chore: replace hclog with zap

chore(deps): upgrade dependencies
chore(deps): golang 1.20
2026-04-06 13:02:58 +01:00 · 2023-03-19 10:53:54 +01:00 · 2023-03-12 08:38:18 +01:00 · 2023-03-12 08:26:35 +01:00 · 2023-03-12 08:26:13 +01:00 · 2023-03-11 08:53:54 +01:00
111 changed files with 5488 additions and 3492 deletions
@@ -9,18 +9,28 @@ on:
      - main

 jobs:
+  buf-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Set up Buf
+        uses: bufbuild/buf-setup-action@v1
+      - name: Buf Lint
+        uses: bufbuild/buf-lint-action@v1
+        with:
+          input: proto
+
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
-
      - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
        with:
-          go-version: 1.19
-
+          go-version: "1.20"
      - name: Build
        run: |
-          go test ./...
+          go test -v -short ./...
          go build cmd/ionscale/main.go
@@ -0,0 +1,32 @@
+name: Integration Tests
+
+on: workflow_dispatch
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ts_version:
+          - "1.36.0"
+          - "1.34.1"
+          - "1.32.3"
+          - "1.30.2"
+          - "1.28.0"
+          - "1.26.2"
+          - "1.24.2"
+    env:
+      IONSCALE_TESTS_TS_TARGET_VERSION:  ${{ matrix.ts_version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.20"
+      - name: Run Integration Tests
+        run: |
+          go test -v ./tests
@@ -26,11 +26,11 @@ jobs:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
        with:
-          go-version: 1.19
+          go-version: "1.20"
      - name: Install cosign
-        uses: sigstore/cosign-installer@v2.5.1
+        uses: sigstore/cosign-installer@v2.8.1
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        with:
@@ -29,11 +29,11 @@ jobs:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
        with:
-          go-version: 1.19
+          go-version: "1.20"
      - name: Install cosign
-        uses: sigstore/cosign-installer@v2.5.1
+        uses: sigstore/cosign-installer@v2.8.1
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        with:
@@ -1,4 +1,4 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} alpine:3.16.2
+FROM --platform=${BUILDPLATFORM:-linux/amd64} alpine:3.17.2

 COPY ionscale /usr/local/bin/ionscale

@@ -5,4 +5,13 @@ init:
 	go install github.com/bufbuild/connect-go/cmd/protoc-gen-connect-go@latest

 generate:
-	buf generate proto
+	buf generate proto
+
+format:
+	buf format -w proto
+
+lint:
+	buf lint proto
+
+breaking:
+	buf breaking proto --against https://github.com/jsiebens/ionscale.git#subdir=proto
@@ -1,60 +0,0 @@
-package main
-
-import (
-	"database/sql"
-	"fmt"
-	"github.com/muesli/coral"
-	"os"
-	"time"
-
-	"github.com/lib/pq"
-)
-
-func main() {
-	cmd := rootCommand()
-	if err := cmd.Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-
-func rootCommand() *coral.Command {
-	command := &coral.Command{
-		Use: "pg-ionscale-events",
-	}
-
-	var url string
-	command.Flags().StringVar(&url, "url", "", "")
-	_ = command.MarkFlagRequired("url")
-
-	command.RunE = func(cmd *coral.Command, args []string) error {
-		_, err := sql.Open("postgres", url)
-		if err != nil {
-			return err
-		}
-
-		reportProblem := func(ev pq.ListenerEventType, err error) {
-			if err != nil {
-				fmt.Println(err.Error())
-			}
-		}
-
-		minReconn := 10 * time.Second
-		maxReconn := time.Minute
-		listener := pq.NewListener(url, minReconn, maxReconn, reportProblem)
-		err = listener.Listen("ionscale_events")
-		if err != nil {
-			return err
-		}
-
-		fmt.Println("listening for events ...")
-		fmt.Println("")
-		for {
-			select {
-			case n, _ := <-listener.Notify:
-				fmt.Println(n.Extra)
-			}
-		}
-	}
-
-	return command
-}
@@ -1,153 +1,171 @@
 module github.com/jsiebens/ionscale

-go 1.19
+go 1.20

 require (
 	github.com/apparentlymart/go-cidr v1.1.0
-	github.com/bufbuild/connect-go v1.0.0
+	github.com/bufbuild/connect-go v1.5.2
 	github.com/caarlos0/env/v6 v6.10.1
-	github.com/caddyserver/certmagic v0.17.1
-	github.com/coreos/go-oidc/v3 v3.3.0
-	github.com/glebarez/sqlite v1.4.6
+	github.com/caddyserver/certmagic v0.17.2
+	github.com/coreos/go-oidc/v3 v3.5.0
+	github.com/glebarez/sqlite v1.7.0
 	github.com/go-gormigrate/gormigrate/v2 v2.0.2
-	github.com/golang-jwt/jwt/v4 v4.4.2
-	github.com/google/uuid v1.3.0
+	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/hashicorp/go-bexpr v0.1.11
-	github.com/hashicorp/go-hclog v1.3.0
+	github.com/hashicorp/go-hclog v1.4.0
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/imdario/mergo v0.3.12
+	github.com/imdario/mergo v0.3.13
 	github.com/jsiebens/go-edit v0.1.0
-	github.com/klauspost/compress v1.15.9
-	github.com/labstack/echo-contrib v0.13.0
-	github.com/labstack/echo/v4 v4.9.0
-	github.com/lib/pq v1.10.6
+	github.com/klauspost/compress v1.16.0
+	github.com/labstack/echo-contrib v0.14.1
+	github.com/labstack/echo/v4 v4.10.2
 	github.com/libdns/azure v0.2.0
 	github.com/libdns/cloudflare v0.1.0
 	github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f
-	github.com/libdns/googleclouddns v1.0.2
+	github.com/libdns/googleclouddns v1.1.0
 	github.com/libdns/libdns v0.2.1
-	github.com/libdns/route53 v1.2.2
+	github.com/libdns/route53 v1.3.1
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/pointerstructure v1.2.1
 	github.com/mr-tron/base58 v1.2.0
-	github.com/muesli/coral v1.0.0
 	github.com/nleeper/goment v1.4.4
-	github.com/prometheus/client_golang v1.13.0
-	github.com/rodaine/table v1.0.1
+	github.com/ory/dockertest/v3 v3.9.1
+	github.com/prometheus/client_golang v1.14.0
+	github.com/rodaine/table v1.1.0
 	github.com/sony/sonyflake v1.1.0
-	github.com/stretchr/testify v1.8.0
-	github.com/xhit/go-str2duration/v2 v2.0.0
-	golang.org/x/crypto v0.0.0-20221005025214-4161e89ecf1b
-	golang.org/x/net v0.0.0-20221004154528-8021a29435af
-	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1
-	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0
-	google.golang.org/protobuf v1.28.1
+	github.com/spf13/cobra v1.6.1
+	github.com/stretchr/testify v1.8.1
+	github.com/xhit/go-str2duration/v2 v2.1.0
+	golang.org/x/crypto v0.7.0
+	golang.org/x/net v0.8.0
+	golang.org/x/oauth2 v0.6.0
+	golang.org/x/sync v0.1.0
+	google.golang.org/protobuf v1.29.0
 	gopkg.in/square/go-jose.v2 v2.6.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
-	gorm.io/driver/postgres v1.3.9
-	gorm.io/gorm v1.23.8
+	gorm.io/driver/postgres v1.4.8
+	gorm.io/gorm v1.24.6
+	gorm.io/plugin/prometheus v0.0.0-20230109022219-ee24990c7392
 	inet.af/netaddr v0.0.0-20220811202034-502d2d690317
-	tailscale.com v1.32.0
+	tailscale.com v1.36.2
 )

 require (
-	cloud.google.com/go/compute v1.7.0 // indirect
-	github.com/Azure/azure-sdk-for-go v52.4.0+incompatible // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	cloud.google.com/go/compute v1.18.0 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.17 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.11 // indirect
-	github.com/Azure/go-autorest/autorest/azure/auth v0.5.7 // indirect
-	github.com/Azure/go-autorest/autorest/azure/cli v0.4.2 // indirect
+	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.22 // indirect
+	github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
-	github.com/Azure/go-autorest/logger v0.2.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
+	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.11.2 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.11.0 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.6.4 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.8.2 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.2 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.0.2 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.5.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/route53 v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.6.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.11.1 // indirect
-	github.com/aws/smithy-go v1.9.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.17.6 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.18.16 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.24 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.24 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.27.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.18.6 // indirect
+	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/containerd/continuity v0.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/digitalocean/godo v1.41.0 // indirect
+	github.com/digitalocean/godo v1.98.0 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/fatih/color v1.13.0 // indirect
-	github.com/form3tech-oss/jwt-go v3.2.2+incompatible // indirect
-	github.com/glebarez/go-sqlite v1.18.1 // indirect
+	github.com/docker/cli v23.0.1+incompatible // indirect
+	github.com/docker/docker v23.0.1+incompatible // indirect
+	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/fatih/color v1.14.1 // indirect
+	github.com/glebarez/go-sqlite v1.21.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/google/go-querystring v1.0.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa // indirect
-	github.com/googleapis/gax-go/v2 v2.4.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
+	github.com/googleapis/gax-go/v2 v2.7.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
-	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.13.0 // indirect
-	github.com/jackc/pgio v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.1 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
-	github.com/jackc/pgtype v1.12.0 // indirect
-	github.com/jackc/pgx/v4 v4.17.2 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgx/v5 v5.3.1 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/josharian/native v1.0.0 // indirect
-	github.com/jsimonetti/rtnetlink v1.2.2 // indirect
-	github.com/klauspost/cpuid/v2 v2.1.1 // indirect
+	github.com/josharian/native v1.1.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.3.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
 	github.com/labstack/gommon v0.4.0 // indirect
+	github.com/lib/pq v1.10.6 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.16 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mdlayher/netlink v1.6.0 // indirect
-	github.com/mdlayher/socket v0.2.3 // indirect
-	github.com/mholt/acmez v1.0.4 // indirect
-	github.com/miekg/dns v1.1.50 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/mdlayher/netlink v1.7.1 // indirect
+	github.com/mdlayher/socket v0.4.0 // indirect
+	github.com/mholt/acmez v1.1.0 // indirect
+	github.com/miekg/dns v1.1.51 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae // indirect
+	github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
+	github.com/opencontainers/runc v1.1.4 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.37.0 // indirect
-	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/tkuchiki/go-timezone v0.2.2 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasttemplate v1.2.1 // indirect
-	go.opencensus.io v0.23.0 // indirect
+	github.com/valyala/fasttemplate v1.2.2 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	go.opencensus.io v0.24.0 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
-	go.uber.org/multierr v1.8.0 // indirect
-	go.uber.org/zap v1.23.0 // indirect
-	go4.org/intern v0.0.0-20220617035311-6925f38cc365 // indirect
+	go.uber.org/multierr v1.10.0 // indirect
+	go.uber.org/zap v1.24.0 // indirect
+	go4.org/intern v0.0.0-20230205224052-192e9f60865c // indirect
 	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
-	go4.org/unsafe/assume-no-moving-gc v0.0.0-20220617031537-928513b29760 // indirect
-	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/sys v0.0.0-20221010170243-090e33056c14 // indirect
-	golang.org/x/text v0.4.0 // indirect
-	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
-	golang.org/x/tools v0.1.12 // indirect
+	go4.org/unsafe/assume-no-moving-gc v0.0.0-20230221090011-e4bae7ad2296 // indirect
+	golang.org/x/exp v0.0.0-20230310171629-522b1b587ee0 // indirect
+	golang.org/x/mod v0.9.0 // indirect
+	golang.org/x/sys v0.6.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.7.0 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
-	google.golang.org/api v0.84.0 // indirect
+	google.golang.org/api v0.112.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90 // indirect
-	google.golang.org/grpc v1.48.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	modernc.org/libc v1.18.0 // indirect
+	google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
+	google.golang.org/grpc v1.53.0 // indirect
+	modernc.org/libc v1.22.3 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/memory v1.3.0 // indirect
-	modernc.org/sqlite v1.18.1 // indirect
+	modernc.org/memory v1.5.0 // indirect
+	modernc.org/sqlite v1.21.0 // indirect
 	nhooyr.io/websocket v1.8.7 // indirect
 )
@@ -8,6 +8,8 @@ import (
 	"github.com/klauspost/compress/zstd"
 	"github.com/labstack/echo/v4"
 	"io/ioutil"
+	"sync"
+	"tailscale.com/smallzstd"
 	"tailscale.com/types/key"
 )

@@ -77,12 +79,7 @@ func (d *defaultBinder) Marshal(compress string, v interface{}) ([]byte, error)
 	}

 	if compress == "zstd" {
-		encoder, err := zstd.NewWriter(nil)
-		if err != nil {
-			return nil, err
-		}
-
-		payload = encoder.EncodeAll(marshalled, nil)
+		payload = zstdEncode(marshalled)
 	} else {
 		payload = marshalled
 	}
@@ -140,12 +137,7 @@ func (b *boxBinder) Marshal(compress string, v interface{}) ([]byte, error) {
 	}

 	if compress == "zstd" {
-		encoder, err := zstd.NewWriter(nil)
-		if err != nil {
-			return nil, err
-		}
-
-		encoded := encoder.EncodeAll(marshalled, nil)
+		encoded := zstdEncode(marshalled)
 		payload = b.controlKey.SealTo(b.machineKey, encoded)
 	} else {
 		payload = b.controlKey.SealTo(b.machineKey, marshalled)
@@ -161,3 +153,21 @@ func (b *boxBinder) Marshal(compress string, v interface{}) ([]byte, error) {
 func (b *boxBinder) Peer() key.MachinePublic {
 	return b.machineKey
 }
+
+func zstdEncode(in []byte) []byte {
+	encoder := zstdEncoderPool.Get().(*zstd.Encoder)
+	out := encoder.EncodeAll(in, nil)
+	encoder.Close()
+	zstdEncoderPool.Put(encoder)
+	return out
+}
+
+var zstdEncoderPool = &sync.Pool{
+	New: func() any {
+		encoder, err := smallzstd.NewEncoder(nil, zstd.WithEncoderLevel(zstd.SpeedFastest))
+		if err != nil {
+			panic(err)
+		}
+		return encoder
+	},
+}
@@ -1 +0,0 @@
-package broker
@@ -1,16 +0,0 @@
-package broker
-
-type Signal struct {
-	PeerUpdated  *uint64
-	PeersRemoved []uint64
-	ACLUpdated   bool
-	DNSUpdated   bool
-}
-
-type Listener chan *Signal
-
-type Pubsub interface {
-	Subscribe(tailnet uint64, listener Listener) (cancel func(), err error)
-	Publish(tailnet uint64, message *Signal) error
-	Close() error
-}
@@ -1,61 +0,0 @@
-package broker
-
-import (
-	"github.com/google/uuid"
-	"sync"
-)
-
-type memoryPubsub struct {
-	mut       sync.RWMutex
-	listeners map[uint64]map[uuid.UUID]Listener
-}
-
-func (m *memoryPubsub) Subscribe(tailnet uint64, listener Listener) (cancel func(), err error) {
-	m.mut.Lock()
-	defer m.mut.Unlock()
-
-	var listeners map[uuid.UUID]Listener
-	var ok bool
-	if listeners, ok = m.listeners[tailnet]; !ok {
-		listeners = map[uuid.UUID]Listener{}
-		m.listeners[tailnet] = listeners
-	}
-	var id uuid.UUID
-	for {
-		id = uuid.New()
-		if _, ok = listeners[id]; !ok {
-			break
-		}
-	}
-
-	listeners[id] = listener
-	return func() {
-		m.mut.Lock()
-		defer m.mut.Unlock()
-		listeners := m.listeners[tailnet]
-		delete(listeners, id)
-	}, nil
-}
-
-func (m *memoryPubsub) Publish(tailnet uint64, message *Signal) error {
-	m.mut.RLock()
-	defer m.mut.RUnlock()
-	listeners, ok := m.listeners[tailnet]
-	if !ok {
-		return nil
-	}
-	for _, listener := range listeners {
-		listener <- message
-	}
-	return nil
-}
-
-func (*memoryPubsub) Close() error {
-	return nil
-}
-
-func NewPubsubInMemory() Pubsub {
-	return &memoryPubsub{
-		listeners: make(map[uint64]map[uuid.UUID]Listener),
-	}
-}
@@ -1,117 +0,0 @@
-package broker
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"github.com/lib/pq"
-	"time"
-)
-
-type pgPubsub struct {
-	pgListener *pq.Listener
-	db         *sql.DB
-	target     Pubsub
-}
-
-func NewPubsub(ctx context.Context, database *sql.DB, connectURL string) (Pubsub, error) {
-	errCh := make(chan error)
-	listener := pq.NewListener(connectURL, time.Second, time.Minute, func(event pq.ListenerEventType, err error) {
-		select {
-		case <-errCh:
-			return
-		default:
-			errCh <- err
-			close(errCh)
-		}
-	})
-
-	select {
-	case err := <-errCh:
-		if err != nil {
-			return nil, fmt.Errorf("create pq listener: %w", err)
-		}
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	}
-
-	if err := listener.Listen("ionscale_events"); err != nil {
-		return nil, fmt.Errorf("listen: %w", err)
-	}
-
-	pubsub := &pgPubsub{
-		db:         database,
-		pgListener: listener,
-		target:     NewPubsubInMemory(),
-	}
-	go pubsub.listen(ctx)
-
-	return pubsub, nil
-}
-
-func (p *pgPubsub) Close() error {
-	return p.pgListener.Close()
-}
-
-func (p *pgPubsub) Subscribe(tailnet uint64, listener Listener) (cancel func(), err error) {
-	return p.target.Subscribe(tailnet, listener)
-}
-
-func (p *pgPubsub) Publish(tailnet uint64, message *Signal) error {
-	event := &pgEvent{
-		TailnetID: tailnet,
-		Signal:    message,
-	}
-
-	payload, err := json.Marshal(event)
-	if err != nil {
-		return err
-	}
-
-	_, err = p.db.ExecContext(context.Background(), `select pg_notify(`+pq.QuoteLiteral("ionscale_events")+`, $1)`, payload)
-	if err != nil {
-		return fmt.Errorf("exec pg_notify: %w", err)
-	}
-
-	return nil
-}
-
-func (p *pgPubsub) listen(ctx context.Context) {
-	var (
-		notif *pq.Notification
-		ok    bool
-	)
-	defer p.pgListener.Close()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case notif, ok = <-p.pgListener.Notify:
-			if !ok {
-				return
-			}
-		}
-		// A nil notification can be dispatched on reconnect.
-		if notif == nil {
-			continue
-		}
-		p.listenReceive(notif)
-	}
-}
-
-func (p *pgPubsub) listenReceive(notif *pq.Notification) {
-	extra := []byte(notif.Extra)
-	event := &pgEvent{}
-
-	if err := json.Unmarshal(extra, event); err == nil {
-		p.target.Publish(event.TailnetID, event.Signal)
-	} else {
-		fmt.Println(err)
-	}
-}
-
-type pgEvent struct {
-	TailnetID uint64
-	Signal    *Signal
-}
@@ -8,13 +8,13 @@ import (
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/go-edit/editor"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 	"io/ioutil"
 	"os"
 )

-func getACLConfigCommand() *coral.Command {
-	command := &coral.Command{
+func getACLConfigCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "get-acl-policy",
 		Short:        "Get the ACL policy",
 		SilenceUsage: true,
@@ -29,7 +29,7 @@ func getACLConfigCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(cmd *coral.Command, args []string) error {
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -58,8 +58,8 @@ func getACLConfigCommand() *coral.Command {
 	return command
 }

-func editACLConfigCommand() *coral.Command {
-	command := &coral.Command{
+func editACLConfigCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "edit-acl-policy",
 		Short:        "Edit the ACL policy",
 		SilenceUsage: true,
@@ -74,7 +74,7 @@ func editACLConfigCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(cmd *coral.Command, args []string) error {
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		edit := editor.NewDefaultEditor([]string{"IONSCALE_EDITOR", "EDITOR"})

 		client, err := target.createGRPCClient()
@@ -122,8 +122,8 @@ func editACLConfigCommand() *coral.Command {
 	return command
 }

-func setACLConfigCommand() *coral.Command {
-	command := &coral.Command{
+func setACLConfigCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "set-acl-policy",
 		Short:        "Set ACL policy",
 		SilenceUsage: true,
@@ -140,7 +140,7 @@ func setACLConfigCommand() *coral.Command {
 	command.Flags().StringVar(&file, "file", "", "Path to json file with the acl configuration")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(cmd *coral.Command, args []string) error {
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		rawJson, err := ioutil.ReadFile(file)
 		if err != nil {
 			return err
@@ -6,11 +6,11 @@ import (
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/pkg/client/ionscale"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )

-func authCommand() *coral.Command {
-	command := &coral.Command{
+func authCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use: "auth",
 	}

@@ -19,8 +19,8 @@ func authCommand() *coral.Command {
 	return command
 }

-func authLoginCommand() *coral.Command {
-	command := &coral.Command{
+func authLoginCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "login",
 		SilenceUsage: true,
 	}
@@ -29,14 +29,14 @@ func authLoginCommand() *coral.Command {

 	target.prepareCommand(command)

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {

 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
 		}

-		req := &api.AuthenticationRequest{}
+		req := &api.AuthenticateRequest{}
 		stream, err := client.Authenticate(context.Background(), connect.NewRequest(req))
 		if err != nil {
 			return err
@@ -5,16 +5,16 @@ import (
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
 	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
 	str2dur "github.com/xhit/go-str2duration/v2"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"strings"
 	"time"
 )

-func authkeysCommand() *coral.Command {
-	command := &coral.Command{
+func authkeysCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:     "auth-keys",
 		Aliases: []string{"auth-key"},
 		Short:   "Manage ionscale auth keys",
@@ -27,8 +27,8 @@ func authkeysCommand() *coral.Command {
 	return command
 }

-func createAuthkeysCommand() *coral.Command {
-	command := &coral.Command{
+func createAuthkeysCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "create",
 		Short:        "Creates a new auth key in the specified tailnet",
 		SilenceUsage: true,
@@ -37,6 +37,7 @@ func createAuthkeysCommand() *coral.Command {
 	var tailnetID uint64
 	var tailnetName string
 	var ephemeral bool
+	var preAuthorized bool
 	var tags []string
 	var expiry string
 	var target = Target{}
@@ -47,9 +48,10 @@ func createAuthkeysCommand() *coral.Command {
 	command.Flags().BoolVar(&ephemeral, "ephemeral", false, "When enabled, machines authenticated by this key will be automatically removed after going offline.")
 	command.Flags().StringSliceVar(&tags, "tag", []string{}, "Machines authenticated by this key will be automatically tagged with these tags")
 	command.Flags().StringVar(&expiry, "expiry", "180d", "Human-readable expiration of the key")
+	command.Flags().BoolVar(&preAuthorized, "pre-authorized", false, "Generate an auth key which is pre-authorized.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -71,10 +73,11 @@ func createAuthkeysCommand() *coral.Command {
 		}

 		req := &api.CreateAuthKeyRequest{
-			TailnetId: tailnet.Id,
-			Ephemeral: ephemeral,
-			Tags:      tags,
-			Expiry:    expiryDur,
+			TailnetId:     tailnet.Id,
+			Ephemeral:     ephemeral,
+			PreAuthorized: preAuthorized,
+			Tags:          tags,
+			Expiry:        expiryDur,
 		}
 		resp, err := client.CreateAuthKey(context.Background(), connect.NewRequest(req))

@@ -95,8 +98,8 @@ func createAuthkeysCommand() *coral.Command {
 	return command
 }

-func deleteAuthKeyCommand() *coral.Command {
-	command := &coral.Command{
+func deleteAuthKeyCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "delete",
 		Short:        "Delete a specified auth key",
 		SilenceUsage: true,
@@ -107,7 +110,7 @@ func deleteAuthKeyCommand() *coral.Command {
 	target.prepareCommand(command)
 	command.Flags().Uint64Var(&authKeyId, "id", 0, "Auth Key ID")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		grpcClient, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -126,8 +129,8 @@ func deleteAuthKeyCommand() *coral.Command {
 	return command
 }

-func listAuthkeysCommand() *coral.Command {
-	command := &coral.Command{
+func listAuthkeysCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "list",
 		Short:        "List all auth keys for a given tailnet",
 		SilenceUsage: true,
@@ -142,7 +145,7 @@ func listAuthkeysCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -5,13 +5,13 @@ import (
 	"fmt"
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/key"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v2"
 	"path/filepath"
 )

-func configureCommand() *coral.Command {
-	command := &coral.Command{
+func configureCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "configure",
 		Short:        "Generate a simple config file to get started.",
 		SilenceUsage: true,
@@ -33,7 +33,7 @@ func configureCommand() *coral.Command {

 	command.MarkFlagRequired("domain")

-	command.PreRunE = func(cmd *coral.Command, args []string) error {
+	command.PreRunE = func(cmd *cobra.Command, args []string) error {
 		if domain == "" {
 			return errors.New("required flag 'domain' is missing")
 		}
@@ -49,7 +49,7 @@ func configureCommand() *coral.Command {
 		return nil
 	}

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		c := &config.Config{}

 		c.HttpListenAddr = "0.0.0.0:80"
@@ -6,14 +6,14 @@ import (
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v2"
 	"os"
 	"tailscale.com/tailcfg"
 )

-func systemCommand() *coral.Command {
-	command := &coral.Command{
+func systemCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:   "system",
 		Short: "Manage global system configurations",
 	}
@@ -25,8 +25,8 @@ func systemCommand() *coral.Command {
 	return command
 }

-func getDefaultDERPMap() *coral.Command {
-	command := &coral.Command{
+func getDefaultDERPMap() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "get-derp-map",
 		Short:        "Get the DERP Map configuration",
 		SilenceUsage: true,
@@ -38,7 +38,7 @@ func getDefaultDERPMap() *coral.Command {
 	target.prepareCommand(command)
 	command.Flags().BoolVar(&asJson, "json", false, "When enabled, render output as json otherwise yaml")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -80,8 +80,8 @@ func getDefaultDERPMap() *coral.Command {
 	return command
 }

-func setDefaultDERPMap() *coral.Command {
-	command := &coral.Command{
+func setDefaultDERPMap() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "set-derp-map",
 		Short:        "Set the DERP Map configuration",
 		SilenceUsage: true,
@@ -92,7 +92,7 @@ func setDefaultDERPMap() *coral.Command {
 	target.prepareCommand(command)
 	command.Flags().StringVar(&file, "file", "", "Path to json file with the DERP Map configuration")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		grpcClient, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -121,8 +121,8 @@ func setDefaultDERPMap() *coral.Command {
 	return command
 }

-func resetDefaultDERPMap() *coral.Command {
-	command := &coral.Command{
+func resetDefaultDERPMap() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "reset-derp-map",
 		Short:        "Reset the DERP Map to the default configuration",
 		SilenceUsage: true,
@@ -131,7 +131,7 @@ func resetDefaultDERPMap() *coral.Command {
 	var target = Target{}
 	target.prepareCommand(command)

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		grpcClient, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -5,14 +5,14 @@ import (
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 	"os"
 	"strings"
 	"text/tabwriter"
 )

-func getDNSConfigCommand() *coral.Command {
-	command := &coral.Command{
+func getDNSConfigCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "get-dns",
 		Short:        "Get DNS configuration",
 		SilenceUsage: true,
@@ -27,7 +27,7 @@ func getDNSConfigCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -46,18 +46,12 @@ func getDNSConfigCommand() *coral.Command {
 		}
 		config := resp.Msg.Config

-		var allNameservers = config.Nameservers
-
-		for i, j := range config.Routes {
-			for _, n := range j.Routes {
-				allNameservers = append(allNameservers, fmt.Sprintf("%s:%s", i, n))
-			}
-		}
-
 		w := new(tabwriter.Writer)
-		w.Init(os.Stdout, 8, 8, 0, '\t', 0)
+		w.Init(os.Stdout, 8, 8, 1, '\t', 0)
 		defer w.Flush()

+		fmt.Fprintf(w, "%s\t\t%v\n", "MagicDNS", config.MagicDns)
+		fmt.Fprintf(w, "%s\t\t%v\n", "HTTPS Certs", config.HttpsCerts)
 		fmt.Fprintf(w, "%s\t\t%v\n", "Override Local DNS", config.OverrideLocalDns)

 		if config.MagicDns {
@@ -88,8 +82,8 @@ func getDNSConfigCommand() *coral.Command {
 	return command
 }

-func setDNSConfigCommand() *coral.Command {
-	command := &coral.Command{
+func setDNSConfigCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "set-dns",
 		Short:        "Set DNS config",
 		SilenceUsage: true,
@@ -107,10 +101,11 @@ func setDNSConfigCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
 	command.Flags().StringSliceVarP(&nameservers, "nameserver", "", []string{}, "Machines on your network will use these nameservers to resolve DNS queries.")
 	command.Flags().BoolVarP(&magicDNS, "magic-dns", "", false, "Enable MagicDNS for the specified Tailnet")
+	command.Flags().BoolVarP(&magicDNS, "https-certs", "", false, "Enable HTTPS Certificates for the specified Tailnet")
 	command.Flags().BoolVarP(&overrideLocalDNS, "override-local-dns", "", false, "When enabled, connected clients ignore local DNS settings and always use the nameservers specified for this Tailnet")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -172,88 +167,3 @@ func setDNSConfigCommand() *coral.Command {

 	return command
 }
-
-func enableHttpsCommand() *coral.Command {
-	command := &coral.Command{
-		Use:          "enable-https",
-		Short:        "Enable HTTPS certificates",
-		SilenceUsage: true,
-	}
-
-	var tailnetID uint64
-	var tailnetName string
-	var alias string
-	var target = Target{}
-
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
-	command.Flags().StringVar(&alias, "alias", "", "")
-
-	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
-
-		req := api.EnableHttpsCertificatesRequest{
-			TailnetId: tailnet.Id,
-			Alias:     alias,
-		}
-
-		if _, err := client.EnableHttpsCertificates(context.Background(), connect.NewRequest(&req)); err != nil {
-			return err
-		}
-
-		return nil
-	}
-
-	return command
-}
-
-func disableHttpsCommand() *coral.Command {
-	command := &coral.Command{
-		Use:          "disable-https",
-		Short:        "Disable HTTPS certificates",
-		SilenceUsage: true,
-	}
-
-	var tailnetID uint64
-	var tailnetName string
-	var target = Target{}
-
-	target.prepareCommand(command)
-	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
-	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
-
-	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
-		client, err := target.createGRPCClient()
-		if err != nil {
-			return err
-		}
-
-		tailnet, err := findTailnet(client, tailnetName, tailnetID)
-		if err != nil {
-			return err
-		}
-
-		req := api.DisableHttpsCertificatesRequest{
-			TailnetId: tailnet.Id,
-		}
-
-		if _, err := client.DisableHttpsCertificates(context.Background(), connect.NewRequest(&req)); err != nil {
-			return err
-		}
-
-		return nil
-	}
-
-	return command
-}
@@ -7,10 +7,10 @@ import (
 	"github.com/jsiebens/ionscale/pkg/client/ionscale"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	apiconnect "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1/ionscalev1connect"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )

-func checkRequiredTailnetAndTailnetIdFlags(cmd *coral.Command, args []string) error {
+func checkRequiredTailnetAndTailnetIdFlags(cmd *cobra.Command, args []string) error {
 	savedTailnetID, err := ionscale.TailnetFromFile()
 	if err != nil {
 		return err
@@ -37,7 +37,7 @@ func findTailnet(client apiconnect.IonscaleServiceClient, tailnet string, tailne
 		return nil, fmt.Errorf("requested tailnet not found or you are not authorized for this tailnet")
 	}

-	tailnets, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetRequest{}))
+	tailnets, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetsRequest{}))
 	if err != nil {
 		return nil, err
 	}
@@ -8,13 +8,13 @@ import (
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/go-edit/editor"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 	"io/ioutil"
 	"os"
 )

-func getIAMPolicyCommand() *coral.Command {
-	command := &coral.Command{
+func getIAMPolicyCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "get-iam-policy",
 		Short:        "Get the IAM policy",
 		SilenceUsage: true,
@@ -29,7 +29,7 @@ func getIAMPolicyCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(cmd *coral.Command, args []string) error {
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -58,8 +58,8 @@ func getIAMPolicyCommand() *coral.Command {
 	return command
 }

-func editIAMPolicyCommand() *coral.Command {
-	command := &coral.Command{
+func editIAMPolicyCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "edit-iam-policy",
 		Short:        "Edit the IAM policy",
 		SilenceUsage: true,
@@ -74,7 +74,7 @@ func editIAMPolicyCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(cmd *coral.Command, args []string) error {
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		edit := editor.NewDefaultEditor([]string{"IONSCALE_EDITOR", "EDITOR"})

 		client, err := target.createGRPCClient()
@@ -122,8 +122,8 @@ func editIAMPolicyCommand() *coral.Command {
 	return command
 }

-func setIAMPolicyCommand() *coral.Command {
-	command := &coral.Command{
+func setIAMPolicyCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "set-iam-policy",
 		Short:        "Set IAM policy",
 		SilenceUsage: true,
@@ -140,7 +140,7 @@ func setIAMPolicyCommand() *coral.Command {
 	command.Flags().StringVar(&file, "file", "", "Path to json file with the acl configuration")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(cmd *coral.Command, args []string) error {
+	command.RunE = func(cmd *cobra.Command, args []string) error {
 		rawJson, err := ioutil.ReadFile(file)
 		if err != nil {
 			return err
@@ -3,11 +3,11 @@ package cmd
 import (
 	"fmt"
 	"github.com/jsiebens/ionscale/internal/key"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )

-func keyCommand() *coral.Command {
-	command := &coral.Command{
+func keyCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "genkey",
 		SilenceUsage: true,
 	}
@@ -16,7 +16,7 @@ func keyCommand() *coral.Command {

 	command.Flags().BoolVarP(&disableNewLine, "no-newline", "n", false, "do not output a trailing newline")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		serverKey := key.NewServerKey()
 		if disableNewLine {
 			fmt.Print(serverKey.String())
@@ -5,17 +5,17 @@ import (
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
 	"github.com/nleeper/goment"
 	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
 	"inet.af/netaddr"
 	"os"
 	"strings"
 	"text/tabwriter"
 )

-func machineCommands() *coral.Command {
-	command := &coral.Command{
+func machineCommands() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "machines",
 		Aliases:      []string{"machine"},
 		Short:        "Manage ionscale machines",
@@ -33,12 +33,13 @@ func machineCommands() *coral.Command {
 	command.AddCommand(enableExitNodeCommand())
 	command.AddCommand(disableExitNodeCommand())
 	command.AddCommand(disableMachineKeyExpiryCommand())
+	command.AddCommand(authorizeMachineCommand())

 	return command
 }

-func getMachineCommand() *coral.Command {
-	command := &coral.Command{
+func getMachineCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "get",
 		Short:        "Retrieve detailed information for a machine",
 		SilenceUsage: true,
@@ -51,7 +52,7 @@ func getMachineCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -95,6 +96,10 @@ func getMachineCommand() *coral.Command {
 		fmt.Fprintf(w, "%s\t%s\n", "Tailscale IPv4", m.Ipv4)
 		fmt.Fprintf(w, "%s\t%s\n", "Tailscale IPv6", m.Ipv6)
 		fmt.Fprintf(w, "%s\t%s\n", "Last seen", lastSeen)
+		fmt.Fprintf(w, "%s\t%v\n", "Ephemeral", m.Ephemeral)
+		if !m.Authorized {
+			fmt.Fprintf(w, "%s\t%v\n", "Authorized", m.Authorized)
+		}
 		fmt.Fprintf(w, "%s\t%s\n", "Key expiry", expiresAt)

 		for i, t := range m.Tags {
@@ -145,8 +150,8 @@ func getMachineCommand() *coral.Command {
 	return command
 }

-func deleteMachineCommand() *coral.Command {
-	command := &coral.Command{
+func deleteMachineCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "delete",
 		Short:        "Deletes a machine",
 		SilenceUsage: true,
@@ -159,7 +164,7 @@ func deleteMachineCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -178,8 +183,8 @@ func deleteMachineCommand() *coral.Command {
 	return command
 }

-func expireMachineCommand() *coral.Command {
-	command := &coral.Command{
+func expireMachineCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "expire",
 		Short:        "Expires a machine",
 		SilenceUsage: true,
@@ -192,7 +197,7 @@ func expireMachineCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -211,8 +216,41 @@ func expireMachineCommand() *coral.Command {
 	return command
 }

-func listMachinesCommand() *coral.Command {
-	command := &coral.Command{
+func authorizeMachineCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "authorize",
+		Short:        "Authorizes a machine",
+		SilenceUsage: true,
+	}
+
+	var machineID uint64
+	var target = Target{}
+	target.prepareCommand(command)
+	command.Flags().Uint64Var(&machineID, "machine-id", 0, "Machine ID.")
+
+	_ = command.MarkFlagRequired("machine-id")
+
+	command.RunE = func(command *cobra.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		req := api.AuthorizeMachineRequest{MachineId: machineID}
+		if _, err := client.AuthorizeMachine(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		fmt.Println("Machine authorized.")
+
+		return nil
+	}
+
+	return command
+}
+
+func listMachinesCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "list",
 		Short:        "List machines",
 		SilenceUsage: true,
@@ -227,7 +265,7 @@ func listMachinesCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -245,7 +283,7 @@ func listMachinesCommand() *coral.Command {
 			return err
 		}

-		tbl := table.New("ID", "TAILNET", "NAME", "IPv4", "IPv6", "EPHEMERAL", "LAST_SEEN", "TAGS")
+		tbl := table.New("ID", "TAILNET", "NAME", "IPv4", "IPv6", "AUTHORIZED", "EPHEMERAL", "LAST_SEEN", "TAGS")
 		for _, m := range resp.Msg.Machines {
 			var lastSeen = "N/A"
 			if m.Connected {
@@ -256,7 +294,7 @@ func listMachinesCommand() *coral.Command {
 					lastSeen = mom.FromNow()
 				}
 			}
-			tbl.AddRow(m.Id, m.Tailnet.Name, m.Name, m.Ipv4, m.Ipv6, m.Ephemeral, lastSeen, strings.Join(m.Tags, ","))
+			tbl.AddRow(m.Id, m.Tailnet.Name, m.Name, m.Ipv4, m.Ipv6, m.Authorized, m.Ephemeral, lastSeen, strings.Join(m.Tags, ","))
 		}
 		tbl.Print()

@@ -266,8 +304,8 @@ func listMachinesCommand() *coral.Command {
 	return command
 }

-func getMachineRoutesCommand() *coral.Command {
-	command := &coral.Command{
+func getMachineRoutesCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "get-routes",
 		Short:        "Show routes advertised and enabled by a given machine",
 		SilenceUsage: true,
@@ -280,7 +318,7 @@ func getMachineRoutesCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		grpcClient, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -292,7 +330,7 @@ func getMachineRoutesCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -300,8 +338,8 @@ func getMachineRoutesCommand() *coral.Command {
 	return command
 }

-func enableMachineRoutesCommand() *coral.Command {
-	command := &coral.Command{
+func enableMachineRoutesCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "enable-routes",
 		Short:        "Enable routes for a given machine",
 		SilenceUsage: true,
@@ -318,7 +356,7 @@ func enableMachineRoutesCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -336,7 +374,7 @@ func enableMachineRoutesCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -344,8 +382,8 @@ func enableMachineRoutesCommand() *coral.Command {
 	return command
 }

-func disableMachineRoutesCommand() *coral.Command {
-	command := &coral.Command{
+func disableMachineRoutesCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "disable-routes",
 		Short:        "Disable routes for a given machine",
 		SilenceUsage: true,
@@ -360,7 +398,7 @@ func disableMachineRoutesCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -378,7 +416,7 @@ func disableMachineRoutesCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -386,8 +424,8 @@ func disableMachineRoutesCommand() *coral.Command {
 	return command
 }

-func enableExitNodeCommand() *coral.Command {
-	command := &coral.Command{
+func enableExitNodeCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "enable-exit-node",
 		Short:        "Enable given machine as an exit node",
 		SilenceUsage: true,
@@ -400,7 +438,7 @@ func enableExitNodeCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -412,7 +450,7 @@ func enableExitNodeCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -420,8 +458,8 @@ func enableExitNodeCommand() *coral.Command {
 	return command
 }

-func disableExitNodeCommand() *coral.Command {
-	command := &coral.Command{
+func disableExitNodeCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "disable-exit-node",
 		Short:        "Disable given machine as an exit node",
 		SilenceUsage: true,
@@ -434,7 +472,7 @@ func disableExitNodeCommand() *coral.Command {

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -446,7 +484,7 @@ func disableExitNodeCommand() *coral.Command {
 			return err
 		}

-		printMachinesRoutesResponse(resp.Msg)
+		printMachinesRoutesResponse(resp.Msg.Routes)

 		return nil
 	}
@@ -454,8 +492,8 @@ func disableExitNodeCommand() *coral.Command {
 	return command
 }

-func enableMachineKeyExpiryCommand() *coral.Command {
-	command := &coral.Command{
+func enableMachineKeyExpiryCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "enable-key-expiry",
 		Short:        "Enable machine key expiry",
 		SilenceUsage: true,
@@ -464,8 +502,8 @@ func enableMachineKeyExpiryCommand() *coral.Command {
 	return configureSetMachineKeyExpiryCommand(command, false)
 }

-func disableMachineKeyExpiryCommand() *coral.Command {
-	command := &coral.Command{
+func disableMachineKeyExpiryCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "disable-key-expiry",
 		Short:        "Disable machine key expiry",
 		SilenceUsage: true,
@@ -474,7 +512,7 @@ func disableMachineKeyExpiryCommand() *coral.Command {
 	return configureSetMachineKeyExpiryCommand(command, true)
 }

-func configureSetMachineKeyExpiryCommand(command *coral.Command, v bool) *coral.Command {
+func configureSetMachineKeyExpiryCommand(command *cobra.Command, v bool) *cobra.Command {
 	var machineID uint64
 	var target = Target{}
 	target.prepareCommand(command)
@@ -482,7 +520,7 @@ func configureSetMachineKeyExpiryCommand(command *coral.Command, v bool) *coral.

