fix grub config

* feat: add "Add new gateway" option

* Update web/projects/ui/src/app/routes/portal/components/form/controls/select.component.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* add translation

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Matt Hill <mattnine@protonmail.com>

.claude/settings.json

@@ -1 +0,0 @@
-{}

.github/actions/setup-build/action.yml

@@ -1,81 +0,0 @@
-name: Setup Build Environment
-description: Common build environment setup steps
-
-inputs:
-  nodejs-version:
-    description: Node.js version
-    required: true
-  setup-python:
-    description: Set up Python
-    required: false
-    default: "false"
-  setup-docker:
-    description: Set up Docker QEMU and Buildx
-    required: false
-    default: "true"
-  setup-sccache:
-    description: Configure sccache for GitHub Actions
-    required: false
-    default: "true"
-  free-space:
-    description: Remove unnecessary packages to free disk space
-    required: false
-    default: "true"
-
-runs:
-  using: composite
-  steps:
-    - name: Free disk space
-      if: inputs.free-space == 'true'
-      shell: bash
-      run: |
-        sudo apt-get remove --purge -y azure-cli || true
-        sudo apt-get remove --purge -y firefox || true
-        sudo apt-get remove --purge -y ghc-* || true
-        sudo apt-get remove --purge -y google-cloud-sdk || true
-        sudo apt-get remove --purge -y google-chrome-stable || true
-        sudo apt-get remove --purge -y powershell || true
-        sudo apt-get remove --purge -y php* || true
-        sudo apt-get remove --purge -y ruby* || true
-        sudo apt-get remove --purge -y mono-* || true
-        sudo apt-get autoremove -y
-        sudo apt-get clean
-        sudo rm -rf /usr/lib/jvm
-        sudo rm -rf /usr/local/.ghcup
-        sudo rm -rf /usr/local/lib/android
-        sudo rm -rf /usr/share/dotnet
-        sudo rm -rf /usr/share/swift
-        sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-
-    # BuildJet runners lack /opt/hostedtoolcache, which setup-python and setup-qemu expect
-    - name: Ensure hostedtoolcache exists
-      shell: bash
-      run: sudo mkdir -p /opt/hostedtoolcache && sudo chown $USER:$USER /opt/hostedtoolcache
-
-    - name: Set up Python
-      if: inputs.setup-python == 'true'
-      uses: actions/setup-python@v5
-      with:
-        python-version: "3.x"
-
-    - uses: actions/setup-node@v4
-      with:
-        node-version: ${{ inputs.nodejs-version }}
-        cache: npm
-        cache-dependency-path: "**/package-lock.json"
-
-    - name: Set up Docker QEMU
-      if: inputs.setup-docker == 'true'
-      uses: docker/setup-qemu-action@v3
-
-    - name: Set up Docker Buildx
-      if: inputs.setup-docker == 'true'
-      uses: docker/setup-buildx-action@v3
-
-    - name: Configure sccache
-      if: inputs.setup-sccache == 'true'
-      uses: actions/github-script@v7
-      with:
-        script: |
-          core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
-          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

.github/workflows/start-cli.yaml

@@ -37,10 +37,6 @@ on:
       - master
       - next/*
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
 env:
   NODEJS_VERSION: "24.11.0"
   ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
@@ -48,7 +44,6 @@ env:
 jobs:
   compile:
     name: Build Debian Package
-    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: true
       matrix:
@@ -65,15 +60,50 @@ jobs:
           }}
     runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
     steps:
-      - name: Mount tmpfs
+      - name: Cleaning up unnecessary files
+        run: |
+          sudo apt-get remove --purge -y mono-* \
+            ghc* cabal-install* \
+            dotnet* \
+            php* \
+            ruby* \
+            mysql-* \
+            postgresql-* \
+            azure-cli \
+            powershell \
+            google-cloud-sdk \
+            msodbcsql* mssql-tools* \
+            imagemagick* \
+            libgl1-mesa-dri \
+            google-chrome-stable \
+            firefox
+          sudo apt-get autoremove -y
+          sudo apt-get clean
+
+      - run: |
+          sudo mount -t tmpfs tmpfs .
         if: ${{ github.event.inputs.runner == 'fast' }}
-        run: sudo mount -t tmpfs tmpfs .
+
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: ./.github/actions/setup-build
+
+      - uses: actions/setup-node@v4
         with:
-          nodejs-version: ${{ env.NODEJS_VERSION }}
+          node-version: ${{ env.NODEJS_VERSION }}
+
+      - name: Set up docker QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Configure sccache
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
       - name: Make
         run: TARGET=${{ matrix.triple }} make cli

.github/workflows/start-registry.yaml

@@ -1,4 +1,4 @@
-name: start-registry
+name: Start-Registry
 
 on:
   workflow_call:
@@ -35,10 +35,6 @@ on:
       - master
       - next/*
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
 env:
   NODEJS_VERSION: "24.11.0"
   ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
@@ -46,7 +42,6 @@ env:
 jobs:
   compile:
     name: Build Debian Package
-    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: true
       matrix:
@@ -61,15 +56,50 @@ jobs:
           }}
     runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
     steps:
-      - name: Mount tmpfs
+      - name: Cleaning up unnecessary files
+        run: |
+          sudo apt-get remove --purge -y mono-* \
+            ghc* cabal-install* \
+            dotnet* \
+            php* \
+            ruby* \
+            mysql-* \
+            postgresql-* \
+            azure-cli \
+            powershell \
+            google-cloud-sdk \
+            msodbcsql* mssql-tools* \
+            imagemagick* \
+            libgl1-mesa-dri \
+            google-chrome-stable \
+            firefox
+          sudo apt-get autoremove -y
+          sudo apt-get clean
+
+      - run: |
+          sudo mount -t tmpfs tmpfs .
         if: ${{ github.event.inputs.runner == 'fast' }}
-        run: sudo mount -t tmpfs tmpfs .
+
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: ./.github/actions/setup-build
+
+      - uses: actions/setup-node@v4
         with:
-          nodejs-version: ${{ env.NODEJS_VERSION }}
+          node-version: ${{ env.NODEJS_VERSION }}
+
+      - name: Set up docker QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Configure sccache
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
       - name: Make
         run: make registry-deb

.github/workflows/start-tunnel.yaml

@@ -1,4 +1,4 @@
-name: start-tunnel
+name: Start-Tunnel
 
 on:
   workflow_call:
@@ -35,10 +35,6 @@ on:
       - master
       - next/*
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
 env:
   NODEJS_VERSION: "24.11.0"
   ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
@@ -46,7 +42,6 @@ env:
 jobs:
   compile:
     name: Build Debian Package
-    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: true
       matrix:
@@ -61,15 +56,50 @@ jobs:
           }}
     runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
     steps:
-      - name: Mount tmpfs
+      - name: Cleaning up unnecessary files
+        run: |
+          sudo apt-get remove --purge -y mono-* \
+            ghc* cabal-install* \
+            dotnet* \
+            php* \
+            ruby* \
+            mysql-* \
+            postgresql-* \
+            azure-cli \
+            powershell \
+            google-cloud-sdk \
+            msodbcsql* mssql-tools* \
+            imagemagick* \
+            libgl1-mesa-dri \
+            google-chrome-stable \
+            firefox
+          sudo apt-get autoremove -y
+          sudo apt-get clean
+
+      - run: |
+          sudo mount -t tmpfs tmpfs .
         if: ${{ github.event.inputs.runner == 'fast' }}
-        run: sudo mount -t tmpfs tmpfs .
+
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: ./.github/actions/setup-build
+
+      - uses: actions/setup-node@v4
         with:
-          nodejs-version: ${{ env.NODEJS_VERSION }}
+          node-version: ${{ env.NODEJS_VERSION }}
+
+      - name: Set up docker QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Configure sccache
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
       - name: Make
         run: make tunnel-deb

.github/workflows/startos-iso.yaml

@@ -27,7 +27,7 @@ on:
           - x86_64-nonfree
           - aarch64
           - aarch64-nonfree
-          # - raspberrypi
+          - raspberrypi
           - riscv64
       deploy:
         type: choice
@@ -45,10 +45,6 @@ on:
       - master
       - next/*
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
 env:
   NODEJS_VERSION: "24.11.0"
   ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'
@@ -56,7 +52,6 @@ env:
 jobs:
   compile:
     name: Compile Base Binaries
-    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: true
       matrix:
@@ -91,16 +86,54 @@ jobs:
         )[github.event.inputs.runner == 'fast']
       }}
     steps:
-      - name: Mount tmpfs
+      - name: Cleaning up unnecessary files
+        run: |
+          sudo apt-get remove --purge -y azure-cli || true
+          sudo apt-get remove --purge -y firefox || true
+          sudo apt-get remove --purge -y ghc-* || true
+          sudo apt-get remove --purge -y google-cloud-sdk || true
+          sudo apt-get remove --purge -y google-chrome-stable || true
+          sudo apt-get remove --purge -y powershell || true
+          sudo apt-get remove --purge -y php* || true
+          sudo apt-get remove --purge -y ruby* || true
+          sudo apt-get remove --purge -y mono-* || true
+          sudo apt-get autoremove -y
+          sudo apt-get clean
+          sudo rm -rf /usr/lib/jvm               # All JDKs
+          sudo rm -rf /usr/local/.ghcup          # Haskell toolchain
+          sudo rm -rf /usr/local/lib/android     # Android SDK/NDK, emulator
+          sudo rm -rf /usr/share/dotnet          # .NET SDKs
+          sudo rm -rf /usr/share/swift           # Swift toolchain (if present)
+          sudo rm -rf "$AGENT_TOOLSDIRECTORY"    # Pre-cached tool cache (Go, Node, etc.)
+      - run: |
+          sudo mount -t tmpfs tmpfs .
         if: ${{ github.event.inputs.runner == 'fast' }}
-        run: sudo mount -t tmpfs tmpfs .
+
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: ./.github/actions/setup-build
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
         with:
-          nodejs-version: ${{ env.NODEJS_VERSION }}
-          setup-python: "true"
+          python-version: "3.x"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODEJS_VERSION }}
+
+      - name: Set up docker QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Configure sccache
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
       - name: Make
         run: make ARCH=${{ matrix.arch }} compiled-${{ matrix.arch }}.tar
@@ -118,14 +151,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # TODO: re-add "raspberrypi" to the platform list below
         platform: >-
           ${{
             fromJson(
               format(
                 '[
                   ["{0}"],
-                  ["x86_64", "x86_64-nonfree", "aarch64", "aarch64-nonfree", "riscv64"]
+                  ["x86_64", "x86_64-nonfree", "aarch64", "aarch64-nonfree", "riscv64", "raspberrypi"]
                 ]',
                 github.event.inputs.platform || 'ALL'
               )
@@ -189,10 +221,6 @@ jobs:
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"    # Pre-cached tool cache (Go, Node, etc.)
         if: ${{ github.event.inputs.runner != 'fast' }}
 
-      # BuildJet runners lack /opt/hostedtoolcache, which setup-qemu expects
-      - name: Ensure hostedtoolcache exists
-        run: sudo mkdir -p /opt/hostedtoolcache && sudo chown $USER:$USER /opt/hostedtoolcache
-
       - name: Set up docker QEMU
         uses: docker/setup-qemu-action@v3
 

.github/workflows/test.yaml

@@ -10,10 +10,6 @@ on:
       - master
       - next/*
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
 env:
   NODEJS_VERSION: "24.11.0"
   ENVIRONMENT: dev-unstable
@@ -21,18 +17,15 @@ env:
 jobs:
   test:
     name: Run Automated Tests
-    if: github.event.pull_request.draft != true
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: ./.github/actions/setup-build
+
+      - uses: actions/setup-node@v4
         with:
-          nodejs-version: ${{ env.NODEJS_VERSION }}
-          free-space: "false"
-          setup-docker: "false"
-          setup-sccache: "false"
+          node-version: ${{ env.NODEJS_VERSION }}
 
       - name: Build And Run Tests
         run: make test

.gitignore

@@ -19,6 +19,4 @@ secrets.db
 /compiled.tar
 /compiled-*.tar
 /build/lib/firmware
-tmp
-web/.i18n-checked
-docs/USER.md
+tmp

ARCHITECTURE.md

@@ -1,101 +0,0 @@
-# Architecture
-
-StartOS is an open-source Linux distribution for running personal servers. It manages discovery, installation, network configuration, backups, and health monitoring of self-hosted services.
-
-## Tech Stack
-
-- Backend: Rust (async/Tokio, Axum web framework)
-- Frontend: Angular 20 + TypeScript + TaigaUI
-- Container runtime: Node.js/TypeScript with LXC
-- Database/State: Patch-DB (git submodule) - storage layer with reactive frontend sync
-- API: JSON-RPC via rpc-toolkit (see `core/rpc-toolkit.md`)
-- Auth: Password + session cookie, public/private key signatures, local authcookie (see `core/src/middleware/auth/`)
-
-## Project Structure
-
-```bash
-/
-├── assets/              # Screenshots for README
-├── build/               # Auxiliary files and scripts for deployed images
-├── container-runtime/   # Node.js program managing package containers
-├── core/                # Rust backend: API, daemon (startd), CLI (start-cli)
-├── debian/              # Debian package maintainer scripts
-├── image-recipe/        # Scripts for building StartOS images
-├── patch-db/            # (submodule) Diff-based data store for frontend sync
-├── sdk/                 # TypeScript SDK for building StartOS packages
-└── web/                 # Web UIs (Angular)
-```
-
-## Components
-
-- **`core/`** — Rust backend daemon. Produces a single binary `startbox` that is symlinked as `startd` (main daemon), `start-cli` (CLI), `start-container` (runs inside LXC containers), `registrybox` (package registry), and `tunnelbox` (VPN/tunnel). Handles all backend logic: RPC API, service lifecycle, networking (DNS, ACME, WiFi, Tor, WireGuard), backups, and database state management. See [core/ARCHITECTURE.md](core/ARCHITECTURE.md).
-
-- **`web/`** — Angular 20 + TypeScript workspace using Taiga UI. Contains three applications (admin UI, setup wizard, VPN management) and two shared libraries (common components/services, marketplace). Communicates with the backend exclusively via JSON-RPC. See [web/ARCHITECTURE.md](web/ARCHITECTURE.md).
-
-- **`container-runtime/`** — Node.js runtime that runs inside each service's LXC container. Loads the service's JavaScript from its S9PK package and manages subcontainers. Communicates with the host daemon via JSON-RPC over Unix socket. See [container-runtime/CLAUDE.md](container-runtime/CLAUDE.md).
-
-- **`sdk/`** — TypeScript SDK for packaging services for StartOS (`@start9labs/start-sdk`). Split into `base/` (core types, ABI definitions, effects interface, consumed by web as `@start9labs/start-sdk-base`) and `package/` (full SDK for service developers, consumed by container-runtime as `@start9labs/start-sdk`).
-
-- **`patch-db/`** — Git submodule providing diff-based state synchronization. Uses CBOR encoding. Backend mutations produce diffs that are pushed to the frontend via WebSocket, enabling reactive UI updates without polling. See [patch-db repo](https://github.com/Start9Labs/patch-db).
-
-## Build Pipeline
-
-Components have a strict dependency chain. Changes flow in one direction:
-
-```
-Rust (core/)
-  → cargo test exports ts-rs types to core/bindings/
-    → rsync copies to sdk/base/lib/osBindings/
-      → SDK build produces baseDist/ and dist/
-        → web/ consumes baseDist/ (via @start9labs/start-sdk-base)
-        → container-runtime/ consumes dist/ (via @start9labs/start-sdk)
-```
-
-Key make targets along this chain:
-
-| Step | Command | What it does |
-|---|---|---|
-| 1 | `cargo check -p start-os` | Verify Rust compiles |
-| 2 | `make ts-bindings` | Export ts-rs types → rsync to SDK |
-| 3 | `cd sdk && make baseDist dist` | Build SDK packages |
-| 4 | `cd web && npm run check` | Type-check Angular projects |
-| 5 | `cd container-runtime && npm run check` | Type-check runtime |
-
-**Important**: Editing `sdk/base/lib/osBindings/*.ts` alone is NOT sufficient — you must rebuild the SDK bundle (step 3) before web/container-runtime can see the changes.
-
-## Cross-Layer Verification
-
-When making changes across multiple layers (Rust, SDK, web, container-runtime), verify in this order:
-
-1. **Rust**: `cargo check -p start-os` — verifies core compiles
-2. **TS bindings**: `make ts-bindings` — regenerates TypeScript types from Rust `#[ts(export)]` structs
-   - Runs `./core/build/build-ts.sh` to export ts-rs types to `core/bindings/`
-   - Syncs `core/bindings/` → `sdk/base/lib/osBindings/` via rsync
-   - If you manually edit files in `sdk/base/lib/osBindings/`, you must still rebuild the SDK (step 3)
-3. **SDK bundle**: `cd sdk && make baseDist dist` — compiles SDK source into packages
-   - `baseDist/` is consumed by `/web` (via `@start9labs/start-sdk-base`)
-   - `dist/` is consumed by `/container-runtime` (via `@start9labs/start-sdk`)
-   - Web and container-runtime reference the **built** SDK, not source files
-4. **Web type check**: `cd web && npm run check` — type-checks all Angular projects
-5. **Container runtime type check**: `cd container-runtime && npm run check` — type-checks the runtime
-
-## Data Flow: Backend to Frontend
-
-StartOS uses Patch-DB for reactive state synchronization:
-
-1. The backend mutates state via `db.mutate()`, producing CBOR diffs
-2. Diffs are pushed to the frontend over a persistent WebSocket connection
-3. The frontend applies diffs to its local state copy and notifies observers
-4. Components watch specific database paths via `PatchDB.watch$()`, receiving updates reactively
-
-This means the UI is always eventually consistent with the backend — after any mutating API call, the frontend waits for the corresponding PatchDB diff before resolving, so the UI reflects the result immediately.
-
-## Further Reading
-
-- [core/ARCHITECTURE.md](core/ARCHITECTURE.md) — Rust backend architecture
-- [web/ARCHITECTURE.md](web/ARCHITECTURE.md) — Angular frontend architecture
-- [container-runtime/CLAUDE.md](container-runtime/CLAUDE.md) — Container runtime details
-- [core/rpc-toolkit.md](core/rpc-toolkit.md) — JSON-RPC handler patterns
-- [core/s9pk-structure.md](core/s9pk-structure.md) — S9PK package format
-- [docs/exver.md](docs/exver.md) — Extended versioning format
-- [docs/VERSION_BUMP.md](docs/VERSION_BUMP.md) — Version bumping guide

CLAUDE.md

@@ -1,55 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Architecture
-
-See [ARCHITECTURE.md](ARCHITECTURE.md) for the full system architecture, component map, build pipeline, and cross-layer verification order.
-
-Each major component has its own `CLAUDE.md` with detailed guidance: `core/`, `web/`, `container-runtime/`, `sdk/`.
-
-## Build & Development
-
-See [CONTRIBUTING.md](CONTRIBUTING.md) for:
-- Environment setup and requirements
-- Build commands and make targets
-- Testing and formatting commands
-- Environment variables
-
-**Quick reference:**
-```bash
-. ./devmode.sh                            # Enable dev mode
-make update-startbox REMOTE=start9@<ip>   # Fastest iteration (binary + UI)
-make test-core                            # Run Rust tests
-```
-
-## Operating Rules
-
-- Always verify cross-layer changes using the order described in [ARCHITECTURE.md](ARCHITECTURE.md#cross-layer-verification)
-- Check component-level CLAUDE.md files for component-specific conventions
-- Follow existing patterns before inventing new ones
-
-## Supplementary Documentation
-
-The `docs/` directory contains cross-cutting documentation for AI assistants:
-
-- `TODO.md` - Pending tasks for AI agents (check this first, remove items when completed)
-- `USER.md` - Current user identifier (gitignored, see below)
-- `exver.md` - Extended versioning format (used across core, sdk, and web)
-- `VERSION_BUMP.md` - Guide for bumping the StartOS version across the codebase
-
-Component-specific docs live alongside their code (e.g., `core/rpc-toolkit.md`, `core/i18n-patterns.md`).
-
-### Session Startup
-
-On startup:
-
-1. **Check for `docs/USER.md`** - If it doesn't exist, prompt the user for their name/identifier and create it. This file is gitignored since it varies per developer.
-
-2. **Check `docs/TODO.md` for relevant tasks** - Show TODOs that either:
-   - Have no `@username` tag (relevant to everyone)
-   - Are tagged with the current user's identifier
-
-   Skip TODOs tagged with a different user.
-
-3. **Ask "What would you like to do today?"** - Offer options for each relevant TODO item, plus "Something else" for other requests.

CONTRIBUTING.md

@@ -1,240 +1,133 @@
 # Contributing to StartOS
 
-This guide is for contributing to the StartOS. If you are interested in packaging a service for StartOS, visit the [service packaging guide](https://github.com/Start9Labs/ai-service-packaging). If you are interested in promoting, providing technical support, creating tutorials, or helping in other ways, please visit the [Start9 website](https://start9.com/contribute).
+This guide is for contributing to the StartOS. If you are interested in packaging a service for StartOS, visit the [service packaging guide](https://docs.start9.com/latest/packaging-guide/). If you are interested in promoting, providing technical support, creating tutorials, or helping in other ways, please visit the [Start9 website](https://start9.com/contribute).
 
 ## Collaboration
 
-- [Matrix](https://matrix.to/#/#dev-startos:matrix.start9labs.com)
+- [Matrix](https://matrix.to/#/#community-dev:matrix.start9labs.com)
+- [Telegram](https://t.me/start9_labs/47471)
 
-For project structure and system architecture, see [ARCHITECTURE.md](ARCHITECTURE.md).
+## Project Structure
+
+```bash
+/
+├── assets/
+├── container-runtime/
+├── core/
+├── build/
+├── debian/
+├── web/
+├── image-recipe/
+├── patch-db
+└── sdk/
+```
+
+#### assets
+
+screenshots for the StartOS README
+
+#### container-runtime
+
+A NodeJS program that dynamically loads maintainer scripts and communicates with the OS to manage packages
+
+#### core
+
+An API, daemon (startd), and CLI (start-cli) that together provide the core functionality of StartOS.
+
+#### build
+
+Auxiliary files and scripts to include in deployed StartOS images
+
+#### debian
+
+Maintainer scripts for the StartOS Debian package
+
+#### web
+
+Web UIs served under various conditions and used to interact with StartOS APIs.
+
+#### image-recipe
+
+Scripts for building StartOS images
+
+#### patch-db (submodule)
+
+A diff based data store used to synchronize data between the web interfaces and server.
+
+#### sdk
+
+A typescript sdk for building start-os packages
 
 ## Environment Setup
 
-### Installing Dependencies (Debian/Ubuntu)
-
-> Debian/Ubuntu is the only officially supported build environment.
-> MacOS has limited build capabilities and Windows requires [WSL2](https://learn.microsoft.com/en-us/windows/wsl/install).
+#### Clone the StartOS repository
 
 ```sh
-sudo apt update
-sudo apt install -y ca-certificates curl gpg build-essential
-curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
-echo "deb [arch=$(dpkg-architecture -q DEB_HOST_ARCH) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian bookworm stable" | sudo tee /etc/apt/sources.list.d/docker.list
-sudo apt update
-sudo apt install -y sed grep gawk jq gzip brotli containerd.io docker-ce docker-ce-cli docker-compose-plugin qemu-user-static binfmt-support squashfs-tools git debspawn rsync b3sum
-sudo mkdir -p /etc/debspawn/
-echo "AllowUnsafePermissions=true" | sudo tee /etc/debspawn/global.toml
-sudo usermod -aG docker $USER
-sudo su $USER
-docker run --privileged --rm tonistiigi/binfmt --install all
-docker buildx create --use
-curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # proceed with default installation
-curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh | bash
-source ~/.bashrc
-nvm install 24
-nvm use 24
-nvm alias default 24 # this prevents your machine from reverting back to another version
-```
-
-### Cloning the Repository
-
-```sh
-git clone --recursive https://github.com/Start9Labs/start-os.git --branch next/major
+git clone https://github.com/Start9Labs/start-os.git --recurse-submodules
 cd start-os
 ```
 
-### Development Mode
+#### Continue to your project of interest for additional instructions:
 
-For faster iteration during development:
-
-```sh
-. ./devmode.sh
-```
-
-This sets `ENVIRONMENT=dev` and `GIT_BRANCH_AS_HASH=1` to prevent rebuilds on every commit.
+- [`core`](core/README.md)
+- [`web-interfaces`](web-interfaces/README.md)
+- [`build`](build/README.md)
+- [`patch-db`](https://github.com/Start9Labs/patch-db)
 
 ## Building
 
-All builds can be performed on any operating system that can run Docker.
-
-This project uses [GNU Make](https://www.gnu.org/software/make/) to build its components.
+This project uses [GNU Make](https://www.gnu.org/software/make/) to build its components. To build any specific component, simply run `make <TARGET>` replacing `<TARGET>` with the name of the target you'd like to build
 
 ### Requirements
 
 - [GNU Make](https://www.gnu.org/software/make/)
-- [Docker](https://docs.docker.com/get-docker/) or [Podman](https://podman.io/)
+- [Docker](https://docs.docker.com/get-docker/)
 - [NodeJS v20.16.0](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
-- [Rust](https://rustup.rs/) (nightly for formatting)
-- [sed](https://www.gnu.org/software/sed/), [grep](https://www.gnu.org/software/grep/), [awk](https://www.gnu.org/software/gawk/)
+- [sed](https://www.gnu.org/software/sed/)
+- [grep](https://www.gnu.org/software/grep/)
+- [awk](https://www.gnu.org/software/gawk/)
 - [jq](https://jqlang.github.io/jq/)
-- [gzip](https://www.gnu.org/software/gzip/), [brotli](https://github.com/google/brotli)
+- [gzip](https://www.gnu.org/software/gzip/)
+- [brotli](https://github.com/google/brotli)
 
-### Environment Variables
+### Environment variables
 
-| Variable             | Description                                                                                         |
-| -------------------- | --------------------------------------------------------------------------------------------------- |
-| `PLATFORM`           | Target platform: `x86_64`, `x86_64-nonfree`, `aarch64`, `aarch64-nonfree`, `riscv64`, `raspberrypi` |
-| `ENVIRONMENT`        | Hyphen-separated feature flags (see below)                                                          |
-| `PROFILE`            | Build profile: `release` (default) or `dev`                                                         |
-| `GIT_BRANCH_AS_HASH` | Set to `1` to use git branch name as version hash (avoids rebuilds)                                 |
+- `PLATFORM`: which platform you would like to build for. Must be one of `x86_64`, `x86_64-nonfree`, `aarch64`, `aarch64-nonfree`, `raspberrypi`
+  - NOTE: `nonfree` images are for including `nonfree` firmware packages in the built ISO
+- `ENVIRONMENT`: a hyphen separated set of feature flags to enable
+  - `dev`: enables password ssh (INSECURE!) and does not compress frontends
+  - `unstable`: enables assertions that will cause errors on unexpected inconsistencies that are undesirable in production use either for performance or reliability reasons
+  - `docker`: use `docker` instead of `podman`
+- `GIT_BRANCH_AS_HASH`: set to `1` to use the current git branch name as the git hash so that the project does not need to be rebuilt on each commit
 
-**ENVIRONMENT flags:**
+### Useful Make Targets
 
-- `dev` - Enables password SSH before setup, skips frontend compression
-- `unstable` - Enables assertions and debugging with performance penalty
-- `console` - Enables tokio-console for async debugging
-
-**Platform notes:**
-
-- `-nonfree` variants include proprietary firmware and drivers
-- `raspberrypi` includes non-free components by necessity
-- Platform is remembered between builds if not specified
-
-### Make Targets
-
-#### Building
-
-| Target        | Description                                    |
-| ------------- | ---------------------------------------------- |
-| `iso`         | Create full `.iso` image (not for raspberrypi) |
-| `img`         | Create full `.img` image (raspberrypi only)    |
-| `deb`         | Build Debian package                           |
-| `all`         | Build all Rust binaries                        |
-| `uis`         | Build all web UIs                              |
-| `ui`          | Build main UI only                             |
-| `ts-bindings` | Generate TypeScript bindings from Rust types   |
-
-#### Deploying to Device
-
-For devices on the same network:
-
-| Target                               | Description                                     |
-| ------------------------------------ | ----------------------------------------------- |
-| `update-startbox REMOTE=start9@<ip>` | Deploy binary + UI only (fastest)               |
-| `update-deb REMOTE=start9@<ip>`      | Deploy full Debian package                      |
-| `update REMOTE=start9@<ip>`          | OTA-style update                                |
-| `reflash REMOTE=start9@<ip>`         | Reflash as if using live ISO                    |
-| `update-overlay REMOTE=start9@<ip>`  | Deploy to in-memory overlay (reverts on reboot) |
-
-For devices on different networks (uses [magic-wormhole](https://github.com/magic-wormhole/magic-wormhole)):
-
-| Target              | Description          |
-| ------------------- | -------------------- |
-| `wormhole`          | Send startbox binary |
-| `wormhole-deb`      | Send Debian package  |
-| `wormhole-squashfs` | Send squashfs image  |
-
-### Creating a VM
-
-Install virt-manager:
-
-```sh
-sudo apt update
-sudo apt install -y virt-manager
-sudo usermod -aG libvirt $USER
-sudo su $USER
-virt-manager
-```
-
-Follow the screenshot walkthrough in [`assets/create-vm/`](assets/create-vm/) to create a new virtual machine. Key steps:
-
-1. Create a new virtual machine
-2. Browse for the ISO — create a storage pool pointing to your `results/` directory
-3. Select "Generic or unknown OS"
-4. Set memory and CPUs
-5. Create a disk and name the VM
-
-Build an ISO first:
-
-```sh
-PLATFORM=$(uname -m) ENVIRONMENT=dev make iso
-```
-
-#### Other
-
-| Target                   | Description                                 |
-| ------------------------ | ------------------------------------------- |
-| `format`                 | Run code formatting (Rust nightly required) |
-| `test`                   | Run all automated tests                     |
-| `test-core`              | Run Rust tests                              |
-| `test-sdk`               | Run SDK tests                               |
-| `test-container-runtime` | Run container runtime tests                 |
-| `clean`                  | Delete all compiled artifacts               |
-
-## Testing
-
-```bash
-make test                    # All tests
-make test-core               # Rust tests (via ./core/run-tests.sh)
-make test-sdk                # SDK tests
-make test-container-runtime  # Container runtime tests
-
-# Run specific Rust test
-cd core && cargo test <test_name> --features=test
-```
-
-## Code Formatting
-
-```bash
-# Rust (requires nightly)
-make format
-
-# TypeScript/HTML/SCSS (web)
-cd web && npm run format
-```
-
-## Code Style Guidelines
-
-### Formatting
-
-Run the formatters before committing. Configuration is handled by `rustfmt.toml` (Rust) and prettier configs (TypeScript).
-
-### Documentation & Comments
-
-**Rust:**
-
-- Add doc comments (`///`) to public APIs, structs, and non-obvious functions
-- Use `//` comments sparingly for complex logic that isn't self-evident
-- Prefer self-documenting code (clear naming, small functions) over comments
-
-**TypeScript:**
-
-- Document exported functions and complex types with JSDoc
-- Keep comments focused on "why" rather than "what"
-
-**General:**
-
-- Don't add comments that just restate the code
-- Update or remove comments when code changes
-- TODOs should include context: `// TODO(username): reason`
-
-### Commit Messages
-
-Use [Conventional Commits](https://www.conventionalcommits.org/):
-
-```
-<type>(<scope>): <description>
-
-[optional body]
-
-[optional footer]
-```
-
-**Types:**
-
-- `feat` - New feature
-- `fix` - Bug fix
-- `docs` - Documentation only
-- `style` - Formatting, no code change
-- `refactor` - Code change that neither fixes a bug nor adds a feature
-- `test` - Adding or updating tests
-- `chore` - Build process, dependencies, etc.
-
-**Examples:**
-
-```
-feat(web): add dark mode toggle
-fix(core): resolve race condition in service startup
-docs: update CONTRIBUTING.md with style guidelines
-refactor(sdk): simplify package validation logic
-```
+- `iso`: Create a full `.iso` image
+  - Only possible from Debian
+  - Not available for `PLATFORM=raspberrypi`
+  - Additional Requirements:
+    - [debspawn](https://github.com/lkhq/debspawn)
+- `img`: Create a full `.img` image
+  - Only possible from Debian
+  - Only available for `PLATFORM=raspberrypi`
+  - Additional Requirements:
+    - [debspawn](https://github.com/lkhq/debspawn)
+- `format`: Run automatic code formatting for the project
+  - Additional Requirements:
+    - [rust](https://rustup.rs/)
+- `test`: Run automated tests for the project
+  - Additional Requirements:
+    - [rust](https://rustup.rs/)
+- `update`: Deploy the current working project to a device over ssh as if through an over-the-air update
+  - Requires an argument `REMOTE` which is the ssh address of the device, i.e. `start9@192.168.122.2`
+- `reflash`: Deploy the current working project to a device over ssh as if using a live `iso` image to reflash it
+  - Requires an argument `REMOTE` which is the ssh address of the device, i.e. `start9@192.168.122.2`
+- `update-overlay`: Deploy the current working project to a device over ssh to the in-memory overlay without restarting it
+  - WARNING: changes will be reverted after the device is rebooted
+  - WARNING: changes to `init` will not take effect as the device is already initialized
+  - Requires an argument `REMOTE` which is the ssh address of the device, i.e. `start9@192.168.122.2`
+- `wormhole`: Deploy the `startbox` to a device using [magic-wormhole](https://github.com/magic-wormhole/magic-wormhole)
+  - When the build it complete will emit a command to paste into the shell of the device to upgrade it
+  - Additional Requirements:
+    - [magic-wormhole](https://github.com/magic-wormhole/magic-wormhole)
+- `clean`: Delete all compiled artifacts

DEVELOPMENT.md

@@ -0,0 +1,134 @@
+# Setting up your development environment on Debian/Ubuntu
+
+A step-by-step guide
+
+> This is the only officially supported build environment.
+> MacOS has limited build capabilities and Windows requires [WSL2](https://learn.microsoft.com/en-us/windows/wsl/install)
+
+## Installing dependencies
+
+Run the following commands one at a time
+
+```sh
+sudo apt update
+sudo apt install -y ca-certificates curl gpg build-essential
+curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+echo "deb [arch=$(dpkg-architecture -q DEB_HOST_ARCH) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian bookworm stable" | sudo tee /etc/apt/sources.list.d/docker.list
+sudo apt update
+sudo apt install -y sed grep gawk jq gzip brotli containerd.io docker-ce docker-ce-cli docker-compose-plugin qemu-user-static binfmt-support squashfs-tools git debspawn rsync b3sum
+sudo mkdir -p /etc/debspawn/
+echo "AllowUnsafePermissions=true" | sudo tee /etc/debspawn/global.toml
+sudo usermod -aG docker $USER
+sudo su $USER
+docker run --privileged --rm tonistiigi/binfmt --install all
+docker buildx create --use
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # proceed with default installation
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh | bash
+source ~/.bashrc
+nvm install 24
+nvm use 24
+nvm alias default 24 # this prevents your machine from reverting back to another version
+```
+
+## Cloning the repository
+
+```sh
+git clone --recursive https://github.com/Start9Labs/start-os.git --branch next/major
+cd start-os
+```
+
+## Building an ISO
+
+```sh
+PLATFORM=$(uname -m) ENVIRONMENT=dev make iso
+```
+
+This will build an ISO for your current architecture. If you are building to run on an architecture other than the one you are currently on, replace `$(uname -m)` with the correct platform for the device (one of `aarch64`, `aarch64-nonfree`, `x86_64`, `x86_64-nonfree`, `raspberrypi`)
+
+## Creating a VM
+
+### Install virt-manager
+
+```sh
+sudo apt update
+sudo apt install -y virt-manager
+sudo usermod -aG libvirt $USER
+sudo su $USER
+```
+
+### Launch virt-manager
+
+```sh
+virt-manager
+```
+
+### Create new virtual machine
+
+![Select "Create a new virtual machine"](assets/create-vm/step-1.png)
+![Click "Forward"](assets/create-vm/step-2.png)
+![Click "Browse"](assets/create-vm/step-3.png)
+![Click "+"](assets/create-vm/step-4.png)
+
+#### make sure to set "Target Path" to the path to your results directory in start-os
+
+![Create storage pool](assets/create-vm/step-5.png)
+![Select storage pool](assets/create-vm/step-6.png)
+![Select ISO](assets/create-vm/step-7.png)
+![Select "Generic or unknown OS" and click "Forward"](assets/create-vm/step-8.png)
+![Set Memory and CPUs](assets/create-vm/step-9.png)
+![Create disk](assets/create-vm/step-10.png)
+![Name VM](assets/create-vm/step-11.png)
+![Create network](assets/create-vm/step-12.png)
+
+## Updating a VM
+
+The fastest way to update a VM to your latest code depends on what you changed:
+
+### UI or startd:
+
+```sh
+PLATFORM=$(uname -m) ENVIRONMENT=dev make update-startbox REMOTE=start9@<VM IP>
+```
+
+### Container runtime or debian dependencies:
+
+```sh
+PLATFORM=$(uname -m) ENVIRONMENT=dev make update-deb REMOTE=start9@<VM IP>
+```
+
+### Image recipe:
+
+```sh
+PLATFORM=$(uname -m) ENVIRONMENT=dev make update-squashfs REMOTE=start9@<VM IP>
+```
+
+---
+
+If the device you are building for is not available via ssh, it is also possible to use `magic-wormhole` to send the relevant files.
+
+### Prerequisites:
+
+```sh
+sudo apt update
+sudo apt install -y magic-wormhole
+```
+
+As before, the fastest way to update a VM to your latest code depends on what you changed. Each of the following commands will return a command to paste into the shell of the device you would like to upgrade.
+
+### UI or startd:
+
+```sh
+PLATFORM=$(uname -m) ENVIRONMENT=dev make wormhole
+```
+
+### Container runtime or debian dependencies:
+
+```sh
+PLATFORM=$(uname -m) ENVIRONMENT=dev make wormhole-deb
+```
+
+### Image recipe:
+
+```sh
+PLATFORM=$(uname -m) ENVIRONMENT=dev make wormhole-squashfs
+```

