feat(controller,sysupgrade): openwrt upgrade controller

chore: use date based versioning
feat: host-based routing in proxy
2023-03-24 23:17:55 +01:00 · 2023-03-22 18:41:18 +01:00 · 2023-03-22 18:15:22 +01:00 · 2023-03-21 16:20:59 +01:00 · 2023-03-21 16:20:36 +01:00 · 2023-03-21 16:05:29 +01:00
51 changed files with 1105 additions and 369 deletions
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@ -64,7 +64,7 @@ archives:
 checksum:
  name_template: 'checksums.txt'
 snapshot:
-  name_template: "{{ incpatch .Version }}-next"
+  name_template: "{{ .Version }}"
 changelog:
  sort: asc
  filters:
--- a/16
+++ b/16
@ -1,14 +1,16 @@
 LINT_ARGS ?= --timeout 5m
 GORELEASER_VERSION ?= v1.13.1
-GORELEASER_ARGS ?= release --auto-snapshot --snapshot --rm-dist
+GORELEASER_ARGS ?= release --snapshot --rm-dist
 GITCHLOG_ARGS ?=
 SHELL := /bin/bash

 EMISSARY_VERSION ?= 
-GIT_VERSION ?= $(shell git describe --always)
+GIT_VERSION := $(shell git describe --always)
+DATE_VERSION := $(shell date +%Y.%-m.%-d)
+FULL_VERSION := v$(DATE_VERSION)-$(GIT_VERSION)$(if $(shell git diff --stat),-dirty,)

 DOCKER_IMAGE_NAME ?= bornholm/emissary
-DOCKER_IMAGE_TAG ?= $(GIT_VERSION)$(if $(shell git diff --stat),-dirty,)
+DOCKER_IMAGE_TAG ?= $(FULL_VERSION)

 GOTEST_ARGS ?= -short

@ -43,7 +45,7 @@ build-emissary-%: deps ## Build executable
 		-v \
 		-ldflags "\
 			-X 'main.GitRef=$(shell git rev-parse --short HEAD)' \
-			-X 'main.ProjectVersion=$(shell git describe --always)' \
+			-X 'main.ProjectVersion=$(FULL_VERSION)' \
 			-X 'main.BuildDate=$(shell date --utc --rfc-3339=seconds)' \
 		" \
 		-o ./bin/$* \
@ -73,7 +75,7 @@ dump-config: build-emissary

 .PHONY: goreleaser
 goreleaser: deps
-	( set -o allexport && source .env && set +o allexport && VERSION=$(GORELEASER_VERSION) curl -sfL https://goreleaser.com/static/run | bash /dev/stdin $(GORELEASER_ARGS) )
+	( set -o allexport && source .env && set +o allexport && VERSION=$(GORELEASER_VERSION) curl -sfL https://goreleaser.com/static/run | GORELEASER_CURRENT_TAG="$(FULL_VERSION)" bash /dev/stdin $(GORELEASER_ARGS) )

 .PHONY: start-release
 start-release:
@ -126,8 +128,8 @@ gitea-release: tools/gitea-release/bin/gitea-release.sh goreleaser
 	GITEA_RELEASE_PROJECT="emissary" \
 		GITEA_RELEASE_ORG="arcad" \
 		GITEA_RELEASE_BASE_URL="https://forge.cadoles.com" \
-		GITEA_RELEASE_VERSION="$(GIT_VERSION)" \
-		GITEA_RELEASE_NAME="$(GIT_VERSION)" \
+		GITEA_RELEASE_VERSION="$(FULL_VERSION)" \
+		GITEA_RELEASE_NAME="$(FULL_VERSION)" \
 		GITEA_RELEASE_COMMITISH_TARGET="$(GIT_VERSION)" \
 		GITEA_RELEASE_IS_DRAFT="false" \
 		GITEA_RELEASE_BODY="" \
--- a/cmd/agent/main.go
+++ b/cmd/agent/main.go
@ -6,6 +6,8 @@ import (
 	"forge.cadoles.com/Cadoles/emissary/internal/command"
 	"forge.cadoles.com/Cadoles/emissary/internal/command/agent"
 	"forge.cadoles.com/Cadoles/emissary/internal/command/api"
+
+	_ "forge.cadoles.com/Cadoles/emissary/internal/imports/spec"
 )

 // nolint: gochecknoglobals
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@ -7,8 +7,9 @@ import (
 	"forge.cadoles.com/Cadoles/emissary/internal/command/api"
 	"forge.cadoles.com/Cadoles/emissary/internal/command/server"

-	_ "github.com/jackc/pgx/v5/stdlib"
-	_ "modernc.org/sqlite"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/imports/format"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/imports/spec"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/imports/sql"
 )

 // nolint: gochecknoglobals
--- a/go.mod
+++ b/go.mod
@ -3,24 +3,25 @@ module forge.cadoles.com/Cadoles/emissary
 go 1.19

 require (
-	forge.cadoles.com/arcad/edge v0.0.0-20230310133312-fd12d2ba42fa
+	forge.cadoles.com/arcad/edge v0.0.0-20230322170544-cf8a3f8ac077
 	github.com/alecthomas/participle/v2 v2.0.0-beta.5
 	github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
 	github.com/btcsuite/btcd/btcutil v1.1.3
 	github.com/davecgh/go-spew v1.1.1
 	github.com/denisbrodbeck/machineid v1.0.1
+	github.com/dop251/goja v0.0.0-20230304130813-e2f543bf4b4c
 	github.com/evanphx/json-patch/v5 v5.6.0
 	github.com/go-chi/chi v4.1.2+incompatible
 	github.com/go-chi/cors v1.2.1
 	github.com/golang-migrate/migrate/v4 v4.15.2
 	github.com/jackc/pgx/v5 v5.3.1
 	github.com/jedib0t/go-pretty/v6 v6.4.4
-	github.com/lestrrat-go/jwx/v2 v2.0.8
+	github.com/lestrrat-go/jwx/v2 v2.0.9
 	github.com/lithammer/shortuuid/v4 v4.0.0
+	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/pkg/errors v0.9.1
 	github.com/qri-io/jsonschema v0.2.1
-	github.com/santhosh-tekuri/jsonschema/v5 v5.1.1
 	github.com/urfave/cli/v2 v2.24.4
 	gitlab.com/wpetit/goweb v0.0.0-20230227162855-a1f09bafccb3
 	gopkg.in/yaml.v3 v3.0.1
@ -29,18 +30,15 @@ require (

 require (
 	github.com/barnybug/go-cast v0.0.0-20201201064555-a87ccbc26692 // indirect
-	github.com/dop251/goja v0.0.0-20230304130813-e2f543bf4b4c // indirect
-	github.com/dop251/goja_nodejs v0.0.0-20230226152057-060fa99b809f // indirect
+	github.com/dop251/goja_nodejs v0.0.0-20230320130059-dcf93ba651dd // indirect
 	github.com/gabriel-vasile/mimetype v1.4.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/google/pprof v0.0.0-20230309165930-d61513b1440d // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/hashicorp/mdns v1.0.5 // indirect
 	github.com/igm/sockjs-go/v3 v3.0.2 // indirect
 	github.com/miekg/dns v1.1.51 // indirect
-	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/oklog/ulid/v2 v2.1.0 // indirect
 	github.com/orcaman/concurrent-map v1.0.0 // indirect
 	golang.org/x/net v0.8.0 // indirect
@ -49,17 +47,17 @@ require (
 )