 	_ = command.MarkFlagRequired("machine-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -500,7 +538,7 @@ func configureSetMachineKeyExpiryCommand(command *coral.Command, v bool) *coral.
 	return command
 }

-func printMachinesRoutesResponse(msg *api.GetMachineRoutesResponse) {
+func printMachinesRoutesResponse(msg *api.MachineRoutes) {
 	w := new(tabwriter.Writer)
 	w.Init(os.Stdout, 8, 8, 0, '\t', 0)
 	defer w.Flush()
@@ -1,10 +1,10 @@
 package cmd

 import (
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )

-func Command() *coral.Command {
+func Command() *cobra.Command {
 	rootCmd := rootCommand()
 	rootCmd.AddCommand(configureCommand())
 	rootCmd.AddCommand(keyCommand())
@@ -24,8 +24,8 @@ func Execute() error {
 	return Command().Execute()
 }

-func rootCommand() *coral.Command {
-	return &coral.Command{
+func rootCommand() *cobra.Command {
+	return &cobra.Command{
 		Use: "ionscale",
 	}
 }
@@ -3,11 +3,11 @@ package cmd
 import (
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/server"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )

-func serverCommand() *coral.Command {
-	command := &coral.Command{
+func serverCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "server",
 		Short:        "Start an ionscale server",
 		SilenceUsage: true,
@@ -17,7 +17,7 @@ func serverCommand() *coral.Command {

 	command.Flags().StringVarP(&configFile, "config", "c", "", "Path to the configuration file.")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {

 		c, err := config.LoadConfig(configFile)
 		if err != nil {
@@ -6,17 +6,18 @@ import (
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	idomain "github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/pkg/defaults"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
 	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v3"
 	"os"
 	"strings"
 	"tailscale.com/tailcfg"
 )

-func tailnetCommand() *coral.Command {
-	command := &coral.Command{
+func tailnetCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:     "tailnets",
 		Aliases: []string{"tailnet"},
 		Short:   "Manage ionscale tailnets",
@@ -33,14 +34,14 @@ func tailnetCommand() *coral.Command {
 	command.AddCommand(getIAMPolicyCommand())
 	command.AddCommand(setIAMPolicyCommand())
 	command.AddCommand(editIAMPolicyCommand())
-	command.AddCommand(enableHttpsCommand())
-	command.AddCommand(disableHttpsCommand())
 	command.AddCommand(enableServiceCollectionCommand())
 	command.AddCommand(disableServiceCollectionCommand())
 	command.AddCommand(enableFileSharingCommand())
 	command.AddCommand(disableFileSharingCommand())
 	command.AddCommand(enableSSHCommand())
 	command.AddCommand(disableSSHCommand())
+	command.AddCommand(enableMachineAuthorizationCommand())
+	command.AddCommand(disableMachineAuthorizationCommand())
 	command.AddCommand(getDERPMap())
 	command.AddCommand(setDERPMap())
 	command.AddCommand(resetDERPMap())
@@ -48,8 +49,8 @@ func tailnetCommand() *coral.Command {
 	return command
 }

-func listTailnetsCommand() *coral.Command {
-	command := &coral.Command{
+func listTailnetsCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "list",
 		Short:        "List available Tailnets",
 		SilenceUsage: true,
@@ -58,14 +59,14 @@ func listTailnetsCommand() *coral.Command {
 	var target = Target{}
 	target.prepareCommand(command)

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {

 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
 		}

-		resp, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetRequest{}))
+		resp, err := client.ListTailnets(context.Background(), connect.NewRequest(&api.ListTailnetsRequest{}))

 		if err != nil {
 			return err
@@ -83,8 +84,8 @@ func listTailnetsCommand() *coral.Command {
 	return command
 }

-func createTailnetsCommand() *coral.Command {
-	command := &coral.Command{
+func createTailnetsCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "create",
 		Short:        "Create a new Tailnet",
 		SilenceUsage: true,
@@ -100,9 +101,9 @@ func createTailnetsCommand() *coral.Command {
 	command.Flags().StringVar(&domain, "domain", "", "")
 	command.Flags().StringVar(&email, "email", "", "")

-	command.PreRunE = func(cmd *coral.Command, args []string) error {
-		if name == "" && email == "" && domain == "" {
-			return fmt.Errorf("at least flag --name, --email or --domain is required")
+	command.PreRunE = func(cmd *cobra.Command, args []string) error {
+		if name == "" {
+			return fmt.Errorf("flag --name is required")
 		}
 		if domain != "" && email != "" {
 			return fmt.Errorf("flags --email and --domain are mutually exclusive")
@@ -110,23 +111,22 @@ func createTailnetsCommand() *coral.Command {
 		return nil
 	}

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {

-		var tailnetName = ""
-		var iamPolicy = api.IAMPolicy{}
+		dnsConfig := defaults.DefaultDNSConfig()
+		aclPolicy := defaults.DefaultACLPolicy()
+		iamPolicy := &api.IAMPolicy{}

 		if len(domain) != 0 {
 			domainToLower := strings.ToLower(domain)
-			tailnetName = domainToLower
-			iamPolicy = api.IAMPolicy{
+			iamPolicy = &api.IAMPolicy{
 				Filters: []string{fmt.Sprintf("domain == %s", domainToLower)},
 			}
 		}

 		if len(email) != 0 {
 			emailToLower := strings.ToLower(email)
-			tailnetName = emailToLower
-			iamPolicy = api.IAMPolicy{
+			iamPolicy = &api.IAMPolicy{
 				Emails: []string{emailToLower},
 				Roles: map[string]string{
 					emailToLower: string(idomain.UserRoleAdmin),
@@ -134,18 +134,16 @@ func createTailnetsCommand() *coral.Command {
 			}
 		}

-		if len(name) != 0 {
-			tailnetName = name
-		}
-
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
 		}

 		resp, err := client.CreateTailnet(context.Background(), connect.NewRequest(&api.CreateTailnetRequest{
-			Name:      tailnetName,
-			IamPolicy: &iamPolicy,
+			Name:      name,
+			IamPolicy: iamPolicy,
+			AclPolicy: aclPolicy,
+			DnsConfig: dnsConfig,
 		}))

 		if err != nil {
@@ -162,8 +160,8 @@ func createTailnetsCommand() *coral.Command {
 	return command
 }

-func deleteTailnetCommand() *coral.Command {
-	command := &coral.Command{
+func deleteTailnetCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "delete",
 		Short:        "Delete a tailnet",
 		SilenceUsage: true,
@@ -180,7 +178,7 @@ func deleteTailnetCommand() *coral.Command {
 	command.Flags().BoolVar(&force, "force", false, "When enabled, force delete the specified Tailnet even when machines are still available.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {

 		client, err := target.createGRPCClient()
 		if err != nil {
@@ -206,8 +204,8 @@ func deleteTailnetCommand() *coral.Command {
 	return command
 }

-func getDERPMap() *coral.Command {
-	command := &coral.Command{
+func getDERPMap() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "get-derp-map",
 		Short:        "Get the DERP Map configuration",
 		SilenceUsage: true,
@@ -225,7 +223,7 @@ func getDERPMap() *coral.Command {
 	command.Flags().BoolVar(&asJson, "json", false, "When enabled, render output as json otherwise yaml")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -272,8 +270,8 @@ func getDERPMap() *coral.Command {
 	return command
 }

-func setDERPMap() *coral.Command {
-	command := &coral.Command{
+func setDERPMap() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "set-derp-map",
 		Short:        "Set the DERP Map configuration",
 		SilenceUsage: true,
@@ -290,7 +288,7 @@ func setDERPMap() *coral.Command {
 	command.Flags().StringVar(&file, "file", "", "Path to json file with the DERP Map configuration")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -324,8 +322,8 @@ func setDERPMap() *coral.Command {
 	return command
 }

-func resetDERPMap() *coral.Command {
-	command := &coral.Command{
+func resetDERPMap() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "reset-derp-map",
 		Short:        "Reset the DERP Map to the default configuration",
 		SilenceUsage: true,
@@ -340,7 +338,7 @@ func resetDERPMap() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -363,8 +361,8 @@ func resetDERPMap() *coral.Command {
 	return command
 }

-func enableFileSharingCommand() *coral.Command {
-	command := &coral.Command{
+func enableFileSharingCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "enable-file-sharing",
 		Aliases:      []string{"enable-taildrop"},
 		Short:        "Enable Taildrop, the file sharing feature",
@@ -380,7 +378,7 @@ func enableFileSharingCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -395,7 +393,7 @@ func enableFileSharingCommand() *coral.Command {
 			TailnetId: tailnet.Id,
 		}

-		if _, err := client.EnabledFileSharing(context.Background(), connect.NewRequest(&req)); err != nil {
+		if _, err := client.EnableFileSharing(context.Background(), connect.NewRequest(&req)); err != nil {
 			return err
 		}

@@ -405,8 +403,8 @@ func enableFileSharingCommand() *coral.Command {
 	return command
 }

-func disableFileSharingCommand() *coral.Command {
-	command := &coral.Command{
+func disableFileSharingCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "disable-file-sharing",
 		Aliases:      []string{"disable-taildrop"},
 		Short:        "Disable Taildrop, the file sharing feature",
@@ -422,7 +420,7 @@ func disableFileSharingCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -447,8 +445,8 @@ func disableFileSharingCommand() *coral.Command {
 	return command
 }

-func enableServiceCollectionCommand() *coral.Command {
-	command := &coral.Command{
+func enableServiceCollectionCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "enable-service-collection",
 		Short:        "Enable monitoring live services running on your network’s machines.",
 		SilenceUsage: true,
@@ -463,7 +461,7 @@ func enableServiceCollectionCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -478,7 +476,7 @@ func enableServiceCollectionCommand() *coral.Command {
 			TailnetId: tailnet.Id,
 		}

-		if _, err := client.EnabledServiceCollection(context.Background(), connect.NewRequest(&req)); err != nil {
+		if _, err := client.EnableServiceCollection(context.Background(), connect.NewRequest(&req)); err != nil {
 			return err
 		}

@@ -488,8 +486,8 @@ func enableServiceCollectionCommand() *coral.Command {
 	return command
 }

-func disableServiceCollectionCommand() *coral.Command {
-	command := &coral.Command{
+func disableServiceCollectionCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "disable-service-collection",
 		Short:        "Disable monitoring live services running on your network’s machines.",
 		SilenceUsage: true,
@@ -504,7 +502,7 @@ func disableServiceCollectionCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -529,8 +527,8 @@ func disableServiceCollectionCommand() *coral.Command {
 	return command
 }

-func enableSSHCommand() *coral.Command {
-	command := &coral.Command{
+func enableSSHCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "enable-ssh",
 		Short:        "Enable ssh access using tailnet and ACLs.",
 		SilenceUsage: true,
@@ -545,7 +543,7 @@ func enableSSHCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -560,7 +558,7 @@ func enableSSHCommand() *coral.Command {
 			TailnetId: tailnet.Id,
 		}

-		if _, err := client.EnabledSSH(context.Background(), connect.NewRequest(&req)); err != nil {
+		if _, err := client.EnableSSH(context.Background(), connect.NewRequest(&req)); err != nil {
 			return err
 		}

@@ -570,8 +568,8 @@ func enableSSHCommand() *coral.Command {
 	return command
 }

-func disableSSHCommand() *coral.Command {
-	command := &coral.Command{
+func disableSSHCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "disable-ssh",
 		Short:        "Disable ssh access using tailnet and ACLs.",
 		SilenceUsage: true,
@@ -586,7 +584,7 @@ func disableSSHCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -610,3 +608,85 @@ func disableSSHCommand() *coral.Command {

 	return command
 }
+
+func enableMachineAuthorizationCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "enable-machine-authorization",
+		Short:        "Enable machine authorization.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *cobra.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.EnableMachineAuthorizationRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.EnableMachineAuthorization(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
+
+func disableMachineAuthorizationCommand() *cobra.Command {
+	command := &cobra.Command{
+		Use:          "disable-machine-authorization",
+		Short:        "Disable machine authorization.",
+		SilenceUsage: true,
+	}
+
+	var tailnetID uint64
+	var tailnetName string
+	var target = Target{}
+
+	target.prepareCommand(command)
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "Tailnet name. Mutually exclusive with --tailnet-id.")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")
+
+	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
+	command.RunE = func(command *cobra.Command, args []string) error {
+		client, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		req := api.DisableMachineAuthorizationRequest{
+			TailnetId: tailnet.Id,
+		}
+
+		if _, err := client.DisableMachineAuthorization(context.Background(), connect.NewRequest(&req)); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return command
+}
@@ -4,7 +4,7 @@ import (
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/pkg/client/ionscale"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1/ionscalev1connect"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )

 const (
@@ -19,7 +19,7 @@ type Target struct {
 	systemAdminKey     string
 }

-func (t *Target) prepareCommand(cmd *coral.Command) {
+func (t *Target) prepareCommand(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&t.addr, "addr", "", "Addr of the ionscale server, as a complete URL")
 	cmd.Flags().BoolVar(&t.insecureSkipVerify, "tls-skip-verify", false, "Disable verification of TLS certificates")
 	cmd.Flags().StringVar(&t.systemAdminKey, "system-admin-key", "", "If specified, the given value will be used as the key to generate a Bearer token for the call. This can also be specified via the IONSCALE_ADMIN_KEY environment variable.")
@@ -5,12 +5,12 @@ import (
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
 	"github.com/rodaine/table"
+	"github.com/spf13/cobra"
 )

-func userCommands() *coral.Command {
-	command := &coral.Command{
+func userCommands() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "users",
 		Aliases:      []string{"user"},
 		Short:        "Manage ionscale users",
@@ -23,8 +23,8 @@ func userCommands() *coral.Command {
 	return command
 }

-func listUsersCommand() *coral.Command {
-	command := &coral.Command{
+func listUsersCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "list",
 		Short:        "List users",
 		SilenceUsage: true,
@@ -39,7 +39,7 @@ func listUsersCommand() *coral.Command {
 	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "Tailnet ID. Mutually exclusive with --tailnet.")

 	command.PreRunE = checkRequiredTailnetAndTailnetIdFlags
-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -69,8 +69,8 @@ func listUsersCommand() *coral.Command {
 	return command
 }

-func deleteUserCommand() *coral.Command {
-	command := &coral.Command{
+func deleteUserCommand() *cobra.Command {
+	command := &cobra.Command{
 		Use:          "delete",
 		Short:        "Deletes a user",
 		SilenceUsage: true,
@@ -83,7 +83,7 @@ func deleteUserCommand() *coral.Command {

 	_ = command.MarkFlagRequired("user-id")

-	command.RunE = func(command *coral.Command, args []string) error {
+	command.RunE = func(command *cobra.Command, args []string) error {
 		client, err := target.createGRPCClient()
 		if err != nil {
 			return err
@@ -6,11 +6,11 @@ import (
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/version"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"github.com/muesli/coral"
+	"github.com/spf13/cobra"
 )

-func versionCommand() *coral.Command {
-	var command = &coral.Command{
+func versionCommand() *cobra.Command {
+	var command = &cobra.Command{
 		Use:          "version",
 		Short:        "Display version information",
 		SilenceUsage: true,
@@ -19,7 +19,7 @@ func versionCommand() *coral.Command {
 	var target = Target{}
 	target.prepareCommand(command)

-	command.Run = func(cmd *coral.Command, args []string) {
+	command.Run = func(cmd *cobra.Command, args []string) {
 		clientVersion, clientRevision := version.GetReleaseInfo()
 		fmt.Printf(`
 Client:
@@ -24,9 +24,9 @@ const (
 )

 var (
-	keepAliveInterval = defaultKeepAliveInterval
-	magicDNSSuffix    = defaultMagicDNSSuffix
-	certDNSSuffix     = ""
+	keepAliveInterval     = defaultKeepAliveInterval
+	magicDNSSuffix        = defaultMagicDNSSuffix
+	dnsProviderConfigured = false
 )

 func KeepAliveInterval() time.Duration {
@@ -37,8 +37,8 @@ func MagicDNSSuffix() string {
 	return magicDNSSuffix
 }

-func CertDNSSuffix() string {
-	return certDNSSuffix
+func DNSProviderConfigured() bool {
+	return dnsProviderConfigured
 }

 func LoadConfig(path string) (*Config, error) {
@@ -67,7 +67,7 @@ func LoadConfig(path string) (*Config, error) {

 	envCfgB64 := os.Getenv("IONSCALE_CONFIG_BASE64")
 	if len(envCfgB64) != 0 {
-		b, err := base64.RawStdEncoding.DecodeString(envCfgB64)
+		b, err := base64.StdEncoding.DecodeString(envCfgB64)
 		if err != nil {
 			return nil, err
 		}
@@ -92,11 +92,7 @@ func LoadConfig(path string) (*Config, error) {
 	magicDNSSuffix = cfg.DNS.MagicDNSSuffix

 	if cfg.DNS.Provider.Zone != "" {
-		if cfg.DNS.Provider.Subdomain == "" {
-			certDNSSuffix = cfg.DNS.Provider.Zone
-		} else {
-			certDNSSuffix = fmt.Sprintf("%s.%s", cfg.DNS.Provider.Subdomain, cfg.DNS.Provider.Zone)
-		}
+		dnsProviderConfigured = true
 	}

 	return cfg, nil
@@ -109,8 +105,10 @@ func defaultConfig() *Config {
 		MetricsListenAddr: ":9091",
 		ServerUrl:         "https://localhost:8843",
 		Database: Database{
-			Type: "sqlite",
-			Url:  "./ionscale.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(ON)",
+			Type:         "sqlite",
+			Url:          "./ionscale.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(ON)",
+			MaxOpenConns: 0,
+			MaxIdleConns: 2,
 		},
 		Tls: Tls{
 			Disable:     false,
@@ -173,8 +171,12 @@ type Logging struct {
 }

 type Database struct {
-	Type string `yaml:"type,omitempty" env:"TYPE"`
-	Url  string `yaml:"url,omitempty" env:"URL"`
+	Type            string        `yaml:"type,omitempty" env:"TYPE"`
+	Url             string        `yaml:"url,omitempty" env:"URL"`
+	MaxOpenConns    int           `yaml:"max_open_conns,omitempty" env:"MAX_OPEN_CONNS"`
+	MaxIdleConns    int           `yaml:"max_idle_conns,omitempty" env:"MAX_IDLE_CONNS"`
+	ConnMaxLifetime time.Duration `yaml:"conn_max_life_time,omitempty" env:"CONN_MAX_LIFE_TIME"`
+	ConnMaxIdleTime time.Duration `yaml:"conn_max_idle_time,omitempty" env:"CONN_MAX_IDLE_TIME"`
 }

 type Keys struct {
@@ -203,7 +205,6 @@ type DNS struct {
 type DNSProvider struct {
 	Name          string            `yaml:"name"`
 	Zone          string            `yaml:"zone"`
-	Subdomain     string            `yaml:"subdomain"`
 	Configuration map[string]string `yaml:"config"`
 }

@@ -1,8 +1,7 @@
-package handlers
+package core

 import (
 	"context"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"time"
 )
@@ -12,26 +11,28 @@ const (
 	inactivityTimeout = 30 * time.Minute
 )

-func NewReaper(brokers broker.Pubsub, repository domain.Repository) *Reaper {
-	return &Reaper{
-		pubsub:     brokers,
-		repository: repository,
+func StartReaper(repository domain.Repository, sessionManager PollMapSessionManager) {
+	r := &reaper{
+		sessionManager: sessionManager,
+		repository:     repository,
 	}
+
+	go r.start()
 }

-type Reaper struct {
-	pubsub     broker.Pubsub
-	repository domain.Repository
+type reaper struct {
+	sessionManager PollMapSessionManager
+	repository     domain.Repository
 }

-func (r *Reaper) Start() {
+func (r *reaper) start() {
 	t := time.NewTicker(ticker)
 	for range t.C {
 		r.reapInactiveEphemeralNodes()
 	}
 }

-func (r *Reaper) reapInactiveEphemeralNodes() {
+func (r *reaper) reapInactiveEphemeralNodes() {
 	ctx := context.Background()

 	now := time.Now().UTC()
@@ -54,8 +55,8 @@ func (r *Reaper) reapInactiveEphemeralNodes() {
 	}

 	if len(removedNodes) != 0 {
-		for i, p := range removedNodes {
-			r.pubsub.Publish(i, &broker.Signal{PeersRemoved: p})
+		for i, _ := range removedNodes {
+			r.sessionManager.NotifyAll(i)
 		}
 	}
 }
@@ -0,0 +1,94 @@
+package core
+
+import (
+	"sync"
+	"time"
+)
+
+type Ping struct{}
+
+type PollMapSessionManager interface {
+	Register(tailnetID uint64, machineID uint64, ch chan *Ping)
+	Deregister(tailnetID uint64, machineID uint64)
+	HasSession(tailnetID uint64, machineID uint64) bool
+	NotifyAll(tailnetID uint64)
+}
+
+func NewPollMapSessionManager() PollMapSessionManager {
+	return &pollMapSessionManager{
+		data:   map[uint64]map[uint64]chan *Ping{},
+		timers: map[uint64]*time.Timer{},
+	}
+}
+
+type pollMapSessionManager struct {
+	sync.RWMutex
+	data   map[uint64]map[uint64]chan *Ping
+	timers map[uint64]*time.Timer
+}
+
+func (n *pollMapSessionManager) Register(tailnetID uint64, machineID uint64, ch chan *Ping) {
+	n.Lock()
+	defer n.Unlock()
+
+	if ss := n.data[tailnetID]; ss == nil {
+		n.data[tailnetID] = map[uint64]chan *Ping{machineID: ch}
+	} else {
+		ss[machineID] = ch
+	}
+
+	t, ok := n.timers[machineID]
+	if ok {
+		t.Stop()
+		delete(n.timers, machineID)
+	}
+}
+
+func (n *pollMapSessionManager) Deregister(tailnetID uint64, machineID uint64) {
+	n.Lock()
+	defer n.Unlock()
+
+	if ss := n.data[tailnetID]; ss != nil {
+		delete(ss, machineID)
+	}
+
+	t, ok := n.timers[machineID]
+	if ok {
+		t.Stop()
+		delete(n.timers, machineID)
+	}
+
+	timer := time.NewTimer(10 * time.Second)
+	go func() {
+		<-timer.C
+		if !n.HasSession(tailnetID, machineID) {
+			n.NotifyAll(tailnetID)
+		}
+	}()
+
+	n.timers[machineID] = timer
+}
+
+func (n *pollMapSessionManager) HasSession(tailnetID uint64, machineID uint64) bool {
+	n.RLock()
+	defer n.RUnlock()
+
+	if ss := n.data[tailnetID]; ss != nil {
+		if _, ok := ss[machineID]; ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (n *pollMapSessionManager) NotifyAll(tailnetID uint64) {
+	n.RLock()
+	defer n.RUnlock()
+
+	if ss := n.data[tailnetID]; ss != nil {
+		for _, p := range ss {
+			p <- &Ping{}
+		}
+	}
+}
@@ -5,10 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"github.com/go-gormigrate/gormigrate/v2"
-	"github.com/hashicorp/go-hclog"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/database/migration"
 	"github.com/jsiebens/ionscale/internal/util"
+	"go.uber.org/zap"
 	"tailscale.com/types/key"
 	"time"

@@ -16,57 +15,55 @@ import (
 	"github.com/jsiebens/ionscale/internal/domain"
 	"gorm.io/gorm"
 	"gorm.io/gorm/logger"
+	"gorm.io/plugin/prometheus"
 )

-type db interface {
-	DB() *gorm.DB
+type dbLock interface {
 	Lock() error
-	Unlock() error
 	UnlockErr(error) error
 }

-func OpenDB(config *config.Database, logger hclog.Logger) (domain.Repository, broker.Pubsub, error) {
-	db, pubsub, err := createDB(config, logger)
+func OpenDB(config *config.Database, logger *zap.Logger) (domain.Repository, error) {
+	db, lock, err := createDB(config, logger)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}

-	repository := domain.NewRepository(db.DB())
+	_ = db.Use(prometheus.New(prometheus.Config{StartServer: false}))

-	if err := db.Lock(); err != nil {
-		return nil, nil, err
+	sqlDB, err := db.DB()
+	if err != nil {
+		return nil, err
 	}

-	if err := db.UnlockErr(migrate(db.DB())); err != nil {
-		return nil, nil, err
+	sqlDB.SetMaxOpenConns(config.MaxOpenConns)
+	sqlDB.SetMaxIdleConns(config.MaxIdleConns)
+	sqlDB.SetConnMaxLifetime(config.ConnMaxLifetime)
+	sqlDB.SetConnMaxIdleTime(config.ConnMaxIdleTime)
+
+	repository := domain.NewRepository(db)
+
+	if err := lock.Lock(); err != nil {
+		return nil, err
 	}

-	return repository, pubsub, nil
+	if err := lock.UnlockErr(migrate(db)); err != nil {
+		return nil, err
+	}
+
+	return repository, nil
 }

-func createDB(config *config.Database, logger hclog.Logger) (db, broker.Pubsub, error) {
+func createDB(config *config.Database, logger *zap.Logger) (*gorm.DB, dbLock, error) {
 	gormConfig := &gorm.Config{
-		Logger: &GormLoggerAdapter{logger: logger.Named("db")},
+		Logger: &GormLoggerAdapter{logger: logger.Sugar()},
 	}

 	switch config.Type {
 	case "sqlite", "sqlite3":
-		db, err := newSqliteDB(config, gormConfig)
-		return db, broker.NewPubsubInMemory(), err
+		return newSqliteDB(config, gormConfig)
 	case "postgres", "postgresql":
-		db, err := newPostgresDB(config, gormConfig)
-		if err != nil {
-			return nil, nil, err
-		}
-		stdDB, err := db.DB().DB()
-		if err != nil {
-			return nil, nil, err
-		}
-		pubsub, err := broker.NewPubsub(context.TODO(), stdDB, config.Url)
-		if err != nil {
-			return nil, nil, err
-		}
-		return db, pubsub, err
+		return newPostgresDB(config, gormConfig)
 	}

 	return nil, nil, fmt.Errorf("invalid database type '%s'", config.Type)
@@ -137,7 +134,7 @@ func createJSONWebKeySet(ctx context.Context, repository domain.Repository) erro
 }

 type GormLoggerAdapter struct {
-	logger hclog.Logger
+	logger *zap.SugaredLogger
 }

 func (g *GormLoggerAdapter) LogMode(level logger.LogLevel) logger.Interface {
@@ -145,11 +142,11 @@ func (g *GormLoggerAdapter) LogMode(level logger.LogLevel) logger.Interface {
 }

 func (g *GormLoggerAdapter) Info(ctx context.Context, s string, i ...interface{}) {
-	g.logger.Info(s, i)
+	g.logger.Infow(s, i)
 }

 func (g *GormLoggerAdapter) Warn(ctx context.Context, s string, i ...interface{}) {
-	g.logger.Warn(s, i)
+	g.logger.Warnw(s, i)
 }

 func (g *GormLoggerAdapter) Error(ctx context.Context, s string, i ...interface{}) {
@@ -157,21 +154,23 @@ func (g *GormLoggerAdapter) Error(ctx context.Context, s string, i ...interface{
 }

 func (g *GormLoggerAdapter) Trace(ctx context.Context, begin time.Time, fc func() (sql string, rowsAffected int64), err error) {
-	elapsed := time.Since(begin)
-	switch {
-	case err != nil && !errors.Is(err, gorm.ErrRecordNotFound):
-		sql, rows := fc()
-		if rows == -1 {
-			g.logger.Error("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "err", err)
-		} else {
-			g.logger.Error("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows, "err", err)
-		}
-	case g.logger.IsTrace():
-		sql, rows := fc()
-		if rows == -1 {
-			g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed)
-		} else {
-			g.logger.Trace("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows)
+	if g.logger.Level().Enabled(zap.DebugLevel) {
+		elapsed := time.Since(begin)
+		switch {
+		case err != nil && !errors.Is(err, gorm.ErrRecordNotFound):
+			sql, rows := fc()
+			if rows == -1 {
+				g.logger.Debugw("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "err", err)
+			} else {
+				g.logger.Debugw("Error executing query", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows, "err", err)
+			}
+		default:
+			sql, rows := fc()
+			if rows == -1 {
+				g.logger.Debugw("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed)
+			} else {
+				g.logger.Debugw("Statement executed", "sql", sql, "start_time", begin.Format(time.RFC3339), "duration", elapsed, "rows", rows)
+			}
 		}
 	}
 }
@@ -0,0 +1,33 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202211031100_add_authorized_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202211031100",
+		Migrate: func(db *gorm.DB) error {
+			type Tailnet struct {
+				Name                        string `gorm:"uniqueIndex"`
+				MachineAuthorizationEnabled bool
+			}
+
+			type AuthKey struct {
+				PreAuthorized bool
+			}
+
+			type Machine struct {
+				Authorized bool `gorm:"default:true"`
+			}
+
+			return db.AutoMigrate(
+				&Tailnet{},
+				&AuthKey{},
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -0,0 +1,23 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+func m202212201300_add_user_id_column() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202212201300",
+		Migrate: func(db *gorm.DB) error {
+			type RegistrationRequest struct {
+				Key    string `gorm:"type:varchar(64);uniqueIndex"`
+				UserID uint64
+			}
+
+			return db.AutoMigrate(
+				&RegistrationRequest{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -0,0 +1,32 @@
+package migration
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"gorm.io/gorm"
+)
+
+func m202212270800_machine_indeces() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "202212270800",
+		Migrate: func(db *gorm.DB) error {
+			type Machine struct {
+				ID         uint64 `gorm:"primaryKey;autoIncrement:false;index:idx_tailnet_id_id,priority:2"`
+				MachineKey string `gorm:"index:idx_machine_keys"`
+				NodeKey    string `gorm:"index:idx_machine_keys"`
+
+				Name    string `gorm:"index:idx_tailnet_id_name,priority:2"`
+				NameIdx uint64 `gorm:"index:idx_tailnet_id_name,sort:desc,priority:3"`
+
+				TailnetID uint64 `gorm:"index:idx_tailnet_id_id,priority:1;index:idx_tailnet_id_name,priority:1"`
+
+				IPv4 domain.IP `gorm:"index:idx_ipv4"`
+			}
+
+			return db.AutoMigrate(
+				&Machine{},
+			)
+		},
+		Rollback: nil,
+	}
+}
@@ -13,6 +13,9 @@ func Migrations() []*gormigrate.Migration {
 		m202210040828_add_derpmap_colum(),
 		m202210070814_add_filesharing_and_servicecollection_columns(),
 		m202210080700_ssh_action_request(),
+		m202211031100_add_authorized_column(),
+		m202212201300_add_user_id_column(),
+		m202212270800_machine_indeces(),
 	}
 	return migrations
 }
@@ -11,26 +11,20 @@ import (
 	"gorm.io/gorm"
 )

-func newPostgresDB(config *config.Database, g *gorm.Config) (db, error) {
+func newPostgresDB(config *config.Database, g *gorm.Config) (*gorm.DB, dbLock, error) {
 	db, err := gorm.Open(postgres.Open(config.Url), g)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}

-	return &Postgres{
-		db: db,
-	}, nil
+	return db, &pgLock{db: db}, nil
 }

-type Postgres struct {
+type pgLock struct {
 	db *gorm.DB
 }

-func (s *Postgres) DB() *gorm.DB {
-	return s.db
-}
-
-func (s *Postgres) Lock() error {
+func (s *pgLock) Lock() error {
 	d, _ := s.db.DB()

 	query := `SELECT pg_advisory_lock($1)`
@@ -42,7 +36,14 @@ func (s *Postgres) Lock() error {
 	return nil
 }

-func (s *Postgres) Unlock() error {
+func (s *pgLock) UnlockErr(prevErr error) error {
+	if err := s.unlock(); err != nil {
+		return multierror.Append(prevErr, err)
+	}
+	return prevErr
+}
+
+func (s *pgLock) unlock() error {
 	d, _ := s.db.DB()

 	query := `SELECT pg_advisory_unlock($1)`
@@ -53,16 +54,9 @@ func (s *Postgres) Unlock() error {
 	return nil
 }

-func (s *Postgres) UnlockErr(prevErr error) error {
-	if err := s.Unlock(); err != nil {
-		return multierror.Append(prevErr, err)
-	}
-	return prevErr
-}
-
 const advisoryLockIDSalt uint = 1486364155

-func (s *Postgres) generateAdvisoryLockId() string {
+func (s *pgLock) generateAdvisoryLockId() string {
 	sum := crc32.ChecksumIEEE([]byte("ionscale_migration"))
 	sum = sum * uint32(advisoryLockIDSalt)
 	return fmt.Sprint(sum)
@@ -6,33 +6,21 @@ import (
 	"gorm.io/gorm"
 )

-func newSqliteDB(config *config.Database, g *gorm.Config) (db, error) {
+func newSqliteDB(config *config.Database, g *gorm.Config) (*gorm.DB, dbLock, error) {
 	db, err := gorm.Open(sqlite.Open(config.Url), g)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-
-	return &Sqlite{
-		db: db,
-	}, nil
+	return db, &sqliteLock{}, nil
 }

-type Sqlite struct {
-	db *gorm.DB
+type sqliteLock struct {
 }

-func (s *Sqlite) DB() *gorm.DB {
-	return s.db
-}
-
-func (s *Sqlite) Lock() error {
+func (s *sqliteLock) Lock() error {
 	return nil
 }

-func (s *Sqlite) Unlock() error {
-	return nil
-}
-
-func (s *Sqlite) UnlockErr(prevErr error) error {
+func (s *sqliteLock) UnlockErr(prevErr error) error {
 	return prevErr
 }
@@ -20,24 +20,29 @@ type Provider interface {
 	SetRecord(ctx context.Context, recordType, recordName, value string) error
 }

-func NewProvider(config config.DNSProvider) (Provider, error) {
-	if len(config.Zone) == 0 {
+func NewProvider(config config.DNS) (Provider, error) {
+	p := config.Provider
+	if len(p.Zone) == 0 {
 		return nil, nil
 	}

-	switch config.Name {
+	if !strings.HasSuffix(config.MagicDNSSuffix, p.Zone) {
+		return nil, fmt.Errorf("invalid MagicDNS suffix [%s], not part of zone [%s]", config.MagicDNSSuffix, p.Zone)
+	}
+
+	switch p.Name {
 	case "azure":
-		return configureAzureProvider(config.Zone, config.Configuration)
+		return configureAzureProvider(p.Zone, p.Configuration)
 	case "cloudflare":
-		return configureCloudflareProvider(config.Zone, config.Configuration)
+		return configureCloudflareProvider(p.Zone, p.Configuration)
 	case "digitalocean":
-		return configureDigitalOceanProvider(config.Zone, config.Configuration)
+		return configureDigitalOceanProvider(p.Zone, p.Configuration)
 	case "googleclouddns":
-		return configureGoogleCloudDNSProvider(config.Zone, config.Configuration)
+		return configureGoogleCloudDNSProvider(p.Zone, p.Configuration)
 	case "route53":
-		return configureRoute53Provider(config.Zone, config.Configuration)
+		return configureRoute53Provider(p.Zone, p.Configuration)
 	default:
-		return nil, fmt.Errorf("unknown dns provider: %s", config.Name)
+		return nil, fmt.Errorf("unknown dns provider: %s", p.Name)
 	}
 }

@@ -21,17 +21,17 @@ const (
 )

 type AutoApprovers struct {
-	Routes   map[string][]string `json:"routes"`
-	ExitNode []string            `json:"exitNode"`
+	Routes   map[string][]string `json:"routes,omitempty"`
+	ExitNode []string            `json:"exitNode,omitempty"`
 }

 type ACLPolicy struct {
 	Groups        map[string][]string `json:"groups,omitempty"`
 	Hosts         map[string]string   `json:"hosts,omitempty"`
-	ACLs          []ACL               `json:"acls"`
-	TagOwners     map[string][]string `json:"tagowners"`
-	AutoApprovers *AutoApprovers      `json:"autoApprovers"`
-	SSHRules      []SSHRule           `json:"ssh"`
+	ACLs          []ACL               `json:"acls,omitempty"`
+	TagOwners     map[string][]string `json:"tagowners,omitempty"`
+	AutoApprovers *AutoApprovers      `json:"autoApprovers,omitempty"`
+	SSHRules      []SSHRule           `json:"ssh,omitempty"`
 }

 type ACL struct {
@@ -47,7 +47,7 @@ type SSHRule struct {
 	Users  []string `json:"users"`
 }

-func DefaultPolicy() ACLPolicy {
+func DefaultACLPolicy() ACLPolicy {
 	return ACLPolicy{
 		ACLs: []ACL{
 			{
@@ -65,7 +65,7 @@ func (r *repository) LoadApiKey(ctx context.Context, key string) (*ApiKey, error
 	}

 	var m ApiKey
-	tx := r.withContext(ctx).Preload("User").Preload("Tailnet").First(&m, "key = ?", split[0])
+	tx := r.withContext(ctx).Preload("User").Preload("Tailnet").Take(&m, "key = ?", split[0])

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -79,7 +79,7 @@ func (r *repository) LoadApiKey(ctx context.Context, key string) (*ApiKey, error
 		return nil, nil
 	}

-	if !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
+	if m.ExpiresAt != nil && !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
 		return nil, nil
 	}

@@ -11,7 +11,7 @@ import (
 	"time"
 )

-func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expiresAt *time.Time) (string, *AuthKey) {
+func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, preAuthorized bool, tags Tags, expiresAt *time.Time) (string, *AuthKey) {
 	key := util.RandStringBytes(12)
 	pwd := util.RandStringBytes(22)
 	value := fmt.Sprintf("%s_%s", key, pwd)
@@ -22,13 +22,14 @@ func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expi
 	}

 	return value, &AuthKey{
-		ID:        util.NextID(),
-		Key:       key,
-		Hash:      string(hash),
-		Ephemeral: ephemeral,
-		Tags:      tags,
-		CreatedAt: time.Now().UTC(),
-		ExpiresAt: expiresAt,
+		ID:            util.NextID(),
+		Key:           key,
+		Hash:          string(hash),
+		Ephemeral:     ephemeral,
+		PreAuthorized: preAuthorized,
+		Tags:          tags,
+		CreatedAt:     time.Now().UTC(),
+		ExpiresAt:     expiresAt,

 		TailnetID: tailnet.ID,
 		UserID:    user.ID,
@@ -36,11 +37,12 @@ func CreateAuthKey(tailnet *Tailnet, user *User, ephemeral bool, tags Tags, expi
 }

 type AuthKey struct {
-	ID        uint64 `gorm:"primary_key"`
-	Key       string
-	Hash      string
-	Ephemeral bool
-	Tags      Tags
+	ID            uint64 `gorm:"primary_key"`
+	Key           string
+	Hash          string
+	Ephemeral     bool
+	PreAuthorized bool
+	Tags          Tags

 	CreatedAt time.Time
 	ExpiresAt *time.Time
@@ -134,7 +136,7 @@ func (r *repository) LoadAuthKey(ctx context.Context, key string) (*AuthKey, err
 	}

 	var m AuthKey
-	tx := r.withContext(ctx).Preload("User").Preload("Tailnet").First(&m, "key = ?", split[0])
+	tx := r.withContext(ctx).Preload("User").Preload("Tailnet").Take(&m, "key = ?", split[0])

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -148,7 +150,7 @@ func (r *repository) LoadAuthKey(ctx context.Context, key string) (*AuthKey, err
 		return nil, nil
 	}

-	if !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
+	if m.ExpiresAt != nil && !m.ExpiresAt.IsZero() && m.ExpiresAt.Before(time.Now()) {
 		return nil, nil
 	}

@@ -27,7 +27,7 @@ func (r *repository) SaveAuthenticationRequest(ctx context.Context, session *Aut

 func (r *repository) GetAuthenticationRequest(ctx context.Context, key string) (*AuthenticationRequest, error) {
 	var m AuthenticationRequest
-	tx := r.withContext(ctx).First(&m, "key = ?", key)
+	tx := r.withContext(ctx).Take(&m, "key = ?", key)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -11,6 +11,10 @@ import (
 	"gorm.io/gorm/schema"
 )

+func DefaultIAMPolicy() IAMPolicy {
+	return IAMPolicy{}
+}
+
 type Identity struct {
 	UserID   string
 	Username string
@@ -24,6 +24,7 @@ type Machine struct {
 	RegisteredTags    Tags
 	Tags              Tags
 	KeyExpiryDisabled bool
+	Authorized        bool

 	HostInfo     HostInfo
 	Endpoints    Endpoints
@@ -356,7 +357,7 @@ func (r *repository) DeleteMachine(ctx context.Context, id uint64) (bool, error)

 func (r *repository) GetMachine(ctx context.Context, machineID uint64) (*Machine, error) {
 	var m Machine
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").First(&m, "id = ?", machineID)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").Take(&m, machineID)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -375,7 +376,7 @@ func (r *repository) GetNextMachineNameIndex(ctx context.Context, tailnetID uint
 	tx := r.withContext(ctx).
 		Where("name = ? AND tailnet_id = ?", name, tailnetID).
 		Order("name_idx desc").
-		First(&m)
+		Take(&m)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return 0, nil
@@ -390,7 +391,7 @@ func (r *repository) GetNextMachineNameIndex(ctx context.Context, tailnetID uint

 func (r *repository) GetMachineByKey(ctx context.Context, tailnetID uint64, machineKey string) (*Machine, error) {
 	var m Machine
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").First(&m, "tailnet_id = ? AND machine_key = ?", tailnetID, machineKey)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").Take(&m, "tailnet_id = ? AND machine_key = ?", tailnetID, machineKey)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -405,7 +406,7 @@ func (r *repository) GetMachineByKey(ctx context.Context, tailnetID uint64, mach

 func (r *repository) GetMachineByKeys(ctx context.Context, machineKey string, nodeKey string) (*Machine, error) {
 	var m Machine
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").First(&m, "machine_key = ? AND node_key = ?", machineKey, nodeKey)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("User").Take(&m, "machine_key = ? AND node_key = ?", machineKey, nodeKey)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -19,6 +19,7 @@ type RegistrationRequest struct {
 	CreatedAt     time.Time
 	Authenticated bool
 	Error         string
+	UserID        uint64
 }

 func (r *RegistrationRequest) IsFinished() bool {
@@ -67,7 +68,7 @@ func (r *repository) SaveRegistrationRequest(ctx context.Context, request *Regis

 func (r *repository) GetRegistrationRequestByKey(ctx context.Context, key string) (*RegistrationRequest, error) {
 	var m RegistrationRequest
-	tx := r.withContext(ctx).First(&m, "key = ?", key)
+	tx := r.withContext(ctx).Take(&m, "key = ?", key)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -82,7 +83,7 @@ func (r *repository) GetRegistrationRequestByKey(ctx context.Context, key string

 func (r *repository) GetRegistrationRequestByMachineKey(ctx context.Context, key string) (*RegistrationRequest, error) {
 	var m RegistrationRequest
-	tx := r.withContext(ctx).First(&m, "machine_key = ?", key)
+	tx := r.withContext(ctx).Take(&m, "machine_key = ?", key)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -25,7 +25,6 @@ type Repository interface {
 	GetOrCreateAccount(ctx context.Context, externalID, loginName string) (*Account, bool, error)

 	SaveTailnet(ctx context.Context, tailnet *Tailnet) error
-	GetOrCreateTailnet(ctx context.Context, name string, iamPolicy IAMPolicy) (*Tailnet, bool, error)
 	GetTailnet(ctx context.Context, id uint64) (*Tailnet, error)
 	GetTailnetByAlias(ctx context.Context, alias string) (*Tailnet, error)
 	ListTailnets(ctx context.Context) ([]Tailnet, error)
@@ -27,7 +27,7 @@ func (r *repository) SaveSSHActionRequest(ctx context.Context, session *SSHActio

 func (r *repository) GetSSHActionRequest(ctx context.Context, key string) (*SSHActionRequest, error) {
 	var m SSHActionRequest
-	tx := r.withContext(ctx).First(&m, "key = ?", key)
+	tx := r.withContext(ctx).Take(&m, "key = ?", key)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -69,7 +69,7 @@ func (r *repository) LoadSystemApiKey(ctx context.Context, token string) (*Syste
 	}

 	var m SystemApiKey
-	tx := r.withContext(ctx).Preload("Account").First(&m, "key = ?", key)
+	tx := r.withContext(ctx).Preload("Account").Take(&m, "key = ?", key)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -3,7 +3,6 @@ package domain
 import (
 	"context"
 	"errors"
-	"github.com/jsiebens/ionscale/internal/util"
 	"gorm.io/gorm"
 	"net/mail"
 	"strings"
@@ -11,16 +10,16 @@ import (
 )

 type Tailnet struct {
-	ID                       uint64 `gorm:"primary_key"`
-	Name                     string
-	Alias                    *string
-	DNSConfig                DNSConfig
-	IAMPolicy                IAMPolicy
-	ACLPolicy                ACLPolicy
-	DERPMap                  DERPMap
-	ServiceCollectionEnabled bool
-	FileSharingEnabled       bool
-	SSHEnabled               bool
+	ID                          uint64 `gorm:"primary_key"`
+	Name                        string
+	DNSConfig                   DNSConfig
+	IAMPolicy                   IAMPolicy
+	ACLPolicy                   ACLPolicy
+	DERPMap                     DERPMap
+	ServiceCollectionEnabled    bool
+	FileSharingEnabled          bool
+	SSHEnabled                  bool
+	MachineAuthorizationEnabled bool
 }

 func (t Tailnet) GetDERPMap(ctx context.Context, fallack DefaultDERPMap) (*DERPMap, error) {
@@ -58,22 +57,6 @@ func (r *repository) SaveTailnet(ctx context.Context, tailnet *Tailnet) error {
 	return nil
 }

-func (r *repository) GetOrCreateTailnet(ctx context.Context, name string, iamPolicy IAMPolicy) (*Tailnet, bool, error) {
-	tailnet := &Tailnet{}
-	id := util.NextID()
-
-	tx := r.withContext(ctx).
-		Where(Tailnet{Name: name}).
-		Attrs(Tailnet{ID: id, ACLPolicy: DefaultPolicy(), IAMPolicy: iamPolicy}).
-		FirstOrCreate(tailnet)
-
-	if tx.Error != nil {
-		return nil, false, tx.Error
-	}
-
-	return tailnet, tailnet.ID == id, nil
-}
-
 func (r *repository) GetTailnet(ctx context.Context, id uint64) (*Tailnet, error) {
 	var t Tailnet
 	tx := r.withContext(ctx).Take(&t, "id = ?", id)
@@ -100,7 +100,7 @@ func (r *repository) GetOrCreateUserWithAccount(ctx context.Context, tailnet *Ta

 func (r *repository) GetUser(ctx context.Context, userID uint64) (*User, error) {
 	var m User
-	tx := r.withContext(ctx).Preload("Tailnet").Preload("Account").First(&m, "id = ? and user_type = ?", userID, UserTypePerson)
+	tx := r.withContext(ctx).Preload("Tailnet").Preload("Account").Take(&m, "id = ?", userID)

 	if errors.Is(tx.Error, gorm.ErrRecordNotFound) {
 		return nil, nil
@@ -3,6 +3,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"github.com/jsiebens/ionscale/internal/addr"
 	"github.com/jsiebens/ionscale/internal/auth"
 	"github.com/labstack/echo/v4/middleware"
@@ -56,30 +57,42 @@ type oauthState struct {
 	Flow string
 }

-func (h *AuthenticationHandlers) StartCliAuth(c echo.Context) error {
+func (h *AuthenticationHandlers) StartAuth(c echo.Context) error {
 	ctx := c.Request().Context()
 	flow := c.Param("flow")
 	key := c.Param("key")

+	// machine registration auth flow
+	if flow == "r" || flow == "" {
+		if req, err := h.repository.GetRegistrationRequestByKey(ctx, key); err != nil || req == nil {
+			return logError(err)
+		}
+
+		csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
+		return c.Render(http.StatusOK, "auth.html", &AuthFormData{ProviderAvailable: h.authProvider != nil, Csrf: csrf})
+	}
+
+	// cli auth flow
 	if flow == "c" {
 		if s, err := h.repository.GetAuthenticationRequest(ctx, key); err != nil || s == nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return logError(err)
 		}
 	}

