0BQ6wOWXEQ99bteAmw=
+gorm.io/driver/postgres v1.4.4/go.mod h1:whNfh5WhhHs96honoLjBAMwJGYEuA3m1hvgUbNXhPCw=
 gorm.io/driver/sqlite v1.3.2 h1:nWTy4cE52K6nnMhv23wLmur9Y3qWbZvOBz+V4PrGAxg=
 gorm.io/driver/sqlserver v1.3.2 h1:yYt8f/xdAKLY7lCCyXxIUEgZ/WsURos3dHrx8MKFGAk=
 gorm.io/gorm v1.23.7/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
-gorm.io/gorm v1.23.8 h1:h8sGJ+biDgBA1AD1Ha9gFCx7h8npU7AsLdlkX0n2TpE=
-gorm.io/gorm v1.23.8/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.24.0 h1:j/CoiSm6xpRpmzbFJsQHYj+I8bGYWLXVHeYEyyKlF74=
+gorm.io/gorm v1.24.0/go.mod h1:DVrVomtaYTbqs7gB/x2uVvqnXzv0nqjB396B8cG4dBA=
+gotest.tools/v3 v3.0.2 h1:kG1BFyqVHuQoVQiR1bWGnfz/fmHvvuiSPIV7rvl360E=
+gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -1111,43 +1217,50 @@ howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 inet.af/netaddr v0.0.0-20220811202034-502d2d690317 h1:U2fwK6P2EqmopP/hFLTOAjWTki0qgd4GMJn5X8wOleU=
 inet.af/netaddr v0.0.0-20220811202034-502d2d690317/go.mod h1:OIezDfdzOgFhuw4HuWapWq2e9l0H9tK4F1j+ETRtF3k=
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
-modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/ccgo/v3 v3.0.0-20220428102840-41399a37e894/go.mod h1:eI31LL8EwEBKPpNpA4bU1/i+sKOwOrQy8D87zWUcRZc=
-modernc.org/ccgo/v3 v3.0.0-20220430103911-bc99d88307be/go.mod h1:bwdAnOoaIt8Ax9YdWGjxWsdkPcZyRPHqrOvJxaKAKGw=
-modernc.org/ccgo/v3 v3.16.4/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
-modernc.org/ccgo/v3 v3.16.6/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
-modernc.org/ccgo/v3 v3.16.8/go.mod h1:zNjwkizS+fIFDrDjIAgBSCLkWbJuHF+ar3QRn+Z9aws=
+lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
+modernc.org/cc/v3 v3.36.2/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
+modernc.org/cc/v3 v3.37.0/go.mod h1:vtL+3mdHx/wcj3iEGz84rQa8vEqR6XM84v5Lcvfph20=
+modernc.org/cc/v3 v3.38.1/go.mod h1:vtL+3mdHx/wcj3iEGz84rQa8vEqR6XM84v5Lcvfph20=
+modernc.org/cc/v3 v3.40.0/go.mod h1:/bTg4dnWkSXowUO6ssQKnOV0yMVxDYNIsIrzqTFDGH0=
+modernc.org/ccgo/v3 v3.0.0-20220904174949-82d86e1b6d56/go.mod h1:YSXjPL62P2AMSxBphRHPn7IkzhVHqkvOnRKAKh+W6ZI=
+modernc.org/ccgo/v3 v3.0.0-20220910160915-348f15de615a/go.mod h1:8p47QxPkdugex9J4n9P2tLZ9bK01yngIVp00g4nomW0=
+modernc.org/ccgo/v3 v3.16.9/go.mod h1:zNMzC9A9xeNUepy6KuZBbugn3c0Mc9TeiJO4lgvkJDo=
+modernc.org/ccgo/v3 v3.16.12/go.mod h1:fUB3Vn0nVPReA+7IG7yZDfjv1TMWjhQP8gCxrFAtL5g=
 modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
 modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
-modernc.org/libc v0.0.0-20220428101251-2d5f3daf273b/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.16.0/go.mod h1:N4LD6DBE9cf+Dzf9buBlzVJndKr/iJHG97vGLHYnb5A=
-modernc.org/libc v1.16.1/go.mod h1:JjJE0eu4yeK7tab2n4S1w8tlWd9MxXLRzheaRnAKymU=
-modernc.org/libc v1.16.7/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
-modernc.org/libc v1.16.8/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
-modernc.org/libc v1.16.17/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
-modernc.org/libc v1.16.19/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.18.0 h1:EKpC8eyhOcxpstYjohs7vxni7BoQBUVWXsf5rAZzlgk=
+modernc.org/libc v1.17.0/go.mod h1:XsgLldpP4aWlPlsjqKRdHPqCxCjISdHfM/yeWC5GyW0=
+modernc.org/libc v1.17.4/go.mod h1:WNg2ZH56rDEwdropAJeZPQkXmDwh+JCA1s/htl6r2fA=
 modernc.org/libc v1.18.0/go.mod h1:vj6zehR5bfc98ipowQOM2nIDUZnVew/wNC/2tOGS+q0=
+modernc.org/libc v1.19.0/go.mod h1:ZRfIaEkgrYgZDl6pa4W39HgN5G/yDW+NRmNKZBDFrk0=
+modernc.org/libc v1.20.3/go.mod h1:ZRfIaEkgrYgZDl6pa4W39HgN5G/yDW+NRmNKZBDFrk0=
+modernc.org/libc v1.21.1 h1:BczrQEMmuz/0YWRvD4DcJ77sh1wF5ELAKdIfWCD+Lso=
+modernc.org/libc v1.21.1/go.mod h1:przBsL5RDOZajTVslkugzLBj1evTue36jEomFQOoYuI=
 modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.4.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.5.0 h1:rV0Ko/6SfM+8G+yKiyI830l3Wuz1zRutdslNoQ0kfiQ=
 modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/memory v1.1.1/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
-modernc.org/memory v1.3.0 h1:6ZIOLb5ronARPxEPxtZz1WbSRllgA09FCvNNyql5kZg=
+modernc.org/memory v1.2.0/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
 modernc.org/memory v1.3.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
+modernc.org/memory v1.4.0 h1:crykUfNSnMAXaOJnnxcSzbUGMqkLWjklJKkBK2nwZwk=
+modernc.org/memory v1.4.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.17.3/go.mod h1:10hPVYar9C0kfXuTWGz8s0XtB8uAGymUy51ZzStYe3k=
-modernc.org/sqlite v1.18.1 h1:ko32eKt3jf7eqIkCgPAeHMBXw3riNSLhl2f3loEF7o8=
-modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
+modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
+modernc.org/sqlite v1.19.1/go.mod h1:UfQ83woKMaPW/ZBruK0T7YaFCrI+IE0LeWVY6pmnVms=
+modernc.org/sqlite v1.19.2 h1:1VaNHEe6amuHhelmAOtibvYpAjwLfT4q6cBB2K7ZlQ8=
+modernc.org/sqlite v1.19.2/go.mod h1:fEgebDYAGTFJj2c/ukKmnaq/0ZQZg0PSYxRa/bHyCDs=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
-modernc.org/tcl v1.13.1/go.mod h1:XOLfOwzhkljL4itZkK6T72ckMgvj0BDsnKNdZVUOecw=
+modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
+modernc.org/tcl v1.14.0/go.mod h1:gQ7c1YPMvryCHCcmf8acB6VPabE59QBeuRQLL7cTUlM=
+modernc.org/tcl v1.15.0/go.mod h1:xRoGotBZ6dU+Zo2tca+2EqVEeMmOUBzHnhIwq4YrVnE=
 modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
+modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+modernc.org/z v1.6.0/go.mod h1:hVdgNMh8ggTuRG1rGU8x+xGRFfiQUIAw0ZqlPy8+HyQ=
+modernc.org/z v1.7.0/go.mod h1:hVdgNMh8ggTuRG1rGU8x+xGRFfiQUIAw0ZqlPy8+HyQ=
 nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
 nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 software.sslmate.com/src/go-pkcs12 v0.0.0-20210415151418-c5206de65a78 h1:SqYE5+A2qvRhErbsXFfUEUmpWEKxxRSMgGLkvRAFOV4=
-tailscale.com v1.30.0 h1:J8k19aVG5z2W7FhpjkJyZ53HKb0tiNR1icvWly36Pvg=
-tailscale.com v1.30.0/go.mod h1:MO+tWkQp2YIF3KBnnej/mQvgYccRS5Xk/IrEpZ4Z3BU=
+tailscale.com v1.32.0 h1:00V30ztnQMTvQA9YV+bg28WamrGmUzWlc5SfWSlXz9c=
+tailscale.com v1.32.0/go.mod h1:AwKk+tI7z1+EXzmLxVNXA4dBpgTKd6RVV1VjFYEiv94=
@@ -1,4 +1,4 @@
-package provider
+package auth

 import (
 	"context"
@@ -1,6 +1,6 @@
-package provider
+package auth

-type AuthProvider interface {
+type Provider interface {
 	GetLoginURL(redirectURI, state string) string
 	Exchange(redirectURI, code string) (*User, error)
 }
@@ -1 +0,0 @@
-package broker
@@ -1,16 +0,0 @@
-package broker
-
-type Signal struct {
-	PeerUpdated  *uint64
-	PeersRemoved []uint64
-	ACLUpdated   bool
-	DNSUpdated   bool
-}
-
-type Listener chan *Signal
-
-type Pubsub interface {
-	Subscribe(tailnet uint64, listener Listener) (cancel func(), err error)
-	Publish(tailnet uint64, message *Signal) error
-	Close() error
-}
@@ -1,61 +0,0 @@
-package broker
-
-import (
-	"github.com/google/uuid"
-	"sync"
-)
-
-type memoryPubsub struct {
-	mut       sync.RWMutex
-	listeners map[uint64]map[uuid.UUID]Listener
-}
-
-func (m *memoryPubsub) Subscribe(tailnet uint64, listener Listener) (cancel func(), err error) {
-	m.mut.Lock()
-	defer m.mut.Unlock()
-
-	var listeners map[uuid.UUID]Listener
-	var ok bool
-	if listeners, ok = m.listeners[tailnet]; !ok {
-		listeners = map[uuid.UUID]Listener{}
-		m.listeners[tailnet] = listeners
-	}
-	var id uuid.UUID
-	for {
-		id = uuid.New()
-		if _, ok = listeners[id]; !ok {
-			break
-		}
-	}
-
-	listeners[id] = listener
-	return func() {
-		m.mut.Lock()
-		defer m.mut.Unlock()
-		listeners := m.listeners[tailnet]
-		delete(listeners, id)
-	}, nil
-}
-
-func (m *memoryPubsub) Publish(tailnet uint64, message *Signal) error {
-	m.mut.RLock()
-	defer m.mut.RUnlock()
-	listeners, ok := m.listeners[tailnet]
-	if !ok {
-		return nil
-	}
-	for _, listener := range listeners {
-		listener <- message
-	}
-	return nil
-}
-
-func (*memoryPubsub) Close() error {
-	return nil
-}
-
-func NewPubsubInMemory() Pubsub {
-	return &memoryPubsub{
-		listeners: make(map[uint64]map[uuid.UUID]Listener),
-	}
-}
@@ -1,117 +0,0 @@
-package broker
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"github.com/lib/pq"
-	"time"
-)
-
-type pgPubsub struct {
-	pgListener *pq.Listener
-	db         *sql.DB
-	target     Pubsub
-}
-
-func NewPubsub(ctx context.Context, database *sql.DB, connectURL string) (Pubsub, error) {
-	errCh := make(chan error)
-	listener := pq.NewListener(connectURL, time.Second, time.Minute, func(event pq.ListenerEventType, err error) {
-		select {
-		case <-errCh:
-			return
-		default:
-			errCh <- err
-			close(errCh)
-		}
-	})
-
-	select {
-	case err := <-errCh:
-		if err != nil {
-			return nil, fmt.Errorf("create pq listener: %w", err)
-		}
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	}
-
-	if err := listener.Listen("ionscale_events"); err != nil {
-		return nil, fmt.Errorf("listen: %w", err)
-	}
-
-	pubsub := &pgPubsub{
-		db:         database,
-		pgListener: listener,
-		target:     NewPubsubInMemory(),
-	}
-	go pubsub.listen(ctx)
-
-	return pubsub, nil
-}
-
-func (p *pgPubsub) Close() error {
-	return p.pgListener.Close()
-}
-
-func (p *pgPubsub) Subscribe(tailnet uint64, listener Listener) (cancel func(), err error) {
-	return p.target.Subscribe(tailnet, listener)
-}
-
-func (p *pgPubsub) Publish(tailnet uint64, message *Signal) error {
-	event := &pgEvent{
-		TailnetID: tailnet,
-		Signal:    message,
-	}
-
-	payload, err := json.Marshal(event)
-	if err != nil {
-		return err
-	}
-
-	_, err = p.db.ExecContext(context.Background(), `select pg_notify(`+pq.QuoteLiteral("ionscale_events")+`, $1)`, payload)
-	if err != nil {
-		return fmt.Errorf("exec pg_notify: %w", err)
-	}
-
-	return nil
-}
-
-func (p *pgPubsub) listen(ctx context.Context) {
-	var (
-		notif *pq.Notification
-		ok    bool
-	)
-	defer p.pgListener.Close()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case notif, ok = <-p.pgListener.Notify:
-			if !ok {
-				return
-			}
-		}
-		// A nil notification can be dispatched on reconnect.
-		if notif == nil {
-			continue
-		}
-		p.listenReceive(notif)
-	}
-}
-
-func (p *pgPubsub) listenReceive(notif *pq.Notification) {
-	extra := []byte(notif.Extra)
-	event := &pgEvent{}
-
-	if err := json.Unmarshal(extra, event); err == nil {
-		p.target.Publish(event.TailnetID, event.Signal)
-	} else {
-		fmt.Println(err)
-	}
-}
-
-type pgEvent struct {
-	TailnetID uint64
-	Signal    *Signal
-}
@@ -1,13 +1,16 @@
 package cmd

 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
 	"github.com/bufbuild/connect-go"
+	"github.com/jsiebens/go-edit/editor"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"github.com/muesli/coral"
 	"io/ioutil"
+	"os"
 )

 func getACLConfigCommand() *coral.Command {
@@ -17,7 +20,6 @@ func getACLConfigCommand() *coral.Command {
 		SilenceUsage: true,
 	}

-	var asJson bool
 	var tailnetID uint64
 	var tailnetName string
 	var target = Target{}
@@ -25,7 +27,6 @@ func getACLConfigCommand() *coral.Command {
 	target.prepareCommand(command)
 	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
-	command.Flags().BoolVar(&asJson, "json", false, "When enabled, render output as json otherwise yaml")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
 	command.RunE = func(cmd *coral.Command, args []string) error {
@@ -57,6 +58,70 @@ func getACLConfigCommand() *coral.Command {
 	return command
 }

+func editACLConfigCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "edit-acl-policy",
+		Short:        "Edit the ACL policy",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(cmd *coral.Command, args []string) error {
+		edit := editor.NewDefaultEditor([]string{"IONSCALE_EDITOR", "EDITOR"})
+
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.GetACLPolicy(context.Background(), connect.NewRequest(&api.GetACLPolicyRequest{TailnetId: tailnet.Id}))
+		if err != nil {
+			return err
+		}
+
+		previous, err := json.MarshalIndent(resp.Msg.Policy, "", "  ")
+		if err != nil {
+			return err
+		}
+
+		next, s, err := edit.LaunchTempFile("ionscale", ".json", bytes.NewReader(previous))
+		if err != nil {
+			return err
+		}
+
+		defer os.Remove(s)
+
+		var policy = &api.ACLPolicy{}
+		if err := json.Unmarshal(next, policy); err != nil {
+			return err
+		}
+
+		_, err = client.SetACLPolicy(context.Background(), connect.NewRequest(&api.SetACLPolicyRequest{TailnetId: tailnet.Id, Policy: policy}))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println("ACL policy updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
 func setACLConfigCommand() *coral.Command {
 	command := &coral.Command{
 		Use:          "set-acl-policy",
@@ -36,7 +36,7 @@ func authLoginCommand() *coral.Command {
 			return err
 		}

-		req := &api.AuthenticationRequest{}
+		req := &api.AuthenticateRequest{}
 		stream, err := client.Authenticate(context.Background(), connect.NewRequest(req))
 		if err != nil {
 			return err
@@ -15,8 +15,9 @@ import (

 func authkeysCommand() *coral.Command {
 	command := &coral.Command{
-		Use:   "auth-keys",
-		Short: "Manage ionscale auth keys",
+		Use:     "auth-keys",
+		Aliases: []string{"auth-key"},
+		Short:   "Manage ionscale auth keys",
 	}

 	command.AddCommand(createAuthkeysCommand())
@@ -36,6 +37,7 @@ func createAuthkeysCommand() *coral.Command {
 	var tailnetID uint64
 	var tailnetName string
 	var ephemeral bool
+	var preAuthorized bool
 	var tags []string
 	var expiry string
 	var target = Target{}
@@ -46,6 +48,7 @@ func createAuthkeysCommand() *coral.Command {
 	command.Flags().BoolVar(&ephemeral, "ephemeral", false, "When enabled, machines authenticated by this key will be automatically removed after going offline.")
 	command.Flags().StringSliceVar(&tags, "tag", []string{}, "Machines authenticated by this key will be automatically tagged with these tags")
 	command.Flags().StringVar(&expiry, "expiry", "180d", "Human-readable expiration of the key")
+	command.Flags().BoolVar(&preAuthorized, "pre-authorized", false, "Generate an auth key which is pre-authorized.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
 	command.RunE = func(command *coral.Command, args []string) error {
@@ -70,10 +73,11 @@ func createAuthkeysCommand() *coral.Command {
 		}

 		req := &api.CreateAuthKeyRequest{
-			TailnetId: tailnet.Id,
-			Ephemeral: ephemeral,
-			Tags:      tags,
-			Expiry:    expiryDur,
+			TailnetId:     tailnet.Id,
+			Ephemeral:     ephemeral,
+			PreAuthorized: preAuthorized,
+			Tags:          tags,
+			Expiry:        expiryDur,
 		}
 		resp, err := client.CreateAuthKey(context.Background(), connect.NewRequest(req))

@@ -8,25 +8,26 @@ import (
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"github.com/muesli/coral"
 	"gopkg.in/yaml.v2"
-	"io/ioutil"
+	"os"
 	"tailscale.com/tailcfg"
 )

-func derpMapCommand() *coral.Command {
+func systemCommand() *coral.Command {
 	command := &coral.Command{
-		Use:   "derp-map",
-		Short: "Manage DERP Map configuration",
+		Use:   "system",
+		Short: "Manage global system configurations",
 	}

-	command.AddCommand(getDERPMap())
-	command.AddCommand(setDERPMap())
+	command.AddCommand(getDefaultDERPMap())
+	command.AddCommand(setDefaultDERPMap())
+	command.AddCommand(resetDefaultDERPMap())

 	return command
 }

-func getDERPMap() *coral.Command {
+func getDefaultDERPMap() *coral.Command {
 	command := &coral.Command{
-		Use:          "get",
+		Use:          "get-derp-map",
 		Short:        "Get the DERP Map configuration",
 		SilenceUsage: true,
 	}
@@ -43,7 +44,7 @@ func getDERPMap() *coral.Command {
 			return err
 		}

-		resp, err := client.GetDERPMap(context.Background(), connect.NewRequest(&api.GetDERPMapRequest{}))
+		resp, err := client.GetDefaultDERPMap(context.Background(), connect.NewRequest(&api.GetDefaultDERPMapRequest{}))

 		if err != nil {
 			return err
@@ -63,7 +64,6 @@ func getDERPMap() *coral.Command {
 				return err
 			}

-			fmt.Println()
 			fmt.Println(string(marshal))
 		} else {
 			marshal, err := yaml.Marshal(derpMap)
@@ -71,7 +71,6 @@ func getDERPMap() *coral.Command {
 				return err
 			}

-			fmt.Println()
 			fmt.Println(string(marshal))
 		}

@@ -81,9 +80,9 @@ func getDERPMap() *coral.Command {
 	return command
 }

-func setDERPMap() *coral.Command {
+func setDefaultDERPMap() *coral.Command {
 	command := &coral.Command{
-		Use:          "set",
+		Use:          "set-derp-map",
 		Short:        "Set the DERP Map configuration",
 		SilenceUsage: true,
 	}
@@ -99,12 +98,12 @@ func setDERPMap() *coral.Command {
 			return err
 		}

-		rawJson, err := ioutil.ReadFile(file)
+		rawJson, err := os.ReadFile(file)
 		if err != nil {
 			return err
 		}

-		resp, err := grpcClient.SetDERPMap(context.Background(), connect.NewRequest(&api.SetDERPMapRequest{Value: rawJson}))
+		resp, err := grpcClient.SetDefaultDERPMap(context.Background(), connect.NewRequest(&api.SetDefaultDERPMapRequest{Value: rawJson}))
 		if err != nil {
 			return err
 		}
@@ -114,7 +113,34 @@ func setDERPMap() *coral.Command {
 			return err
 		}

-		fmt.Println()
+		fmt.Println("DERP Map updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
+func resetDefaultDERPMap() *coral.Command {
+	command := &coral.Command{
+		Use:          "reset-derp-map",
+		Short:        "Reset the DERP Map to the default configuration",
+		SilenceUsage: true,
+	}
+
+	var target = Target{}
+	target.prepareCommand(command)
+
+	command.RunE = func(command *coral.Command, args []string) error {
+		grpcClient, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		if _, err := grpcClient.ResetDefaultDERPMap(context.Background(), connect.NewRequest(&api.ResetDefaultDERPMapRequest{})); err != nil {
+			return err
+		}
+
 		fmt.Println("DERP Map updated successfully")

 		return nil
@@ -46,18 +46,12 @@ func getDNSConfigCommand() *coral.Command {
 		}
 		config := resp.Msg.Config

-		var allNameservers = config.Nameservers
-
-		for i, j := range config.Routes {
-			for _, n := range j.Routes {
-				allNameservers = append(allNameservers, fmt.Sprintf("%s:%s", i, n))
-			}
-		}
-
 		w := new(tabwriter.Writer)
-		w.Init(os.Stdout, 8, 8, 0, '\t', 0)
+		w.Init(os.Stdout, 8, 8, 1, '\t', 0)
 		defer w.Flush()

+		fmt.Fprintf(w, "%s\t\t%v\n", "MagicDNS", config.MagicDns)
+		fmt.Fprintf(w, "%s\t\t%v\n", "HTTPS Certs", config.HttpsCerts)
 		fmt.Fprintf(w, "%s\t\t%v\n", "Override Local DNS", config.OverrideLocalDns)

 		if config.MagicDns {
@@ -107,6 +101,7 @@ func setDNSConfigCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
 	command.Flags().StringSliceVarP(&nameservers, "nameserver", "", []string{}, "Machines on your network will use these nameservers to resolve DNS queries.")
 	command.Flags().BoolVarP(&magicDNS, "magic-dns", "", false, "Enable MagicDNS for the specified Tailnet")
+	command.Flags().BoolVarP(&magicDNS, "https-certs", "", false, "Enable HTTPS Certificates for the specified Tailnet")
 	command.Flags().BoolVarP(&overrideLocalDNS, "override-local-dns", "", false, "When enabled, connected clients ignore local DNS settings and always use the nameservers specified for this Tailnet")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
@@ -37,7 +37,7 @@ func findTailnet(client apiconnect.IonscaleServiceClient, tailnet string, tailne
 		return nil, fmt.Errorf("requested tailnet not found or you are not authorized for this tailnet")
 	}

-	tailnets, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetRequest{}))
+	tailnets, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetsRequest{}))
 	if err != nil {
 		return nil, err
 	}
@@ -1,13 +1,16 @@
 package cmd

 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
 	"github.com/bufbuild/connect-go"
+	"github.com/jsiebens/go-edit/editor"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"github.com/muesli/coral"
 	"io/ioutil"
+	"os"
 )

 func getIAMPolicyCommand() *coral.Command {
@@ -55,6 +58,70 @@ func getIAMPolicyCommand() *coral.Command {
 	return command
 }

+func editIAMPolicyCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "edit-iam-policy",
+		Short:        "Edit the IAM policy",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(cmd *coral.Command, args []string) error {
+		edit := editor.NewDefaultEditor([]string{"IONSCALE_EDITOR", "EDITOR"})
+
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.GetIAMPolicy(context.Background(), connect.NewRequest(&api.GetIAMPolicyRequest{TailnetId: tailnet.Id}))
+		if err != nil {
+			return err
+		}
+
+		previous, err := json.MarshalIndent(resp.Msg.Policy, "", "  ")
+		if err != nil {
+			return err
+		}
+
+		next, s, err := edit.LaunchTempFile("ionscale", ".json", bytes.NewReader(previous))
+		if err != nil {
+			return err
+		}
+
+		defer os.Remove(s)
+
+		var policy = &api.IAMPolicy{}
+		if err := json.Unmarshal(next, policy); err != nil {
+			return err
+		}
+
+		_, err = client.SetIAMPolicy(context.Background(), connect.NewRequest(&api.SetIAMPolicyRequest{TailnetId: tailnet.Id, Policy: policy}))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println("IAM policy updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
 func setIAMPolicyCommand() *coral.Command {
 	command := &coral.Command{
 		Use:          "set-iam-policy",
@@ -17,6 +17,7 @@ import (
 func machineCommands() *coral.Command {
 	command := &coral.Command{
 		Use:          "machines",
+		Aliases:      []string{"machine"},
 		Short:        "Manage ionscale machines",
 		SilenceUsage: true,
 	}
@@ -32,6 +33,7 @@ func machineCommands() *coral.Command {
 	command.AddCommand(enableExitNodeCommand())
 	command.AddCommand(disableExitNodeCommand())
 	command.AddCommand(disableMachineKeyExpiryCommand())
+	command.AddCommand(authorizeMachineCommand())

 	return command
 }
@@ -94,6 +96,10 @@ func getMachineCommand() *coral.Command {
 		fmt.Fprintf(w, "%s\t%s\n", "Tailscale IPv4", m.Ipv4)
 		fmt.Fprintf(w, "%s\t%s\n", "Tailscale IPv6", m.Ipv6)
 		fmt.Fprintf(w, "%s\t%s\n", "Last seen", lastSeen)
+		fmt.Fprintf(w, "%s\t%v\n", "Ephemeral", m.Ephemeral)
+		if !m.Authorized {
+			fmt.Fprintf(w, "%s\t%v\n", "Authorized", m.Authorized)
+		}
 		fmt.Fprintf(w, "%s\t%s\n", "Key expiry", expiresAt)

 		for i, t := range m.Tags {
@@ -210,6 +216,39 @@ func expireMachineCommand() *coral.Command {
 	return command
 }

+func authorizeMachineCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "authorize",
+		Short:        "Authorizes a machine",
+		SilenceUsage: true,
+	}
+
+	var machineID uint64
+	var target = Target{}
+	target.prepareCommand(command)
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID.")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		req := api.AuthorizeMachineRequest{MachineId: machineID}
+		if _, err := client.AuthorizeMachine(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		fmt.Println("Machine authorized.")
+
+		return nil
+	}
+
+	return command
+}
+
 func listMachinesCommand() *coral.Command {
 	command := &coral.Command{
 		Use:          "list",
@@ -244,7 +283,7 @@ func listMachinesCommand() *coral.Command {
 			return err
 		}

-		tbl := table.New("ID", "TAILNET", "NAME", "IPv4", "IPv6", "EPHEMERAL", "LAST_SEEN", "TAGS")
+		tbl := table.New("ID", "TAILNET", "NAME", "IPv4", "IPv6", "AUTHORIZED", "EPHEMERAL", "LAST_SEEN", "TAGS")
 		for _, m := range resp.Msg.Machines {
 			var lastSeen = "N/A"
 			if m.Connected {
@@ -255,7 +294,7 @@ func listMachinesCommand() *coral.Command {
 					lastSeen = mom.FromNow()
 				}
 			}
-			tbl.AddRow(m.Id, m.Tailnet.Name, m.Name, m.Ipv4, m.Ipv6, m.Ephemeral, lastSeen, strings.Join(m.Tags, ","))
+			tbl.AddRow(m.Id, m.Tailnet.Name, m.Name, m.Ipv4, m.Ipv6, m.Authorized, m.Ephemeral, lastSeen, strings.Join(m.Tags, ","))
 		}
 		tbl.Print()

@@ -291,7 +330,7 @@ func getMachineRoutesCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -335,7 +374,7 @@ func enableMachineRoutesCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -377,7 +416,7 @@ func disableMachineRoutesCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -411,7 +450,7 @@ func enableExitNodeCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -445,7 +484,7 @@ func disableExitNodeCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -499,7 +538,7 @@ func configureSetMachineKeyExpiryCommand(command *coral.Command, v bool) *coral.
 	return command
 }

-func printMachinesRoutesResponse(msg *api.GetMachineRoutesResponse) {
+func printMachinesRoutesResponse(msg *api.MachineRoutes) {
 	w := new(tabwriter.Writer)
 	w.Init(os.Stdout, 8, 8, 0, '\t', 0)
 	defer w.Flush()
@@ -9,13 +9,13 @@ func Command() *coral.Command {
 	rootCmd.AddCommand(configureCommand())
 	rootCmd.AddCommand(keyCommand())
 	rootCmd.AddCommand(authCommand())
-	rootCmd.AddCommand(derpMapCommand())
 	rootCmd.AddCommand(serverCommand())
 	rootCmd.AddCommand(versionCommand())
 	rootCmd.AddCommand(tailnetCommand())
 	rootCmd.AddCommand(authkeysCommand())
 	rootCmd.AddCommand(machineCommands())
 	rootCmd.AddCommand(userCommands())
+	rootCmd.AddCommand(systemCommand())

 	return rootCmd
 }
@@ -2,19 +2,24 @@ package cmd

 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	idomain "github.com/jsiebens/ionscale/internal/domain"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"github.com/muesli/coral"
 	"github.com/rodaine/table"
+	"gopkg.in/yaml.v3"
+	"os"
 	"strings"
+	"tailscale.com/tailcfg"
 )

 func tailnetCommand() *coral.Command {
 	command := &coral.Command{
-		Use:   "tailnets",
-		Short: "Manage ionscale tailnets",
+		Use:     "tailnets",
+		Aliases: []string{"tailnet"},
+		Short:   "Manage ionscale tailnets",
 	}

 	command.AddCommand(listTailnetsCommand())
@@ -24,8 +29,21 @@ func tailnetCommand() *coral.Command {
 	command.AddCommand(setDNSConfigCommand())
 	command.AddCommand(getACLConfigCommand())
 	command.AddCommand(setACLConfigCommand())
+	command.AddCommand(editACLConfigCommand())
 	command.AddCommand(getIAMPolicyCommand())
 	command.AddCommand(setIAMPolicyCommand())
+	command.AddCommand(editIAMPolicyCommand())
+	command.AddCommand(enableServiceCollectionCommand())
+	command.AddCommand(disableServiceCollectionCommand())
+	command.AddCommand(enableFileSharingCommand())
+	command.AddCommand(disableFileSharingCommand())
+	command.AddCommand(enableSSHCommand())
+	command.AddCommand(disableSSHCommand())
+	command.AddCommand(enableMachineAuthorizationCommand())
+	command.AddCommand(disableMachineAuthorizationCommand())
+	command.AddCommand(getDERPMap())
+	command.AddCommand(setDERPMap())
+	command.AddCommand(resetDERPMap())

 	return command
 }
@@ -47,7 +65,7 @@ func listTailnetsCommand() *coral.Command {
 			return err
 		}

-		resp, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetRequest{}))
+		resp, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetsRequest{}))

 		if err != nil {
 			return err
@@ -83,8 +101,8 @@ func createTailnetsCommand() *coral.Command {
 	command.Flags().StringVar(&email, "email", "", "")

 	command.PreRunE = func(cmd *coral.Command, args []string) error {
-		if name == "" && email == "" && domain == "" {
-			return fmt.Errorf("at least flag --name, --email or --domain is required")
+		if name == "" {
+			return fmt.Errorf("flag --name is required")
 		}
 		if domain != "" && email != "" {
 			return fmt.Errorf("flags --email and --domain are mutually exclusive")
@@ -94,12 +112,10 @@ func createTailnetsCommand() *coral.Command {

 	command.RunE = func(command *coral.Command, args []string) error {

-		var tailnetName = ""
 		var iamPolicy = api.IAMPolicy{}

 		if len(domain) != 0 {
 			domainToLower := strings.ToLower(domain)
-			tailnetName = domainToLower
 			iamPolicy = api.IAMPolicy{
 				Filters: []string{fmt.Sprintf("domain == %s", domainToLower)},
 			}
@@ -107,7 +123,6 @@ func createTailnetsCommand() *coral.Command {

 		if len(email) != 0 {
 			emailToLower := strings.ToLower(email)
-			tailnetName = emailToLower
 			iamPolicy = api.IAMPolicy{
 				Emails: []string{emailToLower},
 				Roles: map[string]string{
@@ -116,17 +131,13 @@ func createTailnetsCommand() *coral.Command {
 			}
 		}

-		if len(name) != 0 {
-			tailnetName = name
-		}
-
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
 		}

 		resp, err := client.CreateTailnet(context.Background(), connect.NewRequest(&api.CreateTailnetRequest{
-			Name:      tailnetName,
+			Name:      name,
 			IamPolicy: &iamPolicy,
 		}))

@@ -187,3 +198,490 @@ func deleteTailnetCommand() *coral.Command {

 	return command
 }
+
+func getDERPMap() *coral.Command {
+	command := &coral.Command{
+		Use:          "get-derp-map",
+		Short:        "Get the DERP Map configuration",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var asJson bool
+
+	var target = Target{}
+	target.prepareCommand(command)
+
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+	command.Flags().BoolVar(&asJson, "json", false, "When enabled, render output as json otherwise yaml")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.GetDERPMap(context.Background(), connect.NewRequest(&api.GetDERPMapRequest{TailnetId: tailnet.Id}))
+
+		if err != nil {
+			return err
+		}
+
+		var derpMap struct {
+			Regions map[int]*tailcfg.DERPRegion
+		}
+
+		if err := json.Unmarshal(resp.Msg.Value, &derpMap); err != nil {
+			return err
+		}
+
+		if asJson {
+			marshal, err := json.MarshalIndent(derpMap, "", "  ")
+			if err != nil {
+				return err
+			}
+
+			fmt.Println(string(marshal))
+		} else {
+			marshal, err := yaml.Marshal(derpMap)
+			if err != nil {
+				return err
+			}
+
+			fmt.Println(string(marshal))
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func setDERPMap() *coral.Command {
+	command := &coral.Command{
+		Use:          "set-derp-map",
+		Short:        "Set the DERP Map configuration",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var file string
+	var target = Target{}
+	target.prepareCommand(command)
+
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+	command.Flags().StringVar(&file, "file", "", "Path to json file with the DERP Map configuration")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		rawJson, err := os.ReadFile(file)
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.SetDERPMap(context.Background(), connect.NewRequest(&api.SetDERPMapRequest{TailnetId: tailnet.Id, Value: rawJson}))
+		if err != nil {
+			return err
+		}
+
+		var derpMap tailcfg.DERPMap
+		if err := json.Unmarshal(resp.Msg.Value, &derpMap); err != nil {
+			return err
+		}
+
+		fmt.Println("DERP Map updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
+func resetDERPMap() *coral.Command {
+	command := &coral.Command{
+		Use:          "reset-derp-map",
+		Short:        "Reset the DERP Map to the default configuration",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+	target.prepareCommand(command)
+
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		if _, err := client.ResetDERPMap(context.Background(), connect.NewRequest(&api.ResetDERPMapRequest{TailnetId: tailnet.Id})); err != nil {
+			return err
+		}
+
+		fmt.Println("DERP Map updated successfully")
+
+		return nil
+	}
+
+	return command
+}
+
+func enableFileSharingCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "enable-file-sharing",
+		Aliases:      []string{"enable-taildrop"},
+		Short:        "Enable Taildrop, the file sharing feature",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.EnableFileSharingRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.EnableFileSharing(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableFileSharingCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "disable-file-sharing",
+		Aliases:      []string{"disable-taildrop"},
+		Short:        "Disable Taildrop, the file sharing feature",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.DisableFileSharingRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.DisableFileSharing(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func enableServiceCollectionCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "enable-service-collection",
+		Short:        "Enable monitoring live services running on your network’s machines.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.EnableServiceCollectionRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.EnableServiceCollection(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableServiceCollectionCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "disable-service-collection",
+		Short:        "Disable monitoring live services running on your network’s machines.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.DisableServiceCollectionRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.DisableServiceCollection(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func enableSSHCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "enable-ssh",
+		Short:        "Enable ssh access using tailnet and ACLs.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.EnableSSHRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.EnableSSH(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableSSHCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "disable-ssh",
+		Short:        "Disable ssh access using tailnet and ACLs.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.DisableSSHRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.DisableSSH(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func enableMachineAuthorizationCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "enable-machine-authorization",
+		Short:        "Enable machine authorization.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.EnableMachineAuthorizationRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.EnableMachineAuthorization(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableMachineAuthorizationCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "disable-machine-authorization",
+		Short:        "Disable machine authorization.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.DisableMachineAuthorizationRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.DisableMachineAuthorization(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
@@ -12,6 +12,7 @@ import (
 func userCommands() *coral.Command {
 	command := &coral.Command{
 		Use:          "users",
+		Aliases:      []string{"user"},
 		Short:        "Manage ionscale users",
 		SilenceUsage: true,
 	}
@@ -1,6 +1,7 @@
 package config

 import (
+	"encoding/base64"
 	"fmt"
 	"github.com/caarlos0/env/v6"
 	"github.com/caddyserver/certmagic"
@@ -23,8 +24,9 @@ const (
 )

 var (
-	keepAliveInterval = defaultKeepAliveInterval
-	magicDNSSuffix    = defaultMagicDNSSuffix
+	keepAliveInterval     = defaultKeepAliveInterval
+	magicDNSSuffix        = defaultMagicDNSSuffix
+	dnsProviderConfigured = false
 )

 func KeepAliveInterval() time.Duration {
@@ -35,6 +37,10 @@ func MagicDNSSuffix() string {
 	return magicDNSSuffix
 }

+func DNSProviderConfigured() bool {
+	return dnsProviderConfigured
+}
+
 func LoadConfig(path string) (*Config, error) {
 	cfg := defaultConfig()

@@ -59,6 +65,19 @@ func LoadConfig(path string) (*Config, error) {
 		}
 	}

+	envCfgB64 := os.Getenv("IONSCALE_CONFIG_BASE64")
+	if len(envCfgB64) != 0 {
+		b, err := base64.RawStdEncoding.DecodeString(envCfgB64)
+		if err != nil {
+			return nil, err
+		}
+
+		// merge env configuration on top of the default/file configuration
+		if err := yaml.Unmarshal(b, cfg); err != nil {
+			return nil, err
+		}
+	}
+
 	envCfg := &Config{}
 	if err := env.Parse(envCfg, env.Options{Prefix: "IONSCALE_"}); err != nil {
 		return nil, err
@@ -72,6 +91,10 @@ func LoadConfig(path string) (*Config, error) {
 	keepAliveInterval = cfg.PollNet.KeepAliveInterval
 	magicDNSSuffix = cfg.DNS.MagicDNSSuffix

+	if cfg.DNS.Provider.Zone != "" {
+		dnsProviderConfigured = true
+	}
+
 	return cfg, nil
 }

@@ -111,17 +134,17 @@ type ServerKeys struct {
 }

 type Config struct {
-	HttpListenAddr    string       `yaml:"http_listen_addr,omitempty" env:"HTTP_LISTEN_ADDR"`
-	HttpsListenAddr   string       `yaml:"https_listen_addr,omitempty" env:"HTTPS_LISTEN_ADDR"`
-	MetricsListenAddr string       `yaml:"metrics_listen_addr,omitempty" env:"METRICS_LISTEN_ADDR"`
-	ServerUrl         string       `yaml:"server_url,omitempty" env:"SERVER_URL"`
-	Tls               Tls          `yaml:"tls,omitempty" envPrefix:"TLS_"`
-	PollNet           PollNet      `yaml:"poll_net,omitempty" envPrefix:"POLL_NET_"`
-	Keys              Keys         `yaml:"keys,omitempty" envPrefix:"KEYS_"`
-	Database          Database     `yaml:"database,omitempty" envPrefix:"DB_"`
-	AuthProvider      AuthProvider `yaml:"auth_provider,omitempty"`
-	DNS               DNS          `yaml:"dns,omitempty"`
-	Logging           Logging      `yaml:"logging,omitempty" envPrefix:"LOGGING_"`
+	HttpListenAddr    string   `yaml:"http_listen_addr,omitempty" env:"HTTP_LISTEN_ADDR"`
+	HttpsListenAddr   string   `yaml:"https_listen_addr,omitempty" env:"HTTPS_LISTEN_ADDR"`
+	MetricsListenAddr string   `yaml:"metrics_listen_addr,omitempty" env:"METRICS_LISTEN_ADDR"`
+	ServerUrl         string   `yaml:"server_url,omitempty" env:"SERVER_URL"`
+	Tls               Tls      `yaml:"tls,omitempty" envPrefix:"TLS_"`
+	PollNet           PollNet  `yaml:"poll_net,omitempty" envPrefix:"POLL_NET_"`
+	Keys              Keys     `yaml:"keys,omitempty" envPrefix:"KEYS_"`
+	Database          Database `yaml:"database,omitempty" envPrefix:"DB_"`
+	Auth              Auth     `yaml:"auth,omitempty" envPrefix:"AUTH_"`
+	DNS               DNS      `yaml:"dns,omitempty"`
+	Logging           Logging  `yaml:"logging,omitempty" envPrefix:"LOGGING_"`
 }

 type Tls struct {
@@ -156,22 +179,33 @@ type Keys struct {
 	SystemAdminKey   string `yaml:"system_admin_key,omitempty" env:"SYSTEM_ADMIN_KEY"`
 }

-type AuthProvider struct {
-	Issuer            string            `yaml:"issuer"`
-	ClientID          string            `yaml:"client_id"`
-	ClientSecret      string            `yaml:"client_secret"`
-	Scopes            []string          `yaml:"additional_scopes"`
+type Auth struct {
+	Provider          AuthProvider      `yaml:"provider,omitempty" envPrefix:"PROVIDER_"`
 	SystemAdminPolicy SystemAdminPolicy `yaml:"system_admins"`
 }

+type AuthProvider struct {
+	Issuer       string   `yaml:"issuer" env:"ISSUER"`
+	ClientID     string   `yaml:"client_id" env:"CLIENT_ID"`
+	ClientSecret string   `yaml:"client_secret" env:"CLIENT_SECRET"`
+	Scopes       []string `yaml:"additional_scopes"  env:"SCOPES"`
+}
+
 type DNS struct {
-	MagicDNSSuffix string `yaml:"magic_dns_suffix"`
+	MagicDNSSuffix string      `yaml:"magic_dns_suffix"`
+	Provider       DNSProvider `yaml:"provider,omitempty"`
+}
+
+type DNSProvider struct {
+	Name          string            `yaml:"name"`
+	Zone          string            `yaml:"zone"`
+	Configuration map[string]string `yaml:"config"`
 }

 type SystemAdminPolicy struct {
-	Subs    []string `json:"subs,omitempty"`
-	Emails  []string `json:"emails,omitempty"`
-	Filters []string `json:"filters,omitempty"`
+	Subs    []string `yaml:"subs,omitempty"`
+	Emails  []string `yaml:"emails,omitempty"`
+	Filters []string `yaml:"filters,omitempty"`
 }

 func (c *Config) CreateUrl(format string, a ...interface{}) string {
@@ -1,8 +1,7 @@
-package handlers
+package core

 import (
 	"context"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"time"
 )
@@ -12,26 +11,28 @@ const (
 	inactivityTimeout = 30 * time.Minute
 )