 require (
-	cdr.dev/slog v1.4.1 // indirect
+	cdr.dev/slog v1.4.2 // indirect
 	github.com/alecthomas/chroma v0.10.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0 // indirect
 	github.com/dlclark/regexp2 v1.8.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/fatih/color v1.14.1 // indirect
+	github.com/fatih/color v1.15.0 // indirect
 	github.com/go-chi/chi/v5 v5.0.8
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/goccy/go-json v0.9.11 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@ -73,7 +71,7 @@ require (
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/httprc v1.0.4 // indirect
 	github.com/lestrrat-go/iter v1.0.2 // indirect
-	github.com/lestrrat-go/option v1.0.0 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/lib/pq v1.10.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.17 // indirect
@ -107,3 +105,5 @@ require (
 	modernc.org/strutil v1.1.3 // indirect
 	modernc.org/token v1.1.0 // indirect
 )
+
+// replace forge.cadoles.com/arcad/edge => ../edge
--- a/go.sum
+++ b/go.sum
@ -1,8 +1,8 @@
 bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
 bazil.org/fuse v0.0.0-20200407214033-5883e5a4b512/go.mod h1:FbcW6z/2VytnFDhZfumh8Ss8zxHE6qpMP5sHTRe0EaM=
 cdr.dev/slog v1.4.0/go.mod h1:C5OL99WyuOK8YHZdYY57dAPN1jK2WJlCdq2VP6xeQns=
-cdr.dev/slog v1.4.1 h1:Q8+X63m8/WB4geelMTDO8t4CTwVh1f7+5Cxi7kS/SZg=
-cdr.dev/slog v1.4.1/go.mod h1:O76C6gZJxa5HK1SXMrjd48V2kJxYZKFRTcFfn/V9OhA=
+cdr.dev/slog v1.4.2 h1:fIfiqASYQFJBZiASwL825atyzeA96NsqSxx2aL61P8I=
+cdr.dev/slog v1.4.2/go.mod h1:0EkH+GkFNxizNR+GAXUEdUHanxUH5t9zqPILmPM/Vn8=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@ -54,10 +54,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-forge.cadoles.com/arcad/edge v0.0.0-20230303153719-6399196fe5c9 h1:dleaaf/rV2GWtGvrPunRakjrKVDfXoANxAy8/1ctMVs=
-forge.cadoles.com/arcad/edge v0.0.0-20230303153719-6399196fe5c9/go.mod h1:pl9EMtSLSVr4wbDgQBDjr4aizwtmwasE686dm5arYPw=
-forge.cadoles.com/arcad/edge v0.0.0-20230310133312-fd12d2ba42fa h1:dk0rNaBuCx0SxWTZBodg/y655tBaRtgLcW2hDqZRdxg=
-forge.cadoles.com/arcad/edge v0.0.0-20230310133312-fd12d2ba42fa/go.mod h1:pl9EMtSLSVr4wbDgQBDjr4aizwtmwasE686dm5arYPw=
+forge.cadoles.com/arcad/edge v0.0.0-20230322170544-cf8a3f8ac077 h1:vsYcNHZevZrs0VeOTasvJoqvPynb8OvH+MMpIUvNT6Q=
+forge.cadoles.com/arcad/edge v0.0.0-20230322170544-cf8a3f8ac077/go.mod h1:ONd6vyQ0IM0vHi1i+bmZBRc1Fd0BoXMuDdY/+0sZefw=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
 github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
@ -125,13 +123,11 @@ github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38 h1:smF2tmSOzy2Mm
 github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38/go.mod h1:r7bzyVFMNntcxPZXK3/+KdruV1H5KSlyVY0gc+NgInI=
 github.com/alecthomas/assert/v2 v2.0.3 h1:WKqJODfOiQG0nEJKFKzDIG3E29CN2/4zR9XGJzKIkbg=
 github.com/alecthomas/chroma v0.7.0/go.mod h1:1U/PfCsTALWWYHDnsIQkxEBM0+6LLe0v8+RSVMOwxeY=
-github.com/alecthomas/chroma v0.9.1/go.mod h1:eMuEnpA18XbG/WhOWtCzJHS7WqEtDAI+HxdwoW0nVSk=
 github.com/alecthomas/chroma v0.10.0 h1:7XDcGkCQopCNKjZHfYrNLraA+M7e0fMiJ/Mfikbfjek=
 github.com/alecthomas/chroma v0.10.0/go.mod h1:jtJATyUxlIORhUOFNA9NZDWGAQ8wpxQQqNSB4rjA/1s=
 github.com/alecthomas/colour v0.0.0-20160524082231-60882d9e2721/go.mod h1:QO9JBoKquHd+jz9nshCh40fOfO+JzsoXy8qTHF68zU0=
 github.com/alecthomas/kong v0.1.17-0.20190424132513-439c674f7ae0/go.mod h1:+inYUSluD+p4L8KdviBSgzcqEjUQOfC5fQDRFuc36lI=
 github.com/alecthomas/kong v0.2.1-0.20190708041108-0548c6b1afae/go.mod h1:+inYUSluD+p4L8KdviBSgzcqEjUQOfC5fQDRFuc36lI=
-github.com/alecthomas/kong v0.2.4/go.mod h1:kQOmtJgV+Lb4aj+I2LEn40cbtawdWJ9Y8QLq+lElKxE=
 github.com/alecthomas/kong-hcl v0.1.8-0.20190615233001-b21fea9723c8/go.mod h1:MRgZdU3vrFd05IQ89AxUZ0aYdF39BYoNFa324SodPCA=
 github.com/alecthomas/participle/v2 v2.0.0-beta.5 h1:y6dsSYVb1G5eK6mgmy+BgI3Mw35a3WghArZ/Hbebrjo=
 github.com/alecthomas/participle/v2 v2.0.0-beta.5/go.mod h1:RC764t6n4L8D8ITAJv0qdokritYSNR3wV5cVwmIEaMM=
@ -448,14 +444,12 @@ github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZ
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dop251/goja v0.0.0-20211022113120-dc8c55024d06/go.mod h1:R9ET47fwRVRPZnOGvHxxhuZcbrMCuiqOz3Rlrh4KSnk=
 github.com/dop251/goja v0.0.0-20221118162653-d4bf6fde1b86/go.mod h1:yRkwfj0CBpOGre+TwBsqPV0IH0Pk73e4PXJOeNDboGs=
-github.com/dop251/goja v0.0.0-20230226152633-7c93113e17ac h1:NGu46Adk2oPN3tinGFItahy4W9l+9uhEf03ZxbwmdVE=
-github.com/dop251/goja v0.0.0-20230226152633-7c93113e17ac/go.mod h1:yRkwfj0CBpOGre+TwBsqPV0IH0Pk73e4PXJOeNDboGs=
 github.com/dop251/goja v0.0.0-20230304130813-e2f543bf4b4c h1:/utv6nmTctV6OVgfk5+O6lEMEWL+6KJy4h9NZ5fnkQQ=
 github.com/dop251/goja v0.0.0-20230304130813-e2f543bf4b4c/go.mod h1:QMWlm50DNe14hD7t24KEqZuUdC9sOTy8W6XbCU1mlw4=
 github.com/dop251/goja_nodejs v0.0.0-20210225215109-d91c329300e7/go.mod h1:hn7BA7c8pLvoGndExHudxTDKZ84Pyvv+90pbBjbTz0Y=
 github.com/dop251/goja_nodejs v0.0.0-20211022123610-8dd9abb0616d/go.mod h1:DngW8aVqWbuLRMHItjPUyqdj+HWPvnQe8V8y1nDpIbM=
-github.com/dop251/goja_nodejs v0.0.0-20230226152057-060fa99b809f h1:mmnNidRg3cMfcgyeNtIBSDZgjf/85lA/2pplccwSxYg=
-github.com/dop251/goja_nodejs v0.0.0-20230226152057-060fa99b809f/go.mod h1:0tlktQL7yHfYEtjcRGi/eiOkbDR5XF7gyFFvbC5//E0=
+github.com/dop251/goja_nodejs v0.0.0-20230320130059-dcf93ba651dd h1:8FguYHL/davT0sAfVoi84iRI4MCVTVFtlnmZqIoAXDQ=
+github.com/dop251/goja_nodejs v0.0.0-20230320130059-dcf93ba651dd/go.mod h1:0tlktQL7yHfYEtjcRGi/eiOkbDR5XF7gyFFvbC5//E0=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@ -480,9 +474,9 @@ github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQL
 github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
 github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
-github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
-github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
+github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
+github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
 github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
@ -583,8 +577,8 @@ github.com/gobuffalo/packd v0.1.0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWe
 github.com/gobuffalo/packr/v2 v2.0.9/go.mod h1:emmyGweYTm6Kdper+iywB6YK5YzuKchGtJQZ0Odn4pQ=
 github.com/gobuffalo/packr/v2 v2.2.0/go.mod h1:CaAwI0GPIAv+5wKLtv8Afwl+Cm78K/I/VCm/3ptBN+0=
 github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
-github.com/goccy/go-json v0.9.11 h1:/pAaQDLHEoCq/5FFmSKBswWmK6H0e8g4159Kc/X/nqk=
-github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gocql/gocql v0.0.0-20210515062232-b7ef815b4556/go.mod h1:DL0ekTmBSTdlNF25Orwt/JMzqIq3EJ4MVa/J/uK64OY=
 github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
@ -604,8 +598,6 @@ github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXP
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
-github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.1.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-migrate/migrate/v4 v4.15.2 h1:vU+M05vs6jWHKDdmE1Ecwj0BznygFc4QsdRe2E/L7kc=
@ -696,7 +688,6 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
 github.com/google/pprof v0.0.0-20230207041349-798e818bf904/go.mod h1:uglQLonpP8qtYCYyzA+8c/9qtqgA3qsXGYqCPKARAFg=
 github.com/google/pprof v0.0.0-20230309165930-d61513b1440d h1:um9/pc7tKMINFfP1eE7Wv6PRGXlcCSJkVajF7KJw3uQ=
 github.com/google/pprof v0.0.0-20230309165930-d61513b1440d/go.mod h1:79YE0hCXdHag9sBkw2o+N/YnZtTkXi0UT9Nnixa5eYk=
@ -913,10 +904,11 @@ github.com/lestrrat-go/httprc v1.0.4 h1:bAZymwoZQb+Oq8MEbyipag7iSq6YIga8Wj6GOiJG
 github.com/lestrrat-go/httprc v1.0.4/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
 github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
 github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
-github.com/lestrrat-go/jwx/v2 v2.0.8 h1:jCFT8oc0hEDVjgUgsBy1F9cbjsjAVZSXNi7JaU9HR/Q=
-github.com/lestrrat-go/jwx/v2 v2.0.8/go.mod h1:zLxnyv9rTlEvOUHbc48FAfIL8iYu2hHvIRaTFGc8mT0=
-github.com/lestrrat-go/option v1.0.0 h1:WqAWL8kh8VcSoD6xjSH34/1m8yxluXQbDeKNfvFeEO4=
+github.com/lestrrat-go/jwx/v2 v2.0.9 h1:TRX4Q630UXxPVLvP5vGaqVJO7S+0PE6msRZUsFSBoC8=
+github.com/lestrrat-go/jwx/v2 v2.0.9/go.mod h1:K68euYaR95FnL0hIQB8VvzL70vB7pSifbJUydCTPmgM=
 github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
+github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
+github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@ -945,7 +937,7 @@ github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcncea
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
@ -957,6 +949,7 @@ github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@ -1028,7 +1021,6 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLA
 github.com/nkovacs/streamquote v0.0.0-20170412213628-49af9bddb229/go.mod h1:0aYXnNPJ8l7uZxf45rWW1a/uME32OF0rhiYGNQ2oF2E=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/oklog/ulid/v2 v2.1.0 h1:+9lhoxAP56we25tyYETBBY1YLA2SaoLvUFgrP2miPJU=
 github.com/oklog/ulid/v2 v2.1.0/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
@ -1177,8 +1169,6 @@ github.com/rwtodd/Go.Sed v0.0.0-20210816025313-55464686f9ef/go.mod h1:8AEUvGVi2u
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/safchain/ethtool v0.0.0-20210803160452-9aa261dae9b1/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
-github.com/santhosh-tekuri/jsonschema/v5 v5.1.1 h1:lEOLY2vyGIqKWUI9nzsOJRV3mb3WC9dXYORsLEUcoeY=
-github.com/santhosh-tekuri/jsonschema/v5 v5.1.1/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
@ -1355,6 +1345,7 @@ go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
 go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
@ -1388,9 +1379,6 @@ golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@ -1510,7 +1498,6 @@ golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220111093109-d55c255bac03/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@ -1519,8 +1506,7 @@ golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/oauth2 v0.0.0-20180227000427-d7d64896b5ff/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@ -1613,7 +1599,6 @@ golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200413165638-669c56c373c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@ -1686,7 +1671,6 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@ -1697,7 +1681,6 @@ golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuX
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
-golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
@ -1713,7 +1696,6 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
--- a/internal/agent/agent.go
+++ b/internal/agent/agent.go
@ -39,28 +39,32 @@ func (a *Agent) Run(ctx context.Context) error {

 	ctx = withClient(ctx, client)