+	// ssh check auth flow
 	if flow == "s" {
 		if s, err := h.repository.GetSSHActionRequest(ctx, key); err != nil || s == nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return logError(err)
 		}
 	}

 	if h.authProvider == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return logError(fmt.Errorf("unable to start auth flow as no auth provider is configured"))
 	}

 	state, err := h.createState(flow, key)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	redirectUrl := h.authProvider.GetLoginURL(h.config.CreateUrl("/a/callback"), state)
@@ -87,18 +100,6 @@ func (h *AuthenticationHandlers) StartCliAuth(c echo.Context) error {
 	return c.Redirect(http.StatusFound, redirectUrl)
 }

-func (h *AuthenticationHandlers) StartAuth(c echo.Context) error {
-	ctx := c.Request().Context()
-	key := c.Param("key")
-
-	if req, err := h.repository.GetRegistrationRequestByKey(ctx, key); err != nil || req == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
-	}
-
-	csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
-	return c.Render(http.StatusOK, "auth.html", &AuthFormData{ProviderAvailable: h.authProvider != nil, Csrf: csrf})
-}
-
 func (h *AuthenticationHandlers) ProcessAuth(c echo.Context) error {
 	ctx := c.Request().Context()

@@ -108,7 +109,7 @@ func (h *AuthenticationHandlers) ProcessAuth(c echo.Context) error {

 	req, err := h.repository.GetRegistrationRequestByKey(ctx, key)
 	if err != nil || req == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return logError(err)
 	}

 	if authKey != "" {
@@ -118,7 +119,7 @@ func (h *AuthenticationHandlers) ProcessAuth(c echo.Context) error {
 	if interactive != "" {
 		state, err := h.createState("r", key)
 		if err != nil {
-			return err
+			return logError(err)
 		}

 		redirectUrl := h.authProvider.GetLoginURL(h.config.CreateUrl("/a/callback"), state)
@@ -135,17 +136,17 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {
 	code := c.QueryParam("code")
 	state, err := h.readState(c.QueryParam("state"))
 	if err != nil {
-		return err
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid state parameter")
 	}

 	user, err := h.exchangeUser(code)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	account, _, err := h.repository.GetOrCreateAccount(ctx, user.ID, user.Name)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	if state.Flow == "s" {
@@ -156,37 +157,27 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {

 		machine, err := h.repository.GetMachine(ctx, sshActionReq.SrcMachineID)
 		if err != nil || sshActionReq == nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return logError(err)
 		}

-		policy := machine.Tailnet.ACLPolicy
-
-		if machine.HasTags() && policy.IsTagOwner(machine.Tags, &domain.User{Name: account.LoginName, UserType: domain.UserTypePerson}) {
+		if !machine.HasTags() && machine.User.AccountID != nil && *machine.User.AccountID == account.ID {
 			sshActionReq.Action = "accept"
 			if err := h.repository.SaveSSHActionRequest(ctx, sshActionReq); err != nil {
-				return c.Redirect(http.StatusFound, "/a/error")
-			}
-			return c.Redirect(http.StatusFound, "/a/success")
-		}
-
-		if machine.User.AccountID != nil && *machine.User.AccountID == account.ID {
-			sshActionReq.Action = "accept"
-			if err := h.repository.SaveSSHActionRequest(ctx, sshActionReq); err != nil {
-				return c.Redirect(http.StatusFound, "/a/error")
+				return logError(err)
 			}
 			return c.Redirect(http.StatusFound, "/a/success")
 		}

 		sshActionReq.Action = "reject"
 		if err := h.repository.SaveSSHActionRequest(ctx, sshActionReq); err != nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return logError(err)
 		}
 		return c.Redirect(http.StatusFound, "/a/error?e=nmo")
 	}

 	tailnets, err := h.listAvailableTailnets(ctx, user)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	csrf := c.Get(middleware.DefaultCSRFConfig.ContextKey).(string)
@@ -211,7 +202,7 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {
 	if state.Flow == "c" {
 		isSystemAdmin, err := h.isSystemAdmin(ctx, user)
 		if err != nil {
-			return err
+			return logError(err)
 		}

 		if !isSystemAdmin && len(tailnets) == 0 {
@@ -230,7 +221,7 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {
 		})
 	}

-	return c.Redirect(http.StatusFound, "/a/error")
+	return echo.NewHTTPError(http.StatusNotFound)
 }

 func (h *AuthenticationHandlers) isSystemAdmin(ctx context.Context, u *auth.User) (bool, error) {
@@ -260,13 +251,13 @@ func (h *AuthenticationHandlers) EndOAuth(c echo.Context) error {

 	state, err := h.readState(c.QueryParam("state"))
 	if err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid state parameter")
 	}

 	if state.Flow == "r" {
 		req, err := h.repository.GetRegistrationRequestByKey(ctx, state.Key)
 		if err != nil || req == nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return logError(err)
 		}

 		return h.endMachineRegistrationFlow(c, req, state)
@@ -274,13 +265,18 @@ func (h *AuthenticationHandlers) EndOAuth(c echo.Context) error {

 	req, err := h.repository.GetAuthenticationRequest(ctx, state.Key)
 	if err != nil || req == nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return logError(err)
 	}

 	return h.endCliAuthenticationFlow(c, req, state)
 }

 func (h *AuthenticationHandlers) Success(c echo.Context) error {
+	s := c.QueryParam("s")
+	switch s {
+	case "nma":
+		return c.Render(http.StatusOK, "newmachine.html", nil)
+	}
 	return c.Render(http.StatusOK, "success.html", nil)
 }

@@ -311,12 +307,12 @@ func (h *AuthenticationHandlers) endCliAuthenticationFlow(c echo.Context, req *d

 	var form TailnetSelectionForm
 	if err := c.Bind(&form); err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return logError(err)
 	}

 	account, err := h.repository.GetAccount(ctx, form.AccountID)
 	if err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return logError(err)
 	}

 	// continue as system admin?
@@ -327,27 +323,27 @@ func (h *AuthenticationHandlers) endCliAuthenticationFlow(c echo.Context, req *d

 		err := h.repository.Transaction(func(rp domain.Repository) error {
 			if err := rp.SaveSystemApiKey(ctx, apiKey); err != nil {
-				return err
+				return logError(err)
 			}
 			if err := rp.SaveAuthenticationRequest(ctx, req); err != nil {
-				return err
+				return logError(err)
 			}
 			return nil
 		})
 		if err != nil {
-			return err
+			return logError(err)
 		}
 		return c.Redirect(http.StatusFound, "/a/success")
 	}

 	tailnet, err := h.repository.GetTailnet(ctx, form.TailnetID)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	user, _, err := h.repository.GetOrCreateUserWithAccount(ctx, tailnet, account)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	expiresAt := time.Now().Add(24 * time.Hour)
@@ -365,7 +361,7 @@ func (h *AuthenticationHandlers) endCliAuthenticationFlow(c echo.Context, req *d
 		return nil
 	})
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	return c.Redirect(http.StatusFound, "/a/success")
@@ -376,7 +372,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi

 	var form TailnetSelectionForm
 	if err := c.Bind(&form); err != nil {
-		return c.Redirect(http.StatusFound, "/a/error")
+		return logError(err)
 	}

 	req := tailcfg.RegisterRequest(registrationRequest.Data)
@@ -387,11 +383,12 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 	var user *domain.User
 	var ephemeral bool
 	var tags = []string{}
+	var authorized = false

 	if form.AuthKey != "" {
 		authKey, err := h.repository.LoadAuthKey(ctx, form.AuthKey)
 		if err != nil {
-			return err
+			return logError(err)
 		}

 		if authKey == nil {
@@ -400,7 +397,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 			registrationRequest.Error = "invalid auth key"

 			if err := h.repository.SaveRegistrationRequest(ctx, registrationRequest); err != nil {
-				return c.Redirect(http.StatusFound, "/a/error")
+				return logError(err)
 			}

 			return c.Redirect(http.StatusFound, "/a/error?e=iak")
@@ -410,20 +407,21 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		user = &authKey.User
 		tags = authKey.Tags
 		ephemeral = authKey.Ephemeral
+		authorized = authKey.PreAuthorized
 	} else {
 		selectedTailnet, err := h.repository.GetTailnet(ctx, form.TailnetID)
 		if err != nil {
-			return err
+			return logError(err)
 		}

 		account, err := h.repository.GetAccount(ctx, form.AccountID)
 		if err != nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return logError(err)
 		}

 		selectedUser, _, err := h.repository.GetOrCreateUserWithAccount(ctx, selectedTailnet, account)
 		if err != nil {
-			return err
+			return logError(err)
 		}

 		user = selectedUser
@@ -435,7 +433,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		registrationRequest.Authenticated = false
 		registrationRequest.Error = err.Error()
 		if err := h.repository.SaveRegistrationRequest(ctx, registrationRequest); err != nil {
-			return c.Redirect(http.StatusFound, "/a/error")
+			return logError(err)
 		}
 		return c.Redirect(http.StatusFound, "/a/error?e=nto")
 	}
@@ -446,7 +444,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi

 	m, err := h.repository.GetMachineByKey(ctx, tailnet.ID, machineKey)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	now := time.Now().UTC()
@@ -459,7 +457,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		sanitizeHostname := dnsname.SanitizeHostname(req.Hostinfo.Hostname)
 		nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 		if err != nil {
-			return err
+			return logError(err)
 		}

 		m = &domain.Machine{
@@ -475,6 +473,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 			CreatedAt:         now,
 			ExpiresAt:         now.Add(180 * 24 * time.Hour).UTC(),
 			KeyExpiryDisabled: len(tags) != 0,
+			Authorized:        !tailnet.MachineAuthorizationEnabled || authorized,

 			User:    *user,
 			Tailnet: *tailnet,
@@ -482,7 +481,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi

 		ipv4, ipv6, err := addr.SelectIP(checkIP(ctx, h.repository.CountMachinesWithIPv4))
 		if err != nil {
-			return err
+			return logError(err)
 		}
 		m.IPv4 = domain.IP{Addr: ipv4}
 		m.IPv6 = domain.IP{Addr: ipv6}
@@ -495,7 +494,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 		if m.Name != sanitizeHostname {
 			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 			if err != nil {
-				return err
+				return logError(err)
 			}
 			m.Name = sanitizeHostname
 			m.NameIdx = nameIdx
@@ -515,6 +514,7 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 	err = h.repository.Transaction(func(rp domain.Repository) error {
 		registrationRequest.Authenticated = true
 		registrationRequest.Error = ""
+		registrationRequest.UserID = user.ID

 		if err := rp.SaveMachine(ctx, m); err != nil {
 			return err
@@ -528,10 +528,14 @@ func (h *AuthenticationHandlers) endMachineRegistrationFlow(c echo.Context, regi
 	})

 	if err != nil {
-		return err
+		return logError(err)
 	}

-	return c.Redirect(http.StatusFound, "/a/success")
+	if m.Authorized {
+		return c.Redirect(http.StatusFound, "/a/success")
+	} else {
+		return c.Redirect(http.StatusFound, "/a/success?s=nma")
+	}
 }

 func (h *AuthenticationHandlers) exchangeUser(code string) (*auth.User, error) {
@@ -28,12 +28,12 @@ func (h *DNSHandlers) SetDNS(c echo.Context) error {

 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	req := &tailcfg.SetDNSRequest{}
 	if err := binder.BindRequest(c, req); err != nil {
-		return err
+		return logError(err)
 	}

 	if h.provider == nil {
@@ -41,7 +41,7 @@ func (h *DNSHandlers) SetDNS(c echo.Context) error {
 	}

 	if err := h.provider.SetRecord(ctx, req.Type, req.Name, req.Value); err != nil {
-		return err
+		return logError(err)
 	}

 	if strings.HasPrefix(req.Name, "_acme-challenge") && req.Type == "TXT" {
@@ -55,7 +55,7 @@ func (h *IDTokenHandlers) OpenIDConfig(c echo.Context) error {
 func (h *IDTokenHandlers) Jwks(c echo.Context) error {
 	keySet, err := h.repository.GetJSONWebKeySet(c.Request().Context())
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	pub := jose.JSONWebKey{Key: keySet.Key.Public(), KeyID: keySet.Key.Id, Algorithm: "RS256", Use: "sig"}
@@ -68,17 +68,17 @@ func (h *IDTokenHandlers) FetchToken(c echo.Context) error {

 	keySet, err := h.repository.GetJSONWebKeySet(c.Request().Context())
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	req := &tailcfg.TokenRequest{}
 	if err := binder.BindRequest(c, req); err != nil {
-		return err
+		return logError(err)
 	}

 	machineKey := binder.Peer().String()
@@ -87,7 +87,7 @@ func (h *IDTokenHandlers) FetchToken(c echo.Context) error {
 	var m *domain.Machine
 	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	if m == nil {
@@ -130,7 +130,7 @@ func (h *IDTokenHandlers) FetchToken(c echo.Context) error {

 	jwtB64, err := unsignedToken.SignedString(&keySet.Key.PrivateKey)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	resp := tailcfg.TokenResponse{IDToken: jwtB64}
@@ -22,7 +22,7 @@ func KeyHandler(keys *config.ServerKeys) echo.HandlerFunc {
 		if v != "" {
 			clientCapabilityVersion, err := strconv.Atoi(v)
 			if err != nil {
-				return c.String(http.StatusBadRequest, "Invalid version")
+				return echo.NewHTTPError(http.StatusBadRequest, "Invalid version")
 			}

 			if clientCapabilityVersion >= NoiseCapabilityVersion {
@@ -1,9 +1,11 @@
 package handlers

 import (
+	stderrors "errors"
 	"github.com/labstack/echo/v4"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
+	"io"
 	"net/http"
 	"tailscale.com/control/controlhttp"
 	"tailscale.com/net/netutil"
@@ -25,14 +27,17 @@ func NewNoiseHandlers(controlKey key.MachinePrivate, createPeerHandler CreatePee
 }

 func (h *NoiseHandlers) Upgrade(c echo.Context) error {
-	conn, err := controlhttp.AcceptHTTP(c.Request().Context(), c.Response(), c.Request(), h.controlKey)
+	conn, err := controlhttp.AcceptHTTP(c.Request().Context(), c.Response(), c.Request(), h.controlKey, nil)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	handler := h.createPeerHandler(conn.Peer())

 	server := http.Server{}
 	server.Handler = h2c.NewHandler(handler, &http2.Server{})
-	return server.Serve(netutil.NewOneConnListener(conn, nil))
+	if err := server.Serve(netutil.NewOneConnListener(conn, nil)); err != nil && !stderrors.Is(err, io.EOF) {
+		return err
+	}
+	return nil
 }
@@ -3,12 +3,13 @@ package handlers
 import (
 	"context"
 	"github.com/jsiebens/ionscale/internal/bind"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/mapping"
 	"github.com/labstack/echo/v4"
 	"net/http"
+	"net/netip"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/opt"
 	"time"
@@ -16,37 +17,34 @@ import (

 func NewPollNetMapHandler(
 	createBinder bind.Factory,
-	brokers broker.Pubsub,
-	repository domain.Repository,
-	offlineTimers *OfflineTimers) *PollNetMapHandler {
+	sessionManager core.PollMapSessionManager,
+	repository domain.Repository) *PollNetMapHandler {

 	handler := &PollNetMapHandler{
-		createBinder:  createBinder,
-		brokers:       brokers,
-		repository:    repository,
-		offlineTimers: offlineTimers,
+		createBinder:   createBinder,
+		sessionManager: sessionManager,
+		repository:     repository,
 	}

 	return handler
 }

 type PollNetMapHandler struct {
-	createBinder  bind.Factory
-	repository    domain.Repository
-	brokers       broker.Pubsub
-	offlineTimers *OfflineTimers
+	createBinder   bind.Factory
+	repository     domain.Repository
+	sessionManager core.PollMapSessionManager
 }

 func (h *PollNetMapHandler) PollNetMap(c echo.Context) error {
 	ctx := c.Request().Context()
 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	req := &tailcfg.MapRequest{}
 	if err := binder.BindRequest(c, req); err != nil {
-		return err
+		return logError(err)
 	}

 	machineKey := binder.Peer().String()
@@ -55,7 +53,7 @@ func (h *PollNetMapHandler) PollNetMap(c echo.Context) error {
 	var m *domain.Machine
 	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	if m == nil {
@@ -80,13 +78,13 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 	m.LastSeen = &now

 	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
+		return logError(err)
 	}

 	tailnetID := m.TailnetID
 	machineID := m.ID

-	h.brokers.Publish(tailnetID, &broker.Signal{PeerUpdated: &machineID})
+	h.sessionManager.NotifyAll(tailnetID)

 	if !mapRequest.Stream {
 		return c.String(http.StatusOK, "")
@@ -97,43 +95,38 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *

 	response, syncedPeers, derpMapChecksum, err := h.createMapResponse(m, binder, mapRequest, false, make(map[uint64]bool), derpMapChecksum)
 	if err != nil {
-		return err
+		return logError(err)
 	}

-	updateChan := make(chan *broker.Signal, 20)
-
-	unsubscribe, err := h.brokers.Subscribe(tailnetID, updateChan)
-	if err != nil {
-		return err
-	}
-	h.cancelOfflineMessage(machineID)
+	updateChan := make(chan *core.Ping, 20)
+	h.sessionManager.Register(m.TailnetID, m.ID, updateChan)

 	// Listen to connection close
 	notify := c.Request().Context().Done()

 	keepAliveResponse, err := h.createKeepAliveResponse(binder, mapRequest)
 	if err != nil {
-		return err
+		return logError(err)
 	}
-	keepAliveTicker := time.NewTicker(config.KeepAliveInterval())
-	syncTicker := time.NewTicker(5 * time.Second)

 	c.Response().WriteHeader(http.StatusOK)

 	if _, err := c.Response().Write(response); err != nil {
-		return err
+		return logError(err)
 	}
 	c.Response().Flush()

 	connectedDevices.WithLabelValues(m.Tailnet.Name).Inc()

+	keepAliveTicker := time.NewTicker(config.KeepAliveInterval())
+	syncTicker := time.NewTicker(5 * time.Second)
+
 	defer func() {
 		connectedDevices.WithLabelValues(m.Tailnet.Name).Dec()
-		unsubscribe()
+		h.sessionManager.Deregister(m.TailnetID, m.ID)
 		keepAliveTicker.Stop()
 		syncTicker.Stop()
 		_ = h.repository.SetMachineLastSeen(ctx, machineID)
-		h.scheduleOfflineMessage(tailnetID, machineID)
 	}()

 	var latestSync = time.Now()
@@ -146,7 +139,7 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 		case <-keepAliveTicker.C:
 			if mapRequest.KeepAlive {
 				if _, err := c.Response().Write(keepAliveResponse); err != nil {
-					return err
+					return logError(err)
 				}
 				_ = h.repository.SetMachineLastSeen(ctx, machineID)
 				c.Response().Flush()
@@ -155,7 +148,7 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 			if latestSync.Before(latestUpdate) {
 				machine, err := h.repository.GetMachine(ctx, machineID)
 				if err != nil {
-					return err
+					return logError(err)
 				}
 				if machine == nil {
 					return nil
@@ -171,7 +164,7 @@ func (h *PollNetMapHandler) handleUpdate(c echo.Context, binder bind.Binder, m *
 				}

 				if _, err := c.Response().Write(payload); err != nil {
-					return err
+					return logError(err)
 				}
 				c.Response().Flush()

@@ -190,24 +183,16 @@ func (h *PollNetMapHandler) handleReadOnly(c echo.Context, binder bind.Binder, m
 	m.DiscoKey = request.DiscoKey.String()

 	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
+		return logError(err)
 	}

 	response, _, _, err := h.createMapResponse(m, binder, request, false, map[uint64]bool{}, "")
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	_, err = c.Response().Write(response)
-	return err
-}
-
-func (h *PollNetMapHandler) scheduleOfflineMessage(tailnetID, machineID uint64) {
-	h.offlineTimers.startCh <- [2]uint64{tailnetID, machineID}
-}
-
-func (h *PollNetMapHandler) cancelOfflineMessage(machineID uint64) {
-	h.offlineTimers.stopCh <- machineID
+	return logError(err)
 }

 func (h *PollNetMapHandler) createKeepAliveResponse(binder bind.Binder, request *tailcfg.MapRequest) ([]byte, error) {
@@ -221,13 +206,20 @@ func (h *PollNetMapHandler) createKeepAliveResponse(binder bind.Binder, request
 func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Binder, request *tailcfg.MapRequest, delta bool, prevSyncedPeerIDs map[uint64]bool, prevDerpMapChecksum string) ([]byte, map[uint64]bool, string, error) {
 	ctx := context.TODO()

+	prc := &primaryRoutesCollector{flagged: map[netip.Prefix]bool{}}
+
 	tailnet, err := h.repository.GetTailnet(ctx, m.TailnetID)
 	if err != nil {
 		return nil, nil, "", err
 	}

+	serviceUser, _, err := h.repository.GetOrCreateServiceUser(ctx, tailnet)
+	if err != nil {
+		return nil, nil, "", err
+	}
+
 	hostinfo := tailcfg.Hostinfo(m.HostInfo)
-	node, user, err := mapping.ToNode(m, tailnet, false)
+	node, user, err := mapping.ToNode(m, tailnet, serviceUser, false, true, prc.filter)
 	if err != nil {
 		return nil, nil, "", err
 	}
@@ -236,7 +228,6 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin
 	var users = []tailcfg.UserProfile{*user}
 	var changedPeers []*tailcfg.Node
 	var removedPeers []tailcfg.NodeID
-	var validPeers []domain.Machine

 	candidatePeers, err := h.repository.ListMachinePeers(ctx, m.TailnetID, m.MachineKey)
 	if err != nil {
@@ -244,15 +235,16 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin
 	}

 	syncedPeerIDs := map[uint64]bool{}
-	syncedUserIDs := map[tailcfg.UserID]bool{}
+	syncedUserIDs := map[tailcfg.UserID]bool{user.ID: true}

 	for _, peer := range candidatePeers {
 		if peer.IsExpired() {
 			continue
 		}
 		if policies.IsValidPeer(m, &peer) || policies.IsValidPeer(&peer, m) {
-			validPeers = append(validPeers, peer)
-			n, u, err := mapping.ToNode(&peer, tailnet, true)
+			isConnected := h.sessionManager.HasSession(peer.TailnetID, peer.ID)
+
+			n, u, err := mapping.ToNode(&peer, tailnet, serviceUser, true, isConnected, prc.filter)
 			if err != nil {
 				return nil, nil, "", err
 			}
@@ -287,7 +279,7 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin
 		mapResponse = &tailcfg.MapResponse{
 			KeepAlive:       false,
 			Node:            node,
-			DNSConfig:       mapping.ToDNSConfig(m, validPeers, &m.Tailnet, &dnsConfig),
+			DNSConfig:       mapping.ToDNSConfig(m, &m.Tailnet, &dnsConfig),
 			PacketFilter:    filterRules,
 			DERPMap:         &derpMap.DERPMap,
 			Domain:          domain.SanitizeTailnetName(m.Tailnet.Name),
@@ -302,7 +294,7 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin
 	} else {
 		mapResponse = &tailcfg.MapResponse{
 			Node:            node,
-			DNSConfig:       mapping.ToDNSConfig(m, validPeers, &m.Tailnet, &dnsConfig),
+			DNSConfig:       mapping.ToDNSConfig(m, &m.Tailnet, &dnsConfig),
 			PacketFilter:    filterRules,
 			Domain:          domain.SanitizeTailnetName(m.Tailnet.Name),
 			PeersChanged:    changedPeers,
@@ -332,62 +324,29 @@ func (h *PollNetMapHandler) createMapResponse(m *domain.Machine, binder bind.Bin
 	return payload, syncedPeerIDs, derpMap.Checksum, nil
 }

-func NewOfflineTimers(repository domain.Repository, pubsub broker.Pubsub) *OfflineTimers {
-	return &OfflineTimers{
-		repository: repository,
-		pubsub:     pubsub,
-		data:       make(map[uint64]*time.Timer),
-		startCh:    make(chan [2]uint64),
-		stopCh:     make(chan uint64),
-	}
-}
-
-type OfflineTimers struct {
-	repository domain.Repository
-	pubsub     broker.Pubsub
-	data       map[uint64]*time.Timer
-	stopCh     chan uint64
-	startCh    chan [2]uint64
-}
-
-func (o *OfflineTimers) Start() {
-	for {
-		select {
-		case i := <-o.startCh:
-			o.scheduleOfflineMessage(i[0], i[1])
-		case m := <-o.stopCh:
-			o.cancelOfflineMessage(m)
-		}
-	}
-}
-
-func (o *OfflineTimers) scheduleOfflineMessage(tailnetID, machineID uint64) {
-	t, ok := o.data[machineID]
-	if ok {
-		t.Stop()
-		delete(o.data, machineID)
-	}
-
-	timer := time.NewTimer(config.KeepAliveInterval())
-	go func() {
-		<-timer.C
-		o.pubsub.Publish(tailnetID, &broker.Signal{PeerUpdated: &machineID})
-		o.stopCh <- machineID
-	}()
-
-	o.data[machineID] = timer
-}
-
-func (o *OfflineTimers) cancelOfflineMessage(machineID uint64) {
-	t, ok := o.data[machineID]
-	if ok {
-		t.Stop()
-		delete(o.data, machineID)
-	}
-}
-
 func optBool(v bool) opt.Bool {
 	b := opt.Bool("")
 	b.Set(v)
 	return b
 }
+
+type primaryRoutesCollector struct {
+	flagged map[netip.Prefix]bool
+}
+
+func (p *primaryRoutesCollector) filter(m *domain.Machine) []netip.Prefix {
+	var result = []netip.Prefix{}
+	for _, r := range m.AllowIPs {
+		if _, ok := p.flagged[r]; r.Bits() != 0 && !ok {
+			result = append(result, r)
+			p.flagged[r] = true
+		}
+	}
+	for _, r := range m.AutoAllowIPs {
+		if _, ok := p.flagged[r]; r.Bits() != 0 && !ok {
+			result = append(result, r)
+			p.flagged[r] = true
+		}
+	}
+	return result
+}
@@ -4,9 +4,10 @@ import (
 	"context"
 	"github.com/jsiebens/ionscale/internal/addr"
 	"github.com/jsiebens/ionscale/internal/bind"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/mapping"
 	"github.com/jsiebens/ionscale/internal/util"
 	"github.com/labstack/echo/v4"
 	"net/http"
@@ -19,21 +20,21 @@ import (
 func NewRegistrationHandlers(
 	createBinder bind.Factory,
 	config *config.Config,
-	brokers broker.Pubsub,
+	sessionManager core.PollMapSessionManager,
 	repository domain.Repository) *RegistrationHandlers {
 	return &RegistrationHandlers{
-		createBinder: createBinder,
-		pubsub:       brokers,
-		repository:   repository,
-		config:       config,
+		createBinder:   createBinder,
+		sessionManager: sessionManager,
+		repository:     repository,
+		config:         config,
 	}
 }

 type RegistrationHandlers struct {
-	createBinder bind.Factory
-	repository   domain.Repository
-	pubsub       broker.Pubsub
-	config       *config.Config
+	createBinder   bind.Factory
+	repository     domain.Repository
+	sessionManager core.PollMapSessionManager
+	config         *config.Config
 }

 func (h *RegistrationHandlers) Register(c echo.Context) error {
@@ -41,12 +42,12 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {

 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	req := &tailcfg.RegisterRequest{}
 	if err := binder.BindRequest(c, req); err != nil {
-		return err
+		return logError(err)
 	}

 	machineKey := binder.Peer().String()
@@ -56,7 +57,7 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {
 	m, err = h.repository.GetMachineByKeys(ctx, machineKey, nodeKey)

 	if err != nil {
-		return err
+		return logError(err)
 	}

 	if m != nil {
@@ -70,14 +71,14 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {

 			if m.Ephemeral {
 				if _, err := h.repository.DeleteMachine(ctx, m.ID); err != nil {
-					return err
+					return logError(err)
 				}
-				h.pubsub.Publish(m.TailnetID, &broker.Signal{PeersRemoved: []uint64{m.ID}})
+				h.sessionManager.NotifyAll(m.TailnetID)
 			} else {
 				if err := h.repository.SaveMachine(ctx, m); err != nil {
-					return err
+					return logError(err)
 				}
-				h.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+				h.sessionManager.NotifyAll(m.TailnetID)
 			}

 			response := tailcfg.RegisterResponse{NodeKeyExpired: true}
@@ -88,7 +89,7 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {
 		if m.Name != sanitizeHostname {
 			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, m.TailnetID, sanitizeHostname)
 			if err != nil {
-				return err
+				return logError(err)
 			}
 			m.Name = sanitizeHostname
 			m.NameIdx = nameIdx
@@ -99,10 +100,17 @@ func (h *RegistrationHandlers) Register(c echo.Context) error {
 		m.Tags = append(m.RegisteredTags, advertisedTags...)

 		if err := h.repository.SaveMachine(ctx, m); err != nil {
-			return err
+			return logError(err)
+		}
+
+		tUser, tLogin := mapping.ToUser(m.User)
+
+		response := tailcfg.RegisterResponse{
+			MachineAuthorized: m.Authorized,
+			User:              tUser,
+			Login:             tLogin,
 		}

-		response := tailcfg.RegisterResponse{MachineAuthorized: true}
 		return binder.WriteResponse(c, http.StatusOK, response)
 	}

@@ -118,7 +126,7 @@ func (h *RegistrationHandlers) authenticateMachine(c echo.Context, binder bind.B

 	if req.Auth.AuthKey == "" {
 		key := util.RandStringBytes(8)
-		authUrl := h.config.CreateUrl("/a/%s", key)
+		authUrl := h.config.CreateUrl("/a/r/%s", key)

 		request := domain.RegistrationRequest{
 			MachineKey: machineKey,
@@ -146,7 +154,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi

 	authKey, err := h.repository.LoadAuthKey(ctx, req.Auth.AuthKey)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	if authKey == nil {
@@ -172,7 +180,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi

 	m, err = h.repository.GetMachineByKey(ctx, tailnet.ID, machineKey)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	now := time.Now().UTC()
@@ -181,7 +189,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 		sanitizeHostname := dnsname.SanitizeHostname(req.Hostinfo.Hostname)
 		nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 		if err != nil {
-			return err
+			return logError(err)
 		}

 		m = &domain.Machine{
@@ -197,6 +205,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 			CreatedAt:         now,
 			ExpiresAt:         now.Add(180 * 24 * time.Hour).UTC(),
 			KeyExpiryDisabled: len(tags) != 0,
+			Authorized:        !tailnet.MachineAuthorizationEnabled || authKey.PreAuthorized,

 			User:    user,
 			Tailnet: tailnet,
@@ -208,7 +217,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi

 		ipv4, ipv6, err := addr.SelectIP(checkIP(ctx, h.repository.CountMachinesWithIPv4))
 		if err != nil {
-			return err
+			return logError(err)
 		}
 		m.IPv4 = domain.IP{Addr: ipv4}
 		m.IPv6 = domain.IP{Addr: ipv6}
@@ -217,7 +226,7 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 		if m.Name != sanitizeHostname {
 			nameIdx, err := h.repository.GetNextMachineNameIndex(ctx, tailnet.ID, sanitizeHostname)
 			if err != nil {
-				return err
+				return logError(err)
 			}
 			m.Name = sanitizeHostname
 			m.NameIdx = nameIdx
@@ -235,10 +244,16 @@ func (h *RegistrationHandlers) authenticateMachineWithAuthKey(c echo.Context, bi
 	}

 	if err := h.repository.SaveMachine(ctx, m); err != nil {
-		return err
+		return logError(err)
+	}
+
+	tUser, tLogin := mapping.ToUser(m.User)
+	response := tailcfg.RegisterResponse{
+		MachineAuthorized: true,
+		User:              tUser,
+		Login:             tLogin,
 	}

-	response := tailcfg.RegisterResponse{MachineAuthorized: true}
 	return binder.WriteResponse(c, http.StatusOK, response)
 }

@@ -263,7 +278,19 @@ func (h *RegistrationHandlers) followup(c echo.Context, binder bind.Binder, req
 			}

 			if m != nil && m.IsFinished() {
-				response := tailcfg.RegisterResponse{MachineAuthorized: len(m.Error) != 0, Error: m.Error}
+				user, err := h.repository.GetUser(ctx, m.UserID)
+				if err != nil {
+					return err
+				}
+
+				u, l := mapping.ToUser(*user)
+
+				response := tailcfg.RegisterResponse{
+					MachineAuthorized: len(m.Error) != 0,
+					Error:             m.Error,
+					User:              u,
+					Login:             l,
+				}
 				return binder.WriteResponse(c, http.StatusOK, response)
 			}
 		case <-notify:
@@ -36,12 +36,12 @@ func (h *SSHActionHandlers) StartAuth(c echo.Context) error {

 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	data := new(sshActionRequestData)
 	if err = c.Bind(data); err != nil {
-		return c.String(http.StatusBadRequest, "bad request")
+		return logError(err)
 	}

 	key := util.RandStringBytes(8)
@@ -55,7 +55,7 @@ func (h *SSHActionHandlers) StartAuth(c echo.Context) error {
 	authUrl := h.config.CreateUrl("/a/s/%s", key)

 	if err := h.repository.SaveSSHActionRequest(ctx, request); err != nil {
-		return err
+		return logError(err)
 	}

 	resp := &tailcfg.SSHAction{
@@ -73,7 +73,7 @@ func (h *SSHActionHandlers) CheckAuth(c echo.Context) error {

 	binder, err := h.createBinder(c)
 	if err != nil {
-		return err
+		return logError(err)
 	}

 	tick := time.NewTicker(2 * time.Second)
@@ -3,6 +3,7 @@ package handlers
 import (
 	"github.com/jsiebens/ionscale/internal/version"
 	"github.com/labstack/echo/v4"
+	"go.uber.org/zap"
 	"net/http"
 )

@@ -14,3 +15,8 @@ func Version(c echo.Context) error {
 	}
 	return c.JSON(http.StatusOK, resp)
 }
+
+func logError(err error) error {
+	zap.L().WithOptions(zap.AddCallerSkip(1)).Error("error processing request", zap.Error(err))
+	return err
+}
@@ -27,16 +27,11 @@ func CopyViaJson[F any, T any](f F, t T) error {
 	return nil
 }

-func ToDNSConfig(m *domain.Machine, peers []domain.Machine, tailnet *domain.Tailnet, c *domain.DNSConfig) *tailcfg.DNSConfig {
-	certDNSSuffix := config.CertDNSSuffix()
-	certsEnabled := c.HttpsCertsEnabled && len(certDNSSuffix) != 0
+func ToDNSConfig(m *domain.Machine, tailnet *domain.Tailnet, c *domain.DNSConfig) *tailcfg.DNSConfig {
+	certsEnabled := c.HttpsCertsEnabled && config.DNSProviderConfigured()

-	tailnetDomain := domain.SanitizeTailnetName(tailnet.Name)
-
-	var certDomain = ""
-	if certsEnabled {
-		certDomain = domain.SanitizeTailnetName(*tailnet.Alias)
-	}
+	sanitizeTailnetName := domain.SanitizeTailnetName(tailnet.Name)
+	tailnetDomain := fmt.Sprintf("%s.%s", sanitizeTailnetName, config.MagicDNSSuffix())

 	resolvers := []*dnstype.Resolver{}
 	for _, r := range c.Nameservers {
@@ -52,12 +47,11 @@ func ToDNSConfig(m *domain.Machine, peers []domain.Machine, tailnet *domain.Tail
 	var certDomains []string

 	if c.MagicDNS {
-		domains = append(domains, fmt.Sprintf("%s.%s", tailnetDomain, config.MagicDNSSuffix()))
+		domains = append(domains, tailnetDomain)
 		dnsConfig.Proxied = true

 		if certsEnabled {
-			domains = append(domains, fmt.Sprintf("%s.%s", certDomain, certDNSSuffix))
-			certDomains = append(certDomains, fmt.Sprintf("%s.%s.%s", m.CompleteName(), certDomain, certDNSSuffix))
+			certDomains = append(certDomains, fmt.Sprintf("%s.%s", m.CompleteName(), tailnetDomain))
 		}
 	}

@@ -70,10 +64,6 @@ func ToDNSConfig(m *domain.Machine, peers []domain.Machine, tailnet *domain.Tail
 	if len(c.Routes) != 0 || certsEnabled {
 		routes := make(map[string][]*dnstype.Resolver)

-		if certsEnabled {
-			routes[fmt.Sprintf("%s.", certDNSSuffix)] = nil
-		}
-
 		for r, s := range c.Routes {
 			routeResolver := []*dnstype.Resolver{}
 			for _, addr := range s {
@@ -89,26 +79,10 @@ func ToDNSConfig(m *domain.Machine, peers []domain.Machine, tailnet *domain.Tail
 	dnsConfig.Domains = domains
 	dnsConfig.CertDomains = certDomains

-	if certsEnabled {
-		var extraRecords = []tailcfg.DNSRecord{{
-			Name:  fmt.Sprintf("%s.%s.%s", m.CompleteName(), certDomain, certDNSSuffix),
-			Value: m.IPv4.String(),
-		}}
-
-		for _, p := range peers {
-			extraRecords = append(extraRecords, tailcfg.DNSRecord{
-				Name:  fmt.Sprintf("%s.%s.%s", p.CompleteName(), certDomain, certDNSSuffix),
-				Value: p.IPv4.String(),
-			})
-		}
-
-		dnsConfig.ExtraRecords = extraRecords
-	}
-
 	return dnsConfig
 }

-func ToNode(m *domain.Machine, tailnet *domain.Tailnet, peer bool) (*tailcfg.Node, *tailcfg.UserProfile, error) {
+func ToNode(m *domain.Machine, tailnet *domain.Tailnet, taggedDevicesUser *domain.User, peer bool, connected bool, routeFilter func(m *domain.Machine) []netip.Prefix) (*tailcfg.Node, *tailcfg.UserProfile, error) {
 	role := tailnet.IAMPolicy.GetRole(m.User)

 	var capabilities []string
@@ -170,8 +144,13 @@ func ToNode(m *domain.Machine, tailnet *domain.Tailnet, peer bool) (*tailcfg.Nod
 		allowedIPs = append(allowedIPs, ipv6)
 	}

-	allowedIPs = append(allowedIPs, m.AllowIPs...)
-	allowedIPs = append(allowedIPs, m.AutoAllowIPs...)
+	if connected {
+		allowedIPs = append(allowedIPs, routeFilter(m)...)
+	}
+
+	if m.IsAllowedExitNode() {
+		allowedIPs = append(allowedIPs, netip.MustParsePrefix("0.0.0.0/0"), netip.MustParsePrefix("::/0"))
+	}

 	var derp string
 	if hostinfo.NetInfo != nil {
@@ -207,7 +186,7 @@ func ToNode(m *domain.Machine, tailnet *domain.Tailnet, peer bool) (*tailcfg.Nod

 		Created: m.CreatedAt.UTC(),

-		MachineAuthorized: true,
+		MachineAuthorized: m.Authorized,
 		User:              tailcfg.UserID(m.UserID),
 	}

@@ -220,19 +199,17 @@ func ToNode(m *domain.Machine, tailnet *domain.Tailnet, peer bool) (*tailcfg.Nod
 		n.KeyExpiry = time.Time{}
 	}

-	if m.LastSeen != nil {
-		l := m.LastSeen.UTC()
-		online := m.LastSeen.After(time.Now().Add(-config.KeepAliveInterval()))
-		n.LastSeen = &l
-		n.Online = &online
+	n.Online = &connected
+	if !connected && m.LastSeen != nil {
+		n.LastSeen = m.LastSeen
 	}

 	var user = ToUserProfile(m.User)

 	if m.HasTags() {
-		n.User = tailcfg.UserID(m.ID)
+		n.User = tailcfg.UserID(taggedDevicesUser.ID)
 		user = tailcfg.UserProfile{
-			ID:          tailcfg.UserID(m.ID),
+			ID:          tailcfg.UserID(taggedDevicesUser.ID),
 			LoginName:   "tagged-devices",
 			DisplayName: "Tagged Devices",
 		}
@@ -250,6 +227,23 @@ func ToUserProfile(u domain.User) tailcfg.UserProfile {
 	return profile
 }

+func ToUser(u domain.User) (tailcfg.User, tailcfg.Login) {
+	user := tailcfg.User{
+		ID:          tailcfg.UserID(u.ID),
+		LoginName:   u.Name,
+		DisplayName: u.Name,
+		Logins:      []tailcfg.LoginID{tailcfg.LoginID(u.ID)},
+		Domain:      u.Tailnet.Name,
+	}
+	login := tailcfg.Login{
+		ID:          tailcfg.LoginID(u.ID),
+		LoginName:   u.Name,
+		DisplayName: u.Name,
+		Domain:      u.Tailnet.Name,
+	}
+	return user, login
+}
+
 func filterServices(services []tailcfg.Service) []tailcfg.Service {
 	result := []tailcfg.Service{}
 	for _, s := range services {
@@ -2,17 +2,35 @@ package server

 import (
 	"fmt"
-	"github.com/hashicorp/go-hclog"
+	"github.com/labstack/echo-contrib/prometheus"
 	"github.com/labstack/echo/v4"
-	"runtime"
+	"go.uber.org/zap"
+	"net/http"
+	"strings"
 	"time"
 )

-func EchoLogger(logger hclog.Logger) echo.MiddlewareFunc {
-	httpLogger := logger.Named("http")
+func EchoErrorHandler() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			request := c.Request()
+
+			err := next(c)
+
+			if err != nil && strings.HasPrefix(request.RequestURI, "/a/") {
+				return c.Render(http.StatusInternalServerError, "error.html", nil)
+			}
+
+			return err
+		}
+	}
+}
+
+func EchoLogger(logger *zap.Logger) echo.MiddlewareFunc {
+	httpLogger := logger.Sugar()
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) (err error) {
-			if !httpLogger.IsTrace() {
+			if !httpLogger.Level().Enabled(zap.DebugLevel) {
 				return next(c)
 			}

@@ -23,7 +41,7 @@ func EchoLogger(logger hclog.Logger) echo.MiddlewareFunc {
 				c.Error(err)
 			}

-			httpLogger.Trace("finished server http call",
+			httpLogger.Debugw("finished server http call",
 				"http.code", response.Status,
 				"http.method", request.Method,
 				"http.uri", request.RequestURI,
@@ -35,23 +53,27 @@ func EchoLogger(logger hclog.Logger) echo.MiddlewareFunc {
 	}
 }

-func EchoRecover(logger hclog.Logger) echo.MiddlewareFunc {
-	httpLogger := logger.Named("http")
+func EchoRecover() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			defer func() {
-				if r := recover(); r != nil {
-					err, ok := r.(error)
-					if !ok {
-						err = fmt.Errorf("%v", r)
+			apply := func() (topErr error) {
+				defer func() {
+					if r := recover(); r != nil {
+						err, ok := r.(error)
+						if !ok {
+							err = fmt.Errorf("%v", r)
+						}
+						zap.L().Error("panic when processing request", zap.Error(err))
+						topErr = err
 					}
-					stack := make([]byte, 4<<10) // 4 KB
-					length := runtime.Stack(stack, false)
-					httpLogger.Error("panic handling request", "err", err, "stack", string(stack[:length]))
-					c.Error(err)
-				}
-			}()
-			return next(c)
+				}()
+				return next(c)
+			}
+			return apply()
 		}
 	}
 }
+
+func EchoMetrics(p *prometheus.Prometheus) echo.MiddlewareFunc {
+	return p.HandlerFunc
+}
@@ -10,6 +10,6 @@ import (
 )

 func NewRpcHandler(systemAdminKey *key.ServerPrivate, repository domain.Repository, handler apiconnect.IonscaleServiceHandler) (string, http.Handler) {
-	interceptors := connect.WithInterceptors(service.AuthenticationInterceptor(systemAdminKey, repository))
+	interceptors := connect.WithInterceptors(service.NewErrorInterceptor(), service.AuthenticationInterceptor(systemAdminKey, repository))
 	return apiconnect.NewIonscaleServiceHandler(handler, interceptors)
 }
@@ -5,10 +5,10 @@ import (
 	"crypto/tls"
 	"fmt"
 	"github.com/caddyserver/certmagic"
-	"github.com/hashicorp/go-hclog"
 	"github.com/jsiebens/ionscale/internal/auth"
 	"github.com/jsiebens/ionscale/internal/bind"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/database"
 	"github.com/jsiebens/ionscale/internal/dns"
 	"github.com/jsiebens/ionscale/internal/domain"
@@ -18,15 +18,15 @@ import (
 	echo_prometheus "github.com/labstack/echo-contrib/prometheus"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
 	"golang.org/x/sync/errgroup"
-	"log"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
-	"strings"
 	"tailscale.com/types/key"
 )

@@ -38,11 +38,16 @@ func Start(c *config.Config) error {

 	logger.Info("Starting ionscale server")