-func NewReaper(brokers broker.Pubsub, repository domain.Repository) *Reaper {
-	return &Reaper{
-		pubsub:     brokers,
-		repository: repository,
+func StartReaper(repository domain.Repository, sessionManager PollMapSessionManager) {
+	r := &reaper{
+		sessionManager: sessionManager,
+		repository:     repository,
 	}
+
+	go r.start()
 }

-type Reaper struct {
-	pubsub     broker.Pubsub
-	repository domain.Repository
+type reaper struct {
+	sessionManager PollMapSessionManager
+	repository     domain.Repository
 }

-func (r *Reaper) Start() {
+func (r *reaper) start() {
 	t := time.NewTicker(ticker)
 	for range t.C {
 		r.reapInactiveEphemeralNodes()
 	}
 }

-func (r *Reaper) reapInactiveEphemeralNodes() {
+func (r *reaper) reapInactiveEphemeralNodes() {
 	ctx := context.Background()

 	now := time.Now().UTC()
@@ -54,8 +55,8 @@ func (r *Reaper) reapInactiveEphemeralNodes() {
 	}

 	if len(removedNodes) != 0 {
-		for i, p := range removedNodes {
-			r.pubsub.Publish(i, &broker.Signal{PeersRemoved: p})
+		for i, _ := range removedNodes {
+			r.sessionManager.NotifyAll(i)
 		}
 	}
 }
@@ -0,0 +1,94 @@
+package core
+
+import (
+	"sync"
+	"time"
+)
+
+type Ping struct{}
+
+type PollMapSessionManager interface {
+	Register(tailnetID uint64, machineID uint64, ch chan *Ping)
+	Deregister(tailnetID uint64, machineID uint64)
+	HasSession(tailnetID uint64, machineID uint64) bool
+	NotifyAll(tailnetID uint64)
+}
+
+func NewPollMapSessionManager() PollMapSessionManager {
+	return &pollMapSessionManager{
+		data:   map[uint64]map[uint64]chan *Ping{},
+		timers: map[uint64]*time.Timer{},
+	}
+}
+
+type pollMapSessionManager struct {
+	sync.RWMutex
+	data   map[uint64]map[uint64]chan *Ping
+	timers map[uint64]*time.Timer
+}
+
+func (n *pollMapSessionManager) Register(tailnetID uint64, machineID uint64, ch chan *Ping) {
+	n.Lock()
+	defer n.Unlock()
+
+	if ss := n.data[tailnetID]; ss == nil {
+		n.data[tailnetID] = map[uint64]chan *Ping{machineID: ch}
+	} else {
+		ss[machineID] = ch
+	}
+
+	t, ok := n.timers[machineID]
+	if ok {
+		t.Stop()
+		delete(n.timers, machineID)
+	}
+}
+
+func (n *pollMapSessionManager) Deregister(tailnetID uint64, machineID uint64) {
+	n.Lock()
+	defer n.Unlock()
+
+	if ss := n.data[tailnetID]; ss != nil {
+		delete(ss, machineID)
+	}
+
+	t, ok := n.timers[machineID]
+	if ok {
+		t.Stop()
+		delete(n.timers, machineID)
+	}
+
+	timer := time.NewTimer(10 * time.Second)
+	go func() {
+		<-timer.C
+		if !n.HasSession(tailnetID, machineID) {
+			n.NotifyAll(tailnetID)
+		}
+	}()
+
+	n.timers[machineID] = timer
+}
+
+func (n *pollMapSessionManager) HasSession(tailnetID uint64, machineID uint64) bool {
+	n.RLock()
+	defer n.RUnlock()
+
+	if ss := n.data[tailnetID]; ss != nil {
+		if _, ok := ss[machineID]; ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (n *pollMapSessionManager) NotifyAll(tailnetID uint64) {
+	n.RLock()
+	defer n.RUnlock()
+
+	if ss := n.data[tailnetID]; ss != nil {
+		for _, p := range ss {
+			p <- &Ping{}
+		}
+	}
+}
@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"github.com/go-gormigrate/gormigrate/v2"
 	"github.com/hashicorp/go-hclog"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/database/migration"
+	"github.com/jsiebens/ionscale/internal/util"
 	"tailscale.com/types/key"
 	"time"

@@ -24,51 +24,38 @@ type db interface {
 	UnlockErr(error) error
 }

-func OpenDB(config *config.Database, logger hclog.Logger) (domain.Repository, broker.Pubsub, error) {
-	db, pubsub, err := createDB(config, logger)
+func OpenDB(config *config.Database, logger hclog.Logger) (domain.Repository, error) {
+	db, err := createDB(config, logger)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}

 	repository := domain.NewRepository(db.DB())

 	if err := db.Lock(); err != nil {
-		return nil, nil, err
+		return nil, err
 	}

 	if err := db.UnlockErr(migrate(db.DB())); err != nil {
-		return nil, nil, err
+		return nil, err
 	}

-	return repository, pubsub, nil
+	return repository, nil
 }

-func createDB(config *config.Database, logger hclog.Logger) (db, broker.Pubsub, error) {
+func createDB(config *config.Database, logger hclog.Logger) (db, error) {
 	gormConfig := &gorm.Config{
 		Logger: &GormLoggerAdapter{logger: logger.Named("db")},
 	}

 	switch config.Type {
 	case "sqlite", "sqlite3":
-		db, err := newSqliteDB(config, gormConfig)
-		return db, broker.NewPubsubInMemory(), err
+		return newSqliteDB(config, gormConfig)
 	case "postgres", "postgresql":
-		db, err := newPostgresDB(config, gormConfig)
-		if err != nil {
-			return nil, nil, err
-		}
-		stdDB, err := db.DB().DB()
-		if err != nil {
-			return nil, nil, err
-		}
-		pubsub, err := broker.NewPubsub(context.TODO(), stdDB, config.Url)
-		if err != nil {
-			return nil, nil, err
-		}
-		return db, pubsub, err
+		return newPostgresDB(config, gormConfig)
 	}

-	return nil, nil, fmt.Errorf("invalid database type '%s'", config.Type)
+	return nil, fmt.Errorf("invalid database type '%s'", config.Type)
 }

 func migrate(db *gorm.DB) error {
@@ -85,6 +72,10 @@ func migrate(db *gorm.DB) error {
 		return err
 	}

+	if err := createJSONWebKeySet(ctx, repository); err != nil {
+		return err
+	}
+
 	return nil
 }

@@ -108,6 +99,29 @@ func createServerKey(ctx context.Context, repository domain.Repository) error {
 	return nil
 }

+func createJSONWebKeySet(ctx context.Context, repository domain.Repository) error {
+	jwks, err := repository.GetJSONWebKeySet(ctx)
+	if err != nil {
+		return err
+	}
+	if jwks != nil {
+		return nil
+	}
+
+	privateKey, id, err := util.NewPrivateKey()
+	if err != nil {
+		return err
+	}
+
+	jsonWebKey := domain.JSONWebKey{Id: id, PrivateKey: *privateKey}
+
+	if err := repository.SetJSONWebKeySet(ctx, &domain.JSONWebKeys{Key: jsonWebKey}); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 type GormLoggerAdapter struct {
 	logger hclog.Logger
 }
@@ -129,21 +143,23 @@ func (g *GormLoggerAdapter) Error(ctx context.Context, s string, i ...interface{
 }

 func (g *GormLoggerAdapter) Trace(ctx context.Context, begin time.Time, fc func() (sql string, rowsAffected int64), err error) {
-	elapsed := time.Since(begin)
-	switch {
-	case err != nil && !errors.Is(err, gorm.ErrRecordNotFound):
-		sql, rows := fc()
-		if rows == -1 {
-			g.logger.Error("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "err", err)
-		} else {
-			g.logger.Error("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows, "err", err)
-		}
-	case g.logger.IsTrace():
-		sql, rows := fc()
-		if rows == -1 {
-			g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed)
-		} else {
-			g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows)
+	if g.logger.IsTrace() {
+		elapsed := time.Since(begin)
+		switch {
+		case err != nil && !errors.Is(err, gorm.ErrRecordNotFound):
+			sql, rows := fc()
+			if rows == -1 {
+				g.logger.Trace("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "err", err)
+			} else {
+				g.logger.Trace("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows, "err", err)
+			}
+		default:
+			sql, rows := fc()
+			if rows == -1 {
+				g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed)
+			} else {
+				g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows)
+			}
 		}
 	}
 }
@@ -14,26 +14,26 @@ func m202209070900_initial_schema() *gormigrate.Migration {
 			// it's a good practice to copy the struct inside the function,
 			// so side effects are prevented if the original struct changes during the time
 			type ServerConfig struct {
-				Key   string `gorm:"primary_key"`
+				Key   string `gorm:"primaryKey"`
 				Value []byte
 			}

 			type Tailnet struct {
-				ID        uint64 `gorm:"primary_key;autoIncrement:false"`
-				Name      string `gorm:"type:varchar(64);unique_index"`
+				ID        uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Name      string `gorm:"type:varchar(64);uniqueIndex"`
 				DNSConfig domain.DNSConfig
 				IAMPolicy domain.IAMPolicy
 				ACLPolicy domain.ACLPolicy
 			}

 			type Account struct {
-				ID         uint64 `gorm:"primary_key;autoIncrement:false"`
+				ID         uint64 `gorm:"primaryKey;autoIncrement:false"`
 				ExternalID string
 				LoginName  string
 			}

 			type User struct {
-				ID        uint64 `gorm:"primary_key;autoIncrement:false"`
+				ID        uint64 `gorm:"primaryKey;autoIncrement:false"`
 				Name      string
 				UserType  domain.UserType
 				TailnetID uint64
@@ -43,8 +43,8 @@ func m202209070900_initial_schema() *gormigrate.Migration {
 			}

 			type SystemApiKey struct {
-				ID   uint64 `gorm:"primary_key;autoIncrement:false"`
-				Key  string `gorm:"type:varchar(64);unique_index"`
+				ID   uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Key  string `gorm:"type:varchar(64);uniqueIndex"`
 				Hash string

 				CreatedAt time.Time
@@ -55,8 +55,8 @@ func m202209070900_initial_schema() *gormigrate.Migration {
 			}

 			type ApiKey struct {
-				ID   uint64 `gorm:"primary_key;autoIncrement:false"`
-				Key  string `gorm:"type:varchar(64);unique_index"`
+				ID   uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Key  string `gorm:"type:varchar(64);uniqueIndex"`
 				Hash string

 				CreatedAt time.Time
@@ -70,8 +70,8 @@ func m202209070900_initial_schema() *gormigrate.Migration {
 			}

 			type AuthKey struct {
-				ID        uint64 `gorm:"primary_key;autoIncrement:false"`
-				Key       string `gorm:"type:varchar(64);unique_index"`
+				ID        uint64 `gorm:"primaryKey;autoIncrement:false"`
+				Key       string `gorm:"type:varchar(64);uniqueIndex"`
 				Hash      string
 				Ephemeral bool
 				Tags      domain.Tags
@@ -87,7 +87,7 @@ func m202209070900_initial_schema() *gormigrate.Migration {
 			}

 			type Machine struct {
-				ID                uint64 `gorm:"primary_key;autoIncrement:false"`
+				ID                uint64 `gorm:"primaryKey;autoIncrement:false"`
 				Name              string
 				NameIdx           uint64
 				MachineKey        string
@@ -117,8 +117,8 @@ func m202209070900_initial_schema() *gormigrate.Migration {
 			}

 			type RegistrationRequest struct {
-				MachineKey    string `gorm:"primary_key;autoIncrement:false"`
-				Key           string `gorm:"type:varchar(64);unique_index"`
+				MachineKey    string `gorm:"primaryKey;autoIncrement:false"`
+				Key           string `gorm:"type:varchar(64);uniqueIndex"`
 				Data          domain.RegistrationRequestData
 				CreatedAt     time.Time
 				Authenticated bool
@@ -126,7 +126,7 @@ func m202209070900_initial_schema() *gormigrate.Migration {
 			}

 			type AuthenticationRequest struct {
-				Key       string `gorm:"primary_key;autoIncrement:false"`
+				Key       string `gorm:"primaryKey;autoIncrement:false"`
 				Token     string
 				TailnetID *uint64
 				Error     string
@@ -0,0 +1,39 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202209251532_add_alias_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202209251532a",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Alias *string `gorm:"type:varchar(64)"`
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}
+
+func m202229251530_add_alias_column_constraint() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202209251532b",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name  string  `gorm:"uniqueIndex"`
+				Alias *string `gorm:"uniqueIndex"`
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -0,0 +1,25 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"gorm.io/gorm"
+)
+
+func m202210040828_add_derpmap_colum() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202210040828",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name    string  `gorm:"uniqueIndex"`
+				Alias   *string `gorm:"uniqueIndex"`
+				DERPMap domain.DERPMap
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -0,0 +1,25 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202210070814_add_filesharing_and_servicecollection_columns() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202210070814",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name                     string  `gorm:"uniqueIndex"`
+				Alias                    *string `gorm:"uniqueIndex"`
+				ServiceCollectionEnabled bool
+				FileSharingEnabled       bool
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -0,0 +1,34 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+	"time"
+)
+
+func m202210080700_ssh_action_request() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202210080700",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name       string  `gorm:"uniqueIndex"`
+				Alias      *string `gorm:"uniqueIndex"`
+				SSHEnabled bool
+			}
+
+			type SSHActionRequest struct {
+				Key          string `gorm:"primary_key"`
+				Action       string
+				SrcMachineID uint64
+				DstMachineID uint64
+				CreatedAt    time.Time
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+				&SSHActionRequest{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -0,0 +1,33 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202211031100_add_authorized_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202211031100",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name                        string `gorm:"uniqueIndex"`
+				MachineAuthorizationEnabled bool
+			}
+
+			type AuthKey struct {
+				PreAuthorized bool
+			}
+
+			type Machine struct {
+				Authorized bool `gorm:"default:true"`
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+				&AuthKey{},
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -0,0 +1,23 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202212201300_add_user_id_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202212201300",
+		Migrate: func(db *gorm.DB) error {
+			type RegistrationRequest struct {
+				Key    string `gorm:"type:varchar(64);uniqueIndex"`
+				UserID uint64
+			}
+
+			return db.AutoMigrate(
+				&RegistrationRequest{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -8,6 +8,13 @@ func Migrations() []*gormigrate.Migration {
 	var migrations = []*gormigrate.Migration{
 		m202209070900_initial_schema(),
 		m202209251530_add_autoallowips_column(),
+		m202209251532_add_alias_column(),
+		m202229251530_add_alias_column_constraint(),
+		m202210040828_add_derpmap_colum(),
+		m202210070814_add_filesharing_and_servicecollection_columns(),
+		m202210080700_ssh_action_request(),
+		m202211031100_add_authorized_column(),
+		m202212201300_add_user_id_column(),
 	}
 	return migrations
 }
@@ -0,0 +1,164 @@
+package dns
+
+import (
+	"context"
+	"fmt"
+	"github.com/imdario/mergo"
+	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/mapping"
+	"github.com/libdns/azure"
+	"github.com/libdns/cloudflare"
+	"github.com/libdns/digitalocean"
+	"github.com/libdns/googleclouddns"
+	"github.com/libdns/libdns"
+	"github.com/libdns/route53"
+	"strings"
+	"time"
+)
+
+type Provider interface {
+	SetRecord(ctx context.Context, recordType, recordName, value string) error
+}
+
+func NewProvider(config config.DNS) (Provider, error) {
+	p := config.Provider
+	if len(p.Zone) == 0 {
+		return nil, nil
+	}
+
+	if !strings.HasSuffix(config.MagicDNSSuffix, p.Zone) {
+		return nil, fmt.Errorf("invalid MagicDNS suffix [%s], not part of zone [%s]", config.MagicDNSSuffix, p.Zone)
+	}
+
+	switch p.Name {
+	case "azure":
+		return configureAzureProvider(p.Zone, p.Configuration)
+	case "cloudflare":
+		return configureCloudflareProvider(p.Zone, p.Configuration)
+	case "digitalocean":
+		return configureDigitalOceanProvider(p.Zone, p.Configuration)
+	case "googleclouddns":
+		return configureGoogleCloudDNSProvider(p.Zone, p.Configuration)
+	case "route53":
+		return configureRoute53Provider(p.Zone, p.Configuration)
+	default:
+		return nil, fmt.Errorf("unknown dns provider: %s", p.Name)
+	}
+}
+
+func configureAzureProvider(zone string, values map[string]string) (Provider, error) {
+	p := &azure.Provider{}
+	if err := mapping.CopyViaJson(values, p); err != nil {
+		return nil, err
+	}
+
+	e := &azure.Provider{
+		TenantId:          config.GetString("IONSCALE_DNS_AZURE_TENANT_ID", ""),
+		ClientId:          config.GetString("IONSCALE_DNS_AZURE_CLIENT_ID", ""),
+		ClientSecret:      config.GetString("IONSCALE_DNS_AZURE_CLIENT_SECRET", ""),
+		SubscriptionId:    config.GetString("IONSCALE_DNS_AZURE_SUBSCRIPTION_ID", ""),
+		ResourceGroupName: config.GetString("IONSCALE_DNS_AZURE_RESOURCE_GROUP_NAME", ""),
+	}
+
+	// merge env configuration on top of the default/file configuration
+	if err := mergo.Merge(p, e, mergo.WithOverride); err != nil {
+		return nil, err
+	}
+
+	return &externalProvider{zone: zone, setter: p}, nil
+}
+
+func configureCloudflareProvider(zone string, values map[string]string) (Provider, error) {
+	p := &cloudflare.Provider{}
+	if err := mapping.CopyViaJson(values, p); err != nil {
+		return nil, err
+	}
+
+	e := &cloudflare.Provider{
+		APIToken: config.GetString("IONSCALE_DNS_CLOUDFLARE_API_TOKEN", ""),
+	}
+
+	// merge env configuration on top of the default/file configuration
+	if err := mergo.Merge(p, e, mergo.WithOverride); err != nil {
+		return nil, err
+	}
+
+	return &externalProvider{zone: zone, setter: p}, nil
+}
+
+func configureDigitalOceanProvider(zone string, values map[string]string) (Provider, error) {
+	p := &digitalocean.Provider{}
+	if err := mapping.CopyViaJson(values, p); err != nil {
+		return nil, err
+	}
+
+	e := &digitalocean.Provider{
+		APIToken: config.GetString("IONSCALE_DNS_DIGITALOCEAN_API_TOKEN", ""),
+	}
+
+	// merge env configuration on top of the default/file configuration
+	if err := mergo.Merge(p, e, mergo.WithOverride); err != nil {
+		return nil, err
+	}
+
+	return &externalProvider{zone: zone, setter: p}, nil
+}
+
+func configureGoogleCloudDNSProvider(zone string, values map[string]string) (Provider, error) {
+	p := &googleclouddns.Provider{}
+	if err := mapping.CopyViaJson(values, p); err != nil {
+		return nil, err
+	}
+
+	e := &googleclouddns.Provider{
+		Project:            config.GetString("IONSCALE_DNS_GOOGLECLOUDDNS_PROJECT", ""),
+		ServiceAccountJSON: config.GetString("IONSCALE_DNS_GOOGLECLOUDDNS_SERVICE_ACCOUNT_JSON", ""),
+	}
+
+	// merge env configuration on top of the default/file configuration
+	if err := mergo.Merge(p, e, mergo.WithOverride); err != nil {
+		return nil, err
+	}
+
+	return &externalProvider{zone: zone, setter: p}, nil
+}
+
+func configureRoute53Provider(zone string, values map[string]string) (Provider, error) {
+	p := &route53.Provider{}
+	if err := mapping.CopyViaJson(values, p); err != nil {
+		return nil, err
+	}
+
+	e := &route53.Provider{
+		MaxRetries:         0,
+		MaxWaitDur:         0,
+		WaitForPropagation: false,
+		Region:             config.GetString("IONSCALE_DNS_ROUTE53_REGION", ""),
+		AWSProfile:         config.GetString("IONSCALE_DNS_ROUTE53_AWS_PROFILE", ""),
+		AccessKeyId:        config.GetString("IONSCALE_DNS_ROUTE53_ACCESS_KEY_ID", ""),
+		SecretAccessKey:    config.GetString("IONSCALE_DNS_ROUTE53_SECRET_ACCESS_KEY", ""),
+		Token:              config.GetString("IONSCALE_DNS_ROUTE53_TOKEN", ""),
+	}
+
+	// merge env configuration on top of the default/file configuration
+	if err := mergo.Merge(p, e, mergo.WithOverride); err != nil {
+		return nil, err
+	}
+
+	return &externalProvider{zone: zone, setter: p}, nil
+}
+
+type externalProvider struct {
+	zone   string
+	setter libdns.RecordSetter
+}
+
+func (p *externalProvider) SetRecord(ctx context.Context, recordType, recordName, value string) error {
+	_, err := p.setter.SetRecords(ctx, fmt.Sprintf("%s.", p.zone), []libdns.Record{{
+		Type:  recordType,
+		Name:  strings.TrimSuffix(recordName, p.zone),
+		Value: value,
+		TTL:   1 * time.Minute,
+	}})
+	return err
+}
@@ -30,7 +30,8 @@ type ACLPolicy struct {
 	Hosts         map[string]string   `json:"hosts,omitempty"`
 	ACLs          []ACL               `json:"acls"`
 	TagOwners     map[string][]string `json:"tagowners"`
-	AutoApprovers AutoApprovers       `json:"autoApprovers"`
+	AutoApprovers *AutoApprovers      `json:"autoApprovers"`
+	SSHRules      []SSHRule           `json:"ssh"`
 }

 type ACL struct {
@@ -39,6 +40,13 @@ type ACL struct {
 	Dst    []string `json:"dst"`
 }

+type SSHRule struct {
+	Action string   `json:"action"`
+	Src    []string `json:"src"`
+	Dst    []string `json:"dst"`
+	Users  []string `json:"users"`
+}
+
 func DefaultPolicy() ACLPolicy {
 	return ACLPolicy{
 		ACLs: []ACL{
@@ -52,7 +60,7 @@ func DefaultPolicy() ACLPolicy {
 }

 func (a ACLPolicy) FindAutoApprovedIPs(routableIPs []netip.Prefix, tags []string, u *User) []netip.Prefix {
-	if len(routableIPs) == 0 {
+	if a.AutoApprovers == nil || len(routableIPs) == 0 {
 		return nil
 	}

@@ -116,17 +124,26 @@ func (a ACLPolicy) FindAutoApprovedIPs(routableIPs []netip.Prefix, tags []string
 	return result
 }

+func (a ACLPolicy) IsTagOwner(tags []string, p *User) bool {
+	for _, t := range tags {
+		if a.isTagOwner(t, p) {
+			return true
+		}
+	}
+	return false
+}
+
 func (a ACLPolicy) CheckTagOwners(tags []string, p *User) error {
 	var result *multierror.Error
 	for _, t := range tags {
-		if ok := a.IsTagOwner(t, p); !ok {
+		if ok := a.isTagOwner(t, p); !ok {
 			result = multierror.Append(result, fmt.Errorf("tag [%s] is invalid or not permitted", t))
 		}
 	}
 	return result.ErrorOrNil()
 }

-func (a ACLPolicy) IsTagOwner(tag string, p *User) bool {
+func (a ACLPolicy) isTagOwner(tag string, p *User) bool {
 	if p.UserType == UserTypeService {
 		return true
 	}
@@ -387,6 +404,25 @@ func (a ACLPolicy) expandValuePortToPortRange(s string) ([]tailcfg.PortRange, er
 	return ports, nil
 }

+func (a ACLPolicy) isGroupMember(group string, m *Machine) bool {
+	if m.HasTags() {
+		return false
+	}
+
+	users, ok := a.Groups[group]
+	if !ok {
+		return false
+	}
+
+	for _, u := range users {
+		if m.HasUser(u) {
+			return true
+		}
+	}
+
+	return false
+}
+
 func (i *ACLPolicy) Scan(destination interface{}) error {
 	switch value := destination.(type) {
 	case []byte:
@@ -0,0 +1,153 @@
+package domain
+
+import (
+	"strings"
+	"tailscale.com/tailcfg"
+)
+
+func (a ACLPolicy) BuildSSHPolicy(srcs []Machine, dst *Machine) *tailcfg.SSHPolicy {
+	var rules []*tailcfg.SSHRule
+
+	expandSrcAliases := func(aliases []string, action string, u *User) []*tailcfg.SSHPrincipal {
+		var allSrcIPsSet = &StringSet{}
+		for _, alias := range aliases {
+			if strings.HasPrefix(alias, "tag:") && action == "check" {
+				continue
+			}
+			for _, src := range srcs {
+				srcIPs := a.expandSSHSrcAlias(&src, alias, u)
+				allSrcIPsSet.Add(srcIPs...)
+			}
+		}
+
+		var result = []*tailcfg.SSHPrincipal{}
+		for _, i := range allSrcIPsSet.Items() {
+			result = append(result, &tailcfg.SSHPrincipal{NodeIP: i})
+		}
+
+		return result
+	}
+
+	for _, rule := range a.SSHRules {
+		if rule.Action != "accept" && rule.Action != "check" {
+			continue
+		}
+
+		var action = &tailcfg.SSHAction{
+			Accept:                   true,
+			AllowAgentForwarding:     true,
+			AllowLocalPortForwarding: true,
+		}
+
+		if rule.Action == "check" {
+			action = &tailcfg.SSHAction{
+				HoldAndDelegate: "https://unused/machine/ssh/action/$SRC_NODE_ID/to/$DST_NODE_ID",
+			}
+		}
+
+		selfUsers, otherUsers := a.expandSSHDstToSSHUsers(dst, rule)
+
+		if len(selfUsers) != 0 {
+			principals := expandSrcAliases(rule.Src, rule.Action, &dst.User)
+			if len(principals) != 0 {
+				rules = append(rules, &tailcfg.SSHRule{
+					Principals: principals,
+					SSHUsers:   selfUsers,
+					Action:     action,
+				})
+			}
+		}
+
+		if len(otherUsers) != 0 {
+			principals := expandSrcAliases(rule.Src, rule.Action, nil)
+			if len(principals) != 0 {
+				rules = append(rules, &tailcfg.SSHRule{
+					Principals: principals,
+					SSHUsers:   otherUsers,
+					Action:     action,
+				})
+			}
+		}
+	}
+
+	return &tailcfg.SSHPolicy{Rules: rules}
+}
+
+func (a ACLPolicy) expandSSHSrcAlias(m *Machine, alias string, dstUser *User) []string {
+	if dstUser != nil {
+		if !m.HasUser(dstUser.Name) || m.HasTags() {
+			return []string{}
+		}
+
+		if alias == AutoGroupMembers {
+			return m.IPs()
+		}
+
+		if strings.Contains(alias, "@") && m.HasUser(alias) {
+			return m.IPs()
+		}
+
+		if strings.HasPrefix(alias, "group:") && a.isGroupMember(alias, m) {
+			return m.IPs()
+		}
+
+		return []string{}
+	}
+
+	if alias == AutoGroupMembers && !m.HasTags() {
+		return m.IPs()
+	}
+
+	if strings.Contains(alias, "@") && !m.HasTags() && m.HasUser(alias) {
+		return m.IPs()
+	}
+
+	if strings.HasPrefix(alias, "group:") && !m.HasTags() && a.isGroupMember(alias, m) {
+		return m.IPs()
+	}
+
+	if strings.HasPrefix(alias, "tag:") && m.HasTag(alias) {
+		return m.IPs()
+	}
+
+	return []string{}
+}
+
+func (a ACLPolicy) expandSSHDstToSSHUsers(m *Machine, rule SSHRule) (map[string]string, map[string]string) {
+	users := buildSSHUsers(rule.Users)
+
+	var selfUsers map[string]string
+	var otherUsers map[string]string
+
+	for _, d := range rule.Dst {
+		if strings.HasPrefix(d, "tag:") && m.HasTag(d) {
+			otherUsers = users
+		}
+
+		if m.HasUser(d) || d == AutoGroupSelf {
+			selfUsers = users
+		}
+	}
+
+	return selfUsers, otherUsers
+}
+
+func buildSSHUsers(users []string) map[string]string {
+	var autogroupNonRoot = false
+	m := make(map[string]string)
+	for _, u := range users {
+		if u == "autogroup:nonroot" {
+			m["*"] = "="
+			autogroupNonRoot = true
+		} else {
+			m[u] = u
+		}
+	}
+
+	// disable root when autogroup:nonroot is used and root is not explicitly enabled
+	if _, exists := m["root"]; !exists && autogroupNonRoot {
+		m["root"] = ""
+	}
+
+	return m
+}
@@ -0,0 +1,386 @@
+package domain
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/stretchr/testify/assert"
+	"tailscale.com/tailcfg"
+	"testing"
+)
+
+func TestACLPolicy_BuildSSHPolicy_(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"autogroup:members"},
+				Dst:    []string{"autogroup:self"},
+				Users:  []string{"autogroup:nonroot"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: []*tailcfg.SSHPrincipal{
+				{NodeIP: p1.IPv4.String()},
+				{NodeIP: p1.IPv6.String()},
+			},
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithGroup(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		Groups: map[string][]string{
+			"group:sre": {
+				"john@example.com",
+			},
+		},
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"group:sre"},
+				Dst:    []string{"tag:web"},
+				Users:  []string{"autogroup:nonroot", "root"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: []*tailcfg.SSHPrincipal{
+				{NodeIP: p1.IPv4.String()},
+				{NodeIP: p1.IPv6.String()},
+			},
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "root",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithMatchingUsers(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"john@example.com"},
+				Dst:    []string{"john@example.com"},
+				Users:  []string{"autogroup:nonroot", "root"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1),
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "root",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithMatchingUsersInGroup(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		Groups: map[string][]string{
+			"group:sre": {"jane@example.com", "john@example.com"},
+		},
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"group:sre"},
+				Dst:    []string{"john@example.com"},
+				Users:  []string{"autogroup:nonroot", "root"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1),
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "root",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithNoMatchingUsers(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"jane@example.com"},
+				Dst:    []string{"john@example.com"},
+				Users:  []string{"autogroup:nonroot", "root"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithTags(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("nick@example.com")
+	p3 := createMachine("nick@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"john@example.com", "tag:web"},
+				Dst:    []string{"tag:web"},
+				Users:  []string{"ubuntu"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2, *p3}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1, *p3),
+			SSHUsers: map[string]string{
+				"ubuntu": "ubuntu",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithTagsInDstAndAutogroupMemberInSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("nick@example.com")
+	p3 := createMachine("nick@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"autogroup:members"},
+				Dst:    []string{"tag:web"},
+				Users:  []string{"ubuntu"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2, *p3}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1, *p2),
+			SSHUsers: map[string]string{
+				"ubuntu": "ubuntu",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithUserInDstAndNonMatchingSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"jane@example.com"},
+				Dst:    []string{"john@example.com"},
+				Users:  []string{"autogroup:nonroot"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithUserInDstAndAutogroupMembersSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"autogroup:members"},
+				Dst:    []string{"john@example.com"},
+				Users:  []string{"autogroup:nonroot"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+	expectedRules := []*tailcfg.SSHRule{
+		{
+			Principals: sshPrincipalsFromMachines(*p1),
+			SSHUsers: map[string]string{
+				"*":    "=",
+				"root": "",
+			},
+			Action: &tailcfg.SSHAction{
+				Accept:                   true,
+				AllowAgentForwarding:     true,
+				AllowLocalPortForwarding: true,
+			},
+		},
+	}
+
+	assert.Equal(t, expectedRules, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithAutogroupSelfAndTagSrc(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "accept",
+				Src:    []string{"tag:web"},
+				Dst:    []string{"autogroup:self"},
+				Users:  []string{"autogroup:nonroot"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func TestACLPolicy_BuildSSHPolicy_WithTagsAndActionCheck(t *testing.T) {
+	p1 := createMachine("john@example.com")
+	p2 := createMachine("jane@example.com", "tag:web")
+
+	policy := ACLPolicy{
+		SSHRules: []SSHRule{
+			{
+				Action: "check",
+				Src:    []string{"tag:web"},
+				Dst:    []string{"tag:web"},
+				Users:  []string{"autogroup:nonroot"},
+			},
+		},
+	}
+
+	dst := createMachine("john@example.com", "tag:web")
+
+	actualRules := policy.BuildSSHPolicy([]Machine{*p1, *p2}, dst)
+
+	assert.Nil(t, actualRules.Rules)
+}
+
+func printRules(rules []*tailcfg.SSHRule) {
+	indent, err := json.MarshalIndent(rules, "", "  ")
+	if err != nil {
+		panic(err)
+	}
+	fmt.Println(string(indent))
+}
+
+func sshPrincipalsFromMachines(machines ...Machine) []*tailcfg.SSHPrincipal {
+	x := StringSet{}
+	for _, m := range machines {
+		x.Add(m.IPv4.String(), m.IPv6.String())
+	}
+
+	var result = []*tailcfg.SSHPrincipal{}
+
+	for _, i := range x.Items() {
+		result = append(result, &tailcfg.SSHPrincipal{NodeIP: i})
+	}
+
+	return result
+}
@@ -1,8 +1,6 @@
 package domain

 import (
-	"encoding/json"
-	"fmt"
 	"github.com/jsiebens/ionscale/internal/addr"
 	"github.com/stretchr/testify/assert"
 	"net/netip"
@@ -11,14 +9,6 @@ import (
 	"testing"
 )

-func printRules(rules []tailcfg.FilterRule) {
-	indent, err := json.MarshalIndent(rules, "", "  ")
-	if err != nil {
-		panic(err)
-	}
-	fmt.Println(string(indent))
-}
-
 func TestACLPolicy_BuildFilterRulesWildcards(t *testing.T) {
 	p1 := createMachine("john@example.com")
 	p2 := createMachine("jane@example.com")
@@ -560,6 +550,15 @@ func TestACLPolicy_IsTagOwner(t *testing.T) {
 	}
 }

+func TestACLPolicy_FindAutoApprovedIPsWhenNoAutoapproversAreSet(t *testing.T) {
+	route1 := netip.MustParsePrefix("10.160.0.0/20")
+	route2 := netip.MustParsePrefix("10.161.0.0/20")
+	route3 := netip.MustParsePrefix("10.162.0.0/20")
+
+	policy := ACLPolicy{}
+	assert.Nil(t, policy.FindAutoApprovedIPs([]netip.Prefix{route1, route2, route3}, nil, nil))
+}
+
 func TestACLPolicy_FindAutoApprovedIPs(t *testing.T) {
 	route1 := netip.MustParsePrefix("10.160.0.0/20")
 	route2 := netip.MustParsePrefix("10.161.0.0/20")
@@ -569,7 +568,7 @@ func TestACLPolicy_FindAutoApprovedIPs(t *testing.T) {
 		Groups: map[string][]string{
 			"group:admins": {"jane@example.com"},
 		},
-		AutoApprovers: AutoApprovers{
+		AutoApprovers: &AutoApprovers{
 			Routes: map[string][]string{
 				route1.String(): {"group:admins"},
 				route2.String(): {"john@example.com", "tag:router"},
@@ -79,7 +79,7 @@ func (r *repository) LoadApiKey(ctx context.Context, key string) (*ApiKey, error
 		return nil, nil
 	}

-	if !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
+	if m.ExpiresAt != nil && !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
 		return nil, nil
 	}

@@ -11,7 +11,7 @@ import (
 	"time"
 )

-func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expiresAt *time.Time) (string, *AuthKey) {
+func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, preAuthorized bool, tags Tags, expiresAt *time.Time) (string, *AuthKey) {
 	key := util.RandStringBytes(12)
 	pwd := util.RandStringBytes(22)
 	value := fmt.Sprintf("%s_%s", key, pwd)
@@ -22,13 +22,14 @@ func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expi
 	}

 	return value, &AuthKey{
-		ID:        util.NextID(),
-		Key:       key,
-		Hash:      string(hash),
-		Ephemeral: ephemeral,
-		Tags:      tags,
-		CreatedAt: time.Now().UTC(),
-		ExpiresAt: expiresAt,
+		ID:            util.NextID(),
+		Key:           key,
+		Hash:          string(hash),
+		Ephemeral:     ephemeral,
+		PreAuthorized: preAuthorized,
+		Tags:          tags,
+		CreatedAt:     time.Now().UTC(),
+		ExpiresAt:     expiresAt,

 		TailnetID: tailnet.ID,
 		UserID:    user.ID,
@@ -36,11 +37,12 @@ func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expi
 }

 type AuthKey struct {
-	ID        uint64 `gorm:"primary_key"`
-	Key       string
-	Hash      string
-	Ephemeral bool
-	Tags      Tags
+	ID            uint64 `gorm:"primary_key"`
+	Key           string
+	Hash          string
+	Ephemeral     bool
+	PreAuthorized bool
+	Tags          Tags

 	CreatedAt time.Time
 	ExpiresAt *time.Time
@@ -148,7 +150,7 @@ func (r *repository) LoadAuthKey(ctx context.Context, key string) (*AuthKey, err
 		return nil, nil
 	}

-	if !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
+	if m.ExpiresAt != nil && !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
 		return nil, nil
 	}

@@ -0,0 +1,48 @@
+package domain
+
+import (
+	"context"
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+	"tailscale.com/tailcfg"
+)
+
+type DERPMap struct {
+	Checksum string
+	DERPMap  tailcfg.DERPMap
+}
+
+func (hi *DERPMap) Scan(destination interface{}) error {
+	switch value := destination.(type) {
+	case []byte:
+		return json.Unmarshal(value, hi)
+	default:
+		return fmt.Errorf("unexpected data type %T", destination)
+	}
+}
+
+func (hi DERPMap) Value() (driver.Value, error) {
+	bytes, err := json.Marshal(hi)
+	return bytes, err
+}
+
+// GormDataType gorm common data type
+func (DERPMap) GormDataType() string {
+	return "json"
+}
+
+// GormDBDataType gorm db data type
+func (DERPMap) GormDBDataType(db *gorm.DB, field *schema.Field) string {
+	switch db.Dialector.Name() {
+	case "sqlite":
+		return "JSON"
+	}
+	return ""
+}
+
+type DefaultDERPMap interface {
+	GetDERPMap(ctx context.Context) (*DERPMap, error)
+}
@@ -9,10 +9,11 @@ import (
 )

 type DNSConfig struct {
-	MagicDNS         bool                `json:"magic_dns"`
-	OverrideLocalDNS bool                `json:"override_local_dns"`
-	Nameservers      []string            `json:"nameservers"`
-	Routes           map[string][]string `json:"routes"`
+	HttpsCertsEnabled bool                `json:"http_certs"`
+	MagicDNS          bool                `json:"magic_dns"`
+	OverrideLocalDNS  bool                `json:"override_local_dns"`
+	Nameservers       []string            `json:"nameservers"`
+	Routes            map[string][]string `json:"routes"`
 }

 func (i *DNSConfig) Scan(destination interface{}) error {
@@ -24,6 +24,7 @@ type Machine struct {
 	RegisteredTags    Tags
 	Tags              Tags
 	KeyExpiryDisabled bool
+	Authorized        bool

 	HostInfo     HostInfo
 	Endpoints    Endpoints
@@ -46,6 +47,13 @@ type Machine struct {

 type Machines []Machine

+func (m *Machine) CompleteName() string {
+	if m.NameIdx != 0 {
+		return fmt.Sprintf("%s-%d", m.Name, m.NameIdx)
+	}
+	return m.Name
+}
+
 func (m *Machine) IPs() []string {
 	return []string{m.IPv4.String(), m.IPv6.String()}
 }
@@ -19,6 +19,7 @@ type RegistrationRequest struct {
 	CreatedAt     time.Time
 	Authenticated bool
 	Error         string
+	UserID        uint64
 }

 func (r *RegistrationRequest) IsFinished() bool {
@@ -3,6 +3,7 @@ package domain
 import (
 	"context"
 	"encoding/json"
+	"github.com/jsiebens/ionscale/internal/util"
 	"gorm.io/gorm"
 	"net/http"
 	"sync"
@@ -14,8 +15,11 @@ type Repository interface {
 	GetControlKeys(ctx context.Context) (*ControlKeys, error)
 	SetControlKeys(ctx context.Context, keys *ControlKeys) error

-	GetDERPMap(ctx context.Context) (*tailcfg.DERPMap, error)
-	SetDERPMap(ctx context.Context, v *tailcfg.DERPMap) error
+	GetJSONWebKeySet(ctx context.Context) (*JSONWebKeys, error)
+	SetJSONWebKeySet(ctx context.Context, keys *JSONWebKeys) error
+
+	GetDERPMap(ctx context.Context) (*DERPMap, error)
+	SetDERPMap(ctx context.Context, v *DERPMap) error

 	GetAccount(ctx context.Context, accountID uint64) (*Account, error)
 	GetOrCreateAccount(ctx context.Context, externalID, loginName string) (*Account, bool, error)
@@ -23,6 +27,7 @@ type Repository interface {
 	SaveTailnet(ctx context.Context, tailnet *Tailnet) error
 	GetOrCreateTailnet(ctx context.Context, name string, iamPolicy IAMPolicy) (*Tailnet, bool, error)
 	GetTailnet(ctx context.Context, id uint64) (*Tailnet, error)
+	GetTailnetByAlias(ctx context.Context, alias string) (*Tailnet, error)
 	ListTailnets(ctx context.Context) ([]Tailnet, error)
 	DeleteTailnet(ctx context.Context, id uint64) error

@@ -73,6 +78,10 @@ type Repository interface {
 	GetAuthenticationRequest(ctx context.Context, key string) (*AuthenticationRequest, error)
 	DeleteAuthenticationRequest(ctx context.Context, key string) error

+	SaveSSHActionRequest(ctx context.Context, session *SSHActionRequest) error
+	GetSSHActionRequest(ctx context.Context, key string) (*SSHActionRequest, error)
+	DeleteSSHActionRequest(ctx context.Context, key string) error
+
 	Transaction(func(rp Repository) error) error
 }

@@ -100,10 +109,10 @@ func (r *repository) Transaction(action func(Repository) error) error {

 type derpMapCache struct {
 	sync.RWMutex
-	value *tailcfg.DERPMap
+	value *DERPMap
 }

-func (d *derpMapCache) Get() (*tailcfg.DERPMap, error) {
+func (d *derpMapCache) Get() (*DERPMap, error) {
 	d.RLock()

 	if d.value != nil {
@@ -131,7 +140,10 @@ func (d *derpMapCache) Get() (*tailcfg.DERPMap, error) {
 		return nil, err
 	}

-	d.value = m
+	d.value = &DERPMap{
+		Checksum: util.Checksum(m),
+		DERPMap:  *m,
+	}

 	return d.value, nil
 }
@@ -2,11 +2,13 @@ package domain

 import (
 	"context"
+	"crypto"
+	"crypto/rsa"
 	"encoding/json"
 	"errors"
 	"gorm.io/gorm"
-	"tailscale.com/tailcfg"
 	tkey "tailscale.com/types/key"
+	"time"
 )

 type configKey string
@@ -14,8 +16,23 @@ type configKey string
 const (
 	derpMapConfigKey     configKey = "derp_map"
 	controlKeysConfigKey configKey = "control_keys"
+	jwksConfigKey        configKey = "jwks"
 )

+type JSONWebKeys struct {
+	Key JSONWebKey
+}
+
+type JSONWebKey struct {
+	Id         string
+	PrivateKey rsa.PrivateKey
+	CreatedAt  time.Time
+}
+
+func (j JSONWebKey) Public() crypto.PublicKey {
+	return j.PrivateKey.Public()
+}
+
 type ServerConfig struct {
 	Key   configKey `gorm:"primary_key"`
 	Value []byte
@@ -45,8 +62,27 @@ func (r *repository) SetControlKeys(ctx context.Context, v *ControlKeys) error {
 	return r.setServerConfig(ctx, controlKeysConfigKey, v)
 }

-func (r *repository) GetDERPMap(ctx context.Context) (*tailcfg.DERPMap, error) {
-	var m tailcfg.DERPMap
+func (r *repository) GetJSONWebKeySet(ctx context.Context) (*JSONWebKeys, error) {
+	var m JSONWebKeys
+	err := r.getServerConfig(ctx, jwksConfigKey, &m)
+
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &m, nil
+}
+
+func (r *repository) SetJSONWebKeySet(ctx context.Context, v *JSONWebKeys) error {
+	return r.setServerConfig(ctx, jwksConfigKey, v)
+}
+
+func (r *repository) GetDERPMap(ctx context.Context) (*DERPMap, error) {
+	var m DERPMap

 	err := r.getServerConfig(ctx, derpMapConfigKey, &m)

