feat: add mdns controller

.gitignore

@@ -4,7 +4,7 @@ dist/
 /tools
 /tmp
 /state.json
-/emissary.sqlite
+/emissary.sqlite*
 /.gitea-release
 /agent-key.json
 /apps

Jenkinsfile

@@ -0,0 +1,70 @@
+@Library('cadoles') _
+
+pipeline {
+    agent {
+        dockerfile {
+            label 'docker'
+            filename 'Dockerfile'
+            dir 'misc/jenkins'
+        }
+    }
+
+    stages {
+        stage('Run unit tests') {
+            steps {
+                script {
+                    withCredentials([
+                        usernamePassword([
+                        credentialsId: 'forge-jenkins',
+                        usernameVariable: 'GIT_USERNAME',
+                        passwordVariable: 'GIT_PASSWORD'
+                        ])
+                    ]) {
+                        sh '''
+                        git config --global credential.https://forge.cadoles.com.username "$GIT_USERNAME"
+                        git config --global credential.https://forge.cadoles.com.helper '!f() { test "$1" = get && echo "password=$GIT_PASSWORD"; }; f'
+
+                        export GOPRIVATE=forge.cadoles.com/arcad/edge
+                        make test
+                        '''
+                    }
+                }
+            }
+        }
+
+        stage('Release') {
+            when {
+                anyOf {
+                    branch 'master'
+                    branch 'develop'
+                }
+            }
+            steps {
+                script {
+                    withCredentials([
+                        usernamePassword([
+                        credentialsId: 'forge-jenkins',
+                        usernameVariable: 'GITEA_RELEASE_USERNAME',
+                        passwordVariable: 'GITEA_RELEASE_PASSWORD'
+                        ])
+                    ]) {
+                        sh 'make gitea-release'
+                    }
+                    def currentVersion = sh(returnStdout: true, script: 'make full-version').trim()
+                    build(
+                        job: "../emissary-firmware/${env.GIT_BRANCH}",
+                        parameters: [
+                            [$class: 'StringParameterValue', name: 'emissaryRelease', value: currentVersion]
+                        ]
+                    )
+                }
+            }
+        }
+    }
+
+    post {
+        always {
+            cleanWs()
+        }
+    }
+}

Makefile

@@ -135,7 +135,7 @@ gitea-release: tools/gitea-release/bin/gitea-release.sh goreleaser
 		GITEA_RELEASE_COMMITISH_TARGET="$(GIT_VERSION)" \
 		GITEA_RELEASE_IS_DRAFT="false" \
 		GITEA_RELEASE_BODY="" \
-		GITEA_RELEASE_ATTACHMENTS="$(shell find .gitea-release/* -type f)" \
+		GITEA_RELEASE_ATTACHMENTS="$$(find .gitea-release/* -type f)" \
 		tools/gitea-release/bin/gitea-release.sh
 
 tools/gitea-release/bin/gitea-release.sh:
@@ -150,4 +150,8 @@ AGENT_ID ?= 1
 
 load-sample-specs:
 	cat misc/spec-samples/app.emissary.cadoles.com.json | ./bin/server api agent spec update -a $(AGENT_ID) --no-patch --spec-data - --spec-name app.emissary.cadoles.com
-	cat misc/spec-samples/proxy.emissary.cadoles.com.json | ./bin/server api agent spec update -a $(AGENT_ID) --no-patch --spec-data - --spec-name proxy.emissary.cadoles.com
+	cat misc/spec-samples/proxy.emissary.cadoles.com.json | ./bin/server api agent spec update -a $(AGENT_ID) --no-patch --spec-data - --spec-name proxy.emissary.cadoles.com
+	cat misc/spec-samples/mdns.emissary.cadoles.com.json | ./bin/server api agent spec update -a $(AGENT_ID) --no-patch --spec-data - --spec-name mdns.emissary.cadoles.com
+
+full-version:
+	@echo $(FULL_VERSION)

cmd/agent/main.go

@@ -7,6 +7,7 @@ import (
 	"forge.cadoles.com/Cadoles/emissary/internal/command/agent"
 	"forge.cadoles.com/Cadoles/emissary/internal/command/api"
 