+	tick := func() {
+		logger.Debug(ctx, "registering agent")
+
+		if err := a.registerAgent(ctx, client, state); err != nil {
+			logger.Error(ctx, "could not register agent", logger.E(errors.WithStack(err)))
+
+			return
+		}
+
+		logger.Debug(ctx, "state before reconciliation", logger.F("state", state))
+
+		if err := a.Reconcile(ctx, state); err != nil {
+			logger.Error(ctx, "could not reconcile node with state", logger.E(errors.WithStack(err)))
+
+			return
+		}
+
+		logger.Debug(ctx, "state after reconciliation", logger.F("state", state))
+	}
+
+	tick()
+
 	for {
 		select {
 		case <-ticker.C:
-
-			logger.Debug(ctx, "registering agent")
-
-			if err := a.registerAgent(ctx, client, state); err != nil {
-				logger.Error(ctx, "could not register agent", logger.E(errors.WithStack(err)))
-
-				continue
-			}
-
-			logger.Debug(ctx, "state before reconciliation", logger.F("state", state))
-
-			if err := a.Reconcile(ctx, state); err != nil {
-				logger.Error(ctx, "could not reconcile node with state", logger.E(errors.WithStack(err)))
-
-				continue
-			}
-
-			logger.Debug(ctx, "state after reconciliation", logger.F("state", state))
-
+			tick()
 		case <-ctx.Done():
 			return errors.WithStack(ctx.Err())
 		}
--- a/internal/agent/controller/app/controller.go
+++ b/internal/agent/controller/app/controller.go
@ -100,14 +100,14 @@ func (c *Controller) updateApps(ctx context.Context, spec *app.Spec) {
 	for appID, appSpec := range spec.Apps {
 		appCtx := logger.With(ctx, logger.F("appID", appID))

-		if err := c.updateApp(ctx, appID, appSpec); err != nil {
+		if err := c.updateApp(ctx, appID, appSpec, spec.Auth); err != nil {
 			logger.Error(appCtx, "could not update app", logger.E(errors.WithStack(err)))
 			continue
 		}
 	}
 }

-func (c *Controller) updateApp(ctx context.Context, appID string, appSpec app.AppEntry) (err error) {
+func (c *Controller) updateApp(ctx context.Context, appID string, appSpec app.AppEntry, auth *app.Auth) (err error) {
 	newAppSpecHash, err := hashstructure.Hash(appSpec, hashstructure.FormatV2, nil)
 	if err != nil {
 		return errors.WithStack(err)
@ -150,7 +150,7 @@ func (c *Controller) updateApp(ctx context.Context, appID string, appSpec app.Ap
 		}

 		entry = &serverEntry{
-			Server:   NewServer(bundle, db),
+			Server:   NewServer(bundle, db, auth),
 			SpecHash: 0,
 		}

--- a/internal/agent/controller/app/server.go
+++ b/internal/agent/controller/app/server.go
@ -6,12 +6,14 @@ import (
 	"net/http"
 	"sync"

+	appSpec "forge.cadoles.com/Cadoles/emissary/internal/spec/app"
 	"forge.cadoles.com/arcad/edge/pkg/app"
 	"forge.cadoles.com/arcad/edge/pkg/bus"
 	"forge.cadoles.com/arcad/edge/pkg/bus/memory"
 	edgeHTTP "forge.cadoles.com/arcad/edge/pkg/http"
 	"forge.cadoles.com/arcad/edge/pkg/module"
 	"forge.cadoles.com/arcad/edge/pkg/module/auth"
+	authHTTP "forge.cadoles.com/arcad/edge/pkg/module/auth/http"
 	"forge.cadoles.com/arcad/edge/pkg/module/cast"
 	"forge.cadoles.com/arcad/edge/pkg/module/net"
 	"forge.cadoles.com/arcad/edge/pkg/storage"
@ -22,7 +24,11 @@ import (
 	"github.com/dop251/goja"
 	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/chi/v5"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/pkg/errors"
+
+	_ "forge.cadoles.com/Cadoles/emissary/internal/imports/passwd"
 )

 type Server struct {
@ -30,6 +36,8 @@ type Server struct {
 	db          *sql.DB
 	server      *http.Server
 	serverMutex sync.RWMutex
+	auth        *appSpec.Auth
+	keySet      jwk.Set
 }

 func (s *Server) Start(ctx context.Context, addr string) (err error) {
@ -55,6 +63,37 @@ func (s *Server) Start(ctx context.Context, addr string) (err error) {
 		return errors.Wrap(err, "could not load app bundle")
 	}

+	if s.auth != nil {
+		if s.auth.Local != nil {
+			var rawKey any = s.auth.Local.Key
+			if strKey, ok := rawKey.(string); ok {
+				rawKey = []byte(strKey)
+			}
+
+			key, err := jwk.FromRaw(rawKey)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			if err := key.Set(jwk.AlgorithmKey, jwa.HS256); err != nil {
+				return errors.WithStack(err)
+			}
+
+			keySet := jwk.NewSet()
+			if err := keySet.AddKey(key); err != nil {
+				return errors.WithStack(err)
+			}
+
+			s.keySet = keySet
+
+			router.Handle("/auth/*", authHTTP.NewLocalHandler(
+				jwa.HS256, key,
+				authHTTP.WithRoutePrefix("/auth"),
+				authHTTP.WithAccounts(s.auth.Local.Accounts...),
+			))
+		}
+	}
+
 	router.Handle("/*", handler)

 	server := &http.Server{
@ -129,9 +168,19 @@ func (s *Server) getAppModules(bus bus.Bus, ds storage.DocumentStore, bs storage
 		module.StoreModuleFactory(ds),
 		module.BlobModuleFactory(bus, bs),
 		module.Extends(
-			auth.ModuleFactory(),
+			auth.ModuleFactory(
+				auth.WithJWT(s.getJWTKeySet),
+			),
 			func(o *goja.Object) {
-				if err := o.Set("CLAIM_ROLE", "role"); err != nil {
+				if err := o.Set("CLAIM_TENANT", "arcad_tenant"); err != nil {
+					panic(errors.New("could not set 'CLAIM_TENANT' property"))
+				}
+
+				if err := o.Set("CLAIM_ENTRYPOINT", "arcad_entrypoint"); err != nil {
+					panic(errors.New("could not set 'CLAIM_ENTRYPOINT' property"))
+				}
+
+				if err := o.Set("CLAIM_ROLE", "arcad_role"); err != nil {
 					panic(errors.New("could not set 'CLAIM_ROLE' property"))
 				}

@ -143,9 +192,14 @@ func (s *Server) getAppModules(bus bus.Bus, ds storage.DocumentStore, bs storage
 	}
 }

