diff --git a/appmgr/Cargo.lock b/appmgr/Cargo.lock
index ca9a92d3b..e76ecc05a 100644
--- a/appmgr/Cargo.lock
+++ b/appmgr/Cargo.lock
@@ -46,9 +46,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.43"
+version = "1.0.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28ae2b3dec75a406790005a200b1bd89785afc02517a00ca99ecfe093ee9e6cf"
+checksum = "61604a8f862e1d5c3229fdd78f8b02c68dcf73a4c4b05fd636d12240aaa242c1"
 
 [[package]]
 name = "arrayref"
@@ -1593,12 +1593,6 @@ dependencies = [
  "cfg-if 1.0.0",
 ]
 
-[[package]]
-name = "maplit"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
-
 [[package]]
 name = "matches"
 version = "0.1.9"
@@ -2850,14 +2844,12 @@ checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
 [[package]]
 name = "sqlformat"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "684001e7985ec1a9a66963b77ed151ef22a7876b3fdd7e37a57ec774f54b7d96"
+checksum = "b4b7922be017ee70900be125523f38bdd644f4f06a1b16e8fa5a8ee8c34bffd4"
 dependencies = [
- "lazy_static",
- "maplit",
+ "itertools 0.10.1",
  "nom 7.0.0",
- "regex",
  "unicode_categories",
 ]
 
@@ -3456,9 +3448,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ca517f43f0fb96e0c3072ed5c275fe5eece87e8cb52f4a77b69226d3b1c9df8"
+checksum = "46125608c26121c81b0c6d693eab5a420e416da7e43c426d2e8f7df8da8a3acf"
 dependencies = [
  "lazy_static",
 ]
diff --git a/appmgr/migrations/20210629193146_Init.sql b/appmgr/migrations/20210629193146_Init.sql
index fbf8a8ae4..4fa90754b 100644
--- a/appmgr/migrations/20210629193146_Init.sql
+++ b/appmgr/migrations/20210629193146_Init.sql
@@ -27,4 +27,13 @@ CREATE TABLE IF NOT EXISTS ssh_keys
     openssh_pubkey  TEXT NOT NULL,
     created_at      TEXT NOT NULL,
     PRIMARY KEY (fingerprint)
+);
+CREATE TABLE IF NOT EXISTS certificates
+(
+    id INTEGER PRIMARY KEY, -- Root = 0, Int = 1, Other = 2..
+    priv_key_pem TEXT NOT NULL,
+    certificate_pem TEXT NOT NULL,
+    lookup_string TEXT UNIQUE,
+    created_at TEXT,
+    updated_at TEXT
 );
\ No newline at end of file
diff --git a/appmgr/src/error.rs b/appmgr/src/error.rs
index c597be535..a7d768849 100644
--- a/appmgr/src/error.rs
+++ b/appmgr/src/error.rs
@@ -54,7 +54,8 @@ pub enum ErrorKind {
     Wifi = 46,
     Journald = 47,
     Zfs = 48,
-    PasswordHashGeneration = 49,
+    OpenSsl = 49,
+    PasswordHashGeneration = 50,
 }
 impl ErrorKind {
     pub fn as_str(&self) -> &'static str {
@@ -108,6 +109,7 @@ impl ErrorKind {
             Wifi => "WiFi Internal Error",
             Journald => "Journald Error",
             Zfs => "ZFS Error",
+            OpenSsl => "OpenSSL Internal Error",
             PasswordHashGeneration => "Password Hash Generation Error",
         }
     }
@@ -203,6 +205,11 @@ impl From<std::net::AddrParseError> for Error {
         Error::new(e, ErrorKind::ParseNetAddress)
     }
 }
+impl From<openssl::error::ErrorStack> for Error {
+    fn from(e: openssl::error::ErrorStack) -> Self {
+        Error::new(anyhow!("OpenSSL ERROR:\n{}", e), ErrorKind::OpenSsl)
+    }
+}
 impl From<Error> for RpcError {
     fn from(e: Error) -> Self {
         let mut data_object = serde_json::Map::with_capacity(2);
diff --git a/appmgr/src/net/mod.rs b/appmgr/src/net/mod.rs
index 9d9cd4c66..a059f72fe 100644
--- a/appmgr/src/net/mod.rs
+++ b/appmgr/src/net/mod.rs
@@ -14,6 +14,7 @@ use crate::Error;
 pub mod interface;
 #[cfg(feature = "avahi")]
 pub mod mdns;
+pub mod ssl;
 pub mod tor;
 pub mod wifi;
 