-	repository, brokers, err := database.OpenDB(&c.Database, logger)
+	httpLogger := logger.Named("http")
+	dbLogger := logger.Named("db")
+
+	repository, err := database.OpenDB(&c.Database, dbLogger)
 	if err != nil {
 		return err
 	}

+	sessionManager := core.NewPollMapSessionManager()
+
 	defaultControlKeys, err := repository.GetControlKeys(context.Background())
 	if err != nil {
 		return err
@@ -53,11 +58,7 @@ func Start(c *config.Config) error {
 		return err
 	}

-	offlineTimers := handlers.NewOfflineTimers(repository, brokers)
-	reaper := handlers.NewReaper(brokers, repository)
-
-	go offlineTimers.Start()
-	go reaper.Start()
+	core.StartReaper(repository, sessionManager)

 	serverUrl, err := url.Parse(c.ServerUrl)
 	if err != nil {
@@ -69,6 +70,7 @@ func Start(c *config.Config) error {
 		certmagic.DefaultACME.Agreed = true
 		certmagic.DefaultACME.Email = c.Tls.AcmeEmail
 		certmagic.DefaultACME.CA = c.Tls.AcmeCA
+		certmagic.Default.Logger = logger.Named("certmagic")
 		if c.Tls.AcmePath != "" {
 			certmagic.Default.Storage = &certmagic.FileStorage{Path: c.Tls.AcmePath}
 		}
@@ -87,21 +89,27 @@ func Start(c *config.Config) error {
 		return fmt.Errorf("error configuring OIDC provider: %v", err)
 	}

-	dnsProvider, err := dns.NewProvider(c.DNS.Provider)
+	dnsProvider, err := dns.NewProvider(c.DNS)
 	if err != nil {
 		return err
 	}

-	createPeerHandler := func(p key.MachinePublic) http.Handler {
-		registrationHandlers := handlers.NewRegistrationHandlers(bind.DefaultBinder(p), c, brokers, repository)
-		pollNetMapHandler := handlers.NewPollNetMapHandler(bind.DefaultBinder(p), brokers, repository, offlineTimers)
-		dnsHandlers := handlers.NewDNSHandlers(bind.DefaultBinder(p), dnsProvider)
-		idTokenHandlers := handlers.NewIDTokenHandlers(bind.DefaultBinder(p), c, repository)
-		sshActionHandlers := handlers.NewSSHActionHandlers(bind.DefaultBinder(p), c, repository)
+	p := echo_prometheus.NewPrometheus("http", nil)
+
+	metricsHandler := echo.New()
+	p.SetMetricsPath(metricsHandler)
+
+	createPeerHandler := func(machinePublicKey key.MachinePublic) http.Handler {
+		binder := bind.DefaultBinder(machinePublicKey)
+
+		registrationHandlers := handlers.NewRegistrationHandlers(binder, c, sessionManager, repository)
+		pollNetMapHandler := handlers.NewPollNetMapHandler(binder, sessionManager, repository)
+		dnsHandlers := handlers.NewDNSHandlers(binder, dnsProvider)
+		idTokenHandlers := handlers.NewIDTokenHandlers(binder, c, repository)
+		sshActionHandlers := handlers.NewSSHActionHandlers(binder, c, repository)

 		e := echo.New()
-		e.Use(EchoLogger(logger))
-		e.Use(EchoRecover(logger))
+		e.Use(EchoMetrics(p), EchoLogger(httpLogger), EchoErrorHandler(), EchoRecover())
 		e.POST("/machine/register", registrationHandlers.Register)
 		e.POST("/machine/map", pollNetMapHandler.PollNetMap)
 		e.POST("/machine/set-dns", dnsHandlers.SetDNS)
@@ -113,8 +121,8 @@ func Start(c *config.Config) error {
 	}

 	noiseHandlers := handlers.NewNoiseHandlers(serverKey.ControlKey, createPeerHandler)
-	registrationHandlers := handlers.NewRegistrationHandlers(bind.BoxBinder(serverKey.LegacyControlKey), c, brokers, repository)
-	pollNetMapHandler := handlers.NewPollNetMapHandler(bind.BoxBinder(serverKey.LegacyControlKey), brokers, repository, offlineTimers)
+	registrationHandlers := handlers.NewRegistrationHandlers(bind.BoxBinder(serverKey.LegacyControlKey), c, sessionManager, repository)
+	pollNetMapHandler := handlers.NewPollNetMapHandler(bind.BoxBinder(serverKey.LegacyControlKey), sessionManager, repository)
 	dnsHandlers := handlers.NewDNSHandlers(bind.BoxBinder(serverKey.LegacyControlKey), dnsProvider)
 	idTokenHandlers := handlers.NewIDTokenHandlers(bind.BoxBinder(serverKey.LegacyControlKey), c, repository)
 	authenticationHandlers := handlers.NewAuthenticationHandlers(
@@ -124,27 +132,18 @@ func Start(c *config.Config) error {
 		repository,
 	)

-	rpcService := service.NewService(c, authProvider, repository, brokers)
+	rpcService := service.NewService(c, authProvider, repository, sessionManager)
 	rpcPath, rpcHandler := NewRpcHandler(serverKey.SystemAdminKey, repository, rpcService)

-	p := echo_prometheus.NewPrometheus("http", nil)
-
-	metricsHandler := echo.New()
-	p.SetMetricsPath(metricsHandler)
-
 	nonTlsAppHandler := echo.New()
-	nonTlsAppHandler.Use(EchoRecover(logger))
-	nonTlsAppHandler.Use(EchoLogger(logger))
-	nonTlsAppHandler.Use(p.HandlerFunc)
+	nonTlsAppHandler.Use(EchoMetrics(p), EchoLogger(httpLogger), EchoErrorHandler(), EchoRecover())
 	nonTlsAppHandler.POST("/ts2021", noiseHandlers.Upgrade)
 	nonTlsAppHandler.Any("/*", handlers.HttpRedirectHandler(c.Tls))

 	tlsAppHandler := echo.New()
-	tlsAppHandler.Pre(handlers.HttpsRedirect(c.Tls))
 	tlsAppHandler.Renderer = templates.NewTemplates()
-	tlsAppHandler.Use(EchoRecover(logger))
-	tlsAppHandler.Use(EchoLogger(logger))
-	tlsAppHandler.Use(p.HandlerFunc)
+	tlsAppHandler.Pre(handlers.HttpsRedirect(c.Tls))
+	tlsAppHandler.Use(EchoMetrics(p), EchoLogger(logger), EchoErrorHandler(), EchoRecover())

 	tlsAppHandler.Any("/*", handlers.IndexHandler(http.StatusNotFound))
 	tlsAppHandler.Any("/", handlers.IndexHandler(http.StatusOK))
@@ -162,9 +161,8 @@ func Start(c *config.Config) error {
 	auth.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
 		TokenLookup: "form:_csrf",
 	}))
-	auth.GET("/:key", authenticationHandlers.StartAuth)
-	auth.POST("/:key", authenticationHandlers.ProcessAuth)
-	auth.GET("/:flow/:key", authenticationHandlers.StartCliAuth)
+	auth.GET("/:flow/:key", authenticationHandlers.StartAuth)
+	auth.POST("/:flow/:key", authenticationHandlers.ProcessAuth)
 	auth.GET("/callback", authenticationHandlers.Callback)
 	auth.POST("/callback", authenticationHandlers.EndOAuth)
 	auth.GET("/success", authenticationHandlers.Success)
@@ -197,14 +195,14 @@ func Start(c *config.Config) error {
 	}

 	if c.Tls.AcmeEnabled {
-		logger.Info("TLS is enabled with ACME", "domain", serverUrl.Host)
-		logger.Info("Server is running", "http_addr", c.HttpListenAddr, "https_addr", c.HttpsListenAddr, "metrics_addr", c.MetricsListenAddr)
+		logger.Sugar().Infow("TLS is enabled with ACME", "domain", serverUrl.Host)
+		logger.Sugar().Infow("Server is running", "http_addr", c.HttpListenAddr, "https_addr", c.HttpsListenAddr, "metrics_addr", c.MetricsListenAddr)
 	} else if !c.Tls.Disable {
-		logger.Info("TLS is enabled", "cert", c.Tls.CertFile)
-		logger.Info("Server is running", "http_addr", c.HttpListenAddr, "https_addr", c.HttpsListenAddr, "metrics_addr", c.MetricsListenAddr)
+		logger.Sugar().Infow("TLS is enabled", "cert", c.Tls.CertFile)
+		logger.Sugar().Infow("Server is running", "http_addr", c.HttpListenAddr, "https_addr", c.HttpsListenAddr, "metrics_addr", c.MetricsListenAddr)
 	} else {
-		logger.Warn("TLS is disabled")
-		logger.Info("Server is running", "http_addr", c.HttpListenAddr, "metrics_addr", c.MetricsListenAddr)
+		logger.Sugar().Warnw("TLS is disabled")
+		logger.Sugar().Infow("Server is running", "http_addr", c.HttpListenAddr, "metrics_addr", c.MetricsListenAddr)
 	}

 	return g.Wait()
@@ -273,32 +271,34 @@ func selectListener(a net.Listener, b net.Listener) net.Listener {
 	return b
 }

-func setupLogging(config config.Logging) (hclog.Logger, error) {
-	file, err := createLogFile(config)
+func setupLogging(config config.Logging) (*zap.Logger, error) {
+	level, err := zap.ParseAtomicLevel(config.Level)
 	if err != nil {
 		return nil, err
 	}
-	appLogger := hclog.New(&hclog.LoggerOptions{
-		Name:       "ionscale",
-		Level:      hclog.LevelFromString(config.Level),
-		JSONFormat: strings.ToLower(config.Format) == "json",
-		Output:     file,
-	})

-	log.SetOutput(appLogger.StandardWriter(&hclog.StandardLoggerOptions{InferLevels: true}))
-	log.SetPrefix("")
-	log.SetFlags(0)
+	pc := zap.NewProductionConfig()
+	pc.Level = level
+	pc.DisableStacktrace = true
+	pc.OutputPaths = []string{"stdout"}
+	pc.Encoding = "console"
+	pc.EncoderConfig.EncodeLevel = zapcore.CapitalLevelEncoder
+	pc.EncoderConfig.EncodeTime = zapcore.ISO8601TimeEncoder

-	return appLogger, nil
-}
-
-func createLogFile(config config.Logging) (*os.File, error) {
 	if config.File != "" {
-		f, err := os.OpenFile(config.File, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0666)
-		if err != nil {
-			return nil, err
-		}
-		return f, nil
+		pc.OutputPaths = []string{config.File}
 	}
-	return os.Stdout, nil
+
+	if config.Format == "json" {
+		pc.Encoding = "json"
+	}
+
+	logger, err := pc.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	zap.ReplaceGlobals(logger)
+
+	return logger, nil
 }
@@ -2,10 +2,8 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/mapping"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
@@ -14,12 +12,12 @@ import (
 func (s *Service) GetACLPolicy(ctx context.Context, req *connect.Request[api.GetACLPolicyRequest]) (*connect.Response[api.GetACLPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -27,7 +25,7 @@ func (s *Service) GetACLPolicy(ctx context.Context, req *connect.Request[api.Get

 	var policy api.ACLPolicy
 	if err := mapping.CopyViaJson(&tailnet.ACLPolicy, &policy); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	return connect.NewResponse(&api.GetACLPolicyResponse{Policy: &policy}), nil
@@ -36,12 +34,12 @@ func (s *Service) GetACLPolicy(ctx context.Context, req *connect.Request[api.Get
 func (s *Service) SetACLPolicy(ctx context.Context, req *connect.Request[api.SetACLPolicyRequest]) (*connect.Response[api.SetACLPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -49,15 +47,15 @@ func (s *Service) SetACLPolicy(ctx context.Context, req *connect.Request[api.Set

 	var policy domain.ACLPolicy
 	if err := mapping.CopyViaJson(req.Msg.Policy, &policy); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	tailnet.ACLPolicy = policy
 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(tailnet.ID, &broker.Signal{ACLUpdated: true})
+	s.sessionManager.NotifyAll(tailnet.ID)

 	return connect.NewResponse(&api.SetACLPolicyResponse{}), nil
 }
@@ -2,7 +2,7 @@ package service

 import (
 	"context"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/util"
@@ -10,9 +10,9 @@ import (
 	"time"
 )

-func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.AuthenticationRequest], stream *connect.ServerStream[api.AuthenticationResponse]) error {
+func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.AuthenticateRequest], stream *connect.ServerStream[api.AuthenticateResponse]) error {
 	if s.authProvider == nil {
-		return connect.NewError(connect.CodeFailedPrecondition, errors.New("no authentication method available, contact your ionscale administrator for more information"))
+		return connect.NewError(connect.CodeFailedPrecondition, fmt.Errorf("no authentication method available, contact your ionscale administrator for more information"))
 	}

 	key := util.RandStringBytes(8)
@@ -24,11 +24,11 @@ func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.Aut
 	}

 	if err := s.repository.SaveAuthenticationRequest(ctx, session); err != nil {
-		return err
+		return logError(err)
 	}

-	if err := stream.Send(&api.AuthenticationResponse{AuthUrl: authUrl}); err != nil {
-		return err
+	if err := stream.Send(&api.AuthenticateResponse{AuthUrl: authUrl}); err != nil {
+		return logError(err)
 	}

 	notify := ctx.Done()
@@ -43,24 +43,27 @@ func (s *Service) Authenticate(ctx context.Context, req *connect.Request[api.Aut
 		select {
 		case <-tick.C:
 			m, err := s.repository.GetAuthenticationRequest(ctx, key)
+			if err != nil {
+				return logError(err)
+			}

-			if err != nil || m == nil {
-				return connect.NewError(connect.CodeInternal, errors.New("something went wrong"))
+			if m == nil {
+				return connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("invalid authentication request"))
 			}

 			if len(m.Token) != 0 {
-				if err := stream.Send(&api.AuthenticationResponse{Token: m.Token, TailnetId: m.TailnetID}); err != nil {
-					return err
+				if err := stream.Send(&api.AuthenticateResponse{Token: m.Token, TailnetId: m.TailnetID}); err != nil {
+					return logError(err)
 				}
 				return nil
 			}

 			if len(m.Error) != 0 {
-				return connect.NewError(connect.CodePermissionDenied, errors.New(m.Error))
+				return connect.NewError(connect.CodePermissionDenied, fmt.Errorf(m.Error))
 			}

-			if err := stream.Send(&api.AuthenticationResponse{AuthUrl: authUrl}); err != nil {
-				return err
+			if err := stream.Send(&api.AuthenticateResponse{AuthUrl: authUrl}); err != nil {
+				return logError(err)
 			}

 		case <-notify:
@@ -2,7 +2,7 @@ package service

 import (
 	"context"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/domain"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
@@ -15,15 +15,15 @@ func (s *Service) GetAuthKey(ctx context.Context, req *connect.Request[api.GetAu

 	key, err := s.repository.GetAuthKey(ctx, req.Msg.AuthKeyId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if key == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("auth key not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("auth key not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(key.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	var expiresAt *timestamppb.Timestamp
@@ -74,16 +74,16 @@ func mapAuthKeysToApi(authKeys []domain.AuthKey) []*api.AuthKey {
 func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.ListAuthKeysRequest]) (*connect.Response[api.ListAuthKeysResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	response := api.ListAuthKeysResponse{}
@@ -91,7 +91,7 @@ func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.Lis
 	if principal.IsSystemAdmin() {
 		authKeys, err := s.repository.ListAuthKeys(ctx, req.Msg.TailnetId)
 		if err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

 		response.AuthKeys = mapAuthKeysToApi(authKeys)
@@ -101,7 +101,7 @@ func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.Lis
 	if principal.User != nil {
 		authKeys, err := s.repository.ListAuthKeysByTailnetAndUser(ctx, req.Msg.TailnetId, principal.User.ID)
 		if err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

 		response.AuthKeys = mapAuthKeysToApi(authKeys)
@@ -114,11 +114,11 @@ func (s *Service) ListAuthKeys(ctx context.Context, req *connect.Request[api.Lis
 func (s *Service) CreateAuthKey(ctx context.Context, req *connect.Request[api.CreateAuthKeyRequest]) (*connect.Response[api.CreateAuthKeyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if principal.User == nil && len(req.Msg.Tags) == 0 {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("at least one tag is required when creating an auth key"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("at least one tag is required when creating an auth key"))
 	}

 	if err := domain.CheckTags(req.Msg.Tags); err != nil {
@@ -127,11 +127,11 @@ func (s *Service) CreateAuthKey(ctx context.Context, req *connect.Request[api.Cr

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if !principal.IsSystemAdmin() {
@@ -154,17 +154,17 @@ func (s *Service) CreateAuthKey(ctx context.Context, req *connect.Request[api.Cr
 	if user == nil {
 		u, _, err := s.repository.GetOrCreateServiceUser(ctx, tailnet)
 		if err != nil {
-			return nil, err
+			return nil, logError(err)
 		}
 		user = u
 	}

 	tags := domain.SanitizeTags(req.Msg.Tags)

-	v, authKey := domain.CreateAuthKey(tailnet, user, req.Msg.Ephemeral, tags, expiresAt)
+	v, authKey := domain.CreateAuthKey(tailnet, user, req.Msg.Ephemeral, req.Msg.PreAuthorized, tags, expiresAt)

 	if err := s.repository.SaveAuthKey(ctx, authKey); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	response := api.CreateAuthKeyResponse{
@@ -190,19 +190,19 @@ func (s *Service) DeleteAuthKey(ctx context.Context, req *connect.Request[api.De

 	key, err := s.repository.GetAuthKey(ctx, req.Msg.AuthKeyId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if key == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("auth key not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("auth key not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(key.UserID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if _, err := s.repository.DeleteAuthKey(ctx, req.Msg.AuthKeyId); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	return connect.NewResponse(&api.DeleteAuthKeyResponse{}), nil
 }
@@ -3,9 +3,8 @@ package service
 import (
 	"context"
 	"encoding/json"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/util"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
@@ -15,17 +14,17 @@ import (
 func (s *Service) GetDefaultDERPMap(ctx context.Context, _ *connect.Request[api.GetDefaultDERPMapRequest]) (*connect.Response[api.GetDefaultDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	dm, err := s.repository.GetDERPMap(ctx)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	raw, err := json.Marshal(dm.DERPMap)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	return connect.NewResponse(&api.GetDefaultDERPMapResponse{Value: raw}), nil
@@ -34,12 +33,12 @@ func (s *Service) GetDefaultDERPMap(ctx context.Context, _ *connect.Request[api.
 func (s *Service) SetDefaultDERPMap(ctx context.Context, req *connect.Request[api.SetDefaultDERPMapRequest]) (*connect.Response[api.SetDefaultDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	var derpMap tailcfg.DERPMap
 	if err := json.Unmarshal(req.Msg.Value, &derpMap); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	dp := domain.DERPMap{
@@ -48,16 +47,16 @@ func (s *Service) SetDefaultDERPMap(ctx context.Context, req *connect.Request[ap
 	}

 	if err := s.repository.SetDERPMap(ctx, &dp); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	tailnets, err := s.repository.ListTailnets(ctx)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	for _, t := range tailnets {
-		s.pubsub.Publish(t.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(t.ID)
 	}

 	return connect.NewResponse(&api.SetDefaultDERPMapResponse{Value: req.Msg.Value}), nil
@@ -66,22 +65,22 @@ func (s *Service) SetDefaultDERPMap(ctx context.Context, req *connect.Request[ap
 func (s *Service) ResetDefaultDERPMap(ctx context.Context, req *connect.Request[api.ResetDefaultDERPMapRequest]) (*connect.Response[api.ResetDefaultDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	dp := domain.DERPMap{}

 	if err := s.repository.SetDERPMap(ctx, &dp); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	tailnets, err := s.repository.ListTailnets(ctx)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	for _, t := range tailnets {
-		s.pubsub.Publish(t.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(t.ID)
 	}

 	return connect.NewResponse(&api.ResetDefaultDERPMapResponse{}), nil
@@ -2,41 +2,29 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/domain"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
-	"tailscale.com/util/dnsname"
 )

 func (s *Service) GetDNSConfig(ctx context.Context, req *connect.Request[api.GetDNSConfigRequest]) (*connect.Response[api.GetDNSConfigResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

-	dnsConfig := tailnet.DNSConfig
-	tailnetDomain := domain.SanitizeTailnetName(tailnet.Name)
-
 	resp := &api.GetDNSConfigResponse{
-		Config: &api.DNSConfig{
-			MagicDns:         dnsConfig.MagicDNS,
-			MagicDnsSuffix:   fmt.Sprintf("%s.%s", tailnetDomain, config.MagicDNSSuffix()),
-			OverrideLocalDns: dnsConfig.OverrideLocalDNS,
-			Nameservers:      dnsConfig.Nameservers,
-			Routes:           domainRoutesToApiRoutes(dnsConfig.Routes),
-		},
+		Config: domainDNSConfigToApiDNSConfig(tailnet),
 	}

 	return connect.NewResponse(resp), nil
@@ -45,113 +33,42 @@ func (s *Service) GetDNSConfig(ctx context.Context, req *connect.Request[api.Get
 func (s *Service) SetDNSConfig(ctx context.Context, req *connect.Request[api.SetDNSConfigRequest]) (*connect.Response[api.SetDNSConfigResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	dnsConfig := req.Msg.Config

+	if dnsConfig.HttpsCerts && !dnsConfig.MagicDns {
+		return nil, connect.NewError(connect.CodeFailedPrecondition, fmt.Errorf("MagicDNS must be enabled when enabling HTTPS Certs"))
+	}
+
 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	tailnet.DNSConfig = domain.DNSConfig{
-		MagicDNS:         dnsConfig.MagicDns,
-		OverrideLocalDNS: dnsConfig.OverrideLocalDns,
-		Nameservers:      dnsConfig.Nameservers,
-		Routes:           apiRoutesToDomainRoutes(dnsConfig.Routes),
+		MagicDNS:          dnsConfig.MagicDns,
+		HttpsCertsEnabled: dnsConfig.HttpsCerts,
+		OverrideLocalDNS:  dnsConfig.OverrideLocalDns,
+		Nameservers:       dnsConfig.Nameservers,
+		Routes:            apiRoutesToDomainRoutes(dnsConfig.Routes),
 	}

 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(tailnet.ID, &broker.Signal{DNSUpdated: true})
+	s.sessionManager.NotifyAll(tailnet.ID)

 	resp := &api.SetDNSConfigResponse{Config: dnsConfig}

 	return connect.NewResponse(resp), nil
 }

-func (s *Service) EnableHttpsCertificates(ctx context.Context, req *connect.Request[api.EnableHttpsCertificatesRequest]) (*connect.Response[api.EnableHttpsCertificatesResponse], error) {
-	principal := CurrentPrincipal(ctx)
-	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
-	}
-
-	alias := dnsname.SanitizeLabel(req.Msg.Alias)
-
-	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
-	if err != nil {
-		return nil, err
-	}
-	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
-	}
-
-	if !tailnet.DNSConfig.MagicDNS {
-		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.New("MagicDNS must be enabled for this tailnet"))
-	}
-
-	if tailnet.Alias == nil && len(alias) == 0 {
-		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.New("when enabling HTTPS certificates for the first time, a Tailnet alias is required"))
-	}
-
-	if tailnet.Alias != nil && len(alias) != 0 && *tailnet.Alias != alias {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("a Tailnet alias was already configured previously"))
-	}
-
-	tailnet.DNSConfig.HttpsCertsEnabled = true
-	if tailnet.Alias == nil && len(alias) != 0 {
-		t, err := s.repository.GetTailnetByAlias(ctx, alias)
-		if err != nil {
-			return nil, err
-		}
-
-		if t != nil && t.ID != tailnet.ID {
-			return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("given alias is already in use"))
-		}
-
-		tailnet.Alias = &alias
-	}
-
-	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
-	}
-
-	s.pubsub.Publish(tailnet.ID, &broker.Signal{DNSUpdated: true})
-
-	return connect.NewResponse(&api.EnableHttpsCertificatesResponse{}), nil
-}
-
-func (s *Service) DisableHttpsCertificates(ctx context.Context, req *connect.Request[api.DisableHttpsCertificatesRequest]) (*connect.Response[api.DisableHttpsCertificatesResponse], error) {
-	principal := CurrentPrincipal(ctx)
-	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
-	}
-
-	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
-	if err != nil {
-		return nil, err
-	}
-	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
-	}
-
-	tailnet.DNSConfig.HttpsCertsEnabled = false
-
-	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
-	}
-
-	s.pubsub.Publish(tailnet.ID, &broker.Signal{DNSUpdated: true})
-
-	return connect.NewResponse(&api.DisableHttpsCertificatesResponse{}), nil
-}
-
 func domainRoutesToApiRoutes(routes map[string][]string) map[string]*api.Routes {
 	var result = map[string]*api.Routes{}
 	for k, v := range routes {
@@ -167,3 +84,30 @@ func apiRoutesToDomainRoutes(routes map[string]*api.Routes) map[string][]string
 	}
 	return result
 }
+
+func apiDNSConfigToDomainDNSConfig(dnsConfig *api.DNSConfig) domain.DNSConfig {
+	if dnsConfig == nil {
+		return domain.DNSConfig{}
+	}
+
+	return domain.DNSConfig{
+		MagicDNS:          dnsConfig.MagicDns,
+		HttpsCertsEnabled: dnsConfig.HttpsCerts,
+		OverrideLocalDNS:  dnsConfig.OverrideLocalDns,
+		Nameservers:       dnsConfig.Nameservers,
+		Routes:            apiRoutesToDomainRoutes(dnsConfig.Routes),
+	}
+}
+
+func domainDNSConfigToApiDNSConfig(tailnet *domain.Tailnet) *api.DNSConfig {
+	tailnetDomain := domain.SanitizeTailnetName(tailnet.Name)
+	dnsConfig := tailnet.DNSConfig
+	return &api.DNSConfig{
+		MagicDns:         dnsConfig.MagicDNS,
+		HttpsCerts:       dnsConfig.HttpsCertsEnabled,
+		MagicDnsSuffix:   fmt.Sprintf("%s.%s", tailnetDomain, config.MagicDNSSuffix()),
+		OverrideLocalDns: dnsConfig.OverrideLocalDNS,
+		Nameservers:      dnsConfig.Nameservers,
+		Routes:           domainRoutesToApiRoutes(dnsConfig.Routes),
+	}
+}
@@ -2,7 +2,6 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/domain"
@@ -12,12 +11,12 @@ import (
 func (s *Service) GetIAMPolicy(ctx context.Context, req *connect.Request[api.GetIAMPolicyRequest]) (*connect.Response[api.GetIAMPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -36,12 +35,12 @@ func (s *Service) GetIAMPolicy(ctx context.Context, req *connect.Request[api.Get
 func (s *Service) SetIAMPolicy(ctx context.Context, req *connect.Request[api.SetIAMPolicyRequest]) (*connect.Response[api.SetIAMPolicyResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet does not exist"))
@@ -55,7 +54,7 @@ func (s *Service) SetIAMPolicy(ctx context.Context, req *connect.Request[api.Set
 	}

 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	return connect.NewResponse(&api.SetIAMPolicyResponse{}), nil
@@ -7,6 +7,7 @@ import (
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/key"
 	"github.com/jsiebens/ionscale/internal/token"
+	"go.uber.org/zap"
 	"strings"
 )

@@ -75,3 +76,48 @@ func exchangeToken(ctx context.Context, systemAdminKey *key.ServerPrivate, repos

 	return nil
 }
+
+func NewErrorInterceptor() *ErrorInterceptor {
+	return &ErrorInterceptor{}
+}
+
+type ErrorInterceptor struct {
+}
+
+func (e *ErrorInterceptor) handleError(err error) error {
+	if err == nil {
+		return err
+	}
+
+	switch err.(type) {
+	case *connect.Error:
+		return err
+	default:
+		return connect.NewError(connect.CodeInternal, fmt.Errorf("internal server error"))
+	}
+}
+
+func (e *ErrorInterceptor) WrapUnary(next connect.UnaryFunc) connect.UnaryFunc {
+	return func(ctx context.Context, request connect.AnyRequest) (connect.AnyResponse, error) {
+		response, err := next(ctx, request)
+		return response, e.handleError(err)
+	}
+}
+
+func (e *ErrorInterceptor) WrapStreamingClient(next connect.StreamingClientFunc) connect.StreamingClientFunc {
+	return func(ctx context.Context, spec connect.Spec) connect.StreamingClientConn {
+		return next(ctx, spec)
+	}
+}
+
+func (e *ErrorInterceptor) WrapStreamingHandler(next connect.StreamingHandlerFunc) connect.StreamingHandlerFunc {
+	return func(ctx context.Context, conn connect.StreamingHandlerConn) error {
+		err := next(ctx, conn)
+		return e.handleError(err)
+	}
+}
+
+func logError(err error) error {
+	zap.L().WithOptions(zap.AddCallerSkip(1)).Error("error processing request", zap.Error(err))
+	return err
+}
@@ -2,11 +2,8 @@ package service

 import (
 	"context"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
-	"github.com/jsiebens/ionscale/internal/config"
 	"github.com/jsiebens/ionscale/internal/domain"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -22,10 +19,9 @@ func (s *Service) machineToApi(m *domain.Machine) *api.Machine {
 		name = fmt.Sprintf("%s-%d", m.Name, m.NameIdx)
 	}

-	online := false
+	online := s.sessionManager.HasSession(m.TailnetID, m.ID)
 	if m.LastSeen != nil {
 		lastSeen = timestamppb.New(*m.LastSeen)
-		online = m.LastSeen.After(time.Now().Add(-config.KeepAliveInterval()))
 	}

 	return &api.Machine{
@@ -57,26 +53,27 @@ func (s *Service) machineToApi(m *domain.Machine) *api.Machine {
 		EnabledRoutes:      m.AllowedPrefixes(),
 		AdvertisedExitNode: m.IsAdvertisedExitNode(),
 		EnabledExitNode:    m.IsAllowedExitNode(),
+		Authorized:         m.Authorized,
 	}
 }

 func (s *Service) ListMachines(ctx context.Context, req *connect.Request[api.ListMachinesRequest]) (*connect.Response[api.ListMachinesResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	machines, err := s.repository.ListMachineByTailnet(ctx, tailnet.ID)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	response := &api.ListMachinesResponse{}
@@ -92,15 +89,15 @@ func (s *Service) GetMachine(ctx context.Context, req *connect.Request[api.GetMa

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	return connect.NewResponse(&api.GetMachineResponse{Machine: s.machineToApi(m)}), nil
@@ -111,22 +108,22 @@ func (s *Service) DeleteMachine(ctx context.Context, req *connect.Request[api.De

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if _, err := s.repository.DeleteMachine(ctx, req.Msg.MachineId); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeersRemoved: []uint64{m.ID}})
+	s.sessionManager.NotifyAll(m.TailnetID)

 	return connect.NewResponse(&api.DeleteMachineResponse{}), nil
 }
@@ -136,15 +133,15 @@ func (s *Service) ExpireMachine(ctx context.Context, req *connect.Request[api.Ex

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	timestamp := time.Unix(123, 0)
@@ -152,23 +149,40 @@ func (s *Service) ExpireMachine(ctx context.Context, req *connect.Request[api.Ex
 	m.KeyExpiryDisabled = false

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

 	return connect.NewResponse(&api.ExpireMachineResponse{}), nil
 }

-func (s *Service) createMachineRoutesResponse(m *domain.Machine) (*connect.Response[api.GetMachineRoutesResponse], error) {
-	response := api.GetMachineRoutesResponse{
-		AdvertisedRoutes:   m.AdvertisedPrefixes(),
-		EnabledRoutes:      m.AllowedPrefixes(),
-		AdvertisedExitNode: m.IsAdvertisedExitNode(),
-		EnabledExitNode:    m.IsAllowedExitNode(),
+func (s *Service) AuthorizeMachine(ctx context.Context, req *connect.Request[api.AuthorizeMachineRequest]) (*connect.Response[api.AuthorizeMachineResponse], error) {
+	principal := CurrentPrincipal(ctx)
+
+	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
+	if err != nil {
+		return nil, logError(err)
 	}

-	return connect.NewResponse(&response), nil
+	if m == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
+	}
+
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	if !m.Authorized {
+		m.Authorized = true
+		if err := s.repository.SaveMachine(ctx, m); err != nil {
+			return nil, logError(err)
+		}
+	}
+
+	s.sessionManager.NotifyAll(m.TailnetID)
+
+	return connect.NewResponse(&api.AuthorizeMachineResponse{}), nil
 }

 func (s *Service) GetMachineRoutes(ctx context.Context, req *connect.Request[api.GetMachineRoutesRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
@@ -176,34 +190,44 @@ func (s *Service) GetMachineRoutes(ctx context.Context, req *connect.Request[api

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

-	return s.createMachineRoutesResponse(m)
+	response := api.GetMachineRoutesResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[api.EnableMachineRoutesRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[api.EnableMachineRoutesRequest]) (*connect.Response[api.EnableMachineRoutesResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	var allowIPs = domain.NewAllowIPsSet(m.AllowIPs)
@@ -217,7 +241,7 @@ func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[
 	for _, r := range req.Msg.Routes {
 		prefix, err := netip.ParsePrefix(r)
 		if err != nil {
-			return nil, err
+			return nil, logError(err)
 		}
 		allowIPs.Add(prefix)
 	}
@@ -225,28 +249,38 @@ func (s *Service) EnableMachineRoutes(ctx context.Context, req *connect.Request[
 	m.AllowIPs = allowIPs.Items()
 	m.AutoAllowIPs = autoAllowIPs.Items()
 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.EnableMachineRoutesResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request[api.DisableMachineRoutesRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request[api.DisableMachineRoutesRequest]) (*connect.Response[api.DisableMachineRoutesResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	allowIPs := domain.NewAllowIPsSet(m.AllowIPs)
@@ -255,7 +289,7 @@ func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request
 	for _, r := range req.Msg.Routes {
 		prefix, err := netip.ParsePrefix(r)
 		if err != nil {
-			return nil, err
+			return nil, logError(err)
 		}
 		allowIPs.Remove(prefix)
 		autoAllowIPs.Remove(prefix)
@@ -264,32 +298,42 @@ func (s *Service) DisableMachineRoutes(ctx context.Context, req *connect.Request
 	m.AllowIPs = allowIPs.Items()
 	m.AutoAllowIPs = autoAllowIPs.Items()
 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.DisableMachineRoutesResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) EnableExitNode(ctx context.Context, req *connect.Request[api.EnableExitNodeRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) EnableExitNode(ctx context.Context, req *connect.Request[api.EnableExitNodeRequest]) (*connect.Response[api.EnableExitNodeResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if !m.IsAdvertisedExitNode() {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("machine is not a valid exit node"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("machine is not a valid exit node"))
 	}

 	prefix4 := netip.MustParsePrefix("0.0.0.0/0")
@@ -301,32 +345,42 @@ func (s *Service) EnableExitNode(ctx context.Context, req *connect.Request[api.E
 	m.AllowIPs = allowIPs.Items()

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.EnableExitNodeResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

-func (s *Service) DisableExitNode(ctx context.Context, req *connect.Request[api.DisableExitNodeRequest]) (*connect.Response[api.GetMachineRoutesResponse], error) {
+func (s *Service) DisableExitNode(ctx context.Context, req *connect.Request[api.DisableExitNodeRequest]) (*connect.Response[api.DisableExitNodeResponse], error) {
 	principal := CurrentPrincipal(ctx)

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	if !m.IsAdvertisedExitNode() {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("machine is not a valid exit node"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("machine is not a valid exit node"))
 	}

 	prefix4 := netip.MustParsePrefix("0.0.0.0/0")
@@ -342,12 +396,22 @@ func (s *Service) DisableExitNode(ctx context.Context, req *connect.Request[api.
 	m.AutoAllowIPs = autoAllowIPs.Items()

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

-	return s.createMachineRoutesResponse(m)
+	response := api.DisableExitNodeResponse{
+		MachineId: m.ID,
+		Routes: &api.MachineRoutes{
+			AdvertisedRoutes:   m.AdvertisedPrefixes(),
+			EnabledRoutes:      m.AllowedPrefixes(),
+			AdvertisedExitNode: m.IsAdvertisedExitNode(),
+			EnabledExitNode:    m.IsAllowedExitNode(),
+		},
+	}
+
+	return connect.NewResponse(&response), nil
 }

 func (s *Service) SetMachineKeyExpiry(ctx context.Context, req *connect.Request[api.SetMachineKeyExpiryRequest]) (*connect.Response[api.SetMachineKeyExpiryResponse], error) {
@@ -355,24 +419,24 @@ func (s *Service) SetMachineKeyExpiry(ctx context.Context, req *connect.Request[

 	m, err := s.repository.GetMachine(ctx, req.Msg.MachineId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if m == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("machine not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("machine not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(m.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	m.KeyExpiryDisabled = req.Msg.Disabled

 	if err := s.repository.SaveMachine(ctx, m); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(m.TailnetID, &broker.Signal{PeerUpdated: &m.ID})
+	s.sessionManager.NotifyAll(m.TailnetID)

 	return connect.NewResponse(&api.SetMachineKeyExpiryResponse{}), nil
 }
@@ -4,27 +4,27 @@ import (
 	"context"
 	"github.com/bufbuild/connect-go"
 	"github.com/jsiebens/ionscale/internal/auth"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/config"
+	"github.com/jsiebens/ionscale/internal/core"
 	"github.com/jsiebens/ionscale/internal/domain"
 	"github.com/jsiebens/ionscale/internal/version"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 )

-func NewService(config *config.Config, authProvider auth.Provider, repository domain.Repository, pubsub broker.Pubsub) *Service {
+func NewService(config *config.Config, authProvider auth.Provider, repository domain.Repository, sessionManager core.PollMapSessionManager) *Service {
 	return &Service{
-		config:       config,
-		authProvider: authProvider,
-		repository:   repository,
-		pubsub:       pubsub,
+		config:         config,
+		authProvider:   authProvider,
+		repository:     repository,
+		sessionManager: sessionManager,
 	}
 }

 type Service struct {
-	config       *config.Config
-	authProvider auth.Provider
-	repository   domain.Repository
-	pubsub       broker.Pubsub
+	config         *config.Config
+	authProvider   auth.Provider
+	repository     domain.Repository
+	sessionManager core.PollMapSessionManager
 }

 func (s *Service) GetVersion(_ context.Context, _ *connect.Request[api.GetVersionRequest]) (*connect.Response[api.GetVersionResponse], error) {
@@ -3,45 +3,137 @@ package service
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/mapping"
 	"github.com/jsiebens/ionscale/internal/util"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 	"tailscale.com/tailcfg"
 )

-func (s *Service) CreateTailnet(ctx context.Context, req *connect.Request[api.CreateTailnetRequest]) (*connect.Response[api.CreateTailnetResponse], error) {
-	principal := CurrentPrincipal(ctx)
-	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+func domainTailnetToApiTailnet(tailnet *domain.Tailnet) (*api.Tailnet, error) {
+	t := &api.Tailnet{
+		Id:                          tailnet.ID,
+		Name:                        tailnet.Name,
+		IamPolicy:                   new(api.IAMPolicy),
+		AclPolicy:                   new(api.ACLPolicy),
+		DnsConfig:                   domainDNSConfigToApiDNSConfig(tailnet),
+		ServiceCollectionEnabled:    tailnet.ServiceCollectionEnabled,
+		FileSharingEnabled:          tailnet.FileSharingEnabled,
+		SshEnabled:                  tailnet.SSHEnabled,
+		MachineAuthorizationEnabled: tailnet.MachineAuthorizationEnabled,
 	}

-	name := req.Msg.Name
-	iamPolicy := domain.IAMPolicy{}
-
-	if req.Msg.IamPolicy != nil {
-		iamPolicy.Subs = req.Msg.IamPolicy.Subs
-		iamPolicy.Emails = req.Msg.IamPolicy.Emails
-		iamPolicy.Filters = req.Msg.IamPolicy.Filters
-		iamPolicy.Roles = apiRolesMapToDomainRolesMap(req.Msg.IamPolicy.Roles)
-	}
-
-	tailnet, created, err := s.repository.GetOrCreateTailnet(ctx, name, iamPolicy)
-	if err != nil {
+	if err := mapping.CopyViaJson(tailnet.IAMPolicy, t.IamPolicy); err != nil {
 		return nil, err
 	}

-	if !created {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("tailnet already exists"))
+	if err := mapping.CopyViaJson(tailnet.ACLPolicy, t.AclPolicy); err != nil {
+		return nil, err
 	}

-	resp := &api.CreateTailnetResponse{Tailnet: &api.Tailnet{
-		Id:   tailnet.ID,
-		Name: tailnet.Name,
-	}}
+	return t, nil
+}
+
+func (s *Service) CreateTailnet(ctx context.Context, req *connect.Request[api.CreateTailnetRequest]) (*connect.Response[api.CreateTailnetResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet := &domain.Tailnet{
+		ID:                          util.NextID(),
+		Name:                        req.Msg.Name,
+		IAMPolicy:                   domain.IAMPolicy{},
+		ACLPolicy:                   domain.ACLPolicy{},
+		DNSConfig:                   apiDNSConfigToDomainDNSConfig(req.Msg.DnsConfig),
+		ServiceCollectionEnabled:    req.Msg.ServiceCollectionEnabled,
+		FileSharingEnabled:          req.Msg.FileSharingEnabled,
+		SSHEnabled:                  req.Msg.SshEnabled,
+		MachineAuthorizationEnabled: req.Msg.MachineAuthorizationEnabled,
+	}
+
+	if req.Msg.IamPolicy != nil {
+		if err := mapping.CopyViaJson(req.Msg.IamPolicy, &tailnet.IAMPolicy); err != nil {
+			return nil, logError(err)
+		}
+	} else {
+		tailnet.IAMPolicy = domain.DefaultIAMPolicy()
+	}
+
+	if req.Msg.AclPolicy != nil {
+		if err := mapping.CopyViaJson(req.Msg.AclPolicy, &tailnet.ACLPolicy); err != nil {
+			return nil, logError(err)
+		}
+	} else {
+		tailnet.ACLPolicy = domain.DefaultACLPolicy()
+	}
+
+	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+		return nil, logError(err)
+	}
+
+	t, err := domainTailnetToApiTailnet(tailnet)
+	if err != nil {
+		return nil, logError(err)
+	}
+
+	resp := &api.CreateTailnetResponse{Tailnet: t}
+
+	return connect.NewResponse(resp), nil
+}
+
+func (s *Service) UpdateTailnet(ctx context.Context, req *connect.Request[api.UpdateTailnetRequest]) (*connect.Response[api.UpdateTailnetResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, logError(err)
+	}
+
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if req.Msg.IamPolicy != nil {
+		tailnet.IAMPolicy = domain.IAMPolicy{}
+		if err := mapping.CopyViaJson(req.Msg.IamPolicy, &tailnet.IAMPolicy); err != nil {
+			return nil, logError(err)
+		}
+	}
+
+	if req.Msg.AclPolicy != nil {
+		tailnet.ACLPolicy = domain.ACLPolicy{}
+		if err := mapping.CopyViaJson(req.Msg.AclPolicy, &tailnet.ACLPolicy); err != nil {
+			return nil, logError(err)
+		}
+	}
+
+	if req.Msg.DnsConfig != nil {
+		tailnet.DNSConfig = apiDNSConfigToDomainDNSConfig(req.Msg.DnsConfig)
+	}
+
+	tailnet.ServiceCollectionEnabled = req.Msg.ServiceCollectionEnabled
+	tailnet.FileSharingEnabled = req.Msg.FileSharingEnabled
+	tailnet.SSHEnabled = req.Msg.SshEnabled
+	tailnet.MachineAuthorizationEnabled = req.Msg.MachineAuthorizationEnabled
+
+	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+		return nil, logError(err)
+	}
+
+	s.sessionManager.NotifyAll(tailnet.ID)
+
+	t, err := domainTailnetToApiTailnet(tailnet)
+	if err != nil {
+		return nil, logError(err)
+	}
+
+	resp := &api.UpdateTailnetResponse{Tailnet: t}

 	return connect.NewResponse(resp), nil
 }
@@ -49,33 +141,35 @@ func (s *Service) CreateTailnet(ctx context.Context, req *connect.Request[api.Cr
 func (s *Service) GetTailnet(ctx context.Context, req *connect.Request[api.GetTailnetRequest]) (*connect.Response[api.GetTailnetResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.Id) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.Id)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

-	return connect.NewResponse(&api.GetTailnetResponse{Tailnet: &api.Tailnet{
-		Id:   tailnet.ID,
-		Name: tailnet.Name,
-	}}), nil
+	t, err := domainTailnetToApiTailnet(tailnet)
+	if err != nil {
+		return nil, logError(err)
+	}
+
+	return connect.NewResponse(&api.GetTailnetResponse{Tailnet: t}), nil
 }

-func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.ListTailnetRequest]) (*connect.Response[api.ListTailnetResponse], error) {
+func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.ListTailnetsRequest]) (*connect.Response[api.ListTailnetsResponse], error) {
 	principal := CurrentPrincipal(ctx)