-func NewServer(bundle bundle.Bundle, db *sql.DB) *Server {
+func (s *Server) getJWTKeySet() (jwk.Set, error) {
+	return s.keySet, nil
+}
+
+func NewServer(bundle bundle.Bundle, db *sql.DB, auth *appSpec.Auth) *Server {
 	return &Server{
 		bundle: bundle,
 		db:     db,
+		auth:   auth,
 	}
 }
--- a/internal/agent/controller/gateway/controller.go
+++ b/internal/agent/controller/gateway/controller.go
@ -1,124 +0,0 @@
-package gateway
-
-import (
-	"context"
-
-	"forge.cadoles.com/Cadoles/emissary/internal/agent"
-	"forge.cadoles.com/Cadoles/emissary/internal/spec/gateway"
-	"github.com/pkg/errors"
-	"gitlab.com/wpetit/goweb/logger"
-)
-
-type Controller struct {
-	proxies             map[gateway.ID]*ReverseProxy
-	currentSpecRevision int
-}
-
-// Name implements node.Controller.
-func (c *Controller) Name() string {
-	return "gateway-controller"
-}
-
-// Reconcile implements node.Controller.
-func (c *Controller) Reconcile(ctx context.Context, state *agent.State) error {
-	gatewaySpec := gateway.NewSpec()
-
-	if err := state.GetSpec(gateway.NameGateway, gatewaySpec); err != nil {
-		if errors.Is(err, agent.ErrSpecNotFound) {
-			logger.Info(ctx, "could not find gateway spec, stopping all remaining proxies")
-
-			c.stopAllProxies(ctx)
-
-			return nil
-		}
-
-		return errors.WithStack(err)
-	}
-
-	logger.Info(ctx, "retrieved spec", logger.F("spec", gatewaySpec.SpecName()), logger.F("revision", gatewaySpec.SpecRevision()))
-
-	if c.currentSpecRevision == gatewaySpec.SpecRevision() {
-		logger.Info(ctx, "spec revision did not change, doing nothing")
-
-		return nil
-	}
-
-	c.updateProxies(ctx, gatewaySpec)
-
-	c.currentSpecRevision = gatewaySpec.SpecRevision()
-	logger.Info(ctx, "updating current spec revision", logger.F("revision", c.currentSpecRevision))
-
-	return nil
-}
-
-func (c *Controller) stopAllProxies(ctx context.Context) {
-	for gatewayID, proxy := range c.proxies {
-		logger.Info(ctx, "stopping proxy", logger.F("gatewayID", gatewayID))
-
-		if err := proxy.Stop(); err != nil {
-			logger.Error(
-				ctx, "error while stopping proxy",
-				logger.F("gatewayID", gatewayID),
-				logger.E(errors.WithStack(err)),
-			)
-
-			delete(c.proxies, gatewayID)
-		}
-	}
-}
-
-func (c *Controller) updateProxies(ctx context.Context, spec *gateway.Spec) {
-	// Stop and remove obsolete gateways
-	for gatewayID, proxy := range c.proxies {
-		if _, exists := spec.Gateways[gatewayID]; exists {
-			continue
-		}
-
-		logger.Info(ctx, "stopping proxy", logger.F("gatewayID", gatewayID))
-
-		if err := proxy.Stop(); err != nil {
-			logger.Error(
-				ctx, "error while stopping proxy",
-				logger.F("gatewayID", gatewayID),
-				logger.E(errors.WithStack(err)),
-			)
-
-			delete(c.proxies, gatewayID)
-		}
-	}
-
-	// (Re)start gateways
-	for gatewayID, gatewaySpec := range spec.Gateways {
-		proxy, exists := c.proxies[gatewayID]
-		if !exists {
-			proxy = NewReverseProxy()
-			c.proxies[gatewayID] = proxy
-		}
-
-		logger.Info(
-			ctx, "starting proxy",
-			logger.F("gatewayID", gatewayID),
-			logger.F("addr", gatewaySpec.Address),
-			logger.F("target", gatewaySpec.Target),
-		)
-
-		if err := proxy.Start(ctx, gatewaySpec.Address, gatewaySpec.Target); err != nil {
-			logger.Error(
-				ctx, "error while starting proxy",
-				logger.F("gatewayID", gatewayID),
-				logger.E(errors.WithStack(err)),
-			)
-
-			delete(c.proxies, gatewayID)
-		}
-	}
-}
-
-func NewController() *Controller {
-	return &Controller{
-		proxies:             make(map[gateway.ID]*ReverseProxy),
-		currentSpecRevision: -1,
-	}
-}
-
-var _ agent.Controller = &Controller{}
--- a/internal/agent/controller/openwrt/hash.go
+++ b/internal/agent/controller/openwrt/hash.go
@ -0,0 +1,31 @@
+package openwrt
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
+	"os"
+
+	"github.com/pkg/errors"
+)
+
+func hash(path string) (string, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return "", errors.WithStack(err)
+	}
+
+	hasher := sha256.New()
+
+	defer func() {
+		if err := file.Close(); err != nil {
+			panic(errors.WithStack(err))
+		}
+	}()
+
+	if _, err := io.Copy(hasher, file); err != nil {
+		return "", errors.WithStack(err)
+	}
+
+	return hex.EncodeToString(hasher.Sum(nil)), nil
+}
--- a/internal/agent/controller/openwrt/spec/sysupgrade/init.go
+++ b/internal/agent/controller/openwrt/spec/sysupgrade/init.go
@ -1,4 +1,4 @@
-package gateway
+package sysupgrade