diff --git a/appmgr/src/net/ssl.rs b/appmgr/src/net/ssl.rs
new file mode 100644
index 000000000..e3827b004
--- /dev/null
+++ b/appmgr/src/net/ssl.rs
@@ -0,0 +1,442 @@
+use std::cmp::Ordering;
+
+use anyhow::anyhow;
+use openssl::asn1::{Asn1Integer, Asn1Time};
+use openssl::bn::{BigNum, MsbOption};
+use openssl::ec::{EcGroup, EcKey};
+use openssl::hash::MessageDigest;
+use openssl::nid::Nid;
+use openssl::pkey::{PKey, Private};
+use openssl::x509::{X509Builder, X509Extension, X509NameBuilder, X509};
+use openssl::*;
+use sqlx::SqlitePool;
+use tokio::sync::Mutex;
+
+use crate::{Error, ErrorKind};
+
+pub struct SslManager {
+    store: SslStore,
+    root_cert: X509,
+    int_key: PKey<Private>,
+    int_cert: X509,
+}
+
+struct SslStore {
+    secret_store: SqlitePool,
+}
+impl SslStore {
+    fn new(db: SqlitePool) -> Result<Self, Error> {
+        Ok(SslStore { secret_store: db })
+    }
+    async fn save_root_certificate(&self, key: &PKey<Private>, cert: &X509) -> Result<(), Error> {
+        let key_str = String::from_utf8(key.private_key_to_pem_pkcs8()?)?;
+        let cert_str = String::from_utf8(cert.to_pem()?)?;
+        let _n = sqlx::query!("INSERT INTO certificates (id, priv_key_pem, certificate_pem, lookup_string, created_at, updated_at) VALUES (0, ?, ?, NULL, datetime('now'), datetime('now'))", key_str, cert_str).execute(&self.secret_store).await?;
+        Ok(())
+    }
+    async fn load_root_certificate(&self) -> Result<Option<(PKey<Private>, X509)>, Error> {
+        let m_row =
+            sqlx::query!("SELECT priv_key_pem, certificate_pem FROM certificates WHERE id = 0;")
+                .fetch_optional(&self.secret_store)
+                .await?;
+        match m_row {
+            None => Ok(None),
+            Some(row) => {
+                let priv_key = PKey::private_key_from_pem(&row.priv_key_pem.into_bytes())?;
+                let certificate = X509::from_pem(&row.certificate_pem.into_bytes())?;
+                Ok(Some((priv_key, certificate)))
+            }
+        }
+    }
+    async fn save_intermediate_certificate(
+        &self,
+        key: &PKey<Private>,
+        cert: &X509,
+    ) -> Result<(), Error> {
+        let key_str = String::from_utf8(key.private_key_to_pem_pkcs8()?)?;
+        let cert_str = String::from_utf8(cert.to_pem()?)?;
+        let _n = sqlx::query!("INSERT INTO certificates (id, priv_key_pem, certificate_pem, lookup_string, created_at, updated_at) VALUES (1, ?, ?, NULL, datetime('now'), datetime('now'))", key_str, cert_str).execute(&self.secret_store).await?;
+        Ok(())
+    }
+    async fn load_intermediate_certificate(&self) -> Result<Option<(PKey<Private>, X509)>, Error> {
+        let m_row =
+            sqlx::query!("SELECT priv_key_pem, certificate_pem FROM certificates WHERE id = 1;")
+                .fetch_optional(&self.secret_store)
+                .await?;
+        match m_row {
+            None => Ok(None),
+            Some(row) => {
+                let priv_key = PKey::private_key_from_pem(&row.priv_key_pem.into_bytes())?;
+                let certificate = X509::from_pem(&row.certificate_pem.into_bytes())?;
+                Ok(Some((priv_key, certificate)))
+            }
+        }
+    }
+    async fn save_certificate(
+        &self,
+        key: &PKey<Private>,
+        cert: &X509,
+        lookup_string: &str,
+    ) -> Result<(), Error> {
+        let key_str = String::from_utf8(key.private_key_to_pem_pkcs8()?)?;
+        let cert_str = String::from_utf8(cert.to_pem()?)?;
+        let _n = sqlx::query!("INSERT INTO certificates (priv_key_pem, certificate_pem, lookup_string, created_at, updated_at) VALUES (?, ?, ?, datetime('now'), datetime('now'))", key_str, cert_str, lookup_string).execute(&self.secret_store).await?;
+        Ok(())
+    }
+    async fn load_certificate(
+        &self,
+        lookup_string: &str,
+    ) -> Result<Option<(PKey<Private>, X509)>, Error> {
+        let m_row = sqlx::query!(
+            "SELECT priv_key_pem, certificate_pem FROM certificates WHERE lookup_string = ?",
+            lookup_string
+        )
+        .fetch_optional(&self.secret_store)
+        .await?;
+        match m_row {
+            None => Ok(None),
+            Some(row) => {
+                let priv_key = PKey::private_key_from_pem(&row.priv_key_pem.into_bytes())?;
+                let certificate = X509::from_pem(&row.certificate_pem.into_bytes())?;
+                Ok(Some((priv_key, certificate)))
+            }
+        }
+    }
+    async fn update_certificate(
+        &self,
+        key: &PKey<Private>,
+        cert: &X509,
+        lookup_string: &str,
+    ) -> Result<(), Error> {
+        let key_str = String::from_utf8(key.private_key_to_pem_pkcs8()?)?;
+        let cert_str = String::from_utf8(cert.to_pem()?)?;
+        let n = sqlx::query!("UPDATE certificates SET priv_key_pem = ?, certificate_pem = ?, updated_at = datetime('now') WHERE lookup_string = ?", key_str, cert_str, lookup_string).execute(&self.secret_store).await?;
+        if n.rows_affected() == 0 {
+            return Err(Error::new(
+                anyhow!(
+                    "Attempted to update non-existent certificate: {}",
+                    lookup_string
+                ),
+                ErrorKind::OpenSsl,
+            ));
+        }
+        Ok(())
+    }
+}
+
+const EC_CURVE_NAME: nid::Nid = nid::Nid::X9_62_PRIME256V1;
+lazy_static::lazy_static! {
+    static ref EC_GROUP: EcGroup = EcGroup::from_curve_name(EC_CURVE_NAME).unwrap();
+    static ref SSL_MUTEX: Mutex<()> = Mutex::new(()); // TODO: make thread safe
+}
+
+impl SslManager {
+    pub async fn init(db: SqlitePool) -> Result<Self, Error> {