+	_ "forge.cadoles.com/Cadoles/emissary/internal/imports/format"
 	_ "forge.cadoles.com/Cadoles/emissary/internal/imports/spec"
 )
 

go.mod

@@ -3,7 +3,7 @@ module forge.cadoles.com/Cadoles/emissary
 go 1.19
 
 require (
-	forge.cadoles.com/arcad/edge v0.0.0-20230328183829-d8ce2901d2ab
+	forge.cadoles.com/arcad/edge v0.0.0-20230402160147-f08f645432c6
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/alecthomas/participle/v2 v2.0.0-beta.5
 	github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
@@ -33,6 +33,7 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/barnybug/go-cast v0.0.0-20201201064555-a87ccbc26692 // indirect
+	github.com/brutella/dnssd v1.2.6 // indirect
 	github.com/dop251/goja_nodejs v0.0.0-20230320130059-dcf93ba651dd // indirect
 	github.com/gabriel-vasile/mimetype v1.4.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect

go.sum

@@ -56,6 +56,8 @@ cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 forge.cadoles.com/arcad/edge v0.0.0-20230328183829-d8ce2901d2ab h1:xOtzLAYOUcKd/VBx/PzL2riC0zNuQ/cxxf5r3AmEvJE=
 forge.cadoles.com/arcad/edge v0.0.0-20230328183829-d8ce2901d2ab/go.mod h1:ONd6vyQ0IM0vHi1i+bmZBRc1Fd0BoXMuDdY/+0sZefw=
+forge.cadoles.com/arcad/edge v0.0.0-20230402160147-f08f645432c6 h1:MxMEBSEvwagUrFORUJ9snZekFIKkaV3OB0EplXra+LU=
+forge.cadoles.com/arcad/edge v0.0.0-20230402160147-f08f645432c6/go.mod h1:ONd6vyQ0IM0vHi1i+bmZBRc1Fd0BoXMuDdY/+0sZefw=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
 github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
@@ -201,6 +203,8 @@ github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnweb
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/brutella/dnssd v1.2.6 h1:/0P13JkHLRzeLQkWRPEn4hJCr4T3NfknIFw3aNPIC34=
+github.com/brutella/dnssd v1.2.6/go.mod h1:JoW2sJUrmVIef25G6lrLj7HS6Xdwh6q8WUIvMkkBYXs=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
 github.com/btcsuite/btcd v0.20.1-beta/go.mod h1:wVuoA8VJLEcwgqHBwHmzLRazpKxTv13Px/pDuV7OomQ=
 github.com/btcsuite/btcd v0.22.0-beta.0.20220111032746-97732e52810c/go.mod h1:tjmYdS6MLJ5/s0Fj4DbLgSbDHbEqLJrtnHecBFkdz5M=
@@ -978,6 +982,7 @@ github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88J
 github.com/miekg/dns v0.0.0-20161006100029-fc4e1e2843d8/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
+github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
 github.com/miekg/dns v1.1.51 h1:0+Xg7vObnhrz/4ZCZcZh7zPXlmU0aveS2HDBd0m0qSo=
 github.com/miekg/dns v1.1.51/go.mod h1:2Z9d3CP1LQWihRZUf29mQ19yDThaI4DAYzte2CaQW5c=
 github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
@@ -1513,6 +1518,7 @@ golang.org/x/net v0.0.0-20210505024714-0287a6fb4125/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210520170846-37e1c6afe023/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -1803,6 +1809,7 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=

internal/agent/agent.go

@@ -44,8 +44,6 @@ func (a *Agent) Run(ctx context.Context) error {
 
 		if err := a.registerAgent(ctx, client, state); err != nil {
 			logger.Error(ctx, "could not register agent", logger.E(errors.WithStack(err)))
-
-			return
 		}
 
 		logger.Debug(ctx, "state before reconciliation", logger.F("state", state))
@@ -81,7 +79,7 @@ func (a *Agent) Reconcile(ctx context.Context, state *State) error {
 		)
 
 		if err := ctrl.Reconcile(ctrlCtx, state); err != nil {
-			return errors.WithStack(err)
+			logger.Error(ctx, "could not reconcile", logger.E(errors.WithStack(err)))
 		}
 	}
 

internal/agent/controller/app/app_handler.go

@@ -20,6 +20,7 @@ import (
 	"forge.cadoles.com/arcad/edge/pkg/module/auth"
 	"forge.cadoles.com/arcad/edge/pkg/module/blob"
 	"forge.cadoles.com/arcad/edge/pkg/module/cast"
+	fetchModule "forge.cadoles.com/arcad/edge/pkg/module/fetch"
 	"forge.cadoles.com/arcad/edge/pkg/module/net"
 	"forge.cadoles.com/arcad/edge/pkg/storage/sqlite"
 	"github.com/Masterminds/sprig/v3"
@@ -28,6 +29,8 @@ import (
 	"github.com/pkg/errors"
 )
 