 import (
 	_ "embed"
@ -11,7 +11,7 @@ import (
 var schema []byte

 func init() {
-	if err := spec.Register(NameGateway, schema); err != nil {
+	if err := spec.Register(Name, schema); err != nil {
 		panic(errors.WithStack(err))
 	}
 }
--- a/internal/agent/controller/openwrt/spec/sysupgrade/schema.json
+++ b/internal/agent/controller/openwrt/spec/sysupgrade/schema.json
@ -0,0 +1,20 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://sysupgrade.openwrt.emissary.cadoles.com/spec.json",
+    "title": "SysUpgradeSpec",
+    "description": "Emissary 'SysUpgrade' specification",
+    "type": "object",
+    "properties": {
+        "url": {
+            "type": "string"
+        },
+        "sha256sum": {
+            "type": "string"
+        },
+        "version": {
+            "type": "string"
+        }
+    },
+    "required": ["url", "sha256sum", "version"],
+    "additionalProperties": false
+}
--- a/internal/agent/controller/openwrt/spec/sysupgrade/spec.go
+++ b/internal/agent/controller/openwrt/spec/sysupgrade/spec.go
@ -0,0 +1,38 @@
+package sysupgrade
+
+import (
+	"forge.cadoles.com/Cadoles/emissary/internal/spec"
+)
+
+const Name spec.Name = "sysupgrade.openwrt.emissary.cadoles.com"
+
+type Spec struct {
+	Revision  int    `json:"revision"`
+	URL       string `json:"url"`
+	SHA256Sum string `json:"sha256sum"`
+	Version   string `json:"version"`
+}
+
+func (s *Spec) SpecName() spec.Name {
+	return Name
+}
+
+func (s *Spec) SpecRevision() int {
+	return s.Revision
+}
+
+func (s *Spec) SpecData() map[string]any {
+	return map[string]any{
+		"url":       s.URL,
+		"version":   s.Version,
+		"sha256sum": s.SHA256Sum,
+	}
+}
+
+func NewSpec() *Spec {
+	return &Spec{
+		Revision: -1,
+	}
+}
+
+var _ spec.Spec = &Spec{}
--- a/internal/agent/controller/openwrt/spec/sysupgrade/testdata/spec-ok.json
+++ b/internal/agent/controller/openwrt/spec/sysupgrade/testdata/spec-ok.json
@ -0,0 +1,9 @@
+{
+  "name": "sysupgrade.openwrt.emissary.cadoles.com",
+  "data": {
+    "url": "http://example.com/firmware.img",
+    "sha256sum": "58019192dacdae17755707719707db007e26dac856102280583fbd18427dd352",
+    "version": "0.0.0"
+  },
+  "revision": 0
+}
--- a/internal/agent/controller/openwrt/spec/sysupgrade/validator_test.go
+++ b/internal/agent/controller/openwrt/spec/sysupgrade/validator_test.go
@ -0,0 +1,65 @@
+package sysupgrade
+
+import (
+	"context"
+	"encoding/json"
+	"io/ioutil"
+	"testing"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/spec"
+	"github.com/pkg/errors"
+)
+
+type validatorTestCase struct {
+	Name       string
+	Source     string
+	ShouldFail bool
+}
+
+var validatorTestCases = []validatorTestCase{
+	{
+		Name:       "SpecOK",
+		Source:     "testdata/spec-ok.json",
+		ShouldFail: false,
+	},
+}
+
+func TestValidator(t *testing.T) {
+	t.Parallel()
+
+	validator := spec.NewValidator()
+	if err := validator.Register(Name, schema); err != nil {
+		t.Fatalf("+%v", errors.WithStack(err))
+	}
+
+	for _, tc := range validatorTestCases {
+		func(tc validatorTestCase) {
+			t.Run(tc.Name, func(t *testing.T) {
+				t.Parallel()
+
+				rawSpec, err := ioutil.ReadFile(tc.Source)
+				if err != nil {
+					t.Fatalf("+%v", errors.WithStack(err))
+				}
+
+				var spec spec.RawSpec
+
+				if err := json.Unmarshal(rawSpec, &spec); err != nil {
+					t.Fatalf("+%v", errors.WithStack(err))
+				}
+
+				ctx := context.Background()
+
+				err = validator.Validate(ctx, &spec)
+
+				if !tc.ShouldFail && err != nil {
+					t.Errorf("+%v", errors.WithStack(err))
+				}
+
+				if tc.ShouldFail && err == nil {
+					t.Error("validation should have failed")
+				}
+			})
+		}(tc)
+	}
+}
--- a/internal/agent/controller/openwrt/sysupgrade_controller.go
+++ b/internal/agent/controller/openwrt/sysupgrade_controller.go
@ -0,0 +1,177 @@
+package openwrt
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/agent"
+	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/openwrt/spec/sysupgrade"
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+type SysUpgradeController struct {
+	client          *http.Client
+	command         string
+	args            []string
+	firmwareVersion FirmwareVersion
+}
+
+// Name implements agent.Controller
+func (*SysUpgradeController) Name() string {
+	return "sysupgrade-controller"
+}
+
+// Reconcile implements agent.Controller
+func (c *SysUpgradeController) Reconcile(ctx context.Context, state *agent.State) error {
+	sysSpec := sysupgrade.NewSpec()
+
+	if err := state.GetSpec(sysupgrade.Name, sysSpec); err != nil {
+		if errors.Is(err, agent.ErrSpecNotFound) {
+			logger.Info(ctx, "could not find sysupgrade spec, doing nothing")
+
+			return nil
+		}
+
+		return errors.WithStack(err)
+	}
+
+	firmwareVersion, err := c.firmwareVersion.FirmwareVersion(ctx)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	ctx = logger.With(ctx,
+		logger.F("currentFirmwareVersion", firmwareVersion),
+		logger.F("newFirmwareVersion", sysSpec.Version),
+	)
+
+	if firmwareVersion == sysSpec.Version {
+		logger.Info(ctx, "firmware version did not change, doing nothing")
+
+		return nil
+	}
+
+	downloadDir, err := os.MkdirTemp(os.TempDir(), "emissary_sysupgrade_*")
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	defer func() {
+		if err := os.RemoveAll(downloadDir); err != nil {
+			logger.Error(
+				ctx, "could not remove download direction",
+				logger.E(errors.WithStack(err)),
+				logger.F("downloadDir", downloadDir),
+			)
+		}
+	}()
+
+	firmwareFile := filepath.Join(downloadDir, "firmware.bin")
+
+	logger.Info(
+		ctx, "downloading firmware",
+		logger.F("url", sysSpec.URL), logger.F("sha256sum", sysSpec.SHA256Sum),
+	)
+
+	if err := c.downloadFile(ctx, sysSpec.URL, sysSpec.SHA256Sum, firmwareFile); err != nil {
+		return errors.WithStack(err)
+	}
+
+	logger.Info(ctx, "upgrading firmware")
+
+	if err := c.upgradeFirmware(ctx, firmwareFile); err != nil {
+		return errors.WithStack(err)
+	}
+
+	return nil
+}
+
+func (c *SysUpgradeController) downloadFile(ctx context.Context, url string, sha256sum string, dest string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	res, err := c.client.Do(req)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	defer func() {
+		if err := res.Body.Close(); err != nil && !errors.Is(err, os.ErrClosed) {
+			panic(errors.WithStack(err))
+		}
+	}()
+
+	tmp, err := os.CreateTemp(filepath.Dir(dest), "download_")
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	defer func() {
+		if err := os.Remove(tmp.Name()); err != nil && !os.IsNotExist(err) {
+			panic(errors.WithStack(err))
+		}
+	}()
+
+	if _, err := io.Copy(tmp, res.Body); err != nil {
+		return errors.WithStack(err)
+	}
+
+	tmpFileHash, err := hash(tmp.Name())
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	if tmpFileHash != sha256sum {
+		return errors.Errorf("sha256 sum mismatch: expected '%s', got '%s'", sha256sum, tmpFileHash)
+	}
+
+	if err := os.Rename(tmp.Name(), dest); err != nil {
+		return errors.WithStack(err)
+	}
+
+	return nil
+}
+
+func (c *SysUpgradeController) upgradeFirmware(ctx context.Context, firmwareFile string) error {
+	templatizedArgs := make([]string, len(c.args))
+	for i, a := range c.args {
+		templatizedArgs[i] = strings.Replace(a, FirmwareFileTemplate, firmwareFile, 1)
+	}
+
+	command := exec.CommandContext(ctx, c.command, templatizedArgs...)
+
+	command.Stdout = os.Stdout
+	command.Stderr = os.Stderr
+
+	logger.Debug(ctx, "executing command", logger.F("command", c.command), logger.F("args", templatizedArgs))
+
+	if err := command.Run(); err != nil {
+		return errors.WithStack(err)
+	}
+
+	return nil
+}
+
+func NewSysUpgradeController(funcs ...SysUpgradeOptionFunc) *SysUpgradeController {
+	opts := defaultSysUpgradeOptions()
+	for _, fn := range funcs {
+		fn(opts)
+	}
+
+	return &SysUpgradeController{
+		command:         opts.Command,
+		args:            opts.Args,
+		client:          opts.Client,
+		firmwareVersion: opts.FirmwareVersion,
+	}
+}
+
+var _ agent.Controller = &SysUpgradeController{}
--- a/internal/agent/controller/openwrt/sysupgrade_firmware_version.go
+++ b/internal/agent/controller/openwrt/sysupgrade_firmware_version.go
@ -0,0 +1,46 @@
+package openwrt
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+type ShellFirmwareVersion struct {
+	command string
+	args    []string
+}
+
+// FirmwareVersion implements FirmwareVersion
+func (fv *ShellFirmwareVersion) FirmwareVersion(ctx context.Context) (string, error) {
+	command := exec.CommandContext(ctx, fv.command, fv.args...)
+
+	var buf bytes.Buffer
+
+	command.Stdout = &buf
+	command.Stderr = os.Stderr
+
+	logger.Debug(ctx, "executing command", logger.F("command", fv.command), logger.F("args", fv.args))
+
+	if err := command.Run(); err != nil {
+		return "", errors.WithStack(err)
+	}
+
+	version := strings.TrimSpace(buf.String())
+
+	return version, nil
+}
+
+func NewShellFirmwareVersion(command string, args ...string) *ShellFirmwareVersion {
+	return &ShellFirmwareVersion{
+		command: command,
+		args:    args,
+	}
+}
+
+var _ FirmwareVersion = &ShellFirmwareVersion{}
--- a/internal/agent/controller/openwrt/sysupgrade_options.go
+++ b/internal/agent/controller/openwrt/sysupgrade_options.go
@ -0,0 +1,58 @@
+package openwrt
+
+import (
+	"context"
+	"net/http"
+	"time"
+)
+
+const FirmwareFileTemplate = "%FIRMWARE%"
+
+type FirmwareVersion interface {
+	FirmwareVersion(context.Context) (string, error)
+}
+
+type SysUpgradeOptions struct {
+	Command         string
+	Args            []string
+	FirmwareVersion FirmwareVersion
+	Client          *http.Client
+}
+
+func defaultSysUpgradeOptions() *SysUpgradeOptions {
+	return &SysUpgradeOptions{
+		Command: `echo`,
+		Args:    []string{`[DUMMY UPGRADE]`, FirmwareFileTemplate},
+		Client: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+		FirmwareVersion: NewShellFirmwareVersion(`echo`, "0.0.0-dummy"),
+	}
+}
+
+type SysUpgradeOptionFunc func(*SysUpgradeOptions)
+
+func WithSysUpgradeCommand(command string, args ...string) SysUpgradeOptionFunc {
+	return func(opts *SysUpgradeOptions) {
+		opts.Command = command
+		opts.Args = args
+	}
+}
+
+func WithSysUpgradeFirmwareVersion(firmwareVersion FirmwareVersion) SysUpgradeOptionFunc {
+	return func(opts *SysUpgradeOptions) {
+		opts.FirmwareVersion = firmwareVersion
+	}
+}
+
+func WithSysUpgradeShellFirmwareVersion(command string, args ...string) SysUpgradeOptionFunc {
+	return func(opts *SysUpgradeOptions) {
+		opts.FirmwareVersion = NewShellFirmwareVersion(command, args...)
+	}
+}
+
+func WithSysUpgradeClient(client *http.Client) SysUpgradeOptionFunc {
+	return func(opts *SysUpgradeOptions) {
+		opts.Client = client
+	}
+}
--- a/internal/agent/controller/proxy/controller.go
+++ b/internal/agent/controller/proxy/controller.go
@ -0,0 +1,180 @@
+package proxy
+
+import (
+	"context"
+	"net/url"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/agent"
+	"forge.cadoles.com/Cadoles/emissary/internal/spec/proxy"
+	edgeProxy "forge.cadoles.com/arcad/edge/pkg/proxy"
+	"github.com/mitchellh/hashstructure/v2"
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+type proxyEntry struct {
+	SpecHash uint64
+	Proxy    *ReverseProxy
+}
+
+type Controller struct {
+	proxies map[proxy.ID]*proxyEntry
+}
+
+// Name implements node.Controller.
+func (c *Controller) Name() string {
+	return "proxy-controller"
+}
+
+// Reconcile implements node.Controller.
+func (c *Controller) Reconcile(ctx context.Context, state *agent.State) error {
+	proxySpec := proxy.NewSpec()
+
+	if err := state.GetSpec(proxy.NameProxy, proxySpec); err != nil {
+		if errors.Is(err, agent.ErrSpecNotFound) {
+			logger.Info(ctx, "could not find proxy spec")
+
+			c.stopAllProxies(ctx)
+
+			return nil
+		}
+
+		return errors.WithStack(err)
+	}
+
+	logger.Info(ctx, "retrieved spec", logger.F("spec", proxySpec.SpecName()), logger.F("revision", proxySpec.SpecRevision()))
+
+	c.updateProxies(ctx, proxySpec)
+
+	return nil
+}
+
+func (c *Controller) stopAllProxies(ctx context.Context) {
+	if len(c.proxies) > 0 {
+		logger.Info(ctx, "stopping all proxies")
+	}
+
+	for proxyID, entry := range c.proxies {
+		logger.Info(ctx, "stopping proxy", logger.F("proxyID", proxyID))
+
+		if err := entry.Proxy.Stop(); err != nil {
+			logger.Error(
+				ctx, "error while stopping proxy",
+				logger.F("proxyID", proxyID),
+				logger.E(errors.WithStack(err)),
+			)
+
+			delete(c.proxies, proxyID)
+		}
+	}
+}
+
+func (c *Controller) updateProxies(ctx context.Context, spec *proxy.Spec) {
+	// Stop and remove obsolete proxys
+	for proxyID, entry := range c.proxies {
+		if _, exists := spec.Proxies[proxyID]; exists {
+			continue
+		}
+
+		logger.Info(ctx, "stopping proxy", logger.F("proxyID", proxyID))
+
+		if err := entry.Proxy.Stop(); err != nil {
+			logger.Error(
+				ctx, "error while stopping proxy",
+				logger.F("proxyID", proxyID),
+				logger.E(errors.WithStack(err)),
+			)
+
+			delete(c.proxies, proxyID)
+		}
+	}
+
+	// (Re)start proxys
+	for proxyID, proxySpec := range spec.Proxies {
+		proxyCtx := logger.With(ctx, logger.F("proxyID", proxyID))
+
+		if err := c.updateProxy(ctx, proxyID, proxySpec); err != nil {
+			logger.Error(proxyCtx, "could not update proxy", logger.E(errors.WithStack(err)))
+			continue
+		}
+	}
+}
+
+func (c *Controller) updateProxy(ctx context.Context, proxyID proxy.ID, proxySpec proxy.ProxyEntry) (err error) {
+	newProxySpecHash, err := hashstructure.Hash(proxySpec, hashstructure.FormatV2, nil)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	var entry *proxyEntry
+
+	entry, exists := c.proxies[proxyID]
+	if !exists {
+		logger.Info(ctx, "proxy currently not running")
+	}
+
+	if entry == nil {
+		entry = &proxyEntry{
+			Proxy:    NewReverseProxy(),
+			SpecHash: 0,
+		}
+
+		c.proxies[proxyID] = entry
+	}
+
+	specChanged := newProxySpecHash != entry.SpecHash
+
+	if entry.Proxy.Running() && !specChanged {
+		return nil
+	}
+
+	if specChanged && entry.SpecHash != 0 {
+		logger.Info(
+			ctx, "restarting proxy",
+			logger.F("address", proxySpec.Address),
+		)
+	} else {
+		logger.Info(
+			ctx, "starting proxy",
+			logger.F("address", proxySpec.Address),
+		)
+	}
+
+	options := make([]edgeProxy.OptionFunc, 0)
+	allowedHosts := make([]string, len(proxySpec.Mappings))
+	mappings := make(map[string]*url.URL, len(proxySpec.Mappings))
+
+	for _, m := range proxySpec.Mappings {
+		target, err := url.Parse(m.Target)
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		mappings[m.HostPattern] = target
+		allowedHosts = append(allowedHosts, m.HostPattern)
+	}
+
+	options = append(
+		options,
+		edgeProxy.WithAllowedHosts(allowedHosts...),
+		edgeProxy.WithRewriteHosts(mappings),
+	)
+
+	if err := entry.Proxy.Start(ctx, proxySpec.Address, options...); err != nil {
+		delete(c.proxies, proxyID)
+
+		return errors.Wrap(err, "could not start app")
+	}
+
+	entry.SpecHash = newProxySpecHash
+
+	return nil
+}
+
+func NewController() *Controller {
+	return &Controller{
+		proxies: make(map[proxy.ID]*proxyEntry),
+	}
+}
+
+var _ agent.Controller = &Controller{}
--- a/internal/agent/controller/gateway/reverse_proxy.go
+++ b/internal/agent/controller/gateway/reverse_proxy.go
@ -1,28 +1,23 @@
-package gateway
+package proxy

 import (
 	"context"
 	"net/http"
-	"net/http/httputil"
-	"net/url"
+	"sync"