+        let store = SslStore::new(db)?;
+        let (root_key, root_cert) = match store.load_root_certificate().await? {
+            None => {
+                let root_key = generate_key()?;
+                let root_cert = make_root_cert(&root_key)?;
+                store.save_root_certificate(&root_key, &root_cert).await?;
+                Ok::<_, Error>((root_key, root_cert))
+            }
+            Some((key, cert)) => Ok((key, cert)),
+        }?;
+        let (int_key, int_cert) = match store.load_intermediate_certificate().await? {
+            None => {
+                let int_key = generate_key()?;
+                let int_cert = make_int_cert((&root_key, &root_cert), &int_key)?;
+                store
+                    .save_intermediate_certificate(&int_key, &int_cert)
+                    .await?;
+                Ok::<_, Error>((int_key, int_cert))
+            }
+            Some((key, cert)) => Ok((key, cert)),
+        }?;
+        Ok(SslManager {
+            store,
+            root_cert,
+            int_key,
+            int_cert,
+        })
+    }
+
+    pub async fn certificate_for(
+        &self,
+        dns_base: &str,
+    ) -> Result<(PKey<Private>, Vec<X509>), Error> {
+        let (key, cert) = match self.store.load_certificate(dns_base).await? {
+            None => {
+                let key = generate_key()?;
+                let cert = make_leaf_cert((&self.int_key, &self.int_cert), (&key, dns_base))?;
+                self.store.save_certificate(&key, &cert, dns_base).await?;
+                Ok::<_, Error>((key, cert))
+            }
+            Some((key, cert)) => {
+                let window_end = Asn1Time::days_from_now(30)?;
+                let expiration = cert.not_after();
+                if expiration.compare(&window_end)? == Ordering::Less {
+                    let key = generate_key()?;
+                    let cert = make_leaf_cert((&self.int_key, &self.int_cert), (&key, dns_base))?;
+                    Ok((key, cert))
+                } else {
+                    Ok((key, cert))
+                }
+            }
+        }?;
+        Ok((
+            key,
+            vec![cert, self.int_cert.clone(), self.root_cert.clone()],
+        ))
+    }
+}
+
+fn rand_serial() -> Result<Asn1Integer, Error> {
+    let mut bn = BigNum::new()?;
+    bn.rand(64, MsbOption::MAYBE_ZERO, false)?;
+    let asn1 = Asn1Integer::from_bn(&bn)?;
+    Ok(asn1)
+}
+fn generate_key() -> Result<PKey<Private>, Error> {
+    let new_key = EcKey::generate(EC_GROUP.as_ref())?;
+    let key = PKey::from_ec_key(new_key)?;
+    Ok(key)
+}
+fn make_root_cert(root_key: &PKey<Private>) -> Result<X509, Error> {
+    let mut builder = X509Builder::new()?;
+    builder.set_version(3)?;
+
+    let embargo = Asn1Time::days_from_now(0)?;
+    builder.set_not_before(&embargo)?;
+
+    let expiration = Asn1Time::days_from_now(3650)?;
+    builder.set_not_after(&expiration)?;
+
+    builder.set_serial_number(&*rand_serial()?)?;
+
+    let mut subject_name_builder = X509NameBuilder::new()?;
+    subject_name_builder.append_entry_by_text("CN", "Embassy Local Root CA")?;
+    subject_name_builder.append_entry_by_text("O", "Start9")?;
+    subject_name_builder.append_entry_by_text("OU", "Embassy")?;
+    let subject_name = subject_name_builder.build();
+    builder.set_subject_name(&subject_name)?;
+
+    builder.set_issuer_name(&subject_name)?;
+
+    builder.set_pubkey(&root_key)?;
+
+    // Extensions
+    let cfg = conf::Conf::new(conf::ConfMethod::default())?;
+    let ctx = builder.x509v3_context(None, Some(&cfg));
+    // subjectKeyIdentifier = hash
+    let subject_key_identifier =
+        X509Extension::new_nid(Some(&cfg), Some(&ctx), Nid::SUBJECT_KEY_IDENTIFIER, "hash")?;
+    // basicConstraints = critical, CA:true, pathlen:0
+    let basic_constraints = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::BASIC_CONSTRAINTS,
+        "critical,CA:true",
+    )?;
+    // keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+    let key_usage = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::KEY_USAGE,
+        "critical,digitalSignature,cRLSign,keyCertSign",
+    )?;
+    builder.append_extension(subject_key_identifier)?;
+    builder.append_extension(basic_constraints)?;
+    builder.append_extension(key_usage)?;
+    builder.sign(&root_key, MessageDigest::sha256())?;
+    let cert = builder.build();
+    Ok(cert)
+}
+fn make_int_cert(
+    signer: (&PKey<Private>, &X509),
+    applicant: &PKey<Private>,
+) -> Result<X509, Error> {
+    let mut builder = X509Builder::new()?;
+    builder.set_version(3)?;
+
+    let embargo = Asn1Time::days_from_now(0)?;
+    builder.set_not_before(&embargo)?;
+
+    let expiration = Asn1Time::days_from_now(3650)?;
+    builder.set_not_after(&expiration)?;
+
+    builder.set_serial_number(&*rand_serial()?)?;
+
+    let mut subject_name_builder = X509NameBuilder::new()?;
+    subject_name_builder.append_entry_by_text("CN", "Embassy Local Intermediate CA")?;
+    subject_name_builder.append_entry_by_text("O", "Start9")?;
+    subject_name_builder.append_entry_by_text("OU", "Embassy")?;
+    let subject_name = subject_name_builder.build();
+    builder.set_subject_name(&subject_name)?;
+
+    builder.set_issuer_name(signer.1.subject_name())?;
+
+    builder.set_pubkey(&applicant)?;
+
+    let cfg = conf::Conf::new(conf::ConfMethod::default())?;
+    let ctx = builder.x509v3_context(Some(&signer.1), Some(&cfg));
+    // subjectKeyIdentifier = hash
+    let subject_key_identifier =
+        X509Extension::new_nid(Some(&cfg), Some(&ctx), Nid::SUBJECT_KEY_IDENTIFIER, "hash")?;
+    // authorityKeyIdentifier = keyid:always,issuer