@@ -54,6 +90,10 @@ func (r *repository) GetDERPMap(ctx context.Context) (*tailcfg.DERPMap, error) {
 		return r.defaultDERPMap.Get()
 	}

+	if m.Checksum == "" {
+		return r.defaultDERPMap.Get()
+	}
+
 	if err != nil {
 		return nil, err
 	}
@@ -61,7 +101,7 @@ func (r *repository) GetDERPMap(ctx context.Context) (*tailcfg.DERPMap, error) {
 	return &m, nil
 }

-func (r *repository) SetDERPMap(ctx context.Context, v *tailcfg.DERPMap) error {
+func (r *repository) SetDERPMap(ctx context.Context, v *DERPMap) error {
 	return r.setServerConfig(ctx, "derp_map", v)
 }

@@ -0,0 +1,46 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"gorm.io/gorm"
+	"time"
+)
+
+type SSHActionRequest struct {
+	Key          string `gorm:"primary_key"`
+	Action       string
+	SrcMachineID uint64
+	DstMachineID uint64
+	CreatedAt    time.Time
+}
+
+func (r *repository) SaveSSHActionRequest(ctx context.Context, session *SSHActionRequest) error {
+	tx := r.withContext(ctx).Save(session)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}
+
+func (r *repository) GetSSHActionRequest(ctx context.Context, key string) (*SSHActionRequest, error) {
+	var m SSHActionRequest
+	tx := r.withContext(ctx).First(&m, "key = ?", key)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &m, nil
+}
+
+func (r *repository) DeleteSSHActionRequest(ctx context.Context, key string) error {
+	tx := r.withContext(ctx).Delete(&SSHActionRequest{Key: key})
+	return tx.Error
+}
@@ -11,11 +11,24 @@ import (
 )

 type Tailnet struct {
-	ID        uint64 `gorm:"primary_key"`
-	Name      string
-	DNSConfig DNSConfig
-	IAMPolicy IAMPolicy
-	ACLPolicy ACLPolicy
+	ID                          uint64 `gorm:"primary_key"`
+	Name                        string
+	DNSConfig                   DNSConfig
+	IAMPolicy                   IAMPolicy
+	ACLPolicy                   ACLPolicy
+	DERPMap                     DERPMap
+	ServiceCollectionEnabled    bool
+	FileSharingEnabled          bool
+	SSHEnabled                  bool
+	MachineAuthorizationEnabled bool
+}
+
+func (t Tailnet) GetDERPMap(ctx context.Context, fallack DefaultDERPMap) (*DERPMap, error) {
+	if t.DERPMap.Checksum == "" {
+		return fallack.GetDERPMap(ctx)
+	} else {
+		return &t.DERPMap, nil
+	}
 }

 func SanitizeTailnetName(name string) string {
@@ -76,6 +89,21 @@ func (r *repository) GetTailnet(ctx context.Context, id uint64) (*Tailnet, error
 	return &t, nil
 }

+func (r *repository) GetTailnetByAlias(ctx context.Context, alias string) (*Tailnet, error) {
+	var t Tailnet
+	tx := r.withContext(ctx).Take(&t, "alias = ?", alias)
+
+	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return &t, nil
+}
+
 func (r *repository) ListTailnets(ctx context.Context) ([]Tailnet, error) {
 	var tailnets = []Tailnet{}
 	tx := r.withContext(ctx).Find(&tailnets)
@@ -100,7 +100,7 @@ func (r *repository) GetOrCreateUserWithAccount(ctx context.Context, tailnet *Ta

 func (r *repository) GetUser(ctx context.Context, userID uint64) (*User, error) {
 	var m User
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("Account").First(&m, "id = ? and user_type = ?", userID, UserTypePerson)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("Account").First(&m, "id = ?", userID)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -0,0 +1,42 @@
+package errors
+
+import (
+	"fmt"
+	"runtime"
+)
+
+type Error struct {
+	Cause    error
+	Location string
+}
+
+func Wrap(err error, skip int) error {
+	if err == nil {
+		return nil
+	}
+
+	c := &Error{
+		Cause:    err,
+		Location: getLocation(skip),
+	}
+
+	return c
+}
+
+func (w *Error) Error() string {
+	return w.Cause.Error()
+}
+
+func (f *Error) Unwrap() error {
+	return f.Cause
+}
+
+func (f *Error) Format(s fmt.State, verb rune) {
+	fmt.Fprintf(s, "%s\n", f.Cause.Error())
+	fmt.Fprintf(s, "\t%s\n", f.Location)
+}
+
+func getLocation(skip int) string {
+	_, file, line, _ := runtime.Caller(2 + skip)
+	return fmt.Sprintf("%s:%d", file, line)
+}
@@ -3,8 +3,10 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"github.com/jsiebens/ionscale/internal/addr"
-	"github.com/jsiebens/ionscale/internal/provider"
+	"github.com/jsiebens/ionscale/internal/auth"
+	"github.com/jsiebens/ionscale/internal/errors"
 	"github.com/labstack/echo/v4/middleware"
 	"github.com/mr-tron/base58"
 	"net/http"
@@ -20,7 +22,7 @@ import (

 func NewAuthenticationHandlers(
 	config *config.Config,
-	authProvider provider.AuthProvider,
+	authProvider auth.Provider,
 	systemIAMPolicy *domain.IAMPolicy,
 	repository domain.Repository) *AuthenticationHandlers {

@@ -34,7 +36,7 @@ func NewAuthenticationHandlers(

 type AuthenticationHandlers struct {
 	repository      domain.Repository
-	authProvider    provider.AuthProvider
+	authProvider    auth.Provider
 	config          *config.Config
 	systemIAMPolicy *domain.IAMPolicy
 }
@@ -56,21 +58,42 @@ type oauthState struct {
 	Flow string
 }

-func (h *AuthenticationHandlers) StartCliAuth(c echo.Context) error {
+func (h *AuthenticationHandlers) StartAuth(c echo.Context) error {
 	ctx := c.Request().Context()
+	flow := c.Param("flow")
 	key := c.Param("key")

-	if s, err := h.repository.GetAuthenticationRequest(ctx, key); err != nil || s == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+	// machine registration auth flow
+	if flow == "r" || flow == "" {
+		if req, err := h.repository.GetRegistrationRequestByKey(ctx, key); err != nil || req == nil {
+			return errors.Wrap(err, 0)
+		}
+
+		csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
+		return c.Render(http.StatusOK, "auth.html", &AuthFormData{ProviderAvailable: h.authProvider != nil, Csrf: csrf})
+	}
+
+	// cli auth flow
+	if flow == "c" {
+		if s, err := h.repository.GetAuthenticationRequest(ctx, key); err != nil || s == nil {
+			return errors.Wrap(err, 0)
+		}
+	}
+
+	// ssh check auth flow
+	if flow == "s" {
+		if s, err := h.repository.GetSSHActionRequest(ctx, key); err != nil || s == nil {
+			return errors.Wrap(err, 0)
+		}
 	}

 	if h.authProvider == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return errors.Wrap(fmt.Errorf("unable to start auth flow as no auth provider is configured"), 0)
 	}

-	state, err := h.createState("c", key)
+	state, err := h.createState(flow, key)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	redirectUrl := h.authProvider.GetLoginURL(h.config.CreateUrl("/a/callback"), state)
@@ -78,18 +101,6 @@ func (h *AuthenticationHandlers) StartCliAuth(c echo.Context) error {
 	return c.Redirect(http.StatusFound, redirectUrl)
 }

-func (h *AuthenticationHandlers) StartAuth(c echo.Context) error {
-	ctx := c.Request().Context()
-	key := c.Param("key")
-
-	if req, err := h.repository.GetRegistrationRequestByKey(ctx, key); err != nil || req == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
-	}
-
-	csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
-	return c.Render(http.StatusOK, "auth.html", &AuthFormData{ProviderAvailable: h.authProvider != nil, Csrf: csrf})
-}
-
 func (h *AuthenticationHandlers) ProcessAuth(c echo.Context) error {
 	ctx := c.Request().Context()

@@ -99,7 +110,7 @@ func (h *AuthenticationHandlers) ProcessAuth(c echo.Context) error {

 	req, err := h.repository.GetRegistrationRequestByKey(ctx, key)
 	if err != nil || req == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return errors.Wrap(err, 0)
 	}

 	if authKey != "" {
@@ -109,7 +120,7 @@ func (h *AuthenticationHandlers) ProcessAuth(c echo.Context) error {
 	if interactive != "" {
 		state, err := h.createState("r", key)
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}

 		redirectUrl := h.authProvider.GetLoginURL(h.config.CreateUrl("/a/callback"), state)
@@ -126,22 +137,48 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {
 	code := c.QueryParam("code")
 	state, err := h.readState(c.QueryParam("state"))
 	if err != nil {
-		return err
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid state parameter")
 	}

 	user, err := h.exchangeUser(code)
 	if err != nil {
-		return err
-	}
-
-	tailnets, err := h.listAvailableTailnets(ctx, user)
-	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	account, _, err := h.repository.GetOrCreateAccount(ctx, user.ID, user.Name)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
+	}
+
+	if state.Flow == "s" {
+		sshActionReq, err := h.repository.GetSSHActionRequest(ctx, state.Key)
+		if err != nil || sshActionReq == nil {
+			return c.Redirect(http.StatusFound, "/a/error?e=ua")
+		}
+
+		machine, err := h.repository.GetMachine(ctx, sshActionReq.SrcMachineID)
+		if err != nil || sshActionReq == nil {
+			return errors.Wrap(err, 0)
+		}
+
+		if !machine.HasTags() && machine.User.AccountID != nil && *machine.User.AccountID == account.ID {
+			sshActionReq.Action = "accept"
+			if err := h.repository.SaveSSHActionRequest(ctx, sshActionReq); err != nil {
+				return errors.Wrap(err, 0)
+			}
+			return c.Redirect(http.StatusFound, "/a/success")
+		}
+
+		sshActionReq.Action = "reject"
+		if err := h.repository.SaveSSHActionRequest(ctx, sshActionReq); err != nil {
+			return errors.Wrap(err, 0)
+		}
+		return c.Redirect(http.StatusFound, "/a/error?e=nmo")
+	}
+
+	tailnets, err := h.listAvailableTailnets(ctx, user)
+	if err != nil {
+		return errors.Wrap(err, 0)
 	}

 	csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
@@ -166,7 +203,7 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {
 	if state.Flow == "c" {
 		isSystemAdmin, err := h.isSystemAdmin(ctx, user)
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}

 		if !isSystemAdmin && len(tailnets) == 0 {
@@ -185,14 +222,14 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {
 		})
 	}

-	return c.Redirect(http.StatusFound, "/a/error")
+	return echo.NewHTTPError(http.StatusNotFound)
 }

-func (h *AuthenticationHandlers) isSystemAdmin(ctx context.Context, u *provider.User) (bool, error) {
+func (h *AuthenticationHandlers) isSystemAdmin(ctx context.Context, u *auth.User) (bool, error) {
 	return h.systemIAMPolicy.EvaluatePolicy(&domain.Identity{UserID: u.ID, Email: u.Name, Attr: u.Attr})
 }

-func (h *AuthenticationHandlers) listAvailableTailnets(ctx context.Context, u *provider.User) ([]domain.Tailnet, error) {
+func (h *AuthenticationHandlers) listAvailableTailnets(ctx context.Context, u *auth.User) ([]domain.Tailnet, error) {
 	var result = []domain.Tailnet{}
 	tailnets, err := h.repository.ListTailnets(ctx)
 	if err != nil {
@@ -215,13 +252,13 @@ func (h *AuthenticationHandlers) EndOAuth(c echo.Context) error {

 	state, err := h.readState(c.QueryParam("state"))
 	if err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid state parameter")
 	}

 	if state.Flow == "r" {
 		req, err := h.repository.GetRegistrationRequestByKey(ctx, state.Key)
 		if err != nil || req == nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return errors.Wrap(err, 0)
 		}

 		return h.endMachineRegistrationFlow(c, req, state)
@@ -229,13 +266,18 @@ func (h *AuthenticationHandlers) EndOAuth(c echo.Context) error {

 	req, err := h.repository.GetAuthenticationRequest(ctx, state.Key)
 	if err != nil || req == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return errors.Wrap(err, 0)
 	}

 	return h.endCliAuthenticationFlow(c, req, state)
 }

 func (h *AuthenticationHandlers) Success(c echo.Context) error {
+	s := c.QueryParam("s")
+	switch s {
+	case "nma":
+		return c.Render(http.StatusOK, "newmachine.html", nil)
+	}
 	return c.Render(http.StatusOK, "success.html", nil)
 }

@@ -248,6 +290,8 @@ func (h *AuthenticationHandlers) Error(c echo.Context) error {
 		return c.Render(http.StatusForbidden, "unauthorized.html", nil)
 	case "nto":
 		return c.Render(http.StatusForbidden, "notagowner.html", nil)
+	case "nmo":
+		return c.Render(http.StatusForbidden, "notmachineowner.html", nil)
 	}
 	return c.Render(http.StatusOK, "error.html", nil)
 }
@@ -264,12 +308,12 @@ func (h *AuthenticationHandlers) endCliAuthenticationFlow(c echo.Context, req *d

 	var form TailnetSelectionForm
 	if err := c.Bind(&form); err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return errors.Wrap(err, 0)
 	}

 	account, err := h.repository.GetAccount(ctx, form.AccountID)
 	if err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return errors.Wrap(err, 0)
 	}

 	// continue as system admin?
@@ -280,27 +324,27 @@ func (h *AuthenticationHandlers) endCliAuthenticationFlow(c echo.Context, req *d

 		err := h.repository.Transaction(func(rp domain.Repository) error {
 			if err := rp.SaveSystemApiKey(ctx, apiKey); err != nil {
-				return err
+				return errors.Wrap(err, 0)
 			}
 			if err := rp.SaveAuthenticationRequest(ctx, req); err != nil {
-				return err
+				return errors.Wrap(err, 0)
 			}
 			return nil
 		})
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}
 		return c.Redirect(http.StatusFound, "/a/success")
 	}

 	tailnet, err := h.repository.GetTailnet(ctx, form.TailnetID)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	user, _, err := h.repository.GetOrCreateUserWithAccount(ctx, tailnet, account)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	expiresAt := time.Now().Add(24 * time.Hour)
@@ -318,7 +362,7 @@ func (h *AuthenticationHandlers) endCliAuthenticationFlow(c echo.Context, req *d
 		return nil
 	})
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	return c.Redirect(http.StatusFound, "/a/success")
@@ -329,7 +373,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi

 	var form TailnetSelectionForm
 	if err := c.Bind(&form); err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return errors.Wrap(err, 0)
 	}

 	req := tailcfg.RegisterRequest(registrationRequest.Data)
@@ -340,11 +384,12 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 	var user *domain.User
 	var ephemeral bool
 	var tags = []string{}
+	var authorized = false

 	if form.AuthKey != "" {
 		authKey, err := h.repository.LoadAuthKey(ctx, form.AuthKey)
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}

 		if authKey == nil {
@@ -353,7 +398,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 			registrationRequest.Error = "invalid auth key"

 			if err := h.repository.SaveRegistrationRequest(ctx, registrationRequest); err != nil {
-				return c.Redirect(http.StatusFound, "/a/error")
+				return errors.Wrap(err, 0)
 			}

 			return c.Redirect(http.StatusFound, "/a/error?e=iak")
@@ -363,20 +408,21 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		user = &authKey.User
 		tags = authKey.Tags
 		ephemeral = authKey.Ephemeral
+		authorized = authKey.PreAuthorized
 	} else {
 		selectedTailnet, err := h.repository.GetTailnet(ctx, form.TailnetID)
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}

 		account, err := h.repository.GetAccount(ctx, form.AccountID)
 		if err != nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return errors.Wrap(err, 0)
 		}

 		selectedUser, _, err := h.repository.GetOrCreateUserWithAccount(ctx, selectedTailnet, account)
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}

 		user = selectedUser
@@ -388,7 +434,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		registrationRequest.Authenticated = false
 		registrationRequest.Error = err.Error()
 		if err := h.repository.SaveRegistrationRequest(ctx, registrationRequest); err != nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return errors.Wrap(err, 0)
 		}
 		return c.Redirect(http.StatusFound, "/a/error?e=nto")
 	}
@@ -399,7 +445,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi

 	m, err := h.repository.GetMachineByKey(ctx, tailnet.ID, machineKey)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	now := time.Now().UTC()
@@ -412,7 +458,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		sanitizeHostname := dnsname.SanitizeHostname(req.Hostinfo.Hostname)
 		nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}

 		m = &domain.Machine{
@@ -428,6 +474,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 			CreatedAt:         now,
 			ExpiresAt:         now.Add(180 * 24 * time.Hour).UTC(),
 			KeyExpiryDisabled: len(tags) != 0,
+			Authorized:        !tailnet.MachineAuthorizationEnabled || authorized,

 			User:    *user,
 			Tailnet: *tailnet,
@@ -435,7 +482,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi

 		ipv4, ipv6, err := addr.SelectIP(checkIP(ctx, h.repository.CountMachinesWithIPv4))
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}
 		m.IPv4 = domain.IP{Addr: ipv4}
 		m.IPv6 = domain.IP{Addr: ipv6}
@@ -448,7 +495,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		if m.Name != sanitizeHostname {
 			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 			if err != nil {
-				return err
+				return errors.Wrap(err, 0)
 			}
 			m.Name = sanitizeHostname
 			m.NameIdx = nameIdx
@@ -468,6 +515,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 	err = h.repository.Transaction(func(rp domain.Repository) error {
 		registrationRequest.Authenticated = true
 		registrationRequest.Error = ""
+		registrationRequest.UserID = user.ID

 		if err := rp.SaveMachine(ctx, m); err != nil {
 			return err
@@ -481,13 +529,17 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 	})

 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

-	return c.Redirect(http.StatusFound, "/a/success")
+	if m.Authorized {
+		return c.Redirect(http.StatusFound, "/a/success")
+	} else {
+		return c.Redirect(http.StatusFound, "/a/success?s=nma")
+	}
 }

-func (h *AuthenticationHandlers) exchangeUser(code string) (*provider.User, error) {
+func (h *AuthenticationHandlers) exchangeUser(code string) (*auth.User, error) {
 	redirectUrl := h.config.CreateUrl("/a/callback")

 	user, err := h.authProvider.Exchange(redirectUrl, code)
@@ -0,0 +1,74 @@
+package handlers
+
+import (
+	"github.com/jsiebens/ionscale/internal/bind"
+	"github.com/jsiebens/ionscale/internal/dns"
+	"github.com/jsiebens/ionscale/internal/errors"
+	"github.com/labstack/echo/v4"
+	"net"
+	"net/http"
+	"strings"
+	"tailscale.com/tailcfg"
+	"time"
+)
+
+func NewDNSHandlers(createBinder bind.Factory, provider dns.Provider) *DNSHandlers {
+	return &DNSHandlers{
+		createBinder: createBinder,
+		provider:     provider,
+	}
+}
+
+type DNSHandlers struct {
+	createBinder bind.Factory
+	provider     dns.Provider
+}
+
+func (h *DNSHandlers) SetDNS(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	binder, err := h.createBinder(c)
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	req := &tailcfg.SetDNSRequest{}
+	if err := binder.BindRequest(c, req); err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	if h.provider == nil {
+		return echo.NewHTTPError(http.StatusNotFound)
+	}
+
+	if err := h.provider.SetRecord(ctx, req.Type, req.Name, req.Value); err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	if strings.HasPrefix(req.Name, "_acme-challenge") && req.Type == "TXT" {
+		// Listen to connection close
+		notify := ctx.Done()
+		timeout := time.After(5 * time.Minute)
+		tick := time.NewTicker(5 * time.Second)
+
+		defer func() { tick.Stop() }()
+
+		for {
+			select {
+			case <-tick.C:
+				txtrecords, _ := net.LookupTXT(req.Name)
+				for _, txt := range txtrecords {
+					if txt == req.Value {
+						return binder.WriteResponse(c, http.StatusOK, tailcfg.SetDNSResponse{})
+					}
+				}
+			case <-timeout:
+				return binder.WriteResponse(c, http.StatusOK, tailcfg.SetDNSResponse{})
+			case <-notify:
+				return nil
+			}
+		}
+	}
+
+	return binder.WriteResponse(c, http.StatusOK, tailcfg.SetDNSResponse{})
+}
@@ -0,0 +1,149 @@
+package handlers
+
+import (
+	"fmt"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/jsiebens/ionscale/internal/bind"
+	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
+	"github.com/jsiebens/ionscale/internal/util"
+	"github.com/labstack/echo/v4"
+	"gopkg.in/square/go-jose.v2"
+	"net/http"
+	"tailscale.com/tailcfg"
+	"time"
+)
+
+func NewIDTokenHandlers(createBinder bind.Factory, config *config.Config, repository domain.Repository) *IDTokenHandlers {
+	return &IDTokenHandlers{
+		issuer:       config.ServerUrl,
+		jwksUri:      config.CreateUrl("/.well-known/jwks"),
+		createBinder: createBinder,
+		repository:   repository,
+	}
+}
+
+type IDTokenHandlers struct {
+	issuer       string
+	jwksUri      string
+	createBinder bind.Factory
+	repository   domain.Repository
+}
+
+func (h *IDTokenHandlers) OpenIDConfig(c echo.Context) error {
+	v := map[string]interface{}{}
+
+	v["issuer"] = h.issuer
+	v["jwks_uri"] = h.jwksUri
+	v["subject_types_supported"] = []string{"public"}
+	v["response_types_supported"] = []string{"id_token"}
+	v["scopes_supported"] = []string{"openid"}
+	v["id_token_signing_alg_values_supported"] = []string{"RS256"}
+	v["claims_supported"] = []string{
+		"sub",
+		"aud",
+		"exp",
+		"iat",
+		"iss",
+		"jti",
+		"nbf",
+	}
+
+	return c.JSON(http.StatusOK, v)
+}
+
+func (h *IDTokenHandlers) Jwks(c echo.Context) error {
+	keySet, err := h.repository.GetJSONWebKeySet(c.Request().Context())
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	pub := jose.JSONWebKey{Key: keySet.Key.Public(), KeyID: keySet.Key.Id, Algorithm: "RS256", Use: "sig"}
+	set := jose.JSONWebKeySet{Keys: []jose.JSONWebKey{pub}}
+	return c.JSON(http.StatusOK, set)
+}
+
+func (h *IDTokenHandlers) FetchToken(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	keySet, err := h.repository.GetJSONWebKeySet(c.Request().Context())
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	binder, err := h.createBinder(c)
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	req := &tailcfg.TokenRequest{}
+	if err := binder.BindRequest(c, req); err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	machineKey := binder.Peer().String()
+	nodeKey := req.NodeKey.String()
+
+	var m *domain.Machine
+	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	if m == nil {
+		return echo.NewHTTPError(http.StatusBadRequest)
+	}
+
+	_, tailnetDomain, sub := h.names(m)
+
+	now := time.Now()
+
+	claims := jwt.MapClaims{
+		"jit": fmt.Sprintf("%d", util.NextID()),
+		"iss": h.issuer,
+		"sub": sub,
+		"aud": []string{req.Audience},
+		"exp": jwt.NewNumericDate(now.Add(5 * time.Minute)),
+		"nbf": jwt.NewNumericDate(now),
+		"iat": jwt.NewNumericDate(now),
+
+		"key":       m.NodeKey,
+		"addresses": []string{m.IPv4.String(), m.IPv6.String()},
+		"nid":       m.ID,
+		"node":      sub,
+		"domain":    tailnetDomain,
+	}
+
+	if m.HasTags() {
+		tags := []string{}
+		for _, t := range m.Tags {
+			tags = append(tags, fmt.Sprintf("%s:%s", tailnetDomain, t))
+		}
+		claims["tags"] = tags
+	} else {
+		claims["user"] = fmt.Sprintf("%s:%s", tailnetDomain, m.User.Name)
+		claims["uid"] = m.UserID
+	}
+
+	unsignedToken := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	unsignedToken.Header["kid"] = keySet.Key.Id
+
+	jwtB64, err := unsignedToken.SignedString(&keySet.Key.PrivateKey)
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	resp := tailcfg.TokenResponse{IDToken: jwtB64}
+	return binder.WriteResponse(c, http.StatusOK, resp)
+}
+
+func (h *IDTokenHandlers) names(m *domain.Machine) (string, string, string) {
+	var name = m.Name
+	if m.NameIdx != 0 {
+		name = fmt.Sprintf("%s-%d", m.Name, m.NameIdx)
+	}
+
+	sanitizedTailnetName := domain.SanitizeTailnetName(m.Tailnet.Name)
+	return name, sanitizedTailnetName, fmt.Sprintf("%s.%s", name, sanitizedTailnetName)
+}
@@ -22,7 +22,7 @@ func KeyHandler(keys *config.ServerKeys) echo.HandlerFunc {
 		if v != "" {
 			clientCapabilityVersion, err := strconv.Atoi(v)
 			if err != nil {
-				return c.String(http.StatusBadRequest, "Invalid version")
+				return echo.NewHTTPError(http.StatusBadRequest, "Invalid version")
 			}

 			if clientCapabilityVersion >= NoiseCapabilityVersion {
@@ -1,9 +1,12 @@
 package handlers

 import (
+	stderrors "errors"
+	"github.com/jsiebens/ionscale/internal/errors"
 	"github.com/labstack/echo/v4"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
+	"io"
 	"net/http"
 	"tailscale.com/control/controlhttp"
 	"tailscale.com/net/netutil"
@@ -27,12 +30,15 @@ func NewNoiseHandlers(controlKey key.MachinePrivate, createPeerHandler CreatePee
 func (h *NoiseHandlers) Upgrade(c echo.Context) error {
 	conn, err := controlhttp.AcceptHTTP(c.Request().Context(), c.Response(), c.Request(), h.controlKey)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	handler := h.createPeerHandler(conn.Peer())

 	server := http.Server{}
 	server.Handler = h2c.NewHandler(handler, &http2.Server{})
-	return server.Serve(netutil.NewOneConnListener(conn, nil))
+	if err := server.Serve(netutil.NewOneConnListener(conn, nil)); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+	return nil
 }
@@ -3,49 +3,49 @@ package handlers
 import (
 	"context"
 	"github.com/jsiebens/ionscale/internal/bind"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	"github.com/jsiebens/ionscale/internal/mapping"
 	"github.com/labstack/echo/v4"
 	"net/http"
+	"net/netip"
 	"tailscale.com/tailcfg"
+	"tailscale.com/types/opt"
 	"time"
 )

 func NewPollNetMapHandler(
 	createBinder bind.Factory,
-	brokers broker.Pubsub,
-	repository domain.Repository,
-	offlineTimers *OfflineTimers) *PollNetMapHandler {
+	sessionManager core.PollMapSessionManager,
+	repository domain.Repository) *PollNetMapHandler {

 	handler := &PollNetMapHandler{
-		createBinder:  createBinder,
-		brokers:       brokers,
-		repository:    repository,
-		offlineTimers: offlineTimers,
+		createBinder:   createBinder,
+		sessionManager: sessionManager,
+		repository:     repository,
 	}

 	return handler
 }

 type PollNetMapHandler struct {
-	createBinder  bind.Factory
-	repository    domain.Repository
-	brokers       broker.Pubsub
-	offlineTimers *OfflineTimers
+	createBinder   bind.Factory
+	repository     domain.Repository
+	sessionManager core.PollMapSessionManager
 }

 func (h *PollNetMapHandler) PollNetMap(c echo.Context) error {
 	ctx := c.Request().Context()
 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	req := &tailcfg.MapRequest{}
 	if err := binder.BindRequest(c, req); err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	machineKey := binder.Peer().String()
@@ -54,7 +54,7 @@ func (h *PollNetMapHandler) PollNetMap(c echo.Context) error {
 	var m *domain.Machine
 	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	if m == nil {
@@ -79,59 +79,55 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 	m.LastSeen = &now

 	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	tailnetID := m.TailnetID
 	machineID := m.ID

-	h.brokers.Publish(tailnetID, &broker.Signal{PeerUpdated: &machineID})
+	h.sessionManager.NotifyAll(tailnetID)

 	if !mapRequest.Stream {
 		return c.String(http.StatusOK, "")
 	}

 	var syncedPeers = make(map[uint64]bool)
+	var derpMapChecksum = ""

-	response, syncedPeers, err := h.createMapResponse(m, binder, mapRequest, false, make(map[uint64]bool))
+	response, syncedPeers, derpMapChecksum, err := h.createMapResponse(m, binder, mapRequest, false, make(map[uint64]bool), derpMapChecksum)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

-	updateChan := make(chan *broker.Signal, 20)
-
-	unsubscribe, err := h.brokers.Subscribe(tailnetID, updateChan)
-	if err != nil {
-		return err
-	}
-	h.cancelOfflineMessage(machineID)
+	updateChan := make(chan *core.Ping, 20)
+	h.sessionManager.Register(m.TailnetID, m.ID, updateChan)

 	// Listen to connection close
 	notify := c.Request().Context().Done()

 	keepAliveResponse, err := h.createKeepAliveResponse(binder, mapRequest)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}
-	keepAliveTicker := time.NewTicker(config.KeepAliveInterval())
-	syncTicker := time.NewTicker(5 * time.Second)

 	c.Response().WriteHeader(http.StatusOK)

 	if _, err := c.Response().Write(response); err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}
 	c.Response().Flush()

 	connectedDevices.WithLabelValues(m.Tailnet.Name).Inc()

+	keepAliveTicker := time.NewTicker(config.KeepAliveInterval())
+	syncTicker := time.NewTicker(5 * time.Second)
+
 	defer func() {
 		connectedDevices.WithLabelValues(m.Tailnet.Name).Dec()
-		unsubscribe()
+		h.sessionManager.Deregister(m.TailnetID, m.ID)
 		keepAliveTicker.Stop()
 		syncTicker.Stop()
 		_ = h.repository.SetMachineLastSeen(ctx, machineID)
-		h.scheduleOfflineMessage(tailnetID, machineID)
 	}()

 	var latestSync = time.Now()
@@ -144,7 +140,7 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 		case <-keepAliveTicker.C:
 			if mapRequest.KeepAlive {
 				if _, err := c.Response().Write(keepAliveResponse); err != nil {
-					return err
+					return errors.Wrap(err, 0)
 				}
 				_ = h.repository.SetMachineLastSeen(ctx, machineID)
 				c.Response().Flush()
@@ -153,7 +149,7 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 			if latestSync.Before(latestUpdate) {
 				machine, err := h.repository.GetMachine(ctx, machineID)
 				if err != nil {
-					return err
+					return errors.Wrap(err, 0)
 				}
 				if machine == nil {
 					return nil
@@ -162,14 +158,14 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 				var payload []byte
 				var payloadErr error

-				payload, syncedPeers, payloadErr = h.createMapResponse(machine, binder, mapRequest, true, syncedPeers)
+				payload, syncedPeers, derpMapChecksum, payloadErr = h.createMapResponse(machine, binder, mapRequest, true, syncedPeers, derpMapChecksum)

 				if payloadErr != nil {
 					return payloadErr
 				}

 				if _, err := c.Response().Write(payload); err != nil {
-					return err
+					return errors.Wrap(err, 0)
 				}
 				c.Response().Flush()

@@ -188,24 +184,16 @@ func (h *PollNetMapHandler) handleReadOnly(c echo.Context, binder bind.Binder, m
 	m.DiscoKey = request.DiscoKey.String()

 	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

-	response, _, err := h.createMapResponse(m, binder, request, false, map[uint64]bool{})
+	response, _, _, err := h.createMapResponse(m, binder, request, false, map[uint64]bool{}, "")
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	_, err = c.Response().Write(response)
-	return err
-}
-
-func (h *PollNetMapHandler) scheduleOfflineMessage(tailnetID, machineID uint64) {
-	h.offlineTimers.startCh <- [2]uint64{tailnetID, machineID}
-}
-
-func (h *PollNetMapHandler) cancelOfflineMessage(machineID uint64) {
-	h.offlineTimers.stopCh <- machineID
+	return errors.Wrap(err, 0)
 }

 func (h *PollNetMapHandler) createKeepAliveResponse(binder bind.Binder, request *tailcfg.MapRequest) ([]byte, error) {
@@ -216,17 +204,20 @@ func (h *PollNetMapHandler) createKeepAliveResponse(binder bind.Binder, request
 	return binder.Marshal(request.Compress, mapResponse)
 }

-func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Binder, request *tailcfg.MapRequest, delta bool, prevSyncedPeerIDs map[uint64]bool) ([]byte, map[uint64]bool, error) {
+func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Binder, request *tailcfg.MapRequest, delta bool, prevSyncedPeerIDs map[uint64]bool, prevDerpMapChecksum string) ([]byte, map[uint64]bool, string, error) {
 	ctx := context.TODO()

-	node, user, err := mapping.ToNode(m)
-	if err != nil {
-		return nil, nil, err
-	}
+	prc := &primaryRoutesCollector{flagged: map[netip.Prefix]bool{}}

 	tailnet, err := h.repository.GetTailnet(ctx, m.TailnetID)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, "", err
+	}
+
+	hostinfo := tailcfg.Hostinfo(m.HostInfo)
+	node, user, err := mapping.ToNode(m, tailnet, false, true, prc.filter)
+	if err != nil {
+		return nil, nil, "", err
 	}

 	policies := tailnet.ACLPolicy
@@ -236,7 +227,7 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin

 	candidatePeers, err := h.repository.ListMachinePeers(ctx, m.TailnetID, m.MachineKey)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, "", err
 	}

 	syncedPeerIDs := map[uint64]bool{}
@@ -247,9 +238,11 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin
 			continue
 		}
 		if policies.IsValidPeer(m, &peer) || policies.IsValidPeer(&peer, m) {
-			n, u, err := mapping.ToNode(&peer)
+			isConnected := h.sessionManager.HasSession(peer.TailnetID, peer.ID)
+
+			n, u, err := mapping.ToNode(&peer, tailnet, true, isConnected, prc.filter)
 			if err != nil {
-				return nil, nil, err
+				return nil, nil, "", err
 			}
 			changedPeers = append(changedPeers, n)
 			syncedPeerIDs[peer.ID] = true
@@ -268,43 +261,52 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin

 	dnsConfig := tailnet.DNSConfig

-	derpMap, err := h.repository.GetDERPMap(ctx)
+	derpMap, err := m.Tailnet.GetDERPMap(ctx, h.repository)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, "", err
 	}

-	rules := policies.BuildFilterRules(candidatePeers, m)
+	filterRules := policies.BuildFilterRules(candidatePeers, m)

 	controlTime := time.Now().UTC()
 	var mapResponse *tailcfg.MapResponse

 	if !delta {
 		mapResponse = &tailcfg.MapResponse{
-			KeepAlive:    false,
-			Node:         node,
-			DNSConfig:    mapping.ToDNSConfig(&m.Tailnet, &dnsConfig),
-			PacketFilter: rules,
-			DERPMap:      derpMap,
-			Domain:       domain.SanitizeTailnetName(m.Tailnet.Name),
-			Peers:        changedPeers,
-			UserProfiles: users,
-			ControlTime:  &controlTime,
+			KeepAlive:       false,
+			Node:            node,
+			DNSConfig:       mapping.ToDNSConfig(m, &m.Tailnet, &dnsConfig),
+			PacketFilter:    filterRules,
+			DERPMap:         &derpMap.DERPMap,
+			Domain:          domain.SanitizeTailnetName(m.Tailnet.Name),
+			Peers:           changedPeers,
+			UserProfiles:    users,
+			ControlTime:     &controlTime,
+			CollectServices: optBool(tailnet.ServiceCollectionEnabled),
 			Debug: &tailcfg.Debug{
 				DisableLogTail: true,
 			},
 		}
 	} else {
 		mapResponse = &tailcfg.MapResponse{
-			Node:         node,
-			DNSConfig:    mapping.ToDNSConfig(&m.Tailnet, &dnsConfig),
-			PacketFilter: rules,
-			DERPMap:      derpMap,
-			Domain:       domain.SanitizeTailnetName(m.Tailnet.Name),
-			PeersChanged: changedPeers,
-			PeersRemoved: removedPeers,
-			UserProfiles: users,
-			ControlTime:  &controlTime,
+			Node:            node,
+			DNSConfig:       mapping.ToDNSConfig(m, &m.Tailnet, &dnsConfig),
+			PacketFilter:    filterRules,
+			Domain:          domain.SanitizeTailnetName(m.Tailnet.Name),
+			PeersChanged:    changedPeers,
+			PeersRemoved:    removedPeers,
+			UserProfiles:    users,
+			ControlTime:     &controlTime,
+			CollectServices: optBool(tailnet.ServiceCollectionEnabled),
 		}
+
+		if prevDerpMapChecksum != derpMap.Checksum {
+			mapResponse.DERPMap = &derpMap.DERPMap
+		}
+	}
+
+	if tailnet.SSHEnabled && hostinfo.TailscaleSSHEnabled() {
+		mapResponse.SSHPolicy = policies.BuildSSHPolicy(candidatePeers, m)
 	}

 	if request.OmitPeers {
@@ -315,59 +317,32 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin

 	payload, err := binder.Marshal(request.Compress, mapResponse)

-	return payload, syncedPeerIDs, nil
+	return payload, syncedPeerIDs, derpMap.Checksum, nil
 }

-func NewOfflineTimers(repository domain.Repository, pubsub broker.Pubsub) *OfflineTimers {
-	return &OfflineTimers{
-		repository: repository,
-		pubsub:     pubsub,
-		data:       make(map[uint64]*time.Timer),
-		startCh:    make(chan [2]uint64),
-		stopCh:     make(chan uint64),
-	}
+func optBool(v bool) opt.Bool {
+	b := opt.Bool("")
+	b.Set(v)
+	return b
 }

-type OfflineTimers struct {
-	repository domain.Repository
-	pubsub     broker.Pubsub
-	data       map[uint64]*time.Timer
-	stopCh     chan uint64
-	startCh    chan [2]uint64
+type primaryRoutesCollector struct {
+	flagged map[netip.Prefix]bool
 }

-func (o *OfflineTimers) Start() {
-	for {
-		select {
-		case i := <-o.startCh:
-			o.scheduleOfflineMessage(i[0], i[1])
-		case m := <-o.stopCh:
-			o.cancelOfflineMessage(m)
+func (p *primaryRoutesCollector) filter(m *domain.Machine) []netip.Prefix {
+	var result = []netip.Prefix{}
+	for _, r := range m.AllowIPs {
+		if _, ok := p.flagged[r]; r.Bits() != 0 && !ok {
+			result = append(result, r)
+			p.flagged[r] = true
 		}
 	}
-}
-
-func (o *OfflineTimers) scheduleOfflineMessage(tailnetID, machineID uint64) {
-	t, ok := o.data[machineID]
-	if ok {
-		t.Stop()
-		delete(o.data, machineID)
-	}
-
-	timer := time.NewTimer(config.KeepAliveInterval())
-	go func() {
-		<-timer.C
-		o.pubsub.Publish(tailnetID, &broker.Signal{PeerUpdated: &machineID})
-		o.stopCh <- machineID
-	}()
-
-	o.data[machineID] = timer
-}
-
-func (o *OfflineTimers) cancelOfflineMessage(machineID uint64) {
-	t, ok := o.data[machineID]
-	if ok {
-		t.Stop()
-		delete(o.data, machineID)
+	for _, r := range m.AutoAllowIPs {
+		if _, ok := p.flagged[r]; r.Bits() != 0 && !ok {
+			result = append(result, r)
+			p.flagged[r] = true
+		}
 	}
+	return result
 }
@@ -4,9 +4,11 @@ import (
 	"context"
 	"github.com/jsiebens/ionscale/internal/addr"
 	"github.com/jsiebens/ionscale/internal/bind"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
+	"github.com/jsiebens/ionscale/internal/mapping"
 	"github.com/jsiebens/ionscale/internal/util"
 	"github.com/labstack/echo/v4"
 	"net/http"
@@ -19,21 +21,21 @@ import (
 func NewRegistrationHandlers(
 	createBinder bind.Factory,
 	config *config.Config,
-	brokers broker.Pubsub,
+	sessionManager core.PollMapSessionManager,
 	repository domain.Repository) *RegistrationHandlers {
 	return &RegistrationHandlers{
-		createBinder: createBinder,
-		pubsub:       brokers,
-		repository:   repository,
-		config:       config,
+		createBinder:   createBinder,
+		sessionManager: sessionManager,
+		repository:     repository,
+		config:         config,
 	}
 }

 type RegistrationHandlers struct {
-	createBinder bind.Factory
-	repository   domain.Repository
-	pubsub       broker.Pubsub
-	config       *config.Config
+	createBinder   bind.Factory
+	repository     domain.Repository
+	sessionManager core.PollMapSessionManager
+	config         *config.Config
 }

 func (h *RegistrationHandlers) Register(c echo.Context) error {
@@ -41,12 +43,12 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {

 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	req := &tailcfg.RegisterRequest{}
 	if err := binder.BindRequest(c, req); err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	machineKey := binder.Peer().String()
@@ -56,7 +58,7 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {
 	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)

 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	if m != nil {
@@ -68,12 +70,18 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {
 		if !req.Expiry.IsZero() && req.Expiry.Before(time.Now()) {
 			m.ExpiresAt = req.Expiry

-			if err := h.repository.SaveMachine(ctx, m); err != nil {
-				return err
+			if m.Ephemeral {
+				if _, err := h.repository.DeleteMachine(ctx, m.ID); err != nil {
+					return errors.Wrap(err, 0)
+				}
+				h.sessionManager.NotifyAll(m.TailnetID)
+			} else {
+				if err := h.repository.SaveMachine(ctx, m); err != nil {
+					return errors.Wrap(err, 0)
+				}
+				h.sessionManager.NotifyAll(m.TailnetID)
 			}

-			h.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
-
 			response := tailcfg.RegisterResponse{NodeKeyExpired: true}
 			return binder.WriteResponse(c, http.StatusOK, response)
 		}
@@ -82,7 +90,7 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {
 		if m.Name != sanitizeHostname {
 			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, m.TailnetID, sanitizeHostname)
 			if err != nil {
-				return err
+				return errors.Wrap(err, 0)
 			}
 			m.Name = sanitizeHostname
 			m.NameIdx = nameIdx
@@ -93,10 +101,17 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {
 		m.Tags = append(m.RegisteredTags, advertisedTags...)

 		if err := h.repository.SaveMachine(ctx, m); err != nil {
-			return err
+			return errors.Wrap(err, 0)
+		}
+
+		tUser, tLogin := mapping.ToUser(m.User)
+
+		response := tailcfg.RegisterResponse{
+			MachineAuthorized: m.Authorized,
+			User:              tUser,
+			Login:             tLogin,
 		}

-		response := tailcfg.RegisterResponse{MachineAuthorized: true}
 		return binder.WriteResponse(c, http.StatusOK, response)
 	}

@@ -112,7 +127,7 @@ func (h *RegistrationHandlers) authenticateMachine(c echo.Context, binder bind.B

 	if req.Auth.AuthKey == "" {
 		key := util.RandStringBytes(8)
-		authUrl := h.config.CreateUrl("/a/%s", key)
+		authUrl := h.config.CreateUrl("/a/r/%s", key)

 		request := domain.RegistrationRequest{
 			MachineKey: machineKey,
@@ -140,7 +155,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi

 	authKey, err := h.repository.LoadAuthKey(ctx, req.Auth.AuthKey)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	if authKey == nil {
@@ -166,7 +181,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi

 	m, err = h.repository.GetMachineByKey(ctx, tailnet.ID, machineKey)
 	if err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

 	now := time.Now().UTC()
@@ -175,7 +190,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 		sanitizeHostname := dnsname.SanitizeHostname(req.Hostinfo.Hostname)
 		nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}

 		m = &domain.Machine{
@@ -191,6 +206,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 			CreatedAt:         now,
 			ExpiresAt:         now.Add(180 * 24 * time.Hour).UTC(),
 			KeyExpiryDisabled: len(tags) != 0,
+			Authorized:        !tailnet.MachineAuthorizationEnabled || authKey.PreAuthorized,