-	resp := &api.ListTailnetResponse{}
+	resp := &api.ListTailnetsResponse{}

 	if principal.IsSystemAdmin() {
 		tailnets, err := s.repository.ListTailnets(ctx)
 		if err != nil {
-			return nil, err
+			return nil, logError(err)
 		}
 		for _, t := range tailnets {
 			gt := api.Tailnet{Id: t.ID, Name: t.Name}
@@ -86,7 +180,7 @@ func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.Lis
 	if principal.User != nil {
 		tailnet, err := s.repository.GetTailnet(ctx, principal.User.TailnetID)
 		if err != nil {
-			return nil, err
+			return nil, logError(err)
 		}
 		gt := api.Tailnet{Id: tailnet.ID, Name: tailnet.Name}
 		resp.Tailnet = append(resp.Tailnet, &gt)
@@ -98,12 +192,12 @@ func (s *Service) ListTailnets(ctx context.Context, req *connect.Request[api.Lis
 func (s *Service) DeleteTailnet(ctx context.Context, req *connect.Request[api.DeleteTailnetRequest]) (*connect.Response[api.DeleteTailnetResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	count, err := s.repository.CountMachineByTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if !req.Msg.Force && count > 0 {
@@ -135,10 +229,10 @@ func (s *Service) DeleteTailnet(ctx context.Context, req *connect.Request[api.De
 	})

 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(req.Msg.TailnetId, &broker.Signal{})
+	s.sessionManager.NotifyAll(req.Msg.TailnetId)

 	return connect.NewResponse(&api.DeleteTailnetResponse{}), nil
 }
@@ -146,20 +240,20 @@ func (s *Service) DeleteTailnet(ctx context.Context, req *connect.Request[api.De
 func (s *Service) SetDERPMap(ctx context.Context, req *connect.Request[api.SetDERPMapRequest]) (*connect.Response[api.SetDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	derpMap := tailcfg.DERPMap{}
 	if err := json.Unmarshal(req.Msg.Value, &derpMap); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	tailnet.DERPMap = domain.DERPMap{
@@ -168,14 +262,14 @@ func (s *Service) SetDERPMap(ctx context.Context, req *connect.Request[api.SetDE
 	}

 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+	s.sessionManager.NotifyAll(tailnet.ID)

 	raw, err := json.Marshal(derpMap)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	return connect.NewResponse(&api.SetDERPMapResponse{Value: raw}), nil
@@ -184,24 +278,24 @@ func (s *Service) SetDERPMap(ctx context.Context, req *connect.Request[api.SetDE
 func (s *Service) ResetDERPMap(ctx context.Context, req *connect.Request[api.ResetDERPMapRequest]) (*connect.Response[api.ResetDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	tailnet.DERPMap = domain.DERPMap{}

 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+	s.sessionManager.NotifyAll(tailnet.ID)

 	return connect.NewResponse(&api.ResetDERPMapResponse{}), nil
 }
@@ -209,51 +303,51 @@ func (s *Service) ResetDERPMap(ctx context.Context, req *connect.Request[api.Res
 func (s *Service) GetDERPMap(ctx context.Context, req *connect.Request[api.GetDERPMapRequest]) (*connect.Response[api.GetDERPMapResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	derpMap, err := tailnet.GetDERPMap(ctx, s.repository)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	raw, err := json.Marshal(derpMap.DERPMap)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	return connect.NewResponse(&api.GetDERPMapResponse{Value: raw}), nil
 }

-func (s *Service) EnabledFileSharing(ctx context.Context, req *connect.Request[api.EnableFileSharingRequest]) (*connect.Response[api.EnableFileSharingResponse], error) {
+func (s *Service) EnableFileSharing(ctx context.Context, req *connect.Request[api.EnableFileSharingRequest]) (*connect.Response[api.EnableFileSharingResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if !tailnet.FileSharingEnabled {
 		tailnet.FileSharingEnabled = true
 		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

-		s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(tailnet.ID)
 	}

 	return connect.NewResponse(&api.EnableFileSharingResponse{}), nil
@@ -262,50 +356,50 @@ func (s *Service) EnabledFileSharing(ctx context.Context, req *connect.Request[a
 func (s *Service) DisableFileSharing(ctx context.Context, req *connect.Request[api.DisableFileSharingRequest]) (*connect.Response[api.DisableFileSharingResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if tailnet.FileSharingEnabled {
 		tailnet.FileSharingEnabled = false
 		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

-		s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(tailnet.ID)
 	}

 	return connect.NewResponse(&api.DisableFileSharingResponse{}), nil
 }

-func (s *Service) EnabledServiceCollection(ctx context.Context, req *connect.Request[api.EnableServiceCollectionRequest]) (*connect.Response[api.EnableServiceCollectionResponse], error) {
+func (s *Service) EnableServiceCollection(ctx context.Context, req *connect.Request[api.EnableServiceCollectionRequest]) (*connect.Response[api.EnableServiceCollectionResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if !tailnet.ServiceCollectionEnabled {
 		tailnet.ServiceCollectionEnabled = true
 		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

-		s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(tailnet.ID)
 	}

 	return connect.NewResponse(&api.EnableServiceCollectionResponse{}), nil
@@ -314,50 +408,50 @@ func (s *Service) EnabledServiceCollection(ctx context.Context, req *connect.Req
 func (s *Service) DisableServiceCollection(ctx context.Context, req *connect.Request[api.DisableServiceCollectionRequest]) (*connect.Response[api.DisableServiceCollectionResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if tailnet.ServiceCollectionEnabled {
 		tailnet.ServiceCollectionEnabled = false
 		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

-		s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(tailnet.ID)
 	}

 	return connect.NewResponse(&api.DisableServiceCollectionResponse{}), nil
 }

-func (s *Service) EnabledSSH(ctx context.Context, req *connect.Request[api.EnableSSHRequest]) (*connect.Response[api.EnableSSHResponse], error) {
+func (s *Service) EnableSSH(ctx context.Context, req *connect.Request[api.EnableSSHRequest]) (*connect.Response[api.EnableSSHResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if !tailnet.SSHEnabled {
 		tailnet.SSHEnabled = true
 		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

-		s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(tailnet.ID)
 	}

 	return connect.NewResponse(&api.EnableSSHResponse{}), nil
@@ -366,25 +460,73 @@ func (s *Service) EnabledSSH(ctx context.Context, req *connect.Request[api.Enabl
 func (s *Service) DisableSSH(ctx context.Context, req *connect.Request[api.DisableSSHRequest]) (*connect.Response[api.DisableSSHResponse], error) {
 	principal := CurrentPrincipal(ctx)
 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}
 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if tailnet.SSHEnabled {
 		tailnet.SSHEnabled = false
 		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
-			return nil, err
+			return nil, logError(err)
 		}

-		s.pubsub.Publish(tailnet.ID, &broker.Signal{})
+		s.sessionManager.NotifyAll(tailnet.ID)
 	}

 	return connect.NewResponse(&api.DisableSSHResponse{}), nil
 }
+
+func (s *Service) EnableMachineAuthorization(ctx context.Context, req *connect.Request[api.EnableMachineAuthorizationRequest]) (*connect.Response[api.EnableMachineAuthorizationResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, logError(err)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if !tailnet.MachineAuthorizationEnabled {
+		tailnet.MachineAuthorizationEnabled = true
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, logError(err)
+		}
+	}
+
+	return connect.NewResponse(&api.EnableMachineAuthorizationResponse{}), nil
+}
+
+func (s *Service) DisableMachineAuthorization(ctx context.Context, req *connect.Request[api.DisableMachineAuthorizationRequest]) (*connect.Response[api.DisableMachineAuthorizationResponse], error) {
+	principal := CurrentPrincipal(ctx)
+	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(req.Msg.TailnetId) {
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
+	if err != nil {
+		return nil, logError(err)
+	}
+	if tailnet == nil {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
+	}
+
+	if tailnet.MachineAuthorizationEnabled {
+		tailnet.MachineAuthorizationEnabled = false
+		if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {
+			return nil, logError(err)
+		}
+	}
+
+	return connect.NewResponse(&api.DisableMachineAuthorizationResponse{}), nil
+}
@@ -2,9 +2,8 @@ package service

 import (
 	"context"
-	"errors"
+	"fmt"
 	"github.com/bufbuild/connect-go"
-	"github.com/jsiebens/ionscale/internal/broker"
 	"github.com/jsiebens/ionscale/internal/domain"
 	api "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
 )
@@ -14,20 +13,20 @@ func (s *Service) ListUsers(ctx context.Context, req *connect.Request[api.ListUs

 	tailnet, err := s.repository.GetTailnet(ctx, req.Msg.TailnetId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if tailnet == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("tailnet not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("tailnet not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(tailnet.ID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}

 	users, err := s.repository.ListUsers(ctx, tailnet.ID)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	resp := &api.ListUsersResponse{}
@@ -46,20 +45,24 @@ func (s *Service) DeleteUser(ctx context.Context, req *connect.Request[api.Delet
 	principal := CurrentPrincipal(ctx)

 	if !principal.IsSystemAdmin() && principal.UserMatches(req.Msg.UserId) {
-		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("unable delete yourself"))
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("unable to delete yourself"))
 	}

 	user, err := s.repository.GetUser(ctx, req.Msg.UserId)
 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

 	if user == nil {
-		return nil, connect.NewError(connect.CodeNotFound, errors.New("user not found"))
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("user not found"))
 	}

 	if !principal.IsSystemAdmin() && !principal.IsTailnetAdmin(user.TailnetID) {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("permission denied"))
+		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	if user.UserType == domain.UserTypeService {
+		return nil, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("unable delete service account"))
 	}

 	err = s.repository.Transaction(func(tx domain.Repository) error {
@@ -83,10 +86,10 @@ func (s *Service) DeleteUser(ctx context.Context, req *connect.Request[api.Delet
 	})

 	if err != nil {
-		return nil, err
+		return nil, logError(err)
 	}

-	s.pubsub.Publish(user.TailnetID, &broker.Signal{})
+	s.sessionManager.NotifyAll(user.TailnetID)

 	return connect.NewResponse(&api.DeleteUserResponse{}), nil
 }
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        @import url('https://fonts.googleapis.com/css2?family=Poppins:wght@200;300;400;500;600;700&display=swap');
+
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+            font-family: 'Poppins', sans-serif;
+        }
+
+        body {
+            width: 100%;
+            height: 100vh;
+            padding: 10px;
+            background: #379683;
+        }
+
+        .wrapper {
+            background: #fff;
+            max-width: 400px;
+            width: 100%;
+            margin: 120px auto;
+            padding: 25px;
+            border-radius: 5px;
+            box-shadow: 0 10px 15px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li {
+            position: relative;
+            list-style: none;
+            height: 45px;
+            line-height: 45px;
+            margin-bottom: 8px;
+            background: #f2f2f2;
+            border-radius: 3px;
+            overflow: hidden;
+            box-shadow: 0 2px 2px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li button {
+            margin: 0;
+            display: block;
+            width: 100%;
+            height: 100%;
+            border: none;
+        }
+    </style>
+    <title>ionscale</title>
+</head>
+<body>
+<div class="wrapper">
+    <div style="text-align: center">
+        <p><b>Authentication successful</b></p>
+        <small>but this is a <b style="color: blue">new machine</b> and needs to be authorized by your Tailnet admin.</small>
+    </div>
+</div>
+</body>
+</html>
@@ -29,13 +29,13 @@ tls:
  # Required when TLS is enabled and ACME disabled
  key_file: ""
  # Enable automatic TLS certificates provisioning with Let's Encrypt
-  acme_enabled: false
+  acme: false
  # An email address, used when creating an ACME account and keeping you up-to-date regarding your certificates
  acme_email: ""
  # The URL to the ACME CA's directory.
  acme_ca: "https://acme-v02.api.letsencrypt.org/directory"
  # Path to store certificates and metadata needed by ACME
-  amce_path: "./data"
+  acme_path: "./data"

 database:
  # Type of databas to use, supported values are sqlite or postgres
@@ -93,8 +93,6 @@ dns:
    name: ""
    # DNS zone
    zone: ""
-    # DNS subdomain
-    subdomain: ""
    # Provider specific configuration
    config: {}

@@ -68,5 +68,5 @@ docker run \
  -v $(pwd)/data:/data \
  -p 80:80 \
  -p 443:443 \
-  ghcr.io/jsiebens/ionscale:0.4.0 server --config /etc/ionscale/config.yaml
+  ghcr.io/jsiebens/ionscale:0.8.2 server --config /etc/ionscale/config.yaml
 ```
@@ -41,7 +41,7 @@ Run the following commands to install the __ionscale__ binary on your Linux host
 ``` bash
 sudo curl \
    -o "/usr/local/bin/ionscale" \
-    -sfL "https://github.com/jsiebens/ionscale/releases/download/v0.4.0/ionscale_linux_amd64"
+    -sfL "https://github.com/jsiebens/ionscale/releases/download/v0.8.2/ionscale_linux_amd64"