Makefile

@@ -236,9 +236,9 @@ update-startbox: core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox
 update-deb: results/$(BASENAME).deb # better than update, but only available from debian
 	@if [ -z "$(REMOTE)" ]; then >&2 echo "Must specify REMOTE" && false; fi
 	$(call ssh,'sudo /usr/lib/startos/scripts/chroot-and-upgrade --create')
-	$(call mkdir,/media/startos/next/var/tmp/startos-deb)
-	$(call cp,results/$(BASENAME).deb,/media/startos/next/var/tmp/startos-deb/$(BASENAME).deb)
-	$(call ssh,'sudo /media/startos/next/usr/lib/startos/scripts/chroot-and-upgrade --no-sync "apt-get install -y --reinstall /var/tmp/startos-deb/$(BASENAME).deb"')
+	$(call mkdir,/media/startos/next/tmp/startos-deb)
+	$(call cp,results/$(BASENAME).deb,/media/startos/next/tmp/startos-deb/$(BASENAME).deb)
+	$(call ssh,'sudo /media/startos/next/usr/lib/startos/scripts/chroot-and-upgrade --no-sync "apt-get install -y --reinstall /tmp/startos-deb/$(BASENAME).deb"')
 
 update-squashfs: results/$(BASENAME).squashfs
 	@if [ -z "$(REMOTE)" ]; then >&2 echo "Must specify REMOTE" && false; fi
@@ -324,19 +324,15 @@ web/.angular/.updated: patch-db/client/dist/index.js sdk/baseDist/package.json w
 	mkdir -p web/.angular
 	touch web/.angular/.updated
 
-web/.i18n-checked: $(WEB_SHARED_SRC) $(WEB_UI_SRC) $(WEB_SETUP_WIZARD_SRC) $(WEB_START_TUNNEL_SRC)
-	npm --prefix web run check:i18n
-	touch web/.i18n-checked
-
-web/dist/raw/ui/index.html: $(WEB_UI_SRC) $(WEB_SHARED_SRC) web/.angular/.updated web/.i18n-checked
+web/dist/raw/ui/index.html: $(WEB_UI_SRC) $(WEB_SHARED_SRC) web/.angular/.updated
 	npm --prefix web run build:ui
 	touch web/dist/raw/ui/index.html
 
-web/dist/raw/setup-wizard/index.html: $(WEB_SETUP_WIZARD_SRC) $(WEB_SHARED_SRC) web/.angular/.updated web/.i18n-checked
+web/dist/raw/setup-wizard/index.html: $(WEB_SETUP_WIZARD_SRC) $(WEB_SHARED_SRC) web/.angular/.updated
 	npm --prefix web run build:setup
 	touch web/dist/raw/setup-wizard/index.html
 
-web/dist/raw/start-tunnel/index.html: $(WEB_START_TUNNEL_SRC) $(WEB_SHARED_SRC) web/.angular/.updated web/.i18n-checked
+web/dist/raw/start-tunnel/index.html: $(WEB_START_TUNNEL_SRC) $(WEB_SHARED_SRC) web/.angular/.updated
 	npm --prefix web run build:tunnel
 	touch web/dist/raw/start-tunnel/index.html
 

README.md

@@ -7,64 +7,76 @@
   <a href="https://github.com/Start9Labs/start-os/actions/workflows/startos-iso.yaml">
     <img src="https://github.com/Start9Labs/start-os/actions/workflows/startos-iso.yaml/badge.svg">
   </a>
-  <a href="https://heyapollo.com/product/startos">
+    <a href="https://heyapollo.com/product/startos">
     <img alt="Static Badge" src="https://img.shields.io/badge/apollo-review%20%E2%AD%90%E2%AD%90%E2%AD%90%E2%AD%90%E2%AD%90%20-slateblue">
   </a>
   <a href="https://twitter.com/start9labs">
     <img alt="X (formerly Twitter) Follow" src="https://img.shields.io/twitter/follow/start9labs">
   </a>
+  <a href="https://matrix.to/#/#community:matrix.start9labs.com">
+    <img alt="Static Badge" src="https://img.shields.io/badge/community-matrix-yellow?logo=matrix">
+  </a>
+  <a href="https://t.me/start9_labs">
+    <img alt="Static Badge" src="https://img.shields.io/badge/community-telegram-blue?logo=telegram">
+  </a>
   <a href="https://docs.start9.com">
     <img alt="Static Badge" src="https://img.shields.io/badge/docs-orange?label=%F0%9F%91%A4%20support">
   </a>
-  <a href="https://matrix.to/#/#dev-startos:matrix.start9labs.com">
+  <a href="https://matrix.to/#/#community-dev:matrix.start9labs.com">
     <img alt="Static Badge" src="https://img.shields.io/badge/developer-matrix-darkcyan?logo=matrix">
   </a>
   <a href="https://start9.com">
     <img alt="Website" src="https://img.shields.io/website?up_message=online&down_message=offline&url=https%3A%2F%2Fstart9.com&logo=website&label=%F0%9F%8C%90%20website">
   </a>
 </div>
+<br />
+<div align="center">
+  <h3>
+    Welcome to the era of Sovereign Computing
+  </h3>
+  <p>
+    StartOS is an open source Linux distribution optimized for running a personal server. It facilitates the discovery, installation, network configuration, service configuration, data backup, dependency management, and health monitoring of self-hosted software services.
+  </p>
+</div>
+<br />
+<p align="center">
+<img src="assets/StartOS.png" alt="StartOS" width="85%">
+</p>
+<br />
 
-## What is StartOS?
+## Running StartOS
+> [!WARNING]
+> StartOS is in beta. It lacks features. It doesn't always work perfectly. Start9 servers are not plug and play. Using them properly requires some effort and patience. Please do not use StartOS or purchase a server if you are unable or unwilling to follow instructions and learn new concepts.
 
-StartOS is an open-source Linux distribution for running a personal server. It handles discovery, installation, network configuration, data backup, dependency management, and health monitoring of self-hosted services.
+### 💰 Buy a Start9 server
+This is the most convenient option. Simply [buy a server](https://store.start9.com) from Start9 and plug it in.
 
-**Tech stack:** Rust backend (Tokio/Axum), Angular frontend, Node.js container runtime with LXC, and a custom diff-based database ([Patch-DB](https://github.com/Start9Labs/patch-db)) for reactive state synchronization.
+### 👷 Build your own server
+This option is easier than you might imagine, and there are 4 reasons why you might prefer it:
+1. You already have hardware
+1. You want to save on shipping costs
+1. You prefer not to divulge your physical address
+1. You just like building things
 
-Services run in isolated LXC containers, packaged as [S9PKs](https://github.com/Start9Labs/start-os/blob/master/core/s9pk-structure.md) — a signed, merkle-archived format that supports partial downloads and cryptographic verification.
+To pursue this option, follow one of our [DIY guides](https://start9.com/latest/diy).
 
-## What can you do with it?
+## ❤️ Contributing
+There are multiple ways to contribute: work directly on StartOS, package a service for the marketplace, or help with documentation and guides. To learn more about contributing, see [here](https://start9.com/contribute/).
 
-StartOS lets you self-host services that would otherwise depend on third-party cloud providers — giving you full ownership of your data and infrastructure.
+To report security issues, please email our security team - security@start9.com.
 
-Browse available services on the [Start9 Marketplace](https://marketplace.start9.com/), including:
+## 🌎 Marketplace
+There are dozens of services available for StartOS, and new ones are being added all the time. Check out the full list of available services [here](https://marketplace.start9.com/marketplace). To read more about the Marketplace ecosystem, check out this [blog post](https://blog.start9.com/start9-marketplace-strategy/)
 
-- **Bitcoin & Lightning** — Run a full Bitcoin node, Lightning node, BTCPay Server, and other payment infrastructure
-- **Communication** — Self-host Matrix, SimpleX, or other messaging platforms
-- **Cloud Storage** — Run Nextcloud, Vaultwarden, and other productivity tools
+## 🖥️ User Interface Screenshots
 
-Services are added by the community. If a service you want isn't available, you can [package it yourself](https://github.com/Start9Labs/ai-service-packaging/).
-
-## Getting StartOS
-
-### Buy a Start9 server
-
-The easiest path. [Buy a server](https://store.start9.com) from Start9 and plug it in.
-
-### Build your own
-
-Install StartOS on your own hardware. Follow one of the [DIY guides](https://start9.com/latest/diy). Reasons to go this route:
-
-1. You already have compatible hardware
-2. You want to save on shipping costs
-3. You prefer not to share your physical address
-4. You enjoy building things
-
-### Build from source
-
-See [CONTRIBUTING.md](CONTRIBUTING.md) for environment setup, build instructions, and development workflow.
-
-## Contributing
-
-There are multiple ways to contribute: work directly on StartOS, package a service for the marketplace, or help with documentation and guides. See [CONTRIBUTING.md](CONTRIBUTING.md) or visit [start9.com/contribute](https://start9.com/contribute/).
-
-To report security issues, email [security@start9.com](mailto:security@start9.com).
+<p align="center">
+<img src="assets/registry.png" alt="StartOS Marketplace" width="49%">
+<img src="assets/community.png" alt="StartOS Community Registry" width="49%">
+<img src="assets/c-lightning.png" alt="StartOS NextCloud Service" width="49%">
+<img src="assets/btcpay.png" alt="StartOS BTCPay Service" width="49%">
+<img src="assets/nextcloud.png" alt="StartOS System Settings" width="49%">
+<img src="assets/system.png" alt="StartOS System Settings" width="49%">
+<img src="assets/welcome.png" alt="StartOS System Settings" width="49%">
+<img src="assets/logs.png" alt="StartOS System Settings" width="49%">
+</p>

TODO.md

@@ -1,215 +0,0 @@
-# AI Agent TODOs
-
-Pending tasks for AI agents. Remove items when completed.
-
-## Unreviewed CLAUDE.md Sections
-
-- [ ] Architecture - Web (`/web`) - @MattDHill
-
-## Features
-
-- [ ] Support preferred external ports besides 443 - @dr-bonez
-
-  **Problem**: Currently, port 443 is the only preferred external port that is actually honored. When a
-  service requests `preferred_external_port: 8443` (or any non-443 value) for SSL, the system ignores
-  the preference and assigns a dynamic-range port (49152-65535). The `preferred_external_port` is only
-  used as a label for Tor mappings and as a trigger for the port-443 special case in `update()`.
-
-  **Goal**: Honor `preferred_external_port` for both SSL and non-SSL binds when the requested port is
-  available, with proper conflict resolution and fallback to dynamic-range allocation.
-
-  ### Design
-
-  **Key distinction**: There are two separate concepts for SSL port usage:
-  1. **Port ownership** (`assigned_ssl_port`) — A port exclusively owned by a binding, allocated from
-     `AvailablePorts`. Used for server hostnames (`.local`, mDNS, etc.) and iptables forwards.
-  2. **Domain SSL port** — The port used for domain-based vhost entries. A binding does NOT need to own
-     a port to have a domain vhost on it. The VHostController already supports multiple hostnames on the
-     same port via SNI. Any binding can create a domain vhost entry on any SSL port that the
-     VHostController has a listener for, regardless of who "owns" that port.
-
-  For example: the OS owns port 443 as its `assigned_ssl_port`. A service with
-  `preferred_external_port: 443` won't get 443 as its `assigned_ssl_port` (it's taken), but it CAN
-  still have domain vhost entries on port 443 — SNI routes by hostname.
-
-  #### 1. Preferred Port Allocation for Ownership ✅ DONE
-
-  `AvailablePorts::try_alloc(port) -> Option<u16>` added to `forward.rs`. `BindInfo::new()` and
-  `BindInfo::update()` attempt the preferred port first, falling back to dynamic-range allocation.
-
-  #### 2. Per-Address Enable/Disable ✅ DONE
-
-  Gateway-level `private_disabled`/`public_enabled` on `NetInfo` replaced with per-address
-  `DerivedAddressInfo` on `BindInfo`. `hostname_info` removed from `Host` — computed addresses now
-  live in `BindInfo.addresses.possible`.
-
-  **`DerivedAddressInfo` struct** (on `BindInfo`):
-
-  ```rust
-  pub struct DerivedAddressInfo {
-      pub private_disabled: BTreeSet<HostnameInfo>,
-      pub public_enabled: BTreeSet<HostnameInfo>,
-      pub possible: BTreeSet<HostnameInfo>,  // COMPUTED by update()
-  }
-  ```
-
-  `DerivedAddressInfo::enabled()` returns `possible` filtered by the two sets. `HostnameInfo` derives
-  `Ord` for `BTreeSet` usage. `AddressFilter` (implementing `InterfaceFilter`) derives enabled
-  gateway set from `DerivedAddressInfo` for vhost/forward filtering.
-
-  **RPC endpoint**: `set-gateway-enabled` replaced with `set-address-enabled` (on both
-  `server.host.binding` and `package.host.binding`).
-
-  **How disabling works per address type** (enforcement deferred to Section 3):
-  - **WAN/LAN IP:port**: Will be enforced via **source-IP gating** in the vhost layer (Section 3).
-  - **Hostname-based addresses** (`.local`, domains): Disabled by **not creating the vhost/SNI
-    entry** for that hostname.
-
-  #### 3. Eliminate the Port 5443 Hack: Source-IP-Based WAN Blocking (`vhost.rs`, `net_controller.rs`)
-
-  **Current problem**: The `if ssl.preferred_external_port == 443` branch (line 341 of
-  `net_controller.rs`) creates a bespoke dual-vhost setup: port 5443 for private-only access and port
-  443 for public (or public+private). This exists because both public and private traffic arrive on the
-  same port 443 listener, and the current `InterfaceFilter`/`PublicFilter` model distinguishes
-  public/private by which _network interface_ the connection arrived on — which doesn't work when both
-  traffic types share a listener.
-
-  **Solution**: Determine public vs private based on **source IP** at the vhost level. Traffic arriving
-  from the gateway IP should be treated as public (the gateway may MASQUERADE/NAT internet traffic, so
-  anything from the gateway is potentially public). Traffic from LAN IPs is private.
-
-  This applies to **all** vhost targets, not just port 443:
-  - **Add a `public` field to `ProxyTarget`** (or an enum: `Public`, `Private`, `Both`) indicating
-    what traffic this target accepts, derived from the binding's user-controlled `public` field.
-  - **Modify `VHostTarget::filter()`** (`vhost.rs:342`): Instead of (or in addition to) checking the
-    network interface via `GatewayInfo`, check the source IP of the TCP connection against known gateway
-    IPs. If the source IP matches a gateway or IP outside the subnet, the connection is public;
-    otherwise it's private. Use this to gate against the target's `public` field.
-  - **Eliminate the 5443 port entirely**: A single vhost entry on port 443 (or any shared SSL port) can
-    serve both public and private traffic, with per-target source-IP gating determining which backend
-    handles which connections.
-
-  #### 4. Port Forward Mapping in Patch-DB
-
-  When a binding is marked `public = true`, StartOS must record the required port forwards in patch-db
-  so the frontend can display them to the user. The user then configures these on their router manually.
-
-  For each public binding, store:
-  - The external port the router should forward (the actual vhost port used for domains, or the
-    `assigned_port` / `assigned_ssl_port` for non-domain access)
-  - The protocol (TCP/UDP)
-  - The StartOS LAN IP as the forward target
-  - Which service/binding this forward is for (for display purposes)
-
-  This mapping should be in the public database model so the frontend can read and display it.
-
-  #### 5. Simplify `update()` Domain Vhost Logic (`net_controller.rs`)
-
-  With source-IP gating in the vhost controller:
-  - **Remove the `== 443` special case** and the 5443 secondary vhost.
-  - For **server hostnames** (`.local`, mDNS, embassy, startos, localhost): use `assigned_ssl_port`
-    (the port the binding owns).
-  - For **domain-based vhost entries**: attempt to use `preferred_external_port` as the vhost port.
-    This succeeds if the port is either unused or already has an SSL listener (SNI handles sharing).
-    It fails only if the port is already in use by a non-SSL binding, or is a restricted port. On
-    failure, fall back to `assigned_ssl_port`.
-  - The binding's `public` field determines the `ProxyTarget`'s public/private gating.
-  - Hostname info must exactly match the actual vhost port used: for server hostnames, report
-    `ssl_port: assigned_ssl_port`. For domains, report `ssl_port: preferred_external_port` if it was
-    successfully used for the domain vhost, otherwise report `ssl_port: assigned_ssl_port`.
-
-  #### 6. Reachability Test Endpoint
-
-  New RPC endpoint that tests whether an address is actually reachable, with diagnostic info on
-  failure.
-
-  **RPC endpoint** (`binding.rs` or new file):
-  - **`test-address`** — Test reachability of a specific address.
-
-    ```ts
-    interface BindingTestAddressParams {
-      internalPort: number;
-      address: HostnameInfo;
-    }
-    ```
-
-    The backend simply performs the raw checks and returns the results. The **frontend** owns all
-    interpretation — it already knows the address type, expected IP, expected port, etc. from the
-    `HostnameInfo` data, so it can compare against the backend results and construct fix messaging.
-
-    ```ts
-    interface TestAddressResult {
-      dns: string[] | null; // resolved IPs, null if not a domain address or lookup failed
-      portOpen: boolean | null; // TCP connect result, null if not applicable
-    }
-    ```
-
-    This yields two RPC methods:
-    - `server.host.binding.test-address`
-    - `package.host.binding.test-address`
-
-  The frontend already has the full `HostnameInfo` context (expected IP, domain, port, gateway,
-  public/private). It compares the backend's raw results against the expected state and constructs
-  localized fix instructions. For example:
-  - `dns` returned but doesn't contain the expected WAN IP → "Update DNS A record for {domain}
-    to {wanIp}"
-  - `dns` is `null` for a domain address → "DNS lookup failed for {domain}"
-  - `portOpen` is `false` → "Configure port forward on your router: external {port} TCP →
-    {lanIp}:{port}"
-
-  ### Key Files
-
-  | File                                 | Role                                                                                                                                                    |
-  | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `core/src/net/forward.rs`            | `AvailablePorts` — port pool allocation, `try_alloc()` for preferred ports                                                                              |
-  | `core/src/net/host/binding.rs`       | `Bindings` (Map wrapper for patchdb), `BindInfo`/`NetInfo`/`DerivedAddressInfo`/`AddressFilter` — per-address enable/disable, `set-address-enabled` RPC |
-  | `core/src/net/net_controller.rs:259` | `NetServiceData::update()` — computes `DerivedAddressInfo.possible`, vhost/forward/DNS reconciliation, 5443 hack removal                                |
-  | `core/src/net/vhost.rs`              | `VHostController` / `ProxyTarget` — source-IP gating for public/private                                                                                 |
-  | `core/src/net/gateway.rs`            | `InterfaceFilter` trait and filter types (`AddressFilter`, `PublicFilter`, etc.)                                                                        |
-  | `core/src/net/service_interface.rs`  | `HostnameInfo` — derives `Ord` for `BTreeSet` usage                                                                                                     |
-  | `core/src/net/host/address.rs`       | `HostAddress` (flattened struct), domain CRUD endpoints                                                                                                 |
-  | `sdk/base/lib/interfaces/Host.ts`    | SDK `MultiHost.bindPort()` — no changes needed                                                                                                          |
-  | `core/src/db/model/public.rs`        | Public DB model — port forward mapping                                                                                                                  |
-
-- [ ] Extract TS-exported types into a lightweight sub-crate for fast binding generation
-
-  **Problem**: `make ts-bindings` compiles the entire `start-os` crate (with all dependencies: tokio,
-  axum, openssl, etc.) just to run test functions that serialize type definitions to `.ts` files.
-  Even in debug mode, this takes minutes. The generated output is pure type info — no runtime code
-  is needed.
-
-  **Goal**: Generate TS bindings in seconds by isolating exported types in a small crate with minimal
-  dependencies.
-
-  **Approach**: Create a `core/bindings-types/` sub-crate containing (or re-exporting) all 168
-  `#[ts(export)]` types. This crate depends only on `serde`, `ts-rs`, `exver`, and other type-only
-  crates — not on tokio, axum, openssl, etc. Then `build-ts.sh` runs `cargo test -p bindings-types`
-  instead of `cargo test -p start-os`.
-
-  **Challenge**: The exported types are scattered across `core/src/` and reference each other and
-  other crate types. Extracting them requires either moving the type definitions into the sub-crate
-  (and importing them back into `start-os`) or restructuring to share a common types crate.
-
-- [ ] Use auto-generated RPC types in the frontend instead of manual duplicates
-
-  **Problem**: The web frontend manually defines ~755 lines of API request/response types in
-  `web/projects/ui/src/app/services/api/api.types.ts` that can drift from the actual Rust types.
-
-  **Current state**: The Rust backend already has `#[ts(export)]` on RPC param types (e.g.
-  `AddTunnelParams`, `SetWifiEnabledParams`, `LoginParams`), and they are generated into
-  `core/bindings/`. However, commit `71b83245b` ("Chore/unexport api ts #2585", April 2024)
-  deliberately stopped building them into the SDK and had the frontend maintain its own types.
-
-  **Goal**: Reverse that decision — pipe the generated RPC types through the SDK into the frontend
-  so `api.types.ts` can import them instead of duplicating them. This eliminates drift between
-  backend and frontend API contracts.
-
-- [ ] Auto-configure port forwards via UPnP/NAT-PMP/PCP - @dr-bonez
-
-  **Blocked by**: "Support preferred external ports besides 443" (must be implemented and tested
-  end-to-end first).
-
-  **Goal**: When a binding is marked public, automatically configure port forwards on the user's router
-  using UPnP, NAT-PMP, or PCP, instead of requiring manual router configuration. Fall back to
-  displaying manual instructions (the port forward mapping from patch-db) when auto-configuration is
-  unavailable or fails.

build/dpkg-deps/depends

@@ -46,7 +46,6 @@ openssh-server
 podman
 psmisc
 qemu-guest-agent
-qemu-user-static
 rfkill
 rsync
 samba-common-bin

build/lib/scripts/chroot-and-upgrade

@@ -111,6 +111,6 @@ if [ "$CHROOT_RES" -eq 0 ]; then
     reboot
 fi
 
-umount /media/startos/next
+umount -R /media/startos/next
 umount /media/startos/upper
 rm -rf /media/startos/upper /media/startos/next

build/lib/scripts/forward-port

@@ -5,7 +5,7 @@ if [ -z "$sip" ] || [ -z "$dip" ] || [ -z "$dprefix" ] || [ -z "$sport" ] || [ -
     exit 1
 fi
 
-NAME="F$(echo "$sip:$sport -> $dip/$dprefix:$dport ${src_subnet:-any}" | sha256sum | head -c 15)"
+NAME="F$(echo "$sip:$sport -> $dip/$dprefix:$dport" | sha256sum | head -c 15)"
 
 for kind in INPUT FORWARD ACCEPT; do
     if ! iptables -C $kind -j "${NAME}_${kind}" 2> /dev/null; then
@@ -13,7 +13,7 @@ for kind in INPUT FORWARD ACCEPT; do
         iptables -A $kind -j "${NAME}_${kind}"
     fi
 done
-for kind in PREROUTING OUTPUT; do
+for kind in PREROUTING INPUT OUTPUT POSTROUTING; do
     if ! iptables -t nat -C $kind -j "${NAME}_${kind}" 2> /dev/null; then
         iptables -t nat -N "${NAME}_${kind}" 2> /dev/null
         iptables -t nat -A $kind -j "${NAME}_${kind}"
@@ -26,7 +26,7 @@ trap 'err=1' ERR
 for kind in INPUT FORWARD ACCEPT; do
     iptables -F "${NAME}_${kind}" 2> /dev/null
 done
-for kind in PREROUTING OUTPUT; do
+for kind in PREROUTING INPUT OUTPUT POSTROUTING; do
     iptables -t nat -F "${NAME}_${kind}" 2> /dev/null
 done
 if [ "$UNDO" = 1 ]; then
@@ -36,21 +36,20 @@ if [ "$UNDO" = 1 ]; then
 fi
 
 # DNAT: rewrite destination for incoming packets (external traffic)
-# When src_subnet is set, only forward traffic from that subnet (private forwards)
-if [ -n "$src_subnet" ]; then
-    iptables -t nat -A ${NAME}_PREROUTING -s "$src_subnet" -d "$sip" -p tcp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-    iptables -t nat -A ${NAME}_PREROUTING -s "$src_subnet" -d "$sip" -p udp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-else
-    iptables -t nat -A ${NAME}_PREROUTING -d "$sip" -p tcp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-    iptables -t nat -A ${NAME}_PREROUTING -d "$sip" -p udp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
-fi
+iptables -t nat -A ${NAME}_PREROUTING -d "$sip" -p tcp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
+iptables -t nat -A ${NAME}_PREROUTING -d "$sip" -p udp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
 
 # DNAT: rewrite destination for locally-originated packets (hairpin from host itself)
 iptables -t nat -A ${NAME}_OUTPUT -d "$sip" -p tcp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
 iptables -t nat -A ${NAME}_OUTPUT -d "$sip" -p udp --dport "$sport" -j DNAT --to-destination "$dip:$dport"
 
+# MASQUERADE: rewrite source for all forwarded traffic to the destination
+# This ensures responses are routed back through the host regardless of source IP
+iptables -t nat -A ${NAME}_POSTROUTING -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
+iptables -t nat -A ${NAME}_POSTROUTING -d "$dip" -p udp --dport "$dport" -j MASQUERADE
+
 # Allow new connections to be forwarded to the destination
 iptables -A ${NAME}_FORWARD -d $dip -p tcp --dport $dport -m state --state NEW -j ACCEPT
 iptables -A ${NAME}_FORWARD -d $dip -p udp --dport $dport -m state --state NEW -j ACCEPT
 
-exit $err
+exit $err

build/upload-ota.sh

@@ -15,12 +15,13 @@ if [ "$SKIP_DL" != "1" ]; then
     fi
 
     if [ -n "$RUN_ID" ]; then
-        for arch in aarch64 aarch64-nonfree riscv64 x86_64 x86_64-nonfree; do
+        for arch in aarch64 aarch64-nonfree riscv64 riscv64-nonfree x86_64 x86_64-nonfree raspberrypi; do
             while ! gh run download -R Start9Labs/start-os $RUN_ID -n $arch.squashfs -D $(pwd); do sleep 1; done
         done
-        for arch in aarch64 aarch64-nonfree riscv64 x86_64 x86_64-nonfree; do
+        for arch in aarch64 aarch64-nonfree riscv64 riscv64-nonfree x86_64 x86_64-nonfree; do
             while ! gh run download -R Start9Labs/start-os $RUN_ID -n $arch.iso -D $(pwd); do sleep 1; done
         done
+        while ! gh run download -R Start9Labs/start-os $RUN_ID -n raspberrypi.img -D $(pwd); do sleep 1; done
     fi
 
     if [ -n "$ST_RUN_ID" ]; then
@@ -56,23 +57,31 @@ start-cli --registry=https://alpha-registry-x.start9.com registry os version add
 if [ "$SKIP_UL" = "2" ]; then
     exit 2
 elif [ "$SKIP_UL" != "1" ]; then
-    for file in *.deb start-cli_*; do
+    for file in *.squashfs *.iso *.deb start-cli_*; do
         gh release upload -R Start9Labs/start-os v$VERSION $file
     done
-    for file in *.iso *.squashfs; do
-        s3cmd put -P $file s3://startos-images/v$VERSION/$file
+    for file in *.img; do
+        if ! [ -f $file.gz ]; then
+            cat $file | pigz > $file.gz
+        fi
+        gh release upload -R Start9Labs/start-os v$VERSION $file.gz
     done
 fi
 
 if [ "$SKIP_INDEX" != "1" ]; then
-    for arch in aarch64 aarch64-nonfree riscv64 x86_64 x86_64-nonfree; do
+    for arch in aarch64 aarch64-nonfree riscv64 riscv64-nonfree x86_64 x86_64-nonfree; do
         for file in *_$arch.squashfs *_$arch.iso; do
-            start-cli --registry=https://alpha-registry-x.start9.com registry os asset add --platform=$arch --version=$VERSION $file https://startos-images.nyc3.cdn.digitaloceanspaces.com/v$VERSION/$file
+            start-cli --registry=https://alpha-registry-x.start9.com registry os asset add --platform=$arch --version=$VERSION $file https://github.com/Start9Labs/start-os/releases/download/v$VERSION/$(echo -n "$file" | sed 's/~/./g')
+        done
+    done
+    for arch in raspberrypi; do
+        for file in *_$arch.squashfs; do
+            start-cli --registry=https://alpha-registry-x.start9.com registry os asset add --platform=$arch --version=$VERSION $file https://github.com/Start9Labs/start-os/releases/download/v$VERSION/$(echo -n "$file" | sed 's/~/./g')
         done
     done
 fi
 
-for file in *.iso *.squashfs *.deb start-cli_*; do
+for file in *.iso *.img *.img.gz *.squashfs *.deb start-cli_*; do
     gpg -u 7CFFDA41CA66056A --detach-sign --armor -o "${file}.asc" "$file"
 done
 
@@ -81,30 +90,20 @@ tar -czvf signatures.tar.gz *.asc
 
 gh release upload -R Start9Labs/start-os v$VERSION signatures.tar.gz
 
-cat << EOF
-# ISO Downloads
-
-- [x86_64/AMD64](https://startos-images.nyc3.cdn.digitaloceanspaces.com/v$VERSION/$(ls *_x86_64-nonfree.iso))
-- [x86_64/AMD64-slim (FOSS-only)](https://startos-images.nyc3.cdn.digitaloceanspaces.com/v$VERSION/$(ls *_x86_64.iso) "Without proprietary software or drivers")
-- [aarch64/ARM64](https://startos-images.nyc3.cdn.digitaloceanspaces.com/v$VERSION/$(ls *_aarch64-nonfree.iso))
-- [aarch64/ARM64-slim (FOSS-Only)](https://startos-images.nyc3.cdn.digitaloceanspaces.com/v$VERSION/$(ls *_aarch64.iso) "Without proprietary software or drivers")
-- [RISCV64 (RVA23)](https://startos-images.nyc3.cdn.digitaloceanspaces.com/v$VERSION/$(ls *_riscv64.iso))
-
-EOF
 cat << 'EOF'
 # StartOS Checksums
 
 ## SHA-256
 ```
 EOF
-sha256sum *.iso *.squashfs
+sha256sum *.iso *.img *img.gz *.squashfs
 cat << 'EOF'
 ```
 
 ## BLAKE-3
 ```
 EOF
-b3sum *.iso *.squashfs
+b3sum *.iso *.img *.img.gz *.squashfs
 cat << 'EOF'
 ```
 
@@ -139,4 +138,5 @@ EOF
 b3sum start-cli_*
 cat << 'EOF'
 ```
-EOF
+EOF
+

container-runtime/CLAUDE.md

@@ -1,32 +0,0 @@
-# Container Runtime — Node.js Service Manager
-
-Node.js runtime that manages service containers via JSON-RPC. See `RPCSpec.md` in this directory for the full RPC protocol.
-
-## Architecture
-
-```
-LXC Container (uniform base for all services)
-└── systemd
-    └── container-runtime.service
-        └── Loads /usr/lib/startos/package/index.js (from s9pk javascript.squashfs)
-            └── Package JS launches subcontainers (from images in s9pk)
-```
-
-The container runtime communicates with the host via JSON-RPC over Unix socket. Package JavaScript must export functions conforming to the `ABI` type defined in `sdk/base/lib/types.ts`.
-
-## `/media/startos/` Directory (mounted by host into container)
-
-| Path                 | Description                                           |
-| -------------------- | ----------------------------------------------------- |
-| `volumes/<name>/`    | Package data volumes (id-mapped, persistent)          |
-| `assets/`            | Read-only assets from s9pk `assets.squashfs`          |
-| `images/<name>/`     | Container images (squashfs, used for subcontainers)   |
-| `images/<name>.env`  | Environment variables for image                       |
-| `images/<name>.json` | Image metadata                                        |
-| `backup/`            | Backup mount point (mounted during backup operations) |
-| `rpc/service.sock`   | RPC socket (container runtime listens here)           |
-| `rpc/host.sock`      | Host RPC socket (for effects callbacks to host)       |
-
-## S9PK Structure
-
-See `../core/s9pk-structure.md` for the S9PK package format.

container-runtime/RPCSpec.md

@@ -1,21 +1,16 @@
-# Container RPC Server Specification
-
-The container runtime exposes a JSON-RPC server over a Unix socket at `/media/startos/rpc/service.sock`.
+# Container RPC SERVER Specification
 
 ## Methods
 
 ### init
 
-Initialize the runtime and system.
+initialize runtime (mount `/proc`, `/sys`, `/dev`, and `/run` to each image in `/media/images`)
 
-#### params
+called after os has mounted js and images to the container
 
-```ts
-{
-  id: string,
-  kind: "install" | "update" | "restore" | null,
-}
-```
+#### args
+
+`[]`
 
 #### response
 
@@ -23,16 +18,11 @@ Initialize the runtime and system.
 
 ### exit
 
-Shutdown runtime and optionally run exit hooks for a target version.
+shutdown runtime
 
-#### params
+#### args
 
-```ts
-{
-  id: string,
-  target: string | null,  // ExtendedVersion or VersionRange
-}
-```
+`[]`
 
 #### response
 
@@ -40,11 +30,11 @@ Shutdown runtime and optionally run exit hooks for a target version.
 
 ### start
 
-Run main method if not already running.
+run main method if not already running
 
-#### params
+#### args
 
-None
+`[]`
 
 #### response
 
@@ -52,11 +42,11 @@ None
 
 ### stop
 
-Stop main method by sending SIGTERM to child processes, and SIGKILL after timeout.
+stop main method by sending SIGTERM to child processes, and SIGKILL after timeout
 
-#### params
+#### args
 
-None
+`{ timeout: millis }`
 
 #### response
 
@@ -64,16 +54,15 @@ None
 
 ### execute
 
-Run a specific package procedure.
+run a specific package procedure
 
-#### params
+#### args
 
 ```ts
 {
-  id: string,           // event ID
-  procedure: string,    // JSON path (e.g., "/backup/create", "/actions/{name}/run")
-  input: any,
-  timeout: number | null,
+    procedure: JsonPath,
+    input: any,
+    timeout: millis,
 }
 ```
 
@@ -83,64 +72,18 @@ Run a specific package procedure.
 
 ### sandbox
 
-Run a specific package procedure in sandbox mode. Same interface as `execute`.
+run a specific package procedure in sandbox mode
 
-UNIMPLEMENTED: this feature is planned but does not exist
-
-#### params
+#### args
 