 			User:    user,
 			Tailnet: tailnet,
@@ -202,7 +218,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi

 		ipv4, ipv6, err := addr.SelectIP(checkIP(ctx, h.repository.CountMachinesWithIPv4))
 		if err != nil {
-			return err
+			return errors.Wrap(err, 0)
 		}
 		m.IPv4 = domain.IP{Addr: ipv4}
 		m.IPv6 = domain.IP{Addr: ipv6}
@@ -211,7 +227,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 		if m.Name != sanitizeHostname {
 			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 			if err != nil {
-				return err
+				return errors.Wrap(err, 0)
 			}
 			m.Name = sanitizeHostname
 			m.NameIdx = nameIdx
@@ -229,10 +245,16 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 	}

 	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
+		return errors.Wrap(err, 0)
+	}
+
+	tUser, tLogin := mapping.ToUser(m.User)
+	response := tailcfg.RegisterResponse{
+		MachineAuthorized: true,
+		User:              tUser,
+		Login:             tLogin,
 	}

-	response := tailcfg.RegisterResponse{MachineAuthorized: true}
 	return binder.WriteResponse(c, http.StatusOK, response)
 }

@@ -257,7 +279,19 @@ func (h *RegistrationHandlers) followup(c echo.Context, binder bind.Binder, req
 			}

 			if m != nil && m.IsFinished() {
-				response := tailcfg.RegisterResponse{MachineAuthorized: len(m.Error) != 0, Error: m.Error}
+				user, err := h.repository.GetUser(ctx, m.UserID)
+				if err != nil {
+					return err
+				}
+
+				u, l := mapping.ToUser(*user)
+
+				response := tailcfg.RegisterResponse{
+					MachineAuthorized: len(m.Error) != 0,
+					Error:             m.Error,
+					User:              u,
+					Login:             l,
+				}
 				return binder.WriteResponse(c, http.StatusOK, response)
 			}
 		case <-notify:
@@ -0,0 +1,114 @@
+package handlers
+
+import (
+	"fmt"
+	"github.com/jsiebens/ionscale/internal/bind"
+	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
+	"github.com/jsiebens/ionscale/internal/util"
+	"github.com/labstack/echo/v4"
+	"net/http"
+	"tailscale.com/tailcfg"
+	"time"
+)
+
+func NewSSHActionHandlers(createBinder bind.Factory, config *config.Config, repository domain.Repository) *SSHActionHandlers {
+	return &SSHActionHandlers{
+		createBinder: createBinder,
+		repository:   repository,
+		config:       config,
+	}
+}
+
+type SSHActionHandlers struct {
+	createBinder bind.Factory
+	repository   domain.Repository
+	config       *config.Config
+}
+
+type sshActionRequestData struct {
+	SrcMachineID uint64 `param:"src_machine_id"`
+	DstMachineID uint64 `param:"dst_machine_id"`
+}
+
+func (h *SSHActionHandlers) StartAuth(c echo.Context) error {
+	ctx := c.Request().Context()
+
+	binder, err := h.createBinder(c)
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	data := new(sshActionRequestData)
+	if err = c.Bind(data); err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	key := util.RandStringBytes(8)
+	request := &domain.SSHActionRequest{
+		Key:          key,
+		SrcMachineID: data.SrcMachineID,
+		DstMachineID: data.DstMachineID,
+		CreatedAt:    time.Now().UTC(),
+	}
+
+	authUrl := h.config.CreateUrl("/a/s/%s", key)
+
+	if err := h.repository.SaveSSHActionRequest(ctx, request); err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	resp := &tailcfg.SSHAction{
+		Message:         fmt.Sprintf("# Tailscale SSH requires an additional check.\n# To authenticate, visit: %s\n", authUrl),
+		HoldAndDelegate: fmt.Sprintf("https://unused/machine/ssh/action/check/%s", key),
+	}
+
+	return binder.WriteResponse(c, http.StatusOK, resp)
+}
+
+func (h *SSHActionHandlers) CheckAuth(c echo.Context) error {
+	// Listen to connection close
+	ctx := c.Request().Context()
+	notify := ctx.Done()
+
+	binder, err := h.createBinder(c)
+	if err != nil {
+		return errors.Wrap(err, 0)
+	}
+
+	tick := time.NewTicker(2 * time.Second)
+
+	defer func() { tick.Stop() }()
+
+	key := c.Param("key")
+
+	for {
+		select {
+		case <-tick.C:
+			m, err := h.repository.GetSSHActionRequest(ctx, key)
+
+			if err != nil || m == nil {
+				return binder.WriteResponse(c, http.StatusOK, &tailcfg.SSHAction{Reject: true})
+			}
+
+			if m.Action == "accept" {
+				action := &tailcfg.SSHAction{
+					Accept:                   true,
+					AllowAgentForwarding:     true,
+					AllowLocalPortForwarding: true,
+				}
+				_ = h.repository.DeleteSSHActionRequest(ctx, key)
+				return binder.WriteResponse(c, http.StatusOK, action)
+			}
+
+			if m.Action == "reject" {
+				action := &tailcfg.SSHAction{Reject: true}
+				_ = h.repository.DeleteSSHActionRequest(ctx, key)
+				return binder.WriteResponse(c, http.StatusOK, action)
+			}
+		case <-notify:
+			return nil
+		}
+	}
+}
@@ -27,8 +27,12 @@ func CopyViaJson[F any, T any](f F, t T) error {
 	return nil
 }

-func ToDNSConfig(tailnet *domain.Tailnet, c *domain.DNSConfig) *tailcfg.DNSConfig {
-	tailnetDomain := domain.SanitizeTailnetName(tailnet.Name)
+func ToDNSConfig(m *domain.Machine, tailnet *domain.Tailnet, c *domain.DNSConfig) *tailcfg.DNSConfig {
+	certsEnabled := c.HttpsCertsEnabled && config.DNSProviderConfigured()
+
+	sanitizeTailnetName := domain.SanitizeTailnetName(tailnet.Name)
+	tailnetDomain := fmt.Sprintf("%s.%s", sanitizeTailnetName, config.MagicDNSSuffix())
+
 	resolvers := []*dnstype.Resolver{}
 	for _, r := range c.Nameservers {
 		resolver := &dnstype.Resolver{
@@ -40,10 +44,15 @@ func ToDNSConfig(tailnet *domain.Tailnet, c *domain.DNSConfig) *tailcfg.DNSConfi
 	dnsConfig := &tailcfg.DNSConfig{}

 	var domains []string
+	var certDomains []string

 	if c.MagicDNS {
-		domains = append(domains, fmt.Sprintf("%s.%s", tailnetDomain, config.MagicDNSSuffix()))
+		domains = append(domains, tailnetDomain)
 		dnsConfig.Proxied = true
+
+		if certsEnabled {
+			certDomains = append(certDomains, fmt.Sprintf("%s.%s", m.CompleteName(), tailnetDomain))
+		}
 	}

 	if c.OverrideLocalDNS {
@@ -52,8 +61,9 @@ func ToDNSConfig(tailnet *domain.Tailnet, c *domain.DNSConfig) *tailcfg.DNSConfi
 		dnsConfig.FallbackResolvers = resolvers
 	}

-	if len(c.Routes) != 0 {
+	if len(c.Routes) != 0 || certsEnabled {
 		routes := make(map[string][]*dnstype.Resolver)
+
 		for r, s := range c.Routes {
 			routeResolver := []*dnstype.Resolver{}
 			for _, addr := range s {
@@ -67,11 +77,30 @@ func ToDNSConfig(tailnet *domain.Tailnet, c *domain.DNSConfig) *tailcfg.DNSConfi
 	}

 	dnsConfig.Domains = domains
+	dnsConfig.CertDomains = certDomains

 	return dnsConfig
 }

-func ToNode(m *domain.Machine) (*tailcfg.Node, *tailcfg.UserProfile, error) {
+func ToNode(m *domain.Machine, tailnet *domain.Tailnet, peer bool, connected bool, routeFilter func(m *domain.Machine) []netip.Prefix) (*tailcfg.Node, *tailcfg.UserProfile, error) {
+	role := tailnet.IAMPolicy.GetRole(m.User)
+
+	var capabilities []string
+
+	if !peer {
+		if !m.HasTags() && role == domain.UserRoleAdmin {
+			capabilities = append(capabilities, tailcfg.CapabilityAdmin)
+		}
+
+		if tailnet.FileSharingEnabled {
+			capabilities = append(capabilities, tailcfg.CapabilityFileSharing)
+		}
+
+		if tailnet.SSHEnabled {
+			capabilities = append(capabilities, tailcfg.CapabilitySSH)
+		}
+	}
+
 	nKey, err := util.ParseNodePublicKey(m.NodeKey)
 	if err != nil {
 		return nil, nil, err
@@ -115,8 +144,9 @@ func ToNode(m *domain.Machine) (*tailcfg.Node, *tailcfg.UserProfile, error) {
 		allowedIPs = append(allowedIPs, ipv6)
 	}

-	allowedIPs = append(allowedIPs, m.AllowIPs...)
-	allowedIPs = append(allowedIPs, m.AutoAllowIPs...)
+	if connected {
+		allowedIPs = append(allowedIPs, routeFilter(m)...)
+	}

 	var derp string
 	if hostinfo.NetInfo != nil {
@@ -125,17 +155,14 @@ func ToNode(m *domain.Machine) (*tailcfg.Node, *tailcfg.UserProfile, error) {
 		derp = "127.3.3.40:0"
 	}

-	var name = m.Name
-	if m.NameIdx != 0 {
-		name = fmt.Sprintf("%s-%d", m.Name, m.NameIdx)
-	}
+	var name = m.CompleteName()

 	sanitizedTailnetName := domain.SanitizeTailnetName(m.Tailnet.Name)

 	hostInfo := tailcfg.Hostinfo{
 		OS:       hostinfo.OS,
 		Hostname: hostinfo.Hostname,
-		Services: hostinfo.Services,
+		Services: filterServices(hostinfo.Services),
 	}

 	n := tailcfg.Node{
@@ -150,11 +177,12 @@ func ToNode(m *domain.Machine) (*tailcfg.Node, *tailcfg.UserProfile, error) {
 		Endpoints:  endpoints,
 		DERP:       derp,

-		Hostinfo: hostInfo.View(),
+		Hostinfo:     hostInfo.View(),
+		Capabilities: capabilities,

 		Created: m.CreatedAt.UTC(),

-		MachineAuthorized: true,
+		MachineAuthorized: m.Authorized,
 		User:              tailcfg.UserID(m.UserID),
 	}

@@ -167,11 +195,9 @@ func ToNode(m *domain.Machine) (*tailcfg.Node, *tailcfg.UserProfile, error) {
 		n.KeyExpiry = time.Time{}
 	}

-	if m.LastSeen != nil {
-		l := m.LastSeen.UTC()
-		online := m.LastSeen.After(time.Now().Add(-config.KeepAliveInterval()))
-		n.LastSeen = &l
-		n.Online = &online
+	n.Online = &connected
+	if !connected && m.LastSeen != nil {
+		n.LastSeen = m.LastSeen
 	}

 	var user = ToUserProfile(m.User)
@@ -197,10 +223,30 @@ func ToUserProfile(u domain.User) tailcfg.UserProfile {
 	return profile
 }

-func ToUserProfiles(users domain.Users) []tailcfg.UserProfile {
-	var profiles []tailcfg.UserProfile
-	for _, u := range users {
-		profiles = append(profiles, ToUserProfile(u))
+func ToUser(u domain.User) (tailcfg.User, tailcfg.Login) {
+	user := tailcfg.User{
+		ID:          tailcfg.UserID(u.ID),
+		LoginName:   u.Name,
+		DisplayName: u.Name,
+		Logins:      []tailcfg.LoginID{tailcfg.LoginID(u.ID)},
+		Domain:      u.Tailnet.Name,
 	}
-	return profiles
+	login := tailcfg.Login{
+		ID:          tailcfg.LoginID(u.ID),
+		LoginName:   u.Name,
+		DisplayName: u.Name,
+		Domain:      u.Tailnet.Name,
+	}
+	return user, login
+}
+
+func filterServices(services []tailcfg.Service) []tailcfg.Service {
+	result := []tailcfg.Service{}
+	for _, s := range services {
+		if s.Proto == tailcfg.TCP || s.Proto == tailcfg.UDP {
+			continue
+		}
+		result = append(result, s)
+	}
+	return result
 }
@@ -3,11 +3,48 @@ package server
 import (
 	"fmt"
 	"github.com/hashicorp/go-hclog"
+	"github.com/jsiebens/ionscale/internal/errors"
+	"github.com/labstack/echo-contrib/prometheus"
 	"github.com/labstack/echo/v4"
-	"runtime"
+	"net/http"
+	"strings"
 	"time"
 )

+func EchoErrorHandler(logger hclog.Logger) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			request := c.Request()
+
+			if err := next(c); err != nil {
+				switch t := err.(type) {
+				case *echo.HTTPError:
+					return err
+				case *errors.Error:
+					logger.Error("error processing request",
+						"err", t.Cause,
+						"location", t.Location,
+						"http.method", request.Method,
+						"http.uri", request.RequestURI,
+					)
+				default:
+					logger.Error("error processing request",
+						"err", err,
+						"http.method", request.Method,
+						"http.uri", request.RequestURI,
+					)
+				}
+
+				if strings.HasPrefix(request.RequestURI, "/a/") {
+					return c.Render(http.StatusInternalServerError, "error.html", nil)
+				}
+			}
+
+			return nil
+		}
+	}
+}
+
 func EchoLogger(logger hclog.Logger) echo.MiddlewareFunc {
 	httpLogger := logger.Named("http")
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
@@ -36,22 +73,34 @@ func EchoLogger(logger hclog.Logger) echo.MiddlewareFunc {
 }

 func EchoRecover(logger hclog.Logger) echo.MiddlewareFunc {
-	httpLogger := logger.Named("http")
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			defer func() {
-				if r := recover(); r != nil {
-					err, ok := r.(error)
-					if !ok {
-						err = fmt.Errorf("%v", r)
+			apply := func() (topErr error) {
+				defer func() {
+					if r := recover(); r != nil {
+						err, ok := r.(error)
+						if !ok {
+							err = fmt.Errorf("%v", r)
+						}
+						topErr = err
 					}
-					stack := make([]byte, 4<<10) // 4 KB
-					length := runtime.Stack(stack, false)
-					httpLogger.Error("panic handling request", "err", err, "stack", string(stack[:length]))
-					c.Error(err)
-				}
-			}()
+				}()
+				return next(c)
+			}
+			return apply()
+		}
+	}
+}
+
+func ErrorRedirect() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			c.Set("redirect_on_error", true)
 			return next(c)
 		}
 	}
 }
+
+func EchoMetrics(p *prometheus.Prometheus) echo.MiddlewareFunc {
+	return p.HandlerFunc
+}
@@ -2,6 +2,7 @@ package server

 import (
 	"github.com/bufbuild/connect-go"
+	"github.com/hashicorp/go-hclog"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/key"
 	"github.com/jsiebens/ionscale/internal/service"
@@ -9,7 +10,7 @@ import (
 	"net/http"
 )

-func NewRpcHandler(systemAdminKey *key.ServerPrivate, repository domain.Repository, handler apiconnect.IonscaleServiceHandler) (string, http.Handler) {
-	interceptors := connect.WithInterceptors(service.AuthenticationInterceptor(systemAdminKey, repository))
+func NewRpcHandler(systemAdminKey *key.ServerPrivate, repository domain.Repository, logger hclog.Logger, handler apiconnect.IonscaleServiceHandler) (string, http.Handler) {
+	interceptors := connect.WithInterceptors(service.NewErrorInterceptor(logger), service.AuthenticationInterceptor(systemAdminKey, repository))
 	return apiconnect.NewIonscaleServiceHandler(handler, interceptors)
 }
@@ -6,12 +6,14 @@ import (
 	"fmt"
 	"github.com/caddyserver/certmagic"
 	"github.com/hashicorp/go-hclog"
+	"github.com/jsiebens/ionscale/internal/auth"
 	"github.com/jsiebens/ionscale/internal/bind"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/database"
+	"github.com/jsiebens/ionscale/internal/dns"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/handlers"
-	"github.com/jsiebens/ionscale/internal/provider"
 	"github.com/jsiebens/ionscale/internal/service"
 	"github.com/jsiebens/ionscale/internal/templates"
 	echo_prometheus "github.com/labstack/echo-contrib/prometheus"
@@ -37,11 +39,13 @@ func Start(c *config.Config) error {

 	logger.Info("Starting ionscale server")

-	repository, brokers, err := database.OpenDB(&c.Database, logger)
+	repository, err := database.OpenDB(&c.Database, logger)
 	if err != nil {
 		return err
 	}

+	sessionManager := core.NewPollMapSessionManager()
+
 	defaultControlKeys, err := repository.GetControlKeys(context.Background())
 	if err != nil {
 		return err
@@ -52,11 +56,7 @@ func Start(c *config.Config) error {
 		return err
 	}

-	offlineTimers := handlers.NewOfflineTimers(repository, brokers)
-	reaper := handlers.NewReaper(brokers, repository)
-
-	go offlineTimers.Start()
-	go reaper.Start()
+	core.StartReaper(repository, sessionManager)

 	serverUrl, err := url.Parse(c.ServerUrl)
 	if err != nil {
@@ -81,27 +81,47 @@ func Start(c *config.Config) error {
 		c.HttpsListenAddr = fmt.Sprintf(":%d", certmagic.HTTPSPort)
 	}

-	createPeerHandler := func(p key.MachinePublic) http.Handler {
-		registrationHandlers := handlers.NewRegistrationHandlers(bind.DefaultBinder(p), c, brokers, repository)
-		pollNetMapHandler := handlers.NewPollNetMapHandler(bind.DefaultBinder(p), brokers, repository, offlineTimers)
-
-		e := echo.New()
-		e.Use(EchoLogger(logger))
-		e.Use(EchoRecover(logger))
-		e.POST("/machine/register", registrationHandlers.Register)
-		e.POST("/machine/map", pollNetMapHandler.PollNetMap)
-
-		return e
-	}
-
-	authProvider, systemIAMPolicy, err := setupAuthProvider(c.AuthProvider)
+	authProvider, systemIAMPolicy, err := setupAuthProvider(c.Auth)
 	if err != nil {
 		return fmt.Errorf("error configuring OIDC provider: %v", err)
 	}

+	dnsProvider, err := dns.NewProvider(c.DNS)
+	if err != nil {
+		return err
+	}
+
+	p := echo_prometheus.NewPrometheus("http", nil)
+
+	metricsHandler := echo.New()
+	p.SetMetricsPath(metricsHandler)
+
+	createPeerHandler := func(machinePublicKey key.MachinePublic) http.Handler {
+		binder := bind.DefaultBinder(machinePublicKey)
+
+		registrationHandlers := handlers.NewRegistrationHandlers(binder, c, sessionManager, repository)
+		pollNetMapHandler := handlers.NewPollNetMapHandler(binder, sessionManager, repository)
+		dnsHandlers := handlers.NewDNSHandlers(binder, dnsProvider)
+		idTokenHandlers := handlers.NewIDTokenHandlers(binder, c, repository)
+		sshActionHandlers := handlers.NewSSHActionHandlers(binder, c, repository)
+
+		e := echo.New()
+		e.Use(EchoMetrics(p), EchoLogger(logger), EchoErrorHandler(logger), EchoRecover(logger))
+		e.POST("/machine/register", registrationHandlers.Register)
+		e.POST("/machine/map", pollNetMapHandler.PollNetMap)
+		e.POST("/machine/set-dns", dnsHandlers.SetDNS)
+		e.POST("/machine/id-token", idTokenHandlers.FetchToken)
+		e.GET("/machine/ssh/action/:src_machine_id/to/:dst_machine_id", sshActionHandlers.StartAuth)
+		e.GET("/machine/ssh/action/check/:key", sshActionHandlers.CheckAuth)
+
+		return e
+	}
+
 	noiseHandlers := handlers.NewNoiseHandlers(serverKey.ControlKey, createPeerHandler)
-	registrationHandlers := handlers.NewRegistrationHandlers(bind.BoxBinder(serverKey.LegacyControlKey), c, brokers, repository)
-	pollNetMapHandler := handlers.NewPollNetMapHandler(bind.BoxBinder(serverKey.LegacyControlKey), brokers, repository, offlineTimers)
+	registrationHandlers := handlers.NewRegistrationHandlers(bind.BoxBinder(serverKey.LegacyControlKey), c, sessionManager, repository)
+	pollNetMapHandler := handlers.NewPollNetMapHandler(bind.BoxBinder(serverKey.LegacyControlKey), sessionManager, repository)
+	dnsHandlers := handlers.NewDNSHandlers(bind.BoxBinder(serverKey.LegacyControlKey), dnsProvider)
+	idTokenHandlers := handlers.NewIDTokenHandlers(bind.BoxBinder(serverKey.LegacyControlKey), c, repository)
 	authenticationHandlers := handlers.NewAuthenticationHandlers(
 		c,
 		authProvider,
@@ -109,27 +129,18 @@ func Start(c *config.Config) error {
 		repository,
 	)

-	rpcService := service.NewService(c, authProvider, repository, brokers)
-	rpcPath, rpcHandler := NewRpcHandler(serverKey.SystemAdminKey, repository, rpcService)
-
-	p := echo_prometheus.NewPrometheus("http", nil)
-
-	metricsHandler := echo.New()
-	p.SetMetricsPath(metricsHandler)
+	rpcService := service.NewService(c, authProvider, repository, sessionManager)
+	rpcPath, rpcHandler := NewRpcHandler(serverKey.SystemAdminKey, repository, logger, rpcService)

 	nonTlsAppHandler := echo.New()
-	nonTlsAppHandler.Use(EchoRecover(logger))
-	nonTlsAppHandler.Use(EchoLogger(logger))
-	nonTlsAppHandler.Use(p.HandlerFunc)
+	nonTlsAppHandler.Use(EchoMetrics(p), EchoLogger(logger), EchoErrorHandler(logger), EchoRecover(logger))
 	nonTlsAppHandler.POST("/ts2021", noiseHandlers.Upgrade)
 	nonTlsAppHandler.Any("/*", handlers.HttpRedirectHandler(c.Tls))

 	tlsAppHandler := echo.New()
-	tlsAppHandler.Pre(handlers.HttpsRedirect(c.Tls))
 	tlsAppHandler.Renderer = templates.NewTemplates()
-	tlsAppHandler.Use(EchoRecover(logger))
-	tlsAppHandler.Use(EchoLogger(logger))
-	tlsAppHandler.Use(p.HandlerFunc)
+	tlsAppHandler.Pre(handlers.HttpsRedirect(c.Tls))
+	tlsAppHandler.Use(EchoMetrics(p), EchoLogger(logger), EchoErrorHandler(logger), EchoRecover(logger))

 	tlsAppHandler.Any("/*", handlers.IndexHandler(http.StatusNotFound))
 	tlsAppHandler.Any("/", handlers.IndexHandler(http.StatusOK))
@@ -139,14 +150,16 @@ func Start(c *config.Config) error {
 	tlsAppHandler.POST("/ts2021", noiseHandlers.Upgrade)
 	tlsAppHandler.POST("/machine/:id", registrationHandlers.Register)
 	tlsAppHandler.POST("/machine/:id/map", pollNetMapHandler.PollNetMap)
+	tlsAppHandler.POST("/machine/:id/set-dns", dnsHandlers.SetDNS)
+	tlsAppHandler.GET("/.well-known/jwks", idTokenHandlers.Jwks)
+	tlsAppHandler.GET("/.well-known/openid-configuration", idTokenHandlers.OpenIDConfig)

 	auth := tlsAppHandler.Group("/a")
 	auth.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
 		TokenLookup: "form:_csrf",
 	}))
-	auth.GET("/:key", authenticationHandlers.StartAuth)
-	auth.POST("/:key", authenticationHandlers.ProcessAuth)
-	auth.GET("/c/:key", authenticationHandlers.StartCliAuth)
+	auth.GET("/:flow/:key", authenticationHandlers.StartAuth)
+	auth.POST("/:flow/:key", authenticationHandlers.ProcessAuth)
 	auth.GET("/callback", authenticationHandlers.Callback)
 	auth.POST("/callback", authenticationHandlers.EndOAuth)
 	auth.GET("/success", authenticationHandlers.Success)
@@ -192,12 +205,12 @@ func Start(c *config.Config) error {
 	return g.Wait()
 }

-func setupAuthProvider(config config.AuthProvider) (provider.AuthProvider, *domain.IAMPolicy, error) {
-	if len(config.Issuer) == 0 {
+func setupAuthProvider(config config.Auth) (auth.Provider, *domain.IAMPolicy, error) {
+	if len(config.Provider.Issuer) == 0 {
 		return nil, &domain.IAMPolicy{}, nil
 	}

-	authProvider, err := provider.NewOIDCProvider(&config)
+	authProvider, err := auth.NewOIDCProvider(&config.Provider)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -2,11 +2,10 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	"github.com/jsiebens/ionscale/internal/mapping"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 )
@@ -14,12 +13,12 @@ import (
 func (s *Service) GetACLPolicy(ctx context.Context, req *connect.Request[api.GetACLPolicyRequest]) (*connect.Response[api.GetACLPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -27,7 +26,7 @@ func (s *Service) GetACLPolicy(ctx context.Context, req *connect.Request[api.Get

 	var policy api.ACLPolicy
 	if err := mapping.CopyViaJson(&tailnet.ACLPolicy, &policy); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	return connect.NewResponse(&api.GetACLPolicyResponse{Policy: &policy}), nil
@@ -36,12 +35,12 @@ func (s *Service) GetACLPolicy(ctx context.Context, req *connect.Request[api.Get
 func (s *Service) SetACLPolicy(ctx context.Context, req *connect.Request[api.SetACLPolicyRequest]) (*connect.Response[api.SetACLPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -49,15 +48,15 @@ func (s *Service) SetACLPolicy(ctx context.Context, req *connect.Request[api.Set

 	var policy domain.ACLPolicy
 	if err := mapping.CopyViaJson(req.Msg.Policy, &policy); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	tailnet.ACLPolicy = policy
 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(tailnet.ID, &broker.Signal{ACLUpdated: true})
+	s.sessionManager.NotifyAll(tailnet.ID)

 	return connect.NewResponse(&api.SetACLPolicyResponse{}), nil
 }
@@ -2,17 +2,18 @@ package service

 import (
 	"context"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	"github.com/jsiebens/ionscale/internal/util"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"time"
 )

-func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.AuthenticationRequest], stream *connect.ServerStream[api.AuthenticationResponse]) error {
+func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.AuthenticateRequest], stream *connect.ServerStream[api.AuthenticateResponse]) error {
 	if s.authProvider == nil {
-		return connect.NewError(connect.CodeFailedPrecondition, errors.New("no authentication method available, contact your ionscale administrator for more information"))
+		return connect.NewError(connect.CodeFailedPrecondition, fmt.Errorf("no authentication method available, contact your ionscale administrator for more information"))
 	}

 	key := util.RandStringBytes(8)
@@ -24,11 +25,11 @@ func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.Aut
 	}

 	if err := s.repository.SaveAuthenticationRequest(ctx, session); err != nil {
-		return err
+		return errors.Wrap(err, 0)
 	}

-	if err := stream.Send(&api.AuthenticationResponse{AuthUrl: authUrl}); err != nil {
-		return err
+	if err := stream.Send(&api.AuthenticateResponse{AuthUrl: authUrl}); err != nil {
+		return errors.Wrap(err, 0)
 	}

 	notify := ctx.Done()
@@ -43,24 +44,27 @@ func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.Aut
 		select {
 		case <-tick.C:
 			m, err := s.repository.GetAuthenticationRequest(ctx, key)
+			if err != nil {
+				return errors.Wrap(err, 0)
+			}

-			if err != nil || m == nil {
-				return connect.NewError(connect.CodeInternal, errors.New("something went wrong"))
+			if m == nil {
+				return connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("invalid authentication request"))
 			}

 			if len(m.Token) != 0 {
-				if err := stream.Send(&api.AuthenticationResponse{Token: m.Token, TailnetId: m.TailnetID}); err != nil {
-					return err
+				if err := stream.Send(&api.AuthenticateResponse{Token: m.Token, TailnetId: m.TailnetID}); err != nil {
+					return errors.Wrap(err, 0)
 				}
 				return nil
 			}

 			if len(m.Error) != 0 {
-				return connect.NewError(connect.CodePermissionDenied, errors.New(m.Error))
+				return connect.NewError(connect.CodePermissionDenied, fmt.Errorf(m.Error))
 			}

-			if err := stream.Send(&api.AuthenticationResponse{AuthUrl: authUrl}); err != nil {
-				return err
+			if err := stream.Send(&api.AuthenticateResponse{AuthUrl: authUrl}); err != nil {
+				return errors.Wrap(err, 0)
 			}

 		case <-notify:
@@ -2,9 +2,10 @@ package service

 import (
 	"context"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"google.golang.org/protobuf/types/known/timestamppb"
 	"time"
@@ -15,15 +16,15 @@ func (s *Service) GetAuthKey(ctx context.Context, req *connect.Request[api.GetAu

 	key, err := s.repository.GetAuthKey(ctx, req.Msg.AuthKeyId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if key == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("auth key not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("auth key not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(key.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	var expiresAt *timestamppb.Timestamp
@@ -74,16 +75,16 @@ func mapAuthKeysToApi(authKeys []domain.AuthKey) []*api.AuthKey {
 func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.ListAuthKeysRequest]) (*connect.Response[api.ListAuthKeysResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	response := api.ListAuthKeysResponse{}
@@ -91,7 +92,7 @@ func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.Lis
 	if principal.IsSystemAdmin() {
 		authKeys, err := s.repository.ListAuthKeys(ctx, req.Msg.TailnetId)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, 0)
 		}

 		response.AuthKeys = mapAuthKeysToApi(authKeys)
@@ -101,7 +102,7 @@ func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.Lis
 	if principal.User != nil {
 		authKeys, err := s.repository.ListAuthKeysByTailnetAndUser(ctx, req.Msg.TailnetId, principal.User.ID)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, 0)
 		}

 		response.AuthKeys = mapAuthKeysToApi(authKeys)
@@ -114,11 +115,11 @@ func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.Lis
 func (s *Service) CreateAuthKey(ctx context.Context, req *connect.Request[api.CreateAuthKeyRequest]) (*connect.Response[api.CreateAuthKeyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if principal.User == nil && len(req.Msg.Tags) == 0 {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("at least one tag is required when creating an auth key"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("at least one tag is required when creating an auth key"))
 	}

 	if err := domain.CheckTags(req.Msg.Tags); err != nil {
@@ -127,11 +128,11 @@ func (s *Service) CreateAuthKey(ctx context.Context, req *connect.Request[api.Cr

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if !principal.IsSystemAdmin() {
@@ -154,17 +155,17 @@ func (s *Service) CreateAuthKey(ctx context.Context, req *connect.Request[api.Cr
 	if user == nil {
 		u, _, err := s.repository.GetOrCreateServiceUser(ctx, tailnet)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, 0)
 		}
 		user = u
 	}

 	tags := domain.SanitizeTags(req.Msg.Tags)

-	v, authKey := domain.CreateAuthKey(tailnet, user, req.Msg.Ephemeral, tags, expiresAt)
+	v, authKey := domain.CreateAuthKey(tailnet, user, req.Msg.Ephemeral, req.Msg.PreAuthorized, tags, expiresAt)

 	if err := s.repository.SaveAuthKey(ctx, authKey); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	response := api.CreateAuthKeyResponse{
@@ -190,19 +191,19 @@ func (s *Service) DeleteAuthKey(ctx context.Context, req *connect.Request[api.De

 	key, err := s.repository.GetAuthKey(ctx, req.Msg.AuthKeyId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if key == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("auth key not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("auth key not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(key.UserID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if _, err := s.repository.DeleteAuthKey(ctx, req.Msg.AuthKeyId); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	return connect.NewResponse(&api.DeleteAuthKeyResponse{}), nil
 }
@@ -3,56 +3,86 @@ package service
 import (
 	"context"
 	"encoding/json"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
+	"github.com/jsiebens/ionscale/internal/util"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"tailscale.com/tailcfg"
 )

-func (s *Service) GetDERPMap(ctx context.Context, _ *connect.Request[api.GetDERPMapRequest]) (*connect.Response[api.GetDERPMapResponse], error) {
+func (s *Service) GetDefaultDERPMap(ctx context.Context, _ *connect.Request[api.GetDefaultDERPMapRequest]) (*connect.Response[api.GetDefaultDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

-	derpMap, err := s.repository.GetDERPMap(ctx)
+	dm, err := s.repository.GetDERPMap(ctx)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	raw, err := json.Marshal(derpMap)
+	raw, err := json.Marshal(dm.DERPMap)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	return connect.NewResponse(&api.GetDERPMapResponse{Value: raw}), nil
+	return connect.NewResponse(&api.GetDefaultDERPMapResponse{Value: raw}), nil
 }

-func (s *Service) SetDERPMap(ctx context.Context, req *connect.Request[api.SetDERPMapRequest]) (*connect.Response[api.SetDERPMapResponse], error) {
+func (s *Service) SetDefaultDERPMap(ctx context.Context, req *connect.Request[api.SetDefaultDERPMapRequest]) (*connect.Response[api.SetDefaultDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	var derpMap tailcfg.DERPMap
-	err := json.Unmarshal(req.Msg.Value, &derpMap)
-	if err != nil {
-		return nil, err
+	if err := json.Unmarshal(req.Msg.Value, &derpMap); err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	dp := domain.DERPMap{
+		Checksum: util.Checksum(&derpMap),
+		DERPMap:  derpMap,
+	}
+
+	if err := s.repository.SetDERPMap(ctx, &dp); err != nil {
+		return nil, errors.Wrap(err, 0)
 	}

 	tailnets, err := s.repository.ListTailnets(ctx)
 	if err != nil {
-		return nil, err
-	}
-
-	if err := s.repository.SetDERPMap(ctx, &derpMap); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	for _, t := range tailnets {
-		s.pubsub.Publish(t.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(t.ID)
 	}

-	return connect.NewResponse(&api.SetDERPMapResponse{Value: req.Msg.Value}), nil
+	return connect.NewResponse(&api.SetDefaultDERPMapResponse{Value: req.Msg.Value}), nil
+}
+
+func (s *Service) ResetDefaultDERPMap(ctx context.Context, req *connect.Request[api.ResetDefaultDERPMapRequest]) (*connect.Response[api.ResetDefaultDERPMapResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	dp := domain.DERPMap{}
+
+	if err := s.repository.SetDERPMap(ctx, &dp); err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	tailnets, err := s.repository.ListTailnets(ctx)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	for _, t := range tailnets {
+		s.sessionManager.NotifyAll(t.ID)
+	}
+
+	return connect.NewResponse(&api.ResetDefaultDERPMapResponse{}), nil
 }
@@ -2,27 +2,26 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 )

 func (s *Service) GetDNSConfig(ctx context.Context, req *connect.Request[api.GetDNSConfigRequest]) (*connect.Response[api.GetDNSConfigResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	dnsConfig := tailnet.DNSConfig
@@ -31,6 +30,7 @@ func (s *Service) GetDNSConfig(ctx context.Context, req *connect.Request[api.Get
 	resp := &api.GetDNSConfigResponse{
 		Config: &api.DNSConfig{
 			MagicDns:         dnsConfig.MagicDNS,
+			HttpsCerts:       dnsConfig.HttpsCertsEnabled,
 			MagicDnsSuffix:   fmt.Sprintf("%s.%s", tailnetDomain, config.MagicDNSSuffix()),
 			OverrideLocalDns: dnsConfig.OverrideLocalDNS,
 			Nameservers:      dnsConfig.Nameservers,
@@ -44,35 +44,36 @@ func (s *Service) GetDNSConfig(ctx context.Context, req *connect.Request[api.Get
 func (s *Service) SetDNSConfig(ctx context.Context, req *connect.Request[api.SetDNSConfigRequest]) (*connect.Response[api.SetDNSConfigResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	dnsConfig := req.Msg.Config

-	if dnsConfig.MagicDns && len(dnsConfig.Nameservers) == 0 {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("at least one global nameserver is required when enabling magic dns"))
+	if dnsConfig.HttpsCerts && !dnsConfig.MagicDns {
+		return nil, connect.NewError(connect.CodeFailedPrecondition, fmt.Errorf("MagicDNS must be enabled when enabling HTTPS Certs"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	tailnet.DNSConfig = domain.DNSConfig{
-		MagicDNS:         dnsConfig.MagicDns,
-		OverrideLocalDNS: dnsConfig.OverrideLocalDns,
-		Nameservers:      dnsConfig.Nameservers,
-		Routes:           apiRoutesToDomainRoutes(dnsConfig.Routes),
+		MagicDNS:          dnsConfig.MagicDns,
+		HttpsCertsEnabled: dnsConfig.HttpsCerts,
+		OverrideLocalDNS:  dnsConfig.OverrideLocalDns,
+		Nameservers:       dnsConfig.Nameservers,
+		Routes:            apiRoutesToDomainRoutes(dnsConfig.Routes),
 	}

 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(tailnet.ID, &broker.Signal{DNSUpdated: true})
+	s.sessionManager.NotifyAll(tailnet.ID)

 	resp := &api.SetDNSConfigResponse{Config: dnsConfig}

@@ -2,22 +2,22 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 )

 func (s *Service) GetIAMPolicy(ctx context.Context, req *connect.Request[api.GetIAMPolicyRequest]) (*connect.Response[api.GetIAMPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -36,12 +36,12 @@ func (s *Service) GetIAMPolicy(ctx context.Context, req *connect.Request[api.Get
 func (s *Service) SetIAMPolicy(ctx context.Context, req *connect.Request[api.SetIAMPolicyRequest]) (*connect.Response[api.SetIAMPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -55,7 +55,7 @@ func (s *Service) SetIAMPolicy(ctx context.Context, req *connect.Request[api.Set
 	}

 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	return connect.NewResponse(&api.SetIAMPolicyResponse{}), nil
@@ -4,7 +4,9 @@ import (
 	"context"
 	"fmt"
 	"github.com/bufbuild/connect-go"
+	"github.com/hashicorp/go-hclog"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	"github.com/jsiebens/ionscale/internal/key"
 	"github.com/jsiebens/ionscale/internal/token"
 	"strings"
@@ -75,3 +77,55 @@ func exchangeToken(ctx context.Context, systemAdminKey *key.ServerPrivate, repos

 	return nil
 }
+
+func NewErrorInterceptor(logger hclog.Logger) *ErrorInterceptor {
+	return &ErrorInterceptor{
+		logger: logger,
+	}
+}
+
+type ErrorInterceptor struct {
+	logger hclog.Logger
+}
+
+func (e *ErrorInterceptor) handleError(err error) error {
+	if err == nil {
+		return err
+	}
+
+	switch t := err.(type) {
+	case *connect.Error:
+		return err
+	case *errors.Error:
+		e.logger.Error("error processing grpc request",
+			"err", t.Cause,
+			"location", t.Location,
+		)
+		return connect.NewError(connect.CodeInternal, fmt.Errorf("internal server error"))
+	default:
+		e.logger.Error("error processing grpc request",
+			"err", err,
+		)
+		return connect.NewError(connect.CodeInternal, fmt.Errorf("internal server error"))
+	}
+
+}
+func (e *ErrorInterceptor) WrapUnary(next connect.UnaryFunc) connect.UnaryFunc {
+	return func(ctx context.Context, request connect.AnyRequest) (connect.AnyResponse, error) {
+		response, err := next(ctx, request)
+		return response, e.handleError(err)
+	}
+}
+
+func (e *ErrorInterceptor) WrapStreamingClient(next connect.StreamingClientFunc) connect.StreamingClientFunc {
+	return func(ctx context.Context, spec connect.Spec) connect.StreamingClientConn {
+		return next(ctx, spec)
+	}
+}
+
+func (e *ErrorInterceptor) WrapStreamingHandler(next connect.StreamingHandlerFunc) connect.StreamingHandlerFunc {
+	return func(ctx context.Context, conn connect.StreamingHandlerConn) error {
+		err := next(ctx, conn)
+		return e.handleError(err)
+	}
+}
@@ -2,12 +2,10 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
-	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"google.golang.org/protobuf/types/known/timestamppb"
 	"net/netip"
@@ -22,10 +20,9 @@ func (s *Service) machineToApi(m *domain.Machine) *api.Machine {
 		name = fmt.Sprintf("%s-%d", m.Name, m.NameIdx)
 	}

-	online := false
+	online := s.sessionManager.HasSession(m.TailnetID, m.ID)
 	if m.LastSeen != nil {
 		lastSeen = timestamppb.New(*m.LastSeen)
-		online = m.LastSeen.After(time.Now().Add(-config.KeepAliveInterval()))
 	}

 	return &api.Machine{
@@ -57,26 +54,27 @@ func (s *Service) machineToApi(m *domain.Machine) *api.Machine {
 		EnabledRoutes:      m.AllowedPrefixes(),
 		AdvertisedExitNode: m.IsAdvertisedExitNode(),
 		EnabledExitNode:    m.IsAllowedExitNode(),
+		Authorized:         m.Authorized,
 	}
 }

 func (s *Service) ListMachines(ctx context.Context, req *connect.Request[api.ListMachinesRequest]) (*connect.Response[api.ListMachinesResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	machines, err := s.repository.ListMachineByTailnet(ctx, tailnet.ID)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	response := &api.ListMachinesResponse{}
@@ -92,15 +90,15 @@ func (s *Service) GetMachine(ctx context.Context, req *connect.Request[api.GetMa

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	return connect.NewResponse(&api.GetMachineResponse{Machine: s.machineToApi(m)}), nil
@@ -111,22 +109,22 @@ func (s *Service) DeleteMachine(ctx context.Context, req *connect.Request[api.De

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if _, err := s.repository.DeleteMachine(ctx, req.Msg.MachineId); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeersRemoved: []uint64{m.ID}})
+	s.sessionManager.NotifyAll(m.TailnetID)

 	return connect.NewResponse(&api.DeleteMachineResponse{}), nil
 }
@@ -136,15 +134,15 @@ func (s *Service) ExpireMachine(ctx context.Context, req *connect.Request[api.Ex

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	timestamp := time.Unix(123, 0)
@@ -152,23 +150,40 @@ func (s *Service) ExpireMachine(ctx context.Context, req *connect.Request[api.Ex
 	m.KeyExpiryDisabled = false

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

 	return connect.NewResponse(&api.ExpireMachineResponse{}), nil
 }

-func (s *Service) createMachineRoutesResponse(m *domain.Machine) (*connect.Response[api.GetMachineRoutesResponse], error) {
-	response := api.GetMachineRoutesResponse{
-		AdvertisedRoutes:   m.AdvertisedPrefixes(),
-		EnabledRoutes:      m.AllowedPrefixes(),
-		AdvertisedExitNode: m.IsAdvertisedExitNode(),
-		EnabledExitNode:    m.IsAllowedExitNode(),
+func (s *Service) AuthorizeMachine(ctx context.Context, req *connect.Request[api.AuthorizeMachineRequest]) (*connect.Response[api.AuthorizeMachineResponse], error) {
+	principal := CurrentPrincipal(ctx)
+
+	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
 	}

-	return connect.NewResponse(&response), nil
+	if m == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
+	}
+
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	if !m.Authorized {
+		m.Authorized = true
+		if err := s.repository.SaveMachine(ctx, m); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+	}
+
+	s.sessionManager.NotifyAll(m.TailnetID)
+
+	return connect.NewResponse(&api.AuthorizeMachineResponse{}), nil
 }

 func (s *Service) GetMachineRoutes(ctx context.Context, req *connect.Request[api.GetMachineRoutesRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
@@ -176,34 +191,44 @@ func (s *Service) GetMachineRoutes(ctx context.Context, req *connect.Request[api