 sudo chmod +x "/usr/local/bin/ionscale"
 ```
@@ -0,0 +1,21 @@
+package defaults
+
+import ionscalev1 "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1"
+
+func DefaultACLPolicy() *ionscalev1.ACLPolicy {
+	return &ionscalev1.ACLPolicy{
+		Acls: []*ionscalev1.ACL{
+			{
+				Action: "accept",
+				Src:    []string{"*"},
+				Dst:    []string{"*:*"},
+			},
+		},
+	}
+}
+
+func DefaultDNSConfig() *ionscalev1.DNSConfig {
+	return &ionscalev1.DNSConfig{
+		MagicDns: true,
+	}
+}
@@ -491,88 +491,87 @@ var file_ionscale_v1_acl_proto_rawDesc = []byte{
 	0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
 	0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f,
-	0x72, 0x65, 0x66, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74,
-	0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22,
-	0x46, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52,
-	0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x41, 0x43,
-	0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
-	0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a,
-	0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x16, 0x0a,
-	0x14, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xd7, 0x04, 0x0a, 0x09, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x12, 0x37, 0x0a, 0x05, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x12, 0x3a, 0x0a, 0x06,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x24, 0x0a, 0x04, 0x61, 0x63, 0x6c, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x52, 0x04, 0x61, 0x63, 0x6c, 0x73, 0x12, 0x43,
-	0x0a, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x73, 0x12, 0x45, 0x0a, 0x0d, 0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72, 0x6f,
-	0x76, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70,
-	0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x48, 0x00, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x6f, 0x61, 0x70,
-	0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x88, 0x01, 0x01, 0x12, 0x26, 0x0a, 0x03, 0x73, 0x73,
-	0x68, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x53, 0x48, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x03, 0x73,
-	0x73, 0x68, 0x1a, 0x38, 0x0a, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x55, 0x0a, 0x0b,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
-	0x02, 0x38, 0x01, 0x1a, 0x58, 0x0a, 0x0e, 0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x10, 0x0a,
-	0x0e, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x22,
-	0x41, 0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x10,
-	0x0a, 0x03, 0x73, 0x72, 0x63, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x73, 0x72, 0x63,
-	0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x74, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x64,
-	0x73, 0x74, 0x22, 0xc2, 0x01, 0x0a, 0x0d, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72, 0x6f,
-	0x76, 0x65, 0x72, 0x73, 0x12, 0x3e, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73,
-	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x72, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64, 0x65,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64, 0x65,
-	0x1a, 0x55, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x5b, 0x0a, 0x07, 0x53, 0x53, 0x48, 0x52, 0x75,
-	0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x72,
-	0x63, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x73, 0x72, 0x63, 0x12, 0x10, 0x0a, 0x03,
-	0x64, 0x73, 0x74, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x64, 0x73, 0x74, 0x12, 0x14,
-	0x0a, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x75,
-	0x73, 0x65, 0x72, 0x73, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x6f, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x46, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x41,
+	0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x2e, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41,
+	0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x16, 0x0a, 0x14, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xd7,
+	0x04, 0x0a, 0x09, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x37, 0x0a, 0x05,
+	0x68, 0x6f, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05,
+	0x68, 0x6f, 0x73, 0x74, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x12, 0x24, 0x0a, 0x04, 0x61, 0x63, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43,
+	0x4c, 0x52, 0x04, 0x61, 0x63, 0x6c, 0x73, 0x12, 0x43, 0x0a, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x09, 0x74, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x45, 0x0a, 0x0d,
+	0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x48,
+	0x00, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x6f, 0x61, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73,
+	0x88, 0x01, 0x01, 0x12, 0x26, 0x0a, 0x03, 0x73, 0x73, 0x68, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53,
+	0x53, 0x48, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x03, 0x73, 0x73, 0x68, 0x1a, 0x38, 0x0a, 0x0a, 0x48,
+	0x6f, 0x73, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x55, 0x0a, 0x0b, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x58, 0x0a, 0x0e,
+	0x54, 0x61, 0x67, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x61,
+	0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x22, 0x41, 0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12,
+	0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x72, 0x63, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x73, 0x72, 0x63, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x74,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x64, 0x73, 0x74, 0x22, 0xc2, 0x01, 0x0a, 0x0d,
+	0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3e, 0x0a,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x6f,
+	0x41, 0x70, 0x70, 0x72, 0x6f, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1a, 0x0a,
+	0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x08, 0x65, 0x78, 0x69, 0x74, 0x6e, 0x6f, 0x64, 0x65, 0x1a, 0x55, 0x0a, 0x0b, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x22, 0x5b, 0x0a, 0x07, 0x53, 0x53, 0x48, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x72, 0x63, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x03, 0x73, 0x72, 0x63, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x74, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x03, 0x64, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x42, 0x3d, 0x5a,
+	0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65,
+	0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b,
+	0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76,
+	0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -628,7 +627,6 @@ func file_ionscale_v1_acl_proto_init() {
 	if File_ionscale_v1_acl_proto != nil {
 		return
 	}
-	file_ionscale_v1_ref_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_ionscale_v1_acl_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetACLPolicyRequest); i {
@@ -20,14 +20,14 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )

-type AuthenticationRequest struct {
+type AuthenticateRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 }

-func (x *AuthenticationRequest) Reset() {
-	*x = AuthenticationRequest{}
+func (x *AuthenticateRequest) Reset() {
+	*x = AuthenticateRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_auth_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -35,13 +35,13 @@ func (x *AuthenticationRequest) Reset() {
 	}
 }

-func (x *AuthenticationRequest) String() string {
+func (x *AuthenticateRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*AuthenticationRequest) ProtoMessage() {}
+func (*AuthenticateRequest) ProtoMessage() {}

-func (x *AuthenticationRequest) ProtoReflect() protoreflect.Message {
+func (x *AuthenticateRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_auth_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -53,12 +53,12 @@ func (x *AuthenticationRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use AuthenticationRequest.ProtoReflect.Descriptor instead.
-func (*AuthenticationRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use AuthenticateRequest.ProtoReflect.Descriptor instead.
+func (*AuthenticateRequest) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_auth_proto_rawDescGZIP(), []int{0}
 }

-type AuthenticationResponse struct {
+type AuthenticateResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -68,8 +68,8 @@ type AuthenticationResponse struct {
 	TailnetId *uint64 `protobuf:"varint,3,opt,name=tailnet_id,json=tailnetId,proto3,oneof" json:"tailnet_id,omitempty"`
 }

-func (x *AuthenticationResponse) Reset() {
-	*x = AuthenticationResponse{}
+func (x *AuthenticateResponse) Reset() {
+	*x = AuthenticateResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_ionscale_v1_auth_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -77,13 +77,13 @@ func (x *AuthenticationResponse) Reset() {
 	}
 }

-func (x *AuthenticationResponse) String() string {
+func (x *AuthenticateResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*AuthenticationResponse) ProtoMessage() {}
+func (*AuthenticateResponse) ProtoMessage() {}

-func (x *AuthenticationResponse) ProtoReflect() protoreflect.Message {
+func (x *AuthenticateResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_ionscale_v1_auth_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -95,26 +95,26 @@ func (x *AuthenticationResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use AuthenticationResponse.ProtoReflect.Descriptor instead.
-func (*AuthenticationResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use AuthenticateResponse.ProtoReflect.Descriptor instead.
+func (*AuthenticateResponse) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_auth_proto_rawDescGZIP(), []int{1}
 }

-func (x *AuthenticationResponse) GetAuthUrl() string {
+func (x *AuthenticateResponse) GetAuthUrl() string {
 	if x != nil {
 		return x.AuthUrl
 	}
 	return ""
 }

-func (x *AuthenticationResponse) GetToken() string {
+func (x *AuthenticateResponse) GetToken() string {
 	if x != nil {
 		return x.Token
 	}
 	return ""
 }

-func (x *AuthenticationResponse) GetTailnetId() uint64 {
+func (x *AuthenticateResponse) GetTailnetId() uint64 {
 	if x != nil && x.TailnetId != nil {
 		return *x.TailnetId
 	}
@@ -126,21 +126,20 @@ var File_ionscale_v1_auth_proto protoreflect.FileDescriptor
 var file_ionscale_v1_auth_proto_rawDesc = []byte{
 	0x0a, 0x16, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75,
 	0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x22, 0x17, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x7c,
-	0x0a, 0x16, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68,
-	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68,
-	0x55, 0x72, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x61, 0x69,
-	0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x48, 0x00, 0x52,
-	0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a,
-	0x0b, 0x5f, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x42, 0x3d, 0x5a, 0x3b,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62,
-	0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67,
-	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31,
-	0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x22, 0x15, 0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x7a, 0x0a, 0x14,
+	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x75, 0x72, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x55, 0x72, 0x6c, 0x12,
+	0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x48, 0x00, 0x52, 0x09, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e,
+	0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -157,8 +156,8 @@ func file_ionscale_v1_auth_proto_rawDescGZIP() []byte {

 var file_ionscale_v1_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_ionscale_v1_auth_proto_goTypes = []interface{}{
-	(*AuthenticationRequest)(nil),  // 0: ionscale.v1.AuthenticationRequest
-	(*AuthenticationResponse)(nil), // 1: ionscale.v1.AuthenticationResponse
+	(*AuthenticateRequest)(nil),  // 0: ionscale.v1.AuthenticateRequest
+	(*AuthenticateResponse)(nil), // 1: ionscale.v1.AuthenticateResponse
 }
 var file_ionscale_v1_auth_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for method output_type
@@ -175,7 +174,7 @@ func file_ionscale_v1_auth_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_ionscale_v1_auth_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticationRequest); i {
+			switch v := v.(*AuthenticateRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -187,7 +186,7 @@ func file_ionscale_v1_auth_proto_init() {
 			}
 		}
 		file_ionscale_v1_auth_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticationResponse); i {
+			switch v := v.(*AuthenticateResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -74,7 +74,7 @@ type GetAuthKeyResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	AuthKey *AuthKey `protobuf:"bytes,1,opt,name=authKey,proto3" json:"authKey,omitempty"`
+	AuthKey *AuthKey `protobuf:"bytes,1,opt,name=auth_key,json=authKey,proto3" json:"auth_key,omitempty"`
 }

 func (x *GetAuthKeyResponse) Reset() {
@@ -121,10 +121,11 @@ type CreateAuthKeyRequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	TailnetId uint64               `protobuf:"varint,1,opt,name=tailnet_id,json=tailnetId,proto3" json:"tailnet_id,omitempty"`
-	Ephemeral bool                 `protobuf:"varint,2,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
-	Expiry    *durationpb.Duration `protobuf:"bytes,3,opt,name=expiry,proto3,oneof" json:"expiry,omitempty"`
-	Tags      []string             `protobuf:"bytes,4,rep,name=tags,proto3" json:"tags,omitempty"`
+	TailnetId     uint64               `protobuf:"varint,1,opt,name=tailnet_id,json=tailnetId,proto3" json:"tailnet_id,omitempty"`
+	Ephemeral     bool                 `protobuf:"varint,2,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
+	Expiry        *durationpb.Duration `protobuf:"bytes,3,opt,name=expiry,proto3,oneof" json:"expiry,omitempty"`
+	Tags          []string             `protobuf:"bytes,4,rep,name=tags,proto3" json:"tags,omitempty"`
+	PreAuthorized bool                 `protobuf:"varint,5,opt,name=pre_authorized,json=preAuthorized,proto3" json:"pre_authorized,omitempty"`
 }

 func (x *CreateAuthKeyRequest) Reset() {
@@ -187,6 +188,13 @@ func (x *CreateAuthKeyRequest) GetTags() []string {
 	return nil
 }

+func (x *CreateAuthKeyRequest) GetPreAuthorized() bool {
+	if x != nil {
+		return x.PreAuthorized
+	}
+	return false
+}
+
 type CreateAuthKeyResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -521,72 +529,75 @@ var File_ionscale_v1_auth_keys_proto protoreflect.FileDescriptor
 var file_ionscale_v1_auth_keys_proto_rawDesc = []byte{
 	0x0a, 0x1b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75,
 	0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67,
 	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65,
-	0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e,
 	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x66, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x22, 0x33, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
 	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x5f,
 	0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x61, 0x75,
-	0x74, 0x68, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x44, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x41, 0x75,
-	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a,
-	0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74,
-	0x68, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x22, 0xaa, 0x01,
-	0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65,
-	0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c,
-	0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72,
-	0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65,
-	0x72, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00,
-	0x52, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04, 0x74,
-	0x61, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x42,
-	0x09, 0x0a, 0x07, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x22, 0x5e, 0x0a, 0x15, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74,
-	0x68, 0x4b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x36, 0x0a, 0x14, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
-	0x49, 0x64, 0x22, 0x17, 0x0a, 0x15, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x34, 0x0a, 0x13, 0x4c,
-	0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49,
-	0x64, 0x22, 0x49, 0x0a, 0x14, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x31, 0x0a, 0x09, 0x61, 0x75, 0x74,
-	0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4b,
-	0x65, 0x79, 0x52, 0x08, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x22, 0x93, 0x02, 0x0a,
-	0x07, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70,
-	0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65,
-	0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x39, 0x0a, 0x0a,
-	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x3e, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x48, 0x00, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x65, 0x73, 0x41, 0x74, 0x88, 0x01, 0x01, 0x12, 0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e,
-	0x65, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c,
-	0x6e, 0x65, 0x74, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f,
-	0x61, 0x74, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76,
-	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x45, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a,
+	0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x22, 0xd1,
+	0x01, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65,
+	0x72, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d,
+	0x65, 0x72, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48,
+	0x00, 0x52, 0x06, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04,
+	0x74, 0x61, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73,
+	0x12, 0x25, 0x0a, 0x0e, 0x70, 0x72, 0x65, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x70, 0x72, 0x65, 0x41, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x65, 0x78, 0x70, 0x69,
+	0x72, 0x79, 0x22, 0x5e, 0x0a, 0x15, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x08, 0x61,
+	0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x22, 0x36, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x09, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x17, 0x0a, 0x15, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x34, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b,
+	0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09,
+	0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x49, 0x0a, 0x14, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x31, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x08, 0x61, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x73, 0x22, 0x93, 0x02, 0x0a, 0x07, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c,
+	0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04,
+	0x74, 0x61, 0x67, 0x73, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12,
+	0x3e, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x48,
+	0x00, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x88, 0x01, 0x01, 0x12,
+	0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x42, 0x0d, 0x0a, 0x0b, 0x5f,
+	0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e,
+	0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67,
+	0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }

 var (
@@ -617,7 +628,7 @@ var file_ionscale_v1_auth_keys_proto_goTypes = []interface{}{
 	(*Ref)(nil),                   // 11: ionscale.v1.Ref
 }
 var file_ionscale_v1_auth_keys_proto_depIdxs = []int32{
-	8,  // 0: ionscale.v1.GetAuthKeyResponse.authKey:type_name -> ionscale.v1.AuthKey
+	8,  // 0: ionscale.v1.GetAuthKeyResponse.auth_key:type_name -> ionscale.v1.AuthKey
 	9,  // 1: ionscale.v1.CreateAuthKeyRequest.expiry:type_name -> google.protobuf.Duration
 	8,  // 2: ionscale.v1.CreateAuthKeyResponse.auth_key:type_name -> ionscale.v1.AuthKey
 	8,  // 3: ionscale.v1.ListAuthKeysResponse.auth_keys:type_name -> ionscale.v1.AuthKey
@@ -9,8 +9,6 @@ package ionscalev1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/known/durationpb"
-	_ "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -218,184 +216,6 @@ func (x *SetDNSConfigResponse) GetConfig() *DNSConfig {
 	return nil
 }

-type EnableHttpsCertificatesRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	TailnetId uint64 `protobuf:"varint,1,opt,name=tailnet_id,json=tailnetId,proto3" json:"tailnet_id,omitempty"`
-	Alias     string `protobuf:"bytes,2,opt,name=alias,proto3" json:"alias,omitempty"`
-}
-
-func (x *EnableHttpsCertificatesRequest) Reset() {
-	*x = EnableHttpsCertificatesRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_dns_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *EnableHttpsCertificatesRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*EnableHttpsCertificatesRequest) ProtoMessage() {}
-
-func (x *EnableHttpsCertificatesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_dns_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use EnableHttpsCertificatesRequest.ProtoReflect.Descriptor instead.
-func (*EnableHttpsCertificatesRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *EnableHttpsCertificatesRequest) GetTailnetId() uint64 {
-	if x != nil {
-		return x.TailnetId
-	}
-	return 0
-}
-
-func (x *EnableHttpsCertificatesRequest) GetAlias() string {
-	if x != nil {
-		return x.Alias
-	}
-	return ""
-}
-
-type EnableHttpsCertificatesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *EnableHttpsCertificatesResponse) Reset() {
-	*x = EnableHttpsCertificatesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_dns_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *EnableHttpsCertificatesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*EnableHttpsCertificatesResponse) ProtoMessage() {}
-
-func (x *EnableHttpsCertificatesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_dns_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use EnableHttpsCertificatesResponse.ProtoReflect.Descriptor instead.
-func (*EnableHttpsCertificatesResponse) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{5}
-}
-
-type DisableHttpsCertificatesRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	TailnetId uint64 `protobuf:"varint,1,opt,name=tailnet_id,json=tailnetId,proto3" json:"tailnet_id,omitempty"`
-}
-
-func (x *DisableHttpsCertificatesRequest) Reset() {
-	*x = DisableHttpsCertificatesRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_dns_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DisableHttpsCertificatesRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DisableHttpsCertificatesRequest) ProtoMessage() {}
-
-func (x *DisableHttpsCertificatesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_dns_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DisableHttpsCertificatesRequest.ProtoReflect.Descriptor instead.
-func (*DisableHttpsCertificatesRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *DisableHttpsCertificatesRequest) GetTailnetId() uint64 {
-	if x != nil {
-		return x.TailnetId
-	}
-	return 0
-}
-
-type DisableHttpsCertificatesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *DisableHttpsCertificatesResponse) Reset() {
-	*x = DisableHttpsCertificatesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_dns_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DisableHttpsCertificatesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DisableHttpsCertificatesResponse) ProtoMessage() {}
-
-func (x *DisableHttpsCertificatesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_dns_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DisableHttpsCertificatesResponse.ProtoReflect.Descriptor instead.
-func (*DisableHttpsCertificatesResponse) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{7}
-}
-
 type DNSConfig struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -406,12 +226,13 @@ type DNSConfig struct {
 	Nameservers      []string           `protobuf:"bytes,3,rep,name=nameservers,proto3" json:"nameservers,omitempty"`
 	Routes           map[string]*Routes `protobuf:"bytes,4,rep,name=routes,proto3" json:"routes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	MagicDnsSuffix   string             `protobuf:"bytes,5,opt,name=magic_dns_suffix,json=magicDnsSuffix,proto3" json:"magic_dns_suffix,omitempty"`
+	HttpsCerts       bool               `protobuf:"varint,6,opt,name=https_certs,json=httpsCerts,proto3" json:"https_certs,omitempty"`
 }

 func (x *DNSConfig) Reset() {
 	*x = DNSConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_dns_proto_msgTypes[8]
+		mi := &file_ionscale_v1_dns_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -424,7 +245,7 @@ func (x *DNSConfig) String() string {
 func (*DNSConfig) ProtoMessage() {}

 func (x *DNSConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_dns_proto_msgTypes[8]
+	mi := &file_ionscale_v1_dns_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -437,7 +258,7 @@ func (x *DNSConfig) ProtoReflect() protoreflect.Message {

 // Deprecated: Use DNSConfig.ProtoReflect.Descriptor instead.
 func (*DNSConfig) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{8}
+	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{4}
 }

 func (x *DNSConfig) GetMagicDns() bool {
@@ -475,6 +296,13 @@ func (x *DNSConfig) GetMagicDnsSuffix() string {
 	return ""
 }

+func (x *DNSConfig) GetHttpsCerts() bool {
+	if x != nil {
+		return x.HttpsCerts
+	}
+	return false
+}
+
 type Routes struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -486,7 +314,7 @@ type Routes struct {
 func (x *Routes) Reset() {
 	*x = Routes{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_dns_proto_msgTypes[9]
+		mi := &file_ionscale_v1_dns_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -499,7 +327,7 @@ func (x *Routes) String() string {
 func (*Routes) ProtoMessage() {}

 func (x *Routes) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_dns_proto_msgTypes[9]
+	mi := &file_ionscale_v1_dns_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -512,7 +340,7 @@ func (x *Routes) ProtoReflect() protoreflect.Message {

 // Deprecated: Use Routes.ProtoReflect.Descriptor instead.
 func (*Routes) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{9}
+	return file_ionscale_v1_dns_proto_rawDescGZIP(), []int{5}
 }

 func (x *Routes) GetRoutes() []string {
@@ -527,58 +355,42 @@ var File_ionscale_v1_dns_proto protoreflect.FileDescriptor
 var file_ionscale_v1_dns_proto_rawDesc = []byte{
 	0x0a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x6e,
 	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a,
-	0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
-	0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x46, 0x0a, 0x14, 0x47,
-	0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61,
-	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09,
-	0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x46, 0x0a, 0x14, 0x53, 0x65, 0x74,
-	0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x22, 0x55, 0x0a, 0x1e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x73,
-	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
-	0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x22, 0x21, 0x0a, 0x1f, 0x45, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x40, 0x0a, 0x1f, 0x44,
-	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
-	0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x22, 0x0a,
-	0x20, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72,
-	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0xae, 0x02, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x5f, 0x64, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x08, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x12, 0x2c, 0x0a, 0x12,
-	0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x64,
-	0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69,
-	0x64, 0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x44, 0x6e, 0x73, 0x12, 0x20, 0x0a, 0x0b, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3a, 0x0a, 0x06,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x6d, 0x61, 0x67, 0x69,
-	0x63, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0e, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x53, 0x75, 0x66, 0x66,
-	0x69, 0x78, 0x1a, 0x4e, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x65, 0x2e, 0x76, 0x31, 0x22, 0x34, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x22, 0x46, 0x0a, 0x14, 0x47, 0x65,
+	0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x22, 0x64, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x46, 0x0a, 0x14, 0x53, 0x65, 0x74, 0x44,
+	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x2e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
+	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x22, 0xcf, 0x02, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1b,
+	0x0a, 0x09, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x5f, 0x64, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x08, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6f,
+	0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x64, 0x6e,
+	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64,
+	0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x44, 0x6e, 0x73, 0x12, 0x20, 0x0a, 0x0b, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0b,
+	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x6d, 0x61, 0x67, 0x69, 0x63,
+	0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x75, 0x66, 0x66, 0x69, 0x78, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x6d, 0x61, 0x67, 0x69, 0x63, 0x44, 0x6e, 0x73, 0x53, 0x75, 0x66, 0x66, 0x69,
+	0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x73, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x73,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72,
+	0x74, 0x73, 0x1a, 0x4e, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72,
 	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
 	0x6b, 0x65, 0x79, 0x12, 0x29, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x13, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
@@ -604,31 +416,27 @@ func file_ionscale_v1_dns_proto_rawDescGZIP() []byte {
 	return file_ionscale_v1_dns_proto_rawDescData
 }

-var file_ionscale_v1_dns_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_ionscale_v1_dns_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
 var file_ionscale_v1_dns_proto_goTypes = []interface{}{
-	(*GetDNSConfigRequest)(nil),              // 0: ionscale.v1.GetDNSConfigRequest
-	(*GetDNSConfigResponse)(nil),             // 1: ionscale.v1.GetDNSConfigResponse
-	(*SetDNSConfigRequest)(nil),              // 2: ionscale.v1.SetDNSConfigRequest
-	(*SetDNSConfigResponse)(nil),             // 3: ionscale.v1.SetDNSConfigResponse
-	(*EnableHttpsCertificatesRequest)(nil),   // 4: ionscale.v1.EnableHttpsCertificatesRequest
-	(*EnableHttpsCertificatesResponse)(nil),  // 5: ionscale.v1.EnableHttpsCertificatesResponse
-	(*DisableHttpsCertificatesRequest)(nil),  // 6: ionscale.v1.DisableHttpsCertificatesRequest
-	(*DisableHttpsCertificatesResponse)(nil), // 7: ionscale.v1.DisableHttpsCertificatesResponse
-	(*DNSConfig)(nil),                        // 8: ionscale.v1.DNSConfig
-	(*Routes)(nil),                           // 9: ionscale.v1.Routes
-	nil,                                      // 10: ionscale.v1.DNSConfig.RoutesEntry
+	(*GetDNSConfigRequest)(nil),  // 0: ionscale.v1.GetDNSConfigRequest
+	(*GetDNSConfigResponse)(nil), // 1: ionscale.v1.GetDNSConfigResponse
+	(*SetDNSConfigRequest)(nil),  // 2: ionscale.v1.SetDNSConfigRequest
+	(*SetDNSConfigResponse)(nil), // 3: ionscale.v1.SetDNSConfigResponse
+	(*DNSConfig)(nil),            // 4: ionscale.v1.DNSConfig
+	(*Routes)(nil),               // 5: ionscale.v1.Routes
+	nil,                          // 6: ionscale.v1.DNSConfig.RoutesEntry
 }
 var file_ionscale_v1_dns_proto_depIdxs = []int32{
-	8,  // 0: ionscale.v1.GetDNSConfigResponse.config:type_name -> ionscale.v1.DNSConfig
-	8,  // 1: ionscale.v1.SetDNSConfigRequest.config:type_name -> ionscale.v1.DNSConfig
-	8,  // 2: ionscale.v1.SetDNSConfigResponse.config:type_name -> ionscale.v1.DNSConfig
-	10, // 3: ionscale.v1.DNSConfig.routes:type_name -> ionscale.v1.DNSConfig.RoutesEntry
-	9,  // 4: ionscale.v1.DNSConfig.RoutesEntry.value:type_name -> ionscale.v1.Routes
-	5,  // [5:5] is the sub-list for method output_type
-	5,  // [5:5] is the sub-list for method input_type
-	5,  // [5:5] is the sub-list for extension type_name
-	5,  // [5:5] is the sub-list for extension extendee
-	0,  // [0:5] is the sub-list for field type_name
+	4, // 0: ionscale.v1.GetDNSConfigResponse.config:type_name -> ionscale.v1.DNSConfig
+	4, // 1: ionscale.v1.SetDNSConfigRequest.config:type_name -> ionscale.v1.DNSConfig
+	4, // 2: ionscale.v1.SetDNSConfigResponse.config:type_name -> ionscale.v1.DNSConfig
+	6, // 3: ionscale.v1.DNSConfig.routes:type_name -> ionscale.v1.DNSConfig.RoutesEntry
+	5, // 4: ionscale.v1.DNSConfig.RoutesEntry.value:type_name -> ionscale.v1.Routes
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
 }

 func init() { file_ionscale_v1_dns_proto_init() }
@@ -686,54 +494,6 @@ func file_ionscale_v1_dns_proto_init() {
 			}
 		}
 		file_ionscale_v1_dns_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnableHttpsCertificatesRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_ionscale_v1_dns_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnableHttpsCertificatesResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_ionscale_v1_dns_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DisableHttpsCertificatesRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_ionscale_v1_dns_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DisableHttpsCertificatesResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_ionscale_v1_dns_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DNSConfig); i {
 			case 0:
 				return &v.state
@@ -745,7 +505,7 @@ func file_ionscale_v1_dns_proto_init() {
 				return nil
 			}
 		}
-		file_ionscale_v1_dns_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+		file_ionscale_v1_dns_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Routes); i {
 			case 0:
 				return &v.state
@@ -764,7 +524,7 @@ func file_ionscale_v1_dns_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_ionscale_v1_dns_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   11,
+			NumMessages:   7,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -9,8 +9,6 @@ package ionscalev1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/known/durationpb"
-	_ "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 )

@@ -26,451 +24,471 @@ var File_ionscale_v1_ionscale_proto protoreflect.FileDescriptor
 var file_ionscale_v1_ionscale_proto_rawDesc = []byte{
 	0x0a, 0x1a, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6f,
 	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x2e,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x63, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x16, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75,
+	0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f,
-	0x76, 0x31, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x61, 0x69, 0x6c, 0x6e,
-	0x65, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x1b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
-	0x1a, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x18, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f,
-	0x76, 0x31, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x61, 0x6d, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31,
-	0x2f, 0x61, 0x63, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x65, 0x72, 0x70, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x32, 0xe5, 0x1e, 0x0a, 0x0f, 0x49, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65,
-	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
-	0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x30, 0x01, 0x12, 0x64, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
-	0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x64, 0x0a, 0x11, 0x53, 0x65,
-	0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12,
-	0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65,
-	0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44,
-	0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x6a, 0x0a, 0x13, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
-	0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x76, 0x31, 0x2f, 0x64, 0x65, 0x72, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76,
+	0x31, 0x2f, 0x69, 0x61, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x18, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x1a, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x74,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2f, 0x76, 0x31, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x32, 0xb4, 0x20, 0x0a, 0x0f, 0x49, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x57, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
+	0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12,
+	0x64, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x12, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x66,
+	0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x64, 0x0a, 0x11, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x25, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61,
+	0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6a, 0x0a, 0x13, 0x52,
 	0x65, 0x73, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d,
-	0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69,
-	0x6c, 0x6e, 0x65, 0x74, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x53, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x54,
-	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x12, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65,
-	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e,
-	0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52,
-	0x50, 0x4d, 0x61, 0x70, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x53, 0x65, 0x74, 0x44, 0x45,
-	0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x65,
-	0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50,
-	0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x45,
+	0x61, 0x70, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x58, 0x0a, 0x0d, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65,
+	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47,
+	0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c,
+	0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x12, 0x20, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54,
+	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c,
+	0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a,
+	0x0a, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x1e, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f,
+	0x0a, 0x0a, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x1e, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45,
+	0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45,
 	0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x65, 0x0a, 0x12, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68,
-	0x61, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68,
-	0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x67, 0x0a, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x26, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62,
-	0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68,
-	0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x77, 0x0a, 0x18, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x79, 0x0a, 0x18, 0x44, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43,
-	0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x12, 0x4d, 0x0a, 0x0a, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x53, 0x53,
-	0x48, 0x12, 0x1d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48,
-	0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
-	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
-	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65,
-	0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e,
-	0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x47, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x49,
-	0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12,
-	0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
-	0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x55, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12,
+	0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x73, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a,
-	0x0a, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74,
-	0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74,
-	0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58,
-	0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12,
-	0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75,
-	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
-	0x79, 0x73, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71,
+	0x52, 0x65, 0x73, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x64, 0x0a, 0x11, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x25, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69,
+	0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x67, 0x0a, 0x12,
+	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69,
+	0x6e, 0x67, 0x12, 0x26, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72,
+	0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
+	0x46, 0x69, 0x6c, 0x65, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x76, 0x0a, 0x17, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x2b, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x79, 0x0a,
+	0x18, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43,
+	0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x09, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x53, 0x53, 0x48, 0x12, 0x1d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x53, 0x53, 0x48, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x53, 0x48, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7f, 0x0a, 0x1a, 0x45, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x82, 0x01, 0x0a, 0x1b, 0x44, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a,
+	0x0c, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x20, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x44,
+	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
+	0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x47,
+	0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x41, 0x4d,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x49,
+	0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71,
 	0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x09, 0x4c, 0x69, 0x73,
-	0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x1d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65,
+	0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x47, 0x65, 0x74,
+	0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x55, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53,
+	0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73,
-	0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x58, 0x0a, 0x0d, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x21, 0x2e, 0x69, 0x6f,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b,
+	0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c,
+	0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x20, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73,
+	0x12, 0x1d, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
+	0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12,
+	0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x12, 0x1e, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x55, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x73, 0x12, 0x20, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x61, 0x0a, 0x10, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x24,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a,
+	0x0d, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x21,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70,
+	0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x21, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x69, 0x6f,
 	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x12, 0x6a, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x12, 0x27, 0x2e, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4b, 0x65, 0x79,
-	0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x61, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x12, 0x24, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x12, 0x67, 0x0a, 0x13, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x69, 0x0a, 0x14,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x6a, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4b,
+	0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x78, 0x70,
+	0x69, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x61, 0x0a,
+	0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x12, 0x24, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x6a, 0x0a, 0x13, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x27, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6d, 0x0a, 0x14,
 	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f,
 	0x75, 0x74, 0x65, 0x73, 0x12, 0x28, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
 	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
-	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5d, 0x0a, 0x0e, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x22, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78,
-	0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5f, 0x0a, 0x0f, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x23, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45,
-	0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25,
-	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
-	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x76, 0x0a, 0x17, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x73, 0x12, 0x2b, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x2c, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x79, 0x0a, 0x18, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x2c, 0x2e, 0x69, 0x6f,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29,
+	0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0e, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x22, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x23, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5e, 0x0a, 0x0f, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x23, 0x2e, 0x69, 0x6f,
 	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x48, 0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x69, 0x6f, 0x6e, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x48,
-	0x74, 0x74, 0x70, 0x73, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e,
-	0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67,
-	0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x24, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
+	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e,
+	0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var file_ionscale_v1_ionscale_proto_goTypes = []interface{}{
-	(*GetVersionRequest)(nil),                // 0: ionscale.v1.GetVersionRequest
-	(*AuthenticationRequest)(nil),            // 1: ionscale.v1.AuthenticationRequest
-	(*GetDefaultDERPMapRequest)(nil),         // 2: ionscale.v1.GetDefaultDERPMapRequest
-	(*SetDefaultDERPMapRequest)(nil),         // 3: ionscale.v1.SetDefaultDERPMapRequest
-	(*ResetDefaultDERPMapRequest)(nil),       // 4: ionscale.v1.ResetDefaultDERPMapRequest
-	(*CreateTailnetRequest)(nil),             // 5: ionscale.v1.CreateTailnetRequest
-	(*GetTailnetRequest)(nil),                // 6: ionscale.v1.GetTailnetRequest
-	(*ListTailnetRequest)(nil),               // 7: ionscale.v1.ListTailnetRequest
-	(*DeleteTailnetRequest)(nil),             // 8: ionscale.v1.DeleteTailnetRequest
-	(*GetDERPMapRequest)(nil),                // 9: ionscale.v1.GetDERPMapRequest
-	(*SetDERPMapRequest)(nil),                // 10: ionscale.v1.SetDERPMapRequest
-	(*ResetDERPMapRequest)(nil),              // 11: ionscale.v1.ResetDERPMapRequest
-	(*EnableFileSharingRequest)(nil),         // 12: ionscale.v1.EnableFileSharingRequest
-	(*DisableFileSharingRequest)(nil),        // 13: ionscale.v1.DisableFileSharingRequest
-	(*EnableServiceCollectionRequest)(nil),   // 14: ionscale.v1.EnableServiceCollectionRequest
-	(*DisableServiceCollectionRequest)(nil),  // 15: ionscale.v1.DisableServiceCollectionRequest
-	(*EnableSSHRequest)(nil),                 // 16: ionscale.v1.EnableSSHRequest
-	(*DisableSSHRequest)(nil),                // 17: ionscale.v1.DisableSSHRequest
-	(*GetDNSConfigRequest)(nil),              // 18: ionscale.v1.GetDNSConfigRequest
-	(*SetDNSConfigRequest)(nil),              // 19: ionscale.v1.SetDNSConfigRequest
-	(*GetIAMPolicyRequest)(nil),              // 20: ionscale.v1.GetIAMPolicyRequest
-	(*SetIAMPolicyRequest)(nil),              // 21: ionscale.v1.SetIAMPolicyRequest
-	(*GetACLPolicyRequest)(nil),              // 22: ionscale.v1.GetACLPolicyRequest
-	(*SetACLPolicyRequest)(nil),              // 23: ionscale.v1.SetACLPolicyRequest
-	(*GetAuthKeyRequest)(nil),                // 24: ionscale.v1.GetAuthKeyRequest
-	(*CreateAuthKeyRequest)(nil),             // 25: ionscale.v1.CreateAuthKeyRequest
-	(*DeleteAuthKeyRequest)(nil),             // 26: ionscale.v1.DeleteAuthKeyRequest
-	(*ListAuthKeysRequest)(nil),              // 27: ionscale.v1.ListAuthKeysRequest
-	(*ListUsersRequest)(nil),                 // 28: ionscale.v1.ListUsersRequest
-	(*DeleteUserRequest)(nil),                // 29: ionscale.v1.DeleteUserRequest
-	(*GetMachineRequest)(nil),                // 30: ionscale.v1.GetMachineRequest
-	(*ListMachinesRequest)(nil),              // 31: ionscale.v1.ListMachinesRequest
-	(*ExpireMachineRequest)(nil),             // 32: ionscale.v1.ExpireMachineRequest
-	(*DeleteMachineRequest)(nil),             // 33: ionscale.v1.DeleteMachineRequest
-	(*SetMachineKeyExpiryRequest)(nil),       // 34: ionscale.v1.SetMachineKeyExpiryRequest
-	(*GetMachineRoutesRequest)(nil),          // 35: ionscale.v1.GetMachineRoutesRequest
-	(*EnableMachineRoutesRequest)(nil),       // 36: ionscale.v1.EnableMachineRoutesRequest
-	(*DisableMachineRoutesRequest)(nil),      // 37: ionscale.v1.DisableMachineRoutesRequest
-	(*EnableExitNodeRequest)(nil),            // 38: ionscale.v1.EnableExitNodeRequest
-	(*DisableExitNodeRequest)(nil),           // 39: ionscale.v1.DisableExitNodeRequest
-	(*EnableHttpsCertificatesRequest)(nil),   // 40: ionscale.v1.EnableHttpsCertificatesRequest
-	(*DisableHttpsCertificatesRequest)(nil),  // 41: ionscale.v1.DisableHttpsCertificatesRequest
-	(*GetVersionResponse)(nil),               // 42: ionscale.v1.GetVersionResponse
-	(*AuthenticationResponse)(nil),           // 43: ionscale.v1.AuthenticationResponse
-	(*GetDefaultDERPMapResponse)(nil),        // 44: ionscale.v1.GetDefaultDERPMapResponse
-	(*SetDefaultDERPMapResponse)(nil),        // 45: ionscale.v1.SetDefaultDERPMapResponse
-	(*ResetDefaultDERPMapResponse)(nil),      // 46: ionscale.v1.ResetDefaultDERPMapResponse
-	(*CreateTailnetResponse)(nil),            // 47: ionscale.v1.CreateTailnetResponse
-	(*GetTailnetResponse)(nil),               // 48: ionscale.v1.GetTailnetResponse
-	(*ListTailnetResponse)(nil),              // 49: ionscale.v1.ListTailnetResponse
-	(*DeleteTailnetResponse)(nil),            // 50: ionscale.v1.DeleteTailnetResponse
-	(*GetDERPMapResponse)(nil),               // 51: ionscale.v1.GetDERPMapResponse
-	(*SetDERPMapResponse)(nil),               // 52: ionscale.v1.SetDERPMapResponse
-	(*ResetDERPMapResponse)(nil),             // 53: ionscale.v1.ResetDERPMapResponse
-	(*EnableFileSharingResponse)(nil),        // 54: ionscale.v1.EnableFileSharingResponse
-	(*DisableFileSharingResponse)(nil),       // 55: ionscale.v1.DisableFileSharingResponse
-	(*EnableServiceCollectionResponse)(nil),  // 56: ionscale.v1.EnableServiceCollectionResponse
-	(*DisableServiceCollectionResponse)(nil), // 57: ionscale.v1.DisableServiceCollectionResponse
-	(*EnableSSHResponse)(nil),                // 58: ionscale.v1.EnableSSHResponse
-	(*DisableSSHResponse)(nil),               // 59: ionscale.v1.DisableSSHResponse
-	(*GetDNSConfigResponse)(nil),             // 60: ionscale.v1.GetDNSConfigResponse
-	(*SetDNSConfigResponse)(nil),             // 61: ionscale.v1.SetDNSConfigResponse
-	(*GetIAMPolicyResponse)(nil),             // 62: ionscale.v1.GetIAMPolicyResponse
-	(*SetIAMPolicyResponse)(nil),             // 63: ionscale.v1.SetIAMPolicyResponse
-	(*GetACLPolicyResponse)(nil),             // 64: ionscale.v1.GetACLPolicyResponse
-	(*SetACLPolicyResponse)(nil),             // 65: ionscale.v1.SetACLPolicyResponse
-	(*GetAuthKeyResponse)(nil),               // 66: ionscale.v1.GetAuthKeyResponse
-	(*CreateAuthKeyResponse)(nil),            // 67: ionscale.v1.CreateAuthKeyResponse
-	(*DeleteAuthKeyResponse)(nil),            // 68: ionscale.v1.DeleteAuthKeyResponse
-	(*ListAuthKeysResponse)(nil),             // 69: ionscale.v1.ListAuthKeysResponse
-	(*ListUsersResponse)(nil),                // 70: ionscale.v1.ListUsersResponse
-	(*DeleteUserResponse)(nil),               // 71: ionscale.v1.DeleteUserResponse
-	(*GetMachineResponse)(nil),               // 72: ionscale.v1.GetMachineResponse
-	(*ListMachinesResponse)(nil),             // 73: ionscale.v1.ListMachinesResponse
-	(*ExpireMachineResponse)(nil),            // 74: ionscale.v1.ExpireMachineResponse
-	(*DeleteMachineResponse)(nil),            // 75: ionscale.v1.DeleteMachineResponse
-	(*SetMachineKeyExpiryResponse)(nil),      // 76: ionscale.v1.SetMachineKeyExpiryResponse
-	(*GetMachineRoutesResponse)(nil),         // 77: ionscale.v1.GetMachineRoutesResponse
-	(*EnableHttpsCertificatesResponse)(nil),  // 78: ionscale.v1.EnableHttpsCertificatesResponse
-	(*DisableHttpsCertificatesResponse)(nil), // 79: ionscale.v1.DisableHttpsCertificatesResponse
+	(*GetVersionRequest)(nil),                   // 0: ionscale.v1.GetVersionRequest
+	(*AuthenticateRequest)(nil),                 // 1: ionscale.v1.AuthenticateRequest
+	(*GetDefaultDERPMapRequest)(nil),            // 2: ionscale.v1.GetDefaultDERPMapRequest
+	(*SetDefaultDERPMapRequest)(nil),            // 3: ionscale.v1.SetDefaultDERPMapRequest
+	(*ResetDefaultDERPMapRequest)(nil),          // 4: ionscale.v1.ResetDefaultDERPMapRequest
+	(*CreateTailnetRequest)(nil),                // 5: ionscale.v1.CreateTailnetRequest
+	(*UpdateTailnetRequest)(nil),                // 6: ionscale.v1.UpdateTailnetRequest
+	(*GetTailnetRequest)(nil),                   // 7: ionscale.v1.GetTailnetRequest
+	(*ListTailnetsRequest)(nil),                 // 8: ionscale.v1.ListTailnetsRequest
+	(*DeleteTailnetRequest)(nil),                // 9: ionscale.v1.DeleteTailnetRequest
+	(*GetDERPMapRequest)(nil),                   // 10: ionscale.v1.GetDERPMapRequest
+	(*SetDERPMapRequest)(nil),                   // 11: ionscale.v1.SetDERPMapRequest
+	(*ResetDERPMapRequest)(nil),                 // 12: ionscale.v1.ResetDERPMapRequest
+	(*EnableFileSharingRequest)(nil),            // 13: ionscale.v1.EnableFileSharingRequest
+	(*DisableFileSharingRequest)(nil),           // 14: ionscale.v1.DisableFileSharingRequest
+	(*EnableServiceCollectionRequest)(nil),      // 15: ionscale.v1.EnableServiceCollectionRequest
+	(*DisableServiceCollectionRequest)(nil),     // 16: ionscale.v1.DisableServiceCollectionRequest
+	(*EnableSSHRequest)(nil),                    // 17: ionscale.v1.EnableSSHRequest
+	(*DisableSSHRequest)(nil),                   // 18: ionscale.v1.DisableSSHRequest
+	(*EnableMachineAuthorizationRequest)(nil),   // 19: ionscale.v1.EnableMachineAuthorizationRequest
+	(*DisableMachineAuthorizationRequest)(nil),  // 20: ionscale.v1.DisableMachineAuthorizationRequest
+	(*GetDNSConfigRequest)(nil),                 // 21: ionscale.v1.GetDNSConfigRequest
+	(*SetDNSConfigRequest)(nil),                 // 22: ionscale.v1.SetDNSConfigRequest
+	(*GetIAMPolicyRequest)(nil),                 // 23: ionscale.v1.GetIAMPolicyRequest
+	(*SetIAMPolicyRequest)(nil),                 // 24: ionscale.v1.SetIAMPolicyRequest
+	(*GetACLPolicyRequest)(nil),                 // 25: ionscale.v1.GetACLPolicyRequest
+	(*SetACLPolicyRequest)(nil),                 // 26: ionscale.v1.SetACLPolicyRequest
+	(*GetAuthKeyRequest)(nil),                   // 27: ionscale.v1.GetAuthKeyRequest
+	(*CreateAuthKeyRequest)(nil),                // 28: ionscale.v1.CreateAuthKeyRequest
+	(*DeleteAuthKeyRequest)(nil),                // 29: ionscale.v1.DeleteAuthKeyRequest
+	(*ListAuthKeysRequest)(nil),                 // 30: ionscale.v1.ListAuthKeysRequest
+	(*ListUsersRequest)(nil),                    // 31: ionscale.v1.ListUsersRequest
+	(*DeleteUserRequest)(nil),                   // 32: ionscale.v1.DeleteUserRequest
+	(*GetMachineRequest)(nil),                   // 33: ionscale.v1.GetMachineRequest
+	(*ListMachinesRequest)(nil),                 // 34: ionscale.v1.ListMachinesRequest
+	(*AuthorizeMachineRequest)(nil),             // 35: ionscale.v1.AuthorizeMachineRequest
+	(*ExpireMachineRequest)(nil),                // 36: ionscale.v1.ExpireMachineRequest
+	(*DeleteMachineRequest)(nil),                // 37: ionscale.v1.DeleteMachineRequest
+	(*SetMachineKeyExpiryRequest)(nil),          // 38: ionscale.v1.SetMachineKeyExpiryRequest
+	(*GetMachineRoutesRequest)(nil),             // 39: ionscale.v1.GetMachineRoutesRequest
+	(*EnableMachineRoutesRequest)(nil),          // 40: ionscale.v1.EnableMachineRoutesRequest
+	(*DisableMachineRoutesRequest)(nil),         // 41: ionscale.v1.DisableMachineRoutesRequest