 ```ts
 {
-  id: string,
-  procedure: string,
-  input: any,
-  timeout: number | null,
+    procedure: JsonPath,
+    input: any,
+    timeout: millis,
 }
 ```
 
 #### response
 
 `any`
-
-### callback
-
-Handle a callback from an effect.
-
-#### params
-
-```ts
-{
-  id: number,
-  args: any[],
-}
-```
-
-#### response
-
-`null` (no response sent)
-
-### eval
-
-Evaluate a script in the runtime context. Used for debugging.
-
-#### params
-
-```ts
-{
-  script: string,
-}
-```
-
-#### response
-
-`any`
-
-## Procedures
-
-The `execute` and `sandbox` methods route to procedures based on the `procedure` path:
-
-| Procedure                  | Description                  |
-| -------------------------- | ---------------------------- |
-| `/backup/create`           | Create a backup              |
-| `/actions/{name}/getInput` | Get input spec for an action |
-| `/actions/{name}/run`      | Run an action with input     |

container-runtime/src/Adapters/Systems/SystemForEmbassy/DockerProcedureContainer.ts

@@ -82,15 +82,18 @@ export class DockerProcedureContainer extends Drop {
             }),
           )
         } else if (volumeMount.type === "certificate") {
-          const hostInfo = await effects.getHostInfo({
-            hostId: volumeMount["interface-id"],
-          })
           const hostnames = [
             `${packageId}.embassy`,
             ...new Set(
-              Object.values(hostInfo?.bindings || {})
-                .flatMap((b) => b.addresses.available)
-                .map((h) => h.host),
+              Object.values(
+                (
+                  await effects.getHostInfo({
+                    hostId: volumeMount["interface-id"],
+                  })
+                )?.hostnameInfo || {},
+              )
+                .flatMap((h) => h)
+                .flatMap((h) => (h.kind === "onion" ? [h.hostname.value] : [])),
             ).values(),
           ]
           const certChain = await effects.getSslCertificate({

container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts

@@ -1244,8 +1244,12 @@ async function updateConfig(
             ? ""
             : catchFn(
                 () =>
-                  filled.addressInfo!.filter({ kind: "mdns" })!.hostnames[0]
-                    .host,
+                  (specValue.target === "lan-address"
+                    ? filled.addressInfo!.filter({ kind: "mdns" }) ||
+                      filled.addressInfo!.onion
+                    : filled.addressInfo!.onion ||
+                      filled.addressInfo!.filter({ kind: "mdns" })
+                  ).hostnames[0].hostname.value,
               ) || ""
         mutConfigValue[key] = url
       }

core/ARCHITECTURE.md

@@ -1,69 +0,0 @@
-# Core Architecture
-
-The Rust backend daemon for StartOS.
-
-## Binaries
-
-The crate produces a single binary `startbox` that is symlinked under different names for different behavior:
-
-- `startbox` / `startd` — Main daemon
-- `start-cli` — CLI interface
-- `start-container` — Runs inside LXC containers; communicates with host and manages subcontainers
-- `registrybox` — Registry daemon
-- `tunnelbox` — VPN/tunnel daemon
-
-## Crate Structure
-
-- `startos` — Core library that supports building `startbox`
-- `helpers` — Utility functions used across both `startos` and `js-engine`
-- `models` — Types shared across `startos`, `js-engine`, and `helpers`
-
-## Key Modules
-
-- `src/context/` — Context types (RpcContext, CliContext, InitContext, DiagnosticContext)
-- `src/service/` — Service lifecycle management with actor pattern (`service_actor.rs`)
-- `src/db/model/` — Patch-DB models (`public.rs` synced to frontend, `private.rs` backend-only)
-- `src/net/` — Networking (DNS, ACME, WiFi, Tor via Arti, WireGuard)
-- `src/s9pk/` — S9PK package format (merkle archive)
-- `src/registry/` — Package registry management
-
-## RPC Pattern
-
-The API is JSON-RPC (not REST). All endpoints are RPC methods organized in a hierarchical command structure using [rpc-toolkit](https://github.com/Start9Labs/rpc-toolkit). Handlers are registered in a tree of `ParentHandler` nodes, with four handler types: `from_fn_async` (standard), `from_fn_async_local` (non-Send), `from_fn` (sync), and `from_fn_blocking` (blocking). Metadata like `.with_about()` drives middleware and documentation.
-
-See [rpc-toolkit.md](rpc-toolkit.md) for full handler patterns and configuration.
-
-## Patch-DB Patterns
-
-Patch-DB provides diff-based state synchronization. Changes to `db/model/public.rs` automatically sync to the frontend.
-
-**Key patterns:**
-- `db.peek().await` — Get a read-only snapshot of the database state
-- `db.mutate(|db| { ... }).await` — Apply mutations atomically, returns `MutateResult`
-- `#[derive(HasModel)]` — Derive macro for types stored in the database, generates typed accessors
-
-**Generated accessor types** (from `HasModel` derive):
-- `as_field()` — Immutable reference: `&Model<T>`
-- `as_field_mut()` — Mutable reference: `&mut Model<T>`
-- `into_field()` — Owned value: `Model<T>`
-
-**`Model<T>` APIs** (from `db/prelude.rs`):
-- `.de()` — Deserialize to `T`
-- `.ser(&value)` — Serialize from `T`
-- `.mutate(|v| ...)` — Deserialize, mutate, reserialize
-- For maps: `.keys()`, `.as_idx(&key)`, `.as_idx_mut(&key)`, `.insert()`, `.remove()`, `.contains_key()`
-
-## i18n
-
-See [i18n-patterns.md](i18n-patterns.md) for internationalization key conventions and the `t!()` macro.
-
-## Rust Utilities & Patterns
-
-See [core-rust-patterns.md](core-rust-patterns.md) for common utilities (Invoke trait, Guard pattern, mount guards, Apply trait, etc.).
-
-## Related Documentation
-
-- [rpc-toolkit.md](rpc-toolkit.md) — JSON-RPC handler patterns
-- [i18n-patterns.md](i18n-patterns.md) — Internationalization conventions
-- [core-rust-patterns.md](core-rust-patterns.md) — Common Rust utilities
-- [s9pk-structure.md](s9pk-structure.md) — S9PK package format

core/CLAUDE.md

@@ -1,25 +0,0 @@
-# Core — Rust Backend
-
-The Rust backend daemon for StartOS.
-
-## Architecture
-
-See [ARCHITECTURE.md](ARCHITECTURE.md) for binaries, modules, Patch-DB patterns, and related documentation.
-
-See [CONTRIBUTING.md](CONTRIBUTING.md) for how to add RPC endpoints, TS-exported types, and i18n keys.
-
-## Quick Reference
-
-```bash
-cargo check -p start-os                    # Type check
-make test-core                             # Run tests
-make ts-bindings                           # Regenerate TS types after changing #[ts(export)] structs
-cd sdk && make baseDist dist               # Rebuild SDK after ts-bindings
-```
-
-## Operating Rules
-
-- Always run `cargo check -p start-os` after modifying Rust code
-- When adding RPC endpoints, follow the patterns in [rpc-toolkit.md](rpc-toolkit.md)
-- When modifying `#[ts(export)]` types, regenerate bindings and rebuild the SDK (see [ARCHITECTURE.md](../ARCHITECTURE.md#build-pipeline))
-- When adding i18n keys, add all 5 locales in `core/locales/i18n.yaml` (see [i18n-patterns.md](i18n-patterns.md))

core/CONTRIBUTING.md

@@ -1,49 +0,0 @@
-# Contributing to Core
-
-For general environment setup, cloning, and build system, see the root [CONTRIBUTING.md](../CONTRIBUTING.md).
-
-## Prerequisites
-
-- [Rust](https://rustup.rs) (nightly for formatting)
-- [rust-analyzer](https://rust-analyzer.github.io/) recommended
-- [Docker](https://docs.docker.com/get-docker/) (for cross-compilation via `rust-zig-builder` container)
-
-## Common Commands
-
-```bash
-cargo check -p start-os                    # Type check
-cargo test --features=test                 # Run tests (or: make test-core)
-make format                                # Format with nightly rustfmt
-cd core && cargo test <test_name> --features=test  # Run a specific test
-```
-
-## Adding a New RPC Endpoint
-
-1. Define a params struct with `#[derive(Deserialize, Serialize)]`
-2. Choose a handler type (`from_fn_async` for most cases)
-3. Write the handler function: `async fn my_handler(ctx: RpcContext, params: MyParams) -> Result<MyResponse, Error>`
-4. Register it in the appropriate `ParentHandler` tree
-5. If params/response should be available in TypeScript, add `#[derive(TS)]` and `#[ts(export)]`
-
-See [rpc-toolkit.md](rpc-toolkit.md) for full handler patterns and all four handler types.
-
-## Adding TS-Exported Types
-
-When a Rust type needs to be available in TypeScript (for the web frontend or SDK):
-
-1. Add `ts_rs::TS` to the derive list and `#[ts(export)]` to the struct/enum
-2. Use `#[serde(rename_all = "camelCase")]` for JS-friendly field names
-3. For types that don't implement TS (like `DateTime<Utc>`, `exver::Version`), use `#[ts(type = "string")]` overrides
-4. For `u64` fields that should be JS `number` (not `bigint`), use `#[ts(type = "number")]`
-5. Run `make ts-bindings` to regenerate — files appear in `core/bindings/` then sync to `sdk/base/lib/osBindings/`
-6. Rebuild the SDK: `cd sdk && make baseDist dist`
-
-## Adding i18n Keys
-
-1. Add the key to `core/locales/i18n.yaml` with all 5 language translations
-2. Use the `t!("your.key.name")` macro in Rust code
-3. Follow existing namespace conventions — match the module path where the key is used
-4. Use kebab-case for multi-word segments
-5. Translations are validated at compile time
-
-See [i18n-patterns.md](i18n-patterns.md) for full conventions.

core/Cargo.toml

@@ -15,7 +15,7 @@ license = "MIT"
 name = "start-os"
 readme = "README.md"
 repository = "https://github.com/Start9Labs/start-os"
-version = "0.4.0-alpha.20" # VERSION_BUMP
+version = "0.4.0-alpha.18" # VERSION_BUMP
 
 [lib]
 name = "startos"
@@ -42,6 +42,17 @@ name = "tunnelbox"
 path = "src/main/tunnelbox.rs"
 
 [features]
+arti = [
+  "arti-client",
+  "safelog",
+  "tor-cell",
+  "tor-hscrypto",
+  "tor-hsservice",
+  "tor-keymgr",
+  "tor-llcrypto",
+  "tor-proto",
+  "tor-rtcompat",
+]
 beta = []
 console = ["console-subscriber", "tokio/tracing"]
 default = []
@@ -51,6 +62,16 @@ unstable = ["backtrace-on-stack-overflow"]
 
 [dependencies]
 aes = { version = "0.7.5", features = ["ctr"] }
+arti-client = { version = "0.33", features = [
+  "compression",
+  "ephemeral-keystore",
+  "experimental-api",
+  "onion-service-client",
+  "onion-service-service",
+  "rustls",
+  "static",
+  "tokio",
+], default-features = false, git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
 async-acme = { version = "0.6.0", git = "https://github.com/dr-bonez/async-acme.git", features = [
   "use_rustls",
   "use_tokio",
@@ -79,6 +100,7 @@ console-subscriber = { version = "0.5.0", optional = true }
 const_format = "0.2.34"
 cookie = "0.18.0"
 cookie_store = "0.22.0"
+curve25519-dalek = "4.1.3"
 der = { version = "0.7.9", features = ["derive", "pem"] }
 digest = "0.10.7"
 divrem = "1.0.0"
@@ -154,7 +176,6 @@ mio = "1"
 new_mime_guess = "4"
 nix = { version = "0.30.1", features = [
   "fs",
-  "hostname",
   "mount",
   "net",
   "process",
@@ -194,6 +215,7 @@ rpassword = "7.2.0"
 rust-argon2 = "3.0.0"
 rust-i18n = "3.1.5"
 rpc-toolkit = { git = "https://github.com/Start9Labs/rpc-toolkit.git" }
+safelog = { version = "0.4.8", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
 semver = { version = "1.0.20", features = ["serde"] }
 serde = { version = "1.0", features = ["derive", "rc"] }
 serde_cbor = { package = "ciborium", version = "0.2.1" }
@@ -221,6 +243,23 @@ tokio-stream = { version = "0.1.14", features = ["io-util", "net", "sync"] }
 tokio-tar = { git = "https://github.com/dr-bonez/tokio-tar.git" }
 tokio-tungstenite = { version = "0.26.2", features = ["native-tls", "url"] }
 tokio-util = { version = "0.7.9", features = ["io"] }
+tor-cell = { version = "0.33", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
+tor-hscrypto = { version = "0.33", features = [
+  "full",
+], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
+tor-hsservice = { version = "0.33", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
+tor-keymgr = { version = "0.33", features = [
+  "ephemeral-keystore",
+], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
+tor-llcrypto = { version = "0.33", features = [
+  "full",
+], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
+tor-proto = { version = "0.33", git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
+tor-rtcompat = { version = "0.33", features = [
+  "rustls",
+  "tokio",
+], git = "https://github.com/Start9Labs/arti.git", branch = "patch/disable-exit", optional = true }
+torut = "0.2.1"
 tower-service = "0.3.3"
 tracing = "0.1.39"
 tracing-error = "0.2.0"

core/README.md

@@ -22,7 +22,9 @@ several different names for different behavior:
 - `start-sdk`: This is a CLI tool that aids in building and packaging services
   you wish to deploy to StartOS
 
-## Documentation
+## Questions
 
-- [ARCHITECTURE.md](ARCHITECTURE.md) — Backend architecture, modules, and patterns
-- [CONTRIBUTING.md](CONTRIBUTING.md) — How to contribute to core
+If you have questions about how various pieces of the backend system work. Open
+an issue and tag the following people
+
+- dr-bonez

core/build/build-ts.sh

@@ -7,11 +7,11 @@ source ./builder-alias.sh
 set -ea
 shopt -s expand_aliases
 
-PROFILE=${PROFILE:-debug}
+PROFILE=${PROFILE:-release}
 if [ "${PROFILE}" = "release" ]; then
 	BUILD_FLAGS="--release"
 else
-  if [ "$PROFILE" != "debug" ]; then
+  if [ "$PROFILE" != "debug"]; then
     >&2 echo "Unknown profile $PROFILE: falling back to debug..."
     PROFILE=debug
   fi
@@ -38,7 +38,7 @@ if [[ "${ENVIRONMENT}" =~ (^|-)console($|-) ]]; then
 fi
 echo "FEATURES=\"$FEATURES\""
 echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-zig-builder cargo test --manifest-path=./core/Cargo.toml --lib $BUILD_FLAGS --features test,$FEATURES --locked 'export_bindings_'
+rust-zig-builder cargo test --manifest-path=./core/Cargo.toml $BUILD_FLAGS --features test,$FEATURES --locked 'export_bindings_'
 if [ "$(ls -nd "core/bindings" | awk '{ print $3 }')" != "$UID" ]; then
   rust-zig-builder sh -c "chown -R $UID:$UID core/target && chown -R $UID:$UID core/bindings && chown -R $UID:$UID  /usr/local/cargo"
 fi

core/core-rust-patterns.md

@@ -1,249 +0,0 @@
-# Utilities & Patterns
-
-This document covers common utilities and patterns used throughout the StartOS codebase.
-
-## Util Module (`core/src/util/`)
-
-The `util` module contains reusable utilities. Key submodules:
-
-| Module | Purpose |
-|--------|---------|
-| `actor/` | Actor pattern implementation for concurrent state management |
-| `collections/` | Custom collection types |
-| `crypto.rs` | Cryptographic utilities (encryption, hashing) |
-| `future.rs` | Future/async utilities |
-| `io.rs` | File I/O helpers (create_file, canonicalize, etc.) |
-| `iter.rs` | Iterator extensions |
-| `net.rs` | Network utilities |
-| `rpc.rs` | RPC helpers |
-| `rpc_client.rs` | RPC client utilities |
-| `serde.rs` | Serialization helpers (Base64, display/fromstr, etc.) |
-| `sync.rs` | Synchronization primitives (SyncMutex, etc.) |
-
-## Command Invocation (`Invoke` trait)
-
-The `Invoke` trait provides a clean way to run external commands with error handling:
-
-```rust
-use crate::util::Invoke;
-
-// Simple invocation
-tokio::process::Command::new("ls")
-    .arg("-la")
-    .invoke(ErrorKind::Filesystem)
-    .await?;
-
-// With timeout
-tokio::process::Command::new("slow-command")
-    .timeout(Some(Duration::from_secs(30)))
-    .invoke(ErrorKind::Timeout)
-    .await?;
-
-// With input
-let mut input = Cursor::new(b"input data");
-tokio::process::Command::new("cat")
-    .input(Some(&mut input))
-    .invoke(ErrorKind::Filesystem)
-    .await?;
-
-// Piped commands
-tokio::process::Command::new("cat")
-    .arg("file.txt")
-    .pipe(&mut tokio::process::Command::new("grep").arg("pattern"))
-    .invoke(ErrorKind::Filesystem)
-    .await?;
-```
-
-## Guard Pattern
-
-Guards ensure cleanup happens when they go out of scope.
-
-### `GeneralGuard` / `GeneralBoxedGuard`
-
-For arbitrary cleanup actions:
-
-```rust
-use crate::util::GeneralGuard;
-
-let guard = GeneralGuard::new(|| {
-    println!("Cleanup runs on drop");
-});
-
-// Do work...
-
-// Explicit drop with action
-guard.drop();
-
-// Or skip the action
-// guard.drop_without_action();
-```
-
-### `FileLock`
-
-File-based locking with automatic unlock:
-
-```rust
-use crate::util::FileLock;
-
-let lock = FileLock::new("/path/to/lockfile", true).await?;  // blocking=true
-// Lock held until dropped or explicitly unlocked
-lock.unlock().await?;
-```
-
-## Mount Guard Pattern (`core/src/disk/mount/guard.rs`)
-
-RAII guards for filesystem mounts. Ensures filesystems are unmounted when guards are dropped.
-
-### `MountGuard`
-
-Basic mount guard:
-
-```rust
-use crate::disk::mount::guard::MountGuard;
-use crate::disk::mount::filesystem::{MountType, ReadOnly};
-
-let guard = MountGuard::mount(&filesystem, "/mnt/target", ReadOnly).await?;
-
-// Use the mounted filesystem at guard.path()
-do_something(guard.path()).await?;
-
-// Explicit unmount (or auto-unmounts on drop)
-guard.unmount(false).await?;  // false = don't delete mountpoint
-```
-
-### `TmpMountGuard`
-
-Reference-counted temporary mount (mounts to `/media/startos/tmp/`):
-
-```rust
-use crate::disk::mount::guard::TmpMountGuard;
-use crate::disk::mount::filesystem::ReadOnly;
-
-// Multiple clones share the same mount
-let guard1 = TmpMountGuard::mount(&filesystem, ReadOnly).await?;
-let guard2 = guard1.clone();
-
-// Mount stays alive while any guard exists
-// Auto-unmounts when last guard is dropped
-```
-
-### `GenericMountGuard` trait
-
-All mount guards implement this trait:
-
-```rust
-pub trait GenericMountGuard: std::fmt::Debug + Send + Sync + 'static {
-    fn path(&self) -> &Path;
-    fn unmount(self) -> impl Future<Output = Result<(), Error>> + Send;
-}
-```
-
-### `SubPath`
-
-Wraps a mount guard to point to a subdirectory:
-
-```rust
-use crate::disk::mount::guard::SubPath;
-
-let mount = TmpMountGuard::mount(&filesystem, ReadOnly).await?;
-let subdir = SubPath::new(mount, "data/subdir");
-
-// subdir.path() returns the full path including subdirectory
-```
-
-## FileSystem Implementations (`core/src/disk/mount/filesystem/`)
-
-Various filesystem types that can be mounted:
-
-| Type | Description |
-|------|-------------|
-| `bind.rs` | Bind mounts |
-| `block_dev.rs` | Block device mounts |
-| `cifs.rs` | CIFS/SMB network shares |
-| `ecryptfs.rs` | Encrypted filesystem |
-| `efivarfs.rs` | EFI variables |
-| `httpdirfs.rs` | HTTP directory as filesystem |
-| `idmapped.rs` | ID-mapped mounts |
-| `label.rs` | Mount by label |
-| `loop_dev.rs` | Loop device mounts |
-| `overlayfs.rs` | Overlay filesystem |
-
-## Other Useful Utilities
-
-### `Apply` / `ApplyRef` traits
-
-Fluent method chaining:
-
-```rust
-use crate::util::Apply;
-
-let result = some_value
-    .apply(|v| transform(v))
-    .apply(|v| another_transform(v));
-```
-
-### `Container<T>`
-
-Async-safe optional container:
-
-```rust
-use crate::util::Container;
-
-let container = Container::new(None);
-container.set(value).await;
-let taken = container.take().await;
-```
-
-### `HashWriter<H, W>`
-
-Write data while computing hash:
-
-```rust
-use crate::util::HashWriter;
-use sha2::Sha256;
-
-let writer = HashWriter::new(Sha256::new(), file);
-// Write data...
-let (hasher, file) = writer.finish();
-let hash = hasher.finalize();
-```
-
-### `Never` type
-
-Uninhabited type for impossible cases:
-
-```rust
-use crate::util::Never;
-
-fn impossible() -> Never {
-    // This function can never return
-}
-
-let never: Never = impossible();
-never.absurd::<String>()  // Can convert to any type
-```
-
-### `MaybeOwned<'a, T>`
-
-Either borrowed or owned data:
-
-```rust
-use crate::util::MaybeOwned;
-
-fn accept_either(data: MaybeOwned<'_, String>) {
-    // Use &*data to access the value
-}
-
-accept_either(MaybeOwned::from(&existing_string));
-accept_either(MaybeOwned::from(owned_string));
-```
-
-### `new_guid()`
-
-Generate a random GUID:
-
-```rust
-use crate::util::new_guid;
-
-let guid = new_guid();  // Returns InternedString
-```

core/i18n-patterns.md

@@ -1,100 +0,0 @@
-# i18n Patterns in `core/`
-
-## Library & Setup
-
-**Crate:** [`rust-i18n`](https://crates.io/crates/rust-i18n) v3.1.5 (`core/Cargo.toml`)
-
-**Initialization** (`core/src/lib.rs:3`):
-```rust
-rust_i18n::i18n!("locales", fallback = ["en_US"]);
-```
-This macro scans `core/locales/` at compile time and embeds all translations as constants.
-
-**Prelude re-export** (`core/src/prelude.rs:4`):
-```rust
-pub use rust_i18n::t;
-```
-Most modules import `t!` via the prelude.
-
-## Translation File
-
-**Location:** `core/locales/i18n.yaml`
-**Format:** YAML v2 (~755 keys)
-
-**Supported languages:** `en_US`, `de_DE`, `es_ES`, `fr_FR`, `pl_PL`
-
-**Entry structure:**
-```yaml
-namespace.sub.key-name:
-  en_US: "English text with %{param}"
-  de_DE: "German text with %{param}"
-  # ...
-```
-
-## Using `t!()`
-
-```rust
-// Simple key
-t!("error.unknown")
-
-// With parameter interpolation (%{name} in YAML)
-t!("bins.deprecated.renamed", old = old_name, new = new_name)
-```
-
-## Key Naming Conventions
-
-Keys use **dot-separated hierarchical namespaces** with **kebab-case** for multi-word segments:
-
-```
-<module>.<submodule>.<descriptive-name>
-```
-
-Examples:
-- `error.incorrect-password` — error kind label
-- `bins.start-init.updating-firmware` — startup phase message
-- `backup.bulk.complete-title` — backup notification title
-- `help.arg.acme-contact` — CLI help text for an argument
-- `context.diagnostic.starting-diagnostic-ui` — diagnostic context status
-
-### Top-Level Namespaces
-
-| Namespace | Purpose |
-|-----------|---------|
-| `error.*` | `ErrorKind` display strings (see `src/error.rs`) |
-| `bins.*` | CLI binary messages (deprecated, start-init, startd, etc.) |
-| `init.*` | Initialization phase labels |
-| `setup.*` | First-run setup messages |
-| `context.*` | Context startup messages (diagnostic, setup, CLI) |
-| `service.*` | Service lifecycle messages |
-| `backup.*` | Backup/restore operation messages |
-| `registry.*` | Package registry messages |
-| `net.*` | Network-related messages |
-| `middleware.*` | Request middleware messages (auth, etc.) |
-| `disk.*` | Disk operation messages |
-| `lxc.*` | Container management messages |
-| `system.*` | System monitoring/metrics messages |
-| `notifications.*` | User-facing notification messages |
-| `update.*` | OS update messages |
-| `util.*` | Utility messages (TUI, RPC) |
-| `ssh.*` | SSH operation messages |
-| `shutdown.*` | Shutdown-related messages |
-| `logs.*` | Log-related messages |
-| `auth.*` | Authentication messages |
-| `help.*` | CLI help text (`help.arg.<arg-name>`) |
-| `about.*` | CLI command descriptions |
-
-## Locale Selection
-
-`core/src/bins/mod.rs:15-36` — `set_locale_from_env()`:
-
-1. Reads `LANG` environment variable
-2. Strips `.UTF-8` suffix
-3. Exact-matches against available locales, falls back to language-prefix match (e.g. `en_GB` matches `en_US`)
-
-## Adding New Keys
-
-1. Add the key to `core/locales/i18n.yaml` with all 5 language translations
-2. Use the `t!("your.key.name")` macro in Rust code
-3. Follow existing namespace conventions — match the module path where the key is used
-4. Use kebab-case for multi-word segments
-5. Translations are validated at compile time

core/locales/i18n.yaml

@@ -1843,18 +1843,18 @@ service.mod.failed-to-parse-package-data-entry:
   pl_PL: "Nie udało się przeanalizować PackageDataEntry, znaleziono: %{error}"
 
 service.mod.no-matching-subcontainers:
-  en_US: "no matching subcontainers are running for %{id}; some possible choices are:"
-  de_DE: "keine passenden Subcontainer laufen für %{id}; einige mögliche Optionen sind:"
-  es_ES: "no hay subcontenedores coincidentes ejecutándose para %{id}; algunas opciones posibles son:"
-  fr_FR: "aucun sous-conteneur correspondant n'est en cours d'exécution pour %{id} ; voici quelques choix possibles :"
-  pl_PL: "nie działają pasujące podkontenery dla %{id}; niektóre możliwe wybory to:"
+  en_US: "no matching subcontainers are running for %{id}; some possible choices are:\n%{subcontainers}"
+  de_DE: "keine passenden Subcontainer laufen für %{id}; einige mögliche Optionen sind:\n%{subcontainers}"
+  es_ES: "no hay subcontenedores coincidentes ejecutándose para %{id}; algunas opciones posibles son:\n%{subcontainers}"
+  fr_FR: "aucun sous-conteneur correspondant n'est en cours d'exécution pour %{id} ; voici quelques choix possibles :\n%{subcontainers}"
+  pl_PL: "nie działają pasujące podkontenery dla %{id}; niektóre możliwe wybory to:\n%{subcontainers}"
 
 service.mod.multiple-subcontainers-found:
-  en_US: "multiple subcontainers found for %{id}"
-  de_DE: "mehrere Subcontainer für %{id} gefunden"
-  es_ES: "se encontraron múltiples subcontenedores para %{id}"
-  fr_FR: "plusieurs sous-conteneurs trouvés pour %{id}"
-  pl_PL: "znaleziono wiele podkontenerów dla %{id}"
+  en_US: "multiple subcontainers found for %{id}: \n%{subcontainer_ids}"
+  de_DE: "mehrere Subcontainer für %{id} gefunden: \n%{subcontainer_ids}"
+  es_ES: "se encontraron múltiples subcontenedores para %{id}: \n%{subcontainer_ids}"
+  fr_FR: "plusieurs sous-conteneurs trouvés pour %{id} : \n%{subcontainer_ids}"
+  pl_PL: "znaleziono wiele podkontenerów dla %{id}: \n%{subcontainer_ids}"
 
 service.mod.invalid-byte-length-for-signal:
   en_US: "invalid byte length for signal: %{length}"
@@ -3703,20 +3703,6 @@ help.arg.wireguard-config:
   fr_FR: "Configuration WireGuard"
   pl_PL: "Konfiguracja WireGuard"
 
-help.s9pk-s3base:
-  en_US: "Base URL for publishing s9pks"
-  de_DE: "Basis-URL für die Veröffentlichung von s9pks"
-  es_ES: "URL base para publicar s9pks"
-  fr_FR: "URL de base pour publier les s9pks"
-  pl_PL: "Bazowy URL do publikowania s9pks"
-
-help.s9pk-s3bucket:
-  en_US: "S3 bucket to publish s9pks to (should correspond to s3base)"
-  de_DE: "S3-Bucket zum Veröffentlichen von s9pks (sollte mit s3base übereinstimmen)"
-  es_ES: "Bucket S3 para publicar s9pks (debe corresponder con s3base)"
-  fr_FR: "Bucket S3 pour publier les s9pks (doit correspondre à s3base)"
-  pl_PL: "Bucket S3 do publikowania s9pks (powinien odpowiadać s3base)"
-
 # CLI command descriptions (about.*)
 about.add-address-to-host:
   en_US: "Add an address to this host"
@@ -4880,13 +4866,6 @@ about.persist-new-notification:
   fr_FR: "Persister une nouvelle notification"
   pl_PL: "Utrwal nowe powiadomienie"
 
-about.publish-s9pk:
-  en_US: "Publish s9pk to S3 bucket and index on registry"
-  de_DE: "S9pk in S3-Bucket veröffentlichen und in Registry indizieren"
-  es_ES: "Publicar s9pk en bucket S3 e indexar en el registro"
-  fr_FR: "Publier s9pk dans le bucket S3 et indexer dans le registre"
-  pl_PL: "Opublikuj s9pk do bucketu S3 i zindeksuj w rejestrze"
-
 about.rebuild-service-container:
   en_US: "Rebuild service container"
   de_DE: "Dienst-Container neu erstellen"

core/rpc-toolkit.md

@@ -1,226 +0,0 @@
-# rpc-toolkit
-
-StartOS uses [rpc-toolkit](https://github.com/Start9Labs/rpc-toolkit) for its JSON-RPC API. This document covers the patterns used in this codebase.
-
-## Overview
-
-The API is JSON-RPC (not REST). All endpoints are RPC methods organized in a hierarchical command structure.
-
-## Handler Functions
-
-There are four types of handler functions, chosen based on the function's characteristics:
-
-### `from_fn_async` - Async handlers
-For standard async functions. Most handlers use this.
-
-```rust
-pub async fn my_handler(ctx: RpcContext, params: MyParams) -> Result<MyResponse, Error> {
-    // Can use .await
-}
-
-from_fn_async(my_handler)
-```
-
-### `from_fn_async_local` - Non-thread-safe async handlers
-For async functions that are not `Send` (cannot be safely moved between threads). Use when working with non-thread-safe types.
-
-```rust
-pub async fn cli_download(ctx: CliContext, params: Params) -> Result<(), Error> {
-    // Non-Send async operations
-}
-
-from_fn_async_local(cli_download)
-```
-
-### `from_fn_blocking` - Sync blocking handlers
-For synchronous functions that perform blocking I/O or long computations.
-
-```rust
-pub fn query_dns(ctx: RpcContext, params: DnsParams) -> Result<DnsResponse, Error> {
-    // Blocking operations (file I/O, DNS lookup, etc.)
-}
-
-from_fn_blocking(query_dns)
-```
-
-### `from_fn` - Sync non-blocking handlers
-For pure functions or quick synchronous operations with no I/O.
-
-```rust
-pub fn echo(ctx: RpcContext, params: EchoParams) -> Result<String, Error> {
-    Ok(params.message)
-}
-
-from_fn(echo)
-```
-
-## ParentHandler
-
-Groups related RPC methods into a hierarchy:
-
-```rust
-use rpc_toolkit::{Context, HandlerExt, ParentHandler, from_fn_async};
-
-pub fn my_api<C: Context>() -> ParentHandler<C> {
-    ParentHandler::new()
-        .subcommand("list", from_fn_async(list_handler).with_call_remote::<CliContext>())
-        .subcommand("create", from_fn_async(create_handler).with_call_remote::<CliContext>())
-}
-```
-
-## Handler Extensions
-
-Chain methods to configure handler behavior.
-
-**Ordering rules:**
-1. `with_about()` must come AFTER other CLI modifiers (`no_display()`, `with_custom_display_fn()`, etc.)
-2. `with_call_remote()` must be the LAST adapter in the chain
-
-| Method | Purpose |
-|--------|---------|
-| `.with_metadata("key", Value)` | Attach metadata for middleware |
-| `.no_cli()` | RPC-only, not available via CLI |
-| `.no_display()` | No CLI output |
-| `.with_display_serializable()` | Default JSON/YAML output for CLI |
-| `.with_custom_display_fn(\|_, res\| ...)` | Custom CLI output formatting |
-| `.with_about("about.description")` | Add help text (i18n key) - **after CLI modifiers** |
-| `.with_call_remote::<CliContext>()` | Enable CLI to call remotely - **must be last** |
-
-### Correct ordering example:
-```rust
-from_fn_async(my_handler)
-    .with_metadata("sync_db", Value::Bool(true))  // metadata early
-    .no_display()                                  // CLI modifier
-    .with_about("about.my-handler")                // after CLI modifiers
-    .with_call_remote::<CliContext>()              // always last
-```
-
-## Metadata by Middleware
-
-Metadata tags are processed by different middleware. Group them logically:
-
-### Auth Middleware (`middleware/auth/mod.rs`)
-
-| Metadata | Default | Description |
-|----------|---------|-------------|
-| `authenticated` | `true` | Whether endpoint requires authentication. Set to `false` for public endpoints. |
-
-### Session Auth Middleware (`middleware/auth/session.rs`)
-
-| Metadata | Default | Description |
-|----------|---------|-------------|
-| `login` | `false` | Special handling for login endpoints (rate limiting, cookie setting) |
-| `get_session` | `false` | Inject session ID into params as `__Auth_session` |
-
-### Signature Auth Middleware (`middleware/auth/signature.rs`)
-
-| Metadata | Default | Description |
-|----------|---------|-------------|
-| `get_signer` | `false` | Inject signer public key into params as `__Auth_signer` |
-
-### Registry Auth (extends Signature Auth)
-
-| Metadata | Default | Description |
-|----------|---------|-------------|
-| `admin` | `false` | Require admin privileges (signer must be in admin list) |
-| `get_device_info` | `false` | Inject device info header for hardware filtering |
-
-### Database Middleware (`middleware/db.rs`)
-
-| Metadata | Default | Description |
-|----------|---------|-------------|
-| `sync_db` | `false` | Sync database after mutation, add `X-Patch-Sequence` header |
-
-## Context Types
-
-Different contexts for different execution environments:
-
-- `RpcContext` - Web/RPC requests with full service access
-- `CliContext` - CLI operations, calls remote RPC
-- `InitContext` - During system initialization
-- `DiagnosticContext` - Diagnostic/recovery mode
-- `RegistryContext` - Registry daemon context
-- `EffectContext` - Service effects context (container-to-host calls)
-
-## Parameter Structs
-
-Parameters use derive macros for JSON-RPC, CLI parsing, and TypeScript generation:
-
-```rust
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[serde(rename_all = "camelCase")]  // JSON-RPC uses camelCase
-#[command(rename_all = "kebab-case")]  // CLI uses kebab-case
-#[ts(export)]  // Generate TypeScript types
-pub struct MyParams {
-    pub package_id: PackageId,
-}
-```
-
-### Middleware Injection
-
-Auth middleware can inject values into params using special field names:
-
-```rust
-#[derive(Deserialize, Serialize, Parser, TS)]
-pub struct MyParams {
-    #[ts(skip)]
-    #[serde(rename = "__Auth_session")]  // Injected by session auth
-    session: InternedString,
-
-    #[ts(skip)]
-    #[serde(rename = "__Auth_signer")]   // Injected by signature auth
-    signer: AnyVerifyingKey,
-
-    #[ts(skip)]
-    #[serde(rename = "__Auth_userAgent")] // Injected during login
-    user_agent: Option<String>,
-}
-```
-
-## Common Patterns
-
-### Adding a New RPC Endpoint
-
-1. Define params struct with `Deserialize, Serialize, Parser, TS`
-2. Choose handler type based on sync/async and thread-safety
-3. Write handler function taking `(Context, Params) -> Result<Response, Error>`
-4. Add to parent handler with appropriate extensions (display modifiers before `with_about`)
-5. TypeScript types auto-generated via `make ts-bindings`
-
-### Public (Unauthenticated) Endpoint
-
-```rust
-from_fn_async(get_info)
-    .with_metadata("authenticated", Value::Bool(false))
-    .with_display_serializable()
-    .with_about("about.get-info")
-    .with_call_remote::<CliContext>()  // last
-```
-
-### Mutating Endpoint with DB Sync
-
-```rust
-from_fn_async(update_config)
-    .with_metadata("sync_db", Value::Bool(true))
-    .no_display()
-    .with_about("about.update-config")
-    .with_call_remote::<CliContext>()  // last
-```
-
-### Session-Aware Endpoint
-
-```rust
-from_fn_async(logout)
-    .with_metadata("get_session", Value::Bool(true))
-    .no_display()
-    .with_about("about.logout")
-    .with_call_remote::<CliContext>()  // last
-```
-
-## File Locations
-
-- Handler definitions: Throughout `core/src/` modules
-- Main API tree: `core/src/lib.rs` (`main_api()`, `server()`, `package()`)
-- Auth middleware: `core/src/middleware/auth/`
-- DB middleware: `core/src/middleware/db.rs`
-- Context types: `core/src/context/`

core/s9pk-structure.md

@@ -1,122 +0,0 @@
-# S9PK Package Format
-
-S9PK is the package format for StartOS services. Version 2 uses a merkle archive structure for efficient downloading and cryptographic verification.
-
-## File Format
-
-S9PK files begin with a 3-byte header: `0x3b 0x3b 0x02` (magic bytes + version 2).
-
-The archive is cryptographically signed using Ed25519 with prehashed content (SHA-512 over blake3 merkle root hash).
-
-## Archive Structure
-
-```
-/
-├── manifest.json           # Package metadata (required)
-├── icon.<ext>              # Package icon - any image/* format (required)
-├── LICENSE.md              # License text (required)
-├── dependencies/           # Dependency metadata (optional)
-│   └── <package-id>/
-│       ├── metadata.json   # DependencyMetadata
-│       └── icon.<ext>      # Dependency icon
-├── javascript.squashfs     # Package JavaScript code (required)
-├── assets.squashfs         # Static assets (optional, legacy: assets/ directory)
-└── images/                 # Container images by architecture
-    └── <arch>/             # e.g., x86_64, aarch64, riscv64
-        ├── <image-id>.squashfs  # Container filesystem
-        ├── <image-id>.json      # Image metadata
-        └── <image-id>.env       # Environment variables
-```
-
-## Components
-
-### manifest.json
-
-The package manifest contains all metadata:
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `id` | string | Package identifier (e.g., `bitcoind`) |
-| `title` | string | Display name |
-| `version` | string | Extended version string |
-| `satisfies` | string[] | Version ranges this version satisfies |
-| `releaseNotes` | string/object | Release notes (localized) |
-| `canMigrateTo` | string | Version range for forward migration |
-| `canMigrateFrom` | string | Version range for backward migration |
-| `license` | string | License type |
-| `wrapperRepo` | string | StartOS wrapper repository URL |
-| `upstreamRepo` | string | Upstream project URL |
-| `supportSite` | string | Support site URL |
-| `marketingSite` | string | Marketing site URL |
-| `donationUrl` | string? | Optional donation URL |
-| `docsUrl` | string? | Optional documentation URL |
-| `description` | object | Short and long descriptions (localized) |
-| `images` | object | Image configurations by image ID |
-| `volumes` | string[] | Volume IDs for persistent data |
-| `alerts` | object | User alerts for lifecycle events |
-| `dependencies` | object | Package dependencies |
-| `hardwareRequirements` | object | Hardware requirements (arch, RAM, devices) |
-| `hardwareAcceleration` | boolean | Whether package uses hardware acceleration |
-| `gitHash` | string? | Git commit hash |
-| `osVersion` | string | Minimum StartOS version |
-| `sdkVersion` | string? | SDK version used to build |
-
-### javascript.squashfs
-
-Contains the package JavaScript that implements the `ABI` interface from `@start9labs/start-sdk-base`. This code runs in the container runtime and manages the package lifecycle.
-
-The squashfs is mounted at `/usr/lib/startos/package/` and the runtime loads `index.js`.
-
-### images/
-
-Container images organized by architecture:
-
-- **`<image-id>.squashfs`** - Container root filesystem
-- **`<image-id>.json`** - Image metadata (entrypoint, user, workdir, etc.)
-- **`<image-id>.env`** - Environment variables for the container
-
-Images are built from Docker/Podman and converted to squashfs. The `ImageConfig` in manifest specifies:
-- `arch` - Supported architectures
-- `emulateMissingAs` - Fallback architecture for emulation
-- `nvidiaContainer` - Whether to enable NVIDIA container support
-
-### assets.squashfs
-