+    let authority_key_identifier = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::AUTHORITY_KEY_IDENTIFIER,
+        "keyid:always,issuer",
+    )?;
+    // basicConstraints = critical, CA:true, pathlen:0
+    let basic_constraints = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::BASIC_CONSTRAINTS,
+        "critical,CA:true,pathlen:0",
+    )?;
+    // keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+    let key_usage = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::KEY_USAGE,
+        "critical,digitalSignature,cRLSign,keyCertSign",
+    )?;
+    builder.append_extension(subject_key_identifier)?;
+    builder.append_extension(authority_key_identifier)?;
+    builder.append_extension(basic_constraints)?;
+    builder.append_extension(key_usage)?;
+    builder.sign(&signer.0, MessageDigest::sha256())?;
+    let cert = builder.build();
+    Ok(cert)
+}
+
+fn make_leaf_cert(
+    signer: (&PKey<Private>, &X509),
+    applicant: (&PKey<Private>, &str),
+) -> Result<X509, Error> {
+    let mut builder = X509Builder::new()?;
+    builder.set_version(3)?;
+
+    let embargo = Asn1Time::days_from_now(0)?;
+    builder.set_not_before(&embargo)?;
+
+    // Google Apple and Mozilla reject certificate horizons longer than 397 days
+    // https://techbeacon.com/security/google-apple-mozilla-enforce-1-year-max-security-certifications
+    let expiration = Asn1Time::days_from_now(397)?;
+    builder.set_not_after(&expiration)?;
+
+    builder.set_serial_number(&*rand_serial()?)?;
+
+    let mut subject_name_builder = X509NameBuilder::new()?;
+    subject_name_builder.append_entry_by_text("CN", &format!("{}.local", &applicant.1))?;
+    subject_name_builder.append_entry_by_text("O", "Start9")?;
+    subject_name_builder.append_entry_by_text("OU", "Embassy")?;
+    let subject_name = subject_name_builder.build();
+    builder.set_subject_name(&subject_name)?;
+
+    builder.set_issuer_name(signer.1.subject_name())?;
+
+    builder.set_pubkey(&applicant.0)?;
+
+    // Extensions
+    let cfg = conf::Conf::new(conf::ConfMethod::default())?;
+    let ctx = builder.x509v3_context(Some(&signer.1), Some(&cfg));
+    // subjectKeyIdentifier = hash
+    let subject_key_identifier =
+        X509Extension::new_nid(Some(&cfg), Some(&ctx), Nid::SUBJECT_KEY_IDENTIFIER, "hash")?;
+    // authorityKeyIdentifier = keyid:always,issuer
+    let authority_key_identifier = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::AUTHORITY_KEY_IDENTIFIER,
+        "keyid:always,issuer",
+    )?;
+    // basicConstraints = critical, CA:true, pathlen:0
+    let basic_constraints = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::BASIC_CONSTRAINTS,
+        "critical,CA:true,pathlen:0",
+    )?;
+    // keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+    let key_usage = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::KEY_USAGE,
+        "critical,digitalSignature,cRLSign,keyCertSign",
+    )?;
+
+    let subject_alt_name = X509Extension::new_nid(
+        Some(&cfg),
+        Some(&ctx),
+        Nid::SUBJECT_ALT_NAME,
+        &format!(
+            "DNS:*.{}.local,DNS:{}.onion,DNS:*.{}.onion",
+            &applicant.1, &applicant.1, &applicant.1
+        ),
+    )?;
+    builder.append_extension(subject_key_identifier)?;
+    builder.append_extension(authority_key_identifier)?;
+    builder.append_extension(subject_alt_name)?;
+    builder.append_extension(basic_constraints)?;
+    builder.append_extension(key_usage)?;
+
+    builder.sign(&signer.0, MessageDigest::sha256())?;
+
+    let cert = builder.build();
+    Ok(cert)
+}
+
+#[tokio::test]
+async fn ca_details_persist() -> Result<(), Error> {
+    let pool = sqlx::Pool::<sqlx::Sqlite>::connect("sqlite::memory:").await?;
+    sqlx::query_file!("migrations/20210629193146_Init.sql")
+        .execute(&pool)
+        .await?;
+    let mgr = SslManager::init(pool.clone()).await?;
+    let root_cert0 = mgr.root_cert;
+    let int_key0 = mgr.int_key;
+    let int_cert0 = mgr.int_cert;
+    let mgr = SslManager::init(pool).await?;
+    let root_cert1 = mgr.root_cert;
+    let int_key1 = mgr.int_key;
+    let int_cert1 = mgr.int_cert;
+
+    assert_eq!(root_cert0.to_pem()?, root_cert1.to_pem()?);
+    assert_eq!(
+        int_key0.private_key_to_pem_pkcs8()?,
+        int_key1.private_key_to_pem_pkcs8()?
+    );
+    assert_eq!(int_cert0.to_pem()?, int_cert1.to_pem()?);
+    Ok(())
+}
+
+#[tokio::test]
+async fn certificate_details_persist() -> Result<(), Error> {
+    let pool = sqlx::Pool::<sqlx::Sqlite>::connect("sqlite::memory:").await?;
+    sqlx::query_file!("migrations/20210629193146_Init.sql")
+        .execute(&pool)
+        .await?;
+    let mgr = SslManager::init(pool.clone()).await?;
+    let (key0, cert_chain0) = mgr.certificate_for("start9").await?;
+    let (key1, cert_chain1) = mgr.certificate_for("start9").await?;
+
+    assert_eq!(
+        key0.private_key_to_pem_pkcs8()?,
+        key1.private_key_to_pem_pkcs8()?
+    );
+    assert_eq!(
+        cert_chain0
+            .iter()
+            .map(|cert| cert.to_pem().unwrap())
+            .collect::<Vec<Vec<u8>>>(),
+        cert_chain1
+            .iter()
+            .map(|cert| cert.to_pem().unwrap())
+            .collect::<Vec<Vec<u8>>>()
+    );
+    Ok(())
+}
diff --git a/compat/Cargo.lock b/compat/Cargo.lock
index 16b6ac6d1..975325c22 100644
--- a/compat/Cargo.lock
+++ b/compat/Cargo.lock
@@ -8,7 +8,7 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e8b47f52ea9bae42228d07ec09eb676433d7c4ed1ebdf0f1d1c29ed446f1ab8"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "cipher",
  "cpufeatures",
  "ctr",
@@ -108,15 +108,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
 