+const defaultSQLiteParams = "?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)&_txlock=immediate"
+
 func (c *Controller) getHandlerOptions(ctx context.Context, appKey string, specs *spec.Spec) ([]edgeHTTP.HandlerOptionFunc, error) {
 	dataDir, err := c.ensureAppDataDir(ctx, appKey)
 	if err != nil {
@@ -35,7 +38,7 @@ func (c *Controller) getHandlerOptions(ctx context.Context, appKey string, specs
 	}
 
 	dbFile := filepath.Join(dataDir, appKey+".sqlite")
-	db, err := sqlite.Open(dbFile)
+	db, err := sqlite.Open(dbFile + defaultSQLiteParams)
 	if err != nil {
 		return nil, errors.Wrapf(err, "could not open database file '%s'", dbFile)
 	}
@@ -184,5 +187,6 @@ func (c *Controller) getAppModules(bus bus.Bus, db *sql.DB, spec *appSpec.Spec,
 			},
 		),
 		appModule.ModuleFactory(c.appRepository),
+		fetchModule.ModuleFactory(bus),
 	}
 }

internal/agent/controller/app/controller.go

@@ -16,8 +16,8 @@ import (
 )
 
 type serverEntry struct {
-	SpecHash uint64
-	Server   *Server
+	AppDefHash uint64
+	Server     *Server
 }
 
 type Controller struct {
@@ -124,7 +124,20 @@ func (c *Controller) updateAppRepository(ctx context.Context, specs *spec.Spec)
 func (c *Controller) updateApp(ctx context.Context, specs *spec.Spec, appKey string) (err error) {
 	appEntry := specs.Apps[appKey]
 
-	newAppSpecHash, err := hashstructure.Hash(appEntry, hashstructure.FormatV2, nil)
+	var auth *spec.Auth
+	if specs.Config != nil {
+		auth = specs.Config.Auth
+	}
+
+	appDef := struct {
+		App  spec.AppEntry
+		Auth *spec.Auth
+	}{
+		App:  appEntry,
+		Auth: auth,
+	}
+
+	newAppDefHash, err := hashstructure.Hash(appDef, hashstructure.FormatV2, nil)
 	if err != nil {
 		return errors.WithStack(err)
 	}
@@ -163,20 +176,20 @@ func (c *Controller) updateApp(ctx context.Context, specs *spec.Spec, appKey str
 		}
 
 		server = &serverEntry{
-			Server:   NewServer(bundle, auth, options...),
-			SpecHash: 0,
+			Server:     NewServer(bundle, auth, options...),
+			AppDefHash: 0,
 		}
 
 		c.servers[appKey] = server
 	}
 
-	specChanged := newAppSpecHash != server.SpecHash
+	defChanged := newAppDefHash != server.AppDefHash
 
-	if server.Server.Running() && !specChanged {
+	if server.Server.Running() && !defChanged {
 		return nil
 	}
 
-	if specChanged && server.SpecHash != 0 {
+	if defChanged && server.AppDefHash != 0 {
 		logger.Info(
 			ctx, "restarting app",
 			logger.F("address", appEntry.Address),
@@ -194,7 +207,7 @@ func (c *Controller) updateApp(ctx context.Context, specs *spec.Spec, appKey str
 		return errors.Wrap(err, "could not start app")
 	}
 
-	server.SpecHash = newAppSpecHash
+	server.AppDefHash = newAppDefHash
 
 	return nil
 }

internal/agent/controller/app/server.go

@@ -3,11 +3,13 @@ package app
 import (
 	"context"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app/spec"
 	appSpec "forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app/spec"
+	"forge.cadoles.com/Cadoles/emissary/internal/proxy/wildcard"
 	edgeHTTP "forge.cadoles.com/arcad/edge/pkg/http"
 	authHTTP "forge.cadoles.com/arcad/edge/pkg/module/auth/http"
 	"gitlab.com/wpetit/goweb/logger"
@@ -33,12 +35,15 @@ type Server struct {
 }
 
 func (s *Server) Start(ctx context.Context, addr string) (err error) {
-	if s.server != nil {
+	if s.Running() {
 		if err := s.Stop(); err != nil {
 			return errors.WithStack(err)
 		}
 	}
 
+	s.serverMutex.Lock()
+	defer s.serverMutex.Unlock()
+
 	router := chi.NewRouter()
 
 	router.Use(middleware.Logger)
@@ -83,9 +88,7 @@ func (s *Server) Start(ctx context.Context, addr string) (err error) {
 		}
 	}()
 
-	s.serverMutex.Lock()
 	s.server = server
-	s.serverMutex.Unlock()
 
 	return nil
 }
@@ -98,20 +101,25 @@ func (s *Server) Running() bool {
 }
 
 func (s *Server) Stop() error {
+	if !s.Running() {
+		return nil
+	}
+
+	s.serverMutex.Lock()
+	defer s.serverMutex.Unlock()
+
 	if s.server == nil {
 		return nil
 	}
 
-	defer func() {
-		s.serverMutex.Lock()
-		s.server = nil
-		s.serverMutex.Unlock()
-	}()
-
 	if err := s.server.Close(); err != nil {
-		panic(errors.WithStack(err))
+		s.server = nil
+
+		return errors.WithStack(err)
 	}
 