+	(*EnableExitNodeRequest)(nil),               // 42: ionscale.v1.EnableExitNodeRequest
+	(*DisableExitNodeRequest)(nil),              // 43: ionscale.v1.DisableExitNodeRequest
+	(*GetVersionResponse)(nil),                  // 44: ionscale.v1.GetVersionResponse
+	(*AuthenticateResponse)(nil),                // 45: ionscale.v1.AuthenticateResponse
+	(*GetDefaultDERPMapResponse)(nil),           // 46: ionscale.v1.GetDefaultDERPMapResponse
+	(*SetDefaultDERPMapResponse)(nil),           // 47: ionscale.v1.SetDefaultDERPMapResponse
+	(*ResetDefaultDERPMapResponse)(nil),         // 48: ionscale.v1.ResetDefaultDERPMapResponse
+	(*CreateTailnetResponse)(nil),               // 49: ionscale.v1.CreateTailnetResponse
+	(*UpdateTailnetResponse)(nil),               // 50: ionscale.v1.UpdateTailnetResponse
+	(*GetTailnetResponse)(nil),                  // 51: ionscale.v1.GetTailnetResponse
+	(*ListTailnetsResponse)(nil),                // 52: ionscale.v1.ListTailnetsResponse
+	(*DeleteTailnetResponse)(nil),               // 53: ionscale.v1.DeleteTailnetResponse
+	(*GetDERPMapResponse)(nil),                  // 54: ionscale.v1.GetDERPMapResponse
+	(*SetDERPMapResponse)(nil),                  // 55: ionscale.v1.SetDERPMapResponse
+	(*ResetDERPMapResponse)(nil),                // 56: ionscale.v1.ResetDERPMapResponse
+	(*EnableFileSharingResponse)(nil),           // 57: ionscale.v1.EnableFileSharingResponse
+	(*DisableFileSharingResponse)(nil),          // 58: ionscale.v1.DisableFileSharingResponse
+	(*EnableServiceCollectionResponse)(nil),     // 59: ionscale.v1.EnableServiceCollectionResponse
+	(*DisableServiceCollectionResponse)(nil),    // 60: ionscale.v1.DisableServiceCollectionResponse
+	(*EnableSSHResponse)(nil),                   // 61: ionscale.v1.EnableSSHResponse
+	(*DisableSSHResponse)(nil),                  // 62: ionscale.v1.DisableSSHResponse
+	(*EnableMachineAuthorizationResponse)(nil),  // 63: ionscale.v1.EnableMachineAuthorizationResponse
+	(*DisableMachineAuthorizationResponse)(nil), // 64: ionscale.v1.DisableMachineAuthorizationResponse
+	(*GetDNSConfigResponse)(nil),                // 65: ionscale.v1.GetDNSConfigResponse
+	(*SetDNSConfigResponse)(nil),                // 66: ionscale.v1.SetDNSConfigResponse
+	(*GetIAMPolicyResponse)(nil),                // 67: ionscale.v1.GetIAMPolicyResponse
+	(*SetIAMPolicyResponse)(nil),                // 68: ionscale.v1.SetIAMPolicyResponse
+	(*GetACLPolicyResponse)(nil),                // 69: ionscale.v1.GetACLPolicyResponse
+	(*SetACLPolicyResponse)(nil),                // 70: ionscale.v1.SetACLPolicyResponse
+	(*GetAuthKeyResponse)(nil),                  // 71: ionscale.v1.GetAuthKeyResponse
+	(*CreateAuthKeyResponse)(nil),               // 72: ionscale.v1.CreateAuthKeyResponse
+	(*DeleteAuthKeyResponse)(nil),               // 73: ionscale.v1.DeleteAuthKeyResponse
+	(*ListAuthKeysResponse)(nil),                // 74: ionscale.v1.ListAuthKeysResponse
+	(*ListUsersResponse)(nil),                   // 75: ionscale.v1.ListUsersResponse
+	(*DeleteUserResponse)(nil),                  // 76: ionscale.v1.DeleteUserResponse
+	(*GetMachineResponse)(nil),                  // 77: ionscale.v1.GetMachineResponse
+	(*ListMachinesResponse)(nil),                // 78: ionscale.v1.ListMachinesResponse
+	(*AuthorizeMachineResponse)(nil),            // 79: ionscale.v1.AuthorizeMachineResponse
+	(*ExpireMachineResponse)(nil),               // 80: ionscale.v1.ExpireMachineResponse
+	(*DeleteMachineResponse)(nil),               // 81: ionscale.v1.DeleteMachineResponse
+	(*SetMachineKeyExpiryResponse)(nil),         // 82: ionscale.v1.SetMachineKeyExpiryResponse
+	(*GetMachineRoutesResponse)(nil),            // 83: ionscale.v1.GetMachineRoutesResponse
+	(*EnableMachineRoutesResponse)(nil),         // 84: ionscale.v1.EnableMachineRoutesResponse
+	(*DisableMachineRoutesResponse)(nil),        // 85: ionscale.v1.DisableMachineRoutesResponse
+	(*EnableExitNodeResponse)(nil),              // 86: ionscale.v1.EnableExitNodeResponse
+	(*DisableExitNodeResponse)(nil),             // 87: ionscale.v1.DisableExitNodeResponse
 }
 var file_ionscale_v1_ionscale_proto_depIdxs = []int32{
 	0,  // 0: ionscale.v1.IonscaleService.GetVersion:input_type -> ionscale.v1.GetVersionRequest
-	1,  // 1: ionscale.v1.IonscaleService.Authenticate:input_type -> ionscale.v1.AuthenticationRequest
+	1,  // 1: ionscale.v1.IonscaleService.Authenticate:input_type -> ionscale.v1.AuthenticateRequest
 	2,  // 2: ionscale.v1.IonscaleService.GetDefaultDERPMap:input_type -> ionscale.v1.GetDefaultDERPMapRequest
 	3,  // 3: ionscale.v1.IonscaleService.SetDefaultDERPMap:input_type -> ionscale.v1.SetDefaultDERPMapRequest
 	4,  // 4: ionscale.v1.IonscaleService.ResetDefaultDERPMap:input_type -> ionscale.v1.ResetDefaultDERPMapRequest
 	5,  // 5: ionscale.v1.IonscaleService.CreateTailnet:input_type -> ionscale.v1.CreateTailnetRequest
-	6,  // 6: ionscale.v1.IonscaleService.GetTailnet:input_type -> ionscale.v1.GetTailnetRequest
-	7,  // 7: ionscale.v1.IonscaleService.ListTailnets:input_type -> ionscale.v1.ListTailnetRequest
-	8,  // 8: ionscale.v1.IonscaleService.DeleteTailnet:input_type -> ionscale.v1.DeleteTailnetRequest
-	9,  // 9: ionscale.v1.IonscaleService.GetDERPMap:input_type -> ionscale.v1.GetDERPMapRequest
-	10, // 10: ionscale.v1.IonscaleService.SetDERPMap:input_type -> ionscale.v1.SetDERPMapRequest
-	11, // 11: ionscale.v1.IonscaleService.ResetDERPMap:input_type -> ionscale.v1.ResetDERPMapRequest
-	12, // 12: ionscale.v1.IonscaleService.EnabledFileSharing:input_type -> ionscale.v1.EnableFileSharingRequest
-	13, // 13: ionscale.v1.IonscaleService.DisableFileSharing:input_type -> ionscale.v1.DisableFileSharingRequest
-	14, // 14: ionscale.v1.IonscaleService.EnabledServiceCollection:input_type -> ionscale.v1.EnableServiceCollectionRequest
-	15, // 15: ionscale.v1.IonscaleService.DisableServiceCollection:input_type -> ionscale.v1.DisableServiceCollectionRequest
-	16, // 16: ionscale.v1.IonscaleService.EnabledSSH:input_type -> ionscale.v1.EnableSSHRequest
-	17, // 17: ionscale.v1.IonscaleService.DisableSSH:input_type -> ionscale.v1.DisableSSHRequest
-	18, // 18: ionscale.v1.IonscaleService.GetDNSConfig:input_type -> ionscale.v1.GetDNSConfigRequest
-	19, // 19: ionscale.v1.IonscaleService.SetDNSConfig:input_type -> ionscale.v1.SetDNSConfigRequest
-	20, // 20: ionscale.v1.IonscaleService.GetIAMPolicy:input_type -> ionscale.v1.GetIAMPolicyRequest
-	21, // 21: ionscale.v1.IonscaleService.SetIAMPolicy:input_type -> ionscale.v1.SetIAMPolicyRequest
-	22, // 22: ionscale.v1.IonscaleService.GetACLPolicy:input_type -> ionscale.v1.GetACLPolicyRequest
-	23, // 23: ionscale.v1.IonscaleService.SetACLPolicy:input_type -> ionscale.v1.SetACLPolicyRequest
-	24, // 24: ionscale.v1.IonscaleService.GetAuthKey:input_type -> ionscale.v1.GetAuthKeyRequest
-	25, // 25: ionscale.v1.IonscaleService.CreateAuthKey:input_type -> ionscale.v1.CreateAuthKeyRequest
-	26, // 26: ionscale.v1.IonscaleService.DeleteAuthKey:input_type -> ionscale.v1.DeleteAuthKeyRequest
-	27, // 27: ionscale.v1.IonscaleService.ListAuthKeys:input_type -> ionscale.v1.ListAuthKeysRequest
-	28, // 28: ionscale.v1.IonscaleService.ListUsers:input_type -> ionscale.v1.ListUsersRequest
-	29, // 29: ionscale.v1.IonscaleService.DeleteUser:input_type -> ionscale.v1.DeleteUserRequest
-	30, // 30: ionscale.v1.IonscaleService.GetMachine:input_type -> ionscale.v1.GetMachineRequest
-	31, // 31: ionscale.v1.IonscaleService.ListMachines:input_type -> ionscale.v1.ListMachinesRequest
-	32, // 32: ionscale.v1.IonscaleService.ExpireMachine:input_type -> ionscale.v1.ExpireMachineRequest
-	33, // 33: ionscale.v1.IonscaleService.DeleteMachine:input_type -> ionscale.v1.DeleteMachineRequest
-	34, // 34: ionscale.v1.IonscaleService.SetMachineKeyExpiry:input_type -> ionscale.v1.SetMachineKeyExpiryRequest
-	35, // 35: ionscale.v1.IonscaleService.GetMachineRoutes:input_type -> ionscale.v1.GetMachineRoutesRequest
-	36, // 36: ionscale.v1.IonscaleService.EnableMachineRoutes:input_type -> ionscale.v1.EnableMachineRoutesRequest
-	37, // 37: ionscale.v1.IonscaleService.DisableMachineRoutes:input_type -> ionscale.v1.DisableMachineRoutesRequest
-	38, // 38: ionscale.v1.IonscaleService.EnableExitNode:input_type -> ionscale.v1.EnableExitNodeRequest
-	39, // 39: ionscale.v1.IonscaleService.DisableExitNode:input_type -> ionscale.v1.DisableExitNodeRequest
-	40, // 40: ionscale.v1.IonscaleService.EnableHttpsCertificates:input_type -> ionscale.v1.EnableHttpsCertificatesRequest
-	41, // 41: ionscale.v1.IonscaleService.DisableHttpsCertificates:input_type -> ionscale.v1.DisableHttpsCertificatesRequest
-	42, // 42: ionscale.v1.IonscaleService.GetVersion:output_type -> ionscale.v1.GetVersionResponse
-	43, // 43: ionscale.v1.IonscaleService.Authenticate:output_type -> ionscale.v1.AuthenticationResponse
-	44, // 44: ionscale.v1.IonscaleService.GetDefaultDERPMap:output_type -> ionscale.v1.GetDefaultDERPMapResponse
-	45, // 45: ionscale.v1.IonscaleService.SetDefaultDERPMap:output_type -> ionscale.v1.SetDefaultDERPMapResponse
-	46, // 46: ionscale.v1.IonscaleService.ResetDefaultDERPMap:output_type -> ionscale.v1.ResetDefaultDERPMapResponse
-	47, // 47: ionscale.v1.IonscaleService.CreateTailnet:output_type -> ionscale.v1.CreateTailnetResponse
-	48, // 48: ionscale.v1.IonscaleService.GetTailnet:output_type -> ionscale.v1.GetTailnetResponse
-	49, // 49: ionscale.v1.IonscaleService.ListTailnets:output_type -> ionscale.v1.ListTailnetResponse
-	50, // 50: ionscale.v1.IonscaleService.DeleteTailnet:output_type -> ionscale.v1.DeleteTailnetResponse
-	51, // 51: ionscale.v1.IonscaleService.GetDERPMap:output_type -> ionscale.v1.GetDERPMapResponse
-	52, // 52: ionscale.v1.IonscaleService.SetDERPMap:output_type -> ionscale.v1.SetDERPMapResponse
-	53, // 53: ionscale.v1.IonscaleService.ResetDERPMap:output_type -> ionscale.v1.ResetDERPMapResponse
-	54, // 54: ionscale.v1.IonscaleService.EnabledFileSharing:output_type -> ionscale.v1.EnableFileSharingResponse
-	55, // 55: ionscale.v1.IonscaleService.DisableFileSharing:output_type -> ionscale.v1.DisableFileSharingResponse
-	56, // 56: ionscale.v1.IonscaleService.EnabledServiceCollection:output_type -> ionscale.v1.EnableServiceCollectionResponse
-	57, // 57: ionscale.v1.IonscaleService.DisableServiceCollection:output_type -> ionscale.v1.DisableServiceCollectionResponse
-	58, // 58: ionscale.v1.IonscaleService.EnabledSSH:output_type -> ionscale.v1.EnableSSHResponse
-	59, // 59: ionscale.v1.IonscaleService.DisableSSH:output_type -> ionscale.v1.DisableSSHResponse
-	60, // 60: ionscale.v1.IonscaleService.GetDNSConfig:output_type -> ionscale.v1.GetDNSConfigResponse
-	61, // 61: ionscale.v1.IonscaleService.SetDNSConfig:output_type -> ionscale.v1.SetDNSConfigResponse
-	62, // 62: ionscale.v1.IonscaleService.GetIAMPolicy:output_type -> ionscale.v1.GetIAMPolicyResponse
-	63, // 63: ionscale.v1.IonscaleService.SetIAMPolicy:output_type -> ionscale.v1.SetIAMPolicyResponse
-	64, // 64: ionscale.v1.IonscaleService.GetACLPolicy:output_type -> ionscale.v1.GetACLPolicyResponse
-	65, // 65: ionscale.v1.IonscaleService.SetACLPolicy:output_type -> ionscale.v1.SetACLPolicyResponse
-	66, // 66: ionscale.v1.IonscaleService.GetAuthKey:output_type -> ionscale.v1.GetAuthKeyResponse
-	67, // 67: ionscale.v1.IonscaleService.CreateAuthKey:output_type -> ionscale.v1.CreateAuthKeyResponse
-	68, // 68: ionscale.v1.IonscaleService.DeleteAuthKey:output_type -> ionscale.v1.DeleteAuthKeyResponse
-	69, // 69: ionscale.v1.IonscaleService.ListAuthKeys:output_type -> ionscale.v1.ListAuthKeysResponse
-	70, // 70: ionscale.v1.IonscaleService.ListUsers:output_type -> ionscale.v1.ListUsersResponse
-	71, // 71: ionscale.v1.IonscaleService.DeleteUser:output_type -> ionscale.v1.DeleteUserResponse
-	72, // 72: ionscale.v1.IonscaleService.GetMachine:output_type -> ionscale.v1.GetMachineResponse
-	73, // 73: ionscale.v1.IonscaleService.ListMachines:output_type -> ionscale.v1.ListMachinesResponse
-	74, // 74: ionscale.v1.IonscaleService.ExpireMachine:output_type -> ionscale.v1.ExpireMachineResponse
-	75, // 75: ionscale.v1.IonscaleService.DeleteMachine:output_type -> ionscale.v1.DeleteMachineResponse
-	76, // 76: ionscale.v1.IonscaleService.SetMachineKeyExpiry:output_type -> ionscale.v1.SetMachineKeyExpiryResponse
-	77, // 77: ionscale.v1.IonscaleService.GetMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
-	77, // 78: ionscale.v1.IonscaleService.EnableMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
-	77, // 79: ionscale.v1.IonscaleService.DisableMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
-	77, // 80: ionscale.v1.IonscaleService.EnableExitNode:output_type -> ionscale.v1.GetMachineRoutesResponse
-	77, // 81: ionscale.v1.IonscaleService.DisableExitNode:output_type -> ionscale.v1.GetMachineRoutesResponse
-	78, // 82: ionscale.v1.IonscaleService.EnableHttpsCertificates:output_type -> ionscale.v1.EnableHttpsCertificatesResponse
-	79, // 83: ionscale.v1.IonscaleService.DisableHttpsCertificates:output_type -> ionscale.v1.DisableHttpsCertificatesResponse
-	42, // [42:84] is the sub-list for method output_type
-	0,  // [0:42] is the sub-list for method input_type
+	6,  // 6: ionscale.v1.IonscaleService.UpdateTailnet:input_type -> ionscale.v1.UpdateTailnetRequest
+	7,  // 7: ionscale.v1.IonscaleService.GetTailnet:input_type -> ionscale.v1.GetTailnetRequest
+	8,  // 8: ionscale.v1.IonscaleService.ListTailnets:input_type -> ionscale.v1.ListTailnetsRequest
+	9,  // 9: ionscale.v1.IonscaleService.DeleteTailnet:input_type -> ionscale.v1.DeleteTailnetRequest
+	10, // 10: ionscale.v1.IonscaleService.GetDERPMap:input_type -> ionscale.v1.GetDERPMapRequest
+	11, // 11: ionscale.v1.IonscaleService.SetDERPMap:input_type -> ionscale.v1.SetDERPMapRequest
+	12, // 12: ionscale.v1.IonscaleService.ResetDERPMap:input_type -> ionscale.v1.ResetDERPMapRequest
+	13, // 13: ionscale.v1.IonscaleService.EnableFileSharing:input_type -> ionscale.v1.EnableFileSharingRequest
+	14, // 14: ionscale.v1.IonscaleService.DisableFileSharing:input_type -> ionscale.v1.DisableFileSharingRequest
+	15, // 15: ionscale.v1.IonscaleService.EnableServiceCollection:input_type -> ionscale.v1.EnableServiceCollectionRequest
+	16, // 16: ionscale.v1.IonscaleService.DisableServiceCollection:input_type -> ionscale.v1.DisableServiceCollectionRequest
+	17, // 17: ionscale.v1.IonscaleService.EnableSSH:input_type -> ionscale.v1.EnableSSHRequest
+	18, // 18: ionscale.v1.IonscaleService.DisableSSH:input_type -> ionscale.v1.DisableSSHRequest
+	19, // 19: ionscale.v1.IonscaleService.EnableMachineAuthorization:input_type -> ionscale.v1.EnableMachineAuthorizationRequest
+	20, // 20: ionscale.v1.IonscaleService.DisableMachineAuthorization:input_type -> ionscale.v1.DisableMachineAuthorizationRequest
+	21, // 21: ionscale.v1.IonscaleService.GetDNSConfig:input_type -> ionscale.v1.GetDNSConfigRequest
+	22, // 22: ionscale.v1.IonscaleService.SetDNSConfig:input_type -> ionscale.v1.SetDNSConfigRequest
+	23, // 23: ionscale.v1.IonscaleService.GetIAMPolicy:input_type -> ionscale.v1.GetIAMPolicyRequest
+	24, // 24: ionscale.v1.IonscaleService.SetIAMPolicy:input_type -> ionscale.v1.SetIAMPolicyRequest
+	25, // 25: ionscale.v1.IonscaleService.GetACLPolicy:input_type -> ionscale.v1.GetACLPolicyRequest
+	26, // 26: ionscale.v1.IonscaleService.SetACLPolicy:input_type -> ionscale.v1.SetACLPolicyRequest
+	27, // 27: ionscale.v1.IonscaleService.GetAuthKey:input_type -> ionscale.v1.GetAuthKeyRequest
+	28, // 28: ionscale.v1.IonscaleService.CreateAuthKey:input_type -> ionscale.v1.CreateAuthKeyRequest
+	29, // 29: ionscale.v1.IonscaleService.DeleteAuthKey:input_type -> ionscale.v1.DeleteAuthKeyRequest
+	30, // 30: ionscale.v1.IonscaleService.ListAuthKeys:input_type -> ionscale.v1.ListAuthKeysRequest
+	31, // 31: ionscale.v1.IonscaleService.ListUsers:input_type -> ionscale.v1.ListUsersRequest
+	32, // 32: ionscale.v1.IonscaleService.DeleteUser:input_type -> ionscale.v1.DeleteUserRequest
+	33, // 33: ionscale.v1.IonscaleService.GetMachine:input_type -> ionscale.v1.GetMachineRequest
+	34, // 34: ionscale.v1.IonscaleService.ListMachines:input_type -> ionscale.v1.ListMachinesRequest
+	35, // 35: ionscale.v1.IonscaleService.AuthorizeMachine:input_type -> ionscale.v1.AuthorizeMachineRequest
+	36, // 36: ionscale.v1.IonscaleService.ExpireMachine:input_type -> ionscale.v1.ExpireMachineRequest
+	37, // 37: ionscale.v1.IonscaleService.DeleteMachine:input_type -> ionscale.v1.DeleteMachineRequest
+	38, // 38: ionscale.v1.IonscaleService.SetMachineKeyExpiry:input_type -> ionscale.v1.SetMachineKeyExpiryRequest
+	39, // 39: ionscale.v1.IonscaleService.GetMachineRoutes:input_type -> ionscale.v1.GetMachineRoutesRequest
+	40, // 40: ionscale.v1.IonscaleService.EnableMachineRoutes:input_type -> ionscale.v1.EnableMachineRoutesRequest
+	41, // 41: ionscale.v1.IonscaleService.DisableMachineRoutes:input_type -> ionscale.v1.DisableMachineRoutesRequest
+	42, // 42: ionscale.v1.IonscaleService.EnableExitNode:input_type -> ionscale.v1.EnableExitNodeRequest
+	43, // 43: ionscale.v1.IonscaleService.DisableExitNode:input_type -> ionscale.v1.DisableExitNodeRequest
+	44, // 44: ionscale.v1.IonscaleService.GetVersion:output_type -> ionscale.v1.GetVersionResponse
+	45, // 45: ionscale.v1.IonscaleService.Authenticate:output_type -> ionscale.v1.AuthenticateResponse
+	46, // 46: ionscale.v1.IonscaleService.GetDefaultDERPMap:output_type -> ionscale.v1.GetDefaultDERPMapResponse
+	47, // 47: ionscale.v1.IonscaleService.SetDefaultDERPMap:output_type -> ionscale.v1.SetDefaultDERPMapResponse
+	48, // 48: ionscale.v1.IonscaleService.ResetDefaultDERPMap:output_type -> ionscale.v1.ResetDefaultDERPMapResponse
+	49, // 49: ionscale.v1.IonscaleService.CreateTailnet:output_type -> ionscale.v1.CreateTailnetResponse
+	50, // 50: ionscale.v1.IonscaleService.UpdateTailnet:output_type -> ionscale.v1.UpdateTailnetResponse
+	51, // 51: ionscale.v1.IonscaleService.GetTailnet:output_type -> ionscale.v1.GetTailnetResponse
+	52, // 52: ionscale.v1.IonscaleService.ListTailnets:output_type -> ionscale.v1.ListTailnetsResponse
+	53, // 53: ionscale.v1.IonscaleService.DeleteTailnet:output_type -> ionscale.v1.DeleteTailnetResponse
+	54, // 54: ionscale.v1.IonscaleService.GetDERPMap:output_type -> ionscale.v1.GetDERPMapResponse
+	55, // 55: ionscale.v1.IonscaleService.SetDERPMap:output_type -> ionscale.v1.SetDERPMapResponse
+	56, // 56: ionscale.v1.IonscaleService.ResetDERPMap:output_type -> ionscale.v1.ResetDERPMapResponse
+	57, // 57: ionscale.v1.IonscaleService.EnableFileSharing:output_type -> ionscale.v1.EnableFileSharingResponse
+	58, // 58: ionscale.v1.IonscaleService.DisableFileSharing:output_type -> ionscale.v1.DisableFileSharingResponse
+	59, // 59: ionscale.v1.IonscaleService.EnableServiceCollection:output_type -> ionscale.v1.EnableServiceCollectionResponse
+	60, // 60: ionscale.v1.IonscaleService.DisableServiceCollection:output_type -> ionscale.v1.DisableServiceCollectionResponse
+	61, // 61: ionscale.v1.IonscaleService.EnableSSH:output_type -> ionscale.v1.EnableSSHResponse
+	62, // 62: ionscale.v1.IonscaleService.DisableSSH:output_type -> ionscale.v1.DisableSSHResponse
+	63, // 63: ionscale.v1.IonscaleService.EnableMachineAuthorization:output_type -> ionscale.v1.EnableMachineAuthorizationResponse
+	64, // 64: ionscale.v1.IonscaleService.DisableMachineAuthorization:output_type -> ionscale.v1.DisableMachineAuthorizationResponse
+	65, // 65: ionscale.v1.IonscaleService.GetDNSConfig:output_type -> ionscale.v1.GetDNSConfigResponse
+	66, // 66: ionscale.v1.IonscaleService.SetDNSConfig:output_type -> ionscale.v1.SetDNSConfigResponse
+	67, // 67: ionscale.v1.IonscaleService.GetIAMPolicy:output_type -> ionscale.v1.GetIAMPolicyResponse
+	68, // 68: ionscale.v1.IonscaleService.SetIAMPolicy:output_type -> ionscale.v1.SetIAMPolicyResponse
+	69, // 69: ionscale.v1.IonscaleService.GetACLPolicy:output_type -> ionscale.v1.GetACLPolicyResponse
+	70, // 70: ionscale.v1.IonscaleService.SetACLPolicy:output_type -> ionscale.v1.SetACLPolicyResponse
+	71, // 71: ionscale.v1.IonscaleService.GetAuthKey:output_type -> ionscale.v1.GetAuthKeyResponse
+	72, // 72: ionscale.v1.IonscaleService.CreateAuthKey:output_type -> ionscale.v1.CreateAuthKeyResponse
+	73, // 73: ionscale.v1.IonscaleService.DeleteAuthKey:output_type -> ionscale.v1.DeleteAuthKeyResponse
+	74, // 74: ionscale.v1.IonscaleService.ListAuthKeys:output_type -> ionscale.v1.ListAuthKeysResponse
+	75, // 75: ionscale.v1.IonscaleService.ListUsers:output_type -> ionscale.v1.ListUsersResponse
+	76, // 76: ionscale.v1.IonscaleService.DeleteUser:output_type -> ionscale.v1.DeleteUserResponse
+	77, // 77: ionscale.v1.IonscaleService.GetMachine:output_type -> ionscale.v1.GetMachineResponse
+	78, // 78: ionscale.v1.IonscaleService.ListMachines:output_type -> ionscale.v1.ListMachinesResponse
+	79, // 79: ionscale.v1.IonscaleService.AuthorizeMachine:output_type -> ionscale.v1.AuthorizeMachineResponse
+	80, // 80: ionscale.v1.IonscaleService.ExpireMachine:output_type -> ionscale.v1.ExpireMachineResponse
+	81, // 81: ionscale.v1.IonscaleService.DeleteMachine:output_type -> ionscale.v1.DeleteMachineResponse
+	82, // 82: ionscale.v1.IonscaleService.SetMachineKeyExpiry:output_type -> ionscale.v1.SetMachineKeyExpiryResponse
+	83, // 83: ionscale.v1.IonscaleService.GetMachineRoutes:output_type -> ionscale.v1.GetMachineRoutesResponse
+	84, // 84: ionscale.v1.IonscaleService.EnableMachineRoutes:output_type -> ionscale.v1.EnableMachineRoutesResponse
+	85, // 85: ionscale.v1.IonscaleService.DisableMachineRoutes:output_type -> ionscale.v1.DisableMachineRoutesResponse
+	86, // 86: ionscale.v1.IonscaleService.EnableExitNode:output_type -> ionscale.v1.EnableExitNodeResponse
+	87, // 87: ionscale.v1.IonscaleService.DisableExitNode:output_type -> ionscale.v1.DisableExitNodeResponse
+	44, // [44:88] is the sub-list for method output_type
+	0,  // [0:44] is the sub-list for method input_type
 	0,  // [0:0] is the sub-list for extension type_name
 	0,  // [0:0] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
@@ -481,17 +499,17 @@ func file_ionscale_v1_ionscale_proto_init() {
 	if File_ionscale_v1_ionscale_proto != nil {
 		return
 	}
-	file_ionscale_v1_version_proto_init()
+	file_ionscale_v1_acl_proto_init()
 	file_ionscale_v1_auth_proto_init()
-	file_ionscale_v1_tailnets_proto_init()
-	file_ionscale_v1_users_proto_init()
 	file_ionscale_v1_auth_keys_proto_init()
-	file_ionscale_v1_machines_proto_init()
-	file_ionscale_v1_routes_proto_init()
+	file_ionscale_v1_derp_proto_init()
 	file_ionscale_v1_dns_proto_init()
 	file_ionscale_v1_iam_proto_init()
-	file_ionscale_v1_acl_proto_init()
-	file_ionscale_v1_derp_proto_init()
+	file_ionscale_v1_machines_proto_init()
+	file_ionscale_v1_routes_proto_init()
+	file_ionscale_v1_tailnets_proto_init()
+	file_ionscale_v1_users_proto_init()
+	file_ionscale_v1_version_proto_init()
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
@@ -28,23 +28,26 @@ const (
 // IonscaleServiceClient is a client for the ionscale.v1.IonscaleService service.
 type IonscaleServiceClient interface {
 	GetVersion(context.Context, *connect_go.Request[v1.GetVersionRequest]) (*connect_go.Response[v1.GetVersionResponse], error)
-	Authenticate(context.Context, *connect_go.Request[v1.AuthenticationRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticationResponse], error)
+	Authenticate(context.Context, *connect_go.Request[v1.AuthenticateRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticateResponse], error)
 	GetDefaultDERPMap(context.Context, *connect_go.Request[v1.GetDefaultDERPMapRequest]) (*connect_go.Response[v1.GetDefaultDERPMapResponse], error)
 	SetDefaultDERPMap(context.Context, *connect_go.Request[v1.SetDefaultDERPMapRequest]) (*connect_go.Response[v1.SetDefaultDERPMapResponse], error)
 	ResetDefaultDERPMap(context.Context, *connect_go.Request[v1.ResetDefaultDERPMapRequest]) (*connect_go.Response[v1.ResetDefaultDERPMapResponse], error)
 	CreateTailnet(context.Context, *connect_go.Request[v1.CreateTailnetRequest]) (*connect_go.Response[v1.CreateTailnetResponse], error)
+	UpdateTailnet(context.Context, *connect_go.Request[v1.UpdateTailnetRequest]) (*connect_go.Response[v1.UpdateTailnetResponse], error)
 	GetTailnet(context.Context, *connect_go.Request[v1.GetTailnetRequest]) (*connect_go.Response[v1.GetTailnetResponse], error)
-	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error)
+	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error)
 	DeleteTailnet(context.Context, *connect_go.Request[v1.DeleteTailnetRequest]) (*connect_go.Response[v1.DeleteTailnetResponse], error)
 	GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error)
 	SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error)
 	ResetDERPMap(context.Context, *connect_go.Request[v1.ResetDERPMapRequest]) (*connect_go.Response[v1.ResetDERPMapResponse], error)
-	EnabledFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error)
+	EnableFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error)
 	DisableFileSharing(context.Context, *connect_go.Request[v1.DisableFileSharingRequest]) (*connect_go.Response[v1.DisableFileSharingResponse], error)
-	EnabledServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error)
+	EnableServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error)
 	DisableServiceCollection(context.Context, *connect_go.Request[v1.DisableServiceCollectionRequest]) (*connect_go.Response[v1.DisableServiceCollectionResponse], error)
-	EnabledSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error)
+	EnableSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error)
 	DisableSSH(context.Context, *connect_go.Request[v1.DisableSSHRequest]) (*connect_go.Response[v1.DisableSSHResponse], error)
+	EnableMachineAuthorization(context.Context, *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error)
+	DisableMachineAuthorization(context.Context, *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error)
 	GetDNSConfig(context.Context, *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error)
 	SetDNSConfig(context.Context, *connect_go.Request[v1.SetDNSConfigRequest]) (*connect_go.Response[v1.SetDNSConfigResponse], error)
 	GetIAMPolicy(context.Context, *connect_go.Request[v1.GetIAMPolicyRequest]) (*connect_go.Response[v1.GetIAMPolicyResponse], error)
@@ -59,16 +62,15 @@ type IonscaleServiceClient interface {
 	DeleteUser(context.Context, *connect_go.Request[v1.DeleteUserRequest]) (*connect_go.Response[v1.DeleteUserResponse], error)
 	GetMachine(context.Context, *connect_go.Request[v1.GetMachineRequest]) (*connect_go.Response[v1.GetMachineResponse], error)
 	ListMachines(context.Context, *connect_go.Request[v1.ListMachinesRequest]) (*connect_go.Response[v1.ListMachinesResponse], error)
+	AuthorizeMachine(context.Context, *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error)
 	ExpireMachine(context.Context, *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error)
 	DeleteMachine(context.Context, *connect_go.Request[v1.DeleteMachineRequest]) (*connect_go.Response[v1.DeleteMachineResponse], error)
 	SetMachineKeyExpiry(context.Context, *connect_go.Request[v1.SetMachineKeyExpiryRequest]) (*connect_go.Response[v1.SetMachineKeyExpiryResponse], error)
 	GetMachineRoutes(context.Context, *connect_go.Request[v1.GetMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableHttpsCertificates(context.Context, *connect_go.Request[v1.EnableHttpsCertificatesRequest]) (*connect_go.Response[v1.EnableHttpsCertificatesResponse], error)
-	DisableHttpsCertificates(context.Context, *connect_go.Request[v1.DisableHttpsCertificatesRequest]) (*connect_go.Response[v1.DisableHttpsCertificatesResponse], error)
+	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error)
+	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error)
+	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error)
+	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error)
 }

 // NewIonscaleServiceClient constructs a client for the ionscale.v1.IonscaleService service. By
@@ -86,7 +88,7 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/GetVersion",
 			opts...,
 		),
-		authenticate: connect_go.NewClient[v1.AuthenticationRequest, v1.AuthenticationResponse](
+		authenticate: connect_go.NewClient[v1.AuthenticateRequest, v1.AuthenticateResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/Authenticate",
 			opts...,
@@ -111,12 +113,17 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/CreateTailnet",
 			opts...,
 		),
+		updateTailnet: connect_go.NewClient[v1.UpdateTailnetRequest, v1.UpdateTailnetResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/UpdateTailnet",
+			opts...,
+		),
 		getTailnet: connect_go.NewClient[v1.GetTailnetRequest, v1.GetTailnetResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/GetTailnet",
 			opts...,
 		),
-		listTailnets: connect_go.NewClient[v1.ListTailnetRequest, v1.ListTailnetResponse](
+		listTailnets: connect_go.NewClient[v1.ListTailnetsRequest, v1.ListTailnetsResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/ListTailnets",
 			opts...,
@@ -141,9 +148,9 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/ResetDERPMap",
 			opts...,
 		),
-		enabledFileSharing: connect_go.NewClient[v1.EnableFileSharingRequest, v1.EnableFileSharingResponse](
+		enableFileSharing: connect_go.NewClient[v1.EnableFileSharingRequest, v1.EnableFileSharingResponse](
 			httpClient,
-			baseURL+"/ionscale.v1.IonscaleService/EnabledFileSharing",
+			baseURL+"/ionscale.v1.IonscaleService/EnableFileSharing",
 			opts...,
 		),
 		disableFileSharing: connect_go.NewClient[v1.DisableFileSharingRequest, v1.DisableFileSharingResponse](
@@ -151,9 +158,9 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/DisableFileSharing",
 			opts...,
 		),
-		enabledServiceCollection: connect_go.NewClient[v1.EnableServiceCollectionRequest, v1.EnableServiceCollectionResponse](
+		enableServiceCollection: connect_go.NewClient[v1.EnableServiceCollectionRequest, v1.EnableServiceCollectionResponse](
 			httpClient,
-			baseURL+"/ionscale.v1.IonscaleService/EnabledServiceCollection",
+			baseURL+"/ionscale.v1.IonscaleService/EnableServiceCollection",
 			opts...,
 		),
 		disableServiceCollection: connect_go.NewClient[v1.DisableServiceCollectionRequest, v1.DisableServiceCollectionResponse](
@@ -161,9 +168,9 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/DisableServiceCollection",
 			opts...,
 		),
-		enabledSSH: connect_go.NewClient[v1.EnableSSHRequest, v1.EnableSSHResponse](
+		enableSSH: connect_go.NewClient[v1.EnableSSHRequest, v1.EnableSSHResponse](
 			httpClient,
-			baseURL+"/ionscale.v1.IonscaleService/EnabledSSH",
+			baseURL+"/ionscale.v1.IonscaleService/EnableSSH",
 			opts...,
 		),
 		disableSSH: connect_go.NewClient[v1.DisableSSHRequest, v1.DisableSSHResponse](
@@ -171,6 +178,16 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/DisableSSH",
 			opts...,
 		),
+		enableMachineAuthorization: connect_go.NewClient[v1.EnableMachineAuthorizationRequest, v1.EnableMachineAuthorizationResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/EnableMachineAuthorization",
+			opts...,
+		),
+		disableMachineAuthorization: connect_go.NewClient[v1.DisableMachineAuthorizationRequest, v1.DisableMachineAuthorizationResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/DisableMachineAuthorization",
+			opts...,
+		),
 		getDNSConfig: connect_go.NewClient[v1.GetDNSConfigRequest, v1.GetDNSConfigResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/GetDNSConfig",
@@ -241,6 +258,11 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/ListMachines",
 			opts...,
 		),
+		authorizeMachine: connect_go.NewClient[v1.AuthorizeMachineRequest, v1.AuthorizeMachineResponse](
+			httpClient,
+			baseURL+"/ionscale.v1.IonscaleService/AuthorizeMachine",
+			opts...,
+		),
 		expireMachine: connect_go.NewClient[v1.ExpireMachineRequest, v1.ExpireMachineResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/ExpireMachine",
@@ -261,83 +283,75 @@ func NewIonscaleServiceClient(httpClient connect_go.HTTPClient, baseURL string,
 			baseURL+"/ionscale.v1.IonscaleService/GetMachineRoutes",
 			opts...,
 		),
-		enableMachineRoutes: connect_go.NewClient[v1.EnableMachineRoutesRequest, v1.GetMachineRoutesResponse](
+		enableMachineRoutes: connect_go.NewClient[v1.EnableMachineRoutesRequest, v1.EnableMachineRoutesResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/EnableMachineRoutes",
 			opts...,
 		),
-		disableMachineRoutes: connect_go.NewClient[v1.DisableMachineRoutesRequest, v1.GetMachineRoutesResponse](
+		disableMachineRoutes: connect_go.NewClient[v1.DisableMachineRoutesRequest, v1.DisableMachineRoutesResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/DisableMachineRoutes",
 			opts...,
 		),
-		enableExitNode: connect_go.NewClient[v1.EnableExitNodeRequest, v1.GetMachineRoutesResponse](
+		enableExitNode: connect_go.NewClient[v1.EnableExitNodeRequest, v1.EnableExitNodeResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/EnableExitNode",
 			opts...,
 		),
-		disableExitNode: connect_go.NewClient[v1.DisableExitNodeRequest, v1.GetMachineRoutesResponse](
+		disableExitNode: connect_go.NewClient[v1.DisableExitNodeRequest, v1.DisableExitNodeResponse](
 			httpClient,
 			baseURL+"/ionscale.v1.IonscaleService/DisableExitNode",
 			opts...,
 		),
-		enableHttpsCertificates: connect_go.NewClient[v1.EnableHttpsCertificatesRequest, v1.EnableHttpsCertificatesResponse](
-			httpClient,
-			baseURL+"/ionscale.v1.IonscaleService/EnableHttpsCertificates",
-			opts...,
-		),
-		disableHttpsCertificates: connect_go.NewClient[v1.DisableHttpsCertificatesRequest, v1.DisableHttpsCertificatesResponse](
-			httpClient,
-			baseURL+"/ionscale.v1.IonscaleService/DisableHttpsCertificates",
-			opts...,
-		),
 	}
 }

 // ionscaleServiceClient implements IonscaleServiceClient.
 type ionscaleServiceClient struct {
-	getVersion               *connect_go.Client[v1.GetVersionRequest, v1.GetVersionResponse]
-	authenticate             *connect_go.Client[v1.AuthenticationRequest, v1.AuthenticationResponse]
-	getDefaultDERPMap        *connect_go.Client[v1.GetDefaultDERPMapRequest, v1.GetDefaultDERPMapResponse]
-	setDefaultDERPMap        *connect_go.Client[v1.SetDefaultDERPMapRequest, v1.SetDefaultDERPMapResponse]
-	resetDefaultDERPMap      *connect_go.Client[v1.ResetDefaultDERPMapRequest, v1.ResetDefaultDERPMapResponse]
-	createTailnet            *connect_go.Client[v1.CreateTailnetRequest, v1.CreateTailnetResponse]
-	getTailnet               *connect_go.Client[v1.GetTailnetRequest, v1.GetTailnetResponse]
-	listTailnets             *connect_go.Client[v1.ListTailnetRequest, v1.ListTailnetResponse]
-	deleteTailnet            *connect_go.Client[v1.DeleteTailnetRequest, v1.DeleteTailnetResponse]
-	getDERPMap               *connect_go.Client[v1.GetDERPMapRequest, v1.GetDERPMapResponse]
-	setDERPMap               *connect_go.Client[v1.SetDERPMapRequest, v1.SetDERPMapResponse]
-	resetDERPMap             *connect_go.Client[v1.ResetDERPMapRequest, v1.ResetDERPMapResponse]
-	enabledFileSharing       *connect_go.Client[v1.EnableFileSharingRequest, v1.EnableFileSharingResponse]
-	disableFileSharing       *connect_go.Client[v1.DisableFileSharingRequest, v1.DisableFileSharingResponse]
-	enabledServiceCollection *connect_go.Client[v1.EnableServiceCollectionRequest, v1.EnableServiceCollectionResponse]
-	disableServiceCollection *connect_go.Client[v1.DisableServiceCollectionRequest, v1.DisableServiceCollectionResponse]
-	enabledSSH               *connect_go.Client[v1.EnableSSHRequest, v1.EnableSSHResponse]
-	disableSSH               *connect_go.Client[v1.DisableSSHRequest, v1.DisableSSHResponse]
-	getDNSConfig             *connect_go.Client[v1.GetDNSConfigRequest, v1.GetDNSConfigResponse]
-	setDNSConfig             *connect_go.Client[v1.SetDNSConfigRequest, v1.SetDNSConfigResponse]
-	getIAMPolicy             *connect_go.Client[v1.GetIAMPolicyRequest, v1.GetIAMPolicyResponse]
-	setIAMPolicy             *connect_go.Client[v1.SetIAMPolicyRequest, v1.SetIAMPolicyResponse]
-	getACLPolicy             *connect_go.Client[v1.GetACLPolicyRequest, v1.GetACLPolicyResponse]
-	setACLPolicy             *connect_go.Client[v1.SetACLPolicyRequest, v1.SetACLPolicyResponse]
-	getAuthKey               *connect_go.Client[v1.GetAuthKeyRequest, v1.GetAuthKeyResponse]
-	createAuthKey            *connect_go.Client[v1.CreateAuthKeyRequest, v1.CreateAuthKeyResponse]
-	deleteAuthKey            *connect_go.Client[v1.DeleteAuthKeyRequest, v1.DeleteAuthKeyResponse]
-	listAuthKeys             *connect_go.Client[v1.ListAuthKeysRequest, v1.ListAuthKeysResponse]
-	listUsers                *connect_go.Client[v1.ListUsersRequest, v1.ListUsersResponse]
-	deleteUser               *connect_go.Client[v1.DeleteUserRequest, v1.DeleteUserResponse]
-	getMachine               *connect_go.Client[v1.GetMachineRequest, v1.GetMachineResponse]
-	listMachines             *connect_go.Client[v1.ListMachinesRequest, v1.ListMachinesResponse]
-	expireMachine            *connect_go.Client[v1.ExpireMachineRequest, v1.ExpireMachineResponse]
-	deleteMachine            *connect_go.Client[v1.DeleteMachineRequest, v1.DeleteMachineResponse]
-	setMachineKeyExpiry      *connect_go.Client[v1.SetMachineKeyExpiryRequest, v1.SetMachineKeyExpiryResponse]
-	getMachineRoutes         *connect_go.Client[v1.GetMachineRoutesRequest, v1.GetMachineRoutesResponse]
-	enableMachineRoutes      *connect_go.Client[v1.EnableMachineRoutesRequest, v1.GetMachineRoutesResponse]
-	disableMachineRoutes     *connect_go.Client[v1.DisableMachineRoutesRequest, v1.GetMachineRoutesResponse]
-	enableExitNode           *connect_go.Client[v1.EnableExitNodeRequest, v1.GetMachineRoutesResponse]
-	disableExitNode          *connect_go.Client[v1.DisableExitNodeRequest, v1.GetMachineRoutesResponse]
-	enableHttpsCertificates  *connect_go.Client[v1.EnableHttpsCertificatesRequest, v1.EnableHttpsCertificatesResponse]
-	disableHttpsCertificates *connect_go.Client[v1.DisableHttpsCertificatesRequest, v1.DisableHttpsCertificatesResponse]
+	getVersion                  *connect_go.Client[v1.GetVersionRequest, v1.GetVersionResponse]
+	authenticate                *connect_go.Client[v1.AuthenticateRequest, v1.AuthenticateResponse]
+	getDefaultDERPMap           *connect_go.Client[v1.GetDefaultDERPMapRequest, v1.GetDefaultDERPMapResponse]
+	setDefaultDERPMap           *connect_go.Client[v1.SetDefaultDERPMapRequest, v1.SetDefaultDERPMapResponse]
+	resetDefaultDERPMap         *connect_go.Client[v1.ResetDefaultDERPMapRequest, v1.ResetDefaultDERPMapResponse]
+	createTailnet               *connect_go.Client[v1.CreateTailnetRequest, v1.CreateTailnetResponse]
+	updateTailnet               *connect_go.Client[v1.UpdateTailnetRequest, v1.UpdateTailnetResponse]
+	getTailnet                  *connect_go.Client[v1.GetTailnetRequest, v1.GetTailnetResponse]
+	listTailnets                *connect_go.Client[v1.ListTailnetsRequest, v1.ListTailnetsResponse]
+	deleteTailnet               *connect_go.Client[v1.DeleteTailnetRequest, v1.DeleteTailnetResponse]
+	getDERPMap                  *connect_go.Client[v1.GetDERPMapRequest, v1.GetDERPMapResponse]
+	setDERPMap                  *connect_go.Client[v1.SetDERPMapRequest, v1.SetDERPMapResponse]
+	resetDERPMap                *connect_go.Client[v1.ResetDERPMapRequest, v1.ResetDERPMapResponse]
+	enableFileSharing           *connect_go.Client[v1.EnableFileSharingRequest, v1.EnableFileSharingResponse]
+	disableFileSharing          *connect_go.Client[v1.DisableFileSharingRequest, v1.DisableFileSharingResponse]
+	enableServiceCollection     *connect_go.Client[v1.EnableServiceCollectionRequest, v1.EnableServiceCollectionResponse]
+	disableServiceCollection    *connect_go.Client[v1.DisableServiceCollectionRequest, v1.DisableServiceCollectionResponse]
+	enableSSH                   *connect_go.Client[v1.EnableSSHRequest, v1.EnableSSHResponse]
+	disableSSH                  *connect_go.Client[v1.DisableSSHRequest, v1.DisableSSHResponse]
+	enableMachineAuthorization  *connect_go.Client[v1.EnableMachineAuthorizationRequest, v1.EnableMachineAuthorizationResponse]
+	disableMachineAuthorization *connect_go.Client[v1.DisableMachineAuthorizationRequest, v1.DisableMachineAuthorizationResponse]
+	getDNSConfig                *connect_go.Client[v1.GetDNSConfigRequest, v1.GetDNSConfigResponse]
+	setDNSConfig                *connect_go.Client[v1.SetDNSConfigRequest, v1.SetDNSConfigResponse]
+	getIAMPolicy                *connect_go.Client[v1.GetIAMPolicyRequest, v1.GetIAMPolicyResponse]
+	setIAMPolicy                *connect_go.Client[v1.SetIAMPolicyRequest, v1.SetIAMPolicyResponse]
+	getACLPolicy                *connect_go.Client[v1.GetACLPolicyRequest, v1.GetACLPolicyResponse]
+	setACLPolicy                *connect_go.Client[v1.SetACLPolicyRequest, v1.SetACLPolicyResponse]
+	getAuthKey                  *connect_go.Client[v1.GetAuthKeyRequest, v1.GetAuthKeyResponse]
+	createAuthKey               *connect_go.Client[v1.CreateAuthKeyRequest, v1.CreateAuthKeyResponse]
+	deleteAuthKey               *connect_go.Client[v1.DeleteAuthKeyRequest, v1.DeleteAuthKeyResponse]
+	listAuthKeys                *connect_go.Client[v1.ListAuthKeysRequest, v1.ListAuthKeysResponse]
+	listUsers                   *connect_go.Client[v1.ListUsersRequest, v1.ListUsersResponse]
+	deleteUser                  *connect_go.Client[v1.DeleteUserRequest, v1.DeleteUserResponse]
+	getMachine                  *connect_go.Client[v1.GetMachineRequest, v1.GetMachineResponse]
+	listMachines                *connect_go.Client[v1.ListMachinesRequest, v1.ListMachinesResponse]
+	authorizeMachine            *connect_go.Client[v1.AuthorizeMachineRequest, v1.AuthorizeMachineResponse]
+	expireMachine               *connect_go.Client[v1.ExpireMachineRequest, v1.ExpireMachineResponse]
+	deleteMachine               *connect_go.Client[v1.DeleteMachineRequest, v1.DeleteMachineResponse]
+	setMachineKeyExpiry         *connect_go.Client[v1.SetMachineKeyExpiryRequest, v1.SetMachineKeyExpiryResponse]
+	getMachineRoutes            *connect_go.Client[v1.GetMachineRoutesRequest, v1.GetMachineRoutesResponse]
+	enableMachineRoutes         *connect_go.Client[v1.EnableMachineRoutesRequest, v1.EnableMachineRoutesResponse]
+	disableMachineRoutes        *connect_go.Client[v1.DisableMachineRoutesRequest, v1.DisableMachineRoutesResponse]
+	enableExitNode              *connect_go.Client[v1.EnableExitNodeRequest, v1.EnableExitNodeResponse]
+	disableExitNode             *connect_go.Client[v1.DisableExitNodeRequest, v1.DisableExitNodeResponse]
 }

 // GetVersion calls ionscale.v1.IonscaleService.GetVersion.
@@ -346,7 +360,7 @@ func (c *ionscaleServiceClient) GetVersion(ctx context.Context, req *connect_go.
 }

 // Authenticate calls ionscale.v1.IonscaleService.Authenticate.
-func (c *ionscaleServiceClient) Authenticate(ctx context.Context, req *connect_go.Request[v1.AuthenticationRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticationResponse], error) {
+func (c *ionscaleServiceClient) Authenticate(ctx context.Context, req *connect_go.Request[v1.AuthenticateRequest]) (*connect_go.ServerStreamForClient[v1.AuthenticateResponse], error) {
 	return c.authenticate.CallServerStream(ctx, req)
 }

@@ -370,13 +384,18 @@ func (c *ionscaleServiceClient) CreateTailnet(ctx context.Context, req *connect_
 	return c.createTailnet.CallUnary(ctx, req)
 }

+// UpdateTailnet calls ionscale.v1.IonscaleService.UpdateTailnet.
+func (c *ionscaleServiceClient) UpdateTailnet(ctx context.Context, req *connect_go.Request[v1.UpdateTailnetRequest]) (*connect_go.Response[v1.UpdateTailnetResponse], error) {
+	return c.updateTailnet.CallUnary(ctx, req)
+}
+
 // GetTailnet calls ionscale.v1.IonscaleService.GetTailnet.
 func (c *ionscaleServiceClient) GetTailnet(ctx context.Context, req *connect_go.Request[v1.GetTailnetRequest]) (*connect_go.Response[v1.GetTailnetResponse], error) {
 	return c.getTailnet.CallUnary(ctx, req)
 }

 // ListTailnets calls ionscale.v1.IonscaleService.ListTailnets.
-func (c *ionscaleServiceClient) ListTailnets(ctx context.Context, req *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error) {
+func (c *ionscaleServiceClient) ListTailnets(ctx context.Context, req *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error) {
 	return c.listTailnets.CallUnary(ctx, req)
 }

@@ -400,9 +419,9 @@ func (c *ionscaleServiceClient) ResetDERPMap(ctx context.Context, req *connect_g
 	return c.resetDERPMap.CallUnary(ctx, req)
 }

-// EnabledFileSharing calls ionscale.v1.IonscaleService.EnabledFileSharing.
-func (c *ionscaleServiceClient) EnabledFileSharing(ctx context.Context, req *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error) {
-	return c.enabledFileSharing.CallUnary(ctx, req)
+// EnableFileSharing calls ionscale.v1.IonscaleService.EnableFileSharing.
+func (c *ionscaleServiceClient) EnableFileSharing(ctx context.Context, req *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error) {
+	return c.enableFileSharing.CallUnary(ctx, req)
 }

 // DisableFileSharing calls ionscale.v1.IonscaleService.DisableFileSharing.
@@ -410,9 +429,9 @@ func (c *ionscaleServiceClient) DisableFileSharing(ctx context.Context, req *con
 	return c.disableFileSharing.CallUnary(ctx, req)
 }

-// EnabledServiceCollection calls ionscale.v1.IonscaleService.EnabledServiceCollection.
-func (c *ionscaleServiceClient) EnabledServiceCollection(ctx context.Context, req *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error) {
-	return c.enabledServiceCollection.CallUnary(ctx, req)
+// EnableServiceCollection calls ionscale.v1.IonscaleService.EnableServiceCollection.
+func (c *ionscaleServiceClient) EnableServiceCollection(ctx context.Context, req *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error) {
+	return c.enableServiceCollection.CallUnary(ctx, req)
 }

 // DisableServiceCollection calls ionscale.v1.IonscaleService.DisableServiceCollection.
@@ -420,9 +439,9 @@ func (c *ionscaleServiceClient) DisableServiceCollection(ctx context.Context, re
 	return c.disableServiceCollection.CallUnary(ctx, req)
 }

-// EnabledSSH calls ionscale.v1.IonscaleService.EnabledSSH.
-func (c *ionscaleServiceClient) EnabledSSH(ctx context.Context, req *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error) {
-	return c.enabledSSH.CallUnary(ctx, req)
+// EnableSSH calls ionscale.v1.IonscaleService.EnableSSH.
+func (c *ionscaleServiceClient) EnableSSH(ctx context.Context, req *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error) {
+	return c.enableSSH.CallUnary(ctx, req)
 }

 // DisableSSH calls ionscale.v1.IonscaleService.DisableSSH.
@@ -430,6 +449,16 @@ func (c *ionscaleServiceClient) DisableSSH(ctx context.Context, req *connect_go.
 	return c.disableSSH.CallUnary(ctx, req)
 }

+// EnableMachineAuthorization calls ionscale.v1.IonscaleService.EnableMachineAuthorization.
+func (c *ionscaleServiceClient) EnableMachineAuthorization(ctx context.Context, req *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error) {
+	return c.enableMachineAuthorization.CallUnary(ctx, req)
+}
+
+// DisableMachineAuthorization calls ionscale.v1.IonscaleService.DisableMachineAuthorization.
+func (c *ionscaleServiceClient) DisableMachineAuthorization(ctx context.Context, req *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error) {
+	return c.disableMachineAuthorization.CallUnary(ctx, req)
+}
+
 // GetDNSConfig calls ionscale.v1.IonscaleService.GetDNSConfig.
 func (c *ionscaleServiceClient) GetDNSConfig(ctx context.Context, req *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error) {
 	return c.getDNSConfig.CallUnary(ctx, req)
@@ -500,6 +529,11 @@ func (c *ionscaleServiceClient) ListMachines(ctx context.Context, req *connect_g
 	return c.listMachines.CallUnary(ctx, req)
 }

+// AuthorizeMachine calls ionscale.v1.IonscaleService.AuthorizeMachine.
+func (c *ionscaleServiceClient) AuthorizeMachine(ctx context.Context, req *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error) {
+	return c.authorizeMachine.CallUnary(ctx, req)
+}
+
 // ExpireMachine calls ionscale.v1.IonscaleService.ExpireMachine.
 func (c *ionscaleServiceClient) ExpireMachine(ctx context.Context, req *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error) {
 	return c.expireMachine.CallUnary(ctx, req)
@@ -521,55 +555,48 @@ func (c *ionscaleServiceClient) GetMachineRoutes(ctx context.Context, req *conne
 }

 // EnableMachineRoutes calls ionscale.v1.IonscaleService.EnableMachineRoutes.
-func (c *ionscaleServiceClient) EnableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) EnableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error) {
 	return c.enableMachineRoutes.CallUnary(ctx, req)
 }

 // DisableMachineRoutes calls ionscale.v1.IonscaleService.DisableMachineRoutes.
-func (c *ionscaleServiceClient) DisableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) DisableMachineRoutes(ctx context.Context, req *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error) {
 	return c.disableMachineRoutes.CallUnary(ctx, req)
 }

 // EnableExitNode calls ionscale.v1.IonscaleService.EnableExitNode.
-func (c *ionscaleServiceClient) EnableExitNode(ctx context.Context, req *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) EnableExitNode(ctx context.Context, req *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error) {
 	return c.enableExitNode.CallUnary(ctx, req)
 }

 // DisableExitNode calls ionscale.v1.IonscaleService.DisableExitNode.
-func (c *ionscaleServiceClient) DisableExitNode(ctx context.Context, req *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (c *ionscaleServiceClient) DisableExitNode(ctx context.Context, req *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error) {
 	return c.disableExitNode.CallUnary(ctx, req)
 }

-// EnableHttpsCertificates calls ionscale.v1.IonscaleService.EnableHttpsCertificates.
-func (c *ionscaleServiceClient) EnableHttpsCertificates(ctx context.Context, req *connect_go.Request[v1.EnableHttpsCertificatesRequest]) (*connect_go.Response[v1.EnableHttpsCertificatesResponse], error) {
-	return c.enableHttpsCertificates.CallUnary(ctx, req)
-}
-
-// DisableHttpsCertificates calls ionscale.v1.IonscaleService.DisableHttpsCertificates.
-func (c *ionscaleServiceClient) DisableHttpsCertificates(ctx context.Context, req *connect_go.Request[v1.DisableHttpsCertificatesRequest]) (*connect_go.Response[v1.DisableHttpsCertificatesResponse], error) {
-	return c.disableHttpsCertificates.CallUnary(ctx, req)
-}
-
 // IonscaleServiceHandler is an implementation of the ionscale.v1.IonscaleService service.
 type IonscaleServiceHandler interface {
 	GetVersion(context.Context, *connect_go.Request[v1.GetVersionRequest]) (*connect_go.Response[v1.GetVersionResponse], error)
-	Authenticate(context.Context, *connect_go.Request[v1.AuthenticationRequest], *connect_go.ServerStream[v1.AuthenticationResponse]) error
+	Authenticate(context.Context, *connect_go.Request[v1.AuthenticateRequest], *connect_go.ServerStream[v1.AuthenticateResponse]) error
 	GetDefaultDERPMap(context.Context, *connect_go.Request[v1.GetDefaultDERPMapRequest]) (*connect_go.Response[v1.GetDefaultDERPMapResponse], error)
 	SetDefaultDERPMap(context.Context, *connect_go.Request[v1.SetDefaultDERPMapRequest]) (*connect_go.Response[v1.SetDefaultDERPMapResponse], error)
 	ResetDefaultDERPMap(context.Context, *connect_go.Request[v1.ResetDefaultDERPMapRequest]) (*connect_go.Response[v1.ResetDefaultDERPMapResponse], error)
 	CreateTailnet(context.Context, *connect_go.Request[v1.CreateTailnetRequest]) (*connect_go.Response[v1.CreateTailnetResponse], error)
+	UpdateTailnet(context.Context, *connect_go.Request[v1.UpdateTailnetRequest]) (*connect_go.Response[v1.UpdateTailnetResponse], error)
 	GetTailnet(context.Context, *connect_go.Request[v1.GetTailnetRequest]) (*connect_go.Response[v1.GetTailnetResponse], error)
-	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error)
+	ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error)
 	DeleteTailnet(context.Context, *connect_go.Request[v1.DeleteTailnetRequest]) (*connect_go.Response[v1.DeleteTailnetResponse], error)
 	GetDERPMap(context.Context, *connect_go.Request[v1.GetDERPMapRequest]) (*connect_go.Response[v1.GetDERPMapResponse], error)
 	SetDERPMap(context.Context, *connect_go.Request[v1.SetDERPMapRequest]) (*connect_go.Response[v1.SetDERPMapResponse], error)
 	ResetDERPMap(context.Context, *connect_go.Request[v1.ResetDERPMapRequest]) (*connect_go.Response[v1.ResetDERPMapResponse], error)
-	EnabledFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error)
+	EnableFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error)
 	DisableFileSharing(context.Context, *connect_go.Request[v1.DisableFileSharingRequest]) (*connect_go.Response[v1.DisableFileSharingResponse], error)
-	EnabledServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error)
+	EnableServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error)
 	DisableServiceCollection(context.Context, *connect_go.Request[v1.DisableServiceCollectionRequest]) (*connect_go.Response[v1.DisableServiceCollectionResponse], error)
-	EnabledSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error)
+	EnableSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error)
 	DisableSSH(context.Context, *connect_go.Request[v1.DisableSSHRequest]) (*connect_go.Response[v1.DisableSSHResponse], error)
+	EnableMachineAuthorization(context.Context, *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error)
+	DisableMachineAuthorization(context.Context, *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error)
 	GetDNSConfig(context.Context, *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error)
 	SetDNSConfig(context.Context, *connect_go.Request[v1.SetDNSConfigRequest]) (*connect_go.Response[v1.SetDNSConfigResponse], error)
 	GetIAMPolicy(context.Context, *connect_go.Request[v1.GetIAMPolicyRequest]) (*connect_go.Response[v1.GetIAMPolicyResponse], error)
@@ -584,16 +611,15 @@ type IonscaleServiceHandler interface {
 	DeleteUser(context.Context, *connect_go.Request[v1.DeleteUserRequest]) (*connect_go.Response[v1.DeleteUserResponse], error)
 	GetMachine(context.Context, *connect_go.Request[v1.GetMachineRequest]) (*connect_go.Response[v1.GetMachineResponse], error)
 	ListMachines(context.Context, *connect_go.Request[v1.ListMachinesRequest]) (*connect_go.Response[v1.ListMachinesResponse], error)
+	AuthorizeMachine(context.Context, *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error)
 	ExpireMachine(context.Context, *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error)
 	DeleteMachine(context.Context, *connect_go.Request[v1.DeleteMachineRequest]) (*connect_go.Response[v1.DeleteMachineResponse], error)
 	SetMachineKeyExpiry(context.Context, *connect_go.Request[v1.SetMachineKeyExpiryRequest]) (*connect_go.Response[v1.SetMachineKeyExpiryResponse], error)
 	GetMachineRoutes(context.Context, *connect_go.Request[v1.GetMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error)
-	EnableHttpsCertificates(context.Context, *connect_go.Request[v1.EnableHttpsCertificatesRequest]) (*connect_go.Response[v1.EnableHttpsCertificatesResponse], error)
-	DisableHttpsCertificates(context.Context, *connect_go.Request[v1.DisableHttpsCertificatesRequest]) (*connect_go.Response[v1.DisableHttpsCertificatesResponse], error)
+	EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error)
+	DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error)
+	EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error)
+	DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error)
 }

 // NewIonscaleServiceHandler builds an HTTP handler from the service implementation. It returns the
@@ -633,6 +659,11 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.CreateTailnet,
 		opts...,
 	))
+	mux.Handle("/ionscale.v1.IonscaleService/UpdateTailnet", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/UpdateTailnet",
+		svc.UpdateTailnet,
+		opts...,
+	))
 	mux.Handle("/ionscale.v1.IonscaleService/GetTailnet", connect_go.NewUnaryHandler(
 		"/ionscale.v1.IonscaleService/GetTailnet",
 		svc.GetTailnet,
@@ -663,9 +694,9 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.ResetDERPMap,
 		opts...,
 	))
-	mux.Handle("/ionscale.v1.IonscaleService/EnabledFileSharing", connect_go.NewUnaryHandler(
-		"/ionscale.v1.IonscaleService/EnabledFileSharing",
-		svc.EnabledFileSharing,
+	mux.Handle("/ionscale.v1.IonscaleService/EnableFileSharing", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableFileSharing",
+		svc.EnableFileSharing,
 		opts...,
 	))
 	mux.Handle("/ionscale.v1.IonscaleService/DisableFileSharing", connect_go.NewUnaryHandler(
@@ -673,9 +704,9 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.DisableFileSharing,
 		opts...,
 	))
-	mux.Handle("/ionscale.v1.IonscaleService/EnabledServiceCollection", connect_go.NewUnaryHandler(
-		"/ionscale.v1.IonscaleService/EnabledServiceCollection",
-		svc.EnabledServiceCollection,
+	mux.Handle("/ionscale.v1.IonscaleService/EnableServiceCollection", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableServiceCollection",
+		svc.EnableServiceCollection,
 		opts...,
 	))
 	mux.Handle("/ionscale.v1.IonscaleService/DisableServiceCollection", connect_go.NewUnaryHandler(
@@ -683,9 +714,9 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.DisableServiceCollection,
 		opts...,
 	))
-	mux.Handle("/ionscale.v1.IonscaleService/EnabledSSH", connect_go.NewUnaryHandler(
-		"/ionscale.v1.IonscaleService/EnabledSSH",
-		svc.EnabledSSH,
+	mux.Handle("/ionscale.v1.IonscaleService/EnableSSH", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableSSH",
+		svc.EnableSSH,
 		opts...,
 	))
 	mux.Handle("/ionscale.v1.IonscaleService/DisableSSH", connect_go.NewUnaryHandler(