-[[package]]
-name = "avahi-sys"
-version = "0.10.0"
-source = "git+https://github.com/Start9Labs/avahi-sys?branch=feature/dynamic-linking#12bef9e435cfb0d36cb229b9d08e2114c176ea7a"
-dependencies = [
- "bindgen",
- "libc",
-]
-
 [[package]]
 name = "base-x"
 version = "0.2.8"
@@ -152,30 +143,6 @@ dependencies = [
  "regex",
 ]
 
-[[package]]
-name = "bindgen"
-version = "0.55.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75b13ce559e6433d360c26305643803cb52cfbabbc2b9c47ce04a58493dfb443"
-dependencies = [
- "bitflags",
- "cexpr",
- "cfg-if 0.1.10",
- "clang-sys",
- "clap",
- "env_logger 0.7.1",
- "lazy_static",
- "lazycell",
- "log",
- "peeking_take_while",
- "proc-macro2 1.0.29",
- "quote 1.0.9",
- "regex",
- "rustc-hash",
- "shlex",
- "which",
-]
-
 [[package]]
 name = "bit-set"
 version = "0.5.2"
@@ -319,21 +286,6 @@ version = "1.0.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d26a6ce4b6a484fa3edb70f7efa6fc430fd2b87285fe8b84304fd0936faa0dc0"
 