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

-	return s.createMachineRoutesResponse(m)
+	response := api.GetMachineRoutesResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[api.EnableMachineRoutesRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[api.EnableMachineRoutesRequest]) (*connect.Response[api.EnableMachineRoutesResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	var allowIPs = domain.NewAllowIPsSet(m.AllowIPs)
@@ -217,7 +242,7 @@ func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[
 	for _, r := range req.Msg.Routes {
 		prefix, err := netip.ParsePrefix(r)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, 0)
 		}
 		allowIPs.Add(prefix)
 	}
@@ -225,28 +250,38 @@ func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[
 	m.AllowIPs = allowIPs.Items()
 	m.AutoAllowIPs = autoAllowIPs.Items()
 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.EnableMachineRoutesResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request[api.DisableMachineRoutesRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request[api.DisableMachineRoutesRequest]) (*connect.Response[api.DisableMachineRoutesResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	allowIPs := domain.NewAllowIPsSet(m.AllowIPs)
@@ -255,7 +290,7 @@ func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request
 	for _, r := range req.Msg.Routes {
 		prefix, err := netip.ParsePrefix(r)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, 0)
 		}
 		allowIPs.Remove(prefix)
 		autoAllowIPs.Remove(prefix)
@@ -264,32 +299,42 @@ func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request
 	m.AllowIPs = allowIPs.Items()
 	m.AutoAllowIPs = autoAllowIPs.Items()
 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.DisableMachineRoutesResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) EnableExitNode(ctx context.Context, req *connect.Request[api.EnableExitNodeRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) EnableExitNode(ctx context.Context, req *connect.Request[api.EnableExitNodeRequest]) (*connect.Response[api.EnableExitNodeResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if !m.IsAdvertisedExitNode() {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("machine is not a valid exit node"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("machine is not a valid exit node"))
 	}

 	prefix4 := netip.MustParsePrefix("0.0.0.0/0")
@@ -301,32 +346,42 @@ func (s *Service) EnableExitNode(ctx context.Context, req *connect.Request[api.E
 	m.AllowIPs = allowIPs.Items()

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.EnableExitNodeResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) DisableExitNode(ctx context.Context, req *connect.Request[api.DisableExitNodeRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) DisableExitNode(ctx context.Context, req *connect.Request[api.DisableExitNodeRequest]) (*connect.Response[api.DisableExitNodeResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if !m.IsAdvertisedExitNode() {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("machine is not a valid exit node"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("machine is not a valid exit node"))
 	}

 	prefix4 := netip.MustParsePrefix("0.0.0.0/0")
@@ -342,12 +397,22 @@ func (s *Service) DisableExitNode(ctx context.Context, req *connect.Request[api.
 	m.AutoAllowIPs = autoAllowIPs.Items()

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.DisableExitNodeResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

 func (s *Service) SetMachineKeyExpiry(ctx context.Context, req *connect.Request[api.SetMachineKeyExpiryRequest]) (*connect.Response[api.SetMachineKeyExpiryResponse], error) {
@@ -355,24 +420,24 @@ func (s *Service) SetMachineKeyExpiry(ctx context.Context, req *connect.Request[

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	m.KeyExpiryDisabled = req.Msg.Disabled

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

 	return connect.NewResponse(&api.SetMachineKeyExpiryResponse{}), nil
 }
@@ -3,28 +3,28 @@ package service
 import (
 	"context"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
+	"github.com/jsiebens/ionscale/internal/auth"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/domain"
-	"github.com/jsiebens/ionscale/internal/provider"
 	"github.com/jsiebens/ionscale/internal/version"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 )

-func NewService(config *config.Config, authProvider provider.AuthProvider, repository domain.Repository, pubsub broker.Pubsub) *Service {
+func NewService(config *config.Config, authProvider auth.Provider, repository domain.Repository, sessionManager core.PollMapSessionManager) *Service {
 	return &Service{
-		config:       config,
-		authProvider: authProvider,
-		repository:   repository,
-		pubsub:       pubsub,
+		config:         config,
+		authProvider:   authProvider,
+		repository:     repository,
+		sessionManager: sessionManager,
 	}
 }

 type Service struct {
-	config       *config.Config
-	authProvider provider.AuthProvider
-	repository   domain.Repository
-	pubsub       broker.Pubsub
+	config         *config.Config
+	authProvider   auth.Provider
+	repository     domain.Repository
+	sessionManager core.PollMapSessionManager
 }

 func (s *Service) GetVersion(_ context.Context, _ *connect.Request[api.GetVersionRequest]) (*connect.Response[api.GetVersionResponse], error) {
@@ -2,35 +2,42 @@ package service

 import (
 	"context"
-	"errors"
+	"encoding/json"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
+	"github.com/jsiebens/ionscale/internal/util"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+	"tailscale.com/tailcfg"
 )

 func (s *Service) CreateTailnet(ctx context.Context, req *connect.Request[api.CreateTailnetRequest]) (*connect.Response[api.CreateTailnetResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	name := req.Msg.Name
-	iamPolicy := domain.IAMPolicy{
-		Subs:    req.Msg.IamPolicy.Subs,
-		Emails:  req.Msg.IamPolicy.Emails,
-		Filters: req.Msg.IamPolicy.Filters,
-		Roles:   apiRolesMapToDomainRolesMap(req.Msg.IamPolicy.Roles),
+	iamPolicy := domain.IAMPolicy{}
+
+	if req.Msg.IamPolicy != nil {
+		iamPolicy.Subs = req.Msg.IamPolicy.Subs
+		iamPolicy.Emails = req.Msg.IamPolicy.Emails
+		iamPolicy.Filters = req.Msg.IamPolicy.Filters
+		iamPolicy.Roles = apiRolesMapToDomainRolesMap(req.Msg.IamPolicy.Roles)
 	}

-	tailnet, created, err := s.repository.GetOrCreateTailnet(ctx, name, iamPolicy)
-	if err != nil {
-		return nil, err
+	tailnet := &domain.Tailnet{
+		ID:        util.NextID(),
+		Name:      name,
+		IAMPolicy: iamPolicy,
+		ACLPolicy: domain.DefaultPolicy(),
+		DNSConfig: domain.DNSConfig{MagicDNS: true},
 	}

-	if !created {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("tailnet already exists"))
+	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+		return nil, errors.Wrap(err, 0)
 	}

 	resp := &api.CreateTailnetResponse{Tailnet: &api.Tailnet{
@@ -44,16 +51,16 @@ func (s *Service) CreateTailnet(ctx context.Context, req *connect.Request[api.Cr
 func (s *Service) GetTailnet(ctx context.Context, req *connect.Request[api.GetTailnetRequest]) (*connect.Response[api.GetTailnetResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.Id) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.Id)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	return connect.NewResponse(&api.GetTailnetResponse{Tailnet: &api.Tailnet{
@@ -62,15 +69,15 @@ func (s *Service) GetTailnet(ctx context.Context, req *connect.Request[api.GetTa
 	}}), nil
 }

-func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.ListTailnetRequest]) (*connect.Response[api.ListTailnetResponse], error) {
+func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.ListTailnetsRequest]) (*connect.Response[api.ListTailnetsResponse], error) {
 	principal := CurrentPrincipal(ctx)

-	resp := &api.ListTailnetResponse{}
+	resp := &api.ListTailnetsResponse{}

 	if principal.IsSystemAdmin() {
 		tailnets, err := s.repository.ListTailnets(ctx)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, 0)
 		}
 		for _, t := range tailnets {
 			gt := api.Tailnet{Id: t.ID, Name: t.Name}
@@ -81,7 +88,7 @@ func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.Lis
 	if principal.User != nil {
 		tailnet, err := s.repository.GetTailnet(ctx, principal.User.TailnetID)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, 0)
 		}
 		gt := api.Tailnet{Id: tailnet.ID, Name: tailnet.Name}
 		resp.Tailnet = append(resp.Tailnet, &gt)
@@ -93,12 +100,12 @@ func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.Lis
 func (s *Service) DeleteTailnet(ctx context.Context, req *connect.Request[api.DeleteTailnetRequest]) (*connect.Response[api.DeleteTailnetResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	count, err := s.repository.CountMachineByTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if !req.Msg.Force && count > 0 {
@@ -130,10 +137,304 @@ func (s *Service) DeleteTailnet(ctx context.Context, req *connect.Request[api.De
 	})

 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(req.Msg.TailnetId, &broker.Signal{})
+	s.sessionManager.NotifyAll(req.Msg.TailnetId)

 	return connect.NewResponse(&api.DeleteTailnetResponse{}), nil
 }
+
+func (s *Service) SetDERPMap(ctx context.Context, req *connect.Request[api.SetDERPMapRequest]) (*connect.Response[api.SetDERPMapResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	derpMap := tailcfg.DERPMap{}
+	if err := json.Unmarshal(req.Msg.Value, &derpMap); err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	tailnet.DERPMap = domain.DERPMap{
+		Checksum: util.Checksum(&derpMap),
+		DERPMap:  derpMap,
+	}
+
+	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	s.sessionManager.NotifyAll(tailnet.ID)
+
+	raw, err := json.Marshal(derpMap)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	return connect.NewResponse(&api.SetDERPMapResponse{Value: raw}), nil
+}
+
+func (s *Service) ResetDERPMap(ctx context.Context, req *connect.Request[api.ResetDERPMapRequest]) (*connect.Response[api.ResetDERPMapResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	tailnet.DERPMap = domain.DERPMap{}
+
+	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	s.sessionManager.NotifyAll(tailnet.ID)
+
+	return connect.NewResponse(&api.ResetDERPMapResponse{}), nil
+}
+
+func (s *Service) GetDERPMap(ctx context.Context, req *connect.Request[api.GetDERPMapRequest]) (*connect.Response[api.GetDERPMapResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	derpMap, err := tailnet.GetDERPMap(ctx, s.repository)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	raw, err := json.Marshal(derpMap.DERPMap)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+
+	return connect.NewResponse(&api.GetDERPMapResponse{Value: raw}), nil
+}
+
+func (s *Service) EnableFileSharing(ctx context.Context, req *connect.Request[api.EnableFileSharingRequest]) (*connect.Response[api.EnableFileSharingResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if !tailnet.FileSharingEnabled {
+		tailnet.FileSharingEnabled = true
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+
+		s.sessionManager.NotifyAll(tailnet.ID)
+	}
+
+	return connect.NewResponse(&api.EnableFileSharingResponse{}), nil
+}
+
+func (s *Service) DisableFileSharing(ctx context.Context, req *connect.Request[api.DisableFileSharingRequest]) (*connect.Response[api.DisableFileSharingResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if tailnet.FileSharingEnabled {
+		tailnet.FileSharingEnabled = false
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+
+		s.sessionManager.NotifyAll(tailnet.ID)
+	}
+
+	return connect.NewResponse(&api.DisableFileSharingResponse{}), nil
+}
+
+func (s *Service) EnableServiceCollection(ctx context.Context, req *connect.Request[api.EnableServiceCollectionRequest]) (*connect.Response[api.EnableServiceCollectionResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if !tailnet.ServiceCollectionEnabled {
+		tailnet.ServiceCollectionEnabled = true
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+
+		s.sessionManager.NotifyAll(tailnet.ID)
+	}
+
+	return connect.NewResponse(&api.EnableServiceCollectionResponse{}), nil
+}
+
+func (s *Service) DisableServiceCollection(ctx context.Context, req *connect.Request[api.DisableServiceCollectionRequest]) (*connect.Response[api.DisableServiceCollectionResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if tailnet.ServiceCollectionEnabled {
+		tailnet.ServiceCollectionEnabled = false
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+
+		s.sessionManager.NotifyAll(tailnet.ID)
+	}
+
+	return connect.NewResponse(&api.DisableServiceCollectionResponse{}), nil
+}
+
+func (s *Service) EnableSSH(ctx context.Context, req *connect.Request[api.EnableSSHRequest]) (*connect.Response[api.EnableSSHResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if !tailnet.SSHEnabled {
+		tailnet.SSHEnabled = true
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+
+		s.sessionManager.NotifyAll(tailnet.ID)
+	}
+
+	return connect.NewResponse(&api.EnableSSHResponse{}), nil
+}
+
+func (s *Service) DisableSSH(ctx context.Context, req *connect.Request[api.DisableSSHRequest]) (*connect.Response[api.DisableSSHResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if tailnet.SSHEnabled {
+		tailnet.SSHEnabled = false
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+
+		s.sessionManager.NotifyAll(tailnet.ID)
+	}
+
+	return connect.NewResponse(&api.DisableSSHResponse{}), nil
+}
+
+func (s *Service) EnableMachineAuthorization(ctx context.Context, req *connect.Request[api.EnableMachineAuthorizationRequest]) (*connect.Response[api.EnableMachineAuthorizationResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if !tailnet.MachineAuthorizationEnabled {
+		tailnet.MachineAuthorizationEnabled = true
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+	}
+
+	return connect.NewResponse(&api.EnableMachineAuthorizationResponse{}), nil
+}
+
+func (s *Service) DisableMachineAuthorization(ctx context.Context, req *connect.Request[api.DisableMachineAuthorizationRequest]) (*connect.Response[api.DisableMachineAuthorizationResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, errors.Wrap(err, 0)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if tailnet.MachineAuthorizationEnabled {
+		tailnet.MachineAuthorizationEnabled = false
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, errors.Wrap(err, 0)
+		}
+	}
+
+	return connect.NewResponse(&api.DisableMachineAuthorizationResponse{}), nil
+}
@@ -2,10 +2,10 @@ package service

 import (
 	"context"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/errors"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 )

@@ -14,20 +14,20 @@ func (s *Service) ListUsers(ctx context.Context, req *connect.Request[api.ListUs

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(tailnet.ID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	users, err := s.repository.ListUsers(ctx, tailnet.ID)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	resp := &api.ListUsersResponse{}
@@ -46,20 +46,24 @@ func (s *Service) DeleteUser(ctx context.Context, req *connect.Request[api.Delet
 	principal := CurrentPrincipal(ctx)

 	if !principal.IsSystemAdmin() && principal.UserMatches(req.Msg.UserId) {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("unable delete yourself"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("unable to delete yourself"))
 	}

 	user, err := s.repository.GetUser(ctx, req.Msg.UserId)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

 	if user == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("user not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("user not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(user.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	if user.UserType == domain.UserTypeService {
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("unable delete service account"))
 	}

 	err = s.repository.Transaction(func(tx domain.Repository) error {
@@ -83,10 +87,10 @@ func (s *Service) DeleteUser(ctx context.Context, req *connect.Request[api.Delet
 	})

 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, 0)
 	}

-	s.pubsub.Publish(user.TailnetID, &broker.Signal{})
+	s.sessionManager.NotifyAll(user.TailnetID)

 	return connect.NewResponse(&api.DeleteUserResponse{}), nil
 }
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        @import url('https://fonts.googleapis.com/css2?family=Poppins:wght@200;300;400;500;600;700&display=swap');
+
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+            font-family: 'Poppins', sans-serif;
+        }
+
+        body {
+            width: 100%;
+            height: 100vh;
+            padding: 10px;
+            background: #379683;
+        }
+
+        .wrapper {
+            background: #fff;
+            max-width: 400px;
+            width: 100%;
+            margin: 120px auto;
+            padding: 25px;
+            border-radius: 5px;
+            box-shadow: 0 10px 15px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li {
+            position: relative;
+            list-style: none;
+            height: 45px;
+            line-height: 45px;
+            margin-bottom: 8px;
+            background: #f2f2f2;
+            border-radius: 3px;
+            overflow: hidden;
+            box-shadow: 0 2px 2px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li button {
+            margin: 0;
+            display: block;
+            width: 100%;
+            height: 100%;
+            border: none;
+        }
+    </style>
+    <title>ionscale</title>
+</head>
+<body>
+<div class="wrapper">
+    <div style="text-align: center">
+        <p><b>Authentication successful</b></p>
+        <small>but this is a <b style="color: blue">new machine</b> and needs to be authorized by your Tailnet admin.</small>
+    </div>
+</div>
+</body>
+</html>
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        @import url('https://fonts.googleapis.com/css2?family=Poppins:wght@200;300;400;500;600;700&display=swap');
+
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+            font-family: 'Poppins', sans-serif;
+        }
+
+        body {
+            width: 100%;
+            height: 100vh;
+            padding: 10px;
+            background: #379683;
+        }
+
+        .wrapper {
+            background: #fff;
+            max-width: 400px;
+            width: 100%;
+            margin: 120px auto;
+            padding: 25px;
+            border-radius: 5px;
+            box-shadow: 0 10px 15px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li {
+            position: relative;
+            list-style: none;
+            height: 45px;
+            line-height: 45px;
+            margin-bottom: 8px;
+            background: #f2f2f2;
+            border-radius: 3px;
+            overflow: hidden;
+            box-shadow: 0 2px 2px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li button {
+            margin: 0;
+            display: block;
+            width: 100%;
+            height: 100%;
+            border: none;
+        }
+    </style>
+    <title>ionscale</title>
+</head>
+<body>
+<div class="wrapper">
+    <div style="text-align: center">
+        <p><b>Authentication successful</b></p>
+        <small>but you're <b style="color: red">not</b> a valid owner of the machine</small>
+    </div>
+</div>
+</body>
+</html>
@@ -1,36 +1,60 @@
 package util

 import (
-	"math/rand"
-	"time"
+	"crypto/md5"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/hex"
+	"encoding/json"
+	"math/big"
 )

-var entropy *rand.Rand
-
-func init() {
-	seed := time.Now().UnixNano()
-	source := rand.NewSource(seed)
-	entropy = rand.New(source)
-}
-
 const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"

 func RandStringBytes(n int) string {
 	b := make([]byte, n)
 	for i := range b {
-		b[i] = letterBytes[rand.Intn(len(letterBytes))]
+		idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(letterBytes))))
+		if err != nil {
+			panic(err)
+		}
+		b[i] = letterBytes[idx.Int64()]
 	}
 	return string(b)
 }

 func RandUint64(n uint64) uint64 {
-	return entropy.Uint64() % n
+	val, err := rand.Int(rand.Reader, big.NewInt(int64(n)))
+	if err != nil {
+		panic(err)
+	}
+	return val.Uint64()
 }

 func RandomBytes(size int) ([]byte, error) {
 	buf := make([]byte, size)
-	if _, err := entropy.Read(buf); err != nil {
+	if _, err := rand.Read(buf); err != nil {
 		return nil, err
 	}
 	return buf, nil
 }
+
+func NewPrivateKey() (*rsa.PrivateKey, string, error) {
+	id := RandStringBytes(22)
+
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return privateKey, id, nil
+}
+
+func Checksum(v interface{}) string {
+	marshal, err := json.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	sum := md5.Sum(marshal)
+	return hex.EncodeToString(sum[:])
+}
@@ -0,0 +1,2 @@
+serve:
+	docker run --rm -it -p 8000:8000 -v ${PWD}:/docs squidfunk/mkdocs-material
@@ -0,0 +1,105 @@
+# Configuration Reference
+
+__ionscale__ uses the YAML file format for configuration. 
+A full configuration reference file is shown below, this provides comments and all available options.
+
+```yaml
+# The address to bind to for HTTP.
+http_listen_addr: ":8080"
+
+# The address to bind to for HTTPS.
+https_listen_addr: "8443"
+
+# The address to bind to for the metrics.
+metrics_listen_addr: ":9091"
+
+# The public URL at which the ionscale server can be reached by clients and the CLI.
+server_url: "https://ionscale.example.com"
+
+tls:
+  # Disable TLS (not recommended)
+  # Use this flag to disable TLS e.g. when running behind a reverse proxy
+  disable: false
+  # Redirect HTTP requests to HTTPS requests
+  force_https: true
+  # The path to the certificate for TLS.
+  # Required when TLS is enabled and ACME disabled
+  cert_file: ""
+  # The path to the private key for the certificate.
+  # Required when TLS is enabled and ACME disabled
+  key_file: ""
+  # Enable automatic TLS certificates provisioning with Let's Encrypt
+  acme_enabled: false
+  # An email address, used when creating an ACME account and keeping you up-to-date regarding your certificates
+  acme_email: ""
+  # The URL to the ACME CA's directory.
+  acme_ca: "https://acme-v02.api.letsencrypt.org/directory"
+  # Path to store certificates and metadata needed by ACME
+  amce_path: "./data"
+
+database:
+  # Type of databas to use, supported values are sqlite or postgres
+  type: "sqlite"
+  # The URL for connecting to the database
+  # e.g
+  # url: "/data/ionscale.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)"
+  # url: "postgres://ionscale:ionscale@localhost/ionscale?sslmode=disable"
+  url: "./ionscale.db"
+
+keys:
+  # A private, 32 bytes in hex, system admin key
+  # Use this key with the CLI when configuring system-wide resources like tailnets
+  # A key can be generated by:
+  # - ionscale genkey
+  # - openssl rand -hex 32
+  system_admin_key: ""
+
+poll_net:
+  # Period to send keep alive messages to the connected devices
+  keep_alive_interval: "60s"
+
+# Optional authentication configuration
+auth:
+  # OIDC provider configuration
+  provider:
+    # OIDC issuer URL where ionscale can find the OpenID Provider Configuration Document
+    issuer: ""
+    # OIDC client id and secrets
+    client_id: ""
+    client_secret: ""
+    # additional OIDC scopes used in the OIDC flow
+    additional_scopes: ""
+  # IAM policy to mark some authenticated users as System Admin
+  system_admins:
+    # A list of emails of users that are System Admin
+    emails: []
+    # A list of ID (sub OIDC claim) of users that are System Admin
+    subs: []
+    # A list of BEXPR filters to mark authenticated users as System Admin
+    filters: []
+
+dns:
+  # The base domain of the MagicDNS FQDN hostnames
+  magic_dns_suffix: "ionscale.net"
+  # A DNS provider for setting public TXT records
+  # This is a requirement to enable Tailscale HTTPS certs.
+  provider:
+    # name of your provider, currently supported implementations:
+    # - azure (https://github.com/libdns/azure)
+    # - cloudflare (https://github.com/libdns/cloudflare)
+    # - digitialocean (https://github.com/libdns/digitalocean)
+    # - googleclouddns (https://github.com/libdns/googleclouddns)
+    # - route53 (https://github.com/libdns/route53)
+    name: ""
+    # DNS zone
+    zone: ""
+    # Provider specific configuration
+    config: {}
+
+logging:
+  # Output formatting for logs: text or json
+  format: "text"
+  level: "info"
+  # Path of a target log file, if omitted logs are written to stdout
+  file: ""
+```
@@ -0,0 +1,72 @@
+# Getting started with Docker
+
+You can install and run __ionscale__ using the Docker images published on [GitHub Container Registry](https://github.com/jsiebens/ionscale/pkgs/container/ionscale).
+
+## Requirements 
+
+- A Linux machine with port 80 and 443 open to ingress traffic.
+- Docker installed. See the [official installation documentation](https://docs.docker.com/install/)
+- A registered domain name.
+
+## Step 1. Configure DNS
+
+Set up a `A` DNS records: `ionscale.example.com` (We are assuming that your domain name is example.com.)
+
+!!! tip
+
+    You can use `dig` to make sure that DNS records are propagated:
+
+    ``` bash
+    $ dig ionscale.example.com
+    ```
+
+## Step 2. Run ionscale with Docker
+
+### Configure ionscale
+
+``` bash
+mkdir -p ionscale/data
+cd ./ionscale
+```
+
+Generate a configuration file for __ionscale__ with the following commands:
+
+``` bash
+export IONSCALE_DOMAIN=example.com
+export IONSCALE_ACME_EMAIL=<your email>
+```
+
+``` bash
+tee ./config.yaml >/dev/null <<EOF
+http_listen_addr: ":80"
+https_listen_addr: ":443"
+server_url: "https://${IONSCALE_DOMAIN}"
+
+tls:
+  acme: true
+  acme_email: "${IONSCALE_ACME_EMAIL}"
+  acme_path: "/data/acme"
+
+keys:
+  system_admin_key: "$(ionscale genkey -n)"
+  
+database:
+  url: "/data/ionscale.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)"
+
+logging:
+  level: info
+EOF
+```
+
+### Start ionscale
+
+Run an __ionscale__ instance with the following command:
+
+``` bash
+docker run \
+  -v $(pwd)/config.yaml:/etc/ionscale/config.yaml \
+  -v $(pwd)/data:/data \
+  -p 80:80 \
+  -p 443:443 \
+  ghcr.io/jsiebens/ionscale:0.5.0 server --config /etc/ionscale/config.yaml
+```
@@ -0,0 +1,116 @@
+# Getting started on a Linux Server
+
+This tutorial will guide you through the steps needed to install and run __ionscale__ on a Linux machine.
+
+## Prerequisites 
+
+- A Linux machine with port 80 and 443 open to ingress traffic.
+- A registered domain name.
+
+## Step 1. Configure DNS
+
+Set up a `A` DNS records: `ionscale.example.com` (We are assuming that your domain name is example.com.)
+
+!!! tip
+
+    You can use `dig` to make sure that DNS records are propagated:
+
+    ``` bash
+    $ dig ionscale.example.com
+    ```
+
+## Step 2. Set up ionscale on your Linux host
+
+### Prepare installation
+
+Run the following commands to prepare the installation:
+
+``` bash
+sudo mkdir -p /etc/ionscale
+sudo mkdir -p /var/lib/ionscale
+
+sudo useradd --system --no-create-home --shell /bin/false ionscale
+sudo chown ionscale:ionscale /etc/ionscale
+sudo chown ionscale:ionscale /var/lib/ionscale
+```
+
+### Install ionscale
+
+Run the following commands to install the __ionscale__ binary on your Linux host:
+
+``` bash
+sudo curl \
+    -o "/usr/local/bin/ionscale" \
+    -sfL "https://github.com/jsiebens/ionscale/releases/download/v0.5.0/ionscale_linux_amd64"
+
+sudo chmod +x "/usr/local/bin/ionscale"
+```
+
+### Configure ionscale
+
+Generate a system admin key for __ionscale__ using the `ionscale genkey` command and write it the an environment file:
+
+``` bash
+sudo tee /etc/default/ionscale >/dev/null <<EOF
+IONSCALE_KEYS_SYSTEM_ADMIN_KEY=$(ionscale genkey -n)
+EOF
+```
+
+Generate a configuration file for __ionscale__ with the following commands:
+
+``` bash
+export IONSCALE_DOMAIN=example.com
+export IONSCALE_ACME_EMAIL=<your email>
+```
+
+``` bash
+sudo tee /etc/ionscale/config.yaml >/dev/null <<EOF
+http_listen_addr: ":80"
+https_listen_addr: ":443"
+server_url: "https://${IONSCALE_DOMAIN}"
+
+tls:
+  acme: true
+  acme_email: "${IONSCALE_ACME_EMAIL}"
+  acme_path: "/var/lib/ionscale/acme"
+
+database:
+  url: "/var/lib/ionscale/ionscale.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)"
+
+logging:
+  level: info
+EOF
+```
+
+Create a systemd service file for __ionscale__ with the following commands:
+
+``` bash
+sudo tee /etc/systemd/system/ionscale.service >/dev/null <<EOF
+[Unit]
+Description=ionscale - a Tailscale Controller server
+Requires=network-online.target
+After=network.target
+
+[Service]
+EnvironmentFile=/etc/default/ionscale
+User=ionscale
+Group=ionscale
+ExecStart=/usr/local/bin/ionscale server --config /etc/ionscale/config.yaml
+Restart=on-failure
+RestartSec=10s
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+EOF
+```
+
+### Start ionscale
+
+On your Linux machine, run the following commands to enable and start the __ionscale__ daemon:
+
+``` bash
+sudo systemctl daemon-reload
+sudo systemctl enable ionscale
+sudo systemctl start ionscale
+```
@@ -0,0 +1,35 @@
+# ionscale
+
+> **Note**:
+> ionscale is currently beta quality, actively being developed and so subject to changes
+
+**What is Tailscale?**
+
+[Tailscale](https://tailscale.com) is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly.
+It enables encrypted point-to-point connections using the open source [WireGuard](https://www.wireguard.com/) protocol, which means only devices on your private network can communicate with each other.
+
+**What is ionscale?**
+
+While the Tailscale software running on each node is open source, their centralized "coordination server" which act as a shared drop box for public keys is not.
+
+_ionscale_ aims to implement such lightweight, open source alternative Tailscale control server.
+
+## Features
+
+- multi [tailnet](https://tailscale.com/kb/1136/tailnet/) support
+- multi user support
+- OIDC integration (not required, although recommended)
+- [Auth keys](https://tailscale.com/kb/1085/auth-keys/)
+- [Access control list](https://tailscale.com/kb/1018/acls/)
+- [DNS](https://tailscale.com/kb/1054/dns/)
+    - nameservers
+    - Split DNS
+    - MagicDNS
+- [HTTPS Certs](https://tailscale.com/kb/1153/enabling-https/)
+- [Tailscale SSH](https://tailscale.com/kb/1193/tailscale-ssh/)
+- [Service collection](https://tailscale.com/kb/1100/services/)
+- [Taildrop](https://tailscale.com/kb/1106/taildrop/)
+
+## Disclaimer
+
+This is not an official Tailscale or Tailscale Inc. project.
@@ -0,0 +1,56 @@
+site_name: ionscale
+
+repo_name: jsiebens/ionscale
+repo_url: https://github.com/jsiebens/ionscale
+edit_uri: ""
+
+nav:
+  - Overview:
+      - Introduction: index.md
+  - Installation:
+      - Manual: ./getting-started/manual.md
+      - Docker: ./getting-started/docker.md
+  - Configuration:
+      - Reference: ./configuration/reference.md
+
+theme:
+  name: material
+  custom_dir: overrides
+
+  palette:
+    - scheme: default
+      toggle:
+        icon: material/toggle-switch-off-outline
+        name: Switch to dark mode
+    - scheme: slate
+      toggle:
+        icon: material/toggle-switch
+        name: Switch to light mode
+
+  font:
+    text: Lato
+    code: Roboto Mono
+
+  features:
+    - navigation.tracking
+    - navigation.sections
+    - toc.integrate
+
+  include_search_page: false
+  search_index_only: true
+
+  language: en
+
+markdown_extensions:
+  - admonition
+  - pymdownx.details
+  - pymdownx.superfences
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.superfences
+
+extra:
+  analytics:
+    provider: custom
@@ -0,0 +1 @@
+<script defer data-domain="jsiebens.github.io" src="https://plausible.io/js/plausible.js"></script>
@@ -217,7 +217,8 @@ type ACLPolicy struct {
 	Groups        map[string]*structpb.ListValue `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	Acls          []*ACL                         `protobuf:"bytes,3,rep,name=acls,proto3" json:"acls,omitempty"`
 	Tagowners     map[string]*structpb.ListValue `protobuf:"bytes,4,rep,name=tagowners,proto3" json:"tagowners,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	Autoapprovers *AutoApprovers                 `protobuf:"bytes,5,opt,name=autoapprovers,proto3" json:"autoapprovers,omitempty"`
+	Autoapprovers *AutoApprovers                 `protobuf:"bytes,5,opt,name=autoapprovers,proto3,oneof" json:"autoapprovers,omitempty"`
+	Ssh           []*SSHRule                     `protobuf:"bytes,6,rep,name=ssh,proto3" json:"ssh,omitempty"`
 }

 func (x *ACLPolicy) Reset() {
@@ -287,6 +288,13 @@ func (x *ACLPolicy) GetAutoapprovers() *AutoApprovers {
 	return nil
 }

+func (x *ACLPolicy) GetSsh() []*SSHRule {
+	if x != nil {
+		return x.Ssh
+	}
+	return nil
+}
+
 type ACL struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -405,6 +413,77 @@ func (x *AutoApprovers) GetExitnode() []string {
 	return nil
 }

+type SSHRule struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Action string   `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
+	Src    []string `protobuf:"bytes,2,rep,name=src,proto3" json:"src,omitempty"`
+	Dst    []string `protobuf:"bytes,3,rep,name=dst,proto3" json:"dst,omitempty"`
+	Users  []string `protobuf:"bytes,4,rep,name=users,proto3" json:"users,omitempty"`
+}
+
+func (x *SSHRule) Reset() {
+	*x = SSHRule{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_acl_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SSHRule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SSHRule) ProtoMessage() {}
+
+func (x *SSHRule) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_acl_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SSHRule.ProtoReflect.Descriptor instead.
+func (*SSHRule) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_acl_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *SSHRule) GetAction() string {
+	if x != nil {
+		return x.Action
+	}
+	return ""
+}
+
+func (x *SSHRule) GetSrc() []string {
+	if x != nil {
+		return x.Src
+	}
+	return nil
+}
+
+func (x *SSHRule) GetDst() []string {
+	if x != nil {
+		return x.Dst
+	}
+	return nil
+}
+
+func (x *SSHRule) GetUsers() []string {
+	if x != nil {
+		return x.Users
+	}
+	return nil
+}
+
 var File_ionscale_v1_acl_proto protoreflect.FileDescriptor

 var file_ionscale_v1_acl_proto_rawDesc = []byte{
@@ -412,78 +491,87 @@ var file_ionscale_v1_acl_proto_rawDesc = []byte{
 	0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
 	0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f,
-	0x72, 0x65, 0x66, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74,
-	0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22,
-	0x46, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52,
-	0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x41, 0x43,
-	0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
-	0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a,
-	0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x16, 0x0a,
-	0x14, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x98, 0x04, 0x0a, 0x09, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x12, 0x37, 0x0a, 0x05, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x12, 0x3a, 0x0a, 0x06,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x24, 0x0a, 0x04, 0x61, 0x63, 0x6c, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x52, 0x04, 0x61, 0x63, 0x6c, 0x73, 0x12, 0x43,
-	0x0a, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x73, 0x12, 0x40, 0x0a, 0x0d, 0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72, 0x6f,
-	0x76, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70,
-	0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72,
-	0x6f, 0x76, 0x65, 0x72, 0x73, 0x1a, 0x38, 0x0a, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x73, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a,
-	0x55, 0x0a, 0x0b, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x74, 0x6f, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x46, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x41,
+	0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x2e, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41,
+	0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x16, 0x0a, 0x14, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xd7,
+	0x04, 0x0a, 0x09, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x37, 0x0a, 0x05,
+	0x68, 0x6f, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05,
+	0x68, 0x6f, 0x73, 0x74, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x12, 0x24, 0x0a, 0x04, 0x61, 0x63, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43,
+	0x4c, 0x52, 0x04, 0x61, 0x63, 0x6c, 0x73, 0x12, 0x43, 0x0a, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x45, 0x0a, 0x0d,
+	0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x48,
+	0x00, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73,
+	0x88, 0x01, 0x01, 0x12, 0x26, 0x0a, 0x03, 0x73, 0x73, 0x68, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53,
+	0x53, 0x48, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x03, 0x73, 0x73, 0x68, 0x1a, 0x38, 0x0a, 0x0a, 0x48,
+	0x6f, 0x73, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x55, 0x0a, 0x0b, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x58, 0x0a, 0x0e,
+	0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
 	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
 	0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
 	0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x58, 0x0a, 0x0e, 0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x61,
+	0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x22, 0x41, 0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12,
+	0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x72, 0x63, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x73, 0x72, 0x63, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x74,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x64, 0x73, 0x74, 0x22, 0xc2, 0x01, 0x0a, 0x0d,
+	0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3e, 0x0a,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f,
+	0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1a, 0x0a,
+	0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64, 0x65, 0x1a, 0x55, 0x0a, 0x0b, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61,
 	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
 	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74,
 	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
-	0x22, 0x41, 0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x10, 0x0a, 0x03, 0x73, 0x72, 0x63, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x73, 0x72,
-	0x63, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x74, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03,
-	0x64, 0x73, 0x74, 0x22, 0xc2, 0x01, 0x0a, 0x0d, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72,
-	0x6f, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3e, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72,
-	0x73, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x72,
-	0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64,
-	0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64,
-	0x65, 0x1a, 0x55, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e,
-	0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x22, 0x5b, 0x0a, 0x07, 0x53, 0x53, 0x48, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x72, 0x63, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x03, 0x73, 0x72, 0x63, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x74, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x03, 0x64, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x42, 0x3d, 0x5a,
+	0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65,
+	0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b,
+	0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76,
+	0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -498,7 +586,7 @@ func file_ionscale_v1_acl_proto_rawDescGZIP() []byte {
 	return file_ionscale_v1_acl_proto_rawDescData
 }

-var file_ionscale_v1_acl_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_ionscale_v1_acl_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
 var file_ionscale_v1_acl_proto_goTypes = []interface{}{
 	(*GetACLPolicyRequest)(nil),  // 0: ionscale.v1.GetACLPolicyRequest
 	(*GetACLPolicyResponse)(nil), // 1: ionscale.v1.GetACLPolicyResponse
@@ -507,29 +595,31 @@ var file_ionscale_v1_acl_proto_goTypes = []interface{}{
 	(*ACLPolicy)(nil),            // 4: ionscale.v1.ACLPolicy
 	(*ACL)(nil),                  // 5: ionscale.v1.ACL
 	(*AutoApprovers)(nil),        // 6: ionscale.v1.AutoApprovers
-	nil,                          // 7: ionscale.v1.ACLPolicy.HostsEntry
-	nil,                          // 8: ionscale.v1.ACLPolicy.GroupsEntry
-	nil,                          // 9: ionscale.v1.ACLPolicy.TagownersEntry
-	nil,                          // 10: ionscale.v1.AutoApprovers.RoutesEntry
-	(*structpb.ListValue)(nil),   // 11: google.protobuf.ListValue
+	(*SSHRule)(nil),              // 7: ionscale.v1.SSHRule
+	nil,                          // 8: ionscale.v1.ACLPolicy.HostsEntry
+	nil,                          // 9: ionscale.v1.ACLPolicy.GroupsEntry
+	nil,                          // 10: ionscale.v1.ACLPolicy.TagownersEntry
+	nil,                          // 11: ionscale.v1.AutoApprovers.RoutesEntry
+	(*structpb.ListValue)(nil),   // 12: google.protobuf.ListValue
 }
 var file_ionscale_v1_acl_proto_depIdxs = []int32{
 	4,  // 0: ionscale.v1.GetACLPolicyResponse.policy:type_name -> ionscale.v1.ACLPolicy
 	4,  // 1: ionscale.v1.SetACLPolicyRequest.policy:type_name -> ionscale.v1.ACLPolicy
-	7,  // 2: ionscale.v1.ACLPolicy.hosts:type_name -> ionscale.v1.ACLPolicy.HostsEntry
-	8,  // 3: ionscale.v1.ACLPolicy.groups:type_name -> ionscale.v1.ACLPolicy.GroupsEntry
+	8,  // 2: ionscale.v1.ACLPolicy.hosts:type_name -> ionscale.v1.ACLPolicy.HostsEntry
+	9,  // 3: ionscale.v1.ACLPolicy.groups:type_name -> ionscale.v1.ACLPolicy.GroupsEntry
 	5,  // 4: ionscale.v1.ACLPolicy.acls:type_name -> ionscale.v1.ACL
-	9,  // 5: ionscale.v1.ACLPolicy.tagowners:type_name -> ionscale.v1.ACLPolicy.TagownersEntry
+	10, // 5: ionscale.v1.ACLPolicy.tagowners:type_name -> ionscale.v1.ACLPolicy.TagownersEntry
 	6,  // 6: ionscale.v1.ACLPolicy.autoapprovers:type_name -> ionscale.v1.AutoApprovers
-	10, // 7: ionscale.v1.AutoApprovers.routes:type_name -> ionscale.v1.AutoApprovers.RoutesEntry
-	11, // 8: ionscale.v1.ACLPolicy.GroupsEntry.value:type_name -> google.protobuf.ListValue
-	11, // 9: ionscale.v1.ACLPolicy.TagownersEntry.value:type_name -> google.protobuf.ListValue
-	11, // 10: ionscale.v1.AutoApprovers.RoutesEntry.value:type_name -> google.protobuf.ListValue
-	11, // [11:11] is the sub-list for method output_type
-	11, // [11:11] is the sub-list for method input_type
-	11, // [11:11] is the sub-list for extension type_name
-	11, // [11:11] is the sub-list for extension extendee
-	0,  // [0:11] is the sub-list for field type_name
+	7,  // 7: ionscale.v1.ACLPolicy.ssh:type_name -> ionscale.v1.SSHRule
+	11, // 8: ionscale.v1.AutoApprovers.routes:type_name -> ionscale.v1.AutoApprovers.RoutesEntry
+	12, // 9: ionscale.v1.ACLPolicy.GroupsEntry.value:type_name -> google.protobuf.ListValue
+	12, // 10: ionscale.v1.ACLPolicy.TagownersEntry.value:type_name -> google.protobuf.ListValue
+	12, // 11: ionscale.v1.AutoApprovers.RoutesEntry.value:type_name -> google.protobuf.ListValue
+	12, // [12:12] is the sub-list for method output_type
+	12, // [12:12] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }

 func init() { file_ionscale_v1_acl_proto_init() }
@@ -537,7 +627,6 @@ func file_ionscale_v1_acl_proto_init() {
 	if File_ionscale_v1_acl_proto != nil {
 		return
 	}
-	file_ionscale_v1_ref_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_ionscale_v1_acl_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetACLPolicyRequest); i {
@@ -623,14 +712,27 @@ func file_ionscale_v1_acl_proto_init() {
 				return nil
 			}
 		}
+		file_ionscale_v1_acl_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SSHRule); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
+	file_ionscale_v1_acl_proto_msgTypes[4].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_ionscale_v1_acl_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   11,
+			NumMessages:   12,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -20,14 +20,14 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )

-type AuthenticationRequest struct {
+type AuthenticateRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 }

-func (x *AuthenticationRequest) Reset() {
-	*x = AuthenticationRequest{}
+func (x *AuthenticateRequest) Reset() {
+	*x = AuthenticateRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_auth_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -35,13 +35,13 @@ func (x *AuthenticationRequest) Reset() {
 	}
 }

-func (x *AuthenticationRequest) String() string {
+func (x *AuthenticateRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*AuthenticationRequest) ProtoMessage() {}
+func (*AuthenticateRequest) ProtoMessage() {}

-func (x *AuthenticationRequest) ProtoReflect() protoreflect.Message {
+func (x *AuthenticateRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_auth_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -53,12 +53,12 @@ func (x *AuthenticationRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use AuthenticationRequest.ProtoReflect.Descriptor instead.
-func (*AuthenticationRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use AuthenticateRequest.ProtoReflect.Descriptor instead.
+func (*AuthenticateRequest) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_auth_proto_rawDescGZIP(), []int{0}
 }

-type AuthenticationResponse struct {
+type AuthenticateResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -68,8 +68,8 @@ type AuthenticationResponse struct {
 	TailnetId *uint64 `protobuf:"varint,3,opt,name=tailnet_id,json=tailnetId,proto3,oneof" json:"tailnet_id,omitempty"`
 }

-func (x *AuthenticationResponse) Reset() {
-	*x = AuthenticationResponse{}
+func (x *AuthenticateResponse) Reset() {
+	*x = AuthenticateResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_auth_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -77,13 +77,13 @@ func (x *AuthenticationResponse) Reset() {
 	}
 }

-func (x *AuthenticationResponse) String() string {
+func (x *AuthenticateResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*AuthenticationResponse) ProtoMessage() {}
+func (*AuthenticateResponse) ProtoMessage() {}

-func (x *AuthenticationResponse) ProtoReflect() protoreflect.Message {
+func (x *AuthenticateResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_auth_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -95,26 +95,26 @@ func (x *AuthenticationResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use AuthenticationResponse.ProtoReflect.Descriptor instead.
-func (*AuthenticationResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use AuthenticateResponse.ProtoReflect.Descriptor instead.
+func (*AuthenticateResponse) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_auth_proto_rawDescGZIP(), []int{1}
 }