-Static assets accessible to the package, mounted read-only at `/media/startos/assets/` in the container.
-
-### dependencies/
-
-Metadata for dependencies displayed in the UI:
-- `metadata.json` - Just title for now
-- `icon.<ext>` - Icon for the dependency
-
-## Merkle Archive
-
-The S9PK uses a merkle tree structure where each file and directory has a blake3 hash. This enables:
-
-1. **Partial downloads** - Download and verify individual files
-2. **Integrity verification** - Verify any subset of the archive
-3. **Efficient updates** - Only download changed portions
-4. **DOS protection** - Size limits enforced before downloading content
-
-Files are sorted by priority for streaming (manifest first, then icon, license, dependencies, javascript, assets, images).
-
-## Building S9PK
-
-Use `start-cli s9pk pack` to build packages:
-
-```bash
-start-cli s9pk pack <manifest-path> -o <output.s9pk>
-```
-
-Images can be sourced from:
-- Docker/Podman build (`--docker-build`)
-- Existing Docker tag (`--docker-tag`)
-- Pre-built squashfs files
-
-## Related Code
-
-- `core/src/s9pk/v2/mod.rs` - S9pk struct and serialization
-- `core/src/s9pk/v2/manifest.rs` - Manifest types
-- `core/src/s9pk/v2/pack.rs` - Packing logic
-- `core/src/s9pk/merkle_archive/` - Merkle archive implementation

core/src/account.rs

@@ -8,6 +8,7 @@ use openssl::x509::X509;
 use crate::db::model::DatabaseModel;
 use crate::hostname::{Hostname, generate_hostname, generate_id};
 use crate::net::ssl::{gen_nistp256, make_root_cert};
+use crate::net::tor::TorSecretKey;
 use crate::prelude::*;
 use crate::util::serde::Pem;
 
@@ -25,6 +26,7 @@ pub struct AccountInfo {
     pub server_id: String,
     pub hostname: Hostname,
     pub password: String,
+    pub tor_keys: Vec<TorSecretKey>,
     pub root_ca_key: PKey<Private>,
     pub root_ca_cert: X509,
     pub ssh_key: ssh_key::PrivateKey,
@@ -34,6 +36,7 @@ impl AccountInfo {
     pub fn new(password: &str, start_time: SystemTime) -> Result<Self, Error> {
         let server_id = generate_id();
         let hostname = generate_hostname();
+        let tor_key = vec![TorSecretKey::generate()];
         let root_ca_key = gen_nistp256()?;
         let root_ca_cert = make_root_cert(&root_ca_key, &hostname, start_time)?;
         let ssh_key = ssh_key::PrivateKey::from(ssh_key::private::Ed25519Keypair::random(
@@ -45,6 +48,7 @@ impl AccountInfo {
             server_id,
             hostname,
             password: hash_password(password)?,
+            tor_keys: tor_key,
             root_ca_key,
             root_ca_cert,
             ssh_key,
@@ -57,6 +61,17 @@ impl AccountInfo {
         let hostname = Hostname(db.as_public().as_server_info().as_hostname().de()?);
         let password = db.as_private().as_password().de()?;
         let key_store = db.as_private().as_key_store();
+        let tor_addrs = db
+            .as_public()
+            .as_server_info()
+            .as_network()
+            .as_host()
+            .as_onions()
+            .de()?;
+        let tor_keys = tor_addrs
+            .into_iter()
+            .map(|tor_addr| key_store.as_onion().get_key(&tor_addr))
+            .collect::<Result<_, _>>()?;
         let cert_store = key_store.as_local_certs();
         let root_ca_key = cert_store.as_root_key().de()?.0;
         let root_ca_cert = cert_store.as_root_cert().de()?.0;
@@ -67,6 +82,7 @@ impl AccountInfo {
             server_id,
             hostname,
             password,
+            tor_keys,
             root_ca_key,
             root_ca_cert,
             ssh_key,
@@ -81,6 +97,17 @@ impl AccountInfo {
         server_info
             .as_pubkey_mut()
             .ser(&self.ssh_key.public_key().to_openssh()?)?;
+        server_info
+            .as_network_mut()
+            .as_host_mut()
+            .as_onions_mut()
+            .ser(
+                &self
+                    .tor_keys
+                    .iter()
+                    .map(|tor_key| tor_key.onion_address())
+                    .collect(),
+            )?;
         server_info.as_password_hash_mut().ser(&self.password)?;
         db.as_private_mut().as_password_mut().ser(&self.password)?;
         db.as_private_mut()
@@ -90,6 +117,9 @@ impl AccountInfo {
             .as_developer_key_mut()
             .ser(Pem::new_ref(&self.developer_key))?;
         let key_store = db.as_private_mut().as_key_store_mut();
+        for tor_key in &self.tor_keys {
+            key_store.as_onion_mut().insert_key(tor_key)?;
+        }
         let cert_store = key_store.as_local_certs_mut();
         if cert_store.as_root_cert().de()?.0 != self.root_ca_cert {
             cert_store
@@ -118,5 +148,11 @@ impl AccountInfo {
             self.hostname.no_dot_host_name(),
             self.hostname.local_domain_name(),
         ]
+        .into_iter()
+        .chain(
+            self.tor_keys
+                .iter()
+                .map(|k| InternedString::from_display(&k.onion_address())),
+        )
     }
 }

core/src/action.rs

@@ -271,7 +271,6 @@ pub fn display_action_result<T: Serialize>(
 }
 
 #[derive(Deserialize, Serialize, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 pub struct RunActionParams {
     pub package_id: PackageId,
@@ -363,7 +362,6 @@ pub async fn run_action(
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct ClearTaskParams {

core/src/auth.rs

@@ -418,7 +418,6 @@ impl AsLogoutSessionId for KillSessionId {
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct KillParams {
@@ -436,7 +435,6 @@ pub async fn kill<C: SessionAuthContext>(
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct ResetPasswordParams {

core/src/backup/backup_bulk.rs

@@ -30,7 +30,6 @@ use crate::util::serde::IoFormat;
 use crate::version::VersionT;
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct BackupParams {

core/src/backup/mod.rs

@@ -2,7 +2,6 @@ use std::collections::BTreeMap;
 
 use rpc_toolkit::{Context, HandlerExt, ParentHandler, from_fn_async};
 use serde::{Deserialize, Serialize};
-use ts_rs::TS;
 
 use crate::PackageId;
 use crate::context::CliContext;
@@ -14,22 +13,19 @@ pub mod os;
 pub mod restore;
 pub mod target;
 
-#[derive(Debug, Deserialize, Serialize, TS)]
-#[ts(export)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct BackupReport {
     server: ServerBackupReport,
     packages: BTreeMap<PackageId, PackageBackupReport>,
 }
 
-#[derive(Debug, Deserialize, Serialize, TS)]
-#[ts(export)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct ServerBackupReport {
     attempted: bool,
     error: Option<String>,
 }
 
-#[derive(Debug, Deserialize, Serialize, TS)]
-#[ts(export)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct PackageBackupReport {
     pub error: Option<String>,
 }

core/src/backup/os.rs

@@ -7,7 +7,9 @@ use ssh_key::private::Ed25519Keypair;
 
 use crate::account::AccountInfo;
 use crate::hostname::{Hostname, generate_hostname, generate_id};
+use crate::net::tor::TorSecretKey;
 use crate::prelude::*;
+use crate::util::crypto::ed25519_expand_key;
 use crate::util::serde::{Base32, Base64, Pem};
 
 pub struct OsBackup {
@@ -83,6 +85,10 @@ impl OsBackupV0 {
                     &mut ssh_key::rand_core::OsRng::default(),
                     ssh_key::Algorithm::Ed25519,
                 )?,
+                tor_keys: TorSecretKey::from_bytes(self.tor_key.0)
+                    .ok()
+                    .into_iter()
+                    .collect(),
                 developer_key: ed25519_dalek::SigningKey::generate(
                     &mut ssh_key::rand_core::OsRng::default(),
                 ),
@@ -113,6 +119,10 @@ impl OsBackupV1 {
                 root_ca_key: self.root_ca_key.0,
                 root_ca_cert: self.root_ca_cert.0,
                 ssh_key: ssh_key::PrivateKey::from(Ed25519Keypair::from_seed(&self.net_key.0)),
+                tor_keys: TorSecretKey::from_bytes(ed25519_expand_key(&self.net_key.0))
+                    .ok()
+                    .into_iter()
+                    .collect(),
                 developer_key: ed25519_dalek::SigningKey::from_bytes(&self.net_key),
             },
             ui: self.ui,
@@ -130,6 +140,7 @@ struct OsBackupV2 {
     root_ca_key: Pem<PKey<Private>>,                 // PEM Encoded OpenSSL Key
     root_ca_cert: Pem<X509>,                         // PEM Encoded OpenSSL X509 Certificate
     ssh_key: Pem<ssh_key::PrivateKey>,               // PEM Encoded OpenSSH Key
+    tor_keys: Vec<TorSecretKey>,                     // Base64 Encoded Ed25519 Expanded Secret Key
     compat_s9pk_key: Pem<ed25519_dalek::SigningKey>, // PEM Encoded ED25519 Key
     ui: Value,                                       // JSON Value
 }
@@ -143,6 +154,7 @@ impl OsBackupV2 {
                 root_ca_key: self.root_ca_key.0,
                 root_ca_cert: self.root_ca_cert.0,
                 ssh_key: self.ssh_key.0,
+                tor_keys: self.tor_keys,
                 developer_key: self.compat_s9pk_key.0,
             },
             ui: self.ui,
@@ -155,6 +167,7 @@ impl OsBackupV2 {
             root_ca_key: Pem(backup.account.root_ca_key.clone()),
             root_ca_cert: Pem(backup.account.root_ca_cert.clone()),
             ssh_key: Pem(backup.account.ssh_key.clone()),
+            tor_keys: backup.account.tor_keys.clone(),
             compat_s9pk_key: Pem(backup.account.developer_key.clone()),
             ui: backup.ui.clone(),
         }

core/src/backup/restore.rs

@@ -30,7 +30,6 @@ use crate::{PLATFORM, PackageId};
 #[derive(Deserialize, Serialize, Parser, TS)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
-#[ts(export)]
 pub struct RestorePackageParams {
     #[arg(help = "help.arg.package-ids")]
     pub ids: Vec<PackageId>,

core/src/backup/target/cifs.rs

@@ -36,8 +36,7 @@ impl Map for CifsTargets {
     }
 }
 
-#[derive(Debug, Deserialize, Serialize, TS)]
-#[ts(export)]
+#[derive(Debug, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CifsBackupTarget {
     hostname: String,
@@ -73,10 +72,9 @@ pub fn cifs<C: Context>() -> ParentHandler<C> {
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
-pub struct CifsAddParams {
+pub struct AddParams {
     #[arg(help = "help.arg.cifs-hostname")]
     pub hostname: String,
     #[arg(help = "help.arg.cifs-path")]
@@ -89,12 +87,12 @@ pub struct CifsAddParams {
 
 pub async fn add(
     ctx: RpcContext,
-    CifsAddParams {
+    AddParams {
         hostname,
         path,
         username,
         password,
-    }: CifsAddParams,
+    }: AddParams,
 ) -> Result<KeyVal<BackupTargetId, BackupTarget>, Error> {
     let cifs = Cifs {
         hostname,
@@ -133,10 +131,9 @@ pub async fn add(
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
-pub struct CifsUpdateParams {
+pub struct UpdateParams {
     #[arg(help = "help.arg.backup-target-id")]
     pub id: BackupTargetId,
     #[arg(help = "help.arg.cifs-hostname")]
@@ -151,13 +148,13 @@ pub struct CifsUpdateParams {
 
 pub async fn update(
     ctx: RpcContext,
-    CifsUpdateParams {
+    UpdateParams {
         id,
         hostname,
         path,
         username,
         password,
-    }: CifsUpdateParams,
+    }: UpdateParams,
 ) -> Result<KeyVal<BackupTargetId, BackupTarget>, Error> {
     let id = if let BackupTargetId::Cifs { id } = id {
         id
@@ -183,13 +180,7 @@ pub async fn update(
                 .as_idx_mut(&id)
                 .ok_or_else(|| {
                     Error::new(
-                        eyre!(
-                            "{}",
-                            t!(
-                                "backup.target.cifs.target-not-found",
-                                id = BackupTargetId::Cifs { id }
-                            )
-                        ),
+                        eyre!("{}", t!("backup.target.cifs.target-not-found", id = BackupTargetId::Cifs { id })),
                         ErrorKind::NotFound,
                     )
                 })?
@@ -210,15 +201,14 @@ pub async fn update(
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
-pub struct CifsRemoveParams {
+pub struct RemoveParams {
     #[arg(help = "help.arg.backup-target-id")]
     pub id: BackupTargetId,
 }
 
-pub async fn remove(ctx: RpcContext, CifsRemoveParams { id }: CifsRemoveParams) -> Result<(), Error> {
+pub async fn remove(ctx: RpcContext, RemoveParams { id }: RemoveParams) -> Result<(), Error> {
     let id = if let BackupTargetId::Cifs { id } = id {
         id
     } else {

core/src/backup/target/mod.rs

@@ -34,8 +34,7 @@ use crate::util::{FromStrParser, VersionString};
 
 pub mod cifs;
 
-#[derive(Debug, Deserialize, Serialize, TS)]
-#[ts(export)]
+#[derive(Debug, Deserialize, Serialize)]
 #[serde(tag = "type")]
 #[serde(rename_all = "camelCase")]
 pub enum BackupTarget {
@@ -50,7 +49,7 @@ pub enum BackupTarget {
 }
 
 #[derive(Debug, PartialEq, Eq, PartialOrd, Ord, Clone, TS)]
-#[ts(export, type = "string")]
+#[ts(type = "string")]
 pub enum BackupTargetId {
     Disk { logicalname: PathBuf },
     Cifs { id: u32 },
@@ -112,7 +111,6 @@ impl Serialize for BackupTargetId {
 }
 
 #[derive(Debug, Deserialize, Serialize, TS)]
-#[ts(export)]
 #[serde(tag = "type")]
 #[serde(rename_all = "camelCase")]
 pub enum BackupTargetFS {
@@ -212,26 +210,20 @@ pub async fn list(ctx: RpcContext) -> Result<BTreeMap<BackupTargetId, BackupTarg
         .collect())
 }
 
-#[derive(Clone, Debug, Default, Deserialize, Serialize, TS)]
-#[ts(export)]
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct BackupInfo {
-    #[ts(type = "string")]
     pub version: Version,
-    #[ts(type = "string | null")]
     pub timestamp: Option<DateTime<Utc>>,
     pub package_backups: BTreeMap<PackageId, PackageBackupInfo>,
 }
 
-#[derive(Clone, Debug, Deserialize, Serialize, TS)]
-#[ts(export)]
+#[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PackageBackupInfo {
     pub title: InternedString,
     pub version: VersionString,
-    #[ts(type = "string")]
     pub os_version: Version,
-    #[ts(type = "string")]
     pub timestamp: DateTime<Utc>,
 }
 
@@ -273,7 +265,6 @@ fn display_backup_info(params: WithIoFormat<InfoParams>, info: BackupInfo) -> Re
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct InfoParams {
@@ -396,7 +387,6 @@ pub async fn mount(
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct UmountParams {

core/src/bins/deprecated.rs

@@ -1,7 +1,10 @@
 use rust_i18n::t;
 
 pub fn renamed(old: &str, new: &str) -> ! {
-    eprintln!("{}", t!("bins.deprecated.renamed", old = old, new = new));
+    eprintln!(
+        "{}",
+        t!("bins.deprecated.renamed", old = old, new = new)
+    );
     std::process::exit(1)
 }
 

core/src/bins/start_init.rs

@@ -9,7 +9,7 @@ use crate::disk::fsck::RepairStrategy;
 use crate::disk::main::DEFAULT_PASSWORD;
 use crate::firmware::{check_for_firmware_update, update_firmware};
 use crate::init::{InitPhases, STANDBY_MODE_PATH};
-use crate::net::gateway::WildcardListener;
+use crate::net::gateway::UpgradableListener;
 use crate::net::web_server::WebServer;
 use crate::prelude::*;
 use crate::progress::FullProgressTracker;
@@ -19,7 +19,7 @@ use crate::{DATA_DIR, PLATFORM};
 
 #[instrument(skip_all)]
 async fn setup_or_init(
-    server: &mut WebServer<WildcardListener>,
+    server: &mut WebServer<UpgradableListener>,
     config: &ServerConfig,
 ) -> Result<Result<(RpcContext, FullProgressTracker), Shutdown>, Error> {
     if let Some(firmware) = check_for_firmware_update()
@@ -204,7 +204,7 @@ async fn setup_or_init(
 
 #[instrument(skip_all)]
 pub async fn main(
-    server: &mut WebServer<WildcardListener>,
+    server: &mut WebServer<UpgradableListener>,
     config: &ServerConfig,
 ) -> Result<Result<(RpcContext, FullProgressTracker), Shutdown>, Error> {
     if &*PLATFORM == "raspberrypi" && tokio::fs::metadata(STANDBY_MODE_PATH).await.is_ok() {

core/src/bins/startd.rs

@@ -4,15 +4,15 @@ use std::time::Duration;
 
 use clap::Parser;
 use color_eyre::eyre::eyre;
-use futures::{FutureExt, TryFutureExt};
 use rust_i18n::t;
+use futures::{FutureExt, TryFutureExt};
 use tokio::signal::unix::signal;
 use tracing::instrument;
 
 use crate::context::config::ServerConfig;
 use crate::context::rpc::InitRpcContextPhases;
 use crate::context::{DiagnosticContext, InitContext, RpcContext};
-use crate::net::gateway::WildcardListener;
+use crate::net::gateway::{BindTcp, SelfContainedNetworkInterfaceListener, UpgradableListener};
 use crate::net::static_server::refresher;
 use crate::net::web_server::{Acceptor, WebServer};
 use crate::prelude::*;
@@ -23,7 +23,7 @@ use crate::util::logger::LOGGER;
 
 #[instrument(skip_all)]
 async fn inner_main(
-    server: &mut WebServer<WildcardListener>,
+    server: &mut WebServer<UpgradableListener>,
     config: &ServerConfig,
 ) -> Result<Option<Shutdown>, Error> {
     let rpc_ctx = if !tokio::fs::metadata("/run/startos/initialized")
@@ -148,7 +148,7 @@ pub fn main(args: impl IntoIterator<Item = OsString>) {
             .expect(&t!("bins.startd.failed-to-initialize-runtime"));
         let res = rt.block_on(async {
             let mut server = WebServer::new(
-                Acceptor::new(WildcardListener::new(80)?),
+                Acceptor::bind_upgradable(SelfContainedNetworkInterfaceListener::bind(BindTcp, 80)),
                 refresher(),
             );
             match inner_main(&mut server, &config).await {

core/src/bins/tunnel.rs

@@ -13,7 +13,7 @@ use visit_rs::Visit;
 
 use crate::context::CliContext;
 use crate::context::config::ClientConfig;
-use tokio::net::TcpListener;
+use crate::net::gateway::{Bind, BindTcp};
 use crate::net::tls::TlsListener;
 use crate::net::web_server::{Accept, Acceptor, MetadataVisitor, WebServer};
 use crate::prelude::*;
@@ -57,12 +57,7 @@ async fn inner_main(config: &TunnelConfig) -> Result<(), Error> {
                             if !a.contains_key(&key) {
                                 match (|| {
                                     Ok::<_, Error>(TlsListener::new(
-                                        TcpListener::from_std(
-                                            mio::net::TcpListener::bind(addr)
-                                                .with_kind(ErrorKind::Network)?
-                                                .into(),
-                                        )
-                                        .with_kind(ErrorKind::Network)?,
+                                        BindTcp.bind(addr)?,
                                         TunnelCertHandler {
                                             db: https_db.clone(),
                                             crypto_provider: Arc::new(tokio_rustls::rustls::crypto::ring::default_provider()),

core/src/context/cli.rs

@@ -38,8 +38,6 @@ pub struct CliContextSeed {
     pub registry_url: Option<Url>,
     pub registry_hostname: Vec<InternedString>,
     pub registry_listen: Option<SocketAddr>,
-    pub s9pk_s3base: Option<Url>,
-    pub s9pk_s3bucket: Option<InternedString>,
     pub tunnel_addr: Option<SocketAddr>,
     pub tunnel_listen: Option<SocketAddr>,
     pub client: Client,
@@ -131,8 +129,6 @@ impl CliContext {
                 .transpose()?,
             registry_hostname: config.registry_hostname.unwrap_or_default(),
             registry_listen: config.registry_listen,
-            s9pk_s3base: config.s9pk_s3base,
-            s9pk_s3bucket: config.s9pk_s3bucket,
             tunnel_addr: config.tunnel,
             tunnel_listen: config.tunnel_listen,
             client: {
@@ -164,23 +160,21 @@ impl CliContext {
                 if !path.exists() {
                     continue;
                 }
-                let pair =
-                    <ed25519::KeypairBytes as ed25519::pkcs8::DecodePrivateKey>::from_pkcs8_pem(
-                        &std::fs::read_to_string(path)?,
+                let pair = <ed25519::KeypairBytes as ed25519::pkcs8::DecodePrivateKey>::from_pkcs8_pem(
+                    &std::fs::read_to_string(path)?,
+                )
+                .with_kind(crate::ErrorKind::Pem)?;
+                let secret = ed25519_dalek::SecretKey::try_from(&pair.secret_key[..]).map_err(|_| {
+                    Error::new(
+                        eyre!("{}", t!("context.cli.pkcs8-key-incorrect-length")),
+                        ErrorKind::OpenSsl,
                     )
-                    .with_kind(crate::ErrorKind::Pem)?;
-                let secret =
-                    ed25519_dalek::SecretKey::try_from(&pair.secret_key[..]).map_err(|_| {
-                        Error::new(
-                            eyre!("{}", t!("context.cli.pkcs8-key-incorrect-length")),
-                            ErrorKind::OpenSsl,
-                        )
-                    })?;
-                return Ok(secret.into());
+                })?;
+                return Ok(secret.into())
             }
             Err(Error::new(
                 eyre!("{}", t!("context.cli.developer-key-does-not-exist")),
-                crate::ErrorKind::Uninitialized,
+                crate::ErrorKind::Uninitialized
             ))
         })
     }
@@ -201,12 +195,8 @@ impl CliContext {
                 .into());
             }
         };
-        url.set_scheme(ws_scheme).map_err(|_| {
-            Error::new(
-                eyre!("{}", t!("context.cli.cannot-set-url-scheme")),
-                crate::ErrorKind::ParseUrl,
-            )
-        })?;
+        url.set_scheme(ws_scheme)
+            .map_err(|_| Error::new(eyre!("{}", t!("context.cli.cannot-set-url-scheme")), crate::ErrorKind::ParseUrl))?;
         url.path_segments_mut()
             .map_err(|_| eyre!("Url cannot be base"))
             .with_kind(crate::ErrorKind::ParseUrl)?

core/src/context/config.rs

@@ -68,10 +68,6 @@ pub struct ClientConfig {
     pub registry_hostname: Option<Vec<InternedString>>,
     #[arg(skip)]
     pub registry_listen: Option<SocketAddr>,
-    #[arg(long, help = "help.s9pk-s3base")]
-    pub s9pk_s3base: Option<Url>,
-    #[arg(long, help = "help.s9pk-s3bucket")]
-    pub s9pk_s3bucket: Option<InternedString>,
     #[arg(short = 't', long, help = "help.arg.tunnel-address")]
     pub tunnel: Option<SocketAddr>,
     #[arg(skip)]
@@ -93,13 +89,8 @@ impl ContextConfig for ClientConfig {
         self.host = self.host.take().or(other.host);
         self.registry = self.registry.take().or(other.registry);
         self.registry_hostname = self.registry_hostname.take().or(other.registry_hostname);
-        self.registry_listen = self.registry_listen.take().or(other.registry_listen);
-        self.s9pk_s3base = self.s9pk_s3base.take().or(other.s9pk_s3base);
-        self.s9pk_s3bucket = self.s9pk_s3bucket.take().or(other.s9pk_s3bucket);
         self.tunnel = self.tunnel.take().or(other.tunnel);
-        self.tunnel_listen = self.tunnel_listen.take().or(other.tunnel_listen);
         self.proxy = self.proxy.take().or(other.proxy);
-        self.socks_listen = self.socks_listen.take().or(other.socks_listen);
         self.cookie_path = self.cookie_path.take().or(other.cookie_path);
         self.developer_key_path = self.developer_key_path.take().or(other.developer_key_path);
     }

core/src/context/diagnostic.rs

@@ -27,10 +27,7 @@ impl DiagnosticContext {
         disk_guid: Option<InternedString>,
         error: Error,
     ) -> Result<Self, Error> {
-        tracing::error!(
-            "{}",
-            t!("context.diagnostic.starting-diagnostic-ui", error = error)
-        );
+        tracing::error!("{}", t!("context.diagnostic.starting-diagnostic-ui", error = error));
         tracing::debug!("{:?}", error);
 
         let (shutdown, _) = tokio::sync::broadcast::channel(1);

core/src/context/rpc.rs

@@ -34,7 +34,7 @@ use crate::disk::mount::guard::MountGuard;
 use crate::init::{InitResult, check_time_is_synchronized};
 use crate::install::PKG_ARCHIVE_DIR;
 use crate::lxc::LxcManager;
-use crate::net::gateway::WildcardListener;
+use crate::net::gateway::UpgradableListener;
 use crate::net::net_controller::{NetController, NetService};
 use crate::net::socks::DEFAULT_SOCKS_LISTEN;
 use crate::net::utils::{find_eth_iface, find_wifi_iface};
@@ -132,7 +132,7 @@ pub struct RpcContext(Arc<RpcContextSeed>);
 impl RpcContext {
     #[instrument(skip_all)]
     pub async fn init(
-        webserver: &WebServerAcceptorSetter<WildcardListener>,
+        webserver: &WebServerAcceptorSetter<UpgradableListener>,
         config: &ServerConfig,
         disk_guid: InternedString,
         init_result: Option<InitResult>,
@@ -167,7 +167,7 @@ impl RpcContext {
         } else {
             let net_ctrl =
                 Arc::new(NetController::init(db.clone(), &account.hostname, socks_proxy).await?);
-            webserver.send_modify(|wl| wl.set_ip_info(net_ctrl.net_iface.watcher.subscribe()));
+            webserver.try_upgrade(|a| net_ctrl.net_iface.watcher.upgrade_listener(a))?;
             let os_net_service = net_ctrl.os_bindings().await?;
             (net_ctrl, os_net_service)
         };
@@ -463,10 +463,7 @@ impl RpcContext {
                     .await
                     .result
                 {
-                    tracing::error!(
-                        "{}",
-                        t!("context.rpc.error-in-session-cleanup-cron", error = e)
-                    );
+                    tracing::error!("{}", t!("context.rpc.error-in-session-cleanup-cron", error = e));
                     tracing::debug!("{e:?}");
                 }
             }
@@ -579,7 +576,6 @@ impl RpcContext {
     pub async fn call_remote<RemoteContext>(
         &self,
         method: &str,
-        metadata: OrdMap<&'static str, Value>,
         params: Value,
     ) -> Result<Value, RpcError>
     where
@@ -588,7 +584,7 @@ impl RpcContext {
         <Self as CallRemote<RemoteContext, Empty>>::call_remote(
             &self,
             method,
-            metadata,
+            OrdMap::new(),
             params,
             Empty {},
         )
@@ -597,15 +593,20 @@ impl RpcContext {
     pub async fn call_remote_with<RemoteContext, T>(
         &self,
         method: &str,
-        metadata: OrdMap<&'static str, Value>,
         params: Value,
         extra: T,
     ) -> Result<Value, RpcError>
     where
         Self: CallRemote<RemoteContext, T>,
     {
-        <Self as CallRemote<RemoteContext, T>>::call_remote(&self, method, metadata, params, extra)
-            .await
+        <Self as CallRemote<RemoteContext, T>>::call_remote(
+            &self,
+            method,
+            OrdMap::new(),
+            params,
+            extra,
+        )
+        .await
     }
 }
 impl AsRef<Client> for RpcContext {

core/src/context/setup.rs

@@ -20,7 +20,7 @@ use crate::context::RpcContext;
 use crate::context::config::ServerConfig;
 use crate::disk::mount::guard::{MountGuard, TmpMountGuard};
 use crate::hostname::Hostname;
-use crate::net::gateway::WildcardListener;
+use crate::net::gateway::UpgradableListener;
 use crate::net::web_server::{WebServer, WebServerAcceptorSetter};
 use crate::prelude::*;
 use crate::progress::FullProgressTracker;
@@ -51,7 +51,7 @@ pub struct SetupResult {
 }
 
 pub struct SetupContextSeed {
-    pub webserver: WebServerAcceptorSetter<WildcardListener>,
+    pub webserver: WebServerAcceptorSetter<UpgradableListener>,
     pub config: SyncMutex<ServerConfig>,
     pub disable_encryption: bool,
     pub progress: FullProgressTracker,
@@ -70,7 +70,7 @@ pub struct SetupContext(Arc<SetupContextSeed>);
 impl SetupContext {
     #[instrument(skip_all)]
     pub fn init(
-        webserver: &WebServer<WildcardListener>,
+        webserver: &WebServer<UpgradableListener>,
         config: ServerConfig,
     ) -> Result<Self, Error> {
         let (shutdown, _) = tokio::sync::broadcast::channel(1);

core/src/control.rs

@@ -8,7 +8,6 @@ use crate::prelude::*;
 use crate::{Error, PackageId};
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct ControlParams {

core/src/db/mod.rs

@@ -87,11 +87,7 @@ pub enum RevisionsRes {
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct CliDumpParams {
-    #[arg(
-        long = "include-private",
-        short = 'p',
-        help = "help.arg.include-private-data"
-    )]
+    #[arg(long = "include-private", short = 'p', help = "help.arg.include-private-data")]
     #[serde(default)]
     include_private: bool,
     #[arg(help = "help.arg.db-path")]

core/src/db/model/package.rs

@@ -18,7 +18,7 @@ use crate::s9pk::manifest::{LocaleString, Manifest};
 use crate::status::StatusInfo;
 use crate::util::DataUrl;
 use crate::util::serde::{Pem, is_partial_of};
-use crate::{ActionId, GatewayId, HealthCheckId, HostId, PackageId, ReplayId, ServiceInterfaceId};
+use crate::{ActionId, HealthCheckId, HostId, PackageId, ReplayId, ServiceInterfaceId};
 
 #[derive(Debug, Default, Deserialize, Serialize, TS)]
 #[ts(export)]
@@ -381,9 +381,6 @@ pub struct PackageDataEntry {
     pub hosts: Hosts,
     #[ts(type = "string[]")]
     pub store_exposed_dependents: Vec<JsonPointer>,
-    #[serde(default)]
-    #[ts(type = "string | null")]
-    pub outbound_gateway: Option<GatewayId>,
 }
 impl AsRef<PackageDataEntry> for PackageDataEntry {
     fn as_ref(&self) -> &PackageDataEntry {

core/src/db/model/public.rs

@@ -20,9 +20,8 @@ use crate::db::model::Database;
 use crate::db::model::package::AllPackageData;
 use crate::net::acme::AcmeProvider;
 use crate::net::host::Host;
-use crate::net::host::binding::{
-    AddSslOptions, BindInfo, BindOptions, Bindings, DerivedAddressInfo, NetInfo,
-};
+use crate::net::host::binding::{AddSslOptions, BindInfo, BindOptions, NetInfo};
+use crate::net::utils::ipv6_is_local;
 use crate::net::vhost::AlpnInfo;
 use crate::prelude::*;
 use crate::progress::FullProgress;
@@ -64,36 +63,36 @@ impl Public {
                 post_init_migration_todos: BTreeMap::new(),
                 network: NetworkInfo {
                     host: Host {
-                        bindings: Bindings(
-                            [(
-                                80,
-                                BindInfo {
-                                    enabled: false,
-                                    options: BindOptions {
-                                        preferred_external_port: 80,
-                                        add_ssl: Some(AddSslOptions {
-                                            preferred_external_port: 443,
-                                            add_x_forwarded_headers: false,
-                                            alpn: Some(AlpnInfo::Specified(vec![
-                                                MaybeUtf8String("h2".into()),
-                                                MaybeUtf8String("http/1.1".into()),
-                                            ])),
-                                        }),
-                                        secure: None,
-                                    },
-                                    net: NetInfo {
-                                        assigned_port: None,
-                                        assigned_ssl_port: Some(443),
-                                    },
-                                    addresses: DerivedAddressInfo::default(),
+                        bindings: [(
+                            80,
+                            BindInfo {
+                                enabled: false,
+                                options: BindOptions {
+                                    preferred_external_port: 80,
+                                    add_ssl: Some(AddSslOptions {
+                                        preferred_external_port: 443,
+                                        add_x_forwarded_headers: false,
+                                        alpn: Some(AlpnInfo::Specified(vec![
+                                            MaybeUtf8String("h2".into()),
+                                            MaybeUtf8String("http/1.1".into()),
+                                        ])),
+                                    }),
+                                    secure: None,
                                 },
-                            )]
-                            .into_iter()
-                            .collect(),
-                        ),
+                                net: NetInfo {
+                                    assigned_port: None,
+                                    assigned_ssl_port: Some(443),
+                                    private_disabled: OrdSet::new(),
+                                    public_enabled: OrdSet::new(),
+                                },
+                            },
+                        )]
+                        .into_iter()
+                        .collect(),
+                        onions: account.tor_keys.iter().map(|k| k.onion_address()).collect(),
                         public_domains: BTreeMap::new(),
-                        private_domains: BTreeMap::new(),
-                        port_forwards: BTreeSet::new(),
+                        private_domains: BTreeSet::new(),
+                        hostname_info: BTreeMap::new(),
                     },
                     wifi: WifiInfo {
                         enabled: true,
@@ -118,7 +117,6 @@ impl Public {
                         acme
                     },
                     dns: Default::default(),
-                    default_outbound: None,
                 },
                 status_info: ServerStatus {
                     backup_progress: None,
@@ -222,9 +220,6 @@ pub struct NetworkInfo {
     pub acme: BTreeMap<AcmeProvider, AcmeSettings>,
     #[serde(default)]
     pub dns: DnsSettings,
-    #[serde(default)]
-    #[ts(type = "string | null")]
-    pub default_outbound: Option<GatewayId>,
 }
 
 #[derive(Debug, Default, Deserialize, Serialize, HasModel, TS)]
@@ -244,12 +239,41 @@ pub struct DnsSettings {
 #[ts(export)]
 pub struct NetworkInterfaceInfo {
     pub name: Option<InternedString>,
+    pub public: Option<bool>,
     pub secure: Option<bool>,
     pub ip_info: Option<Arc<IpInfo>>,
-    #[serde(default, rename = "type")]
-    pub gateway_type: Option<GatewayType>,
 }
 impl NetworkInterfaceInfo {
+    pub fn public(&self) -> bool {
+        self.public.unwrap_or_else(|| {
+            !self.ip_info.as_ref().map_or(true, |ip_info| {
+                let ip4s = ip_info
+                    .subnets
+                    .iter()
+                    .filter_map(|ipnet| {
+                        if let IpAddr::V4(ip4) = ipnet.addr() {
+                            Some(ip4)
+                        } else {
+                            None
+                        }
+                    })
+                    .collect::<BTreeSet<_>>();
+                if !ip4s.is_empty() {
+                    return ip4s
+                        .iter()
+                        .all(|ip4| ip4.is_loopback() || ip4.is_private() || ip4.is_link_local());
+                }
+                ip_info.subnets.iter().all(|ipnet| {
+                    if let IpAddr::V6(ip6) = ipnet.addr() {
+                        ipv6_is_local(ip6)
+                    } else {
+                        true
+                    }
+                })
+            })
+        })
+    }
+
     pub fn secure(&self) -> bool {
         self.secure.unwrap_or(false)
     }
@@ -286,28 +310,6 @@ pub enum NetworkInterfaceType {
     Loopback,
 }
 
-#[derive(
-    Clone,
-    Copy,
-    Debug,
-    Default,
-    PartialEq,
-    Eq,
-    PartialOrd,
-    Ord,
-    Deserialize,
-    Serialize,
-    TS,
-    clap::ValueEnum,
-)]
-#[ts(export)]
-#[serde(rename_all = "kebab-case")]
-pub enum GatewayType {
-    #[default]
-    InboundOutbound,
-    OutboundOnly,
-}
-
 #[derive(Debug, Deserialize, Serialize, HasModel, TS)]
 #[serde(rename_all = "camelCase")]
 #[model = "Model<Self>"]

core/src/disk/fsck/ext4.rs

@@ -70,20 +70,12 @@ async fn e2fsck_runner(
     if code & 4 != 0 {
         tracing::error!(
             "{}",
-            t!(
-                "disk.fsck.errors-not-corrected",
-                device = logicalname.as_ref().display(),
-                stderr = e2fsck_stderr
-            ),
+            t!("disk.fsck.errors-not-corrected", device = logicalname.as_ref().display(), stderr = e2fsck_stderr),
         );
     } else if code & 1 != 0 {
         tracing::warn!(
             "{}",
-            t!(
-                "disk.fsck.errors-corrected",
-                device = logicalname.as_ref().display(),
-                stderr = e2fsck_stderr
-            ),
+            t!("disk.fsck.errors-corrected", device = logicalname.as_ref().display(), stderr = e2fsck_stderr),
         );
     }
     if code < 8 {

core/src/disk/mount/filesystem/bind.rs

@@ -29,31 +29,25 @@ impl Default for FileType {
 pub struct Bind<Src: AsRef<Path>> {
     src: Src,
     filetype: FileType,
-    recursive: bool,
 }
 impl<Src: AsRef<Path>> Bind<Src> {
     pub fn new(src: Src) -> Self {
         Self {
             src,
             filetype: FileType::Directory,
-            recursive: false,
         }
     }
     pub fn with_type(mut self, filetype: FileType) -> Self {
         self.filetype = filetype;
         self
     }
-    pub fn recursive(mut self, recursive: bool) -> Self {
-        self.recursive = recursive;
-        self
-    }
 }
 impl<Src: AsRef<Path> + Send + Sync> FileSystem for Bind<Src> {
     async fn source(&self) -> Result<Option<impl AsRef<Path>>, Error> {
         Ok(Some(&self.src))
     }
     fn extra_args(&self) -> impl IntoIterator<Item = impl AsRef<std::ffi::OsStr>> {
-        [if self.recursive { "--rbind" } else { "--bind" }]
+        ["--bind"]
     }
     async fn pre_mount(&self, mountpoint: &Path, mount_type: MountType) -> Result<(), Error> {
         let from_meta = tokio::fs::metadata(&self.src).await.ok();

core/src/disk/mount/util.rs

@@ -24,11 +24,7 @@ pub async fn bind<P0: AsRef<Path>, P1: AsRef<Path>>(
 ) -> Result<(), Error> {
     tracing::info!(
         "{}",
-        t!(
-            "disk.mount.binding",
-            src = src.as_ref().display(),