-[[package]]
-name = "cexpr"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4aedb84272dbe89af497cf81375129abda4fc0a9e7c5d317498c15cc30c0d27"
-dependencies = [
- "nom 5.1.2",
-]
-
-[[package]]
-name = "cfg-if"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
-
 [[package]]
 name = "cfg-if"
 version = "1.0.0"
@@ -373,17 +325,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "clang-sys"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10612c0ec0e0a1ff0e97980647cb058a6e7aedb913d01d009c406b8b7d0b26ee"
-dependencies = [
- "glob",
- "libc",
- "libloading",
-]
-
 [[package]]
 name = "clap"
 version = "2.33.3"
@@ -399,6 +340,16 @@ dependencies = [
  "vec_map",
 ]
 
+[[package]]
+name = "compat"
+version = "0.1.0"
+dependencies = [
+ "clap",
+ "embassy-os",
+ "serde",
+ "serde_yaml",
+]
+
 [[package]]
 name = "const_fn"
 version = "0.4.8"
@@ -517,7 +468,7 @@ version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ae5588f6b3c3cb05239e90bd110f257254aecd01e4635400391aeae07497845"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-epoch",
@@ -531,7 +482,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06ed27e177f16d65f0f0c22a213e17c696ace5dd64b14258b52f9417ccb52db4"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "crossbeam-utils",
 ]
 