-func (x *AuthenticationResponse) GetAuthUrl() string {
+func (x *AuthenticateResponse) GetAuthUrl() string {
 	if x != nil {
 		return x.AuthUrl
 	}
 	return ""
 }

-func (x *AuthenticationResponse) GetToken() string {
+func (x *AuthenticateResponse) GetToken() string {
 	if x != nil {
 		return x.Token
 	}
 	return ""
 }

-func (x *AuthenticationResponse) GetTailnetId() uint64 {
+func (x *AuthenticateResponse) GetTailnetId() uint64 {
 	if x != nil && x.TailnetId != nil {
 		return *x.TailnetId
 	}
@@ -126,21 +126,20 @@ var File_ionscale_v1_auth_proto protoreflect.FileDescriptor
 var file_ionscale_v1_auth_proto_rawDesc = []byte{
 	0x0a, 0x16, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75,
 	0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x22, 0x17, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x7c,
-	0x0a, 0x16, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68,
-	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68,
-	0x55, 0x72, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x61, 0x69,
-	0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x48, 0x00, 0x52,
-	0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a,
-	0x0b, 0x5f, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x42, 0x3d, 0x5a, 0x3b,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62,
-	0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67,
-	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31,
-	0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x22, 0x15, 0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x7a, 0x0a, 0x14,
+	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x75, 0x72, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x55, 0x72, 0x6c, 0x12,
+	0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x48, 0x00, 0x52, 0x09, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e,
+	0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -157,8 +156,8 @@ func file_ionscale_v1_auth_proto_rawDescGZIP() []byte {

 var file_ionscale_v1_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_ionscale_v1_auth_proto_goTypes = []interface{}{
-	(*AuthenticationRequest)(nil),  // 0: ionscale.v1.AuthenticationRequest
-	(*AuthenticationResponse)(nil), // 1: ionscale.v1.AuthenticationResponse
+	(*AuthenticateRequest)(nil),  // 0: ionscale.v1.AuthenticateRequest
+	(*AuthenticateResponse)(nil), // 1: ionscale.v1.AuthenticateResponse
 }
 var file_ionscale_v1_auth_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for method output_type
@@ -175,7 +174,7 @@ func file_ionscale_v1_auth_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_ionscale_v1_auth_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticationRequest); i {
+			switch v := v.(*AuthenticateRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -187,7 +186,7 @@ func file_ionscale_v1_auth_proto_init() {
 			}
 		}
 		file_ionscale_v1_auth_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticationResponse); i {
+			switch v := v.(*AuthenticateResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -74,7 +74,7 @@ type GetAuthKeyResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	AuthKey *AuthKey `protobuf:"bytes,1,opt,name=authKey,proto3" json:"authKey,omitempty"`
+	AuthKey *AuthKey `protobuf:"bytes,1,opt,name=auth_key,json=authKey,proto3" json:"auth_key,omitempty"`
 }

 func (x *GetAuthKeyResponse) Reset() {
@@ -121,10 +121,11 @@ type CreateAuthKeyRequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	TailnetId uint64               `protobuf:"varint,1,opt,name=tailnet_id,json=tailnetId,proto3" json:"tailnet_id,omitempty"`
-	Ephemeral bool                 `protobuf:"varint,2,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
-	Expiry    *durationpb.Duration `protobuf:"bytes,3,opt,name=expiry,proto3,oneof" json:"expiry,omitempty"`
-	Tags      []string             `protobuf:"bytes,4,rep,name=tags,proto3" json:"tags,omitempty"`
+	TailnetId     uint64               `protobuf:"varint,1,opt,name=tailnet_id,json=tailnetId,proto3" json:"tailnet_id,omitempty"`
+	Ephemeral     bool                 `protobuf:"varint,2,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
+	Expiry        *durationpb.Duration `protobuf:"bytes,3,opt,name=expiry,proto3,oneof" json:"expiry,omitempty"`
+	Tags          []string             `protobuf:"bytes,4,rep,name=tags,proto3" json:"tags,omitempty"`
+	PreAuthorized bool                 `protobuf:"varint,5,opt,name=pre_authorized,json=preAuthorized,proto3" json:"pre_authorized,omitempty"`
 }

 func (x *CreateAuthKeyRequest) Reset() {
@@ -187,6 +188,13 @@ func (x *CreateAuthKeyRequest) GetTags() []string {
 	return nil
 }

+func (x *CreateAuthKeyRequest) GetPreAuthorized() bool {
+	if x != nil {
+		return x.PreAuthorized
+	}
+	return false
+}
+
 type CreateAuthKeyResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -521,72 +529,75 @@ var File_ionscale_v1_auth_keys_proto protoreflect.FileDescriptor
 var file_ionscale_v1_auth_keys_proto_rawDesc = []byte{
 	0x0a, 0x1b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75,
 	0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67,
 	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65,
-	0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e,
 	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x66, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x22, 0x33, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
 	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x5f,
 	0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x61, 0x75,
-	0x74, 0x68, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x44, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x41, 0x75,
-	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a,
-	0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74,
-	0x68, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x22, 0xaa, 0x01,
-	0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65,
-	0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c,
-	0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72,
-	0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65,
-	0x72, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00,
-	0x52, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04, 0x74,
-	0x61, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x42,
-	0x09, 0x0a, 0x07, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x22, 0x5e, 0x0a, 0x15, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74,
-	0x68, 0x4b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x36, 0x0a, 0x14, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
-	0x49, 0x64, 0x22, 0x17, 0x0a, 0x15, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x34, 0x0a, 0x13, 0x4c,
-	0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49,
-	0x64, 0x22, 0x49, 0x0a, 0x14, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x31, 0x0a, 0x09, 0x61, 0x75, 0x74,
-	0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4b,
-	0x65, 0x79, 0x52, 0x08, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x22, 0x93, 0x02, 0x0a,
-	0x07, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70,
-	0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65,
-	0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x39, 0x0a, 0x0a,
-	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x3e, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x48, 0x00, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x65, 0x73, 0x41, 0x74, 0x88, 0x01, 0x01, 0x12, 0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e,
-	0x65, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c,
-	0x6e, 0x65, 0x74, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f,
-	0x61, 0x74, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76,
-	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x45, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a,
+	0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x22, 0xd1,
+	0x01, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65,
+	0x72, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d,
+	0x65, 0x72, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48,
+	0x00, 0x52, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04,
+	0x74, 0x61, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73,
+	0x12, 0x25, 0x0a, 0x0e, 0x70, 0x72, 0x65, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x70, 0x72, 0x65, 0x41, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x65, 0x78, 0x70, 0x69,
+	0x72, 0x79, 0x22, 0x5e, 0x0a, 0x15, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x08, 0x61,
+	0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x22, 0x36, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x09, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x17, 0x0a, 0x15, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x34, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b,
+	0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09,
+	0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x49, 0x0a, 0x14, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x31, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x08, 0x61, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x73, 0x22, 0x93, 0x02, 0x0a, 0x07, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c,
+	0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04,
+	0x74, 0x61, 0x67, 0x73, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12,
+	0x3e, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x48,
+	0x00, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x88, 0x01, 0x01, 0x12,
+	0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x42, 0x0d, 0x0a, 0x0b, 0x5f,
+	0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e,
+	0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67,
+	0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }

 var (
@@ -617,7 +628,7 @@ var file_ionscale_v1_auth_keys_proto_goTypes = []interface{}{
 	(*Ref)(nil),                   // 11: ionscale.v1.Ref
 }
 var file_ionscale_v1_auth_keys_proto_depIdxs = []int32{
-	8,  // 0: ionscale.v1.GetAuthKeyResponse.authKey:type_name -> ionscale.v1.AuthKey
+	8,  // 0: ionscale.v1.GetAuthKeyResponse.auth_key:type_name -> ionscale.v1.AuthKey
 	9,  // 1: ionscale.v1.CreateAuthKeyRequest.expiry:type_name -> google.protobuf.Duration
 	8,  // 2: ionscale.v1.CreateAuthKeyResponse.auth_key:type_name -> ionscale.v1.AuthKey
 	8,  // 3: ionscale.v1.ListAuthKeysResponse.auth_keys:type_name -> ionscale.v1.AuthKey
@@ -20,14 +20,14 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )

-type GetDERPMapRequest struct {
+type GetDefaultDERPMapRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 }

-func (x *GetDERPMapRequest) Reset() {
-	*x = GetDERPMapRequest{}
+func (x *GetDefaultDERPMapRequest) Reset() {
+	*x = GetDefaultDERPMapRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_derp_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -35,13 +35,13 @@ func (x *GetDERPMapRequest) Reset() {
 	}
 }

-func (x *GetDERPMapRequest) String() string {
+func (x *GetDefaultDERPMapRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*GetDERPMapRequest) ProtoMessage() {}
+func (*GetDefaultDERPMapRequest) ProtoMessage() {}

-func (x *GetDERPMapRequest) ProtoReflect() protoreflect.Message {
+func (x *GetDefaultDERPMapRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_derp_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -53,12 +53,12 @@ func (x *GetDERPMapRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use GetDERPMapRequest.ProtoReflect.Descriptor instead.
-func (*GetDERPMapRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetDefaultDERPMapRequest.ProtoReflect.Descriptor instead.
+func (*GetDefaultDERPMapRequest) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_derp_proto_rawDescGZIP(), []int{0}
 }

-type GetDERPMapResponse struct {
+type GetDefaultDERPMapResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -66,8 +66,8 @@ type GetDERPMapResponse struct {
 	Value []byte `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
 }

-func (x *GetDERPMapResponse) Reset() {
-	*x = GetDERPMapResponse{}
+func (x *GetDefaultDERPMapResponse) Reset() {
+	*x = GetDefaultDERPMapResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_derp_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -75,13 +75,13 @@ func (x *GetDERPMapResponse) Reset() {
 	}
 }

-func (x *GetDERPMapResponse) String() string {
+func (x *GetDefaultDERPMapResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*GetDERPMapResponse) ProtoMessage() {}
+func (*GetDefaultDERPMapResponse) ProtoMessage() {}

-func (x *GetDERPMapResponse) ProtoReflect() protoreflect.Message {
+func (x *GetDefaultDERPMapResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_derp_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -93,19 +93,19 @@ func (x *GetDERPMapResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use GetDERPMapResponse.ProtoReflect.Descriptor instead.
-func (*GetDERPMapResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetDefaultDERPMapResponse.ProtoReflect.Descriptor instead.
+func (*GetDefaultDERPMapResponse) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_derp_proto_rawDescGZIP(), []int{1}
 }

-func (x *GetDERPMapResponse) GetValue() []byte {
+func (x *GetDefaultDERPMapResponse) GetValue() []byte {
 	if x != nil {
 		return x.Value
 	}
 	return nil
 }

-type SetDERPMapRequest struct {
+type SetDefaultDERPMapRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -113,8 +113,8 @@ type SetDERPMapRequest struct {
 	Value []byte `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
 }

-func (x *SetDERPMapRequest) Reset() {
-	*x = SetDERPMapRequest{}
+func (x *SetDefaultDERPMapRequest) Reset() {
+	*x = SetDefaultDERPMapRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_derp_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -122,13 +122,13 @@ func (x *SetDERPMapRequest) Reset() {
 	}
 }

-func (x *SetDERPMapRequest) String() string {
+func (x *SetDefaultDERPMapRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*SetDERPMapRequest) ProtoMessage() {}
+func (*SetDefaultDERPMapRequest) ProtoMessage() {}

-func (x *SetDERPMapRequest) ProtoReflect() protoreflect.Message {
+func (x *SetDefaultDERPMapRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_derp_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -140,19 +140,19 @@ func (x *SetDERPMapRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use SetDERPMapRequest.ProtoReflect.Descriptor instead.
-func (*SetDERPMapRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use SetDefaultDERPMapRequest.ProtoReflect.Descriptor instead.
+func (*SetDefaultDERPMapRequest) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_derp_proto_rawDescGZIP(), []int{2}
 }

-func (x *SetDERPMapRequest) GetValue() []byte {
+func (x *SetDefaultDERPMapRequest) GetValue() []byte {
 	if x != nil {
 		return x.Value
 	}
 	return nil
 }

-type SetDERPMapResponse struct {
+type SetDefaultDERPMapResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -160,8 +160,8 @@ type SetDERPMapResponse struct {
 	Value []byte `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
 }

-func (x *SetDERPMapResponse) Reset() {
-	*x = SetDERPMapResponse{}
+func (x *SetDefaultDERPMapResponse) Reset() {
+	*x = SetDefaultDERPMapResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_derp_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -169,13 +169,13 @@ func (x *SetDERPMapResponse) Reset() {
 	}
 }

-func (x *SetDERPMapResponse) String() string {
+func (x *SetDefaultDERPMapResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*SetDERPMapResponse) ProtoMessage() {}
+func (*SetDefaultDERPMapResponse) ProtoMessage() {}

-func (x *SetDERPMapResponse) ProtoReflect() protoreflect.Message {
+func (x *SetDefaultDERPMapResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_derp_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -187,38 +187,119 @@ func (x *SetDERPMapResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use SetDERPMapResponse.ProtoReflect.Descriptor instead.
-func (*SetDERPMapResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use SetDefaultDERPMapResponse.ProtoReflect.Descriptor instead.
+func (*SetDefaultDERPMapResponse) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_derp_proto_rawDescGZIP(), []int{3}
 }

-func (x *SetDERPMapResponse) GetValue() []byte {
+func (x *SetDefaultDERPMapResponse) GetValue() []byte {
 	if x != nil {
 		return x.Value
 	}
 	return nil
 }

+type ResetDefaultDERPMapRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ResetDefaultDERPMapRequest) Reset() {
+	*x = ResetDefaultDERPMapRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_derp_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResetDefaultDERPMapRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResetDefaultDERPMapRequest) ProtoMessage() {}
+
+func (x *ResetDefaultDERPMapRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_derp_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResetDefaultDERPMapRequest.ProtoReflect.Descriptor instead.
+func (*ResetDefaultDERPMapRequest) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_derp_proto_rawDescGZIP(), []int{4}
+}
+
+type ResetDefaultDERPMapResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ResetDefaultDERPMapResponse) Reset() {
+	*x = ResetDefaultDERPMapResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_derp_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResetDefaultDERPMapResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResetDefaultDERPMapResponse) ProtoMessage() {}
+
+func (x *ResetDefaultDERPMapResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_derp_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResetDefaultDERPMapResponse.ProtoReflect.Descriptor instead.
+func (*ResetDefaultDERPMapResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_derp_proto_rawDescGZIP(), []int{5}
+}
+
 var File_ionscale_v1_derp_proto protoreflect.FileDescriptor

 var file_ionscale_v1_derp_proto_rawDesc = []byte{
 	0x0a, 0x16, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x65,
 	0x72, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x22, 0x13, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50,
-	0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x2a, 0x0a, 0x12, 0x47, 0x65,
-	0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x22, 0x1a, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x22, 0x31, 0x0a, 0x19, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44,
+	0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x22, 0x30, 0x0a, 0x18, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75,
+	0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
 	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x29, 0x0a, 0x11, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52,
-	0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x22, 0x2a, 0x0a, 0x12, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x3d, 0x5a,
-	0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65,
-	0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b,
-	0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76,
-	0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x31, 0x0a, 0x19, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66,
+	0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x1c, 0x0a, 0x1a, 0x52, 0x65, 0x73,
+	0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x1d, 0x0a, 0x1b, 0x52, 0x65, 0x73, 0x65, 0x74,
+	0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -233,12 +314,14 @@ func file_ionscale_v1_derp_proto_rawDescGZIP() []byte {
 	return file_ionscale_v1_derp_proto_rawDescData
 }

-var file_ionscale_v1_derp_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_ionscale_v1_derp_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_ionscale_v1_derp_proto_goTypes = []interface{}{
-	(*GetDERPMapRequest)(nil),  // 0: ionscale.v1.GetDERPMapRequest
-	(*GetDERPMapResponse)(nil), // 1: ionscale.v1.GetDERPMapResponse
-	(*SetDERPMapRequest)(nil),  // 2: ionscale.v1.SetDERPMapRequest
-	(*SetDERPMapResponse)(nil), // 3: ionscale.v1.SetDERPMapResponse
+	(*GetDefaultDERPMapRequest)(nil),    // 0: ionscale.v1.GetDefaultDERPMapRequest
+	(*GetDefaultDERPMapResponse)(nil),   // 1: ionscale.v1.GetDefaultDERPMapResponse
+	(*SetDefaultDERPMapRequest)(nil),    // 2: ionscale.v1.SetDefaultDERPMapRequest
+	(*SetDefaultDERPMapResponse)(nil),   // 3: ionscale.v1.SetDefaultDERPMapResponse
+	(*ResetDefaultDERPMapRequest)(nil),  // 4: ionscale.v1.ResetDefaultDERPMapRequest
+	(*ResetDefaultDERPMapResponse)(nil), // 5: ionscale.v1.ResetDefaultDERPMapResponse
 }
 var file_ionscale_v1_derp_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for method output_type
@@ -255,7 +338,7 @@ func file_ionscale_v1_derp_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_ionscale_v1_derp_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetDERPMapRequest); i {
+			switch v := v.(*GetDefaultDERPMapRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -267,7 +350,7 @@ func file_ionscale_v1_derp_proto_init() {
 			}
 		}
 		file_ionscale_v1_derp_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetDERPMapResponse); i {
+			switch v := v.(*GetDefaultDERPMapResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -279,7 +362,7 @@ func file_ionscale_v1_derp_proto_init() {
 			}
 		}
 		file_ionscale_v1_derp_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetDERPMapRequest); i {
+			switch v := v.(*SetDefaultDERPMapRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -291,7 +374,31 @@ func file_ionscale_v1_derp_proto_init() {
 			}
 		}
 		file_ionscale_v1_derp_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetDERPMapResponse); i {
+			switch v := v.(*SetDefaultDERPMapResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_derp_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResetDefaultDERPMapRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_derp_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResetDefaultDERPMapResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -309,7 +416,7 @@ func file_ionscale_v1_derp_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_ionscale_v1_derp_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   4,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -9,8 +9,6 @@ package ionscalev1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/known/durationpb"
-	_ "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -228,6 +226,7 @@ type DNSConfig struct {
 	Nameservers      []string           `protobuf:"bytes,3,rep,name=nameservers,proto3" json:"nameservers,omitempty"`
 	Routes           map[string]*Routes `protobuf:"bytes,4,rep,name=routes,proto3" json:"routes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	MagicDnsSuffix   string             `protobuf:"bytes,5,opt,name=magic_dns_suffix,json=magicDnsSuffix,proto3" json:"magic_dns_suffix,omitempty"`
+	HttpsCerts       bool               `protobuf:"varint,6,opt,name=https_certs,json=httpsCerts,proto3" json:"https_certs,omitempty"`
 }

 func (x *DNSConfig) Reset() {
@@ -297,6 +296,13 @@ func (x *DNSConfig) GetMagicDnsSuffix() string {
 	return ""
 }

+func (x *DNSConfig) GetHttpsCerts() bool {
+	if x != nil {
+		return x.HttpsCerts
+	}
+	return false
+}
+
 type Routes struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -349,44 +355,42 @@ var File_ionscale_v1_dns_proto protoreflect.FileDescriptor
 var file_ionscale_v1_dns_proto_rawDesc = []byte{
 	0x0a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x6e,
 	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a,
-	0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
-	0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x46, 0x0a, 0x14, 0x47,
-	0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61,
-	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09,
-	0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x46, 0x0a, 0x14, 0x53, 0x65, 0x74,
-	0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x22, 0xae, 0x02, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x5f, 0x64, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x08, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x12, 0x2c, 0x0a, 0x12,
-	0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x64,
-	0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69,
-	0x64, 0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x44, 0x6e, 0x73, 0x12, 0x20, 0x0a, 0x0b, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3a, 0x0a, 0x06,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x6d, 0x61, 0x67, 0x69,
-	0x63, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0e, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x53, 0x75, 0x66, 0x66,
-	0x69, 0x78, 0x1a, 0x4e, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x65, 0x2e, 0x76, 0x31, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x46, 0x0a, 0x14, 0x47, 0x65,
+	0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x46, 0x0a, 0x14, 0x53, 0x65, 0x74, 0x44,
+	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
+	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x22, 0xcf, 0x02, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1b,
+	0x0a, 0x09, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x5f, 0x64, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x08, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6f,
+	0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x64, 0x6e,
+	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64,
+	0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x44, 0x6e, 0x73, 0x12, 0x20, 0x0a, 0x0b, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0b,
+	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x6d, 0x61, 0x67, 0x69, 0x63,
+	0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x53, 0x75, 0x66, 0x66, 0x69,
+	0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x73, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x73,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72,
+	0x74, 0x73, 0x1a, 0x4e, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72,
 	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
 	0x6b, 0x65, 0x79, 0x12, 0x29, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x13, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
@@ -9,8 +9,6 @@ package ionscalev1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/known/durationpb"
-	_ "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 )

@@ -26,324 +24,462 @@ var File_ionscale_v1_ionscale_proto protoreflect.FileDescriptor
 var file_ionscale_v1_ionscale_proto_rawDesc = []byte{
 	0x0a, 0x1a, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6f,
 	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x2e,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x63, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x16, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75,
+	0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f,
-	0x76, 0x31, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x61, 0x69, 0x6c, 0x6e,
-	0x65, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x1b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
-	0x1a, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x18, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f,
-	0x76, 0x31, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x61, 0x6d, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31,
-	0x2f, 0x61, 0x63, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x65, 0x72, 0x70, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x32, 0xff, 0x14, 0x0a, 0x0f, 0x49, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65,
-	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
-	0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x30, 0x01, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d,
-	0x61, 0x70, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50,
-	0x4d, 0x61, 0x70, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75,
+	0x76, 0x31, 0x2f, 0x64, 0x65, 0x72, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76,
+	0x31, 0x2f, 0x69, 0x61, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x18, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x1a, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2f, 0x76, 0x31, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x32, 0xda, 0x1f, 0x0a, 0x0f, 0x49, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
 	0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c,
-	0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54,
-	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x1e,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
-	0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x57, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
+	0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12,
+	0x64, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x12, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66,
+	0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x64, 0x0a, 0x11, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x25, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61,
+	0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6a, 0x0a, 0x13, 0x52,
+	0x65, 0x73, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d,
+	0x61, 0x70, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
 	0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x53, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
-	0x73, 0x12, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c,
-	0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e,
+	0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12,
+	0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
+	0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
+	0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65,
+	0x74, 0x73, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e,
 	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54,
-	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
-	0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x44, 0x4e,
-	0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55,
-	0x0a, 0x0c, 0x47, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
-	0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
-	0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c,
-	0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x43,
-	0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
-	0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65,
-	0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
-	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
-	0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41,
-	0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b,
-	0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75,
-	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x12,
-	0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69,
-	0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73,
-	0x65, 0x72, 0x73, 0x12, 0x1d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73,
-	0x65, 0x72, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61,
+	0x70, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d,
+	0x61, 0x70, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a,
-	0x0d, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x21,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70,
-	0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x45,
+	0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d,
+	0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x64, 0x0a, 0x11,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e,
+	0x67, 0x12, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e,
+	0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c,
+	0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x67, 0x0a, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c,
+	0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69,
+	0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
+	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e,
+	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x76, 0x0a, 0x17, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43,
+	0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x79, 0x0a, 0x18, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x2c, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c,
+	0x0a, 0x09, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x12, 0x1d, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x53, 0x53, 0x48, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53,
+	0x53, 0x48, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a,
+	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
+	0x53, 0x53, 0x48, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
+	0x53, 0x53, 0x48, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7f, 0x0a,
+	0x1a, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x82,
+	0x01, 0x0a, 0x1b, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2f,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x30, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65,
+	0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e,
+	0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x49,
+	0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12,
+	0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
+	0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a,
+	0x0a, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74,
+	0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74,
+	0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58,
+	0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12,
+	0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
+	0x79, 0x73, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x09, 0x4c, 0x69, 0x73,
+	0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x1d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73,
+	0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x61, 0x0a, 0x10, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x12, 0x24, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a,
+	0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x21,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x6a, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4b,
-	0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70,
-	0x69, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x61, 0x0a,
-	0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x12, 0x24, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6a, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x12, 0x27,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x4b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x61, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x24, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
 	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x67, 0x0a, 0x13, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
-	0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x69, 0x0a, 0x14, 0x44, 0x69, 0x73,
-	0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x12, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x12, 0x5d, 0x0a, 0x0e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78,
-	0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e,
-	0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x12, 0x5f, 0x0a, 0x0f, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78,
-	0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x23, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6a, 0x0a, 0x13, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x27, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x6d, 0x0a, 0x14, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x28, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x5b, 0x0a, 0x0e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e,
+	0x6f, 0x64, 0x65, 0x12, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5e,
+	0x0a, 0x0f, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64,
+	0x65, 0x12, 0x23, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
 	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74,
-	0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x3d,
+	0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69,
+	0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70,
+	0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f,
+	0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var file_ionscale_v1_ionscale_proto_goTypes = []interface{}{
-	(*GetVersionRequest)(nil),           // 0: ionscale.v1.GetVersionRequest
-	(*AuthenticationRequest)(nil),       // 1: ionscale.v1.AuthenticationRequest
-	(*GetDERPMapRequest)(nil),           // 2: ionscale.v1.GetDERPMapRequest
-	(*SetDERPMapRequest)(nil),           // 3: ionscale.v1.SetDERPMapRequest
-	(*CreateTailnetRequest)(nil),        // 4: ionscale.v1.CreateTailnetRequest
-	(*GetTailnetRequest)(nil),           // 5: ionscale.v1.GetTailnetRequest
-	(*ListTailnetRequest)(nil),          // 6: ionscale.v1.ListTailnetRequest
-	(*DeleteTailnetRequest)(nil),        // 7: ionscale.v1.DeleteTailnetRequest
-	(*GetDNSConfigRequest)(nil),         // 8: ionscale.v1.GetDNSConfigRequest
-	(*SetDNSConfigRequest)(nil),         // 9: ionscale.v1.SetDNSConfigRequest
-	(*GetIAMPolicyRequest)(nil),         // 10: ionscale.v1.GetIAMPolicyRequest
-	(*SetIAMPolicyRequest)(nil),         // 11: ionscale.v1.SetIAMPolicyRequest
-	(*GetACLPolicyRequest)(nil),         // 12: ionscale.v1.GetACLPolicyRequest
-	(*SetACLPolicyRequest)(nil),         // 13: ionscale.v1.SetACLPolicyRequest
-	(*GetAuthKeyRequest)(nil),           // 14: ionscale.v1.GetAuthKeyRequest
-	(*CreateAuthKeyRequest)(nil),        // 15: ionscale.v1.CreateAuthKeyRequest
-	(*DeleteAuthKeyRequest)(nil),        // 16: ionscale.v1.DeleteAuthKeyRequest
-	(*ListAuthKeysRequest)(nil),         // 17: ionscale.v1.ListAuthKeysRequest
-	(*ListUsersRequest)(nil),            // 18: ionscale.v1.ListUsersRequest
-	(*DeleteUserRequest)(nil),           // 19: ionscale.v1.DeleteUserRequest
-	(*GetMachineRequest)(nil),           // 20: ionscale.v1.GetMachineRequest
-	(*ListMachinesRequest)(nil),         // 21: ionscale.v1.ListMachinesRequest
-	(*ExpireMachineRequest)(nil),        // 22: ionscale.v1.ExpireMachineRequest
-	(*DeleteMachineRequest)(nil),        // 23: ionscale.v1.DeleteMachineRequest
-	(*SetMachineKeyExpiryRequest)(nil),  // 24: ionscale.v1.SetMachineKeyExpiryRequest
-	(*GetMachineRoutesRequest)(nil),     // 25: ionscale.v1.GetMachineRoutesRequest
-	(*EnableMachineRoutesRequest)(nil),  // 26: ionscale.v1.EnableMachineRoutesRequest
-	(*DisableMachineRoutesRequest)(nil), // 27: ionscale.v1.DisableMachineRoutesRequest
-	(*EnableExitNodeRequest)(nil),       // 28: ionscale.v1.EnableExitNodeRequest
-	(*DisableExitNodeRequest)(nil),      // 29: ionscale.v1.DisableExitNodeRequest
-	(*GetVersionResponse)(nil),          // 30: ionscale.v1.GetVersionResponse
-	(*AuthenticationResponse)(nil),      // 31: ionscale.v1.AuthenticationResponse
-	(*GetDERPMapResponse)(nil),          // 32: ionscale.v1.GetDERPMapResponse
-	(*SetDERPMapResponse)(nil),          // 33: ionscale.v1.SetDERPMapResponse
-	(*CreateTailnetResponse)(nil),       // 34: ionscale.v1.CreateTailnetResponse
-	(*GetTailnetResponse)(nil),          // 35: ionscale.v1.GetTailnetResponse
-	(*ListTailnetResponse)(nil),         // 36: ionscale.v1.ListTailnetResponse
-	(*DeleteTailnetResponse)(nil),       // 37: ionscale.v1.DeleteTailnetResponse
-	(*GetDNSConfigResponse)(nil),        // 38: ionscale.v1.GetDNSConfigResponse
-	(*SetDNSConfigResponse)(nil),        // 39: ionscale.v1.SetDNSConfigResponse
-	(*GetIAMPolicyResponse)(nil),        // 40: ionscale.v1.GetIAMPolicyResponse
-	(*SetIAMPolicyResponse)(nil),        // 41: ionscale.v1.SetIAMPolicyResponse
-	(*GetACLPolicyResponse)(nil),        // 42: ionscale.v1.GetACLPolicyResponse
-	(*SetACLPolicyResponse)(nil),        // 43: ionscale.v1.SetACLPolicyResponse
-	(*GetAuthKeyResponse)(nil),          // 44: ionscale.v1.GetAuthKeyResponse
-	(*CreateAuthKeyResponse)(nil),       // 45: ionscale.v1.CreateAuthKeyResponse
-	(*DeleteAuthKeyResponse)(nil),       // 46: ionscale.v1.DeleteAuthKeyResponse
-	(*ListAuthKeysResponse)(nil),        // 47: ionscale.v1.ListAuthKeysResponse
-	(*ListUsersResponse)(nil),           // 48: ionscale.v1.ListUsersResponse
-	(*DeleteUserResponse)(nil),          // 49: ionscale.v1.DeleteUserResponse
-	(*GetMachineResponse)(nil),          // 50: ionscale.v1.GetMachineResponse
-	(*ListMachinesResponse)(nil),        // 51: ionscale.v1.ListMachinesResponse
-	(*ExpireMachineResponse)(nil),       // 52: ionscale.v1.ExpireMachineResponse
-	(*DeleteMachineResponse)(nil),       // 53: ionscale.v1.DeleteMachineResponse
-	(*SetMachineKeyExpiryResponse)(nil), // 54: ionscale.v1.SetMachineKeyExpiryResponse
-	(*GetMachineRoutesResponse)(nil),    // 55: ionscale.v1.GetMachineRoutesResponse
+	(*GetVersionRequest)(nil),                   // 0: ionscale.v1.GetVersionRequest
+	(*AuthenticateRequest)(nil),                 // 1: ionscale.v1.AuthenticateRequest
+	(*GetDefaultDERPMapRequest)(nil),            // 2: ionscale.v1.GetDefaultDERPMapRequest
+	(*SetDefaultDERPMapRequest)(nil),            // 3: ionscale.v1.SetDefaultDERPMapRequest
+	(*ResetDefaultDERPMapRequest)(nil),          // 4: ionscale.v1.ResetDefaultDERPMapRequest
+	(*CreateTailnetRequest)(nil),                // 5: ionscale.v1.CreateTailnetRequest
+	(*GetTailnetRequest)(nil),                   // 6: ionscale.v1.GetTailnetRequest
+	(*ListTailnetsRequest)(nil),                 // 7: ionscale.v1.ListTailnetsRequest
+	(*DeleteTailnetRequest)(nil),                // 8: ionscale.v1.DeleteTailnetRequest
+	(*GetDERPMapRequest)(nil),                   // 9: ionscale.v1.GetDERPMapRequest
+	(*SetDERPMapRequest)(nil),                   // 10: ionscale.v1.SetDERPMapRequest
+	(*ResetDERPMapRequest)(nil),                 // 11: ionscale.v1.ResetDERPMapRequest
+	(*EnableFileSharingRequest)(nil),            // 12: ionscale.v1.EnableFileSharingRequest
+	(*DisableFileSharingRequest)(nil),           // 13: ionscale.v1.DisableFileSharingRequest
+	(*EnableServiceCollectionRequest)(nil),      // 14: ionscale.v1.EnableServiceCollectionRequest
+	(*DisableServiceCollectionRequest)(nil),     // 15: ionscale.v1.DisableServiceCollectionRequest
+	(*EnableSSHRequest)(nil),                    // 16: ionscale.v1.EnableSSHRequest
+	(*DisableSSHRequest)(nil),                   // 17: ionscale.v1.DisableSSHRequest
+	(*EnableMachineAuthorizationRequest)(nil),   // 18: ionscale.v1.EnableMachineAuthorizationRequest
+	(*DisableMachineAuthorizationRequest)(nil),  // 19: ionscale.v1.DisableMachineAuthorizationRequest
+	(*GetDNSConfigRequest)(nil),                 // 20: ionscale.v1.GetDNSConfigRequest
+	(*SetDNSConfigRequest)(nil),                 // 21: ionscale.v1.SetDNSConfigRequest
+	(*GetIAMPolicyRequest)(nil),                 // 22: ionscale.v1.GetIAMPolicyRequest
+	(*SetIAMPolicyRequest)(nil),                 // 23: ionscale.v1.SetIAMPolicyRequest
+	(*GetACLPolicyRequest)(nil),                 // 24: ionscale.v1.GetACLPolicyRequest
+	(*SetACLPolicyRequest)(nil),                 // 25: ionscale.v1.SetACLPolicyRequest
+	(*GetAuthKeyRequest)(nil),                   // 26: ionscale.v1.GetAuthKeyRequest
+	(*CreateAuthKeyRequest)(nil),                // 27: ionscale.v1.CreateAuthKeyRequest
+	(*DeleteAuthKeyRequest)(nil),                // 28: ionscale.v1.DeleteAuthKeyRequest
+	(*ListAuthKeysRequest)(nil),                 // 29: ionscale.v1.ListAuthKeysRequest
+	(*ListUsersRequest)(nil),                    // 30: ionscale.v1.ListUsersRequest
+	(*DeleteUserRequest)(nil),                   // 31: ionscale.v1.DeleteUserRequest
+	(*GetMachineRequest)(nil),                   // 32: ionscale.v1.GetMachineRequest
+	(*ListMachinesRequest)(nil),                 // 33: ionscale.v1.ListMachinesRequest
+	(*AuthorizeMachineRequest)(nil),             // 34: ionscale.v1.AuthorizeMachineRequest
+	(*ExpireMachineRequest)(nil),                // 35: ionscale.v1.ExpireMachineRequest
+	(*DeleteMachineRequest)(nil),                // 36: ionscale.v1.DeleteMachineRequest
+	(*SetMachineKeyExpiryRequest)(nil),          // 37: ionscale.v1.SetMachineKeyExpiryRequest
+	(*GetMachineRoutesRequest)(nil),             // 38: ionscale.v1.GetMachineRoutesRequest
+	(*EnableMachineRoutesRequest)(nil),          // 39: ionscale.v1.EnableMachineRoutesRequest
+	(*DisableMachineRoutesRequest)(nil),         // 40: ionscale.v1.DisableMachineRoutesRequest
+	(*EnableExitNodeRequest)(nil),               // 41: ionscale.v1.EnableExitNodeRequest
+	(*DisableExitNodeRequest)(nil),              // 42: ionscale.v1.DisableExitNodeRequest
+	(*GetVersionResponse)(nil),                  // 43: ionscale.v1.GetVersionResponse
+	(*AuthenticateResponse)(nil),                // 44: ionscale.v1.AuthenticateResponse
+	(*GetDefaultDERPMapResponse)(nil),           // 45: ionscale.v1.GetDefaultDERPMapResponse
+	(*SetDefaultDERPMapResponse)(nil),           // 46: ionscale.v1.SetDefaultDERPMapResponse
+	(*ResetDefaultDERPMapResponse)(nil),         // 47: ionscale.v1.ResetDefaultDERPMapResponse
+	(*CreateTailnetResponse)(nil),               // 48: ionscale.v1.CreateTailnetResponse
+	(*GetTailnetResponse)(nil),                  // 49: ionscale.v1.GetTailnetResponse
+	(*ListTailnetsResponse)(nil),                // 50: ionscale.v1.ListTailnetsResponse
+	(*DeleteTailnetResponse)(nil),               // 51: ionscale.v1.DeleteTailnetResponse
+	(*GetDERPMapResponse)(nil),                  // 52: ionscale.v1.GetDERPMapResponse
+	(*SetDERPMapResponse)(nil),                  // 53: ionscale.v1.SetDERPMapResponse
+	(*ResetDERPMapResponse)(nil),                // 54: ionscale.v1.ResetDERPMapResponse
+	(*EnableFileSharingResponse)(nil),           // 55: ionscale.v1.EnableFileSharingResponse
+	(*DisableFileSharingResponse)(nil),          // 56: ionscale.v1.DisableFileSharingResponse
+	(*EnableServiceCollectionResponse)(nil),     // 57: ionscale.v1.EnableServiceCollectionResponse
+	(*DisableServiceCollectionResponse)(nil),    // 58: ionscale.v1.DisableServiceCollectionResponse
+	(*EnableSSHResponse)(nil),                   // 59: ionscale.v1.EnableSSHResponse
+	(*DisableSSHResponse)(nil),                  // 60: ionscale.v1.DisableSSHResponse
+	(*EnableMachineAuthorizationResponse)(nil),  // 61: ionscale.v1.EnableMachineAuthorizationResponse
+	(*DisableMachineAuthorizationResponse)(nil), // 62: ionscale.v1.DisableMachineAuthorizationResponse
+	(*GetDNSConfigResponse)(nil),                // 63: ionscale.v1.GetDNSConfigResponse
+	(*SetDNSConfigResponse)(nil),                // 64: ionscale.v1.SetDNSConfigResponse
+	(*GetIAMPolicyResponse)(nil),                // 65: ionscale.v1.GetIAMPolicyResponse
+	(*SetIAMPolicyResponse)(nil),                // 66: ionscale.v1.SetIAMPolicyResponse
+	(*GetACLPolicyResponse)(nil),                // 67: ionscale.v1.GetACLPolicyResponse
+	(*SetACLPolicyResponse)(nil),                // 68: ionscale.v1.SetACLPolicyResponse
+	(*GetAuthKeyResponse)(nil),                  // 69: ionscale.v1.GetAuthKeyResponse
+	(*CreateAuthKeyResponse)(nil),               // 70: ionscale.v1.CreateAuthKeyResponse
+	(*DeleteAuthKeyResponse)(nil),               // 71: ionscale.v1.DeleteAuthKeyResponse
+	(*ListAuthKeysResponse)(nil),                // 72: ionscale.v1.ListAuthKeysResponse
+	(*ListUsersResponse)(nil),                   // 73: ionscale.v1.ListUsersResponse
+	(*DeleteUserResponse)(nil),                  // 74: ionscale.v1.DeleteUserResponse
+	(*GetMachineResponse)(nil),                  // 75: ionscale.v1.GetMachineResponse
+	(*ListMachinesResponse)(nil),                // 76: ionscale.v1.ListMachinesResponse
+	(*AuthorizeMachineResponse)(nil),            // 77: ionscale.v1.AuthorizeMachineResponse
+	(*ExpireMachineResponse)(nil),               // 78: ionscale.v1.ExpireMachineResponse
+	(*DeleteMachineResponse)(nil),               // 79: ionscale.v1.DeleteMachineResponse
+	(*SetMachineKeyExpiryResponse)(nil),         // 80: ionscale.v1.SetMachineKeyExpiryResponse
+	(*GetMachineRoutesResponse)(nil),            // 81: ionscale.v1.GetMachineRoutesResponse
+	(*EnableMachineRoutesResponse)(nil),         // 82: ionscale.v1.EnableMachineRoutesResponse
+	(*DisableMachineRoutesResponse)(nil),        // 83: ionscale.v1.DisableMachineRoutesResponse
+	(*EnableExitNodeResponse)(nil),              // 84: ionscale.v1.EnableExitNodeResponse
+	(*DisableExitNodeResponse)(nil),             // 85: ionscale.v1.DisableExitNodeResponse
 }
 var file_ionscale_v1_ionscale_proto_depIdxs = []int32{
 	0,  // 0: ionscale.v1.IonscaleService.GetVersion:input_type -> ionscale.v1.GetVersionRequest
-	1,  // 1: ionscale.v1.IonscaleService.Authenticate:input_type -> ionscale.v1.AuthenticationRequest
-	2,  // 2: ionscale.v1.IonscaleService.GetDERPMap:input_type -> ionscale.v1.GetDERPMapRequest
-	3,  // 3: ionscale.v1.IonscaleService.SetDERPMap:input_type -> ionscale.v1.SetDERPMapRequest
-	4,  // 4: ionscale.v1.IonscaleService.CreateTailnet:input_type -> ionscale.v1.CreateTailnetRequest
-	5,  // 5: ionscale.v1.IonscaleService.GetTailnet:input_type -> ionscale.v1.GetTailnetRequest
-	6,  // 6: ionscale.v1.IonscaleService.ListTailnets:input_type -> ionscale.v1.ListTailnetRequest
-	7,  // 7: ionscale.v1.IonscaleService.DeleteTailnet:input_type -> ionscale.v1.DeleteTailnetRequest
-	8,  // 8: ionscale.v1.IonscaleService.GetDNSConfig:input_type -> ionscale.v1.GetDNSConfigRequest
-	9,  // 9: ionscale.v1.IonscaleService.SetDNSConfig:input_type -> ionscale.v1.SetDNSConfigRequest
-	10, // 10: ionscale.v1.IonscaleService.GetIAMPolicy:input_type -> ionscale.v1.GetIAMPolicyRequest
-	11, // 11: ionscale.v1.IonscaleService.SetIAMPolicy:input_type -> ionscale.v1.SetIAMPolicyRequest
-	12, // 12: ionscale.v1.IonscaleService.GetACLPolicy:input_type -> ionscale.v1.GetACLPolicyRequest
-	13, // 13: ionscale.v1.IonscaleService.SetACLPolicy:input_type -> ionscale.v1.SetACLPolicyRequest
-	14, // 14: ionscale.v1.IonscaleService.GetAuthKey:input_type -> ionscale.v1.GetAuthKeyRequest
-	15, // 15: ionscale.v1.IonscaleService.CreateAuthKey:input_type -> ionscale.v1.CreateAuthKeyRequest
-	16, // 16: ionscale.v1.IonscaleService.DeleteAuthKey:input_type -> ionscale.v1.DeleteAuthKeyRequest
-	17, // 17: ionscale.v1.IonscaleService.ListAuthKeys:input_type -> ionscale.v1.ListAuthKeysRequest
-	18, // 18: ionscale.v1.IonscaleService.ListUsers:input_type -> ionscale.v1.ListUsersRequest
-	19, // 19: ionscale.v1.IonscaleService.DeleteUser:input_type -> ionscale.v1.DeleteUserRequest
-	20, // 20: ionscale.v1.IonscaleService.GetMachine:input_type -> ionscale.v1.GetMachineRequest
-	21, // 21: ionscale.v1.IonscaleService.ListMachines:input_type -> ionscale.v1.ListMachinesRequest
-	22, // 22: ionscale.v1.IonscaleService.ExpireMachine:input_type -> ionscale.v1.ExpireMachineRequest
-	23, // 23: ionscale.v1.IonscaleService.DeleteMachine:input_type -> ionscale.v1.DeleteMachineRequest
-	24, // 24: ionscale.v1.IonscaleService.SetMachineKeyExpiry:input_type -> ionscale.v1.SetMachineKeyExpiryRequest
-	25, // 25: ionscale.v1.IonscaleService.GetMachineRoutes:input_type -> ionscale.v1.GetMachineRoutesRequest
-	26, // 26: ionscale.v1.IonscaleService.EnableMachineRoutes:input_type -> ionscale.v1.EnableMachineRoutesRequest
-	27, // 27: ionscale.v1.IonscaleService.DisableMachineRoutes:input_type -> ionscale.v1.DisableMachineRoutesRequest
-	28, // 28: ionscale.v1.IonscaleService.EnableExitNode:input_type -> ionscale.v1.EnableExitNodeRequest
-	29, // 29: ionscale.v1.IonscaleService.DisableExitNode:input_type -> ionscale.v1.DisableExitNodeRequest
-	30, // 30: ionscale.v1.IonscaleService.GetVersion:output_type -> ionscale.v1.GetVersionResponse
-	31, // 31: ionscale.v1.IonscaleService.Authenticate:output_type -> ionscale.v1.AuthenticationResponse
-	32, // 32: ionscale.v1.IonscaleService.GetDERPMap:output_type -> ionscale.v1.GetDERPMapResponse
-	33, // 33: ionscale.v1.IonscaleService.SetDERPMap:output_type -> ionscale.v1.SetDERPMapResponse
-	34, // 34: ionscale.v1.IonscaleService.CreateTailnet:output_type -> ionscale.v1.CreateTailnetResponse
-	35, // 35: ionscale.v1.IonscaleService.GetTailnet:output_type -> ionscale.v1.GetTailnetResponse
-	36, // 36: ionscale.v1.IonscaleService.ListTailnets:output_type -> ionscale.v1.ListTailnetResponse
-	37, // 37: ionscale.v1.IonscaleService.DeleteTailnet:output_type -> ionscale.v1.DeleteTailnetResponse
-	38, // 38: ionscale.v1.IonscaleService.GetDNSConfig:output_type -> ionscale.v1.GetDNSConfigResponse
-	39, // 39: ionscale.v1.IonscaleService.SetDNSConfig:output_type -> ionscale.v1.SetDNSConfigResponse
-	40, // 40: ionscale.v1.IonscaleService.GetIAMPolicy:output_type -> ionscale.v1.GetIAMPolicyResponse
-	41, // 41: ionscale.v1.IonscaleService.SetIAMPolicy:output_type -> ionscale.v1.SetIAMPolicyResponse
-	42, // 42: ionscale.v1.IonscaleService.GetACLPolicy:output_type -> ionscale.v1.GetACLPolicyResponse
-	43, // 43: ionscale.v1.IonscaleService.SetACLPolicy:output_type -> ionscale.v1.SetACLPolicyResponse
-	44, // 44: ionscale.v1.IonscaleService.GetAuthKey:output_type -> ionscale.v1.GetAuthKeyResponse
-	45, // 45: ionscale.v1.IonscaleService.CreateAuthKey:output_type -> ionscale.v1.CreateAuthKeyResponse
-	46, // 46: ionscale.v1.IonscaleService.DeleteAuthKey:output_type -> ionscale.v1.DeleteAuthKeyResponse
-	47, // 47: ionscale.v1.IonscaleService.ListAuthKeys:output_type -> ionscale.v1.ListAuthKeysResponse
-	48, // 48: ionscale.v1.IonscaleService.ListUsers:output_type -> ionscale.v1.ListUsersResponse
-	49, // 49: ionscale.v1.IonscaleService.DeleteUser:output_type -> ionscale.v1.DeleteUserResponse
-	50, // 50: ionscale.v1.IonscaleService.GetMachine:output_type -> ionscale.v1.GetMachineResponse
-	51, // 51: ionscale.v1.IonscaleService.ListMachines:output_type -> ionscale.v1.ListMachinesResponse
-	52, // 52: ionscale.v1.IonscaleService.ExpireMachine:output_type -> ionscale.v1.ExpireMachineResponse
-	53, // 53: ionscale.v1.IonscaleService.DeleteMachine:output_type -> ionscale.v1.DeleteMachineResponse
-	54, // 54: ionscale.v1.IonscaleService.SetMachineKeyExpiry:output_type -> ionscale.v1.SetMachineKeyExpiryResponse
-	55, // 55: ionscale.v1.IonscaleService.GetMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
-	55, // 56: ionscale.v1.IonscaleService.EnableMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
-	55, // 57: ionscale.v1.IonscaleService.DisableMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
-	55, // 58: ionscale.v1.IonscaleService.EnableExitNode:output_type -> ionscale.v1.GetMachineRoutesResponse
-	55, // 59: ionscale.v1.IonscaleService.DisableExitNode:output_type -> ionscale.v1.GetMachineRoutesResponse
-	30, // [30:60] is the sub-list for method output_type
-	0,  // [0:30] is the sub-list for method input_type
+	1,  // 1: ionscale.v1.IonscaleService.Authenticate:input_type -> ionscale.v1.AuthenticateRequest
+	2,  // 2: ionscale.v1.IonscaleService.GetDefaultDERPMap:input_type -> ionscale.v1.GetDefaultDERPMapRequest
+	3,  // 3: ionscale.v1.IonscaleService.SetDefaultDERPMap:input_type -> ionscale.v1.SetDefaultDERPMapRequest
+	4,  // 4: ionscale.v1.IonscaleService.ResetDefaultDERPMap:input_type -> ionscale.v1.ResetDefaultDERPMapRequest
+	5,  // 5: ionscale.v1.IonscaleService.CreateTailnet:input_type -> ionscale.v1.CreateTailnetRequest
+	6,  // 6: ionscale.v1.IonscaleService.GetTailnet:input_type -> ionscale.v1.GetTailnetRequest
+	7,  // 7: ionscale.v1.IonscaleService.ListTailnets:input_type -> ionscale.v1.ListTailnetsRequest
+	8,  // 8: ionscale.v1.IonscaleService.DeleteTailnet:input_type -> ionscale.v1.DeleteTailnetRequest
+	9,  // 9: ionscale.v1.IonscaleService.GetDERPMap:input_type -> ionscale.v1.GetDERPMapRequest
+	10, // 10: ionscale.v1.IonscaleService.SetDERPMap:input_type -> ionscale.v1.SetDERPMapRequest
+	11, // 11: ionscale.v1.IonscaleService.ResetDERPMap:input_type -> ionscale.v1.ResetDERPMapRequest
+	12, // 12: ionscale.v1.IonscaleService.EnableFileSharing:input_type -> ionscale.v1.EnableFileSharingRequest
+	13, // 13: ionscale.v1.IonscaleService.DisableFileSharing:input_type -> ionscale.v1.DisableFileSharingRequest
+	14, // 14: ionscale.v1.IonscaleService.EnableServiceCollection:input_type -> ionscale.v1.EnableServiceCollectionRequest
+	15, // 15: ionscale.v1.IonscaleService.DisableServiceCollection:input_type -> ionscale.v1.DisableServiceCollectionRequest
+	16, // 16: ionscale.v1.IonscaleService.EnableSSH:input_type -> ionscale.v1.EnableSSHRequest
+	17, // 17: ionscale.v1.IonscaleService.DisableSSH:input_type -> ionscale.v1.DisableSSHRequest
+	18, // 18: ionscale.v1.IonscaleService.EnableMachineAuthorization:input_type -> ionscale.v1.EnableMachineAuthorizationRequest
+	19, // 19: ionscale.v1.IonscaleService.DisableMachineAuthorization:input_type -> ionscale.v1.DisableMachineAuthorizationRequest
+	20, // 20: ionscale.v1.IonscaleService.GetDNSConfig:input_type -> ionscale.v1.GetDNSConfigRequest
+	21, // 21: ionscale.v1.IonscaleService.SetDNSConfig:input_type -> ionscale.v1.SetDNSConfigRequest
+	22, // 22: ionscale.v1.IonscaleService.GetIAMPolicy:input_type -> ionscale.v1.GetIAMPolicyRequest
+	23, // 23: ionscale.v1.IonscaleService.SetIAMPolicy:input_type -> ionscale.v1.SetIAMPolicyRequest
+	24, // 24: ionscale.v1.IonscaleService.GetACLPolicy:input_type -> ionscale.v1.GetACLPolicyRequest
+	25, // 25: ionscale.v1.IonscaleService.SetACLPolicy:input_type -> ionscale.v1.SetACLPolicyRequest
+	26, // 26: ionscale.v1.IonscaleService.GetAuthKey:input_type -> ionscale.v1.GetAuthKeyRequest
+	27, // 27: ionscale.v1.IonscaleService.CreateAuthKey:input_type -> ionscale.v1.CreateAuthKeyRequest
+	28, // 28: ionscale.v1.IonscaleService.DeleteAuthKey:input_type -> ionscale.v1.DeleteAuthKeyRequest
+	29, // 29: ionscale.v1.IonscaleService.ListAuthKeys:input_type -> ionscale.v1.ListAuthKeysRequest
+	30, // 30: ionscale.v1.IonscaleService.ListUsers:input_type -> ionscale.v1.ListUsersRequest
+	31, // 31: ionscale.v1.IonscaleService.DeleteUser:input_type -> ionscale.v1.DeleteUserRequest
+	32, // 32: ionscale.v1.IonscaleService.GetMachine:input_type -> ionscale.v1.GetMachineRequest
+	33, // 33: ionscale.v1.IonscaleService.ListMachines:input_type -> ionscale.v1.ListMachinesRequest
+	34, // 34: ionscale.v1.IonscaleService.AuthorizeMachine:input_type -> ionscale.v1.AuthorizeMachineRequest
+	35, // 35: ionscale.v1.IonscaleService.ExpireMachine:input_type -> ionscale.v1.ExpireMachineRequest
+	36, // 36: ionscale.v1.IonscaleService.DeleteMachine:input_type -> ionscale.v1.DeleteMachineRequest
+	37, // 37: ionscale.v1.IonscaleService.SetMachineKeyExpiry:input_type -> ionscale.v1.SetMachineKeyExpiryRequest
+	38, // 38: ionscale.v1.IonscaleService.GetMachineRoutes:input_type -> ionscale.v1.GetMachineRoutesRequest
+	39, // 39: ionscale.v1.IonscaleService.EnableMachineRoutes:input_type -> ionscale.v1.EnableMachineRoutesRequest
+	40, // 40: ionscale.v1.IonscaleService.DisableMachineRoutes:input_type -> ionscale.v1.DisableMachineRoutesRequest
+	41, // 41: ionscale.v1.IonscaleService.EnableExitNode:input_type -> ionscale.v1.EnableExitNodeRequest
+	42, // 42: ionscale.v1.IonscaleService.DisableExitNode:input_type -> ionscale.v1.DisableExitNodeRequest
+	43, // 43: ionscale.v1.IonscaleService.GetVersion:output_type -> ionscale.v1.GetVersionResponse
+	44, // 44: ionscale.v1.IonscaleService.Authenticate:output_type -> ionscale.v1.AuthenticateResponse
+	45, // 45: ionscale.v1.IonscaleService.GetDefaultDERPMap:output_type -> ionscale.v1.GetDefaultDERPMapResponse
+	46, // 46: ionscale.v1.IonscaleService.SetDefaultDERPMap:output_type -> ionscale.v1.SetDefaultDERPMapResponse
+	47, // 47: ionscale.v1.IonscaleService.ResetDefaultDERPMap:output_type -> ionscale.v1.ResetDefaultDERPMapResponse
+	48, // 48: ionscale.v1.IonscaleService.CreateTailnet:output_type -> ionscale.v1.CreateTailnetResponse
+	49, // 49: ionscale.v1.IonscaleService.GetTailnet:output_type -> ionscale.v1.GetTailnetResponse
+	50, // 50: ionscale.v1.IonscaleService.ListTailnets:output_type -> ionscale.v1.ListTailnetsResponse
+	51, // 51: ionscale.v1.IonscaleService.DeleteTailnet:output_type -> ionscale.v1.DeleteTailnetResponse
+	52, // 52: ionscale.v1.IonscaleService.GetDERPMap:output_type -> ionscale.v1.GetDERPMapResponse
+	53, // 53: ionscale.v1.IonscaleService.SetDERPMap:output_type -> ionscale.v1.SetDERPMapResponse
+	54, // 54: ionscale.v1.IonscaleService.ResetDERPMap:output_type -> ionscale.v1.ResetDERPMapResponse
+	55, // 55: ionscale.v1.IonscaleService.EnableFileSharing:output_type -> ionscale.v1.EnableFileSharingResponse
+	56, // 56: ionscale.v1.IonscaleService.DisableFileSharing:output_type -> ionscale.v1.DisableFileSharingResponse
+	57, // 57: ionscale.v1.IonscaleService.EnableServiceCollection:output_type -> ionscale.v1.EnableServiceCollectionResponse
+	58, // 58: ionscale.v1.IonscaleService.DisableServiceCollection:output_type -> ionscale.v1.DisableServiceCollectionResponse
+	59, // 59: ionscale.v1.IonscaleService.EnableSSH:output_type -> ionscale.v1.EnableSSHResponse
+	60, // 60: ionscale.v1.IonscaleService.DisableSSH:output_type -> ionscale.v1.DisableSSHResponse
+	61, // 61: ionscale.v1.IonscaleService.EnableMachineAuthorization:output_type -> ionscale.v1.EnableMachineAuthorizationResponse
+	62, // 62: ionscale.v1.IonscaleService.DisableMachineAuthorization:output_type -> ionscale.v1.DisableMachineAuthorizationResponse
+	63, // 63: ionscale.v1.IonscaleService.GetDNSConfig:output_type -> ionscale.v1.GetDNSConfigResponse
+	64, // 64: ionscale.v1.IonscaleService.SetDNSConfig:output_type -> ionscale.v1.SetDNSConfigResponse
+	65, // 65: ionscale.v1.IonscaleService.GetIAMPolicy:output_type -> ionscale.v1.GetIAMPolicyResponse
+	66, // 66: ionscale.v1.IonscaleService.SetIAMPolicy:output_type -> ionscale.v1.SetIAMPolicyResponse
+	67, // 67: ionscale.v1.IonscaleService.GetACLPolicy:output_type -> ionscale.v1.GetACLPolicyResponse
+	68, // 68: ionscale.v1.IonscaleService.SetACLPolicy:output_type -> ionscale.v1.SetACLPolicyResponse
+	69, // 69: ionscale.v1.IonscaleService.GetAuthKey:output_type -> ionscale.v1.GetAuthKeyResponse
+	70, // 70: ionscale.v1.IonscaleService.CreateAuthKey:output_type -> ionscale.v1.CreateAuthKeyResponse
+	71, // 71: ionscale.v1.IonscaleService.DeleteAuthKey:output_type -> ionscale.v1.DeleteAuthKeyResponse
+	72, // 72: ionscale.v1.IonscaleService.ListAuthKeys:output_type -> ionscale.v1.ListAuthKeysResponse
+	73, // 73: ionscale.v1.IonscaleService.ListUsers:output_type -> ionscale.v1.ListUsersResponse
+	74, // 74: ionscale.v1.IonscaleService.DeleteUser:output_type -> ionscale.v1.DeleteUserResponse
+	75, // 75: ionscale.v1.IonscaleService.GetMachine:output_type -> ionscale.v1.GetMachineResponse
+	76, // 76: ionscale.v1.IonscaleService.ListMachines:output_type -> ionscale.v1.ListMachinesResponse
+	77, // 77: ionscale.v1.IonscaleService.AuthorizeMachine:output_type -> ionscale.v1.AuthorizeMachineResponse
+	78, // 78: ionscale.v1.IonscaleService.ExpireMachine:output_type -> ionscale.v1.ExpireMachineResponse
+	79, // 79: ionscale.v1.IonscaleService.DeleteMachine:output_type -> ionscale.v1.DeleteMachineResponse
+	80, // 80: ionscale.v1.IonscaleService.SetMachineKeyExpiry:output_type -> ionscale.v1.SetMachineKeyExpiryResponse
+	81, // 81: ionscale.v1.IonscaleService.GetMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
+	82, // 82: ionscale.v1.IonscaleService.EnableMachineRoutes:output_type -> ionscale.v1.EnableMachineRoutesResponse
+	83, // 83: ionscale.v1.IonscaleService.DisableMachineRoutes:output_type -> ionscale.v1.DisableMachineRoutesResponse
+	84, // 84: ionscale.v1.IonscaleService.EnableExitNode:output_type -> ionscale.v1.EnableExitNodeResponse
+	85, // 85: ionscale.v1.IonscaleService.DisableExitNode:output_type -> ionscale.v1.DisableExitNodeResponse
+	43, // [43:86] is the sub-list for method output_type
+	0,  // [0:43] is the sub-list for method input_type
 	0,  // [0:0] is the sub-list for extension type_name
 	0,  // [0:0] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
@@ -354,17 +490,17 @@ func file_ionscale_v1_ionscale_proto_init() {
 	if File_ionscale_v1_ionscale_proto != nil {
 		return
 	}
-	file_ionscale_v1_version_proto_init()
+	file_ionscale_v1_acl_proto_init()
 	file_ionscale_v1_auth_proto_init()
-	file_ionscale_v1_tailnets_proto_init()
-	file_ionscale_v1_users_proto_init()
 	file_ionscale_v1_auth_keys_proto_init()
-	file_ionscale_v1_machines_proto_init()
-	file_ionscale_v1_routes_proto_init()
+	file_ionscale_v1_derp_proto_init()
 	file_ionscale_v1_dns_proto_init()
 	file_ionscale_v1_iam_proto_init()
-	file_ionscale_v1_acl_proto_init()
-	file_ionscale_v1_derp_proto_init()
+	file_ionscale_v1_machines_proto_init()
+	file_ionscale_v1_routes_proto_init()
+	file_ionscale_v1_tailnets_proto_init()
+	file_ionscale_v1_users_proto_init()
+	file_ionscale_v1_version_proto_init()
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
@@ -28,13 +28,25 @@ const (
 // IonscaleServiceClient is a client for the ionscale.v1.IonscaleService service.
 type IonscaleServiceClient interface {
 	GetVersion(context.Context, *connect_go.Request[v1.GetVersionRequest]) (*connect_go.Response[v1.GetVersionResponse], error)
-	Authenticate(context.Context, *connect_go.Request[v1.AuthenticationRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticationResponse], error)
-	GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error)
-	SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error)
+	Authenticate(context.Context, *connect_go.Request[v1.AuthenticateRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticateResponse], error)
+	GetDefaultDERPMap(context.Context, *connect_go.Request[v1.GetDefaultDERPMapRequest]) (*connect_go.Response[v1.GetDefaultDERPMapResponse], error)
+	SetDefaultDERPMap(context.Context, *connect_go.Request[v1.SetDefaultDERPMapRequest]) (*connect_go.Response[v1.SetDefaultDERPMapResponse], error)
+	ResetDefaultDERPMap(context.Context, *connect_go.Request[v1.ResetDefaultDERPMapRequest]) (*connect_go.Response[v1.ResetDefaultDERPMapResponse], error)
 	CreateTailnet(context.Context, *connect_go.Request[v1.CreateTailnetRequest]) (*connect_go.Response[v1.CreateTailnetResponse], error)
 	GetTailnet(context.Context, *connect_go.Request[v1.GetTailnetRequest]) (*connect_go.Response[v1.GetTailnetResponse], error)
-	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error)
+	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error)
 	DeleteTailnet(context.Context, *connect_go.Request[v1.DeleteTailnetRequest]) (*connect_go.Response[v1.DeleteTailnetResponse], error)
+	GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error)
+	SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error)
+	ResetDERPMap(context.Context, *connect_go.Request[v1.ResetDERPMapRequest]) (*connect_go.Response[v1.ResetDERPMapResponse], error)
+	EnableFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error)
+	DisableFileSharing(context.Context, *connect_go.Request[v1.DisableFileSharingRequest]) (*connect_go.Response[v1.DisableFileSharingResponse], error)
+	EnableServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error)
+	DisableServiceCollection(context.Context, *connect_go.Request[v1.DisableServiceCollectionRequest]) (*connect_go.Response[v1.DisableServiceCollectionResponse], error)
+	EnableSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error)
+	DisableSSH(context.Context, *connect_go.Request[v1.DisableSSHRequest]) (*connect_go.Response[v1.DisableSSHResponse], error)
+	EnableMachineAuthorization(context.Context, *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error)
+	DisableMachineAuthorization(context.Context, *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error)
 	GetDNSConfig(context.Context, *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error)
 	SetDNSConfig(context.Context, *connect_go.Request[v1.SetDNSConfigRequest]) (*connect_go.Response[v1.SetDNSConfigResponse], error)
 	GetIAMPolicy(context.Context, *connect_go.Request[v1.GetIAMPolicyRequest]) (*connect_go.Response[v1.GetIAMPolicyResponse], error)
@@ -49,14 +61,15 @@ type IonscaleServiceClient interface {
 	DeleteUser(context.Context, *connect_go.Request[v1.DeleteUserRequest]) (*connect_go.Response[v1.DeleteUserResponse], error)
 	GetMachine(context.Context, *connect_go.Request[v1.GetMachineRequest]) (*connect_go.Response[v1.GetMachineResponse], error)
 	ListMachines(context.Context, *connect_go.Request[v1.ListMachinesRequest]) (*connect_go.Response[v1.ListMachinesResponse], error)
+	AuthorizeMachine(context.Context, *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error)
 	ExpireMachine(context.Context, *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error)
 	DeleteMachine(context.Context, *connect_go.Request[v1.DeleteMachineRequest]) (*connect_go.Response[v1.DeleteMachineResponse], error)
 	SetMachineKeyExpiry(context.Context, *connect_go.Request[v1.SetMachineKeyExpiryRequest]) (*connect_go.Response[v1.SetMachineKeyExpiryResponse], error)
 	GetMachineRoutes(context.Context, *connect_go.Request[v1.GetMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
+	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error)
+	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error)
+	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error)
+	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error)
 }