-            dst = dst.as_ref().display()
-        )
+        t!("disk.mount.binding", src = src.as_ref().display(), dst = dst.as_ref().display())
     );
     if is_mountpoint(&dst).await? {
         unmount(dst.as_ref(), true).await?;

core/src/disk/util.rs

@@ -43,28 +43,22 @@ pub struct DiskInfo {
     pub guid: Option<InternedString>,
 }
 
-#[derive(Clone, Debug, Deserialize, Serialize, ts_rs::TS)]
-#[ts(export)]
+#[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PartitionInfo {
     pub logicalname: PathBuf,
     pub label: Option<String>,
-    #[ts(type = "number")]
     pub capacity: u64,
-    #[ts(type = "number | null")]
     pub used: Option<u64>,
     pub start_os: BTreeMap<String, StartOsRecoveryInfo>,
     pub guid: Option<InternedString>,
 }
 
-#[derive(Clone, Debug, Default, Deserialize, Serialize, ts_rs::TS)]
-#[ts(export)]
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct StartOsRecoveryInfo {
     pub hostname: Hostname,
-    #[ts(type = "string")]
     pub version: exver::Version,
-    #[ts(type = "string")]
     pub timestamp: DateTime<Utc>,
     pub password_hash: Option<String>,
     pub wrapped_key: Option<String>,

core/src/error.rs

@@ -4,7 +4,7 @@ use axum::http::StatusCode;
 use axum::http::uri::InvalidUri;
 use color_eyre::eyre::eyre;
 use num_enum::TryFromPrimitive;
-use patch_db::Value;
+use patch_db::Revision;
 use rpc_toolkit::reqwest;
 use rpc_toolkit::yajrc::{
     INVALID_PARAMS_ERROR, INVALID_REQUEST_ERROR, METHOD_NOT_FOUND_ERROR, PARSE_ERROR, RpcError,
@@ -16,7 +16,6 @@ use tokio_rustls::rustls;
 use ts_rs::TS;
 
 use crate::InvalidId;
-use crate::prelude::to_value;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, TryFromPrimitive)]
 #[repr(i32)]
@@ -42,11 +41,11 @@ pub enum ErrorKind {
     ParseUrl = 19,
     DiskNotAvailable = 20,
     BlockDevice = 21,
-    // InvalidOnionAddress = 22,
+    InvalidOnionAddress = 22,
     Pack = 23,
     ValidateS9pk = 24,
     DiskCorrupted = 25, // Remove
-    // Tor = 26,
+    Tor = 26,
     ConfigGen = 27,
     ParseNumber = 28,
     Database = 29,
@@ -126,11 +125,11 @@ impl ErrorKind {
             ParseUrl => t!("error.parse-url"),
             DiskNotAvailable => t!("error.disk-not-available"),
             BlockDevice => t!("error.block-device"),
-            // InvalidOnionAddress => t!("error.invalid-onion-address"),
+            InvalidOnionAddress => t!("error.invalid-onion-address"),
             Pack => t!("error.pack"),
             ValidateS9pk => t!("error.validate-s9pk"),
             DiskCorrupted => t!("error.disk-corrupted"), // Remove
-            // Tor => t!("error.tor"),
+            Tor => t!("error.tor"),
             ConfigGen => t!("error.config-gen"),
             ParseNumber => t!("error.parse-number"),
             Database => t!("error.database"),
@@ -184,8 +183,7 @@ impl ErrorKind {
             UpdateFailed => t!("error.update-failed"),
             Smtp => t!("error.smtp"),
             SetSysInfo => t!("error.set-sys-info"),
-        }
-        .to_string()
+        }.to_string()
     }
 }
 impl Display for ErrorKind {
@@ -198,7 +196,7 @@ pub struct Error {
     pub source: color_eyre::eyre::Error,
     pub debug: Option<color_eyre::eyre::Error>,
     pub kind: ErrorKind,
-    pub info: Value,
+    pub revision: Option<Revision>,
     pub task: Option<JoinHandle<()>>,
 }
 
@@ -229,7 +227,7 @@ impl Error {
             source: source.into(),
             debug,
             kind,
-            info: Value::Null,
+            revision: None,
             task: None,
         }
     }
@@ -238,7 +236,7 @@ impl Error {
             source: eyre!("{}", self.source),
             debug: self.debug.as_ref().map(|e| eyre!("{e}")),
             kind: self.kind,
-            info: self.info.clone(),
+            revision: self.revision.clone(),
             task: None,
         }
     }
@@ -246,10 +244,6 @@ impl Error {
         self.task = Some(task);
         self
     }
-    pub fn with_info(mut self, info: Value) -> Self {
-        self.info = info;
-        self
-    }
     pub async fn wait(mut self) -> Self {
         if let Some(task) = &mut self.task {
             task.await.log_err();
@@ -370,6 +364,17 @@ impl From<reqwest::Error> for Error {
         Error::new(e, kind)
     }
 }
+#[cfg(feature = "arti")]
+impl From<arti_client::Error> for Error {
+    fn from(e: arti_client::Error) -> Self {
+        Error::new(e, ErrorKind::Tor)
+    }
+}
+impl From<torut::control::ConnError> for Error {
+    fn from(e: torut::control::ConnError) -> Self {
+        Error::new(e, ErrorKind::Tor)
+    }
+}
 impl From<zbus::Error> for Error {
     fn from(e: zbus::Error) -> Self {
         Error::new(e, ErrorKind::DBus)
@@ -417,8 +422,6 @@ impl From<patch_db::value::Error> for Error {
 pub struct ErrorData {
     pub details: String,
     pub debug: String,
-    #[serde(default)]
-    pub info: Value,
 }
 impl Display for ErrorData {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
@@ -436,7 +439,6 @@ impl From<Error> for ErrorData {
         Self {
             details: value.to_string(),
             debug: format!("{:?}", value),
-            info: value.info,
         }
     }
 }
@@ -467,40 +469,47 @@ impl From<&RpcError> for ErrorData {
                         .or_else(|| d.as_str().map(|s| s.to_owned()))
                 })
                 .unwrap_or_else(|| value.message.clone().into_owned()),
-            info: to_value(
-                &value
-                    .data
-                    .as_ref()
-                    .and_then(|d| d.as_object().and_then(|d| d.get("info"))),
-            )
-            .unwrap_or_default(),
         }
     }
 }
 
 impl From<Error> for RpcError {
     fn from(e: Error) -> Self {
-        let kind = e.kind;
-        let data = ErrorData::from(e);
-        RpcError {
-            code: kind as i32,
-            message: kind.as_str().into(),
-            data: Some(match serde_json::to_value(&data) {
+        let mut data_object = serde_json::Map::with_capacity(3);
+        data_object.insert("details".to_owned(), format!("{}", e.source).into());
+        data_object.insert("debug".to_owned(), format!("{:?}", e.source).into());
+        data_object.insert(
+            "revision".to_owned(),
+            match serde_json::to_value(&e.revision) {
                 Ok(a) => a,
                 Err(e) => {
-                    tracing::warn!("Error serializing ErrorData object: {}", e);
+                    tracing::warn!("Error serializing revision for Error object: {}", e);
                     serde_json::Value::Null
                 }
-            }),
+            },
+        );
+        RpcError {
+            code: e.kind as i32,
+            message: e.kind.as_str().into(),
+            data: Some(
+                match serde_json::to_value(&ErrorData {
+                    details: format!("{}", e.source),
+                    debug: format!("{:?}", e.source),
+                }) {
+                    Ok(a) => a,
+                    Err(e) => {
+                        tracing::warn!("Error serializing revision for Error object: {}", e);
+                        serde_json::Value::Null
+                    }
+                },
+            ),
         }
     }
 }
 impl From<RpcError> for Error {
     fn from(e: RpcError) -> Self {
-        let data = ErrorData::from(&e);
-        let info = data.info.clone();
         Error::new(
-            data,
+            ErrorData::from(&e),
             if let Ok(kind) = e.code.try_into() {
                 kind
             } else if e.code == METHOD_NOT_FOUND_ERROR.code {
@@ -514,7 +523,6 @@ impl From<RpcError> for Error {
                 ErrorKind::Unknown
             },
         )
-        .with_info(info)
     }
 }
 
@@ -597,7 +605,7 @@ where
                 kind,
                 source,
                 debug,
-                info: Value::Null,
+                revision: None,
                 task: None,
             }
         })

core/src/hostname.rs

@@ -6,8 +6,7 @@ use tracing::instrument;
 
 use crate::util::Invoke;
 use crate::{Error, ErrorKind};
-#[derive(Clone, Debug, Default, serde::Deserialize, serde::Serialize, ts_rs::TS)]
-#[ts(type = "string")]
+#[derive(Clone, Debug, Default, serde::Deserialize, serde::Serialize)]
 pub struct Hostname(pub InternedString);
 
 lazy_static::lazy_static! {

core/src/init.rs

@@ -20,7 +20,7 @@ use crate::db::model::public::ServerStatus;
 use crate::developer::OS_DEVELOPER_KEY_PATH;
 use crate::hostname::Hostname;
 use crate::middleware::auth::local::LocalAuthContext;
-use crate::net::gateway::WildcardListener;
+use crate::net::gateway::UpgradableListener;
 use crate::net::net_controller::{NetController, NetService};
 use crate::net::socks::DEFAULT_SOCKS_LISTEN;
 use crate::net::utils::find_wifi_iface;
@@ -144,7 +144,7 @@ pub async fn run_script<P: AsRef<Path>>(path: P, mut progress: PhaseProgressTrac
 
 #[instrument(skip_all)]
 pub async fn init(
-    webserver: &WebServerAcceptorSetter<WildcardListener>,
+    webserver: &WebServerAcceptorSetter<UpgradableListener>,
     cfg: &ServerConfig,
     InitPhases {
         preinit,
@@ -218,7 +218,7 @@ pub async fn init(
         )
         .await?,
     );
-    webserver.send_modify(|wl| wl.set_ip_info(net_ctrl.net_iface.watcher.subscribe()));
+    webserver.try_upgrade(|a| net_ctrl.net_iface.watcher.upgrade_listener(a))?;
     let os_net_service = net_ctrl.os_bindings().await?;
     start_net.complete();
 

core/src/install/mod.rs

@@ -131,13 +131,9 @@ pub async fn install(
     let package: GetPackageResponse = from_value(
         ctx.call_remote_with::<RegistryContext, _>(
             "package.get",
-            [("get_device_info", Value::Bool(true))]
-                .into_iter()
-                .collect(),
             json!({
                 "id": id,
                 "targetVersion": VersionRange::exactly(version.deref().clone()),
-                "otherVersions": "none",
             }),
             RegistryUrlParams {
                 registry: registry.clone(),
@@ -177,7 +173,6 @@ pub async fn install(
 }
 
 #[derive(Deserialize, Serialize, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 pub struct SideloadParams {
     #[ts(skip)]
@@ -186,7 +181,6 @@ pub struct SideloadParams {
 }
 
 #[derive(Deserialize, Serialize, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 pub struct SideloadResponse {
     pub upload: Guid,
@@ -286,7 +280,6 @@ pub async fn sideload(
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct CancelInstallParams {
@@ -488,7 +481,7 @@ pub async fn cli_install(
             let mut packages: GetPackageResponse = from_value(
                 ctx.call_remote::<RegistryContext>(
                     "package.get",
-                    json!({ "id": &id, "targetVersion": version, "sourceVersion": source_version, "otherVersions": "none" }),
+                    json!({ "id": &id, "targetVersion": version, "sourceVersion": source_version }),
                 )
                 .await?,
             )?;
@@ -524,7 +517,6 @@ pub async fn cli_install(
 }
 
 #[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct UninstallParams {

core/src/lib.rs

@@ -540,10 +540,7 @@ pub fn package<C: Context>() -> ParentHandler<C> {
                 .with_about("about.execute-commands-container")
                 .no_cli(),
         )
-        .subcommand(
-            "attach",
-            from_fn_async_local(service::cli_attach).no_display(),
-        )
+        .subcommand("attach", from_fn_async(service::cli_attach).no_display())
         .subcommand(
             "host",
             net::host::host_api::<C>().with_about("about.manage-network-hosts-package"),

core/src/logs.rs

@@ -6,6 +6,7 @@ use std::str::FromStr;
 use std::time::{Duration, UNIX_EPOCH};
 
 use axum::extract::ws;
+use crate::util::net::WebSocket;
 use chrono::{DateTime, Utc};
 use clap::builder::ValueParserFactory;
 use clap::{Args, FromArgMatches, Parser};
@@ -24,14 +25,12 @@ use tokio::process::{Child, Command};
 use tokio_stream::wrappers::LinesStream;
 use tokio_tungstenite::tungstenite::Message;
 use tracing::instrument;
-use ts_rs::TS;
 
 use crate::PackageId;
 use crate::context::{CliContext, RpcContext};
 use crate::error::ResultExt;
 use crate::prelude::*;
 use crate::rpc_continuations::{Guid, RpcContinuation, RpcContinuations};
-use crate::util::net::WebSocket;
 use crate::util::serde::Reversible;
 use crate::util::{FromStrParser, Invoke};
 
@@ -110,28 +109,23 @@ async fn ws_handler(
     }
 }
 
-#[derive(serde::Serialize, serde::Deserialize, Debug, Clone, TS)]
-#[ts(export)]
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct LogResponse {
-    #[ts(as = "Vec<LogEntry>")]
     pub entries: Reversible<LogEntry>,
     start_cursor: Option<String>,
     end_cursor: Option<String>,
 }
-#[derive(serde::Serialize, serde::Deserialize, Debug, Clone, TS)]
-#[ts(export)]
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct LogFollowResponse {
     start_cursor: Option<String>,
     guid: Guid,
 }
 
-#[derive(serde::Serialize, serde::Deserialize, Debug, Clone, TS)]
-#[ts(export)]
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct LogEntry {
-    #[ts(type = "string")]
     timestamp: DateTime<Utc>,
     message: String,
     boot_id: String,
@@ -327,36 +321,21 @@ impl From<BootIdentifier> for String {
     }
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export, concrete(Extra = Empty), bound = "")]
+#[derive(Deserialize, Serialize, Parser)]
 #[serde(rename_all = "camelCase")]
 #[command(rename_all = "kebab-case")]
 pub struct LogsParams<Extra: FromArgMatches + Args = Empty> {
     #[command(flatten)]
     #[serde(flatten)]
-    #[ts(skip)]
     extra: Extra,
     #[arg(short = 'l', long = "limit", help = "help.arg.log-limit")]
-    #[ts(optional)]
     limit: Option<usize>,
-    #[arg(
-        short = 'c',
-        long = "cursor",
-        conflicts_with = "follow",
-        help = "help.arg.log-cursor"
-    )]
-    #[ts(optional)]
+    #[arg(short = 'c', long = "cursor", conflicts_with = "follow", help = "help.arg.log-cursor")]
     cursor: Option<String>,
     #[arg(short = 'b', long = "boot", help = "help.arg.log-boot")]
     #[serde(default)]
-    #[ts(optional, type = "number | string")]
     boot: Option<BootIdentifier>,
-    #[arg(
-        short = 'B',
-        long = "before",
-        conflicts_with = "follow",
-        help = "help.arg.log-before"
-    )]
+    #[arg(short = 'B', long = "before", conflicts_with = "follow", help = "help.arg.log-before")]
     #[serde(default)]
     before: bool,
 }
@@ -574,12 +553,10 @@ pub async fn journalctl(
             follow_cmd.arg("--lines=0");
         }
         let mut child = follow_cmd.stdout(Stdio::piped()).spawn()?;
-        let out = BufReader::new(child.stdout.take().ok_or_else(|| {
-            Error::new(
-                eyre!("{}", t!("logs.no-stdout-available")),
-                crate::ErrorKind::Journald,
-            )
-        })?);
+        let out =
+            BufReader::new(child.stdout.take().ok_or_else(|| {
+                Error::new(eyre!("{}", t!("logs.no-stdout-available")), crate::ErrorKind::Journald)
+            })?);
 
         let journalctl_entries = LinesStream::new(out.lines());
 
@@ -724,10 +701,7 @@ pub async fn follow_logs<Context: AsRef<RpcContinuations>>(
             RpcContinuation::ws(
                 move |socket| async move {
                     if let Err(e) = ws_handler(first_entry, stream, socket).await {
-                        tracing::error!(
-                            "{}",
-                            t!("logs.error-in-log-stream", error = e.to_string())
-                        );
+                        tracing::error!("{}", t!("logs.error-in-log-stream", error = e.to_string()));
                     }
                 },
                 Duration::from_secs(30),

core/src/middleware/auth/local.rs

@@ -40,10 +40,7 @@ impl LocalAuthContext for RpcContext {
 }
 
 fn unauthorized() -> Error {
-    Error::new(
-        eyre!("{}", t!("middleware.auth.unauthorized")),
-        crate::ErrorKind::Authorization,
-    )
+    Error::new(eyre!("{}", t!("middleware.auth.unauthorized")), crate::ErrorKind::Authorization)
 }
 
 async fn check_from_header<C: LocalAuthContext>(header: Option<&HeaderValue>) -> Result<(), Error> {

core/src/middleware/auth/session.rs

@@ -244,10 +244,7 @@ impl ValidSessionToken {
                     C::access_sessions(db)
                         .as_idx_mut(session_hash)
                         .ok_or_else(|| {
-                            Error::new(
-                                eyre!("{}", t!("middleware.auth.unauthorized")),
-                                crate::ErrorKind::Authorization,
-                            )
+                            Error::new(eyre!("{}", t!("middleware.auth.unauthorized")), crate::ErrorKind::Authorization)
                         })?
                         .mutate(|s| {
                             s.last_active = Utc::now();

core/src/middleware/auth/signature.rs

@@ -71,7 +71,7 @@ impl SignatureAuthContext for RpcContext {
                         .as_network()
                         .as_host()
                         .as_private_domains()
-                        .keys()
+                        .de()
                         .map(|k| k.into_iter())
                         .transpose(),
                 )
@@ -347,10 +347,6 @@ pub async fn call_remote<Ctx: SigningContext + AsRef<Client>>(
                 .with_kind(ErrorKind::Deserialization)?
                 .result
         }
-        _ => Err(Error::new(
-            eyre!("{}", t!("middleware.auth.unknown-content-type")),
-            ErrorKind::Network,
-        )
-        .into()),
+        _ => Err(Error::new(eyre!("{}", t!("middleware.auth.unknown-content-type")), ErrorKind::Network).into()),
     }
 }

core/src/middleware/db.rs

@@ -47,13 +47,7 @@ impl Middleware<RpcContext> for SyncDb {
         }
         .await
         {
-            tracing::error!(
-                "{}",
-                t!(
-                    "middleware.db.error-writing-patch-sequence-header",
-                    error = e
-                )
-            );
+            tracing::error!("{}", t!("middleware.db.error-writing-patch-sequence-header", error = e));
             tracing::debug!("{e:?}");
         }
     }

core/src/net/acme.rs

@@ -461,8 +461,7 @@ impl ValueParserFactory for AcmeProvider {
     }
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
+#[derive(Deserialize, Serialize, Parser)]
 pub struct InitAcmeParams {
     #[arg(long, help = "help.arg.acme-provider")]
     pub provider: AcmeProvider,
@@ -487,8 +486,7 @@ pub async fn init(
     Ok(())
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
+#[derive(Deserialize, Serialize, Parser)]
 pub struct RemoveAcmeParams {
     #[arg(long, help = "help.arg.acme-provider")]
     pub provider: AcmeProvider,

core/src/net/dns.rs

@@ -10,7 +10,7 @@ use color_eyre::eyre::eyre;
 use futures::{FutureExt, StreamExt, TryStreamExt};
 use hickory_server::authority::{AuthorityObject, Catalog, MessageResponseBuilder};
 use hickory_server::proto::op::{Header, ResponseCode};
-use hickory_server::proto::rr::{Name, Record, RecordType};
+use hickory_server::proto::rr::{LowerName, Name, Record, RecordType};
 use hickory_server::resolver::config::{ResolverConfig, ResolverOpts};
 use hickory_server::server::{Request, RequestHandler, ResponseHandler, ResponseInfo};
 use hickory_server::store::forwarder::{ForwardAuthority, ForwardConfig};
@@ -25,7 +25,6 @@ use serde::{Deserialize, Serialize};
 use tokio::net::{TcpListener, UdpSocket};
 use tokio::sync::RwLock;
 use tracing::instrument;
-use ts_rs::TS;
 
 use crate::context::{CliContext, RpcContext};
 use crate::db::model::Database;
@@ -94,8 +93,7 @@ pub fn dns_api<C: Context>() -> ParentHandler<C> {
         )
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
+#[derive(Deserialize, Serialize, Parser)]
 pub struct QueryDnsParams {
     #[arg(help = "help.arg.fqdn")]
     pub fqdn: InternedString,
@@ -135,8 +133,7 @@ pub fn query_dns<C: Context>(
         .map_err(Error::from)
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
+#[derive(Deserialize, Serialize, Parser)]
 pub struct SetStaticDnsParams {
     #[arg(help = "help.arg.dns-servers")]
     pub servers: Option<Vec<String>>,

core/src/net/forward.rs

@@ -3,11 +3,9 @@ use std::net::{IpAddr, SocketAddrV4};
 use std::sync::{Arc, Weak};
 use std::time::Duration;
 
-use ipnet::IpNet;
-
 use futures::channel::oneshot;
+use id_pool::IdPool;
 use iddqd::{IdOrdItem, IdOrdMap};
-use rand::Rng;
 use imbl::OrdMap;
 use rpc_toolkit::{Context, HandlerArgs, HandlerExt, ParentHandler, from_fn_async};
 use serde::{Deserialize, Serialize};
@@ -17,6 +15,7 @@ use tokio::sync::mpsc;
 use crate::GatewayId;
 use crate::context::{CliContext, RpcContext};
 use crate::db::model::public::NetworkInterfaceInfo;
+use crate::net::gateway::{DynInterfaceFilter, InterfaceFilter};
 use crate::prelude::*;
 use crate::util::Invoke;
 use crate::util::future::NonDetachingJoinHandle;
@@ -24,66 +23,25 @@ use crate::util::serde::{HandlerExtSerde, display_serializable};
 use crate::util::sync::Watch;
 
 pub const START9_BRIDGE_IFACE: &str = "lxcbr0";
-const EPHEMERAL_PORT_START: u16 = 49152;
-// vhost.rs:89 — not allowed: <=1024, >=32768, 5355, 5432, 9050, 6010, 9051, 5353
-const RESTRICTED_PORTS: &[u16] = &[5353, 5355, 5432, 6010, 9050, 9051];
-
-fn is_restricted(port: u16) -> bool {
-    port <= 1024 || RESTRICTED_PORTS.contains(&port)
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
-pub struct ForwardRequirements {
-    pub public_gateways: BTreeSet<GatewayId>,
-    pub private_ips: BTreeSet<IpAddr>,
-    pub secure: bool,
-}
-
-impl std::fmt::Display for ForwardRequirements {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(
-            f,
-            "ForwardRequirements {{ public: {:?}, private: {:?}, secure: {} }}",
-            self.public_gateways, self.private_ips, self.secure
-        )
-    }
-}
+pub const FIRST_DYNAMIC_PRIVATE_PORT: u16 = 49152;
 
 #[derive(Debug, Deserialize, Serialize)]
-pub struct AvailablePorts(BTreeMap<u16, bool>);
+pub struct AvailablePorts(IdPool);
 impl AvailablePorts {
     pub fn new() -> Self {
-        Self(BTreeMap::new())
+        Self(IdPool::new_ranged(FIRST_DYNAMIC_PRIVATE_PORT..u16::MAX))
     }
-    pub fn alloc(&mut self, ssl: bool) -> Result<u16, Error> {
-        let mut rng = rand::rng();
-        for _ in 0..1000 {
-            let port = rng.random_range(EPHEMERAL_PORT_START..u16::MAX);
-            if !self.0.contains_key(&port) {
-                self.0.insert(port, ssl);
-                return Ok(port);
-            }
-        }
-        Err(Error::new(
-            eyre!("{}", t!("net.forward.no-dynamic-ports-available")),
-            ErrorKind::Network,
-        ))
-    }
-    /// Try to allocate a specific port. Returns Some(port) if available, None if taken/restricted.
-    pub fn try_alloc(&mut self, port: u16, ssl: bool) -> Option<u16> {
-        if is_restricted(port) || self.0.contains_key(&port) {
-            return None;
-        }
-        self.0.insert(port, ssl);
-        Some(port)
-    }
-    /// Returns whether a given allocated port is SSL.
-    pub fn is_ssl(&self, port: u16) -> bool {
-        self.0.get(&port).copied().unwrap_or(false)
+    pub fn alloc(&mut self) -> Result<u16, Error> {
+        self.0.request_id().ok_or_else(|| {
+            Error::new(
+                eyre!("{}", t!("net.forward.no-dynamic-ports-available")),
+                ErrorKind::Network,
+            )
+        })
     }
     pub fn free(&mut self, ports: impl IntoIterator<Item = u16>) {
         for port in ports {
-            self.0.remove(&port);
+            self.0.return_id(port).unwrap_or_default();
         }
     }
 }
@@ -103,10 +61,10 @@ pub fn forward_api<C: Context>() -> ParentHandler<C> {
             }
 
             let mut table = Table::new();
-            table.add_row(row![bc => "FROM", "TO", "REQS"]);
+            table.add_row(row![bc => "FROM", "TO", "FILTER"]);
 
             for (external, target) in res.0 {
-                table.add_row(row![external, target.target, target.reqs]);
+                table.add_row(row![external, target.target, target.filter]);
             }
 
             table.print_tty(false)?;
@@ -121,7 +79,6 @@ struct ForwardMapping {
     source: SocketAddrV4,
     target: SocketAddrV4,
     target_prefix: u8,
-    src_filter: Option<IpNet>,
     rc: Weak<()>,
 }
 
@@ -136,10 +93,9 @@ impl PortForwardState {
         source: SocketAddrV4,
         target: SocketAddrV4,
         target_prefix: u8,
-        src_filter: Option<IpNet>,
     ) -> Result<Arc<()>, Error> {
         if let Some(existing) = self.mappings.get_mut(&source) {
-            if existing.target == target && existing.src_filter == src_filter {
+            if existing.target == target {
                 if let Some(existing_rc) = existing.rc.upgrade() {
                     return Ok(existing_rc);
                 } else {
@@ -148,28 +104,21 @@ impl PortForwardState {
                     return Ok(rc);
                 }
             } else {
-                // Different target or src_filter, need to remove old and add new
+                // Different target, need to remove old and add new
                 if let Some(mapping) = self.mappings.remove(&source) {
-                    unforward(
-                        mapping.source,
-                        mapping.target,
-                        mapping.target_prefix,
-                        mapping.src_filter.as_ref(),
-                    )
-                    .await?;
+                    unforward(mapping.source, mapping.target, mapping.target_prefix).await?;
                 }
             }
         }
 
         let rc = Arc::new(());
-        forward(source, target, target_prefix, src_filter.as_ref()).await?;
+        forward(source, target, target_prefix).await?;
         self.mappings.insert(
             source,
             ForwardMapping {
                 source,
                 target,
                 target_prefix,
-                src_filter,
                 rc: Arc::downgrade(&rc),
             },
         );
@@ -187,13 +136,7 @@ impl PortForwardState {
 
         for source in to_remove {
             if let Some(mapping) = self.mappings.remove(&source) {
-                unforward(
-                    mapping.source,
-                    mapping.target,
-                    mapping.target_prefix,
-                    mapping.src_filter.as_ref(),
-                )
-                .await?;
+                unforward(mapping.source, mapping.target, mapping.target_prefix).await?;
             }
         }
         Ok(())
@@ -214,14 +157,9 @@ impl Drop for PortForwardState {
             let mappings = std::mem::take(&mut self.mappings);
             tokio::spawn(async move {
                 for (_, mapping) in mappings {
-                    unforward(
-                        mapping.source,
-                        mapping.target,
-                        mapping.target_prefix,
-                        mapping.src_filter.as_ref(),
-                    )
-                    .await
-                    .log_err();
+                    unforward(mapping.source, mapping.target, mapping.target_prefix)
+                        .await
+                        .log_err();
                 }
             });
         }
@@ -233,7 +171,6 @@ enum PortForwardCommand {
         source: SocketAddrV4,
         target: SocketAddrV4,
         target_prefix: u8,
-        src_filter: Option<IpNet>,
         respond: oneshot::Sender<Result<Arc<()>, Error>>,
     },
     Gc {
@@ -303,13 +240,7 @@ impl PortForwardController {
             }
             .await
             {
-                tracing::error!(
-                    "{}",
-                    t!(
-                        "net.forward.error-initializing-controller",
-                        error = format!("{e:#}")
-                    )
-                );
+                tracing::error!("{}", t!("net.forward.error-initializing-controller", error = format!("{e:#}")));
                 tracing::debug!("{e:?}");
                 tokio::time::sleep(Duration::from_secs(5)).await;
             }
@@ -320,12 +251,9 @@ impl PortForwardController {
                         source,
                         target,
                         target_prefix,
-                        src_filter,
                         respond,
                     } => {
-                        let result = state
-                            .add_forward(source, target, target_prefix, src_filter)
-                            .await;
+                        let result = state.add_forward(source, target, target_prefix).await;
                         respond.send(result).ok();
                     }
                     PortForwardCommand::Gc { respond } => {
@@ -350,7 +278,6 @@ impl PortForwardController {
         source: SocketAddrV4,
         target: SocketAddrV4,
         target_prefix: u8,
-        src_filter: Option<IpNet>,
     ) -> Result<Arc<()>, Error> {
         let (send, recv) = oneshot::channel();
         self.req
@@ -358,7 +285,6 @@ impl PortForwardController {
                 source,
                 target,
                 target_prefix,
-                src_filter,
                 respond: send,
             })
             .map_err(err_has_exited)?;
@@ -389,14 +315,14 @@ struct InterfaceForwardRequest {
     external: u16,
     target: SocketAddrV4,
     target_prefix: u8,
-    reqs: ForwardRequirements,
+    filter: DynInterfaceFilter,
     rc: Arc<()>,
 }
 
 #[derive(Clone)]
 struct InterfaceForwardEntry {
     external: u16,
-    targets: BTreeMap<ForwardRequirements, (SocketAddrV4, u8, Weak<()>)>,
+    filter: BTreeMap<DynInterfaceFilter, (SocketAddrV4, u8, Weak<()>)>,
     // Maps source SocketAddr -> strong reference for the forward created in PortForwardController
     forwards: BTreeMap<SocketAddrV4, Arc<()>>,
 }
@@ -414,7 +340,7 @@ impl InterfaceForwardEntry {
     fn new(external: u16) -> Self {
         Self {
             external,
-            targets: BTreeMap::new(),
+            filter: BTreeMap::new(),
             forwards: BTreeMap::new(),
         }
     }
@@ -426,38 +352,28 @@ impl InterfaceForwardEntry {
     ) -> Result<(), Error> {
         let mut keep = BTreeSet::<SocketAddrV4>::new();
 
-        for (gw_id, info) in ip_info.iter() {
-            if let Some(ip_info) = &info.ip_info {
-                for subnet in ip_info.subnets.iter() {
-                    if let IpAddr::V4(ip) = subnet.addr() {
-                        let addr = SocketAddrV4::new(ip, self.external);
-                        if keep.contains(&addr) {
-                            continue;
+        for (iface, info) in ip_info.iter() {
+            if let Some((target, target_prefix)) = self
+                .filter
+                .iter()
+                .filter(|(_, (_, _, rc))| rc.strong_count() > 0)
+                .find(|(filter, _)| filter.filter(iface, info))
+                .map(|(_, (target, target_prefix, _))| (*target, *target_prefix))
+            {
+                if let Some(ip_info) = &info.ip_info {
+                    for addr in ip_info.subnets.iter().filter_map(|net| {
+                        if let IpAddr::V4(ip) = net.addr() {
+                            Some(SocketAddrV4::new(ip, self.external))
+                        } else {
+                            None
                         }
-
-                        for (reqs, (target, target_prefix, rc)) in self.targets.iter() {
-                            if rc.strong_count() == 0 {
-                                continue;
-                            }
-                            if !reqs.secure && !info.secure() {
-                                continue;
-                            }
-
-                            let src_filter =
-                                if reqs.public_gateways.contains(gw_id) {
-                                    None
-                                } else if reqs.private_ips.contains(&IpAddr::V4(ip)) {
-                                    Some(subnet.trunc())
-                                } else {
-                                    continue;
-                                };
-
-                            keep.insert(addr);
-                            let fwd_rc = port_forward
-                                .add_forward(addr, *target, *target_prefix, src_filter)
+                    }) {
+                        keep.insert(addr);
+                        if !self.forwards.contains_key(&addr) {
+                            let rc = port_forward
+                                .add_forward(addr, target, target_prefix)
                                 .await?;
-                            self.forwards.insert(addr, fwd_rc);
-                            break;
+                            self.forwards.insert(addr, rc);
                         }
                     }
                 }
@@ -476,7 +392,7 @@ impl InterfaceForwardEntry {
             external,
             target,
             target_prefix,
-            reqs,
+            filter,
             mut rc,
         }: InterfaceForwardRequest,
         ip_info: &OrdMap<GatewayId, NetworkInterfaceInfo>,
@@ -490,8 +406,8 @@ impl InterfaceForwardEntry {
         }
 
         let entry = self
-            .targets
-            .entry(reqs)
+            .filter
+            .entry(filter)
             .or_insert_with(|| (target, target_prefix, Arc::downgrade(&rc)));
         if entry.0 != target {
             entry.0 = target;
@@ -514,7 +430,7 @@ impl InterfaceForwardEntry {
         ip_info: &OrdMap<GatewayId, NetworkInterfaceInfo>,
         port_forward: &PortForwardController,
     ) -> Result<(), Error> {
-        self.targets.retain(|_, (_, _, rc)| rc.strong_count() > 0);
+        self.filter.retain(|_, (_, _, rc)| rc.strong_count() > 0);
 
         self.update(ip_info, port_forward).await
     }
@@ -573,7 +489,7 @@ pub struct ForwardTable(pub BTreeMap<u16, ForwardTarget>);
 pub struct ForwardTarget {
     pub target: SocketAddrV4,
     pub target_prefix: u8,
-    pub reqs: String,
+    pub filter: String,
 }
 
 impl From<&InterfaceForwardState> for ForwardTable {
@@ -584,16 +500,16 @@ impl From<&InterfaceForwardState> for ForwardTable {
                 .iter()
                 .flat_map(|entry| {
                     entry
-                        .targets
+                        .filter
                         .iter()
                         .filter(|(_, (_, _, rc))| rc.strong_count() > 0)
-                        .map(|(reqs, (target, target_prefix, _))| {
+                        .map(|(filter, (target, target_prefix, _))| {
                             (
                                 entry.external,
                                 ForwardTarget {
                                     target: *target,
                                     target_prefix: *target_prefix,
-                                    reqs: format!("{reqs}"),
+                                    filter: format!("{:#?}", filter),
                                 },
                             )
                         })
@@ -612,6 +528,16 @@ enum InterfaceForwardCommand {
     DumpTable(oneshot::Sender<ForwardTable>),
 }
 
+#[test]
+fn test() {
+    use crate::net::gateway::SecureFilter;
+
+    assert_ne!(
+        false.into_dyn(),
+        SecureFilter { secure: false }.into_dyn().into_dyn()
+    );
+}
+
 pub struct InterfacePortForwardController {
     req: mpsc::UnboundedSender<InterfaceForwardCommand>,
     _thread: NonDetachingJoinHandle<()>,
@@ -661,7 +587,7 @@ impl InterfacePortForwardController {
     pub async fn add(
         &self,
         external: u16,
-        reqs: ForwardRequirements,
+        filter: DynInterfaceFilter,
         target: SocketAddrV4,
         target_prefix: u8,
     ) -> Result<Arc<()>, Error> {
@@ -673,7 +599,7 @@ impl InterfacePortForwardController {
                     external,
                     target,
                     target_prefix,
-                    reqs,
+                    filter,
                     rc,
                 },
                 send,
@@ -705,18 +631,15 @@ async fn forward(
     source: SocketAddrV4,
     target: SocketAddrV4,
     target_prefix: u8,
-    src_filter: Option<&IpNet>,
 ) -> Result<(), Error> {
-    let mut cmd = Command::new("/usr/lib/startos/scripts/forward-port");
-    cmd.env("sip", source.ip().to_string())
+    Command::new("/usr/lib/startos/scripts/forward-port")
+        .env("sip", source.ip().to_string())
         .env("dip", target.ip().to_string())
         .env("dprefix", target_prefix.to_string())
         .env("sport", source.port().to_string())
-        .env("dport", target.port().to_string());
-    if let Some(subnet) = src_filter {
-        cmd.env("src_subnet", subnet.to_string());
-    }
-    cmd.invoke(ErrorKind::Network).await?;
+        .env("dport", target.port().to_string())
+        .invoke(ErrorKind::Network)
+        .await?;
     Ok(())
 }
 
@@ -724,18 +647,15 @@ async fn unforward(
     source: SocketAddrV4,
     target: SocketAddrV4,
     target_prefix: u8,
-    src_filter: Option<&IpNet>,
 ) -> Result<(), Error> {
-    let mut cmd = Command::new("/usr/lib/startos/scripts/forward-port");
-    cmd.env("UNDO", "1")
+    Command::new("/usr/lib/startos/scripts/forward-port")
+        .env("UNDO", "1")
         .env("sip", source.ip().to_string())
         .env("dip", target.ip().to_string())
         .env("dprefix", target_prefix.to_string())
         .env("sport", source.port().to_string())
-        .env("dport", target.port().to_string());
-    if let Some(subnet) = src_filter {
-        cmd.env("src_subnet", subnet.to_string());
-    }
-    cmd.invoke(ErrorKind::Network).await?;