 	"github.com/pkg/errors"
 	"gitlab.com/wpetit/goweb/logger"
+
+	"forge.cadoles.com/arcad/edge/pkg/proxy"
 )

 type ReverseProxy struct {
 	addr   string
-	target string
 	server *http.Server
+	mutex  sync.RWMutex
 }

-func (p *ReverseProxy) Start(ctx context.Context, addr, target string) error {
-	alreadyRunning := p.server != nil && target == p.target && addr == p.target
-
-	if alreadyRunning {
-		return nil
-	}
-
+func (p *ReverseProxy) Start(ctx context.Context, addr string, funcs ...proxy.OptionFunc) error {
 	if p.server != nil {
 		if err := p.Stop(); err != nil {
 			return errors.WithStack(err)
@ -33,33 +28,40 @@ func (p *ReverseProxy) Start(ctx context.Context, addr, target string) error {
 		Addr: addr,
 	}

-	url, err := url.Parse(target)
-	if err != nil {
-		return errors.WithStack(err)
-	}
-
-	proxy := httputil.NewSingleHostReverseProxy(url)
-
+	proxy := proxy.New(funcs...)
 	server.Handler = proxy

+	p.mutex.Lock()
 	p.server = server
 	p.addr = addr
-	p.target = target
+	p.mutex.Unlock()

 	go func() {
+		defer func() {
+			if err := p.Stop(); err != nil {
+				logger.Error(ctx, "error while stopping gateway", logger.E(errors.WithStack(err)))
+			}
+		}()
+
 		if err := server.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			logger.Error(ctx, "error while listening", logger.E(errors.WithStack(err)))
 		}
-
-		if err := p.Stop(); err != nil {
-			logger.Error(ctx, "error while stopping gateway", logger.E(errors.WithStack(err)))
-		}
 	}()

 	return nil
 }

+func (p *ReverseProxy) Running() bool {
+	p.mutex.RLock()
+	defer p.mutex.RUnlock()
+
+	return p.server != nil
+}
+
 func (p *ReverseProxy) Stop() error {
+	p.mutex.Lock()
+	defer p.mutex.Unlock()
+
 	if p.server == nil {
 		return nil
 	}
--- a/internal/command/agent/openwrt/uci/transform.go
+++ b/internal/command/agent/openwrt/uci/transform.go
@ -10,7 +10,6 @@ import (
 	"forge.cadoles.com/Cadoles/emissary/internal/command/common"
 	"forge.cadoles.com/Cadoles/emissary/internal/openwrt/uci"
 	"github.com/pkg/errors"
-	_ "github.com/santhosh-tekuri/jsonschema/v5/httploader"
 	"github.com/urfave/cli/v2"
 )

--- a/internal/command/agent/run.go
+++ b/internal/command/agent/run.go
@ -5,9 +5,9 @@ import (

 	"forge.cadoles.com/Cadoles/emissary/internal/agent"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app"
-	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/gateway"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/openwrt"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/persistence"
+	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/proxy"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/spec"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/metadata"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/metadata/collector/buildinfo"
@ -49,8 +49,8 @@ func RunCommand() *cli.Command {
 				controllers = append(controllers, spec.NewController())
 			}

-			if ctrlConf.Gateway.Enabled {
-				controllers = append(controllers, gateway.NewController())
+			if ctrlConf.Proxy.Enabled {
+				controllers = append(controllers, proxy.NewController())
 			}

 			if ctrlConf.UCI.Enabled {
@ -66,6 +66,29 @@ func RunCommand() *cli.Command {
 				))
 			}

+			if ctrlConf.SysUpgrade.Enabled {
+				sysUpgradeArgs := make([]string, 0)
+				if len(ctrlConf.SysUpgrade.SysUpgradeCommand) > 1 {
+					sysUpgradeArgs = ctrlConf.SysUpgrade.SysUpgradeCommand[1:]
+				}
+
+				firmwareVersionArgs := make([]string, 0)
+				if len(ctrlConf.SysUpgrade.FirmwareVersionCommand) > 1 {
+					firmwareVersionArgs = ctrlConf.SysUpgrade.FirmwareVersionCommand[1:]
+				}
+
+				controllers = append(controllers, openwrt.NewSysUpgradeController(
+					openwrt.WithSysUpgradeCommand(
+						ctrlConf.SysUpgrade.SysUpgradeCommand[0],
+						sysUpgradeArgs...,
+					),
+					openwrt.WithSysUpgradeShellFirmwareVersion(
+						ctrlConf.SysUpgrade.FirmwareVersionCommand[0],
+						firmwareVersionArgs...,
+					),
+				))
+			}
+
 			key, err := jwk.LoadOrGenerate(string(conf.Agent.PrivateKeyPath), jwk.DefaultKeySize)
 			if err != nil {
 				return errors.WithStack(err)
--- a/internal/command/api/agent/spec/update.go
+++ b/internal/command/api/agent/spec/update.go
@ -13,11 +13,6 @@ import (
 	jsonpatch "github.com/evanphx/json-patch/v5"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
-
-	// Import specs
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/app"
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/gateway"
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/uci"
 )

 func UpdateCommand() *cli.Command {
--- a/internal/command/api/root.go
+++ b/internal/command/api/root.go
@ -3,10 +3,6 @@ package api
 import (
 	"forge.cadoles.com/Cadoles/emissary/internal/command/api/agent"
 	"github.com/urfave/cli/v2"
-
-	// Output format
-	_ "forge.cadoles.com/Cadoles/emissary/internal/format/json"
-	_ "forge.cadoles.com/Cadoles/emissary/internal/format/table"
 )

 func Root() *cli.Command {
--- a/internal/command/config/dump.go
+++ b/internal/command/config/dump.go
@ -6,7 +6,6 @@ import (
 	"forge.cadoles.com/Cadoles/emissary/internal/command/common"
 	"forge.cadoles.com/Cadoles/emissary/internal/config"
 	"github.com/pkg/errors"
-	_ "github.com/santhosh-tekuri/jsonschema/v5/httploader"
 	"github.com/urfave/cli/v2"
 	"gitlab.com/wpetit/goweb/logger"
 )
--- a/internal/command/main.go
+++ b/internal/command/main.go
@ -9,10 +9,6 @@ import (

 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
-
-	// Spec validation
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/gateway"
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/uci"
 )

 func Main(buildDate, projectVersion, gitRef, defaultConfigPath string, commands ...*cli.Command) {
--- a/internal/command/server/run.go
+++ b/internal/command/server/run.go
@ -7,7 +7,6 @@ import (
 	"forge.cadoles.com/Cadoles/emissary/internal/command/common"
 	"forge.cadoles.com/Cadoles/emissary/internal/server"
 	"github.com/pkg/errors"
-	_ "github.com/santhosh-tekuri/jsonschema/v5/httploader"
 	"github.com/urfave/cli/v2"
 	"gitlab.com/wpetit/goweb/logger"
 )
--- a/internal/config/agent.go
+++ b/internal/config/agent.go
@ -1,5 +1,7 @@
 package config

+import "forge.cadoles.com/Cadoles/emissary/internal/agent/controller/openwrt"
+
 type AgentConfig struct {
 	ServerURL              InterpolatedString     `yaml:"serverUrl"`
 	PrivateKeyPath         InterpolatedString     `yaml:"privateKeyPath"`
@ -17,9 +19,10 @@ type ShellCollectorConfig struct {
 type ControllersConfig struct {
 	Persistence PersistenceControllerConfig `yaml:"persistence"`
 	Spec        SpecControllerConfig        `yaml:"spec"`
-	Gateway     GatewayControllerConfig     `yaml:"gateway"`
+	Proxy       ProxyControllerConfig       `yaml:"proxy"`
 	UCI         UCIControllerConfig         `yaml:"uci"`
 	App         AppControllerConfig         `yaml:"app"`
+	SysUpgrade  SysUpgradeControllerConfig  `yaml:"sysupgrade"`
 }

 type PersistenceControllerConfig struct {
@ -30,7 +33,7 @@ type PersistenceControllerConfig struct {
 type SpecControllerConfig struct {
 	Enabled InterpolatedBool `yaml:"enabled"`
 }
-type GatewayControllerConfig struct {
+type ProxyControllerConfig struct {
 	Enabled InterpolatedBool `yaml:"enabled"`
 }

@ -46,6 +49,12 @@ type AppControllerConfig struct {
 	DownloadDir InterpolatedString `yaml:"downloadDir"`
 }