@@ -693,6 +724,16 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.DisableSSH,
 		opts...,
 	))
+	mux.Handle("/ionscale.v1.IonscaleService/EnableMachineAuthorization", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/EnableMachineAuthorization",
+		svc.EnableMachineAuthorization,
+		opts...,
+	))
+	mux.Handle("/ionscale.v1.IonscaleService/DisableMachineAuthorization", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/DisableMachineAuthorization",
+		svc.DisableMachineAuthorization,
+		opts...,
+	))
 	mux.Handle("/ionscale.v1.IonscaleService/GetDNSConfig", connect_go.NewUnaryHandler(
 		"/ionscale.v1.IonscaleService/GetDNSConfig",
 		svc.GetDNSConfig,
@@ -763,6 +804,11 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.ListMachines,
 		opts...,
 	))
+	mux.Handle("/ionscale.v1.IonscaleService/AuthorizeMachine", connect_go.NewUnaryHandler(
+		"/ionscale.v1.IonscaleService/AuthorizeMachine",
+		svc.AuthorizeMachine,
+		opts...,
+	))
 	mux.Handle("/ionscale.v1.IonscaleService/ExpireMachine", connect_go.NewUnaryHandler(
 		"/ionscale.v1.IonscaleService/ExpireMachine",
 		svc.ExpireMachine,
@@ -803,16 +849,6 @@ func NewIonscaleServiceHandler(svc IonscaleServiceHandler, opts ...connect_go.Ha
 		svc.DisableExitNode,
 		opts...,
 	))
-	mux.Handle("/ionscale.v1.IonscaleService/EnableHttpsCertificates", connect_go.NewUnaryHandler(
-		"/ionscale.v1.IonscaleService/EnableHttpsCertificates",
-		svc.EnableHttpsCertificates,
-		opts...,
-	))
-	mux.Handle("/ionscale.v1.IonscaleService/DisableHttpsCertificates", connect_go.NewUnaryHandler(
-		"/ionscale.v1.IonscaleService/DisableHttpsCertificates",
-		svc.DisableHttpsCertificates,
-		opts...,
-	))
 	return "/ionscale.v1.IonscaleService/", mux
 }

@@ -823,7 +859,7 @@ func (UnimplementedIonscaleServiceHandler) GetVersion(context.Context, *connect_
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetVersion is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) Authenticate(context.Context, *connect_go.Request[v1.AuthenticationRequest], *connect_go.ServerStream[v1.AuthenticationResponse]) error {
+func (UnimplementedIonscaleServiceHandler) Authenticate(context.Context, *connect_go.Request[v1.AuthenticateRequest], *connect_go.ServerStream[v1.AuthenticateResponse]) error {
 	return connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.Authenticate is not implemented"))
 }

@@ -843,11 +879,15 @@ func (UnimplementedIonscaleServiceHandler) CreateTailnet(context.Context, *conne
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.CreateTailnet is not implemented"))
 }

+func (UnimplementedIonscaleServiceHandler) UpdateTailnet(context.Context, *connect_go.Request[v1.UpdateTailnetRequest]) (*connect_go.Response[v1.UpdateTailnetResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.UpdateTailnet is not implemented"))
+}
+
 func (UnimplementedIonscaleServiceHandler) GetTailnet(context.Context, *connect_go.Request[v1.GetTailnetRequest]) (*connect_go.Response[v1.GetTailnetResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetTailnet is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetRequest]) (*connect_go.Response[v1.ListTailnetResponse], error) {
+func (UnimplementedIonscaleServiceHandler) ListTailnets(context.Context, *connect_go.Request[v1.ListTailnetsRequest]) (*connect_go.Response[v1.ListTailnetsResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ListTailnets is not implemented"))
 }

@@ -867,30 +907,38 @@ func (UnimplementedIonscaleServiceHandler) ResetDERPMap(context.Context, *connec
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ResetDERPMap is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) EnabledFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error) {
-	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnabledFileSharing is not implemented"))
+func (UnimplementedIonscaleServiceHandler) EnableFileSharing(context.Context, *connect_go.Request[v1.EnableFileSharingRequest]) (*connect_go.Response[v1.EnableFileSharingResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableFileSharing is not implemented"))
 }

 func (UnimplementedIonscaleServiceHandler) DisableFileSharing(context.Context, *connect_go.Request[v1.DisableFileSharingRequest]) (*connect_go.Response[v1.DisableFileSharingResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableFileSharing is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) EnabledServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error) {
-	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnabledServiceCollection is not implemented"))
+func (UnimplementedIonscaleServiceHandler) EnableServiceCollection(context.Context, *connect_go.Request[v1.EnableServiceCollectionRequest]) (*connect_go.Response[v1.EnableServiceCollectionResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableServiceCollection is not implemented"))
 }

 func (UnimplementedIonscaleServiceHandler) DisableServiceCollection(context.Context, *connect_go.Request[v1.DisableServiceCollectionRequest]) (*connect_go.Response[v1.DisableServiceCollectionResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableServiceCollection is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) EnabledSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error) {
-	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnabledSSH is not implemented"))
+func (UnimplementedIonscaleServiceHandler) EnableSSH(context.Context, *connect_go.Request[v1.EnableSSHRequest]) (*connect_go.Response[v1.EnableSSHResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableSSH is not implemented"))
 }

 func (UnimplementedIonscaleServiceHandler) DisableSSH(context.Context, *connect_go.Request[v1.DisableSSHRequest]) (*connect_go.Response[v1.DisableSSHResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableSSH is not implemented"))
 }

+func (UnimplementedIonscaleServiceHandler) EnableMachineAuthorization(context.Context, *connect_go.Request[v1.EnableMachineAuthorizationRequest]) (*connect_go.Response[v1.EnableMachineAuthorizationResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableMachineAuthorization is not implemented"))
+}
+
+func (UnimplementedIonscaleServiceHandler) DisableMachineAuthorization(context.Context, *connect_go.Request[v1.DisableMachineAuthorizationRequest]) (*connect_go.Response[v1.DisableMachineAuthorizationResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableMachineAuthorization is not implemented"))
+}
+
 func (UnimplementedIonscaleServiceHandler) GetDNSConfig(context.Context, *connect_go.Request[v1.GetDNSConfigRequest]) (*connect_go.Response[v1.GetDNSConfigResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetDNSConfig is not implemented"))
 }
@@ -947,6 +995,10 @@ func (UnimplementedIonscaleServiceHandler) ListMachines(context.Context, *connec
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ListMachines is not implemented"))
 }

+func (UnimplementedIonscaleServiceHandler) AuthorizeMachine(context.Context, *connect_go.Request[v1.AuthorizeMachineRequest]) (*connect_go.Response[v1.AuthorizeMachineResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.AuthorizeMachine is not implemented"))
+}
+
 func (UnimplementedIonscaleServiceHandler) ExpireMachine(context.Context, *connect_go.Request[v1.ExpireMachineRequest]) (*connect_go.Response[v1.ExpireMachineResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.ExpireMachine is not implemented"))
 }
@@ -963,26 +1015,18 @@ func (UnimplementedIonscaleServiceHandler) GetMachineRoutes(context.Context, *co
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.GetMachineRoutes is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) EnableMachineRoutes(context.Context, *connect_go.Request[v1.EnableMachineRoutesRequest]) (*connect_go.Response[v1.EnableMachineRoutesResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableMachineRoutes is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) DisableMachineRoutes(context.Context, *connect_go.Request[v1.DisableMachineRoutesRequest]) (*connect_go.Response[v1.DisableMachineRoutesResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableMachineRoutes is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) EnableExitNode(context.Context, *connect_go.Request[v1.EnableExitNodeRequest]) (*connect_go.Response[v1.EnableExitNodeResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableExitNode is not implemented"))
 }

-func (UnimplementedIonscaleServiceHandler) DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.GetMachineRoutesResponse], error) {
+func (UnimplementedIonscaleServiceHandler) DisableExitNode(context.Context, *connect_go.Request[v1.DisableExitNodeRequest]) (*connect_go.Response[v1.DisableExitNodeResponse], error) {
 	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableExitNode is not implemented"))
 }
-
-func (UnimplementedIonscaleServiceHandler) EnableHttpsCertificates(context.Context, *connect_go.Request[v1.EnableHttpsCertificatesRequest]) (*connect_go.Response[v1.EnableHttpsCertificatesResponse], error) {
-	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.EnableHttpsCertificates is not implemented"))
-}
-
-func (UnimplementedIonscaleServiceHandler) DisableHttpsCertificates(context.Context, *connect_go.Request[v1.DisableHttpsCertificatesRequest]) (*connect_go.Response[v1.DisableHttpsCertificatesResponse], error) {
-	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("ionscale.v1.IonscaleService.DisableHttpsCertificates is not implemented"))
-}
@@ -9,7 +9,6 @@ package ionscalev1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/known/durationpb"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
@@ -473,6 +472,91 @@ func (x *GetMachineResponse) GetMachine() *Machine {
 	return nil
 }

+type AuthorizeMachineRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64 `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+}
+
+func (x *AuthorizeMachineRequest) Reset() {
+	*x = AuthorizeMachineRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthorizeMachineRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthorizeMachineRequest) ProtoMessage() {}
+
+func (x *AuthorizeMachineRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthorizeMachineRequest.ProtoReflect.Descriptor instead.
+func (*AuthorizeMachineRequest) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *AuthorizeMachineRequest) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+type AuthorizeMachineResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *AuthorizeMachineResponse) Reset() {
+	*x = AuthorizeMachineResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthorizeMachineResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthorizeMachineResponse) ProtoMessage() {}
+
+func (x *AuthorizeMachineResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthorizeMachineResponse.ProtoReflect.Descriptor instead.
+func (*AuthorizeMachineResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{11}
+}
+
 type Machine struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -498,12 +582,13 @@ type Machine struct {
 	AdvertisedRoutes   []string               `protobuf:"bytes,18,rep,name=advertised_routes,json=advertisedRoutes,proto3" json:"advertised_routes,omitempty"`
 	AdvertisedExitNode bool                   `protobuf:"varint,19,opt,name=advertised_exit_node,json=advertisedExitNode,proto3" json:"advertised_exit_node,omitempty"`
 	EnabledExitNode    bool                   `protobuf:"varint,20,opt,name=enabled_exit_node,json=enabledExitNode,proto3" json:"enabled_exit_node,omitempty"`
+	Authorized         bool                   `protobuf:"varint,21,opt,name=authorized,proto3" json:"authorized,omitempty"`
 }

 func (x *Machine) Reset() {
 	*x = Machine{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+		mi := &file_ionscale_v1_machines_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -516,7 +601,7 @@ func (x *Machine) String() string {
 func (*Machine) ProtoMessage() {}

 func (x *Machine) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_machines_proto_msgTypes[10]
+	mi := &file_ionscale_v1_machines_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -529,7 +614,7 @@ func (x *Machine) ProtoReflect() protoreflect.Message {

 // Deprecated: Use Machine.ProtoReflect.Descriptor instead.
 func (*Machine) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{10}
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{12}
 }

 func (x *Machine) GetId() uint64 {
@@ -672,6 +757,13 @@ func (x *Machine) GetEnabledExitNode() bool {
 	return false
 }

+func (x *Machine) GetAuthorized() bool {
+	if x != nil {
+		return x.Authorized
+	}
+	return false
+}
+
 type ClientConnectivity struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -683,7 +775,7 @@ type ClientConnectivity struct {
 func (x *ClientConnectivity) Reset() {
 	*x = ClientConnectivity{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+		mi := &file_ionscale_v1_machines_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -696,7 +788,7 @@ func (x *ClientConnectivity) String() string {
 func (*ClientConnectivity) ProtoMessage() {}

 func (x *ClientConnectivity) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_machines_proto_msgTypes[11]
+	mi := &file_ionscale_v1_machines_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -709,7 +801,7 @@ func (x *ClientConnectivity) ProtoReflect() protoreflect.Message {

 // Deprecated: Use ClientConnectivity.ProtoReflect.Descriptor instead.
 func (*ClientConnectivity) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{11}
+	return file_ionscale_v1_machines_proto_rawDescGZIP(), []int{13}
 }

 func (x *ClientConnectivity) GetEndpoints() []string {
@@ -726,9 +818,7 @@ var file_ionscale_v1_machines_proto_rawDesc = []byte{
 	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x69, 0x6f,
 	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x69, 0x6f, 0x6e, 0x73,
 	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x66, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x22, 0x34, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
 	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c,
@@ -763,64 +853,71 @@ var file_ionscale_v1_machines_proto_rawDesc = []byte{
 	0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
 	0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x07, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x22, 0x91, 0x06, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x34, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x34, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x36, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1c, 0x0a, 0x09, 0x65,
-	0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
-	0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x09, 0x6c, 0x61, 0x73,
-	0x74, 0x5f, 0x73, 0x65, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08, 0x6c, 0x61, 0x73, 0x74, 0x53, 0x65,
-	0x65, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64,
-	0x12, 0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x52, 0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x24, 0x0a, 0x04,
-	0x75, 0x73, 0x65, 0x72, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x52, 0x04, 0x75, 0x73,
-	0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d,
-	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a,
-	0x02, 0x6f, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x6f, 0x73, 0x12, 0x50, 0x0a,
-	0x13, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-	0x76, 0x69, 0x74, 0x79, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x69, 0x6f, 0x6e,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x52, 0x12, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12,
-	0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x0e, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x65, 0x78,
-	0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69,
-	0x72, 0x65, 0x73, 0x41, 0x74, 0x12, 0x2e, 0x0a, 0x13, 0x6b, 0x65, 0x79, 0x5f, 0x65, 0x78, 0x70,
-	0x69, 0x72, 0x79, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x10, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x11, 0x6b, 0x65, 0x79, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x44, 0x69, 0x73,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
-	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11,
-	0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x18, 0x12, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69,
-	0x73, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x64, 0x76,
-	0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64,
-	0x65, 0x18, 0x13, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69,
-	0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65,
-	0x18, 0x14, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x45,
-	0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x22, 0x32, 0x0a, 0x12, 0x43, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x1c, 0x0a,
-	0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x42, 0x3d, 0x5a, 0x3b, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65,
-	0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f,
-	0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x69, 0x6e, 0x65, 0x22, 0x38, 0x0a, 0x17, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
+	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x1a, 0x0a,
+	0x18, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xb1, 0x06, 0x0a, 0x07, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76,
+	0x34, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x34, 0x12, 0x12, 0x0a,
+	0x04, 0x69, 0x70, 0x76, 0x36, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76,
+	0x36, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x12,
+	0x37, 0x0a, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08,
+	0x6c, 0x61, 0x73, 0x74, 0x53, 0x65, 0x65, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65,
+	0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x52, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x12, 0x24, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x10, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x66, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73,
+	0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x25, 0x0a, 0x0e,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x6f, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x6f, 0x73, 0x12, 0x50, 0x0a, 0x13, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1f, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74,
+	0x79, 0x52, 0x12, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x74, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74,
+	0x12, 0x39, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x0f,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x12, 0x2e, 0x0a, 0x13, 0x6b,
+	0x65, 0x79, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x6b, 0x65, 0x79, 0x45, 0x78, 0x70,
+	0x69, 0x72, 0x79, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x11, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64,
+	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x12, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61,
+	0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12,
+	0x30, 0x0a, 0x14, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x78,
+	0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x13, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x61,
+	0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64,
+	0x65, 0x12, 0x2a, 0x0a, 0x11, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69,
+	0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x1e, 0x0a,
+	0x0a, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x18, 0x15, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x22, 0x32, 0x0a,
+	0x12, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x76,
+	0x69, 0x74, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x73, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -835,7 +932,7 @@ func file_ionscale_v1_machines_proto_rawDescGZIP() []byte {
 	return file_ionscale_v1_machines_proto_rawDescData
 }

-var file_ionscale_v1_machines_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_ionscale_v1_machines_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_ionscale_v1_machines_proto_goTypes = []interface{}{
 	(*ListMachinesRequest)(nil),         // 0: ionscale.v1.ListMachinesRequest
 	(*ListMachinesResponse)(nil),        // 1: ionscale.v1.ListMachinesResponse
@@ -847,20 +944,22 @@ var file_ionscale_v1_machines_proto_goTypes = []interface{}{
 	(*SetMachineKeyExpiryResponse)(nil), // 7: ionscale.v1.SetMachineKeyExpiryResponse
 	(*GetMachineRequest)(nil),           // 8: ionscale.v1.GetMachineRequest
 	(*GetMachineResponse)(nil),          // 9: ionscale.v1.GetMachineResponse
-	(*Machine)(nil),                     // 10: ionscale.v1.Machine
-	(*ClientConnectivity)(nil),          // 11: ionscale.v1.ClientConnectivity
-	(*timestamppb.Timestamp)(nil),       // 12: google.protobuf.Timestamp
-	(*Ref)(nil),                         // 13: ionscale.v1.Ref
+	(*AuthorizeMachineRequest)(nil),     // 10: ionscale.v1.AuthorizeMachineRequest
+	(*AuthorizeMachineResponse)(nil),    // 11: ionscale.v1.AuthorizeMachineResponse
+	(*Machine)(nil),                     // 12: ionscale.v1.Machine
+	(*ClientConnectivity)(nil),          // 13: ionscale.v1.ClientConnectivity
+	(*timestamppb.Timestamp)(nil),       // 14: google.protobuf.Timestamp
+	(*Ref)(nil),                         // 15: ionscale.v1.Ref
 }
 var file_ionscale_v1_machines_proto_depIdxs = []int32{
-	10, // 0: ionscale.v1.ListMachinesResponse.machines:type_name -> ionscale.v1.Machine
-	10, // 1: ionscale.v1.GetMachineResponse.machine:type_name -> ionscale.v1.Machine
-	12, // 2: ionscale.v1.Machine.last_seen:type_name -> google.protobuf.Timestamp
-	13, // 3: ionscale.v1.Machine.tailnet:type_name -> ionscale.v1.Ref
-	13, // 4: ionscale.v1.Machine.user:type_name -> ionscale.v1.Ref
-	11, // 5: ionscale.v1.Machine.client_connectivity:type_name -> ionscale.v1.ClientConnectivity
-	12, // 6: ionscale.v1.Machine.created_at:type_name -> google.protobuf.Timestamp
-	12, // 7: ionscale.v1.Machine.expires_at:type_name -> google.protobuf.Timestamp
+	12, // 0: ionscale.v1.ListMachinesResponse.machines:type_name -> ionscale.v1.Machine
+	12, // 1: ionscale.v1.GetMachineResponse.machine:type_name -> ionscale.v1.Machine
+	14, // 2: ionscale.v1.Machine.last_seen:type_name -> google.protobuf.Timestamp
+	15, // 3: ionscale.v1.Machine.tailnet:type_name -> ionscale.v1.Ref
+	15, // 4: ionscale.v1.Machine.user:type_name -> ionscale.v1.Ref
+	13, // 5: ionscale.v1.Machine.client_connectivity:type_name -> ionscale.v1.ClientConnectivity
+	14, // 6: ionscale.v1.Machine.created_at:type_name -> google.protobuf.Timestamp
+	14, // 7: ionscale.v1.Machine.expires_at:type_name -> google.protobuf.Timestamp
 	8,  // [8:8] is the sub-list for method output_type
 	8,  // [8:8] is the sub-list for method input_type
 	8,  // [8:8] is the sub-list for extension type_name
@@ -996,7 +1095,7 @@ func file_ionscale_v1_machines_proto_init() {
 			}
 		}
 		file_ionscale_v1_machines_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Machine); i {
+			switch v := v.(*AuthorizeMachineRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1008,6 +1107,30 @@ func file_ionscale_v1_machines_proto_init() {
 			}
 		}
 		file_ionscale_v1_machines_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthorizeMachineResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_machines_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Machine); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_machines_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ClientConnectivity); i {
 			case 0:
 				return &v.state
@@ -1026,7 +1149,7 @@ func file_ionscale_v1_machines_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_ionscale_v1_machines_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   12,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -72,10 +72,8 @@ type GetMachineRoutesResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	AdvertisedRoutes   []string `protobuf:"bytes,1,rep,name=advertised_routes,json=advertisedRoutes,proto3" json:"advertised_routes,omitempty"`
-	EnabledRoutes      []string `protobuf:"bytes,2,rep,name=enabled_routes,json=enabledRoutes,proto3" json:"enabled_routes,omitempty"`
-	AdvertisedExitNode bool     `protobuf:"varint,3,opt,name=advertised_exit_node,json=advertisedExitNode,proto3" json:"advertised_exit_node,omitempty"`
-	EnabledExitNode    bool     `protobuf:"varint,4,opt,name=enabled_exit_node,json=enabledExitNode,proto3" json:"enabled_exit_node,omitempty"`
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
 }

 func (x *GetMachineRoutesResponse) Reset() {
@@ -110,34 +108,20 @@ func (*GetMachineRoutesResponse) Descriptor() ([]byte, []int) {
 	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{1}
 }

-func (x *GetMachineRoutesResponse) GetAdvertisedRoutes() []string {
+func (x *GetMachineRoutesResponse) GetMachineId() uint64 {
 	if x != nil {
-		return x.AdvertisedRoutes
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *GetMachineRoutesResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
 	}
 	return nil
 }

-func (x *GetMachineRoutesResponse) GetEnabledRoutes() []string {
-	if x != nil {
-		return x.EnabledRoutes
-	}
-	return nil
-}
-
-func (x *GetMachineRoutesResponse) GetAdvertisedExitNode() bool {
-	if x != nil {
-		return x.AdvertisedExitNode
-	}
-	return false
-}
-
-func (x *GetMachineRoutesResponse) GetEnabledExitNode() bool {
-	if x != nil {
-		return x.EnabledExitNode
-	}
-	return false
-}
-
 type EnableMachineRoutesRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -201,6 +185,61 @@ func (x *EnableMachineRoutesRequest) GetReplace() bool {
 	return false
 }

+type EnableMachineRoutesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *EnableMachineRoutesResponse) Reset() {
+	*x = EnableMachineRoutesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EnableMachineRoutesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnableMachineRoutesResponse) ProtoMessage() {}
+
+func (x *EnableMachineRoutesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnableMachineRoutesResponse.ProtoReflect.Descriptor instead.
+func (*EnableMachineRoutesResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *EnableMachineRoutesResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *EnableMachineRoutesResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
 type DisableMachineRoutesRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -213,7 +252,7 @@ type DisableMachineRoutesRequest struct {
 func (x *DisableMachineRoutesRequest) Reset() {
 	*x = DisableMachineRoutesRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+		mi := &file_ionscale_v1_routes_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -226,7 +265,7 @@ func (x *DisableMachineRoutesRequest) String() string {
 func (*DisableMachineRoutesRequest) ProtoMessage() {}

 func (x *DisableMachineRoutesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_routes_proto_msgTypes[3]
+	mi := &file_ionscale_v1_routes_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -239,7 +278,7 @@ func (x *DisableMachineRoutesRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use DisableMachineRoutesRequest.ProtoReflect.Descriptor instead.
 func (*DisableMachineRoutesRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{3}
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{4}
 }

 func (x *DisableMachineRoutesRequest) GetMachineId() uint64 {
@@ -256,6 +295,61 @@ func (x *DisableMachineRoutesRequest) GetRoutes() []string {
 	return nil
 }

+type DisableMachineRoutesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *DisableMachineRoutesResponse) Reset() {
+	*x = DisableMachineRoutesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableMachineRoutesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableMachineRoutesResponse) ProtoMessage() {}
+
+func (x *DisableMachineRoutesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableMachineRoutesResponse.ProtoReflect.Descriptor instead.
+func (*DisableMachineRoutesResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *DisableMachineRoutesResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *DisableMachineRoutesResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
 type EnableExitNodeRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -267,7 +361,7 @@ type EnableExitNodeRequest struct {
 func (x *EnableExitNodeRequest) Reset() {
 	*x = EnableExitNodeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_routes_proto_msgTypes[4]
+		mi := &file_ionscale_v1_routes_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -280,7 +374,7 @@ func (x *EnableExitNodeRequest) String() string {
 func (*EnableExitNodeRequest) ProtoMessage() {}

 func (x *EnableExitNodeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_routes_proto_msgTypes[4]
+	mi := &file_ionscale_v1_routes_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -293,7 +387,7 @@ func (x *EnableExitNodeRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use EnableExitNodeRequest.ProtoReflect.Descriptor instead.
 func (*EnableExitNodeRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{4}
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{6}
 }

 func (x *EnableExitNodeRequest) GetMachineId() uint64 {
@@ -303,6 +397,61 @@ func (x *EnableExitNodeRequest) GetMachineId() uint64 {
 	return 0
 }

+type EnableExitNodeResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *EnableExitNodeResponse) Reset() {
+	*x = EnableExitNodeResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EnableExitNodeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnableExitNodeResponse) ProtoMessage() {}
+
+func (x *EnableExitNodeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnableExitNodeResponse.ProtoReflect.Descriptor instead.
+func (*EnableExitNodeResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *EnableExitNodeResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *EnableExitNodeResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
 type DisableExitNodeRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -314,7 +463,7 @@ type DisableExitNodeRequest struct {
 func (x *DisableExitNodeRequest) Reset() {
 	*x = DisableExitNodeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+		mi := &file_ionscale_v1_routes_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -327,7 +476,7 @@ func (x *DisableExitNodeRequest) String() string {
 func (*DisableExitNodeRequest) ProtoMessage() {}

 func (x *DisableExitNodeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ionscale_v1_routes_proto_msgTypes[5]
+	mi := &file_ionscale_v1_routes_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -340,7 +489,7 @@ func (x *DisableExitNodeRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use DisableExitNodeRequest.ProtoReflect.Descriptor instead.
 func (*DisableExitNodeRequest) Descriptor() ([]byte, []int) {
-	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{5}
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{8}
 }

 func (x *DisableExitNodeRequest) GetMachineId() uint64 {
@@ -350,6 +499,132 @@ func (x *DisableExitNodeRequest) GetMachineId() uint64 {
 	return 0
 }

+type DisableExitNodeResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64         `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    *MachineRoutes `protobuf:"bytes,2,opt,name=routes,proto3" json:"routes,omitempty"`
+}
+
+func (x *DisableExitNodeResponse) Reset() {
+	*x = DisableExitNodeResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableExitNodeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableExitNodeResponse) ProtoMessage() {}
+
+func (x *DisableExitNodeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableExitNodeResponse.ProtoReflect.Descriptor instead.
+func (*DisableExitNodeResponse) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DisableExitNodeResponse) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+func (x *DisableExitNodeResponse) GetRoutes() *MachineRoutes {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
+type MachineRoutes struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AdvertisedRoutes   []string `protobuf:"bytes,1,rep,name=advertised_routes,json=advertisedRoutes,proto3" json:"advertised_routes,omitempty"`
+	EnabledRoutes      []string `protobuf:"bytes,2,rep,name=enabled_routes,json=enabledRoutes,proto3" json:"enabled_routes,omitempty"`
+	AdvertisedExitNode bool     `protobuf:"varint,3,opt,name=advertised_exit_node,json=advertisedExitNode,proto3" json:"advertised_exit_node,omitempty"`
+	EnabledExitNode    bool     `protobuf:"varint,4,opt,name=enabled_exit_node,json=enabledExitNode,proto3" json:"enabled_exit_node,omitempty"`
+}
+
+func (x *MachineRoutes) Reset() {
+	*x = MachineRoutes{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_ionscale_v1_routes_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineRoutes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineRoutes) ProtoMessage() {}
+
+func (x *MachineRoutes) ProtoReflect() protoreflect.Message {
+	mi := &file_ionscale_v1_routes_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineRoutes.ProtoReflect.Descriptor instead.
+func (*MachineRoutes) Descriptor() ([]byte, []int) {
+	return file_ionscale_v1_routes_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *MachineRoutes) GetAdvertisedRoutes() []string {
+	if x != nil {
+		return x.AdvertisedRoutes
+	}
+	return nil
+}
+
+func (x *MachineRoutes) GetEnabledRoutes() []string {
+	if x != nil {
+		return x.EnabledRoutes
+	}
+	return nil
+}
+
+func (x *MachineRoutes) GetAdvertisedExitNode() bool {
+	if x != nil {
+		return x.AdvertisedExitNode
+	}
+	return false
+}
+
+func (x *MachineRoutes) GetEnabledExitNode() bool {
+	if x != nil {
+		return x.EnabledExitNode
+	}
+	return false
+}
+
 var File_ionscale_v1_routes_proto protoreflect.FileDescriptor

 var file_ionscale_v1_routes_proto_rawDesc = []byte{
@@ -359,19 +634,13 @@ var file_ionscale_v1_routes_proto_rawDesc = []byte{
 	0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49,
-	0x64, 0x22, 0xcc, 0x01, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2b,
-	0x0a, 0x11, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x64, 0x76, 0x65, 0x72,
-	0x74, 0x69, 0x73, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64,
-	0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x12, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74,
-	0x4e, 0x6f, 0x64, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f,
-	0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65,
+	0x64, 0x22, 0x6d, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a,
+	0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x06,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
 	0x22, 0x6d, 0x0a, 0x1a, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
 	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
 	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
@@ -379,23 +648,64 @@ var file_ionscale_v1_routes_proto_rawDesc = []byte{
 	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x72,
 	0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65,
 	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x22,
-	0x54, 0x0a, 0x1b, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
+	0x70, 0x0a, 0x1b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d,
 	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x16, 0x0a,
-	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x72,
-	0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x36, 0x0a, 0x15, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45,
-	0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
-	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x37, 0x0a,
-	0x16, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x22, 0x54, 0x0a, 0x1b, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12,
+	0x16, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x71, 0x0a, 0x1c, 0x44, 0x69, 0x73, 0x61, 0x62,
+	0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f,
-	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x69,
-	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69, 0x6f, 0x6e, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x36, 0x0a, 0x15, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x49, 0x64, 0x22, 0x6b, 0x0a, 0x16, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22,
+	0x37, 0x0a, 0x16, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f,
+	0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x6c, 0x0a, 0x17, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x49, 0x64, 0x12, 0x32, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x06,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0xc1, 0x01, 0x0a, 0x0d, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x64, 0x76, 0x65,
+	0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x14,
+	0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f,
+	0x6e, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x61, 0x64, 0x76, 0x65,
+	0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x2a,
+	0x0a, 0x11, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x6e,
+	0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x45, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e,
+	0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67,
+	0x65, 0x6e, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x69,
+	0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }

 var (
@@ -410,21 +720,31 @@ func file_ionscale_v1_routes_proto_rawDescGZIP() []byte {
 	return file_ionscale_v1_routes_proto_rawDescData
 }

-var file_ionscale_v1_routes_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_ionscale_v1_routes_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_ionscale_v1_routes_proto_goTypes = []interface{}{
-	(*GetMachineRoutesRequest)(nil),     // 0: ionscale.v1.GetMachineRoutesRequest
-	(*GetMachineRoutesResponse)(nil),    // 1: ionscale.v1.GetMachineRoutesResponse
-	(*EnableMachineRoutesRequest)(nil),  // 2: ionscale.v1.EnableMachineRoutesRequest
-	(*DisableMachineRoutesRequest)(nil), // 3: ionscale.v1.DisableMachineRoutesRequest
-	(*EnableExitNodeRequest)(nil),       // 4: ionscale.v1.EnableExitNodeRequest
-	(*DisableExitNodeRequest)(nil),      // 5: ionscale.v1.DisableExitNodeRequest
+	(*GetMachineRoutesRequest)(nil),      // 0: ionscale.v1.GetMachineRoutesRequest
+	(*GetMachineRoutesResponse)(nil),     // 1: ionscale.v1.GetMachineRoutesResponse
+	(*EnableMachineRoutesRequest)(nil),   // 2: ionscale.v1.EnableMachineRoutesRequest
+	(*EnableMachineRoutesResponse)(nil),  // 3: ionscale.v1.EnableMachineRoutesResponse
+	(*DisableMachineRoutesRequest)(nil),  // 4: ionscale.v1.DisableMachineRoutesRequest
+	(*DisableMachineRoutesResponse)(nil), // 5: ionscale.v1.DisableMachineRoutesResponse
+	(*EnableExitNodeRequest)(nil),        // 6: ionscale.v1.EnableExitNodeRequest
+	(*EnableExitNodeResponse)(nil),       // 7: ionscale.v1.EnableExitNodeResponse
+	(*DisableExitNodeRequest)(nil),       // 8: ionscale.v1.DisableExitNodeRequest
+	(*DisableExitNodeResponse)(nil),      // 9: ionscale.v1.DisableExitNodeResponse
+	(*MachineRoutes)(nil),                // 10: ionscale.v1.MachineRoutes
 }
 var file_ionscale_v1_routes_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	10, // 0: ionscale.v1.GetMachineRoutesResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 1: ionscale.v1.EnableMachineRoutesResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 2: ionscale.v1.DisableMachineRoutesResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 3: ionscale.v1.EnableExitNodeResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	10, // 4: ionscale.v1.DisableExitNodeResponse.routes:type_name -> ionscale.v1.MachineRoutes
+	5,  // [5:5] is the sub-list for method output_type
+	5,  // [5:5] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
 }

 func init() { file_ionscale_v1_routes_proto_init() }
@@ -470,7 +790,7 @@ func file_ionscale_v1_routes_proto_init() {
 			}
 		}
 		file_ionscale_v1_routes_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DisableMachineRoutesRequest); i {
+			switch v := v.(*EnableMachineRoutesResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -482,7 +802,7 @@ func file_ionscale_v1_routes_proto_init() {
 			}
 		}
 		file_ionscale_v1_routes_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnableExitNodeRequest); i {
+			switch v := v.(*DisableMachineRoutesRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -494,6 +814,42 @@ func file_ionscale_v1_routes_proto_init() {
 			}
 		}
 		file_ionscale_v1_routes_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableMachineRoutesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EnableExitNodeRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EnableExitNodeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DisableExitNodeRequest); i {
 			case 0:
 				return &v.state
@@ -505,6 +861,30 @@ func file_ionscale_v1_routes_proto_init() {
 				return nil
 			}
 		}
+		file_ionscale_v1_routes_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableExitNodeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_ionscale_v1_routes_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineRoutes); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -512,7 +892,7 @@ func file_ionscale_v1_routes_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_ionscale_v1_routes_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -1,11 +1,10 @@
 syntax = "proto3";

 package ionscale.v1;
-option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 import "google/protobuf/struct.proto";

-import "ionscale/v1/ref.proto";
+option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 message GetACLPolicyRequest {
  uint64 tailnet_id = 1;
@@ -20,8 +19,7 @@ message SetACLPolicyRequest {
  ACLPolicy policy = 2;
 }

-message SetACLPolicyResponse {
-}
+message SetACLPolicyResponse {}

 message ACLPolicy {
  map<string, string> hosts = 1;
@@ -48,4 +46,4 @@ message SSHRule {
  repeated string src = 2;
  repeated string dst = 3;
  repeated string users = 4;
-}
+}
@@ -1,13 +1,13 @@
 syntax = "proto3";

 package ionscale.v1;
+
 option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

-message AuthenticationRequest {
-}
+message AuthenticateRequest {}

-message AuthenticationResponse {
+message AuthenticateResponse {
  string auth_url = 1;
  string token = 2;
  optional uint64 tailnet_id = 3;
-}
+}
@@ -1,19 +1,19 @@
 syntax = "proto3";

 package ionscale.v1;
-option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

-import "google/protobuf/timestamp.proto";
 import "google/protobuf/duration.proto";
-
+import "google/protobuf/timestamp.proto";
 import "ionscale/v1/ref.proto";

+option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";
+
 message GetAuthKeyRequest {
  uint64 auth_key_id = 1;
 }

 message GetAuthKeyResponse {
-  AuthKey authKey = 1;
+  AuthKey auth_key = 1;
 }

 message CreateAuthKeyRequest {
@@ -21,6 +21,7 @@ message CreateAuthKeyRequest {
  bool ephemeral = 2;
  optional google.protobuf.Duration expiry = 3;
  repeated string tags = 4;
+  bool pre_authorized = 5;
 }

 message CreateAuthKeyResponse {
@@ -50,4 +51,4 @@ message AuthKey {
  google.protobuf.Timestamp created_at = 5;
  optional google.protobuf.Timestamp expires_at = 6;
  Ref tailnet = 7;
-}
+}
@@ -1,6 +1,7 @@
 syntax = "proto3";

 package ionscale.v1;
+
 option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 message GetDefaultDERPMapRequest {}
@@ -17,8 +18,6 @@ message SetDefaultDERPMapResponse {
  bytes value = 1;
 }

-message ResetDefaultDERPMapRequest {
-}
+message ResetDefaultDERPMapRequest {}

-message ResetDefaultDERPMapResponse {
-}
+message ResetDefaultDERPMapResponse {}
@@ -1,10 +1,8 @@
 syntax = "proto3";

 package ionscale.v1;
-option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

-import "google/protobuf/timestamp.proto";
-import "google/protobuf/duration.proto";
+option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 message GetDNSConfigRequest {
  uint64 tailnet_id = 1;
@@ -23,29 +21,15 @@ message SetDNSConfigResponse {
  DNSConfig config = 1;
 }

-message EnableHttpsCertificatesRequest {
-  uint64 tailnet_id = 1;
-  string alias = 2;
-}
-
-message EnableHttpsCertificatesResponse {
-}
-
-message DisableHttpsCertificatesRequest {
-  uint64 tailnet_id = 1;
-}
-
-message DisableHttpsCertificatesResponse {
-}
-
 message DNSConfig {
  bool magic_dns = 1;
  bool override_local_dns = 2;
  repeated string nameservers = 3;
  map<string, Routes> routes = 4;
  string magic_dns_suffix = 5;
+  bool https_certs = 6;
 }

 message Routes {
  repeated string routes = 1;
-}
+}
@@ -1,6 +1,7 @@
 syntax = "proto3";

 package ionscale.v1;
+
 option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 message GetIAMPolicyRequest {
@@ -16,12 +17,11 @@ message SetIAMPolicyRequest {
  IAMPolicy policy = 2;
 }

-message SetIAMPolicyResponse {
-}
+message SetIAMPolicyResponse {}

 message IAMPolicy {
  repeated string subs = 1;
  repeated string emails = 2;
  repeated string filters = 3;
  map<string, string> roles = 4;
-}
+}
@@ -1,73 +1,73 @@
 syntax = "proto3";

 package ionscale.v1;
-option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

-import "google/protobuf/timestamp.proto";
-import "google/protobuf/duration.proto";
-
-import "ionscale/v1/version.proto";
+import "ionscale/v1/acl.proto";
 import "ionscale/v1/auth.proto";
-import "ionscale/v1/tailnets.proto";
-import "ionscale/v1/users.proto";
 import "ionscale/v1/auth_keys.proto";
-import "ionscale/v1/machines.proto";
-import "ionscale/v1/routes.proto";
+import "ionscale/v1/derp.proto";
 import "ionscale/v1/dns.proto";
 import "ionscale/v1/iam.proto";
-import "ionscale/v1/acl.proto";
-import "ionscale/v1/derp.proto";
+import "ionscale/v1/machines.proto";
+import "ionscale/v1/routes.proto";
+import "ionscale/v1/tailnets.proto";
+import "ionscale/v1/users.proto";
+import "ionscale/v1/version.proto";
+
+option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 service IonscaleService {
-  rpc GetVersion (GetVersionRequest) returns (GetVersionResponse) {}
+  rpc GetVersion(GetVersionRequest) returns (GetVersionResponse) {}

-  rpc Authenticate (AuthenticationRequest) returns (stream AuthenticationResponse) {}
+  rpc Authenticate(AuthenticateRequest) returns (stream AuthenticateResponse) {}

-  rpc GetDefaultDERPMap (GetDefaultDERPMapRequest) returns (GetDefaultDERPMapResponse) {}
-  rpc SetDefaultDERPMap (SetDefaultDERPMapRequest) returns (SetDefaultDERPMapResponse) {}
-  rpc ResetDefaultDERPMap (ResetDefaultDERPMapRequest) returns (ResetDefaultDERPMapResponse) {}
+  rpc GetDefaultDERPMap(GetDefaultDERPMapRequest) returns (GetDefaultDERPMapResponse) {}
+  rpc SetDefaultDERPMap(SetDefaultDERPMapRequest) returns (SetDefaultDERPMapResponse) {}
+  rpc ResetDefaultDERPMap(ResetDefaultDERPMapRequest) returns (ResetDefaultDERPMapResponse) {}

-  rpc CreateTailnet (CreateTailnetRequest) returns (CreateTailnetResponse) {}
-  rpc GetTailnet (GetTailnetRequest) returns (GetTailnetResponse) {}
-  rpc ListTailnets (ListTailnetRequest) returns (ListTailnetResponse) {}
-  rpc DeleteTailnet (DeleteTailnetRequest) returns (DeleteTailnetResponse) {}
-  rpc GetDERPMap (GetDERPMapRequest) returns (GetDERPMapResponse) {}
-  rpc SetDERPMap (SetDERPMapRequest) returns (SetDERPMapResponse) {}
-  rpc ResetDERPMap (ResetDERPMapRequest) returns (ResetDERPMapResponse) {}
-  rpc EnabledFileSharing (EnableFileSharingRequest) returns (EnableFileSharingResponse) {}
-  rpc DisableFileSharing (DisableFileSharingRequest) returns (DisableFileSharingResponse) {}
-  rpc EnabledServiceCollection (EnableServiceCollectionRequest) returns (EnableServiceCollectionResponse) {}
-  rpc DisableServiceCollection (DisableServiceCollectionRequest) returns (DisableServiceCollectionResponse) {}
-  rpc EnabledSSH (EnableSSHRequest) returns (EnableSSHResponse) {}
-  rpc DisableSSH (DisableSSHRequest) returns (DisableSSHResponse) {}
+  rpc CreateTailnet(CreateTailnetRequest) returns (CreateTailnetResponse) {}
+  rpc UpdateTailnet(UpdateTailnetRequest) returns (UpdateTailnetResponse) {}
+  rpc GetTailnet(GetTailnetRequest) returns (GetTailnetResponse) {}
+  rpc ListTailnets(ListTailnetsRequest) returns (ListTailnetsResponse) {}
+  rpc DeleteTailnet(DeleteTailnetRequest) returns (DeleteTailnetResponse) {}
+  rpc GetDERPMap(GetDERPMapRequest) returns (GetDERPMapResponse) {}
+  rpc SetDERPMap(SetDERPMapRequest) returns (SetDERPMapResponse) {}
+  rpc ResetDERPMap(ResetDERPMapRequest) returns (ResetDERPMapResponse) {}
+  rpc EnableFileSharing(EnableFileSharingRequest) returns (EnableFileSharingResponse) {}
+  rpc DisableFileSharing(DisableFileSharingRequest) returns (DisableFileSharingResponse) {}
+  rpc EnableServiceCollection(EnableServiceCollectionRequest) returns (EnableServiceCollectionResponse) {}
+  rpc DisableServiceCollection(DisableServiceCollectionRequest) returns (DisableServiceCollectionResponse) {}
+  rpc EnableSSH(EnableSSHRequest) returns (EnableSSHResponse) {}
+  rpc DisableSSH(DisableSSHRequest) returns (DisableSSHResponse) {}
+  rpc EnableMachineAuthorization(EnableMachineAuthorizationRequest) returns (EnableMachineAuthorizationResponse) {}
+  rpc DisableMachineAuthorization(DisableMachineAuthorizationRequest) returns (DisableMachineAuthorizationResponse) {}

-  rpc GetDNSConfig (GetDNSConfigRequest) returns (GetDNSConfigResponse) {}
-  rpc SetDNSConfig (SetDNSConfigRequest) returns (SetDNSConfigResponse) {}
+  rpc GetDNSConfig(GetDNSConfigRequest) returns (GetDNSConfigResponse) {}
+  rpc SetDNSConfig(SetDNSConfigRequest) returns (SetDNSConfigResponse) {}

-  rpc GetIAMPolicy (GetIAMPolicyRequest) returns (GetIAMPolicyResponse) {}
-  rpc SetIAMPolicy (SetIAMPolicyRequest) returns (SetIAMPolicyResponse) {}
+  rpc GetIAMPolicy(GetIAMPolicyRequest) returns (GetIAMPolicyResponse) {}
+  rpc SetIAMPolicy(SetIAMPolicyRequest) returns (SetIAMPolicyResponse) {}

-  rpc GetACLPolicy (GetACLPolicyRequest) returns (GetACLPolicyResponse) {}
-  rpc SetACLPolicy (SetACLPolicyRequest) returns (SetACLPolicyResponse) {}
+  rpc GetACLPolicy(GetACLPolicyRequest) returns (GetACLPolicyResponse) {}
+  rpc SetACLPolicy(SetACLPolicyRequest) returns (SetACLPolicyResponse) {}

-  rpc GetAuthKey (GetAuthKeyRequest) returns (GetAuthKeyResponse) {}
-  rpc CreateAuthKey (CreateAuthKeyRequest) returns (CreateAuthKeyResponse) {}
-  rpc DeleteAuthKey (DeleteAuthKeyRequest) returns (DeleteAuthKeyResponse) {}
-  rpc ListAuthKeys (ListAuthKeysRequest) returns (ListAuthKeysResponse) {}
+  rpc GetAuthKey(GetAuthKeyRequest) returns (GetAuthKeyResponse) {}
+  rpc CreateAuthKey(CreateAuthKeyRequest) returns (CreateAuthKeyResponse) {}
+  rpc DeleteAuthKey(DeleteAuthKeyRequest) returns (DeleteAuthKeyResponse) {}
+  rpc ListAuthKeys(ListAuthKeysRequest) returns (ListAuthKeysResponse) {}

  rpc ListUsers(ListUsersRequest) returns (ListUsersResponse) {}
  rpc DeleteUser(DeleteUserRequest) returns (DeleteUserResponse) {}

-  rpc GetMachine (GetMachineRequest) returns (GetMachineResponse) {}
-  rpc ListMachines (ListMachinesRequest) returns (ListMachinesResponse) {}
+  rpc GetMachine(GetMachineRequest) returns (GetMachineResponse) {}
+  rpc ListMachines(ListMachinesRequest) returns (ListMachinesResponse) {}
+  rpc AuthorizeMachine(AuthorizeMachineRequest) returns (AuthorizeMachineResponse) {}
  rpc ExpireMachine(ExpireMachineRequest) returns (ExpireMachineResponse) {}
  rpc DeleteMachine(DeleteMachineRequest) returns (DeleteMachineResponse) {}
  rpc SetMachineKeyExpiry(SetMachineKeyExpiryRequest) returns (SetMachineKeyExpiryResponse) {}
-  rpc GetMachineRoutes (GetMachineRoutesRequest) returns (GetMachineRoutesResponse) {}
-  rpc EnableMachineRoutes (EnableMachineRoutesRequest) returns (GetMachineRoutesResponse) {}
-  rpc DisableMachineRoutes (DisableMachineRoutesRequest) returns (GetMachineRoutesResponse) {}
-  rpc EnableExitNode (EnableExitNodeRequest) returns (GetMachineRoutesResponse) {}
-  rpc DisableExitNode (DisableExitNodeRequest) returns (GetMachineRoutesResponse) {}
-  rpc EnableHttpsCertificates (EnableHttpsCertificatesRequest) returns (EnableHttpsCertificatesResponse) {}
-  rpc DisableHttpsCertificates (DisableHttpsCertificatesRequest) returns (DisableHttpsCertificatesResponse) {}
+  rpc GetMachineRoutes(GetMachineRoutesRequest) returns (GetMachineRoutesResponse) {}
+  rpc EnableMachineRoutes(EnableMachineRoutesRequest) returns (EnableMachineRoutesResponse) {}
+  rpc DisableMachineRoutes(DisableMachineRoutesRequest) returns (DisableMachineRoutesResponse) {}
+  rpc EnableExitNode(EnableExitNodeRequest) returns (EnableExitNodeResponse) {}
+  rpc DisableExitNode(DisableExitNodeRequest) returns (DisableExitNodeResponse) {}
 }
@@ -1,13 +1,12 @@
 syntax = "proto3";

 package ionscale.v1;
-option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 import "google/protobuf/timestamp.proto";
-import "google/protobuf/duration.proto";
-
 import "ionscale/v1/ref.proto";

+option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";
+
 message ListMachinesRequest {
  uint64 tailnet_id = 1;
 }
@@ -43,6 +42,12 @@ message GetMachineResponse {
  Machine machine = 1;
 }

+message AuthorizeMachineRequest {
+  uint64 machine_id = 1;
+}
+
+message AuthorizeMachineResponse {}
+
 message Machine {
  uint64 id = 1;
  string name = 2;
@@ -64,6 +69,7 @@ message Machine {
  repeated string advertised_routes = 18;
  bool advertised_exit_node = 19;
  bool enabled_exit_node = 20;
+  bool authorized = 21;
 }

 message ClientConnectivity {
@@ -1,9 +1,10 @@
 syntax = "proto3";

 package ionscale.v1;
+
 option go_package = "github.com/jsiebens/ionscale/pkg/gen/ionscale/v1;ionscalev1";

 message Ref {
  uint64 id = 1;
  string name = 2;
-}
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Johan Siebens	4ba540cb2c	chore: replace hclog with zap	2023-03-19 10:53:54 +01:00
Johan Siebens	3577b8b46e	chore(deps): upgrade dependencies	2023-03-12 08:38:18 +01:00
Johan Siebens	f24f0973fe	chore(deps): golang 1.20	2023-03-12 08:26:35 +01:00
Johan Siebens	12cad15a4e	chore(deps): upgrade tailscale	2023-03-12 08:26:13 +01:00
Johan Siebens	d5c3c699dd	chore(docs): fix typo	2023-03-11 08:53:54 +01:00
Johan Siebens	b3b21be50d	chore(docs): fix incorrect acme_enabled property	2023-03-11 08:41:11 +01:00
Johan Siebens	051650ae4e	chore: upgrade to golang 1.20	2023-03-08 07:46:58 +01:00
Johan Siebens	2fc79ee0a1	chore(deps): replace coral with latest cobra	2023-03-08 07:43:03 +01:00
Johan Siebens	b7b3796ae6	chore: update base image	2023-03-08 07:40:48 +01:00
Johan Siebens	b0074152d1	chore: add tests with new 1.36 version	2023-01-28 19:36:27 +01:00
Johan Siebens	4550bdbf2a	fix: set default ACL and IAM policy if not provided	2023-01-28 19:28:51 +01:00
Johan Siebens	d32ece6304	feat: create and update tailnets with all properties	2023-01-07 08:20:35 +01:00
Johan Siebens	ef325dd936	docs: update to latest version	2023-01-05 08:49:06 +01:00
Johan Siebens	9a55d67c7e	chore(deps): upgrade setup-go action	2023-01-05 08:22:26 +01:00
Johan Siebens	cbbaa31580	fix: use stdencoding instead of rawstdencoding	2023-01-03 08:13:06 +01:00
Johan Siebens	35c46eb2ec	chore: fix workflow file	2023-01-02 14:10:10 +01:00
Johan Siebens	d6a564b7a9	chore: some initial integration tests	2023-01-02 14:07:38 +01:00
Johan Siebens	527fb34560	fix: use smallzstd and sync pool, slightly improving performance	2023-01-01 12:08:25 +01:00
Johan Siebens	805a516626	fix: avoid double user entries	2023-01-01 09:43:14 +01:00
Johan Siebens	0dbc81d50f	fix: send exit node prefixes when enabled	2023-01-01 08:10:31 +01:00
Johan Siebens	40cc7b5648	fix: send same user for all tagged devices, reducing mapresponse payload when having many tagged devices	2022-12-31 08:26:30 +01:00
Johan Siebens	b62db084d1	feat: add config to tweak sql connection pool	2022-12-30 09:28:50 +01:00
Johan Siebens	df23c178f9	feat: add gorm prometheus metrics	2022-12-30 09:07:29 +01:00
Johan Siebens	9f7263abd5	fix: add machines indeces and use gorm take instead of first	2022-12-27 11:14:53 +01:00
Johan Siebens	660c684a13	chore(deps): upgrade golang.org/x/net	2022-12-25 07:45:28 +01:00
Johan Siebens	790ef5fe1a	feat: subnet router failover	2022-12-25 07:40:19 +01:00
Johan Siebens	61d9b40144	chore: remove pubsub and introduce session manager	2022-12-24 12:00:00 +01:00
Johan Siebens	a8e8d1aa49	fix: send user and login in registration response	2022-12-21 06:12:41 +01:00
Johan Siebens	b2dbe3b9c5	chore: remove unused arg and only set lastseen when offline	2022-11-30 08:31:41 +01:00
Johan Siebens	8c6e9e00b9	chore: ignore eof errors when clients disconnect	2022-11-29 16:51:28 +01:00
Johan Siebens	beb856a85d	feat: move https certs flag to dns config	2022-11-29 08:28:57 +01:00
Johan Siebens	2345f0b1de	feat: improve error handling/logging a little bit	2022-11-23 11:06:26 +01:00
Johan Siebens	c8b040fcd6	chore(docs): remove unused attribute	2022-11-16 07:21:00 +01:00
Johan Siebens	5481d3bf4b	chore: add check for breaking api	2022-11-16 07:16:11 +01:00
Johan Siebens	aac5414a21	chore: update install script	2022-11-05 09:25:26 +01:00
Johan Siebens	e74faa2605	feat: machine authorization	2022-11-04 14:13:19 +01:00
Johan Siebens	9baf2ec6d1	chore(deps): bump cosign action	2022-10-31 08:54:49 +01:00
Johan Siebens	c73b7e13e0	feat: buf formatting and linting	2022-10-31 07:54:12 +01:00
Johan Siebens	e41bac5a41	chore: improve echo handlers	2022-10-29 08:21:14 +02:00
Johan Siebens	03abebb847	chore: one start auth method	2022-10-28 16:02:00 +02:00
Johan Siebens	210cc9c8a2	fix: don't allow tag owners ssh from machine	2022-10-28 14:40:03 +02:00
Johan Siebens	9e38ffc44d	fix: check if expiresAt is available	2022-10-25 07:28:56 +02:00
Johan Siebens	06f02c1235	chore(deps): upgrade gorm	2022-10-22 10:36:26 +02:00
Johan Siebens	1de736144a	feat: remove the notion of alias	2022-10-22 08:55:32 +02:00
Johan Siebens	2bfe95219d	chore(docs): update docs with latest version	2022-10-20 10:49:39 +02:00