+        .env("dport", target.port().to_string())
+        .invoke(ErrorKind::Network)
+        .await?;
     Ok(())
 }

core/src/net/host/address.rs

@@ -10,29 +10,46 @@ use ts_rs::TS;
 use crate::GatewayId;
 use crate::context::{CliContext, RpcContext};
 use crate::db::model::DatabaseModel;
-use crate::hostname::Hostname;
 use crate::net::acme::AcmeProvider;
 use crate::net::host::{HostApiKind, all_hosts};
+use crate::net::tor::OnionAddress;
 use crate::prelude::*;
 use crate::util::serde::{HandlerExtSerde, display_serializable};
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct HostAddress {
-    pub address: InternedString,
-    pub public: Option<PublicDomainConfig>,
-    pub private: Option<BTreeSet<GatewayId>>,
+#[serde(rename_all = "kebab-case")]
+#[serde(rename_all_fields = "camelCase")]
+#[serde(tag = "kind")]
+pub enum HostAddress {
+    Onion {
+        address: OnionAddress,
+    },
+    Domain {
+        address: InternedString,
+        public: Option<PublicDomainConfig>,
+        private: bool,
+    },
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, TS)]
-#[ts(export)]
 pub struct PublicDomainConfig {
     pub gateway: GatewayId,
     pub acme: Option<AcmeProvider>,
 }
 
 fn handle_duplicates(db: &mut DatabaseModel) -> Result<(), Error> {
+    let mut onions = BTreeSet::<OnionAddress>::new();
     let mut domains = BTreeSet::<InternedString>::new();
+    let check_onion = |onions: &mut BTreeSet<OnionAddress>, onion: OnionAddress| {
+        if onions.contains(&onion) {
+            return Err(Error::new(
+                eyre!("onion address {onion} is already in use"),
+                ErrorKind::InvalidRequest,
+            ));
+        }
+        onions.insert(onion);
+        Ok(())
+    };
     let check_domain = |domains: &mut BTreeSet<InternedString>, domain: InternedString| {
         if domains.contains(&domain) {
             return Err(Error::new(
@@ -51,27 +68,35 @@ fn handle_duplicates(db: &mut DatabaseModel) -> Result<(), Error> {
             not_in_use.push(host);
             continue;
         }
+        for onion in host.as_onions().de()? {
+            check_onion(&mut onions, onion)?;
+        }
         let public = host.as_public_domains().keys()?;
         for domain in &public {
             check_domain(&mut domains, domain.clone())?;
         }
-        for domain in host.as_private_domains().keys()? {
+        for domain in host.as_private_domains().de()? {
             if !public.contains(&domain) {
                 check_domain(&mut domains, domain)?;
             }
         }
     }
     for host in not_in_use {
+        host.as_onions_mut()
+            .mutate(|o| Ok(o.retain(|o| !onions.contains(o))))?;
         host.as_public_domains_mut()
             .mutate(|d| Ok(d.retain(|d, _| !domains.contains(d))))?;
         host.as_private_domains_mut()
-            .mutate(|d| Ok(d.retain(|d, _| !domains.contains(d))))?;
+            .mutate(|d| Ok(d.retain(|d| !domains.contains(d))))?;
 
+        for onion in host.as_onions().de()? {
+            check_onion(&mut onions, onion)?;
+        }
         let public = host.as_public_domains().keys()?;
         for domain in &public {
             check_domain(&mut domains, domain.clone())?;
         }
-        for domain in host.as_private_domains().keys()? {
+        for domain in host.as_private_domains().de()? {
             if !public.contains(&domain) {
                 check_domain(&mut domains, domain)?;
             }
@@ -134,6 +159,29 @@ pub fn address_api<C: Context, Kind: HostApiKind>()
                 )
                 .with_inherited(Kind::inheritance),
         )
+        .subcommand(
+            "onion",
+            ParentHandler::<C, Empty, Kind::Inheritance>::new()
+                .subcommand(
+                    "add",
+                    from_fn_async(add_onion::<Kind>)
+                        .with_metadata("sync_db", Value::Bool(true))
+                        .with_inherited(|_, a| a)
+                        .no_display()
+                        .with_about("about.add-address-to-host")
+                        .with_call_remote::<CliContext>(),
+                )
+                .subcommand(
+                    "remove",
+                    from_fn_async(remove_onion::<Kind>)
+                        .with_metadata("sync_db", Value::Bool(true))
+                        .with_inherited(|_, a| a)
+                        .no_display()
+                        .with_about("about.remove-address-from-host")
+                        .with_call_remote::<CliContext>(),
+                )
+                .with_inherited(Kind::inheritance),
+        )
         .subcommand(
             "list",
             from_fn_async(list_addresses::<Kind>)
@@ -148,7 +196,35 @@ pub fn address_api<C: Context, Kind: HostApiKind>()
                     }
 
                     let mut table = Table::new();
-                    todo!("find a good way to represent this");
+                    table.add_row(row![bc => "ADDRESS", "PUBLIC", "ACME PROVIDER"]);
+                    for address in &res {
+                        match address {
+                            HostAddress::Onion { address } => {
+                                table.add_row(row![address, true, "N/A"]);
+                            }
+                            HostAddress::Domain {
+                                address,
+                                public: Some(PublicDomainConfig { gateway, acme }),
+                                private,
+                            } => {
+                                table.add_row(row![
+                                    address,
+                                    &format!(
+                                        "{} ({gateway})",
+                                        if *private { "YES" } else { "ONLY" }
+                                    ),
+                                    acme.as_ref().map(|a| a.0.as_str()).unwrap_or("NONE")
+                                ]);
+                            }
+                            HostAddress::Domain {
+                                address,
+                                public: None,
+                                ..
+                            } => {
+                                table.add_row(row![address, &format!("NO"), "N/A"]);
+                            }
+                        }
+                    }
 
                     table.print_tty(false)?;
 
@@ -159,8 +235,7 @@ pub fn address_api<C: Context, Kind: HostApiKind>()
         )
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
+#[derive(Deserialize, Serialize, Parser)]
 pub struct AddPublicDomainParams {
     #[arg(help = "help.arg.fqdn")]
     pub fqdn: InternedString,
@@ -196,11 +271,7 @@ pub async fn add_public_domain<Kind: HostApiKind>(
             Kind::host_for(&inheritance, db)?
                 .as_public_domains_mut()
                 .insert(&fqdn, &PublicDomainConfig { acme, gateway })?;
-            handle_duplicates(db)?;
-            let hostname = Hostname(db.as_public().as_server_info().as_hostname().de()?);
-            let gateways = db.as_public().as_server_info().as_network().as_gateways().de()?;
-            let ports = db.as_private().as_available_ports().de()?;
-            Kind::host_for(&inheritance, db)?.update_addresses(&hostname, &gateways, &ports)
+            handle_duplicates(db)
         })
         .await
         .result?;
@@ -213,8 +284,7 @@ pub async fn add_public_domain<Kind: HostApiKind>(
     .with_kind(ErrorKind::Unknown)?
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
+#[derive(Deserialize, Serialize, Parser)]
 pub struct RemoveDomainParams {
     #[arg(help = "help.arg.fqdn")]
     pub fqdn: InternedString,
@@ -229,11 +299,7 @@ pub async fn remove_public_domain<Kind: HostApiKind>(
         .mutate(|db| {
             Kind::host_for(&inheritance, db)?
                 .as_public_domains_mut()
-                .remove(&fqdn)?;
-            let hostname = Hostname(db.as_public().as_server_info().as_hostname().de()?);
-            let gateways = db.as_public().as_server_info().as_network().as_gateways().de()?;
-            let ports = db.as_private().as_available_ports().de()?;
-            Kind::host_for(&inheritance, db)?.update_addresses(&hostname, &gateways, &ports)
+                .remove(&fqdn)
         })
         .await
         .result?;
@@ -242,30 +308,23 @@ pub async fn remove_public_domain<Kind: HostApiKind>(
     Ok(())
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[ts(export)]
+#[derive(Deserialize, Serialize, Parser)]
 pub struct AddPrivateDomainParams {
     #[arg(help = "help.arg.fqdn")]
     pub fqdn: InternedString,
-    pub gateway: GatewayId,
 }
 
 pub async fn add_private_domain<Kind: HostApiKind>(
     ctx: RpcContext,
-    AddPrivateDomainParams { fqdn, gateway }: AddPrivateDomainParams,
+    AddPrivateDomainParams { fqdn }: AddPrivateDomainParams,
     inheritance: Kind::Inheritance,
 ) -> Result<(), Error> {
     ctx.db
         .mutate(|db| {
             Kind::host_for(&inheritance, db)?
                 .as_private_domains_mut()
-                .upsert(&fqdn, || Ok(BTreeSet::new()))?
-                .mutate(|d| Ok(d.insert(gateway)))?;
-            handle_duplicates(db)?;
-            let hostname = Hostname(db.as_public().as_server_info().as_hostname().de()?);
-            let gateways = db.as_public().as_server_info().as_network().as_gateways().de()?;
-            let ports = db.as_private().as_available_ports().de()?;
-            Kind::host_for(&inheritance, db)?.update_addresses(&hostname, &gateways, &ports)
+                .mutate(|d| Ok(d.insert(fqdn)))?;
+            handle_duplicates(db)
         })
         .await
         .result?;
@@ -283,11 +342,7 @@ pub async fn remove_private_domain<Kind: HostApiKind>(
         .mutate(|db| {
             Kind::host_for(&inheritance, db)?
                 .as_private_domains_mut()
-                .mutate(|d| Ok(d.remove(&domain)))?;
-            let hostname = Hostname(db.as_public().as_server_info().as_hostname().de()?);
-            let gateways = db.as_public().as_server_info().as_network().as_gateways().de()?;
-            let ports = db.as_private().as_available_ports().de()?;
-            Kind::host_for(&inheritance, db)?.update_addresses(&hostname, &gateways, &ports)
+                .mutate(|d| Ok(d.remove(&domain)))
         })
         .await
         .result?;
@@ -296,6 +351,55 @@ pub async fn remove_private_domain<Kind: HostApiKind>(
     Ok(())
 }
 
+#[derive(Deserialize, Serialize, Parser)]
+pub struct OnionParams {
+    #[arg(help = "help.arg.onion-address")]
+    pub onion: String,
+}
+
+pub async fn add_onion<Kind: HostApiKind>(
+    ctx: RpcContext,
+    OnionParams { onion }: OnionParams,
+    inheritance: Kind::Inheritance,
+) -> Result<(), Error> {
+    let onion = onion.parse::<OnionAddress>()?;
+    ctx.db
+        .mutate(|db| {
+            db.as_private().as_key_store().as_onion().get_key(&onion)?;
+
+            Kind::host_for(&inheritance, db)?
+                .as_onions_mut()
+                .mutate(|a| Ok(a.insert(onion)))?;
+            handle_duplicates(db)
+        })
+        .await
+        .result?;
+
+    Kind::sync_host(&ctx, inheritance).await?;
+
+    Ok(())
+}
+
+pub async fn remove_onion<Kind: HostApiKind>(
+    ctx: RpcContext,
+    OnionParams { onion }: OnionParams,
+    inheritance: Kind::Inheritance,
+) -> Result<(), Error> {
+    let onion = onion.parse::<OnionAddress>()?;
+    ctx.db
+        .mutate(|db| {
+            Kind::host_for(&inheritance, db)?
+                .as_onions_mut()
+                .mutate(|a| Ok(a.remove(&onion)))
+        })
+        .await
+        .result?;
+
+    Kind::sync_host(&ctx, inheritance).await?;
+
+    Ok(())
+}
+
 pub async fn list_addresses<Kind: HostApiKind>(
     ctx: RpcContext,
     _: Empty,

core/src/net/host/binding.rs

@@ -1,23 +1,23 @@
 use std::collections::{BTreeMap, BTreeSet};
-use std::net::SocketAddr;
 use std::str::FromStr;
 
 use clap::Parser;
 use clap::builder::ValueParserFactory;
+use imbl::OrdSet;
 use rpc_toolkit::{Context, Empty, HandlerArgs, HandlerExt, ParentHandler, from_fn_async};
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
 
-use crate::HostId;
 use crate::context::{CliContext, RpcContext};
-use crate::db::prelude::Map;
+use crate::db::model::public::NetworkInterfaceInfo;
 use crate::net::forward::AvailablePorts;
+use crate::net::gateway::InterfaceFilter;
 use crate::net::host::HostApiKind;
-use crate::net::service_interface::HostnameInfo;
 use crate::net::vhost::AlpnInfo;
 use crate::prelude::*;
 use crate::util::FromStrParser;
 use crate::util::serde::{HandlerExtSerde, display_serializable};
+use crate::{GatewayId, HostId};
 
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize, TS)]
 #[ts(export)]
@@ -45,87 +45,25 @@ impl FromStr for BindId {
     }
 }
 
-#[derive(Debug, Default, Clone, Deserialize, Serialize, TS, HasModel)]
+#[derive(Debug, Deserialize, Serialize, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export)]
-#[model = "Model<Self>"]
-pub struct DerivedAddressInfo {
-    /// User override: enable these addresses (only for public IP & port)
-    pub enabled: BTreeSet<SocketAddr>,
-    /// User override: disable these addresses (only for domains and private IP & port)
-    pub disabled: BTreeSet<(InternedString, u16)>,
-    /// COMPUTED: NetServiceData::update — all possible addresses for this binding
-    pub available: BTreeSet<HostnameInfo>,
-}
-
-impl DerivedAddressInfo {
-    /// Returns addresses that are currently enabled after applying overrides.
-    /// Default: public IPs are disabled, everything else is enabled.
-    /// Explicit `enabled`/`disabled` overrides take precedence.
-    pub fn enabled(&self) -> BTreeSet<&HostnameInfo> {
-        self.available
-            .iter()
-            .filter(|h| {
-                if h.public && h.metadata.is_ip() {
-                    // Public IPs: disabled by default, explicitly enabled via SocketAddr
-                    h.to_socket_addr().map_or(
-                        true, // should never happen, but would rather see them if it does
-                        |sa| self.enabled.contains(&sa),
-                    )
-                } else {
-                    !self
-                        .disabled
-                        .contains(&(h.host.clone(), h.port.unwrap_or_default())) // disablable addresses will always have a port
-                }
-            })
-            .collect()
-    }
-}
-
-#[derive(Debug, Default, Deserialize, Serialize, HasModel, TS)]
-#[model = "Model<Self>"]
-#[ts(export)]
-pub struct Bindings(pub BTreeMap<u16, BindInfo>);
-
-impl Map for Bindings {
-    type Key = u16;
-    type Value = BindInfo;
-    fn key_str(key: &Self::Key) -> Result<impl AsRef<str>, Error> {
-        Self::key_string(key)
-    }
-    fn key_string(key: &Self::Key) -> Result<InternedString, Error> {
-        Ok(InternedString::from_display(key))
-    }
-}
-
-impl std::ops::Deref for Bindings {
-    type Target = BTreeMap<u16, BindInfo>;
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl std::ops::DerefMut for Bindings {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        &mut self.0
-    }
-}
-
-#[derive(Debug, Deserialize, Serialize, HasModel, TS)]
-#[serde(rename_all = "camelCase")]
-#[model = "Model<Self>"]
-#[ts(export)]
 pub struct BindInfo {
     pub enabled: bool,
     pub options: BindOptions,
     pub net: NetInfo,
-    pub addresses: DerivedAddressInfo,
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize, TS, PartialEq, Eq, PartialOrd, Ord)]
 #[serde(rename_all = "camelCase")]
 #[ts(export)]
 pub struct NetInfo {
+    #[ts(as = "BTreeSet::<GatewayId>")]
+    #[serde(default)]
+    pub private_disabled: OrdSet<GatewayId>,
+    #[ts(as = "BTreeSet::<GatewayId>")]
+    #[serde(default)]
+    pub public_enabled: OrdSet<GatewayId>,
     pub assigned_port: Option<u16>,
     pub assigned_ssl_port: Option<u16>,
 }
@@ -133,28 +71,25 @@ impl BindInfo {
     pub fn new(available_ports: &mut AvailablePorts, options: BindOptions) -> Result<Self, Error> {
         let mut assigned_port = None;
         let mut assigned_ssl_port = None;
-        if let Some(ssl) = &options.add_ssl {
-            assigned_ssl_port = available_ports
-                .try_alloc(ssl.preferred_external_port, true)
-                .or_else(|| Some(available_ports.alloc(true).ok()?));
+        if options.add_ssl.is_some() {
+            assigned_ssl_port = Some(available_ports.alloc()?);
         }
         if options
             .secure
             .map_or(true, |s| !(s.ssl && options.add_ssl.is_some()))
         {
-            assigned_port = available_ports
-                .try_alloc(options.preferred_external_port, false)
-                .or_else(|| Some(available_ports.alloc(false).ok()?));
+            assigned_port = Some(available_ports.alloc()?);
         }
 
         Ok(Self {
             enabled: true,
             options,
             net: NetInfo {
+                private_disabled: OrdSet::new(),
+                public_enabled: OrdSet::new(),
                 assigned_port,
                 assigned_ssl_port,
             },
-            addresses: DerivedAddressInfo::default(),
         })
     }
     pub fn update(
@@ -162,11 +97,7 @@ impl BindInfo {
         available_ports: &mut AvailablePorts,
         options: BindOptions,
     ) -> Result<Self, Error> {
-        let Self {
-            net: mut lan,
-            addresses,
-            ..
-        } = self;
+        let Self { net: mut lan, .. } = self;
         if options
             .secure
             .map_or(true, |s| !(s.ssl && options.add_ssl.is_some()))
@@ -174,26 +105,19 @@ impl BindInfo {
         {
             lan.assigned_port = if let Some(port) = lan.assigned_port.take() {
                 Some(port)
-            } else if let Some(port) =
-                available_ports.try_alloc(options.preferred_external_port, false)
-            {
-                Some(port)
             } else {
-                Some(available_ports.alloc(false)?)
+                Some(available_ports.alloc()?)
             };
         } else {
             if let Some(port) = lan.assigned_port.take() {
                 available_ports.free([port]);
             }
         }
-        if let Some(ssl) = &options.add_ssl {
+        if options.add_ssl.is_some() {
             lan.assigned_ssl_port = if let Some(port) = lan.assigned_ssl_port.take() {
                 Some(port)
-            } else if let Some(port) = available_ports.try_alloc(ssl.preferred_external_port, true)
-            {
-                Some(port)
             } else {
-                Some(available_ports.alloc(true)?)
+                Some(available_ports.alloc()?)
             };
         } else {
             if let Some(port) = lan.assigned_ssl_port.take() {
@@ -204,17 +128,22 @@ impl BindInfo {
             enabled: true,
             options,
             net: lan,
-            addresses: DerivedAddressInfo {
-                enabled: addresses.enabled,
-                disabled: addresses.disabled,
-                available: BTreeSet::new(),
-            },
         })
     }
     pub fn disable(&mut self) {
         self.enabled = false;
     }
 }
+impl InterfaceFilter for NetInfo {
+    fn filter(&self, id: &GatewayId, info: &NetworkInterfaceInfo) -> bool {
+        info.ip_info.is_some()
+            && if info.public() {
+                self.public_enabled.contains(id)
+            } else {
+                !self.private_disabled.contains(id)
+            }
+    }
+}
 
 #[derive(Debug, Clone, Copy, serde::Serialize, serde::Deserialize, TS)]
 #[ts(export)]
@@ -259,7 +188,7 @@ pub fn binding<C: Context, Kind: HostApiKind>()
 
                     let mut table = Table::new();
                     table.add_row(row![bc => "INTERNAL PORT", "ENABLED", "EXTERNAL PORT", "EXTERNAL SSL PORT"]);
-                    for (internal, info) in res.iter() {
+                    for (internal, info) in res {
                         table.add_row(row![
                             internal,
                             info.enabled,
@@ -284,12 +213,12 @@ pub fn binding<C: Context, Kind: HostApiKind>()
                 .with_call_remote::<CliContext>(),
         )
         .subcommand(
-            "set-address-enabled",
-            from_fn_async(set_address_enabled::<Kind>)
+            "set-gateway-enabled",
+            from_fn_async(set_gateway_enabled::<Kind>)
                 .with_metadata("sync_db", Value::Bool(true))
                 .with_inherited(Kind::inheritance)
                 .no_display()
-                .with_about("about.set-address-enabled-for-binding")
+                .with_about("about.set-gateway-enabled-for-binding")
                 .with_call_remote::<CliContext>(),
         )
 }
@@ -298,7 +227,7 @@ pub async fn list_bindings<Kind: HostApiKind>(
     ctx: RpcContext,
     _: Empty,
     inheritance: Kind::Inheritance,
-) -> Result<Bindings, Error> {
+) -> Result<BTreeMap<u16, BindInfo>, Error> {
     Kind::host_for(&inheritance, &mut ctx.db.peek().await)?
         .as_bindings()
         .de()
@@ -307,54 +236,50 @@ pub async fn list_bindings<Kind: HostApiKind>(
 #[derive(Deserialize, Serialize, Parser, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export)]
-pub struct BindingSetAddressEnabledParams {
+pub struct BindingGatewaySetEnabledParams {
     #[arg(help = "help.arg.internal-port")]
     internal_port: u16,
-    #[arg(long, help = "help.arg.address")]
-    address: String,
+    #[arg(help = "help.arg.gateway-id")]
+    gateway: GatewayId,
     #[arg(long, help = "help.arg.binding-enabled")]
     enabled: Option<bool>,
 }
 
-pub async fn set_address_enabled<Kind: HostApiKind>(
+pub async fn set_gateway_enabled<Kind: HostApiKind>(
     ctx: RpcContext,
-    BindingSetAddressEnabledParams {
+    BindingGatewaySetEnabledParams {
         internal_port,
-        address,
+        gateway,
         enabled,
-    }: BindingSetAddressEnabledParams,
+    }: BindingGatewaySetEnabledParams,
     inheritance: Kind::Inheritance,
 ) -> Result<(), Error> {
     let enabled = enabled.unwrap_or(true);
-    let address: HostnameInfo =
-        serde_json::from_str(&address).with_kind(ErrorKind::Deserialization)?;
+    let gateway_public = ctx
+        .net_controller
+        .net_iface
+        .watcher
+        .ip_info()
+        .get(&gateway)
+        .or_not_found(&gateway)?
+        .public();
     ctx.db
         .mutate(|db| {
             Kind::host_for(&inheritance, db)?
                 .as_bindings_mut()
                 .mutate(|b| {
-                    let bind = b.get_mut(&internal_port).or_not_found(internal_port)?;
-                    if address.public && address.metadata.is_ip() {
-                        // Public IPs: toggle via SocketAddr in `enabled` set
-                        let sa = address.to_socket_addr().ok_or_else(|| {
-                            Error::new(
-                                eyre!("cannot convert address to socket addr"),
-                                ErrorKind::InvalidRequest,
-                            )
-                        })?;
+                    let net = &mut b.get_mut(&internal_port).or_not_found(internal_port)?.net;
+                    if gateway_public {
                         if enabled {
-                            bind.addresses.enabled.insert(sa);
+                            net.public_enabled.insert(gateway);
                         } else {
-                            bind.addresses.enabled.remove(&sa);
+                            net.public_enabled.remove(&gateway);
                         }
                     } else {
-                        // Domains and private IPs: toggle via (host, port) in `disabled` set
-                        let port = address.port.unwrap_or(if address.ssl { 443 } else { 80 });
-                        let key = (address.host.clone(), port);
                         if enabled {
-                            bind.addresses.disabled.remove(&key);
+                            net.private_disabled.remove(&gateway);
                         } else {
-                            bind.addresses.disabled.insert(key);
+                            net.private_disabled.insert(gateway);
                         }
                     }
                     Ok(())

core/src/net/host/mod.rs

@@ -1,27 +1,23 @@
 use std::collections::{BTreeMap, BTreeSet};
 use std::future::Future;
-use std::net::{IpAddr, SocketAddrV4};
 use std::panic::RefUnwindSafe;
 
 use clap::Parser;
-use imbl::OrdMap;
 use imbl_value::InternedString;
 use itertools::Itertools;
-use patch_db::DestructureMut;
 use rpc_toolkit::{Context, Empty, HandlerExt, OrEmpty, ParentHandler, from_fn_async};
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
 
 use crate::context::RpcContext;
 use crate::db::model::DatabaseModel;
-use crate::db::model::public::{NetworkInterfaceInfo, NetworkInterfaceType};
-use crate::hostname::Hostname;
 use crate::net::forward::AvailablePorts;
 use crate::net::host::address::{HostAddress, PublicDomainConfig, address_api};
-use crate::net::host::binding::{BindInfo, BindOptions, Bindings, binding};
-use crate::net::service_interface::{HostnameInfo, HostnameMetadata};
+use crate::net::host::binding::{BindInfo, BindOptions, binding};
+use crate::net::service_interface::HostnameInfo;
+use crate::net::tor::OnionAddress;
 use crate::prelude::*;
-use crate::{GatewayId, HostId, PackageId};
+use crate::{HostId, PackageId};
 
 pub mod address;
 pub mod binding;
@@ -31,23 +27,13 @@ pub mod binding;
 #[model = "Model<Self>"]
 #[ts(export)]
 pub struct Host {
-    pub bindings: Bindings,
+    pub bindings: BTreeMap<u16, BindInfo>,
+    #[ts(type = "string[]")]
+    pub onions: BTreeSet<OnionAddress>,
     pub public_domains: BTreeMap<InternedString, PublicDomainConfig>,
-    pub private_domains: BTreeMap<InternedString, BTreeSet<GatewayId>>,
-    /// COMPUTED: port forwarding rules needed on gateways for public addresses to work.
-    #[serde(default)]
-    pub port_forwards: BTreeSet<PortForward>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, TS)]
-#[serde(rename_all = "camelCase")]
-#[ts(export)]
-pub struct PortForward {
-    #[ts(type = "string")]
-    pub src: SocketAddrV4,
-    #[ts(type = "string")]
-    pub dst: SocketAddrV4,
-    pub gateway: GatewayId,
+    pub private_domains: BTreeSet<InternedString>,
+    /// COMPUTED: NetService::update
+    pub hostname_info: BTreeMap<u16, Vec<HostnameInfo>>, // internal port -> Hostnames
 }
 
 impl AsRef<Host> for Host {
@@ -60,273 +46,31 @@ impl Host {
         Self::default()
     }
     pub fn addresses<'a>(&'a self) -> impl Iterator<Item = HostAddress> + 'a {
-        self.public_domains
+        self.onions
             .iter()
-            .map(|(address, config)| HostAddress {
-                address: address.clone(),
-                public: Some(config.clone()),
-                private: self.private_domains.get(address).cloned(),
-            })
+            .cloned()
+            .map(|address| HostAddress::Onion { address })
+            .chain(
+                self.public_domains
+                    .iter()
+                    .map(|(address, config)| HostAddress::Domain {
+                        address: address.clone(),
+                        public: Some(config.clone()),
+                        private: self.private_domains.contains(address),
+                    }),
+            )
             .chain(
                 self.private_domains
                     .iter()
-                    .filter(|(domain, _)| !self.public_domains.contains_key(*domain))
-                    .map(|(domain, gateways)| HostAddress {
-                        address: domain.clone(),
+                    .filter(|a| !self.public_domains.contains_key(*a))
+                    .map(|address| HostAddress::Domain {
+                        address: address.clone(),
                         public: None,
-                        private: Some(gateways.clone()),
+                        private: true,
                     }),
             )
     }
 }
-impl Model<Host> {
-    pub fn update_addresses(
-        &mut self,
-        mdns: &Hostname,
-        gateways: &OrdMap<GatewayId, NetworkInterfaceInfo>,
-        available_ports: &AvailablePorts,
-    ) -> Result<(), Error> {
-        let this = self.destructure_mut();
-
-        // ips
-        for (_, bind) in this.bindings.as_entries_mut()? {
-            let net = bind.as_net().de()?;
-            let opt = bind.as_options().de()?;
-            let mut available = BTreeSet::new();
-            for (gid, g) in gateways {
-                let Some(ip_info) = &g.ip_info else {
-                    continue;
-                };
-                let gateway_secure = g.secure();
-                for subnet in &ip_info.subnets {
-                    let host = InternedString::from_display(&subnet.addr());
-                    let metadata = if subnet.addr().is_ipv4() {
-                        HostnameMetadata::Ipv4 {
-                            gateway: gid.clone(),
-                        }
-                    } else {
-                        HostnameMetadata::Ipv6 {
-                            gateway: gid.clone(),
-                            scope_id: ip_info.scope_id,
-                        }
-                    };
-                    if let Some(port) = net.assigned_port.filter(|_| {
-                        opt.secure
-                            .map_or(gateway_secure, |s| !(s.ssl && opt.add_ssl.is_some()))
-                    }) {
-                        available.insert(HostnameInfo {
-                            ssl: opt.secure.map_or(false, |s| s.ssl),
-                            public: false,
-                            host: host.clone(),
-                            port: Some(port),
-                            metadata: metadata.clone(),
-                        });
-                    }
-                    if let Some(port) = net.assigned_ssl_port {
-                        available.insert(HostnameInfo {
-                            ssl: true,
-                            public: false,
-                            host: host.clone(),
-                            port: Some(port),
-                            metadata,
-                        });
-                    }
-                }
-                if let Some(wan_ip) = &ip_info.wan_ip {
-                    let host = InternedString::from_display(&wan_ip);
-                    let metadata = HostnameMetadata::Ipv4 {
-                        gateway: gid.clone(),
-                    };
-                    if let Some(port) = net.assigned_port.filter(|_| {
-                        opt.secure.map_or(
-                            false, // the public internet is never secure
-                            |s| !(s.ssl && opt.add_ssl.is_some()),
-                        )
-                    }) {
-                        available.insert(HostnameInfo {
-                            ssl: opt.secure.map_or(false, |s| s.ssl),
-                            public: true,
-                            host: host.clone(),
-                            port: Some(port),
-                            metadata: metadata.clone(),
-                        });
-                    }
-                    if let Some(port) = net.assigned_ssl_port {
-                        available.insert(HostnameInfo {
-                            ssl: true,
-                            public: true,
-                            host: host.clone(),
-                            port: Some(port),
-                            metadata,
-                        });
-                    }
-                }
-            }
-
-            // mdns
-            let mdns_host = mdns.local_domain_name();
-            let mdns_gateways: BTreeSet<GatewayId> = gateways
-                .iter()
-                .filter(|(_, g)| {
-                    matches!(
-                        g.ip_info.as_ref().and_then(|i| i.device_type),
-                        Some(NetworkInterfaceType::Ethernet | NetworkInterfaceType::Wireless)
-                    )
-                })
-                .map(|(id, _)| id.clone())
-                .collect();
-            if let Some(port) = net.assigned_port.filter(|_| {
-                opt.secure
-                    .map_or(true, |s| !(s.ssl && opt.add_ssl.is_some()))
-            }) {
-                available.insert(HostnameInfo {
-                    ssl: opt.secure.map_or(false, |s| s.ssl),
-                    public: false,
-                    host: mdns_host.clone(),
-                    port: Some(port),
-                    metadata: HostnameMetadata::Mdns {
-                        gateways: mdns_gateways.clone(),
-                    },
-                });
-            }
-            if let Some(port) = net.assigned_ssl_port {
-                available.insert(HostnameInfo {
-                    ssl: true,
-                    public: false,
-                    host: mdns_host,
-                    port: Some(port),
-                    metadata: HostnameMetadata::Mdns {
-                        gateways: mdns_gateways,
-                    },
-                });
-            }
-
-            // public domains
-            for (domain, info) in this.public_domains.de()? {
-                let metadata = HostnameMetadata::PublicDomain {
-                    gateway: info.gateway.clone(),
-                };
-                if let Some(port) = net.assigned_port.filter(|_| {
-                    opt.secure.map_or(
-                        false, // the public internet is never secure
-                        |s| !(s.ssl && opt.add_ssl.is_some()),
-                    )
-                }) {
-                    available.insert(HostnameInfo {
-                        ssl: opt.secure.map_or(false, |s| s.ssl),
-                        public: true,
-                        host: domain.clone(),
-                        port: Some(port),
-                        metadata: metadata.clone(),
-                    });
-                }
-                if let Some(mut port) = net.assigned_ssl_port {
-                    if let Some(preferred) = opt
-                        .add_ssl
-                        .as_ref()
-                        .map(|s| s.preferred_external_port)
-                        .filter(|p| available_ports.is_ssl(*p))
-                    {
-                        port = preferred;
-                    }
-                    available.insert(HostnameInfo {
-                        ssl: true,
-                        public: true,
-                        host: domain,
-                        port: Some(port),
-                        metadata,
-                    });
-                }
-            }
-
-            // private domains
-            for (domain, domain_gateways) in this.private_domains.de()? {
-                if let Some(port) = net.assigned_port.filter(|_| {
-                    opt.secure
-                        .map_or(true, |s| !(s.ssl && opt.add_ssl.is_some()))
-                }) {
-                    let gateways = if opt.secure.is_some() {
-                        domain_gateways.clone()
-                    } else {
-                        domain_gateways
-                            .iter()
-                            .cloned()
-                            .filter(|g| gateways.get(g).map_or(false, |g| g.secure()))
-                            .collect()
-                    };
-                    available.insert(HostnameInfo {
-                        ssl: opt.secure.map_or(false, |s| s.ssl),
-                        public: true,
-                        host: domain.clone(),
-                        port: Some(port),
-                        metadata: HostnameMetadata::PrivateDomain { gateways },
-                    });
-                }
-                if let Some(mut port) = net.assigned_ssl_port {
-                    if let Some(preferred) = opt
-                        .add_ssl
-                        .as_ref()
-                        .map(|s| s.preferred_external_port)
-                        .filter(|p| available_ports.is_ssl(*p))
-                    {
-                        port = preferred;
-                    }
-                    available.insert(HostnameInfo {
-                        ssl: true,
-                        public: true,
-                        host: domain,
-                        port: Some(port),
-                        metadata: HostnameMetadata::PrivateDomain {
-                            gateways: domain_gateways,
-                        },
-                    });
-                }
-            }
-            bind.as_addresses_mut().as_available_mut().ser(&available)?;
-        }
-
-        // compute port forwards from available public addresses
-        let bindings: Bindings = this.bindings.de()?;
-        let mut port_forwards = BTreeSet::new();
-        for bind in bindings.values() {
-            for addr in &bind.addresses.available {
-                if !addr.public {
-                    continue;
-                }
-                let Some(port) = addr.port else {
-                    continue;
-                };
-                let gw_id = match &addr.metadata {
-                    HostnameMetadata::Ipv4 { gateway }
-                    | HostnameMetadata::PublicDomain { gateway } => gateway,
-                    _ => continue,
-                };
-                let Some(gw_info) = gateways.get(gw_id) else {
-                    continue;
-                };
-                let Some(ip_info) = &gw_info.ip_info else {
-                    continue;
-                };
-                let Some(wan_ip) = ip_info.wan_ip else {
-                    continue;
-                };