 // NewIonscaleServiceClient constructs a client for the ionscale.v1.IonscaleService service. By
@@ -74,19 +87,24 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/GetVersion",
 			opts...,
 		),
-		authenticate: connect_go.NewClient[v1.AuthenticationRequest, v1.AuthenticationResponse](
+		authenticate: connect_go.NewClient[v1.AuthenticateRequest, v1.AuthenticateResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/Authenticate",
 			opts...,
 		),
-		getDERPMap: connect_go.NewClient[v1.GetDERPMapRequest, v1.GetDERPMapResponse](
+		getDefaultDERPMap: connect_go.NewClient[v1.GetDefaultDERPMapRequest, v1.GetDefaultDERPMapResponse](
 			httpClient,
-			baseURL+"/ionscale.v1.IonscaleService/GetDERPMap",
+			baseURL+"/ionscale.v1.IonscaleService/GetDefaultDERPMap",
 			opts...,
 		),
-		setDERPMap: connect_go.NewClient[v1.SetDERPMapRequest, v1.SetDERPMapResponse](
+		setDefaultDERPMap: connect_go.NewClient[v1.SetDefaultDERPMapRequest, v1.SetDefaultDERPMapResponse](
 			httpClient,
-			baseURL+"/ionscale.v1.IonscaleService/SetDERPMap",
+			baseURL+"/ionscale.v1.IonscaleService/SetDefaultDERPMap",
+			opts...,
+		),
+		resetDefaultDERPMap: connect_go.NewClient[v1.ResetDefaultDERPMapRequest, v1.ResetDefaultDERPMapResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/ResetDefaultDERPMap",
 			opts...,
 		),
 		createTailnet: connect_go.NewClient[v1.CreateTailnetRequest, v1.CreateTailnetResponse](
@@ -99,7 +117,7 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/GetTailnet",
 			opts...,
 		),
-		listTailnets: connect_go.NewClient[v1.ListTailnetRequest, v1.ListTailnetResponse](
+		listTailnets: connect_go.NewClient[v1.ListTailnetsRequest, v1.ListTailnetsResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/ListTailnets",
 			opts...,
@@ -109,6 +127,61 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/DeleteTailnet",
 			opts...,
 		),
+		getDERPMap: connect_go.NewClient[v1.GetDERPMapRequest, v1.GetDERPMapResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/GetDERPMap",
+			opts...,
+		),
+		setDERPMap: connect_go.NewClient[v1.SetDERPMapRequest, v1.SetDERPMapResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/SetDERPMap",
+			opts...,
+		),
+		resetDERPMap: connect_go.NewClient[v1.ResetDERPMapRequest, v1.ResetDERPMapResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/ResetDERPMap",
+			opts...,
+		),
+		enableFileSharing: connect_go.NewClient[v1.EnableFileSharingRequest, v1.EnableFileSharingResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/EnableFileSharing",
+			opts...,
+		),
+		disableFileSharing: connect_go.NewClient[v1.DisableFileSharingRequest, v1.DisableFileSharingResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/DisableFileSharing",
+			opts...,
+		),
+		enableServiceCollection: connect_go.NewClient[v1.EnableServiceCollectionRequest, v1.EnableServiceCollectionResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/EnableServiceCollection",
+			opts...,
+		),
+		disableServiceCollection: connect_go.NewClient[v1.DisableServiceCollectionRequest, v1.DisableServiceCollectionResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/DisableServiceCollection",
+			opts...,
+		),
+		enableSSH: connect_go.NewClient[v1.EnableSSHRequest, v1.EnableSSHResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/EnableSSH",
+			opts...,
+		),
+		disableSSH: connect_go.NewClient[v1.DisableSSHRequest, v1.DisableSSHResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/DisableSSH",
+			opts...,
+		),
+		enableMachineAuthorization: connect_go.NewClient[v1.EnableMachineAuthorizationRequest, v1.EnableMachineAuthorizationResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/EnableMachineAuthorization",
+			opts...,
+		),
+		disableMachineAuthorization: connect_go.NewClient[v1.DisableMachineAuthorizationRequest, v1.DisableMachineAuthorizationResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/DisableMachineAuthorization",
+			opts...,
+		),
 		getDNSConfig: connect_go.NewClient[v1.GetDNSConfigRequest, v1.GetDNSConfigResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/GetDNSConfig",
@@ -179,6 +252,11 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/ListMachines",
 			opts...,
 		),
+		authorizeMachine: connect_go.NewClient[v1.AuthorizeMachineRequest, v1.AuthorizeMachineResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/AuthorizeMachine",
+			opts...,
+		),
 		expireMachine: connect_go.NewClient[v1.ExpireMachineRequest, v1.ExpireMachineResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/ExpireMachine",
@@ -199,22 +277,22 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/GetMachineRoutes",
 			opts...,
 		),
-		enableMachineRoutes: connect_go.NewClient[v1.EnableMachineRoutesRequest, v1.GetMachineRoutesResponse](
+		enableMachineRoutes: connect_go.NewClient[v1.EnableMachineRoutesRequest, v1.EnableMachineRoutesResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/EnableMachineRoutes",
 			opts...,
 		),
-		disableMachineRoutes: connect_go.NewClient[v1.DisableMachineRoutesRequest, v1.GetMachineRoutesResponse](
+		disableMachineRoutes: connect_go.NewClient[v1.DisableMachineRoutesRequest, v1.DisableMachineRoutesResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/DisableMachineRoutes",
 			opts...,
 		),
-		enableExitNode: connect_go.NewClient[v1.EnableExitNodeRequest, v1.GetMachineRoutesResponse](
+		enableExitNode: connect_go.NewClient[v1.EnableExitNodeRequest, v1.EnableExitNodeResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/EnableExitNode",
 			opts...,
 		),
-		disableExitNode: connect_go.NewClient[v1.DisableExitNodeRequest, v1.GetMachineRoutesResponse](
+		disableExitNode: connect_go.NewClient[v1.DisableExitNodeRequest, v1.DisableExitNodeResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/DisableExitNode",
 			opts...,
@@ -224,36 +302,49 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,

 // ionscaleServiceClient implements IonscaleServiceClient.
 type ionscaleServiceClient struct {
-	getVersion           *connect_go.Client[v1.GetVersionRequest, v1.GetVersionResponse]
-	authenticate         *connect_go.Client[v1.AuthenticationRequest, v1.AuthenticationResponse]
-	getDERPMap           *connect_go.Client[v1.GetDERPMapRequest, v1.GetDERPMapResponse]
-	setDERPMap           *connect_go.Client[v1.SetDERPMapRequest, v1.SetDERPMapResponse]
-	createTailnet        *connect_go.Client[v1.CreateTailnetRequest, v1.CreateTailnetResponse]
-	getTailnet           *connect_go.Client[v1.GetTailnetRequest, v1.GetTailnetResponse]
-	listTailnets         *connect_go.Client[v1.ListTailnetRequest, v1.ListTailnetResponse]
-	deleteTailnet        *connect_go.Client[v1.DeleteTailnetRequest, v1.DeleteTailnetResponse]
-	getDNSConfig         *connect_go.Client[v1.GetDNSConfigRequest, v1.GetDNSConfigResponse]
-	setDNSConfig         *connect_go.Client[v1.SetDNSConfigRequest, v1.SetDNSConfigResponse]
-	getIAMPolicy         *connect_go.Client[v1.GetIAMPolicyRequest, v1.GetIAMPolicyResponse]
-	setIAMPolicy         *connect_go.Client[v1.SetIAMPolicyRequest, v1.SetIAMPolicyResponse]
-	getACLPolicy         *connect_go.Client[v1.GetACLPolicyRequest, v1.GetACLPolicyResponse]
-	setACLPolicy         *connect_go.Client[v1.SetACLPolicyRequest, v1.SetACLPolicyResponse]
-	getAuthKey           *connect_go.Client[v1.GetAuthKeyRequest, v1.GetAuthKeyResponse]
-	createAuthKey        *connect_go.Client[v1.CreateAuthKeyRequest, v1.CreateAuthKeyResponse]
-	deleteAuthKey        *connect_go.Client[v1.DeleteAuthKeyRequest, v1.DeleteAuthKeyResponse]
-	listAuthKeys         *connect_go.Client[v1.ListAuthKeysRequest, v1.ListAuthKeysResponse]
-	listUsers            *connect_go.Client[v1.ListUsersRequest, v1.ListUsersResponse]
-	deleteUser           *connect_go.Client[v1.DeleteUserRequest, v1.DeleteUserResponse]
-	getMachine           *connect_go.Client[v1.GetMachineRequest, v1.GetMachineResponse]
-	listMachines         *connect_go.Client[v1.ListMachinesRequest, v1.ListMachinesResponse]
-	expireMachine        *connect_go.Client[v1.ExpireMachineRequest, v1.ExpireMachineResponse]
-	deleteMachine        *connect_go.Client[v1.DeleteMachineRequest, v1.DeleteMachineResponse]
-	setMachineKeyExpiry  *connect_go.Client[v1.SetMachineKeyExpiryRequest, v1.SetMachineKeyExpiryResponse]
-	getMachineRoutes     *connect_go.Client[v1.GetMachineRoutesRequest, v1.GetMachineRoutesResponse]
-	enableMachineRoutes  *connect_go.Client[v1.EnableMachineRoutesRequest, v1.GetMachineRoutesResponse]
-	disableMachineRoutes *connect_go.Client[v1.DisableMachineRoutesRequest, v1.GetMachineRoutesResponse]
-	enableExitNode       *connect_go.Client[v1.EnableExitNodeRequest, v1.GetMachineRoutesResponse]
-	disableExitNode      *connect_go.Client[v1.DisableExitNodeRequest, v1.GetMachineRoutesResponse]
+	getVersion                  *connect_go.Client[v1.GetVersionRequest, v1.GetVersionResponse]
+	authenticate                *connect_go.Client[v1.AuthenticateRequest, v1.AuthenticateResponse]
+	getDefaultDERPMap           *connect_go.Client[v1.GetDefaultDERPMapRequest, v1.GetDefaultDERPMapResponse]
+	setDefaultDERPMap           *connect_go.Client[v1.SetDefaultDERPMapRequest, v1.SetDefaultDERPMapResponse]
+	resetDefaultDERPMap         *connect_go.Client[v1.ResetDefaultDERPMapRequest, v1.ResetDefaultDERPMapResponse]
+	createTailnet               *connect_go.Client[v1.CreateTailnetRequest, v1.CreateTailnetResponse]
+	getTailnet                  *connect_go.Client[v1.GetTailnetRequest, v1.GetTailnetResponse]
+	listTailnets                *connect_go.Client[v1.ListTailnetsRequest, v1.ListTailnetsResponse]
+	deleteTailnet               *connect_go.Client[v1.DeleteTailnetRequest, v1.DeleteTailnetResponse]
+	getDERPMap                  *connect_go.Client[v1.GetDERPMapRequest, v1.GetDERPMapResponse]
+	setDERPMap                  *connect_go.Client[v1.SetDERPMapRequest, v1.SetDERPMapResponse]
+	resetDERPMap                *connect_go.Client[v1.ResetDERPMapRequest, v1.ResetDERPMapResponse]
+	enableFileSharing           *connect_go.Client[v1.EnableFileSharingRequest, v1.EnableFileSharingResponse]
+	disableFileSharing          *connect_go.Client[v1.DisableFileSharingRequest, v1.DisableFileSharingResponse]
+	enableServiceCollection     *connect_go.Client[v1.EnableServiceCollectionRequest, v1.EnableServiceCollectionResponse]
+	disableServiceCollection    *connect_go.Client[v1.DisableServiceCollectionRequest, v1.DisableServiceCollectionResponse]
+	enableSSH                   *connect_go.Client[v1.EnableSSHRequest, v1.EnableSSHResponse]
+	disableSSH                  *connect_go.Client[v1.DisableSSHRequest, v1.DisableSSHResponse]
+	enableMachineAuthorization  *connect_go.Client[v1.EnableMachineAuthorizationRequest, v1.EnableMachineAuthorizationResponse]
+	disableMachineAuthorization *connect_go.Client[v1.DisableMachineAuthorizationRequest, v1.DisableMachineAuthorizationResponse]
+	getDNSConfig                *connect_go.Client[v1.GetDNSConfigRequest, v1.GetDNSConfigResponse]
+	setDNSConfig                *connect_go.Client[v1.SetDNSConfigRequest, v1.SetDNSConfigResponse]
+	getIAMPolicy                *connect_go.Client[v1.GetIAMPolicyRequest, v1.GetIAMPolicyResponse]
+	setIAMPolicy                *connect_go.Client[v1.SetIAMPolicyRequest, v1.SetIAMPolicyResponse]
+	getACLPolicy                *connect_go.Client[v1.GetACLPolicyRequest, v1.GetACLPolicyResponse]
+	setACLPolicy                *connect_go.Client[v1.SetACLPolicyRequest, v1.SetACLPolicyResponse]
+	getAuthKey                  *connect_go.Client[v1.GetAuthKeyRequest, v1.GetAuthKeyResponse]
+	createAuthKey               *connect_go.Client[v1.CreateAuthKeyRequest, v1.CreateAuthKeyResponse]
+	deleteAuthKey               *connect_go.Client[v1.DeleteAuthKeyRequest, v1.DeleteAuthKeyResponse]
+	listAuthKeys                *connect_go.Client[v1.ListAuthKeysRequest, v1.ListAuthKeysResponse]
+	listUsers                   *connect_go.Client[v1.ListUsersRequest, v1.ListUsersResponse]
+	deleteUser                  *connect_go.Client[v1.DeleteUserRequest, v1.DeleteUserResponse]
+	getMachine                  *connect_go.Client[v1.GetMachineRequest, v1.GetMachineResponse]
+	listMachines                *connect_go.Client[v1.ListMachinesRequest, v1.ListMachinesResponse]
+	authorizeMachine            *connect_go.Client[v1.AuthorizeMachineRequest, v1.AuthorizeMachineResponse]
+	expireMachine               *connect_go.Client[v1.ExpireMachineRequest, v1.ExpireMachineResponse]
+	deleteMachine               *connect_go.Client[v1.DeleteMachineRequest, v1.DeleteMachineResponse]
+	setMachineKeyExpiry         *connect_go.Client[v1.SetMachineKeyExpiryRequest, v1.SetMachineKeyExpiryResponse]
+	getMachineRoutes            *connect_go.Client[v1.GetMachineRoutesRequest, v1.GetMachineRoutesResponse]
+	enableMachineRoutes         *connect_go.Client[v1.EnableMachineRoutesRequest, v1.EnableMachineRoutesResponse]
+	disableMachineRoutes        *connect_go.Client[v1.DisableMachineRoutesRequest, v1.DisableMachineRoutesResponse]
+	enableExitNode              *connect_go.Client[v1.EnableExitNodeRequest, v1.EnableExitNodeResponse]
+	disableExitNode             *connect_go.Client[v1.DisableExitNodeRequest, v1.DisableExitNodeResponse]
 }

 // GetVersion calls ionscale.v1.IonscaleService.GetVersion.
@@ -262,18 +353,23 @@ func (c *ionscaleServiceClient) GetVersion(ctx context.Context, req *connect_go.
 }

 // Authenticate calls ionscale.v1.IonscaleService.Authenticate.
-func (c *ionscaleServiceClient) Authenticate(ctx context.Context, req *connect_go.Request[v1.AuthenticationRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticationResponse], error) {
+func (c *ionscaleServiceClient) Authenticate(ctx context.Context, req *connect_go.Request[v1.AuthenticateRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticateResponse], error) {
 	return c.authenticate.CallServerStream(ctx, req)
 }

-// GetDERPMap calls ionscale.v1.IonscaleService.GetDERPMap.
-func (c *ionscaleServiceClient) GetDERPMap(ctx context.Context, req *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error) {
-	return c.getDERPMap.CallUnary(ctx, req)
+// GetDefaultDERPMap calls ionscale.v1.IonscaleService.GetDefaultDERPMap.
+func (c *ionscaleServiceClient) GetDefaultDERPMap(ctx context.Context, req *connect_go.Request[v1.GetDefaultDERPMapRequest]) (*connect_go.Response[v1.GetDefaultDERPMapResponse], error) {
+	return c.getDefaultDERPMap.CallUnary(ctx, req)
 }

-// SetDERPMap calls ionscale.v1.IonscaleService.SetDERPMap.
-func (c *ionscaleServiceClient) SetDERPMap(ctx context.Context, req *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error) {
-	return c.setDERPMap.CallUnary(ctx, req)
+// SetDefaultDERPMap calls ionscale.v1.IonscaleService.SetDefaultDERPMap.
+func (c *ionscaleServiceClient) SetDefaultDERPMap(ctx context.Context, req *connect_go.Request[v1.SetDefaultDERPMapRequest]) (*connect_go.Response[v1.SetDefaultDERPMapResponse], error) {
+	return c.setDefaultDERPMap.CallUnary(ctx, req)
+}
+
+// ResetDefaultDERPMap calls ionscale.v1.IonscaleService.ResetDefaultDERPMap.
+func (c *ionscaleServiceClient) ResetDefaultDERPMap(ctx context.Context, req *connect_go.Request[v1.ResetDefaultDERPMapRequest]) (*connect_go.Response[v1.ResetDefaultDERPMapResponse], error) {
+	return c.resetDefaultDERPMap.CallUnary(ctx, req)
 }

 // CreateTailnet calls ionscale.v1.IonscaleService.CreateTailnet.
@@ -287,7 +383,7 @@ func (c *ionscaleServiceClient) GetTailnet(ctx context.Context, req *connect_go.
 }

 // ListTailnets calls ionscale.v1.IonscaleService.ListTailnets.
-func (c *ionscaleServiceClient) ListTailnets(ctx context.Context, req *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error) {
+func (c *ionscaleServiceClient) ListTailnets(ctx context.Context, req *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error) {
 	return c.listTailnets.CallUnary(ctx, req)
 }

@@ -296,6 +392,61 @@ func (c *ionscaleServiceClient) DeleteTailnet(ctx context.Context, req *connect_
 	return c.deleteTailnet.CallUnary(ctx, req)
 }

+// GetDERPMap calls ionscale.v1.IonscaleService.GetDERPMap.
+func (c *ionscaleServiceClient) GetDERPMap(ctx context.Context, req *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error) {
+	return c.getDERPMap.CallUnary(ctx, req)
+}
+
+// SetDERPMap calls ionscale.v1.IonscaleService.SetDERPMap.
+func (c *ionscaleServiceClient) SetDERPMap(ctx context.Context, req *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error) {
+	return c.setDERPMap.CallUnary(ctx, req)
+}
+
+// ResetDERPMap calls ionscale.v1.IonscaleService.ResetDERPMap.
+func (c *ionscaleServiceClient) ResetDERPMap(ctx context.Context, req *connect_go.Request[v1.ResetDERPMapRequest]) (*connect_go.Response[v1.ResetDERPMapResponse], error) {
+	return c.resetDERPMap.CallUnary(ctx, req)
+}
+
+// EnableFileSharing calls ionscale.v1.IonscaleService.EnableFileSharing.
+func (c *ionscaleServiceClient) EnableFileSharing(ctx context.Context, req *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error) {
+	return c.enableFileSharing.CallUnary(ctx, req)
+}
+
+// DisableFileSharing calls ionscale.v1.IonscaleService.DisableFileSharing.
+func (c *ionscaleServiceClient) DisableFileSharing(ctx context.Context, req *connect_go.Request[v1.DisableFileSharingRequest]) (*connect_go.Response[v1.DisableFileSharingResponse], error) {
+	return c.disableFileSharing.CallUnary(ctx, req)
+}
+
+// EnableServiceCollection calls ionscale.v1.IonscaleService.EnableServiceCollection.
+func (c *ionscaleServiceClient) EnableServiceCollection(ctx context.Context, req *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error) {
+	return c.enableServiceCollection.CallUnary(ctx, req)
+}
+
+// DisableServiceCollection calls ionscale.v1.IonscaleService.DisableServiceCollection.
+func (c *ionscaleServiceClient) DisableServiceCollection(ctx context.Context, req *connect_go.Request[v1.DisableServiceCollectionRequest]) (*connect_go.Response[v1.DisableServiceCollectionResponse], error) {
+	return c.disableServiceCollection.CallUnary(ctx, req)
+}
+
+// EnableSSH calls ionscale.v1.IonscaleService.EnableSSH.
+func (c *ionscaleServiceClient) EnableSSH(ctx context.Context, req *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error) {
+	return c.enableSSH.CallUnary(ctx, req)
+}
+
+// DisableSSH calls ionscale.v1.IonscaleService.DisableSSH.
+func (c *ionscaleServiceClient) DisableSSH(ctx context.Context, req *connect_go.Request[v1.DisableSSHRequest]) (*connect_go.Response[v1.DisableSSHResponse], error) {
+	return c.disableSSH.CallUnary(ctx, req)
+}
+
+// EnableMachineAuthorization calls ionscale.v1.IonscaleService.EnableMachineAuthorization.
+func (c *ionscaleServiceClient) EnableMachineAuthorization(ctx context.Context, req *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error) {
+	return c.enableMachineAuthorization.CallUnary(ctx, req)
+}
+
+// DisableMachineAuthorization calls ionscale.v1.IonscaleService.DisableMachineAuthorization.
+func (c *ionscaleServiceClient) DisableMachineAuthorization(ctx context.Context, req *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error) {
+	return c.disableMachineAuthorization.CallUnary(ctx, req)
+}
+
 // GetDNSConfig calls ionscale.v1.IonscaleService.GetDNSConfig.
 func (c *ionscaleServiceClient) GetDNSConfig(ctx context.Context, req *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error) {
 	return c.getDNSConfig.CallUnary(ctx, req)
@@ -366,6 +517,11 @@ func (c *ionscaleServiceClient) ListMachines(ctx context.Context, req *connect_g
 	return c.listMachines.CallUnary(ctx, req)
 }

+// AuthorizeMachine calls ionscale.v1.IonscaleService.AuthorizeMachine.
+func (c *ionscaleServiceClient) AuthorizeMachine(ctx context.Context, req *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error) {
+	return c.authorizeMachine.CallUnary(ctx, req)
+}
+
 // ExpireMachine calls ionscale.v1.IonscaleService.ExpireMachine.
 func (c *ionscaleServiceClient) ExpireMachine(ctx context.Context, req *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error) {
 	return c.expireMachine.CallUnary(ctx, req)
@@ -387,35 +543,47 @@ func (c *ionscaleServiceClient) GetMachineRoutes(ctx context.Context, req *conne
 }