+type SysUpgradeControllerConfig struct {
+	Enabled                InterpolatedBool        `yaml:"enabled"`
+	SysUpgradeCommand      InterpolatedStringSlice `yaml:"sysupgradeCommand"`
+	FirmwareVersionCommand InterpolatedStringSlice `yaml:"firmwareVersionCommand"`
+}
+
 func NewDefaultAgentConfig() AgentConfig {
 	return AgentConfig{
 		ServerURL:              "http://127.0.0.1:3000",
@ -59,7 +68,7 @@ func NewDefaultAgentConfig() AgentConfig {
 				Enabled:   true,
 				StateFile: "state.json",
 			},
-			Gateway: GatewayControllerConfig{
+			Proxy: ProxyControllerConfig{
 				Enabled: true,
 			},
 			UCI: UCIControllerConfig{
@ -72,6 +81,11 @@ func NewDefaultAgentConfig() AgentConfig {
 				DataDir:     "apps/data",
 				DownloadDir: "apps/bundles",
 			},
+			SysUpgrade: SysUpgradeControllerConfig{
+				Enabled:                true,
+				SysUpgradeCommand:      InterpolatedStringSlice{"sysupgrade", "--force", "-u", "-v", openwrt.FirmwareFileTemplate},
+				FirmwareVersionCommand: InterpolatedStringSlice{"sh", "-c", `source /etc/openwrt_release && echo "$DISTRIB_ID-$DISTRIB_RELEASE-$DISTRIB_REVISION"`},
+			},
 		},
 		Collectors: []ShellCollectorConfig{
 			{
--- a/internal/imports/format/format_import.go
+++ b/internal/imports/format/format_import.go
@ -0,0 +1,6 @@
+package format
+
+import (
+	_ "forge.cadoles.com/Cadoles/emissary/internal/format/json"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/format/table"
+)
--- a/internal/imports/passwd/passwd_import.go
+++ b/internal/imports/passwd/passwd_import.go
@ -0,0 +1,6 @@
+package passwd
+
+import (
+	_ "forge.cadoles.com/arcad/edge/pkg/module/auth/http/passwd/argon2id"
+	_ "forge.cadoles.com/arcad/edge/pkg/module/auth/http/passwd/plain"
+)
--- a/internal/imports/spec/spec_import.go
+++ b/internal/imports/spec/spec_import.go
@ -0,0 +1,8 @@
+package spec
+
+import (
+	_ "forge.cadoles.com/Cadoles/emissary/internal/agent/controller/openwrt/spec/sysupgrade"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/app"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/proxy"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/uci"
+)
--- a/internal/imports/sql/sql_import.go
+++ b/internal/imports/sql/sql_import.go
@ -0,0 +1,6 @@
+package sql
+
+import (
+	_ "github.com/jackc/pgx/v5/stdlib"
+	_ "modernc.org/sqlite"
+)
--- a/internal/server/spec_api.go
+++ b/internal/server/spec_api.go
@ -10,11 +10,6 @@ import (
 	"github.com/pkg/errors"
 	"gitlab.com/wpetit/goweb/api"
 	"gitlab.com/wpetit/goweb/logger"
-
-	// Import specs
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/app"
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/gateway"
-	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/uci"
 )

 const (
--- a/internal/spec/app/schema.json
+++ b/internal/spec/app/schema.json
@ -1,6 +1,6 @@
 {
    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://app.emissary.cadoles.com/spec.json",
+    "$id": "https://app.edge.emissary.cadoles.com/spec.json",
    "title": "AppSpec",
    "description": "Emissary 'App' specification",
    "type": "object",
@ -22,15 +22,66 @@
                        },
                        "format": {
                            "type": "string",
-                            "enum": ["zip", "tar.gz"]
+                            "enum": [
+                                "zip",
+                                "tar.gz"
+                            ]
                        }
                    },
-                    "required": ["url", "sha256sum", "address", "format"],
+                    "required": [
+                        "url",
+                        "sha256sum",
+                        "address",
+                        "format"
+                    ],
                    "additionalProperties": false
                }
            }
+        },
+        "auth": {
+            "type": "object",
+            "properties": {
+                "local": {
+                    "type": "object",
+                    "properties": {
+                        "key": {
+                            "type": ["object", "string"]
+                        },
+                        "accounts": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "username": {
+                                        "type": "string"
+                                    },
+                                    "password": {
+                                        "type": "string"
+                                    },
+                                    "algo": {
+                                        "type": "string"
+                                    },
+                                    "claims": {
+                                        "type": "object"
+                                    }
+                                },
+                                "required": [
+                                    "username",
+                                    "password",
+                                    "algo"
+                                ]
+                            }
+                        }
+                    },
+                    "required": [
+                        "key"
+                    ]
+                }
+            }
        }
    },
-    "required": ["apps"],
+    "required": [
+        "apps"
+    ],
    "additionalProperties": false
 }
--- a/internal/spec/app/spec.go
+++ b/internal/spec/app/spec.go
@ -2,13 +2,15 @@ package app

 import (
 	"forge.cadoles.com/Cadoles/emissary/internal/spec"
+	edgeAuth "forge.cadoles.com/arcad/edge/pkg/module/auth/http"
 )

 const NameApp spec.Name = "app.emissary.cadoles.com"

 type Spec struct {
-	Revision int `json:"revisions"`
-	Apps     map[string]AppEntry
+	Revision int                 `json:"revision"`
+	Apps     map[string]AppEntry `json:"apps"`
+	Auth     *Auth               `json:"auth"`
 }

 type AppEntry struct {
@ -18,6 +20,15 @@ type AppEntry struct {
 	Format    string `json:"format"`
 }

+type Auth struct {
+	Local *LocalAuth `json:"local,omitempty"`
+}
+
+type LocalAuth struct {
+	Key      any                     `json:"key"`
+	Accounts []edgeAuth.LocalAccount `json:"accounts"`
+}
+
 func (s *Spec) SpecName() spec.Name {
 	return NameApp
 }
@ -29,6 +40,7 @@ func (s *Spec) SpecRevision() int {
 func (s *Spec) SpecData() map[string]any {
 	return map[string]any{
 		"apps": s.Apps,
+		"auth": s.Auth,
 	}
 }