@@ -541,7 +492,7 @@ version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
@@ -552,7 +503,7 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ec02e091aa634e2c3ada4a392989e7c3116673ef0ac5b72232439094d73b7fd"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "crossbeam-utils",
  "lazy_static",
  "memoffset",
@@ -565,7 +516,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b10ddc024425c88c2ad148c1b0fd53f4c6d38db9697c9f1588381212fa657c9"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "crossbeam-utils",
 ]
 
@@ -575,7 +526,7 @@ version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d82cfc11ce7f2c3faef78d8a684447b40d503d9681acebed6cb728d45940c4db"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "lazy_static",
 ]
 
@@ -719,7 +670,7 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "dirs-sys-next",
 ]
 
@@ -799,7 +750,6 @@ dependencies = [
  "aes",
  "anyhow",
  "async-trait",
- "avahi-sys",
  "base32",
  "basic-cookies",
  "bollard",
@@ -895,20 +845,7 @@ version = "0.8.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "80df024fbc5ac80f87dfef0d9f5209a252f2a497f7f42944cff24d8253cac065"
 dependencies = [
- "cfg-if 1.0.0",
-]
-
-[[package]]
-name = "env_logger"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
-dependencies = [
- "atty",
- "humantime 1.3.0",
- "log",
- "regex",
- "termcolor",
+ "cfg-if",
 ]
 
 [[package]]
@@ -918,7 +855,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b2cf0344971ee6c64c31be0d530793fba457d322dfec2810c453d0ef228f9c3"
 dependencies = [
  "atty",
- "humantime 2.1.0",
+ "humantime",
  "log",
  "regex",
  "termcolor",
@@ -939,7 +876,7 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "975ccf83d8d9d0d84682850a38c8169027be83368805971cc4f238c2b245bc98"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "libc",
  "redox_syscall 0.2.10",
  "winapi",
@@ -1118,7 +1055,7 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "libc",
  "wasi 0.9.0+wasi-snapshot-preview1",
 ]
@@ -1129,7 +1066,7 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "libc",
  "wasi 0.10.0+wasi-snapshot-preview1",
 ]
@@ -1156,12 +1093,6 @@ dependencies = [
  "syn 1.0.76",
 ]
 
-[[package]]
-name = "glob"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
-
 [[package]]
 name = "h2"
 version = "0.3.4"
@@ -1273,15 +1204,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6456b8a6c8f33fee7d958fcd1b60d55b11940a79e63ae87013e6d22e26034440"
 
-[[package]]
-name = "humantime"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
-dependencies = [
- "quick-error 1.2.3",
-]
-
 [[package]]
 name = "humantime"
 version = "2.1.0"
@@ -1332,7 +1254,7 @@ source = "git+https://github.com/Start9Labs/hyper-ws-listener.git?branch=main#d5
 dependencies = [
  "anyhow",
  "base64",
- "env_logger 0.9.0",
+ "env_logger",
  "futures",
  "hyper",
  "log",
@@ -1397,7 +1319,7 @@ version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bee0328b1209d157ef001c94dd85b4f8f64139adb0eac2659f4b08382b2f474d"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
 ]
 
 [[package]]
@@ -1523,12 +1445,6 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
 [[package]]
 name = "lexical-core"
 version = "0.7.6"
@@ -1537,7 +1453,7 @@ checksum = "6607c62aa161d23d17a9072cc5da0be67cdfc89d3afb1e8d9c842bebc2525ffe"
 dependencies = [
  "arrayvec",
  "bitflags",
- "cfg-if 1.0.0",
+ "cfg-if",
  "ryu",
  "static_assertions",
 ]
@@ -1548,16 +1464,6 @@ version = "0.2.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3cb00336871be5ed2c8ed44b60ae9959dc5b9f08539422ed43f09e34ecaeba21"
 
-[[package]]
-name = "libloading"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f84d96438c15fcd6c3f244c8fce01d1e2b9c6b5623e9c711dc9286d8fc92d6a"
-dependencies = [
- "cfg-if 1.0.0",
- "winapi",
-]
-
 [[package]]
 name = "libsqlite3-sys"
 version = "0.22.2"
@@ -1590,7 +1496,7 @@ version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
 ]
 