 // EnableMachineRoutes calls ionscale.v1.IonscaleService.EnableMachineRoutes.
-func (c *ionscaleServiceClient) EnableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) EnableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error) {
 	return c.enableMachineRoutes.CallUnary(ctx, req)
 }

 // DisableMachineRoutes calls ionscale.v1.IonscaleService.DisableMachineRoutes.
-func (c *ionscaleServiceClient) DisableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) DisableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error) {
 	return c.disableMachineRoutes.CallUnary(ctx, req)
 }

 // EnableExitNode calls ionscale.v1.IonscaleService.EnableExitNode.
-func (c *ionscaleServiceClient) EnableExitNode(ctx context.Context, req *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) EnableExitNode(ctx context.Context, req *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error) {
 	return c.enableExitNode.CallUnary(ctx, req)
 }

 // DisableExitNode calls ionscale.v1.IonscaleService.DisableExitNode.
-func (c *ionscaleServiceClient) DisableExitNode(ctx context.Context, req *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) DisableExitNode(ctx context.Context, req *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error) {
 	return c.disableExitNode.CallUnary(ctx, req)
 }

 // IonscaleServiceHandler is an implementation of the ionscale.v1.IonscaleService service.
 type IonscaleServiceHandler interface {
 	GetVersion(context.Context, *connect_go.Request[v1.GetVersionRequest]) (*connect_go.Response[v1.GetVersionResponse], error)
-	Authenticate(context.Context, *connect_go.Request[v1.AuthenticationRequest], *connect_go.ServerStream[v1.AuthenticationResponse]) error
-	GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error)
-	SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error)
+	Authenticate(context.Context, *connect_go.Request[v1.AuthenticateRequest], *connect_go.ServerStream[v1.AuthenticateResponse]) error
+	GetDefaultDERPMap(context.Context, *connect_go.Request[v1.GetDefaultDERPMapRequest]) (*connect_go.Response[v1.GetDefaultDERPMapResponse], error)
+	SetDefaultDERPMap(context.Context, *connect_go.Request[v1.SetDefaultDERPMapRequest]) (*connect_go.Response[v1.SetDefaultDERPMapResponse], error)
+	ResetDefaultDERPMap(context.Context, *connect_go.Request[v1.ResetDefaultDERPMapRequest]) (*connect_go.Response[v1.ResetDefaultDERPMapResponse], error)
 	CreateTailnet(context.Context, *connect_go.Request[v1.CreateTailnetRequest]) (*connect_go.Response[v1.CreateTailnetResponse], error)
 	GetTailnet(context.Context, *connect_go.Request[v1.GetTailnetRequest]) (*connect_go.Response[v1.GetTailnetResponse], error)
-	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error)
+	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error)
 	DeleteTailnet(context.Context, *connect_go.Request[v1.DeleteTailnetRequest]) (*connect_go.Response[v1.DeleteTailnetResponse], error)
+	GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error)
+	SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error)
+	ResetDERPMap(context.Context, *connect_go.Request[v1.ResetDERPMapRequest]) (*connect_go.Response[v1.ResetDERPMapResponse], error)
+	EnableFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error)
+	DisableFileSharing(context.Context, *connect_go.Request[v1.DisableFileSharingRequest]) (*connect_go.Response[v1.DisableFileSharingResponse], error)
+	EnableServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error)
+	DisableServiceCollection(context.Context, *connect_go.Request[v1.DisableServiceCollectionRequest]) (*connect_go.Response[v1.DisableServiceCollectionResponse], error)
+	EnableSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error)
+	DisableSSH(context.Context, *connect_go.Request[v1.DisableSSHRequest]) (*connect_go.Response[v1.DisableSSHResponse], error)
+	EnableMachineAuthorization(context.Context, *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error)
+	DisableMachineAuthorization(context.Context, *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error)
 	GetDNSConfig(context.Context, *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error)
 	SetDNSConfig(context.Context, *connect_go.Request[v1.SetDNSConfigRequest]) (*connect_go.Response[v1.SetDNSConfigResponse], error)
 	GetIAMPolicy(context.Context, *connect_go.Request[v1.GetIAMPolicyRequest]) (*connect_go.Response[v1.GetIAMPolicyResponse], error)
@@ -430,14 +598,15 @@ type IonscaleServiceHandler interface {
 	DeleteUser(context.Context, *connect_go.Request[v1.DeleteUserRequest]) (*connect_go.Response[v1.DeleteUserResponse], error)
 	GetMachine(context.Context, *connect_go.Request[v1.GetMachineRequest]) (*connect_go.Response[v1.GetMachineResponse], error)
 	ListMachines(context.Context, *connect_go.Request[v1.ListMachinesRequest]) (*connect_go.Response[v1.ListMachinesResponse], error)
+	AuthorizeMachine(context.Context, *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error)
 	ExpireMachine(context.Context, *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error)
 	DeleteMachine(context.Context, *connect_go.Request[v1.DeleteMachineRequest]) (*connect_go.Response[v1.DeleteMachineResponse], error)
 	SetMachineKeyExpiry(context.Context, *connect_go.Request[v1.SetMachineKeyExpiryRequest]) (*connect_go.Response[v1.SetMachineKeyExpiryResponse], error)
 	GetMachineRoutes(context.Context, *connect_go.Request[v1.GetMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
+	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error)
+	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error)
+	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error)
+	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error)
 }

 // NewIonscaleServiceHandler builds an HTTP handler from the service implementation. It returns the
@@ -457,14 +626,19 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.Authenticate,
 		opts...,
 	))
-	mux.Handle("/ionscale.v1.IonscaleService/GetDERPMap", connect_go.NewUnaryHandler(
-		"/ionscale.v1.IonscaleService/GetDERPMap",
-		svc.GetDERPMap,
+	mux.Handle("/ionscale.v1.IonscaleService/GetDefaultDERPMap", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/GetDefaultDERPMap",
+		svc.GetDefaultDERPMap,
 		opts...,
 	))
-	mux.Handle("/ionscale.v1.IonscaleService/SetDERPMap", connect_go.NewUnaryHandler(
-		"/ionscale.v1.IonscaleService/SetDERPMap",
-		svc.SetDERPMap,
+	mux.Handle("/ionscale.v1.IonscaleService/SetDefaultDERPMap", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/SetDefaultDERPMap",
+		svc.SetDefaultDERPMap,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/ResetDefaultDERPMap", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/ResetDefaultDERPMap",
+		svc.ResetDefaultDERPMap,
 		opts...,
 	))
 	mux.Handle("/ionscale.v1.IonscaleService/CreateTailnet", connect_go.NewUnaryHandler(
@@ -487,6 +661,61 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.DeleteTailnet,
 		opts...,
 	))
+	mux.Handle("/ionscale.v1.IonscaleService/GetDERPMap", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/GetDERPMap",
+		svc.GetDERPMap,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/SetDERPMap", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/SetDERPMap",
+		svc.SetDERPMap,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/ResetDERPMap", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/ResetDERPMap",
+		svc.ResetDERPMap,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/EnableFileSharing", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableFileSharing",
+		svc.EnableFileSharing,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/DisableFileSharing", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/DisableFileSharing",
+		svc.DisableFileSharing,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/EnableServiceCollection", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableServiceCollection",
+		svc.EnableServiceCollection,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/DisableServiceCollection", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/DisableServiceCollection",
+		svc.DisableServiceCollection,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/EnableSSH", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableSSH",
+		svc.EnableSSH,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/DisableSSH", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/DisableSSH",
+		svc.DisableSSH,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/EnableMachineAuthorization", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableMachineAuthorization",
+		svc.EnableMachineAuthorization,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/DisableMachineAuthorization", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/DisableMachineAuthorization",
+		svc.DisableMachineAuthorization,
+		opts...,
+	))
 	mux.Handle("/ionscale.v1.IonscaleService/GetDNSConfig", connect_go.NewUnaryHandler(
 		"/ionscale.v1.IonscaleService/GetDNSConfig",
 		svc.GetDNSConfig,
@@ -557,6 +786,11 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.ListMachines,
 		opts...,
 	))
+	mux.Handle("/ionscale.v1.IonscaleService/AuthorizeMachine", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/AuthorizeMachine",
+		svc.AuthorizeMachine,
+		opts...,
+	))
 	mux.Handle("/ionscale.v1.IonscaleService/ExpireMachine", connect_go.NewUnaryHandler(
 		"/ionscale.v1.IonscaleService/ExpireMachine",
 		svc.ExpireMachine,
@@ -607,16 +841,20 @@ func (UnimplementedIonscaleServiceHandler) GetVersion(context.Context, *connect_
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetVersion is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) Authenticate(context.Context, *connect_go.Request[v1.AuthenticationRequest], *connect_go.ServerStream[v1.AuthenticationResponse]) error {
+func (UnimplementedIonscaleServiceHandler) Authenticate(context.Context, *connect_go.Request[v1.AuthenticateRequest], *connect_go.ServerStream[v1.AuthenticateResponse]) error {
 	return connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.Authenticate is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error) {
-	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetDERPMap is not implemented"))
+func (UnimplementedIonscaleServiceHandler) GetDefaultDERPMap(context.Context, *connect_go.Request[v1.GetDefaultDERPMapRequest]) (*connect_go.Response[v1.GetDefaultDERPMapResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetDefaultDERPMap is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error) {
-	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.SetDERPMap is not implemented"))
+func (UnimplementedIonscaleServiceHandler) SetDefaultDERPMap(context.Context, *connect_go.Request[v1.SetDefaultDERPMapRequest]) (*connect_go.Response[v1.SetDefaultDERPMapResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.SetDefaultDERPMap is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) ResetDefaultDERPMap(context.Context, *connect_go.Request[v1.ResetDefaultDERPMapRequest]) (*connect_go.Response[v1.ResetDefaultDERPMapResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ResetDefaultDERPMap is not implemented"))
 }

 func (UnimplementedIonscaleServiceHandler) CreateTailnet(context.Context, *connect_go.Request[v1.CreateTailnetRequest]) (*connect_go.Response[v1.CreateTailnetResponse], error) {
@@ -627,7 +865,7 @@ func (UnimplementedIonscaleServiceHandler) GetTailnet(context.Context, *connect_
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetTailnet is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error) {
+func (UnimplementedIonscaleServiceHandler) ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ListTailnets is not implemented"))
 }

@@ -635,6 +873,50 @@ func (UnimplementedIonscaleServiceHandler) DeleteTailnet(context.Context, *conne
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DeleteTailnet is not implemented"))
 }

+func (UnimplementedIonscaleServiceHandler) GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetDERPMap is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.SetDERPMap is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) ResetDERPMap(context.Context, *connect_go.Request[v1.ResetDERPMapRequest]) (*connect_go.Response[v1.ResetDERPMapResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ResetDERPMap is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) EnableFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableFileSharing is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) DisableFileSharing(context.Context, *connect_go.Request[v1.DisableFileSharingRequest]) (*connect_go.Response[v1.DisableFileSharingResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableFileSharing is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) EnableServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableServiceCollection is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) DisableServiceCollection(context.Context, *connect_go.Request[v1.DisableServiceCollectionRequest]) (*connect_go.Response[v1.DisableServiceCollectionResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableServiceCollection is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) EnableSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableSSH is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) DisableSSH(context.Context, *connect_go.Request[v1.DisableSSHRequest]) (*connect_go.Response[v1.DisableSSHResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableSSH is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) EnableMachineAuthorization(context.Context, *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableMachineAuthorization is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) DisableMachineAuthorization(context.Context, *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableMachineAuthorization is not implemented"))
+}
+
 func (UnimplementedIonscaleServiceHandler) GetDNSConfig(context.Context, *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetDNSConfig is not implemented"))
 }
@@ -691,6 +973,10 @@ func (UnimplementedIonscaleServiceHandler) ListMachines(context.Context, *connec
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ListMachines is not implemented"))
 }

+func (UnimplementedIonscaleServiceHandler) AuthorizeMachine(context.Context, *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.AuthorizeMachine is not implemented"))
+}
+
 func (UnimplementedIonscaleServiceHandler) ExpireMachine(context.Context, *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ExpireMachine is not implemented"))
 }
@@ -707,18 +993,18 @@ func (UnimplementedIonscaleServiceHandler) GetMachineRoutes(context.Context, *co
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetMachineRoutes is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableMachineRoutes is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableMachineRoutes is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableExitNode is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableExitNode is not implemented"))
 }
@@ -9,7 +9,6 @@ package ionscalev1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/known/durationpb"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
@@ -473,6 +472,91 @@ func (x *GetMachineResponse) GetMachine() *Machine {
 	return nil
 }

+type AuthorizeMachineRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64 `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+}
+
+func (x *AuthorizeMachineRequest) Reset() {
+	*x = AuthorizeMachineRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthorizeMachineRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthorizeMachineRequest) ProtoMessage() {}
+
+func (x *AuthorizeMachineRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthorizeMachineRequest.ProtoReflect.Descriptor instead.
+func (*AuthorizeMachineRequest) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *AuthorizeMachineRequest) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+type AuthorizeMachineResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *AuthorizeMachineResponse) Reset() {
+	*x = AuthorizeMachineResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthorizeMachineResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthorizeMachineResponse) ProtoMessage() {}
+
+func (x *AuthorizeMachineResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthorizeMachineResponse.ProtoReflect.Descriptor instead.
+func (*AuthorizeMachineResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{11}
+}
+
 type Machine struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -498,12 +582,13 @@ type Machine struct {
 	AdvertisedRoutes   []string               `protobuf:"bytes,18,rep,name=advertised_routes,json=advertisedRoutes,proto3" json:"advertised_routes,omitempty"`
 	AdvertisedExitNode bool                   `protobuf:"varint,19,opt,name=advertised_exit_node,json=advertisedExitNode,proto3" json:"advertised_exit_node,omitempty"`
 	EnabledExitNode    bool                   `protobuf:"varint,20,opt,name=enabled_exit_node,json=enabledExitNode,proto3" json:"enabled_exit_node,omitempty"`
+	Authorized         bool                   `protobuf:"varint,21,opt,name=authorized,proto3" json:"authorized,omitempty"`
 }

 func (x *Machine) Reset() {
 	*x = Machine{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+		mi := &file_ionscale_v1_machines_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -516,7 +601,7 @@ func (x *Machine) String() string {
 func (*Machine) ProtoMessage() {}

 func (x *Machine) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+	mi := &file_ionscale_v1_machines_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -529,7 +614,7 @@ func (x *Machine) ProtoReflect() protoreflect.Message {

 // Deprecated: Use Machine.ProtoReflect.Descriptor instead.
 func (*Machine) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{10}
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{12}
 }

 func (x *Machine) GetId() uint64 {
@@ -672,6 +757,13 @@ func (x *Machine) GetEnabledExitNode() bool {
 	return false
 }

+func (x *Machine) GetAuthorized() bool {
+	if x != nil {
+		return x.Authorized
+	}
+	return false
+}
+
 type ClientConnectivity struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -683,7 +775,7 @@ type ClientConnectivity struct {
 func (x *ClientConnectivity) Reset() {
 	*x = ClientConnectivity{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+		mi := &file_ionscale_v1_machines_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -696,7 +788,7 @@ func (x *ClientConnectivity) String() string {
 func (*ClientConnectivity) ProtoMessage() {}

 func (x *ClientConnectivity) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+	mi := &file_ionscale_v1_machines_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -709,7 +801,7 @@ func (x *ClientConnectivity) ProtoReflect() protoreflect.Message {

 // Deprecated: Use ClientConnectivity.ProtoReflect.Descriptor instead.
 func (*ClientConnectivity) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{11}
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{13}
 }

 func (x *ClientConnectivity) GetEndpoints() []string {
@@ -726,9 +818,7 @@ var file_ionscale_v1_machines_proto_rawDesc = []byte{
 	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f,
 	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73,
 	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x66, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x22, 0x34, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
 	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c,
@@ -763,64 +853,71 @@ var file_ionscale_v1_machines_proto_rawDesc = []byte{
 	0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
 	0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x07, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x22, 0x91, 0x06, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x34, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x34, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x36, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1c, 0x0a, 0x09, 0x65,
-	0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
-	0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x09, 0x6c, 0x61, 0x73,
-	0x74, 0x5f, 0x73, 0x65, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08, 0x6c, 0x61, 0x73, 0x74, 0x53, 0x65,
-	0x65, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64,
-	0x12, 0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x52, 0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x24, 0x0a, 0x04,
-	0x75, 0x73, 0x65, 0x72, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x52, 0x04, 0x75, 0x73,
-	0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d,
-	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a,
-	0x02, 0x6f, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x6f, 0x73, 0x12, 0x50, 0x0a,
-	0x13, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-	0x76, 0x69, 0x74, 0x79, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x52, 0x12, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12,
-	0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x0e, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x65, 0x78,
-	0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69,
-	0x72, 0x65, 0x73, 0x41, 0x74, 0x12, 0x2e, 0x0a, 0x13, 0x6b, 0x65, 0x79, 0x5f, 0x65, 0x78, 0x70,
-	0x69, 0x72, 0x79, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x10, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x11, 0x6b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x44, 0x69, 0x73,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
-	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11,
-	0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x18, 0x12, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69,
-	0x73, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x64, 0x76,
-	0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64,
-	0x65, 0x18, 0x13, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69,
-	0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65,
-	0x18, 0x14, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x45,
-	0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x22, 0x32, 0x0a, 0x12, 0x43, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x1c, 0x0a,
-	0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x42, 0x3d, 0x5a, 0x3b, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65,
-	0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f,
-	0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x69, 0x6e, 0x65, 0x22, 0x38, 0x0a, 0x17, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
+	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x1a, 0x0a,
+	0x18, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xb1, 0x06, 0x0a, 0x07, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76,
+	0x34, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x34, 0x12, 0x12, 0x0a,
+	0x04, 0x69, 0x70, 0x76, 0x36, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76,
+	0x36, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x12,
+	0x37, 0x0a, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08,
+	0x6c, 0x61, 0x73, 0x74, 0x53, 0x65, 0x65, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65,
+	0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x12, 0x24, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x66, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73,
+	0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x25, 0x0a, 0x0e,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x6f, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x6f, 0x73, 0x12, 0x50, 0x0a, 0x13, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74,
+	0x79, 0x52, 0x12, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x74, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74,
+	0x12, 0x39, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x0f,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x12, 0x2e, 0x0a, 0x13, 0x6b,
+	0x65, 0x79, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x6b, 0x65, 0x79, 0x45, 0x78, 0x70,
+	0x69, 0x72, 0x79, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x11, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64,
+	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x12, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61,
+	0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12,
+	0x30, 0x0a, 0x14, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x78,
+	0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x13, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x61,
+	0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64,
+	0x65, 0x12, 0x2a, 0x0a, 0x11, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69,
+	0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x1e, 0x0a,
+	0x0a, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x18, 0x15, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x22, 0x32, 0x0a,
+	0x12, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76,
+	0x69, 0x74, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x73, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -835,7 +932,7 @@ func file_ionscale_v1_machines_proto_rawDescGZIP() []byte {
 	return file_ionscale_v1_machines_proto_rawDescData
 }

-var file_ionscale_v1_machines_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_ionscale_v1_machines_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_ionscale_v1_machines_proto_goTypes = []interface{}{
 	(*ListMachinesRequest)(nil),         // 0: ionscale.v1.ListMachinesRequest
 	(*ListMachinesResponse)(nil),        // 1: ionscale.v1.ListMachinesResponse
@@ -847,20 +944,22 @@ var file_ionscale_v1_machines_proto_goTypes = []interface{}{
 	(*SetMachineKeyExpiryResponse)(nil), // 7: ionscale.v1.SetMachineKeyExpiryResponse
 	(*GetMachineRequest)(nil),           // 8: ionscale.v1.GetMachineRequest
 	(*GetMachineResponse)(nil),          // 9: ionscale.v1.GetMachineResponse
-	(*Machine)(nil),                     // 10: ionscale.v1.Machine
-	(*ClientConnectivity)(nil),          // 11: ionscale.v1.ClientConnectivity
-	(*timestamppb.Timestamp)(nil),       // 12: google.protobuf.Timestamp
-	(*Ref)(nil),                         // 13: ionscale.v1.Ref
+	(*AuthorizeMachineRequest)(nil),     // 10: ionscale.v1.AuthorizeMachineRequest
+	(*AuthorizeMachineResponse)(nil),    // 11: ionscale.v1.AuthorizeMachineResponse
+	(*Machine)(nil),                     // 12: ionscale.v1.Machine
+	(*ClientConnectivity)(nil),          // 13: ionscale.v1.ClientConnectivity
+	(*timestamppb.Timestamp)(nil),       // 14: google.protobuf.Timestamp
+	(*Ref)(nil),                         // 15: ionscale.v1.Ref
 }
 var file_ionscale_v1_machines_proto_depIdxs = []int32{
-	10, // 0: ionscale.v1.ListMachinesResponse.machines:type_name -> ionscale.v1.Machine
-	10, // 1: ionscale.v1.GetMachineResponse.machine:type_name -> ionscale.v1.Machine
-	12, // 2: ionscale.v1.Machine.last_seen:type_name -> google.protobuf.Timestamp
-	13, // 3: ionscale.v1.Machine.tailnet:type_name -> ionscale.v1.Ref
-	13, // 4: ionscale.v1.Machine.user:type_name -> ionscale.v1.Ref
-	11, // 5: ionscale.v1.Machine.client_connectivity:type_name -> ionscale.v1.ClientConnectivity
-	12, // 6: ionscale.v1.Machine.created_at:type_name -> google.protobuf.Timestamp
-	12, // 7: ionscale.v1.Machine.expires_at:type_name -> google.protobuf.Timestamp
+	12, // 0: ionscale.v1.ListMachinesResponse.machines:type_name -> ionscale.v1.Machine
+	12, // 1: ionscale.v1.GetMachineResponse.machine:type_name -> ionscale.v1.Machine
+	14, // 2: ionscale.v1.Machine.last_seen:type_name -> google.protobuf.Timestamp
+	15, // 3: ionscale.v1.Machine.tailnet:type_name -> ionscale.v1.Ref
+	15, // 4: ionscale.v1.Machine.user:type_name -> ionscale.v1.Ref
+	13, // 5: ionscale.v1.Machine.client_connectivity:type_name -> ionscale.v1.ClientConnectivity
+	14, // 6: ionscale.v1.Machine.created_at:type_name -> google.protobuf.Timestamp
+	14, // 7: ionscale.v1.Machine.expires_at:type_name -> google.protobuf.Timestamp
 	8,  // [8:8] is the sub-list for method output_type
 	8,  // [8:8] is the sub-list for method input_type
 	8,  // [8:8] is the sub-list for extension type_name
@@ -996,7 +1095,7 @@ func file_ionscale_v1_machines_proto_init() {
 			}
 		}
 		file_ionscale_v1_machines_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Machine); i {
+			switch v := v.(*AuthorizeMachineRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1008,6 +1107,30 @@ func file_ionscale_v1_machines_proto_init() {
 			}
 		}
 		file_ionscale_v1_machines_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthorizeMachineResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_machines_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Machine); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_machines_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ClientConnectivity); i {
 			case 0:
 				return &v.state
@@ -1026,7 +1149,7 @@ func file_ionscale_v1_machines_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_ionscale_v1_machines_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   12,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -72,10 +72,8 @@ type GetMachineRoutesResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	AdvertisedRoutes   []string `protobuf:"bytes,1,rep,name=advertised_routes,json=advertisedRoutes,proto3" json:"advertised_routes,omitempty"`
-	EnabledRoutes      []string `protobuf:"bytes,2,rep,name=enabled_routes,json=enabledRoutes,proto3" json:"enabled_routes,omitempty"`
-	AdvertisedExitNode bool     `protobuf:"varint,3,opt,name=advertised_exit_node,json=advertisedExitNode,proto3" json:"advertised_exit_node,omitempty"`
-	EnabledExitNode    bool     `protobuf:"varint,4,opt,name=enabled_exit_node,json=enabledExitNode,proto3" json:"enabled_exit_node,omitempty"`
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
 }

 func (x *GetMachineRoutesResponse) Reset() {
@@ -110,34 +108,20 @@ func (*GetMachineRoutesResponse) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{1}
 }

-func (x *GetMachineRoutesResponse) GetAdvertisedRoutes() []string {
+func (x *GetMachineRoutesResponse) GetMachineId() uint64 {
 	if x != nil {
-		return x.AdvertisedRoutes
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *GetMachineRoutesResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
 	}
 	return nil
 }

-func (x *GetMachineRoutesResponse) GetEnabledRoutes() []string {
-	if x != nil {
-		return x.EnabledRoutes
-	}
-	return nil
-}
-
-func (x *GetMachineRoutesResponse) GetAdvertisedExitNode() bool {
-	if x != nil {
-		return x.AdvertisedExitNode
-	}
-	return false
-}
-
-func (x *GetMachineRoutesResponse) GetEnabledExitNode() bool {
-	if x != nil {
-		return x.EnabledExitNode
-	}
-	return false
-}
-
 type EnableMachineRoutesRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -201,6 +185,61 @@ func (x *EnableMachineRoutesRequest) GetReplace() bool {
 	return false
 }

+type EnableMachineRoutesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *EnableMachineRoutesResponse) Reset() {
+	*x = EnableMachineRoutesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EnableMachineRoutesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnableMachineRoutesResponse) ProtoMessage() {}
+
+func (x *EnableMachineRoutesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnableMachineRoutesResponse.ProtoReflect.Descriptor instead.
+func (*EnableMachineRoutesResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *EnableMachineRoutesResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *EnableMachineRoutesResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
 type DisableMachineRoutesRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -213,7 +252,7 @@ type DisableMachineRoutesRequest struct {
 func (x *DisableMachineRoutesRequest) Reset() {
 	*x = DisableMachineRoutesRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+		mi := &file_ionscale_v1_routes_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -226,7 +265,7 @@ func (x *DisableMachineRoutesRequest) String() string {
 func (*DisableMachineRoutesRequest) ProtoMessage() {}

 func (x *DisableMachineRoutesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+	mi := &file_ionscale_v1_routes_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -239,7 +278,7 @@ func (x *DisableMachineRoutesRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use DisableMachineRoutesRequest.ProtoReflect.Descriptor instead.
 func (*DisableMachineRoutesRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{3}
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{4}
 }

 func (x *DisableMachineRoutesRequest) GetMachineId() uint64 {
@@ -256,6 +295,61 @@ func (x *DisableMachineRoutesRequest) GetRoutes() []string {
 	return nil
 }

+type DisableMachineRoutesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *DisableMachineRoutesResponse) Reset() {
+	*x = DisableMachineRoutesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableMachineRoutesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableMachineRoutesResponse) ProtoMessage() {}
+
+func (x *DisableMachineRoutesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableMachineRoutesResponse.ProtoReflect.Descriptor instead.
+func (*DisableMachineRoutesResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *DisableMachineRoutesResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *DisableMachineRoutesResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
 type EnableExitNodeRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -267,7 +361,7 @@ type EnableExitNodeRequest struct {
 func (x *EnableExitNodeRequest) Reset() {
 	*x = EnableExitNodeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_routes_proto_msgTypes[4]
+		mi := &file_ionscale_v1_routes_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -280,7 +374,7 @@ func (x *EnableExitNodeRequest) String() string {
 func (*EnableExitNodeRequest) ProtoMessage() {}

 func (x *EnableExitNodeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_routes_proto_msgTypes[4]
+	mi := &file_ionscale_v1_routes_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -293,7 +387,7 @@ func (x *EnableExitNodeRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use EnableExitNodeRequest.ProtoReflect.Descriptor instead.
 func (*EnableExitNodeRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{4}
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{6}
 }

 func (x *EnableExitNodeRequest) GetMachineId() uint64 {
@@ -303,6 +397,61 @@ func (x *EnableExitNodeRequest) GetMachineId() uint64 {
 	return 0
 }

+type EnableExitNodeResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *EnableExitNodeResponse) Reset() {
+	*x = EnableExitNodeResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EnableExitNodeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnableExitNodeResponse) ProtoMessage() {}
+
+func (x *EnableExitNodeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnableExitNodeResponse.ProtoReflect.Descriptor instead.
+func (*EnableExitNodeResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *EnableExitNodeResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *EnableExitNodeResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
 type DisableExitNodeRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -314,7 +463,7 @@ type DisableExitNodeRequest struct {
 func (x *DisableExitNodeRequest) Reset() {
 	*x = DisableExitNodeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+		mi := &file_ionscale_v1_routes_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -327,7 +476,7 @@ func (x *DisableExitNodeRequest) String() string {
 func (*DisableExitNodeRequest) ProtoMessage() {}

 func (x *DisableExitNodeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+	mi := &file_ionscale_v1_routes_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -340,7 +489,7 @@ func (x *DisableExitNodeRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use DisableExitNodeRequest.ProtoReflect.Descriptor instead.
 func (*DisableExitNodeRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{5}
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{8}
 }

 func (x *DisableExitNodeRequest) GetMachineId() uint64 {
@@ -350,6 +499,132 @@ func (x *DisableExitNodeRequest) GetMachineId() uint64 {
 	return 0
 }

+type DisableExitNodeResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *DisableExitNodeResponse) Reset() {
+	*x = DisableExitNodeResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableExitNodeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableExitNodeResponse) ProtoMessage() {}
+
+func (x *DisableExitNodeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableExitNodeResponse.ProtoReflect.Descriptor instead.
+func (*DisableExitNodeResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DisableExitNodeResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *DisableExitNodeResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
+type MachineRoutes struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AdvertisedRoutes   []string `protobuf:"bytes,1,rep,name=advertised_routes,json=advertisedRoutes,proto3" json:"advertised_routes,omitempty"`
+	EnabledRoutes      []string `protobuf:"bytes,2,rep,name=enabled_routes,json=enabledRoutes,proto3" json:"enabled_routes,omitempty"`
+	AdvertisedExitNode bool     `protobuf:"varint,3,opt,name=advertised_exit_node,json=advertisedExitNode,proto3" json:"advertised_exit_node,omitempty"`
+	EnabledExitNode    bool     `protobuf:"varint,4,opt,name=enabled_exit_node,json=enabledExitNode,proto3" json:"enabled_exit_node,omitempty"`
+}
+
+func (x *MachineRoutes) Reset() {
+	*x = MachineRoutes{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineRoutes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineRoutes) ProtoMessage() {}
+
+func (x *MachineRoutes) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineRoutes.ProtoReflect.Descriptor instead.
+func (*MachineRoutes) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *MachineRoutes) GetAdvertisedRoutes() []string {
+	if x != nil {
+		return x.AdvertisedRoutes
+	}
+	return nil
+}
+
+func (x *MachineRoutes) GetEnabledRoutes() []string {
+	if x != nil {
+		return x.EnabledRoutes
+	}
+	return nil
+}
+
+func (x *MachineRoutes) GetAdvertisedExitNode() bool {
+	if x != nil {
+		return x.AdvertisedExitNode
+	}
+	return false
+}
+
+func (x *MachineRoutes) GetEnabledExitNode() bool {
+	if x != nil {
+		return x.EnabledExitNode
+	}
+	return false
+}
+
 var File_ionscale_v1_routes_proto protoreflect.FileDescriptor

 var file_ionscale_v1_routes_proto_rawDesc = []byte{
@@ -359,19 +634,13 @@ var file_ionscale_v1_routes_proto_rawDesc = []byte{
 	0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49,
-	0x64, 0x22, 0xcc, 0x01, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2b,
-	0x0a, 0x11, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x64, 0x76, 0x65, 0x72,
-	0x74, 0x69, 0x73, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64,
-	0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x12, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74,
-	0x4e, 0x6f, 0x64, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f,
-	0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65,
+	0x64, 0x22, 0x6d, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a,
+	0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x06,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
 	0x22, 0x6d, 0x0a, 0x1a, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
 	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
 	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
@@ -379,23 +648,64 @@ var file_ionscale_v1_routes_proto_rawDesc = []byte{
 	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x72,
 	0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65,
 	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x22,
-	0x54, 0x0a, 0x1b, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
+	0x70, 0x0a, 0x1b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d,
 	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x16, 0x0a,
-	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x72,
-	0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x36, 0x0a, 0x15, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45,
-	0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
-	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x37, 0x0a,
-	0x16, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x22, 0x54, 0x0a, 0x1b, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12,
+	0x16, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x71, 0x0a, 0x1c, 0x44, 0x69, 0x73, 0x61, 0x62,
+	0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x36, 0x0a, 0x15, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x49, 0x64, 0x22, 0x6b, 0x0a, 0x16, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22,
+	0x37, 0x0a, 0x16, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f,
+	0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x6c, 0x0a, 0x17, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x49, 0x64, 0x12, 0x32, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0xc1, 0x01, 0x0a, 0x0d, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x64, 0x76, 0x65,
+	0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x14,
+	0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f,
+	0x6e, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x61, 0x64, 0x76, 0x65,
+	0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x2a,
+	0x0a, 0x11, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e,
+	0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e,
+	0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67,
+	0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }

 var (
@@ -410,21 +720,31 @@ func file_ionscale_v1_routes_proto_rawDescGZIP() []byte {
 	return file_ionscale_v1_routes_proto_rawDescData
 }

-var file_ionscale_v1_routes_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_ionscale_v1_routes_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_ionscale_v1_routes_proto_goTypes = []interface{}{
-	(*GetMachineRoutesRequest)(nil),     // 0: ionscale.v1.GetMachineRoutesRequest
-	(*GetMachineRoutesResponse)(nil),    // 1: ionscale.v1.GetMachineRoutesResponse
-	(*EnableMachineRoutesRequest)(nil),  // 2: ionscale.v1.EnableMachineRoutesRequest
-	(*DisableMachineRoutesRequest)(nil), // 3: ionscale.v1.DisableMachineRoutesRequest
-	(*EnableExitNodeRequest)(nil),       // 4: ionscale.v1.EnableExitNodeRequest
-	(*DisableExitNodeRequest)(nil),      // 5: ionscale.v1.DisableExitNodeRequest
+	(*GetMachineRoutesRequest)(nil),      // 0: ionscale.v1.GetMachineRoutesRequest
+	(*GetMachineRoutesResponse)(nil),     // 1: ionscale.v1.GetMachineRoutesResponse
+	(*EnableMachineRoutesRequest)(nil),   // 2: ionscale.v1.EnableMachineRoutesRequest
+	(*EnableMachineRoutesResponse)(nil),  // 3: ionscale.v1.EnableMachineRoutesResponse
+	(*DisableMachineRoutesRequest)(nil),  // 4: ionscale.v1.DisableMachineRoutesRequest
+	(*DisableMachineRoutesResponse)(nil), // 5: ionscale.v1.DisableMachineRoutesResponse
+	(*EnableExitNodeRequest)(nil),        // 6: ionscale.v1.EnableExitNodeRequest
+	(*EnableExitNodeResponse)(nil),       // 7: ionscale.v1.EnableExitNodeResponse
+	(*DisableExitNodeRequest)(nil),       // 8: ionscale.v1.DisableExitNodeRequest
+	(*DisableExitNodeResponse)(nil),      // 9: ionscale.v1.DisableExitNodeResponse
+	(*MachineRoutes)(nil),                // 10: ionscale.v1.MachineRoutes
 }
 var file_ionscale_v1_routes_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	10, // 0: ionscale.v1.GetMachineRoutesResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 1: ionscale.v1.EnableMachineRoutesResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 2: ionscale.v1.DisableMachineRoutesResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 3: ionscale.v1.EnableExitNodeResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 4: ionscale.v1.DisableExitNodeResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	5,  // [5:5] is the sub-list for method output_type
+	5,  // [5:5] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
 }

 func init() { file_ionscale_v1_routes_proto_init() }
@@ -470,7 +790,7 @@ func file_ionscale_v1_routes_proto_init() {
 			}
 		}
 		file_ionscale_v1_routes_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DisableMachineRoutesRequest); i {
+			switch v := v.(*EnableMachineRoutesResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -482,7 +802,7 @@ func file_ionscale_v1_routes_proto_init() {
 			}
 		}
 		file_ionscale_v1_routes_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnableExitNodeRequest); i {
+			switch v := v.(*DisableMachineRoutesRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -494,6 +814,42 @@ func file_ionscale_v1_routes_proto_init() {
 			}
 		}
 		file_ionscale_v1_routes_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableMachineRoutesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EnableExitNodeRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EnableExitNodeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DisableExitNodeRequest); i {
 			case 0:
 				return &v.state
@@ -505,6 +861,30 @@ func file_ionscale_v1_routes_proto_init() {
 				return nil
 			}
 		}
+		file_ionscale_v1_routes_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableExitNodeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineRoutes); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -512,7 +892,7 @@ func file_ionscale_v1_routes_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_ionscale_v1_routes_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -1,11 +1,10 @@
 syntax = "proto3";

 package ionscale.v1;
-option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 import "google/protobuf/struct.proto";

-import "ionscale/v1/ref.proto";
+option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 message GetACLPolicyRequest {
  uint64 tailnet_id = 1;
@@ -20,15 +19,15 @@ message SetACLPolicyRequest {
  ACLPolicy policy = 2;
 }

-message SetACLPolicyResponse {
-}
+message SetACLPolicyResponse {}

 message ACLPolicy {
  map<string, string> hosts = 1;
  map<string, google.protobuf.ListValue> groups = 2;
  repeated ACL acls = 3;
  map<string, google.protobuf.ListValue> tagowners = 4;
-  AutoApprovers autoapprovers = 5;
+  optional AutoApprovers autoapprovers = 5;
+  repeated SSHRule ssh = 6;
 }

 message ACL {
@@ -40,4 +39,11 @@ message ACL {
 message AutoApprovers {
  map<string, google.protobuf.ListValue> routes = 1;
  repeated string exitnode = 2;
-}
+}
+
+message SSHRule {
+  string action = 1;
+  repeated string src = 2;
+  repeated string dst = 3;
+  repeated string users = 4;
+}
@@ -1,13 +1,13 @@
 syntax = "proto3";

 package ionscale.v1;
+
 option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

-message AuthenticationRequest {
-}
+message AuthenticateRequest {}

-message AuthenticationResponse {
+message AuthenticateResponse {
  string auth_url = 1;
  string token = 2;
  optional uint64 tailnet_id = 3;
-}
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Johan Siebens	660c684a13	chore(deps): upgrade golang.org/x/net	2022-12-25 07:45:28 +01:00
Johan Siebens	790ef5fe1a	feat: subnet router failover	2022-12-25 07:40:19 +01:00
Johan Siebens	61d9b40144	chore: remove pubsub and introduce session manager	2022-12-24 12:00:00 +01:00
Johan Siebens	a8e8d1aa49	fix: send user and login in registration response	2022-12-21 06:12:41 +01:00
Johan Siebens	b2dbe3b9c5	chore: remove unused arg and only set lastseen when offline	2022-11-30 08:31:41 +01:00
Johan Siebens	8c6e9e00b9	chore: ignore eof errors when clients disconnect	2022-11-29 16:51:28 +01:00
Johan Siebens	beb856a85d	feat: move https certs flag to dns config	2022-11-29 08:28:57 +01:00
Johan Siebens	2345f0b1de	feat: improve error handling/logging a little bit	2022-11-23 11:06:26 +01:00
Johan Siebens	c8b040fcd6	chore(docs): remove unused attribute	2022-11-16 07:21:00 +01:00
Johan Siebens	5481d3bf4b	chore: add check for breaking api	2022-11-16 07:16:11 +01:00
Johan Siebens	aac5414a21	chore: update install script	2022-11-05 09:25:26 +01:00
Johan Siebens	e74faa2605	feat: machine authorization	2022-11-04 14:13:19 +01:00
Johan Siebens	9baf2ec6d1	chore(deps): bump cosign action	2022-10-31 08:54:49 +01:00
Johan Siebens	c73b7e13e0	feat: buf formatting and linting	2022-10-31 07:54:12 +01:00
Johan Siebens	e41bac5a41	chore: improve echo handlers	2022-10-29 08:21:14 +02:00
Johan Siebens	03abebb847	chore: one start auth method	2022-10-28 16:02:00 +02:00
Johan Siebens	210cc9c8a2	fix: don't allow tag owners ssh from machine	2022-10-28 14:40:03 +02:00
Johan Siebens	9e38ffc44d	fix: check if expiresAt is available	2022-10-25 07:28:56 +02:00
Johan Siebens	06f02c1235	chore(deps): upgrade gorm	2022-10-22 10:36:26 +02:00
Johan Siebens	1de736144a	feat: remove the notion of alias	2022-10-22 08:55:32 +02:00
Johan Siebens	2bfe95219d	chore(docs): update docs with latest version	2022-10-20 10:49:39 +02:00
Johan Siebens	e66fa7eabf	chore(deps): upgrade deps	2022-10-20 08:24:31 +02:00
Johan Siebens	4e96f2a5c3	fix: ignore tag src in check actions	2022-10-20 08:11:01 +02:00
Johan Siebens	43167c1fae	feat: read config from env	2022-10-19 08:09:34 +02:00
Johan Siebens	cf75b9240c	chore(docs): some initial docs	2022-10-16 08:15:05 +02:00
Johan Siebens	ab9439ecfe	chore(docs): update readme	2022-10-15 08:27:43 +02:00
Johan Siebens	429798574d	chore: make autoapprovers optional	2022-10-14 12:15:13 +02:00
Johan Siebens	aad7a8b6e8	feat: edit iam and acl policies from cli	2022-10-12 08:05:54 +02:00
Johan Siebens	a2d97183d2	chore(deps): go mod tidy	2022-10-11 13:15:17 +02:00
Johan Siebens	af3a5f3a25	fix: incorrect env variables for auth provider	2022-10-10 12:57:10 +02:00
Johan Siebens	fea6a10640	chore: update install script	2022-10-09 18:20:52 +02:00
Johan Siebens	11af121126	feat: remove ephemeral machines on logout	2022-10-09 08:52:58 +02:00
Johan Siebens	dfb91d2419	chore: rename provider package to auth package	2022-10-09 08:19:40 +02:00
Johan Siebens	daf577a0ee	feat: config dns using env variables	2022-10-09 08:13:37 +02:00
Johan Siebens	a364188761	chore: check if iam policy is set or not	2022-10-08 12:59:13 +02:00
Johan Siebens	ea4fe22e35	chore(deps): upgrade some dependencies	2022-10-08 08:39:26 +02:00
Johan Siebens	ddc65d2df9	feat: add support for ssh acl policies	2022-10-08 07:26:30 +02:00
Johan Siebens	c70a4cfe6a	fix: don't send peer capabilities to nodes	2022-10-07 20:10:30 +02:00
Johan Siebens	5bf919da12	fix: don't send derp map if not changed	2022-10-07 16:43:37 +02:00
Johan Siebens	6d4a7b7014	feat: set default derp map configuration	2022-10-07 16:31:57 +02:00
Johan Siebens	bc1f188816	feat: add some command aliases	2022-10-07 15:43:51 +02:00
Johan Siebens	9522e3531e	feat: enable/disable taildrop and service collection	2022-10-07 10:12:31 +02:00
Johan Siebens	1e3541e7c8	fix: remove check on nameservers as it is not required anymore for MagicDNS	2022-10-06 21:30:34 +02:00
Johan Siebens	c3e1344199	fix: add admin capability flag when needed	2022-10-06 21:19:58 +02:00
Johan Siebens	70b9373df3	feat: set derp map for a tailnet	2022-10-04 16:06:15 +02:00
Johan Siebens	58de86a978	fix: use crypto/rand	2022-10-03 15:52:39 +02:00
Johan Siebens	2e57338b54	feat: add id token handler	2022-09-30 16:13:25 +02:00
Johan Siebens	7cadcc9085	fix: move auth config a level deeper	2022-09-30 15:39:19 +02:00
Johan Siebens	22cfe60c7d	feat: add support for https certs	2022-09-30 15:31:57 +02:00
				`@@ -0,0 +1 @@`
				`<script defer data-domain="jsiebens.github.io" src="https://plausible.io/js/plausible.js"></script>`