--- a/internal/spec/app/testdata/spec-ok.json
+++ b/internal/spec/app/testdata/spec-ok.json
@ -1,7 +1,42 @@
 {
-    "name": "app.emissary.cadoles.com",
-    "data": {
-      "apps": {}
+  "name": "app.emissary.cadoles.com",
+  "data": {
+    "apps": {
+      "edge.sdk.client.test": {
+        "url": "http://example.com/edge.sdk.client.test_0.0.0.zip",
+        "sha256sum": "58019192dacdae17755707719707db007e26dac856102280583fbd18427dd352",
+        "address": ":8081",
+        "format": "zip"
+      }
    },
-    "revision": 0
+    "auth": {
+      "local": {
+        "key": {
+          "d": "YOre0WZefGfUGFvDg42oL5Oad5Zsb1N_hqPyLVM5ajpTZzcHpB3wT6In9tFO_VshB6lxVtPA9ckPkpMTFY7ygt1Yomc1HkoOKRtmIaqdr4VgNQifU-4yiLiJkSbdYSeMV-KkkN8mGR1keJpJeS34W1X0W6CkU2nw7F5VueBCJfWJA0funRfuWdI68MTUgT9kRZFp-SfvptvRL6jVYHV_5hqxzHCvgEdBSF6QKwx4M6P6QBMt7ft6uMLmFx9abKFw2V51hX3PkxiSepVB3w5CYg4HtS3AHX6bILL4m0R2pdTIkap7i3tkH_xAOuKWt8D6JhadI8X1rEAwXmCS5KrRgQ",
+          "dp": "U0HfvBC6hk-SCpuotGIv3vbHCVt1aF3SHK0y32EYCOe8e_9G6YCEILfcvEJ5fiOCc2kvx6TasHQu4qj1uWRKenZlK1sJ6KDybGCkZL1D3jYnbeLZYBuWBL__YbZiST3ewbxzj_EDMWiZ8sUltahza_1weSgg8auSzTHS2LJBHIE",
+          "dq": "hVom4ScDxgqhCsQNVpZlN7M3v0tgWjl_gTOHjOyzKCHQJeC0QmJJaMKkQZPWJ8jjLqy7VwVpqC2nZU7QDuX1Cq5eJDQcXi9XtaAfIBico9WcYDre6mDyhL588YHpekyRke8HnZ810iesr0G3gU1h0QvZVVuW-pXTJOXhZTt6nFc",
+          "e": "AQAB",
+          "kty": "RSA",
+          "n": "vPnpkE3-HfNgJSru_K40LstkjiG2Bq_Tt-m0d_yUBBSbirFxF3qH4EXi7WrtZdeDahg2iV2BvpbVVj9GlmGo9OLol6jc7AP2yvZrkbABiiJhCbuPdkYbNpx6B7Itl8RT_bUSYAMZhmux5lpsn4weQ01fzjICi1rA-bIJpOfotdOjP4_lol-LxGZOGJQv9kndP8bgmssJb3Y_2s4gPtkmXySLrhpr5So-_6dVksyuBD9aLcnsMLDbywusjEMCdhqzQbvOjryomnmEXwyz_Ewb5HFK2PfgFtoHkdjqDz-mrEs3tw5g4TdYhCftzJxgbyNAEq4aEiOQrAncYyrXlotP_w",
+          "p": "8TNMF0WUe7CEeNVUTsuEcBAAXRguNtpvVifIjlwzFRGOYVGIpKuHsqQPKlZL07I9gPr9LifQnyQus3oEmTOrVs6LB9sfbukbg43ZRKoGVM40JYF5Xjs7R3mEZhgU0WaYOVe3iLtBGMfXNWFwlbfQP-zEb-dPCBX1jWT3LdgNBcE",
+          "q": "yJJLNc9w6O4y2icME8k99FugV9E7ObwUxF3v5JN3y1cmAT0h2njyE3iAGqaDZwcY1_jGCisjwoqX6i5E8xqhxX3Gcy3J7SmUAf8fhY8wU3zv9DK7skg2IdvanDb8Y1OM6GchbYZAOVPEg2IvVio8zI-Ih3DDwDk8Df0ufzoHRb8",
+          "qi": "zOE-4R3cjPesm3MX-4PdwmsaF9QZLUVRUvvHJ08pKs6kAXP18hzjctAoOjhQDxlTYqNYNePfKzKwost3OJoPgRIc9w9qwUCK1gNOS4Z_xozCIaXgMddNFhkoAfZ4JaKjNCiinzjGfqG99Lf-yzmmREuuhRv7SdS3ST4VQjiJQew"
+        },
+        "accounts": [
+          {
+            "username": "foo",
+            "algo": "plain",
+            "password": "bar",
+            "claims": {
+              "arcad_role": "user",
+              "arcad_tenant": "dev.cli",
+              "preferred_username": "Foo",
+              "sub": "foo"
+            }
+          }
+        ]
+      }
+    }
+  },
+  "revision": 0
 }
--- a/internal/spec/gateway/schema.json
+++ b/internal/spec/gateway/schema.json
@ -1,29 +0,0 @@
-{
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://gateway.emissary.cadoles.com/spec.json",
-    "title": "GatewaySpec",
-    "description": "Emissary 'Gateway' specification",
-    "type": "object",
-    "properties": {
-        "gateways": {
-            "type": "object",
-            "patternProperties": {
-                ".*": {
-                    "type": "object",
-                    "properties": {
-                        "address": {
-                            "type": "string"
-                        },
-                        "target": {
-                            "type": "string"
-                        }
-                    },
-                    "required": ["address", "target"],
-                    "additionalProperties": false
-                }
-            }
-        }
-    },
-    "required": ["gateways"],
-    "additionalProperties": false
-}
--- a/internal/spec/gateway/spec.go
+++ b/internal/spec/gateway/spec.go
@ -1,40 +0,0 @@
-package gateway
-
-import "forge.cadoles.com/Cadoles/emissary/internal/spec"
-
-const NameGateway spec.Name = "gateway.emissary.cadoles.com"
-
-type ID string
-
-type Spec struct {
-	Revision int                 `json:"revision"`
-	Gateways map[ID]GatewayEntry `json:"gateways"`
-}
-
-type GatewayEntry struct {
-	Address string `json:"address"`
-	Target  string `json:"target"`
-}
-
-func (s *Spec) SpecName() spec.Name {
-	return NameGateway
-}
-
-func (s *Spec) SpecRevision() int {
-	return s.Revision
-}
-
-func (s *Spec) SpecData() map[string]any {
-	return map[string]any{
-		"gateways": s.Gateways,
-	}
-}
-
-func NewSpec() *Spec {
-	return &Spec{
-		Revision: -1,
-		Gateways: make(map[ID]GatewayEntry),
-	}
-}
-
-var _ spec.Spec = &Spec{}
--- a/internal/spec/gateway/testdata/spec-additional-prop.json
+++ b/internal/spec/gateway/testdata/spec-additional-prop.json
@ -1,13 +0,0 @@
-{
-    "name": "gateway.emissary.cadoles.com",
-    "data": {
-      "gateways": {
-        "cadoles.com": {
-          "address": ":3003",
-          "target": "https://www.cadoles.com",
-          "foo": "bar"
-        }
-      }
-    },
-    "revision": 0
-}
--- a/internal/spec/gateway/testdata/spec-ok.json
+++ b/internal/spec/gateway/testdata/spec-ok.json
@ -1,12 +0,0 @@
-{
-    "name": "gateway.emissary.cadoles.com",
-    "data": {
-      "gateways": {
-        "cadoles.com": {
-          "address": ":3003",
-          "target": "https://www.cadoles.com"
-        }
-      }
-    },
-    "revision": 0
-}
--- a/internal/spec/proxy/init.go
+++ b/internal/spec/proxy/init.go
@ -0,0 +1,17 @@
+package proxy
+
+import (
+	_ "embed"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/spec"
+	"github.com/pkg/errors"
+)
+
+//go:embed schema.json
+var schema []byte
+
+func init() {
+	if err := spec.Register(NameProxy, schema); err != nil {
+		panic(errors.WithStack(err))
+	}
+}
--- a/internal/spec/proxy/schema.json
+++ b/internal/spec/proxy/schema.json
@ -0,0 +1,41 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://proxy.emissary.cadoles.com/spec.json",
+    "title": "ProxySpec",
+    "description": "Emissary 'Proxy' specification",
+    "type": "object",
+    "properties": {
+        "proxies": {
+            "type": "object",
+            "patternProperties": {
+                ".*": {
+                    "type": "object",
+                    "properties": {
+                        "address": {
+                            "type": "string"
+                        },
+                        "mappings": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "hostPattern": {
+                                        "type": "string"
+                                    },
+                                    "target": {
+                                        "type": "string"
+                                    }
+                                },
+                                "required": ["hostPattern", "target"]
+                            }
+                        }
+                    },
+                    "required": ["address", "mappings"],
+                    "additionalProperties": false
+                }
+            }
+        }
+    },
+    "required": ["proxies"],
+    "additionalProperties": false
+}
--- a/internal/spec/proxy/spec.go
+++ b/internal/spec/proxy/spec.go
@ -0,0 +1,45 @@
+package proxy
+
+import "forge.cadoles.com/Cadoles/emissary/internal/spec"
+
+const NameProxy spec.Name = "proxy.emissary.cadoles.com"
+
+type ID string
+
+type Spec struct {
+	Revision int               `json:"revision"`
+	Proxies  map[ID]ProxyEntry `json:"proxies"`
+}
+
+type ProxyEntry struct {
+	Address  string         `json:"address"`
+	Mappings []ProxyMapping `json:"mappings"`
+}
+
+type ProxyMapping struct {
+	HostPattern string `json:"hostPattern"`
+	Target      string `json:"target"`
+}
+
+func (s *Spec) SpecName() spec.Name {
+	return NameProxy
+}
+
+func (s *Spec) SpecRevision() int {
+	return s.Revision
+}
+
+func (s *Spec) SpecData() map[string]any {
+	return map[string]any{
+		"proxies": s.Proxies,
+	}
+}
+
+func NewSpec() *Spec {
+	return &Spec{
+		Revision: -1,
+		Proxies:  make(map[ID]ProxyEntry),
+	}
+}
+
+var _ spec.Spec = &Spec{}
--- a/internal/spec/proxy/testdata/spec-additional-prop.json
+++ b/internal/spec/proxy/testdata/spec-additional-prop.json
@ -0,0 +1,18 @@
+{
+    "name": "proxy.emissary.cadoles.com",
+    "data": {
+      "proxies": {
+        "cadoles.com": {
+          "address": ":3003",
+          "mappings": [
+            {
+              "hostPattern": "localhost:3003",
+              "target": "https://www.cadoles.com" 
+            }
+          ],
+          "foo": "bar"
+        }
+      }
+    },
+    "revision": 0
+}
--- a/internal/spec/gateway/testdata/spec-missing-prop.json
+++ b/internal/spec/gateway/testdata/spec-missing-prop.json
@ -1,7 +1,7 @@
 {
-    "name": "gateway.emissary.cadoles.com",
+    "name": "proxy.emissary.cadoles.com",
    "data": {
-      "gateways": {
+      "proxies": {
        "cadoles.com": {
          "address": ":3003"
        }
--- a/internal/spec/proxy/testdata/spec-ok.json
+++ b/internal/spec/proxy/testdata/spec-ok.json
@ -0,0 +1,17 @@
+{
+    "name": "proxy.emissary.cadoles.com",
+    "data": {
+      "proxies": {
+        "cadoles.com": {
+          "address": ":3003",
+          "mappings": [
+            {
+              "hostPattern": "localhost:3003",
+              "target": "https://www.cadoles.com" 
+            }
+          ]
+        }
+      }
+    },
+    "revision": 0
+}
--- a/internal/spec/gateway/validator_test.go
+++ b/internal/spec/gateway/validator_test.go
@ -1,4 +1,4 @@
-package gateway
+package proxy

 import (
 	"context"
@ -38,7 +38,7 @@ func TestValidator(t *testing.T) {
 	t.Parallel()

 	validator := spec.NewValidator()
-	if err := validator.Register(NameGateway, schema); err != nil {
+	if err := validator.Register(NameProxy, schema); err != nil {
 		t.Fatalf("+%v", errors.WithStack(err))
 	}

--- a/internal/spec/uci/spec.go
+++ b/internal/spec/uci/spec.go
@ -8,7 +8,7 @@ import (
 const NameUCI spec.Name = "uci.emissary.cadoles.com"

 type Spec struct {
-	Revision           int                     `json:"revisions"`
+	Revision           int                     `json:"revision"`
 	Config             *uci.UCI                `json:"config"`
 	PostImportCommands []*UCIPostImportCommand `json:"postImportCommands"`
 }
--- a/misc/packaging/common/config-agent.yml
+++ b/misc/packaging/common/config-agent.yml
@ -11,12 +11,16 @@ agent:
      stateFile: /var/lib/emissary/state.json
    spec:
      enabled: true
-    gateway:
+    proxy:
      enabled: true
    uci:
      enabled: true
      binPath: uci
      configBackupFile: /var/lib/emissary/uci-backup.conf
+    app:
+      enabled: true
+      dataDir: /var/lib/emissary/apps/data
+      downloadDir: /var/lib/emissary/apps/bundles
  collectors:
    - name: uname
      command: uname
--- a/modd.conf
+++ b/modd.conf
@ -1,4 +1,5 @@
 **/*.go
+**/*.json
 modd.conf
 tmp/config.yml
 .env {
Author	SHA1	Message	Date
William Petit	0b783c374a	feat(controller,sysupgrade): openwrt upgrade controller	2023-03-24 23:17:55 +01:00
William Petit	97a60e2617	chore: use date based versioning	2023-03-22 18:41:18 +01:00
William Petit	cd796fff89	feat: host-based routing in proxy	2023-03-22 18:15:22 +01:00
William Petit	8ada7e3b84	chore: update agent package config	2023-03-21 16:20:59 +01:00
William Petit	fa71986d37	chore: update deps	2023-03-21 16:20:36 +01:00
William Petit	1261beb812	feat(agent): execute reconciliation loop directly at startup	2023-03-21 16:05:29 +01:00
William Petit	1b9914c306	feat(spec,app): handle local accounts	2023-03-21 15:21:19 +01:00
William Petit	fbcd3ca806	feat: rename gateway spec to proxy	2023-03-21 13:28:41 +01:00