 [[package]]
@@ -1697,7 +1603,7 @@ checksum = "b2ccba0cfe4fdf15982d1674c69b1fd80bad427d293849982668dfe454bd61f2"
 dependencies = [
  "bitflags",
  "cc",
- "cfg-if 1.0.0",
+ "cfg-if",
  "libc",
 ]
 
@@ -1709,7 +1615,7 @@ checksum = "df8e5e343312e7fbeb2a52139114e9e702991ef9c2aea6817ff2440b35647d56"
 dependencies = [
  "bitflags",
  "cc",
- "cfg-if 1.0.0",
+ "cfg-if",
  "libc",
  "memoffset",
 ]
@@ -1722,21 +1628,11 @@ checksum = "e7555d6c7164cc913be1ce7f95cbecdabda61eb2ccd89008524af306fb7f5031"
 dependencies = [
  "bitflags",
  "cc",
- "cfg-if 1.0.0",
+ "cfg-if",
  "libc",
  "memoffset",
 ]
 
-[[package]]
-name = "nom"
-version = "5.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb4262d26ed83a1c0a33a38fe2bb15797329c85770da05e6b828ddb782627af"
-dependencies = [
- "memchr",
- "version_check",
-]
-
 [[package]]
 name = "nom"
 version = "6.1.2"
@@ -1831,7 +1727,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d9facdb76fec0b73c406f125d44d86fdad818d66fef0531eec9233ca425ff4a"
 dependencies = [
  "bitflags",
- "cfg-if 1.0.0",
+ "cfg-if",
  "foreign-types",
  "libc",
  "once_cell",
@@ -1884,7 +1780,7 @@ version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "instant",
  "libc",
  "redox_syscall 0.2.10",
@@ -1956,12 +1852,6 @@ dependencies = [
  "sha2",
 ]
 
-[[package]]
-name = "peeking_take_while"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
-
 [[package]]
 name = "percent-encoding"
 version = "2.1.0"
@@ -2489,12 +2379,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc_version"
 version = "0.2.3"
@@ -2745,7 +2629,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99cd6713db3cf16b6c84e06321e049a9b9f699826e16096d23bbcc44d15d51a6"
 dependencies = [
  "block-buffer",
- "cfg-if 1.0.0",
+ "cfg-if",
  "cpufeatures",
  "digest",
  "opaque-debug",
@@ -2764,7 +2648,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91e36fa7752016a6c4483706d634fd82c48860dd2df17a0cfaaebc714f23b2dd"
 dependencies = [
  "block-buffer",
- "cfg-if 1.0.0",
+ "cfg-if",
  "cpufeatures",
  "digest",
  "opaque-debug",
@@ -2782,12 +2666,6 @@ dependencies = [
  "opaque-debug",
 ]
 
-[[package]]
-name = "shlex"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fdf1b9db47230893d76faad238fd6097fd6d6a9245cd7a4d90dbd639536bbd2"
-
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.0"
@@ -3112,7 +2990,7 @@ version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dac1c663cfc93810f88aed9b8941d48cabf856a1b111c29a40439018d870eb22"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "libc",
  "rand 0.8.4",
  "redox_syscall 0.2.10",
@@ -3449,7 +3327,7 @@ version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09adeb8c97449311ccd28a427f96fb563e7fd31aabf994189879d9da2394b89d"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "pin-project-lite 0.2.7",
  "tracing-core",
 ]
@@ -3646,7 +3524,7 @@ version = "0.2.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e68338db6becec24d3c7977b5bf8a48be992c934b5d07177e3931f5dc9b076c"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "serde",
  "serde_json",
  "wasm-bindgen-macro",
@@ -3673,7 +3551,7 @@ version = "0.4.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a87d738d4abc4cf22f6eb142f5b9a81301331ee3c767f2fef2fda4e325492060"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
  "js-sys",
  "wasm-bindgen",
  "web-sys",
@@ -3737,15 +3615,6 @@ dependencies = [
  "webpki",
 ]
 
-[[package]]
-name = "which"
-version = "3.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d011071ae14a2f6671d0b74080ae0cd8ebf3a6f8c9589a2cd45f23126fe29724"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "whoami"
 version = "1.1.3"