-                for subnet in &ip_info.subnets {
-                    let IpAddr::V4(addr) = subnet.addr() else {
-                        continue;
-                    };
-                    port_forwards.insert(PortForward {
-                        src: SocketAddrV4::new(wan_ip, port),
-                        dst: SocketAddrV4::new(addr, port),
-                        gateway: gw_id.clone(),
-                    });
-                }
-            }
-        }
-        this.port_forwards.ser(&port_forwards)?;
-
-        Ok(())
-    }
-}
 
 #[derive(Debug, Default, Deserialize, Serialize, HasModel, TS)]
 #[model = "Model<Self>"]
@@ -368,7 +112,22 @@ pub fn host_for<'a>(
                 .as_hosts_mut(),
         )
     }
-    host_info(db, package_id)?.upsert(host_id, || Ok(Host::new()))
+    let tor_key = if host_info(db, package_id)?.as_idx(host_id).is_none() {
+        Some(
+            db.as_private_mut()
+                .as_key_store_mut()
+                .as_onion_mut()
+                .new_key()?,
+        )
+    } else {
+        None
+    };
+    host_info(db, package_id)?.upsert(host_id, || {
+        let mut h = Host::new();
+        h.onions
+            .insert(tor_key.or_not_found("generated tor key")?.onion_address());
+        Ok(h)
+    })
 }
 
 pub fn all_hosts(db: &mut DatabaseModel) -> impl Iterator<Item = Result<&mut Model<Host>, Error>> {

core/src/net/keys.rs

@@ -3,21 +3,28 @@ use serde::{Deserialize, Serialize};
 use crate::account::AccountInfo;
 use crate::net::acme::AcmeCertStore;
 use crate::net::ssl::CertStore;
+use crate::net::tor::OnionStore;
 use crate::prelude::*;
 
 #[derive(Debug, Deserialize, Serialize, HasModel)]
 #[model = "Model<Self>"]
 #[serde(rename_all = "camelCase")]
 pub struct KeyStore {
+    pub onion: OnionStore,
     pub local_certs: CertStore,
     #[serde(default)]
     pub acme: AcmeCertStore,
 }
 impl KeyStore {
     pub fn new(account: &AccountInfo) -> Result<Self, Error> {
-        Ok(Self {
+        let mut res = Self {
+            onion: OnionStore::new(),
             local_certs: CertStore::new(account)?,
             acme: AcmeCertStore::new(),
-        })
+        };
+        for tor_key in account.tor_keys.iter().cloned() {
+            res.onion.insert(tor_key);
+        }
+        Ok(res)
     }
 }

core/src/net/mod.rs

@@ -14,6 +14,7 @@ pub mod socks;
 pub mod ssl;
 pub mod static_server;
 pub mod tls;
+pub mod tor;
 pub mod tunnel;
 pub mod utils;
 pub mod vhost;
@@ -22,6 +23,7 @@ pub mod wifi;
 
 pub fn net_api<C: Context>() -> ParentHandler<C> {
     ParentHandler::new()
+        .subcommand("tor", tor::tor_api::<C>().with_about("about.tor-commands"))
         .subcommand(
             "acme",
             acme::acme_api::<C>().with_about("about.setup-acme-certificate"),

core/src/net/service_interface.rs

@@ -1,84 +1,36 @@
-use std::collections::BTreeSet;
-use std::net::SocketAddr;
+use std::net::{Ipv4Addr, Ipv6Addr};
 
-use imbl_value::{InOMap, InternedString};
+use imbl_value::InternedString;
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
 
-use crate::prelude::*;
-use crate::{GatewayId, HostId, PackageId, ServiceInterfaceId};
+use crate::{GatewayId, HostId, ServiceInterfaceId};
 
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, TS)]
+#[derive(Clone, Debug, Deserialize, Serialize, TS)]
 #[ts(export)]
 #[serde(rename_all = "camelCase")]
-pub struct HostnameInfo {
-    pub ssl: bool,
-    pub public: bool,
-    pub host: InternedString,
-    pub port: Option<u16>,
-    pub metadata: HostnameMetadata,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, TS)]
-#[ts(export)]
-#[serde(rename_all = "kebab-case")]
 #[serde(rename_all_fields = "camelCase")]
 #[serde(tag = "kind")]
-pub enum HostnameMetadata {
-    Ipv4 {
-        gateway: GatewayId,
+pub enum HostnameInfo {
+    Ip {
+        gateway: GatewayInfo,
+        public: bool,
+        hostname: IpHostname,
     },
-    Ipv6 {
-        gateway: GatewayId,
-        scope_id: u32,
-    },
-    Mdns {
-        gateways: BTreeSet<GatewayId>,
-    },
-    PrivateDomain {
-        gateways: BTreeSet<GatewayId>,
-    },
-    PublicDomain {
-        gateway: GatewayId,
-    },
-    Plugin {
-        package: PackageId,
-        #[serde(flatten)]
-        #[ts(skip)]
-        extra: InOMap<InternedString, Value>,
+    Onion {
+        hostname: OnionHostname,
     },
 }
-
 impl HostnameInfo {
-    pub fn to_socket_addr(&self) -> Option<SocketAddr> {
-        let ip = self.host.parse().ok()?;
-        Some(SocketAddr::new(ip, self.port?))
-    }
-
     pub fn to_san_hostname(&self) -> InternedString {
-        self.host.clone()
-    }
-}
-
-impl HostnameMetadata {
-    pub fn is_ip(&self) -> bool {
-        matches!(self, Self::Ipv4 { .. } | Self::Ipv6 { .. })
-    }
-
-    pub fn gateways(&self) -> Box<dyn Iterator<Item = &GatewayId> + '_> {
         match self {
-            Self::Ipv4 { gateway }
-            | Self::Ipv6 { gateway, .. }
-            | Self::PublicDomain { gateway } => Box::new(std::iter::once(gateway)),
-            Self::PrivateDomain { gateways } | Self::Mdns { gateways } => {
-                Box::new(gateways.iter())
-            }
-            Self::Plugin { .. } => Box::new(std::iter::empty()),
+            Self::Ip { hostname, .. } => hostname.to_san_hostname(),
+            Self::Onion { hostname } => hostname.to_san_hostname(),
         }
     }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, TS)]
+#[derive(Clone, Debug, Deserialize, Serialize, TS)]
 #[ts(export)]
 #[serde(rename_all = "camelCase")]
 pub struct GatewayInfo {
@@ -87,6 +39,63 @@ pub struct GatewayInfo {
     pub public: bool,
 }
 
+#[derive(Clone, Debug, Deserialize, Serialize, TS)]
+#[ts(export)]
+#[serde(rename_all = "camelCase")]
+pub struct OnionHostname {
+    #[ts(type = "string")]
+    pub value: InternedString,
+    pub port: Option<u16>,
+    pub ssl_port: Option<u16>,
+}
+impl OnionHostname {
+    pub fn to_san_hostname(&self) -> InternedString {
+        self.value.clone()
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, TS)]
+#[ts(export)]
+#[serde(rename_all = "camelCase")]
+#[serde(rename_all_fields = "camelCase")]
+#[serde(tag = "kind")]
+pub enum IpHostname {
+    Ipv4 {
+        value: Ipv4Addr,
+        port: Option<u16>,
+        ssl_port: Option<u16>,
+    },
+    Ipv6 {
+        value: Ipv6Addr,
+        #[serde(default)]
+        scope_id: u32,
+        port: Option<u16>,
+        ssl_port: Option<u16>,
+    },
+    Local {
+        #[ts(type = "string")]
+        value: InternedString,
+        port: Option<u16>,
+        ssl_port: Option<u16>,
+    },
+    Domain {
+        #[ts(type = "string")]
+        value: InternedString,
+        port: Option<u16>,
+        ssl_port: Option<u16>,
+    },
+}
+impl IpHostname {
+    pub fn to_san_hostname(&self) -> InternedString {
+        match self {
+            Self::Ipv4 { value, .. } => InternedString::from_display(value),
+            Self::Ipv6 { value, .. } => InternedString::from_display(value),
+            Self::Local { value, .. } => value.clone(),
+            Self::Domain { value, .. } => value.clone(),
+        }
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize, TS)]
 #[ts(export)]
 #[serde(rename_all = "camelCase")]

core/src/net/socks.rs

@@ -8,6 +8,7 @@ use socks5_impl::server::{AuthAdaptor, ClientConnection, Server};
 use tokio::net::{TcpListener, TcpStream};
 
 use crate::HOST_IP;
+use crate::net::tor::TorController;
 use crate::prelude::*;
 use crate::util::actor::background::BackgroundJobQueue;
 use crate::util::future::NonDetachingJoinHandle;
@@ -21,7 +22,7 @@ pub struct SocksController {
     _thread: NonDetachingJoinHandle<()>,
 }
 impl SocksController {
-    pub fn new(listen: SocketAddr) -> Result<Self, Error> {
+    pub fn new(listen: SocketAddr, tor: TorController) -> Result<Self, Error> {
         Ok(Self {
             _thread: tokio::spawn(async move {
                 let auth: AuthAdaptor<()> = Arc::new(NoAuth);
@@ -44,6 +45,7 @@ impl SocksController {
                         loop {
                             match server.accept().await {
                                 Ok((stream, _)) => {
+                                    let tor = tor.clone();
                                     bg.add_job(async move {
                                         if let Err(e) = async {
                                             match stream
@@ -55,6 +57,40 @@ impl SocksController {
                                                 .await
                                                 .with_kind(ErrorKind::Network)?
                                             {
+                                                ClientConnection::Connect(
+                                                    reply,
+                                                    Address::DomainAddress(domain, port),
+                                                ) if domain.ends_with(".onion") => {
+                                                    if let Ok(mut target) = tor
+                                                        .connect_onion(&domain.parse()?, port)
+                                                        .await
+                                                    {
+                                                        let mut sock = reply
+                                                            .reply(
+                                                                Reply::Succeeded,
+                                                                Address::unspecified(),
+                                                            )
+                                                            .await
+                                                            .with_kind(ErrorKind::Network)?;
+                                                        tokio::io::copy_bidirectional(
+                                                            &mut sock,
+                                                            &mut target,
+                                                        )
+                                                        .await
+                                                        .with_kind(ErrorKind::Network)?;
+                                                    } else {
+                                                        let mut sock = reply
+                                                            .reply(
+                                                                Reply::HostUnreachable,
+                                                                Address::unspecified(),
+                                                            )
+                                                            .await
+                                                            .with_kind(ErrorKind::Network)?;
+                                                        sock.shutdown()
+                                                            .await
+                                                            .with_kind(ErrorKind::Network)?;
+                                                    }
+                                                }
                                                 ClientConnection::Connect(reply, addr) => {
                                                     if let Ok(mut target) = match addr {
                                                         Address::DomainAddress(domain, port) => {

core/src/net/static_server.rs

@@ -9,14 +9,14 @@ use async_compression::tokio::bufread::GzipEncoder;
 use axum::Router;
 use axum::body::Body;
 use axum::extract::{self as x, Request};
-use axum::response::{IntoResponse, Response};
+use axum::response::{IntoResponse, Redirect, Response};
 use axum::routing::{any, get};
 use base64::display::Base64Display;
 use digest::Digest;
 use futures::future::ready;
 use http::header::{
     ACCEPT_ENCODING, ACCEPT_RANGES, CACHE_CONTROL, CONNECTION, CONTENT_ENCODING, CONTENT_LENGTH,
-    CONTENT_RANGE, CONTENT_TYPE, ETAG, RANGE,
+    CONTENT_RANGE, CONTENT_TYPE, ETAG, HOST, RANGE,
 };
 use http::request::Parts as RequestParts;
 use http::{HeaderValue, Method, StatusCode};
@@ -36,6 +36,8 @@ use crate::middleware::auth::Auth;
 use crate::middleware::auth::session::ValidSessionToken;
 use crate::middleware::cors::Cors;
 use crate::middleware::db::SyncDb;
+use crate::net::gateway::GatewayInfo;
+use crate::net::tls::TlsHandshakeInfo;
 use crate::prelude::*;
 use crate::rpc_continuations::{Guid, RpcContinuations};
 use crate::s9pk::S9pk;
@@ -87,6 +89,30 @@ impl UiContext for RpcContext {
             .middleware(SyncDb::new())
     }
     fn extend_router(self, router: Router) -> Router {
+        async fn https_redirect_if_public_http(
+            req: Request,
+            next: axum::middleware::Next,
+        ) -> Response {
+            if req
+                .extensions()
+                .get::<GatewayInfo>()
+                .map_or(false, |p| p.info.public())
+                && req.extensions().get::<TlsHandshakeInfo>().is_none()
+            {
+                Redirect::temporary(&format!(
+                    "https://{}{}",
+                    req.headers()
+                        .get(HOST)
+                        .and_then(|s| s.to_str().ok())
+                        .unwrap_or("localhost"),
+                    req.uri()
+                ))
+                .into_response()
+            } else {
+                next.run(req).await
+            }
+        }
+
         router
             .route("/proxy/{url}", {
                 let ctx = self.clone();
@@ -110,6 +136,7 @@ impl UiContext for RpcContext {
                     }
                 }),
             )
+            .layer(axum::middleware::from_fn(https_redirect_if_public_http))
     }
 }
 

core/src/net/tls.rs

@@ -171,13 +171,16 @@ where
             let mut tls_handler = self.tls_handler.clone();
             let mut fut = async move {
                 let res = async {
-                    let mut acceptor =
-                        LazyConfigAcceptor::new(Acceptor::default(), BackTrackingIO::new(stream));
+                    let mut acceptor = LazyConfigAcceptor::new(
+                        Acceptor::default(),
+                        BackTrackingIO::new(stream),
+                    );
                     let mut mid: tokio_rustls::StartHandshake<BackTrackingIO<AcceptStream>> =
                         match (&mut acceptor).await {
                             Ok(a) => a,
                             Err(e) => {
-                                let mut stream = acceptor.take_io().or_not_found("acceptor io")?;
+                                let mut stream =
+                                    acceptor.take_io().or_not_found("acceptor io")?;
                                 let (_, buf) = stream.rewind();
                                 if std::str::from_utf8(buf)
                                     .ok()

core/src/net/tor/arti.rs

@@ -0,0 +1,959 @@
+use std::borrow::Cow;
+use std::collections::{BTreeMap, BTreeSet};
+use std::net::SocketAddr;
+use std::str::FromStr;
+use std::sync::{Arc, Weak};
+use std::time::{Duration, Instant};
+
+use arti_client::config::onion_service::OnionServiceConfigBuilder;
+use arti_client::{TorClient, TorClientConfig};
+use base64::Engine;
+use clap::Parser;
+use color_eyre::eyre::eyre;
+use futures::{FutureExt, StreamExt};
+use imbl_value::InternedString;
+use itertools::Itertools;
+use rpc_toolkit::{Context, Empty, HandlerExt, ParentHandler, from_fn_async};
+use serde::{Deserialize, Serialize};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::sync::Notify;
+use tor_cell::relaycell::msg::Connected;
+use tor_hscrypto::pk::{HsId, HsIdKeypair};
+use tor_hsservice::status::State as ArtiOnionServiceState;
+use tor_hsservice::{HsNickname, RunningOnionService};
+use tor_keymgr::config::ArtiKeystoreKind;
+use tor_proto::client::stream::IncomingStreamRequest;
+use tor_rtcompat::tokio::TokioRustlsRuntime;
+use ts_rs::TS;
+
+use crate::context::{CliContext, RpcContext};
+use crate::prelude::*;
+use crate::util::actor::background::BackgroundJobQueue;
+use crate::util::future::{NonDetachingJoinHandle, Until};
+use crate::util::io::ReadWriter;
+use crate::util::serde::{
+    BASE64, Base64, HandlerExtSerde, WithIoFormat, deserialize_from_str, display_serializable,
+    serialize_display,
+};
+use crate::util::sync::{SyncMutex, SyncRwLock, Watch};
+
+const BOOTSTRAP_PROGRESS_TIMEOUT: Duration = Duration::from_secs(300);
+const HS_BOOTSTRAP_TIMEOUT: Duration = Duration::from_secs(300);
+const RETRY_COOLDOWN: Duration = Duration::from_secs(15);
+const HEALTH_CHECK_FAILURE_ALLOWANCE: usize = 5;
+const HEALTH_CHECK_COOLDOWN: Duration = Duration::from_secs(120);
+
+#[derive(Debug, Clone, Copy)]
+pub struct OnionAddress(pub HsId);
+impl std::fmt::Display for OnionAddress {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        safelog::DisplayRedacted::fmt_unredacted(&self.0, f)
+    }
+}
+impl FromStr for OnionAddress {
+    type Err = Error;
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(Self(
+            if s.ends_with(".onion") {
+                Cow::Borrowed(s)
+            } else {
+                Cow::Owned(format!("{s}.onion"))
+            }
+            .parse::<HsId>()
+            .with_kind(ErrorKind::Tor)?,
+        ))
+    }
+}
+impl Serialize for OnionAddress {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        serialize_display(self, serializer)
+    }
+}
+impl<'de> Deserialize<'de> for OnionAddress {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserialize_from_str(deserializer)
+    }
+}
+impl PartialEq for OnionAddress {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.as_ref() == other.0.as_ref()
+    }
+}
+impl Eq for OnionAddress {}
+impl PartialOrd for OnionAddress {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        self.0.as_ref().partial_cmp(other.0.as_ref())
+    }
+}
+impl Ord for OnionAddress {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.0.as_ref().cmp(other.0.as_ref())
+    }
+}
+
+pub struct TorSecretKey(pub HsIdKeypair);
+impl TorSecretKey {
+    pub fn onion_address(&self) -> OnionAddress {
+        OnionAddress(HsId::from(self.0.as_ref().public().to_bytes()))
+    }
+    pub fn from_bytes(bytes: [u8; 64]) -> Result<Self, Error> {
+        Ok(Self(
+            tor_llcrypto::pk::ed25519::ExpandedKeypair::from_secret_key_bytes(bytes)
+                .ok_or_else(|| {
+                    Error::new(
+                        eyre!("{}", t!("net.tor.invalid-ed25519-key")),
+                        ErrorKind::Tor,
+                    )
+                })?
+                .into(),
+        ))
+    }
+    pub fn generate() -> Self {
+        Self(
+            tor_llcrypto::pk::ed25519::ExpandedKeypair::from(
+                &tor_llcrypto::pk::ed25519::Keypair::generate(&mut rand::rng()),
+            )
+            .into(),
+        )
+    }
+}
+impl Clone for TorSecretKey {
+    fn clone(&self) -> Self {
+        Self(HsIdKeypair::from(
+            tor_llcrypto::pk::ed25519::ExpandedKeypair::from_secret_key_bytes(
+                self.0.as_ref().to_secret_key_bytes(),
+            )
+            .unwrap(),
+        ))
+    }
+}
+impl std::fmt::Display for TorSecretKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            BASE64.encode(self.0.as_ref().to_secret_key_bytes())
+        )
+    }
+}
+impl FromStr for TorSecretKey {
+    type Err = Error;
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Self::from_bytes(Base64::<[u8; 64]>::from_str(s)?.0)
+    }
+}
+impl Serialize for TorSecretKey {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        serialize_display(self, serializer)
+    }
+}
+impl<'de> Deserialize<'de> for TorSecretKey {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserialize_from_str(deserializer)
+    }
+}
+
+#[derive(Default, Deserialize, Serialize)]
+pub struct OnionStore(BTreeMap<OnionAddress, TorSecretKey>);
+impl Map for OnionStore {
+    type Key = OnionAddress;
+    type Value = TorSecretKey;
+    fn key_str(key: &Self::Key) -> Result<impl AsRef<str>, Error> {
+        Self::key_string(key)
+    }
+    fn key_string(key: &Self::Key) -> Result<imbl_value::InternedString, Error> {
+        Ok(InternedString::from_display(key))
+    }
+}
+impl OnionStore {
+    pub fn new() -> Self {
+        Self::default()
+    }
+    pub fn insert(&mut self, key: TorSecretKey) {
+        self.0.insert(key.onion_address(), key);
+    }
+}
+impl Model<OnionStore> {
+    pub fn new_key(&mut self) -> Result<TorSecretKey, Error> {
+        let key = TorSecretKey::generate();
+        self.insert(&key.onion_address(), &key)?;
+        Ok(key)
+    }
+    pub fn insert_key(&mut self, key: &TorSecretKey) -> Result<(), Error> {
+        self.insert(&key.onion_address(), &key)
+    }
+    pub fn get_key(&self, address: &OnionAddress) -> Result<TorSecretKey, Error> {
+        self.as_idx(address)
+            .or_not_found(lazy_format!("private key for {address}"))?
+            .de()
+    }
+}
+impl std::fmt::Debug for OnionStore {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        struct OnionStoreMap<'a>(&'a BTreeMap<OnionAddress, TorSecretKey>);
+        impl<'a> std::fmt::Debug for OnionStoreMap<'a> {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                #[derive(Debug)]
+                struct KeyFor(#[allow(unused)] OnionAddress);
+                let mut map = f.debug_map();
+                for (k, v) in self.0 {
+                    map.key(k);
+                    map.value(&KeyFor(v.onion_address()));
+                }
+                map.finish()
+            }
+        }
+        f.debug_tuple("OnionStore")
+            .field(&OnionStoreMap(&self.0))
+            .finish()
+    }
+}
+
+pub fn tor_api<C: Context>() -> ParentHandler<C> {
+    ParentHandler::new()
+        .subcommand(
+            "list-services",
+            from_fn_async(list_services)
+                .with_display_serializable()
+                .with_custom_display_fn(|handle, result| display_services(handle.params, result))
+                .with_about("about.display-tor-v3-onion-addresses")
+                .with_call_remote::<CliContext>(),
+        )
+        .subcommand(
+            "reset",
+            from_fn_async(reset)
+                .no_display()
+                .with_about("about.reset-tor-daemon")
+                .with_call_remote::<CliContext>(),
+        )
+        .subcommand(
+            "key",
+            key::<C>().with_about("about.manage-onion-service-key-store"),
+        )
+}
+
+pub fn key<C: Context>() -> ParentHandler<C> {
+    ParentHandler::new()
+        .subcommand(
+            "generate",
+            from_fn_async(generate_key)
+                .with_about("about.generate-onion-service-key-add-to-store")
+                .with_call_remote::<CliContext>(),
+        )
+        .subcommand(
+            "add",
+            from_fn_async(add_key)
+                .with_about("about.add-onion-service-key-to-store")
+                .with_call_remote::<CliContext>(),
+        )
+        .subcommand(
+            "list",
+            from_fn_async(list_keys)
+                .with_custom_display_fn(|_, res| {
+                    for addr in res {
+                        println!("{addr}");
+                    }
+                    Ok(())
+                })
+                .with_about("about.list-onion-services-with-keys-in-store")
+                .with_call_remote::<CliContext>(),
+        )
+}
+
+pub async fn generate_key(ctx: RpcContext) -> Result<OnionAddress, Error> {
+    ctx.db
+        .mutate(|db| {
+            Ok(db
+                .as_private_mut()
+                .as_key_store_mut()
+                .as_onion_mut()
+                .new_key()?
+                .onion_address())
+        })
+        .await
+        .result
+}
+
+#[derive(Deserialize, Serialize, Parser)]
+pub struct AddKeyParams {
+    #[arg(help = "help.arg.onion-secret-key")]
+    pub key: Base64<[u8; 64]>,
+}
+
+pub async fn add_key(
+    ctx: RpcContext,
+    AddKeyParams { key }: AddKeyParams,
+) -> Result<OnionAddress, Error> {
+    let key = TorSecretKey::from_bytes(key.0)?;
+    ctx.db
+        .mutate(|db| {
+            db.as_private_mut()
+                .as_key_store_mut()
+                .as_onion_mut()
+                .insert_key(&key)
+        })
+        .await
+        .result?;
+    Ok(key.onion_address())
+}
+
+pub async fn list_keys(ctx: RpcContext) -> Result<BTreeSet<OnionAddress>, Error> {
+    ctx.db
+        .peek()
+        .await
+        .into_private()
+        .into_key_store()
+        .into_onion()
+        .keys()
+}
+
+#[derive(Deserialize, Serialize, Parser, TS)]
+#[serde(rename_all = "camelCase")]
+#[command(rename_all = "kebab-case")]
+pub struct ResetParams {
+    #[arg(name = "wipe-state", short = 'w', long = "wipe-state", help = "help.arg.wipe-tor-state")]
+    wipe_state: bool,
+}
+
+pub async fn reset(ctx: RpcContext, ResetParams { wipe_state }: ResetParams) -> Result<(), Error> {
+    ctx.net_controller.tor.reset(wipe_state).await
+}
+
+pub fn display_services(
+    params: WithIoFormat<Empty>,
+    services: BTreeMap<OnionAddress, OnionServiceInfo>,
+) -> Result<(), Error> {
+    use prettytable::*;
+
+    if let Some(format) = params.format {
+        return display_serializable(format, services);
+    }
+
+    let mut table = Table::new();
+    table.add_row(row![bc => "ADDRESS", "STATE", "BINDINGS"]);
+    for (service, info) in services {
+        let row = row![
+            &service.to_string(),
+            &format!("{:?}", info.state),
+            &info
+                .bindings
+                .into_iter()
+                .map(|(port, addr)| lazy_format!("{port} -> {addr}"))
+                .join("; ")
+        ];
+        table.add_row(row);
+    }
+    table.print_tty(false)?;
+    Ok(())
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum OnionServiceState {
+    Shutdown,
+    Bootstrapping,
+    DegradedReachable,
+    DegradedUnreachable,
+    Running,
+    Recovering,
+    Broken,
+}
+impl From<ArtiOnionServiceState> for OnionServiceState {
+    fn from(value: ArtiOnionServiceState) -> Self {
+        match value {
+            ArtiOnionServiceState::Shutdown => Self::Shutdown,
+            ArtiOnionServiceState::Bootstrapping => Self::Bootstrapping,
+            ArtiOnionServiceState::DegradedReachable => Self::DegradedReachable,
+            ArtiOnionServiceState::DegradedUnreachable => Self::DegradedUnreachable,
+            ArtiOnionServiceState::Running => Self::Running,
+            ArtiOnionServiceState::Recovering => Self::Recovering,
+            ArtiOnionServiceState::Broken => Self::Broken,
+            _ => unreachable!(),
+        }
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OnionServiceInfo {
+    pub state: OnionServiceState,
+    pub bindings: BTreeMap<u16, SocketAddr>,
+}
+
+pub async fn list_services(
+    ctx: RpcContext,
+    _: Empty,
+) -> Result<BTreeMap<OnionAddress, OnionServiceInfo>, Error> {
+    ctx.net_controller.tor.list_services().await
+}
+
+#[derive(Clone)]
+pub struct TorController(Arc<TorControllerInner>);
+struct TorControllerInner {
+    client: Watch<(usize, TorClient<TokioRustlsRuntime>)>,
+    _bootstrapper: NonDetachingJoinHandle<()>,
+    services: SyncMutex<BTreeMap<OnionAddress, OnionService>>,
+    reset: Arc<Notify>,
+}
+impl TorController {
+    pub fn new() -> Result<Self, Error> {
+        let mut config = TorClientConfig::builder();
+        config
+            .storage()
+            .keystore()
+            .primary()
+            .kind(ArtiKeystoreKind::Ephemeral.into());
+        let client = Watch::new((
+            0,
+            TorClient::with_runtime(TokioRustlsRuntime::current()?)
+                .config(config.build().with_kind(ErrorKind::Tor)?)
+                .local_resource_timeout(Duration::from_secs(0))
+                .create_unbootstrapped()?,
+        ));
+        let reset = Arc::new(Notify::new());
+        let bootstrapper_reset = reset.clone();
+        let bootstrapper_client = client.clone();
+        let bootstrapper = tokio::spawn(async move {
+            loop {
+                let (epoch, client): (usize, _) = bootstrapper_client.read();
+                if let Err(e) = Until::new()
+                    .with_async_fn(|| bootstrapper_reset.notified().map(Ok))
+                    .run(async {
+                        let mut events = client.bootstrap_events();
+                        let bootstrap_fut =
+                            client.bootstrap().map(|res| res.with_kind(ErrorKind::Tor));
+                        let failure_fut = async {
+                            let mut prev_frac = 0_f32;
+                            let mut prev_inst = Instant::now();
+                            while let Some(event) =
+                                tokio::time::timeout(BOOTSTRAP_PROGRESS_TIMEOUT, events.next())
+                                    .await
+                                    .with_kind(ErrorKind::Tor)?
+                            {
+                                if event.ready_for_traffic() {
+                                    return Ok::<_, Error>(());
+                                }
+                                let frac = event.as_frac();
+                                if frac == prev_frac {
+                                    if prev_inst.elapsed() > BOOTSTRAP_PROGRESS_TIMEOUT {
+                                        return Err(Error::new(
+                                            eyre!(
+                                                "{}",
+                                                t!(
+                                                    "net.tor.bootstrap-no-progress",
+                                                    duration = crate::util::serde::Duration::from(
+                                                        BOOTSTRAP_PROGRESS_TIMEOUT
+                                                    )
+                                                    .to_string()
+                                                )
+                                            ),
+                                            ErrorKind::Tor,
+                                        ));
+                                    }
+                                } else {
+                                    prev_frac = frac;
+                                    prev_inst = Instant::now();
+                                }
+                            }
+                            futures::future::pending().await
+                        };
+                        if let Err::<(), Error>(e) = tokio::select! {
+                            res = bootstrap_fut => res,
+                            res = failure_fut => res,
+                        } {
+                            tracing::error!(
+                                "{}",
+                                t!("net.tor.bootstrap-error", error = e.to_string())
+                            );
+                            tracing::debug!("{e:?}");
+                        } else {
+                            bootstrapper_client.send_modify(|_| ());
+
+                            for _ in 0..HEALTH_CHECK_FAILURE_ALLOWANCE {
+                                if let Err::<(), Error>(e) = async {
+                                    loop {
+                                        let (bg, mut runner) = BackgroundJobQueue::new();
+                                        runner
+                                            .run_while(async {
+                                                const PING_BUF_LEN: usize = 8;
+                                                let key = TorSecretKey::generate();
+                                                let onion = key.onion_address();
+                                                let (hs, stream) = client
+                                                    .launch_onion_service_with_hsid(
+                                                        OnionServiceConfigBuilder::default()
+                                                            .nickname(
+                                                                onion
+                                                                    .to_string()
+                                                                    .trim_end_matches(".onion")
+                                                                    .parse::<HsNickname>()
+                                                                    .with_kind(ErrorKind::Tor)?,
+                                                            )
+                                                            .build()
+                                                            .with_kind(ErrorKind::Tor)?,
+                                                        key.clone().0,
+                                                    )
+                                                    .with_kind(ErrorKind::Tor)?;
+                                                bg.add_job(async move {
+                                                    if let Err(e) = async {
+                                                        let mut stream =
+                                                            tor_hsservice::handle_rend_requests(
+                                                                stream,
+                                                            );
+                                                        while let Some(req) = stream.next().await {
+                                                            let mut stream = req
+                                                                .accept(Connected::new_empty())
+                                                                .await
+                                                                .with_kind(ErrorKind::Tor)?;
+                                                            let mut buf = [0; PING_BUF_LEN];
+                                                            stream.read_exact(&mut buf).await?;
+                                                            stream.write_all(&buf).await?;
+                                                            stream.flush().await?;
+                                                            stream.shutdown().await?;
+                                                        }
+                                                        Ok::<_, Error>(())
+                                                    }
+                                                    .await
+                                                    {
+                                                        tracing::error!(
+                                                            "{}",
+                                                            t!(
+                                                                "net.tor.health-error",
+                                                                error = e.to_string()
+                                                            )
+                                                        );
+                                                        tracing::debug!("{e:?}");
+                                                    }
+                                                });
+
+                                                tokio::time::timeout(HS_BOOTSTRAP_TIMEOUT, async {
+                                                    let mut status = hs.status_events();
+                                                    while let Some(status) = status.next().await {
+                                                        if status.state().is_fully_reachable() {
+                                                            return Ok(());
+                                                        }
+                                                    }
+                                                    Err(Error::new(
+                                                        eyre!(
+                                                            "{}",
+                                                            t!("net.tor.status-stream-ended")
+                                                        ),
+                                                        ErrorKind::Tor,
+                                                    ))
+                                                })
+                                                .await
+                                                .with_kind(ErrorKind::Tor)??;
+
+                                                let mut stream = client
+                                                    .connect((onion.to_string(), 8080))
+                                                    .await?;
+                                                let mut ping_buf = [0; PING_BUF_LEN];
+                                                rand::fill(&mut ping_buf);
+                                                stream.write_all(&ping_buf).await?;
+                                                stream.flush().await?;
+                                                let mut ping_res = [0; PING_BUF_LEN];
+                                                stream.read_exact(&mut ping_res).await?;
+                                                ensure_code!(
+                                                    ping_buf == ping_res,
+                                                    ErrorKind::Tor,
+                                                    "ping buffer mismatch"
+                                                );
+                                                stream.shutdown().await?;
+
+                                                Ok::<_, Error>(())
+                                            })
+                                            .await?;
+                                        tokio::time::sleep(HEALTH_CHECK_COOLDOWN).await;
+                                    }
+                                }
+                                .await
+                                {
+                                    tracing::error!(
+                                        "{}",
+                                        t!("net.tor.client-health-error", error = e.to_string())
+                                    );
+                                    tracing::debug!("{e:?}");
+                                }
+                            }
+                            tracing::error!(
+                                "{}",
+                                t!(
+                                    "net.tor.health-check-failed-recycling",
+                                    count = HEALTH_CHECK_FAILURE_ALLOWANCE
+                                )
+                            );
+                        }
+
+                        Ok(())
+                    })
+                    .await
+                {
+                    tracing::error!(
+                        "{}",
+                        t!("net.tor.bootstrapper-error", error = e.to_string())
+                    );
+                    tracing::debug!("{e:?}");
+                }
+                if let Err::<(), Error>(e) = async {
+                    tokio::time::sleep(RETRY_COOLDOWN).await;
+                    bootstrapper_client.send((
+                        epoch.wrapping_add(1),
+                        TorClient::with_runtime(TokioRustlsRuntime::current()?)
+                            .config(config.build().with_kind(ErrorKind::Tor)?)
+                            .local_resource_timeout(Duration::from_secs(0))
+                            .create_unbootstrapped_async()
+                            .await?,
+                    ));
+                    tracing::debug!("TorClient recycled");
+                    Ok(())
+                }
+                .await
+                {
+                    tracing::error!(
+                        "{}",
+                        t!("net.tor.client-creation-error", error = e.to_string())
+                    );
+                    tracing::debug!("{e:?}");
+                }
+            }
+        })
+        .into();
+        Ok(Self(Arc::new(TorControllerInner {
+            client,
+            _bootstrapper: bootstrapper,
+            services: SyncMutex::new(BTreeMap::new()),
+            reset,
+        })))
+    }
+
+    pub fn service(&self, key: TorSecretKey) -> Result<OnionService, Error> {
+        self.0.services.mutate(|s| {
+            use std::collections::btree_map::Entry;
+            let addr = key.onion_address();
+            match s.entry(addr) {
+                Entry::Occupied(e) => Ok(e.get().clone()),
+                Entry::Vacant(e) => Ok(e
+                    .insert(OnionService::launch(self.0.client.clone(), key)?)
+                    .clone()),
+            }
+        })
+    }
+
+    pub async fn gc(&self, addr: Option<OnionAddress>) -> Result<(), Error> {
+        if let Some(addr) = addr {
+            if let Some(s) = self.0.services.mutate(|s| {
+                let rm = if let Some(s) = s.get(&addr) {
+                    !s.gc()
+                } else {
+                    false
+                };
+                if rm { s.remove(&addr) } else { None }
+            }) {
+                s.shutdown().await
+            } else {
+                Ok(())
+            }
+        } else {
+            for s in self.0.services.mutate(|s| {
+                let mut rm = Vec::new();
+                s.retain(|_, s| {
+                    if s.gc() {
+                        true
+                    } else {
+                        rm.push(s.clone());
+                        false
+                    }
+                });
+                rm
+            }) {
+                s.shutdown().await?;
+            }
+            Ok(())
+        }
+    }
+
+    pub async fn reset(&self, wipe_state: bool) -> Result<(), Error> {
+        self.0.reset.notify_waiters();
+        Ok(())
+    }
+
+    pub async fn list_services(&self) -> Result<BTreeMap<OnionAddress, OnionServiceInfo>, Error> {
+        Ok(self
+            .0
+            .services
+            .peek(|s| s.iter().map(|(a, s)| (a.clone(), s.info())).collect()))
+    }
+
+    pub async fn connect_onion(
+        &self,
+        addr: &OnionAddress,
+        port: u16,
+    ) -> Result<Box<dyn ReadWriter + Unpin + Send + Sync + 'static>, Error> {
+        if let Some(target) = self.0.services.peek(|s| {
+            s.get(addr).and_then(|s| {
+                s.0.bindings.peek(|b| {
+                    b.get(&port).and_then(|b| {
+                        b.iter()
+                            .find(|(_, rc)| rc.strong_count() > 0)
+                            .map(|(a, _)| *a)
+                    })
+                })
+            })
+        }) {
+            let tcp_stream = TcpStream::connect(target)
+                .await
+                .with_kind(ErrorKind::Network)?;
+            if let Err(e) = socket2::SockRef::from(&tcp_stream).set_keepalive(true) {
+                tracing::error!(
+                    "{}",
+                    t!("net.tor.failed-to-set-tcp-keepalive", error = e.to_string())
+                );
+                tracing::debug!("{e:?}");
+            }
+            Ok(Box::new(tcp_stream))
+        } else {
+            let mut client = self.0.client.clone();
+            client
+                .wait_for(|(_, c)| c.bootstrap_status().ready_for_traffic())
+                .await;
+            let stream = client
+                .read()
+                .1
+                .connect((addr.to_string(), port))
+                .await
+                .with_kind(ErrorKind::Tor)?;
+            Ok(Box::new(stream))
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct OnionService(Arc<OnionServiceData>);
+struct OnionServiceData {
+    service: Arc<SyncMutex<Option<Arc<RunningOnionService>>>>,
+    bindings: Arc<SyncRwLock<BTreeMap<u16, BTreeMap<SocketAddr, Weak<()>>>>>,
+    _thread: NonDetachingJoinHandle<()>,
+}
+impl OnionService {
+    fn launch(
+        mut client: Watch<(usize, TorClient<TokioRustlsRuntime>)>,
+        key: TorSecretKey,
+    ) -> Result<Self, Error> {
+        let service = Arc::new(SyncMutex::new(None));
+        let bindings = Arc::new(SyncRwLock::new(BTreeMap::<
+            u16,
+            BTreeMap<SocketAddr, Weak<()>>,
+        >::new()));
+        Ok(Self(Arc::new(OnionServiceData {
+            service: service.clone(),
+            bindings: bindings.clone(),
+            _thread: tokio::spawn(async move {
+                let (bg, mut runner) = BackgroundJobQueue::new();
+                runner
+                    .run_while(async {
+                        loop {
+                            if let Err(e) = async {
+                                client.wait_for(|(_,c)| c.bootstrap_status().ready_for_traffic()).await;
+                                let epoch = client.peek(|(e, c)| {
+                                    ensure_code!(c.bootstrap_status().ready_for_traffic(), ErrorKind::Tor, "TorClient recycled");
+                                    Ok::<_, Error>(*e)
+                                })?;
+                                let addr = key.onion_address();
+                                let (new_service, stream) = client.peek(|(_, c)| {
+                                    c.launch_onion_service_with_hsid(
+                                        OnionServiceConfigBuilder::default()
+                                            .nickname(
+                                                addr
+                                                    .to_string()
+                                                    .trim_end_matches(".onion")
+                                                    .parse::<HsNickname>()
+                                                    .with_kind(ErrorKind::Tor)?,
+                                            )
+                                            .build()
+                                            .with_kind(ErrorKind::Tor)?,
+                                        key.clone().0,
+                                    )
+                                    .with_kind(ErrorKind::Tor)
+                                })?;
+                                let mut status_stream = new_service.status_events();
+                                let mut status = new_service.status();
+                                if status.state().is_fully_reachable() {
+                                    tracing::debug!("{addr} is fully reachable");
+                                } else {
+                                    tracing::debug!("{addr} is not fully reachable");
+                                }
+                                bg.add_job(async move {
+                                    while let Some(new_status) = status_stream.next().await {
+                                        if status.state().is_fully_reachable() && !new_status.state().is_fully_reachable() {
+                                            tracing::debug!("{addr} is no longer fully reachable");
+                                        } else if !status.state().is_fully_reachable() && new_status.state().is_fully_reachable() {
+                                            tracing::debug!("{addr} is now fully reachable");
+                                        }
+                                        status = new_status;
+                                        // TODO: health daemon?
+                                    }
+                                });
+                                service.replace(Some(new_service));
+                                let mut stream = tor_hsservice::handle_rend_requests(stream);
+                                while let Some(req) = tokio::select! {
+                                    req = stream.next() => req,
+                                    _ = client.wait_for(|(e, _)| *e != epoch) => None
+                                } {
+                                    bg.add_job({
+                                        let bg = bg.clone();
+                                        let bindings = bindings.clone();
+                                        async move {
+                                            if let Err(e) = async {
+                                                let IncomingStreamRequest::Begin(begin) =
+                                                    req.request()
+                                                else {
+                                                    return req
+                                                        .reject(tor_cell::relaycell::msg::End::new_with_reason(
+                                                            tor_cell::relaycell::msg::EndReason::DONE,
+                                                        ))
+                                                        .await
+                                                        .with_kind(ErrorKind::Tor);
+                                                };
+                                                let Some(target) = bindings.peek(|b| {
+                                                    b.get(&begin.port()).and_then(|a| {
+                                                        a.iter()
+                                                            .find(|(_, rc)| rc.strong_count() > 0)
+                                                            .map(|(addr, _)| *addr)
+                                                    })
+                                                }) else {
+                                                    return req
+                                                        .reject(tor_cell::relaycell::msg::End::new_with_reason(
+                                                            tor_cell::relaycell::msg::EndReason::DONE,
+                                                        ))
+                                                        .await
+                                                        .with_kind(ErrorKind::Tor);
+                                                };
+                                                bg.add_job(async move {
+                                                    if let Err(e) = async {
+                                                        let mut outgoing =
+                                                            TcpStream::connect(target)
+                                                                .await
+                                                                .with_kind(ErrorKind::Network)?;
+                                                        if let Err(e) = socket2::SockRef::from(&outgoing).set_keepalive(true) {
+                                                            tracing::error!("{}", t!("net.tor.failed-to-set-tcp-keepalive", error = e.to_string()));
+                                                            tracing::debug!("{e:?}");
+                                                        }
+                                                        let mut incoming = req
+                                                            .accept(Connected::new_empty())
+                                                            .await
+                                                            .with_kind(ErrorKind::Tor)?;
+                                                        if let Err(e) =
+                                                            tokio::io::copy_bidirectional(
+                                                                &mut outgoing,
+                                                                &mut incoming,
+                                                            )
+                                                            .await
+                                                        {
+                                                            tracing::trace!("Tor Stream Error: {e}");
+                                                            tracing::trace!("{e:?}");
+                                                        }
+
+                                                        Ok::<_, Error>(())
+                                                    }
+                                                    .await
+                                                    {
+                                                        tracing::trace!("Tor Stream Error: {e}");
+                                                        tracing::trace!("{e:?}");
+                                                    }
+                                                });
+                                                Ok::<_, Error>(())
+                                            }
+                                            .await
+                                            {
+                                                tracing::trace!("Tor Request Error: {e}");
+                                                tracing::trace!("{e:?}");
+                                            }
+                                        }
+                                    });
+                                }
+                                Ok::<_, Error>(())
+                            }
+                            .await
+                            {
+                                tracing::error!("{}", t!("net.tor.client-error", error = e.to_string()));
+                                tracing::debug!("{e:?}");
+                            }
+                        }
+                    })
+                    .await
+            })
+            .into(),
+        })))
+    }
+
+    pub async fn proxy_all<Rcs: FromIterator<Arc<()>>>(
+        &self,
+        bindings: impl IntoIterator<Item = (u16, SocketAddr)>,
+    ) -> Result<Rcs, Error> {
+        Ok(self.0.bindings.mutate(|b| {
+            bindings
+                .into_iter()
+                .map(|(port, target)| {
+                    let entry = b.entry(port).or_default().entry(target).or_default();
+                    if let Some(rc) = entry.upgrade() {
+                        rc
+                    } else {
+                        let rc = Arc::new(());
+                        *entry = Arc::downgrade(&rc);
+                        rc
+                    }
+                })
+                .collect()
+        }))
+    }
+
+    pub fn gc(&self) -> bool {
+        self.0.bindings.mutate(|b| {
+            b.retain(|_, targets| {
+                targets.retain(|_, rc| rc.strong_count() > 0);
+                !targets.is_empty()
+            });
+            !b.is_empty()
+        })
+    }
+
+    pub async fn shutdown(self) -> Result<(), Error> {
+        self.0.service.replace(None);
+        self.0._thread.abort();
+        Ok(())
+    }
+
+    pub fn state(&self) -> OnionServiceState {
+        self.0
+            .service
+            .peek(|s| s.as_ref().map(|s| s.status().state().into()))
+            .unwrap_or(OnionServiceState::Bootstrapping)
+    }
+
+    pub fn info(&self) -> OnionServiceInfo {
+        OnionServiceInfo {
+            state: self.state(),
+            bindings: self.0.bindings.peek(|b| {
+                b.iter()
+                    .filter_map(|(port, b)| {
+                        b.iter()
+                            .find(|(_, rc)| rc.strong_count() > 0)
+                            .map(|(addr, _)| (*port, *addr))
+                    })
+                    .collect()
+            }),
+        }
+    }
+}

core/src/net/tor/mod.rs

@@ -0,0 +1,10 @@
+#[cfg(feature = "arti")]
+mod arti;
+
+#[cfg(not(feature = "arti"))]
+mod ctor;
+
+#[cfg(feature = "arti")]
+pub use arti::{OnionAddress, OnionStore, TorController, TorSecretKey, tor_api};
+#[cfg(not(feature = "arti"))]
+pub use ctor::{OnionAddress, OnionStore, TorController, TorSecretKey, tor_api};

core/src/net/tunnel.rs

@@ -8,7 +8,7 @@ use ts_rs::TS;
 
 use crate::GatewayId;
 use crate::context::{CliContext, RpcContext};
-use crate::db::model::public::{GatewayType, NetworkInterfaceInfo, NetworkInterfaceType};
+use crate::db::model::public::{NetworkInterfaceInfo, NetworkInterfaceType};
 use crate::net::host::all_hosts;
 use crate::prelude::*;
 use crate::util::Invoke;
@@ -32,19 +32,14 @@ pub fn tunnel_api<C: Context>() -> ParentHandler<C> {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, Parser, TS)]
-#[serde(rename_all = "camelCase")]
 #[ts(export)]
 pub struct AddTunnelParams {
     #[arg(help = "help.arg.tunnel-name")]
     name: InternedString,
     #[arg(help = "help.arg.wireguard-config")]
     config: String,
-    #[arg(help = "help.arg.gateway-type")]
-    #[serde(default, rename = "type")]
-    gateway_type: Option<GatewayType>,
-    #[arg(help = "help.arg.set-as-default-outbound")]
-    #[serde(default)]
-    set_as_default_outbound: bool,
+    #[arg(help = "help.arg.is-public")]
+    public: bool,
 }
 
 fn sanitize_config(config: &str) -> String {
@@ -69,8 +64,7 @@ pub async fn add_tunnel(
     AddTunnelParams {
         name,
         config,
-        gateway_type,
-        set_as_default_outbound,
+        public,
     }: AddTunnelParams,
 ) -> Result<GatewayId, Error> {
     let ifaces = ctx.net_controller.net_iface.watcher.subscribe();
@@ -82,9 +76,9 @@ pub async fn add_tunnel(
                     iface.clone(),
                     NetworkInterfaceInfo {
                         name: Some(name),
+                        public: Some(public),
                         secure: None,
                         ip_info: None,
-                        gateway_type,
                     },
                 );
                 return true;
@@ -126,19 +120,6 @@ pub async fn add_tunnel(
 
     sub.recv().await;
 
-    if set_as_default_outbound {
-        ctx.db
-            .mutate(|db| {
-                db.as_public_mut()
-                    .as_server_info_mut()
-                    .as_network_mut()
-                    .as_default_outbound_mut()
-                    .ser(&Some(iface.clone()))
-            })
-            .await
-            .result?;
-    }
-
     Ok(iface)
 }
 
@@ -175,14 +156,10 @@ pub async fn remove_tunnel(
 
     ctx.db
         .mutate(|db| {
-            let hostname = crate::hostname::Hostname(db.as_public().as_server_info().as_hostname().de()?);
-            let gateways = db.as_public().as_server_info().as_network().as_gateways().de()?;
-            let ports = db.as_private().as_available_ports().de()?;
             for host in all_hosts(db) {
                 let host = host?;
                 host.as_public_domains_mut()
                     .mutate(|p| Ok(p.retain(|_, v| v.gateway != id)))?;
-                host.update_addresses(&hostname, &gateways, &ports)?;
             }
 
             Ok(())
@@ -194,19 +171,14 @@ pub async fn remove_tunnel(
 
     ctx.db
         .mutate(|db| {
-            let hostname = crate::hostname::Hostname(db.as_public().as_server_info().as_hostname().de()?);
-            let gateways = db.as_public().as_server_info().as_network().as_gateways().de()?;
-            let ports = db.as_private().as_available_ports().de()?;
             for host in all_hosts(db) {
                 let host = host?;
-                host.as_private_domains_mut().mutate(|d| {
-                    for gateways in d.values_mut() {
-                        gateways.remove(&id);
-                    }
-                    d.retain(|_, gateways| !gateways.is_empty());
-                    Ok(())
+                host.as_bindings_mut().mutate(|b| {
+                    Ok(b.values_mut().for_each(|v| {
+                        v.net.private_disabled.remove(&id);
+                        v.net.public_enabled.remove(&id);
+                    }))
                 })?;
-                host.update_addresses(&hostname, &gateways, &ports)?;
             }
 
             Ok(())

core/src/net/vhost.rs

@@ -1,19 +1,19 @@
 use std::any::Any;
 use std::collections::{BTreeMap, BTreeSet};
 use std::fmt;
-use std::net::{IpAddr, SocketAddr, SocketAddrV6};
+use std::net::{IpAddr, SocketAddr};
 use std::sync::{Arc, Weak};
 use std::task::{Poll, ready};
+use std::time::Duration;
 
 use async_acme::acme::ACME_TLS_ALPN_NAME;
 use color_eyre::eyre::eyre;
 use futures::FutureExt;
 use futures::future::BoxFuture;
-use imbl::OrdMap;
 use imbl_value::{InOMap, InternedString};
 use rpc_toolkit::{Context, HandlerArgs, HandlerExt, ParentHandler, from_fn};
 use serde::{Deserialize, Serialize};
-use tokio::net::{TcpListener, TcpStream};
+use tokio::net::TcpStream;
 use tokio_rustls::TlsConnector;
 use tokio_rustls::rustls::crypto::CryptoProvider;
 use tokio_rustls::rustls::pki_types::ServerName;
@@ -23,28 +23,28 @@ use tracing::instrument;
 use ts_rs::TS;
 use visit_rs::Visit;
 
+use crate::ResultExt;
 use crate::context::{CliContext, RpcContext};
 use crate::db::model::Database;
-use crate::db::model::public::{AcmeSettings, NetworkInterfaceInfo};
+use crate::db::model::public::AcmeSettings;
 use crate::db::{DbAccessByKey, DbAccessMut};
 use crate::net::acme::{
     AcmeCertStore, AcmeProvider, AcmeTlsAlpnCache, AcmeTlsHandler, GetAcmeProvider,
 };
 use crate::net::gateway::{
-    GatewayInfo, NetworkInterfaceController, NetworkInterfaceListenerAcceptMetadata,
+    AnyFilter, BindTcp, DynInterfaceFilter, GatewayInfo, InterfaceFilter,
+    NetworkInterfaceController, NetworkInterfaceListener,
 };
 use crate::net::ssl::{CertStore, RootCaTlsHandler};
 use crate::net::tls::{
     ChainedHandler, TlsHandlerWrapper, TlsListener, TlsMetadata, WrapTlsHandler,
 };
-use crate::net::utils::ipv6_is_link_local;
 use crate::net::web_server::{Accept, AcceptStream, ExtractVisitor, TcpMetadata, extract};
 use crate::prelude::*;
 use crate::util::collections::EqSet;
 use crate::util::future::{NonDetachingJoinHandle, WeakFuture};
 use crate::util::serde::{HandlerExtSerde, MaybeUtf8String, display_serializable};
 use crate::util::sync::{SyncMutex, Watch};
-use crate::{GatewayId, ResultExt};
 
 pub fn vhost_api<C: Context>() -> ParentHandler<C> {
     ParentHandler::new().subcommand(
@@ -93,7 +93,7 @@ pub struct VHostController {
     interfaces: Arc<NetworkInterfaceController>,
     crypto_provider: Arc<CryptoProvider>,
     acme_cache: AcmeTlsAlpnCache,
-    servers: SyncMutex<BTreeMap<u16, VHostServer<VHostBindListener>>>,
+    servers: SyncMutex<BTreeMap<u16, VHostServer<NetworkInterfaceListener>>>,
 }
 impl VHostController {
     pub fn new(
@@ -114,22 +114,14 @@ impl VHostController {
         &self,
         hostname: Option<InternedString>,
         external: u16,
-        target: DynVHostTarget<VHostBindListener>,
+        target: DynVHostTarget<NetworkInterfaceListener>,
     ) -> Result<Arc<()>, Error> {
         self.servers.mutate(|writable| {
             let server = if let Some(server) = writable.remove(&external) {
                 server
             } else {
-                let bind_reqs = Watch::new(VHostBindRequirements::default());
-                let listener = VHostBindListener {
-                    ip_info: self.interfaces.watcher.subscribe(),
-                    port: external,
-                    bind_reqs: bind_reqs.clone_unseen(),
-                    listeners: BTreeMap::new(),
-                };
                 VHostServer::new(
-                    listener,
-                    bind_reqs,
+                    self.interfaces.watcher.bind(BindTcp, external)?,
                     self.db.clone(),
                     self.crypto_provider.clone(),
                     self.acme_cache.clone(),
@@ -181,142 +173,6 @@ impl VHostController {
     }
 }
 
-/// Union of all ProxyTargets' bind requirements for a VHostServer.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct VHostBindRequirements {
-    pub public_gateways: BTreeSet<GatewayId>,
-    pub private_ips: BTreeSet<IpAddr>,
-}
-
-fn compute_bind_reqs<A: Accept + 'static>(mapping: &Mapping<A>) -> VHostBindRequirements {
-    let mut reqs = VHostBindRequirements::default();
-    for (_, targets) in mapping {
-        for (target, rc) in targets {
-            if rc.strong_count() > 0 {
-                let (pub_gw, priv_ip) = target.0.bind_requirements();
-                reqs.public_gateways.extend(pub_gw);
-                reqs.private_ips.extend(priv_ip);
-            }
-        }
-    }
-    reqs
-}
-
-/// Listener that manages its own TCP listeners with IP-level precision.
-/// Binds ALL IPs of public gateways and ONLY matching private IPs.
-pub struct VHostBindListener {
-    ip_info: Watch<OrdMap<GatewayId, NetworkInterfaceInfo>>,
-    port: u16,
-    bind_reqs: Watch<VHostBindRequirements>,
-    listeners: BTreeMap<SocketAddr, (TcpListener, GatewayInfo)>,
-}
-
-fn update_vhost_listeners(
-    listeners: &mut BTreeMap<SocketAddr, (TcpListener, GatewayInfo)>,
-    port: u16,
-    ip_info: &OrdMap<GatewayId, NetworkInterfaceInfo>,
-    reqs: &VHostBindRequirements,
-) -> Result<(), Error> {
-    let mut keep = BTreeSet::<SocketAddr>::new();
-    for (gw_id, info) in ip_info {
-        if let Some(ip_info) = &info.ip_info {
-            for ipnet in &ip_info.subnets {
-                let ip = ipnet.addr();
-                let should_bind =
-                    reqs.public_gateways.contains(gw_id) || reqs.private_ips.contains(&ip);
-                if should_bind {
-                    let addr = match ip {
-                        IpAddr::V6(ip6) => SocketAddrV6::new(
-                            ip6,
-                            port,
-                            0,
-                            if ipv6_is_link_local(ip6) {
-                                ip_info.scope_id
-                            } else {
-                                0
-                            },
-                        )
-                        .into(),
-                        ip => SocketAddr::new(ip, port),
-                    };
-                    keep.insert(addr);
-                    if let Some((_, existing_info)) = listeners.get_mut(&addr) {
-                        *existing_info = GatewayInfo {
-                            id: gw_id.clone(),
-                            info: info.clone(),
-                        };
-                    } else {
-                        let tcp = TcpListener::from_std(
-                            mio::net::TcpListener::bind(addr)
-                                .with_kind(ErrorKind::Network)?
-                                .into(),
-                        )
-                        .with_kind(ErrorKind::Network)?;
-                        listeners.insert(
-                            addr,
-                            (
-                                tcp,
-                                GatewayInfo {
-                                    id: gw_id.clone(),
-                                    info: info.clone(),
-                                },
-                            ),
-                        );
-                    }
-                }
-            }
-        }
-    }
-    listeners.retain(|key, _| keep.contains(key));
-    Ok(())
-}
-
-impl Accept for VHostBindListener {
-    type Metadata = NetworkInterfaceListenerAcceptMetadata;
-    fn poll_accept(
-        &mut self,
-        cx: &mut std::task::Context<'_>,
-    ) -> Poll<Result<(Self::Metadata, AcceptStream), Error>> {
-        // Update listeners when ip_info or bind_reqs change
-        while self.ip_info.poll_changed(cx).is_ready() || self.bind_reqs.poll_changed(cx).is_ready()
-        {
-            let reqs = self.bind_reqs.read_and_mark_seen();
-            let listeners = &mut self.listeners;
-            let port = self.port;
-            self.ip_info.peek_and_mark_seen(|ip_info| {
-                update_vhost_listeners(listeners, port, ip_info, &reqs)
-            })?;
-        }
-
-        // Poll each listener for incoming connections
-        for (&addr, (listener, gw_info)) in &self.listeners {
-            match listener.poll_accept(cx) {
-                Poll::Ready(Ok((stream, peer_addr))) => {
-                    if let Err(e) = socket2::SockRef::from(&stream).set_keepalive(true) {
-                        tracing::error!("Failed to set tcp keepalive: {e}");
-                        tracing::debug!("{e:?}");
-                    }
-                    return Poll::Ready(Ok((
-                        NetworkInterfaceListenerAcceptMetadata {
-                            inner: TcpMetadata {
-                                local_addr: addr,
-                                peer_addr,
-                            },
-                            info: gw_info.clone(),
-                        },
-                        Box::pin(stream),
-                    )));
-                }
-                Poll::Ready(Err(e)) => {
-                    tracing::trace!("VHostBindListener accept error on {addr}: {e}");
-                }
-                Poll::Pending => {}
-            }
-        }
-        Poll::Pending
-    }
-}
-
 pub trait VHostTarget<A: Accept>: std::fmt::Debug + Eq {
     type PreprocessRes: Send + 'static;
     #[allow(unused_variables)]
@@ -326,10 +182,6 @@ pub trait VHostTarget<A: Accept>: std::fmt::Debug + Eq {
     fn acme(&self) -> Option<&AcmeProvider> {
         None
     }
-    /// Returns (public_gateways, private_ips) this target needs the listener to bind on.
-    fn bind_requirements(&self) -> (BTreeSet<GatewayId>, BTreeSet<IpAddr>) {
-        (BTreeSet::new(), BTreeSet::new())
-    }
     fn preprocess<'a>(
         &'a self,
         prev: ServerConfig,
@@ -348,7 +200,6 @@ pub trait VHostTarget<A: Accept>: std::fmt::Debug + Eq {
 pub trait DynVHostTargetT<A: Accept>: std::fmt::Debug + Any {
     fn filter(&self, metadata: &<A as Accept>::Metadata) -> bool;
     fn acme(&self) -> Option<&AcmeProvider>;
-    fn bind_requirements(&self) -> (BTreeSet<GatewayId>, BTreeSet<IpAddr>);
     fn preprocess<'a>(
         &'a self,
         prev: ServerConfig,
@@ -373,9 +224,6 @@ impl<A: Accept, T: VHostTarget<A> + 'static> DynVHostTargetT<A> for T {
     fn acme(&self) -> Option<&AcmeProvider> {
         VHostTarget::acme(self)
     }
-    fn bind_requirements(&self) -> (BTreeSet<GatewayId>, BTreeSet<IpAddr>) {
-        VHostTarget::bind_requirements(self)
-    }
     fn preprocess<'a>(
         &'a self,
         prev: ServerConfig,
@@ -453,8 +301,7 @@ impl<A: Accept + 'static> Preprocessed<A> {
 
 #[derive(Clone)]
 pub struct ProxyTarget {
-    pub public: BTreeSet<GatewayId>,
-    pub private: BTreeSet<IpAddr>,
+    pub filter: DynInterfaceFilter,
     pub acme: Option<AcmeProvider>,
     pub addr: SocketAddr,
     pub add_x_forwarded_headers: bool,
@@ -462,8 +309,7 @@ pub struct ProxyTarget {
 }
 impl PartialEq for ProxyTarget {
     fn eq(&self, other: &Self) -> bool {
-        self.public == other.public
-            && self.private == other.private
+        self.filter == other.filter
             && self.acme == other.acme
             && self.addr == other.addr
             && self.connect_ssl.as_ref().map(Arc::as_ptr)
@@ -474,8 +320,7 @@ impl Eq for ProxyTarget {}
 impl fmt::Debug for ProxyTarget {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         f.debug_struct("ProxyTarget")
-            .field("public", &self.public)
-            .field("private", &self.private)
+            .field("filter", &self.filter)
             .field("acme", &self.acme)
             .field("addr", &self.addr)
             .field("add_x_forwarded_headers", &self.add_x_forwarded_headers)
@@ -495,35 +340,16 @@ where
 {
     type PreprocessRes = AcceptStream;
     fn filter(&self, metadata: &<A as Accept>::Metadata) -> bool {
-        let gw = extract::<GatewayInfo, _>(metadata);
-        let tcp = extract::<TcpMetadata, _>(metadata);
-        let (Some(gw), Some(tcp)) = (gw, tcp) else {
-            return false;
-        };
-        let Some(ip_info) = &gw.info.ip_info else {
-            return false;
-        };
-
-        let src = tcp.peer_addr.ip();
-        // Public: source is outside all known subnets (direct internet)
-        let is_public = !ip_info.subnets.iter().any(|s| s.contains(&src));
-
-        if is_public {
-            self.public.contains(&gw.id)
-        } else {
-            // Private: accept if connection arrived on an interface with a matching IP
-            ip_info
-                .subnets
-                .iter()
-                .any(|s| self.private.contains(&s.addr()))
+        let info = extract::<GatewayInfo, _>(metadata);
+        if info.is_none() {
+            tracing::warn!("No GatewayInfo on metadata");
         }
+        info.as_ref()
+            .map_or(true, |i| self.filter.filter(&i.id, &i.info))
     }
     fn acme(&self) -> Option<&AcmeProvider> {
         self.acme.as_ref()
     }
-    fn bind_requirements(&self) -> (BTreeSet<GatewayId>, BTreeSet<IpAddr>) {
-        (self.public.clone(), self.private.clone())
-    }
     async fn preprocess<'a>(
         &'a self,
         mut prev: ServerConfig,
@@ -692,7 +518,6 @@ where
 
         let (target, rc) = self.0.peek(|m| {
             m.get(&hello.server_name().map(InternedString::from))
-                .or_else(|| m.get(&None))
                 .into_iter()
                 .flatten()
                 .filter(|(_, rc)| rc.strong_count() > 0)
@@ -809,15 +634,28 @@ where
 
 struct VHostServer<A: Accept + 'static> {
     mapping: Watch<Mapping<A>>,
-    bind_reqs: Watch<VHostBindRequirements>,
     _thread: NonDetachingJoinHandle<()>,
 }
 
+impl<'a> From<&'a BTreeMap<Option<InternedString>, BTreeMap<ProxyTarget, Weak<()>>>> for AnyFilter {
+    fn from(value: &'a BTreeMap<Option<InternedString>, BTreeMap<ProxyTarget, Weak<()>>>) -> Self {
+        Self(
+            value
+                .iter()
+                .flat_map(|(_, v)| {
+                    v.iter()
+                        .filter(|(_, r)| r.strong_count() > 0)
+                        .map(|(t, _)| t.filter.clone())
+                })
+                .collect(),
+        )
+    }
+}
+
 impl<A: Accept> VHostServer<A> {
     #[instrument(skip_all)]
     fn new<M: HasModel>(
         listener: A,
-        bind_reqs: Watch<VHostBindRequirements>,
         db: TypedPatchDb<M>,
         crypto_provider: Arc<CryptoProvider>,
         acme_cache: AcmeTlsAlpnCache,
@@ -841,7 +679,6 @@ impl<A: Accept> VHostServer<A> {
         let mapping = Watch::new(BTreeMap::new());
         Self {
             mapping: mapping.clone(),
-            bind_reqs,
             _thread: tokio::spawn(async move {
                 let mut listener = VHostListener(TlsListener::new(
                     listener,
@@ -892,9 +729,6 @@ impl<A: Accept> VHostServer<A> {
             targets.insert(target, Arc::downgrade(&rc));
             writable.insert(hostname, targets);
             res = Ok(rc);
-            if changed {
-                self.update_bind_reqs(writable);
-            }
             changed
         });
         if self.mapping.watcher_count() > 1 {
@@ -918,23 +752,9 @@ impl<A: Accept> VHostServer<A> {
             if !targets.is_empty() {
                 writable.insert(hostname, targets);
             }
-            if pre != post {
-                self.update_bind_reqs(writable);
-            }
             pre == post
         });
     }
-    fn update_bind_reqs(&self, mapping: &Mapping<A>) {
-        let new_reqs = compute_bind_reqs(mapping);
-        self.bind_reqs.send_if_modified(|reqs| {
-            if *reqs != new_reqs {
-                *reqs = new_reqs;
-                true
-            } else {
-                false
-            }
-        });
-    }
     fn is_empty(&self) -> bool {
         self.mapping.peek(|m| m.is_empty())
     }