+	s.server = nil
+
 	return nil
 }
 
@@ -140,6 +148,10 @@ func (s *Server) configureAuth(router chi.Router, auth *spec.Auth) error {
 			}
 		}
 
+		if s.auth.Local.CookieDomain != "" {
+			router.Use(invalidCookieDomainRedirect(s.auth.Local.CookieDomain))
+		}
+
 		router.Handle("/auth/*", authHTTP.NewLocalHandler(
 			jwa.HS256, key,
 			authHTTP.WithRoutePrefix("/auth"),
@@ -158,3 +170,33 @@ func NewServer(bundle bundle.Bundle, auth *appSpec.Auth, handlerOptions ...edgeH
 		handlerOptions: handlerOptions,
 	}
 }
+
+func invalidCookieDomainRedirect(cookieDomain string) func(http.Handler) http.Handler {
+	domain := strings.TrimPrefix(cookieDomain, ".")
+	hostPattern := "*" + domain
+
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			hostParts := strings.SplitN(r.Host, ":", 2)
+
+			if !wildcard.Match(hostParts[0], hostPattern) {
+				url := r.URL
+
+				newHost := domain
+				if len(hostParts) > 1 {
+					newHost += ":" + hostParts[1]
+				}
+
+				url.Host = newHost
+
+				http.Redirect(w, r, url.String(), http.StatusTemporaryRedirect)
+
+				return
+			}
+
+			h.ServeHTTP(w, r)
+		}
+
+		return http.HandlerFunc(fn)
+	}
+}

internal/agent/controller/mdns/controller.go

@@ -0,0 +1,181 @@
+package mdns
+
+import (
+	"context"
+	"net"
+	"sync"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/agent"
+	mdns "forge.cadoles.com/Cadoles/emissary/internal/agent/controller/mdns/spec"
+	"github.com/brutella/dnssd"
+	"github.com/mitchellh/hashstructure/v2"
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+const (
+	DefaultDomain = "local"
+)
+
+type Controller struct {
+	serviceDefHash uint64
+	cancel         context.CancelFunc
+	responder      dnssd.Responder
+	mutex          sync.RWMutex
+}
+
+// Name implements node.Controller.
+func (c *Controller) Name() string {
+	return "mdns-controller"
+}
+
+// Reconcile implements node.Controller.
+func (c *Controller) Reconcile(ctx context.Context, state *agent.State) error {
+	mdnsSpec := mdns.NewSpec()
+
+	if err := state.GetSpec(mdns.Name, mdnsSpec); err != nil {
+		if errors.Is(err, agent.ErrSpecNotFound) {
+			logger.Info(ctx, "could not find mdns spec")
+
+			c.stopResponder(ctx)
+
+			return nil
+		}
+
+		return errors.WithStack(err)
+	}
+
+	logger.Info(ctx, "retrieved spec", logger.F("spec", mdnsSpec.SpecName()), logger.F("revision", mdnsSpec.SpecRevision()))
+
+	if err := c.updateResponder(ctx, mdnsSpec); err != nil {
+		return errors.Wrap(err, "could not update responder")
+	}
+
+	return nil
+}
+
+func (c *Controller) stopResponder(ctx context.Context) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	if c.responder == nil {
+		return
+	}
+
+	c.cancel()
+	c.responder = nil
+	c.cancel = nil
+}
+
+func (c *Controller) updateResponder(ctx context.Context, spec *mdns.Spec) error {
+	serviceDef := struct {
+		Services map[string]mdns.Service
+	}{
+		Services: spec.Services,
+	}
+
+	newServerDefHash, err := hashstructure.Hash(serviceDef, hashstructure.FormatV2, nil)
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	c.mutex.RLock()
+	if newServerDefHash == c.serviceDefHash && c.responder != nil {
+		c.mutex.RUnlock()
+		return nil
+	}
+	c.mutex.RUnlock()
+
+	c.stopResponder(ctx)
+
+	defaultIfaces, err := c.getDefaultIfaces()
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	services := make([]dnssd.Service, 0, len(spec.Services))
+
+	for name, service := range spec.Services {
+		domain := service.Domain
+		if domain == "" {
+			domain = DefaultDomain
+		}
+
+		ifaces := service.Ifaces
+		if len(ifaces) == 0 {
+			ifaces = defaultIfaces
+		}
+
+		config := dnssd.Config{
+			Name:   name,
+			Type:   service.Type,
+			Domain: domain,
+			Host:   service.Host,
+			Ifaces: ifaces,
+			Port:   service.Port,
+		}
+
+		service, err := dnssd.NewService(config)
+		if err != nil {
+			logger.Error(ctx, "could not create mdns service", logger.E(errors.WithStack(err)))
+
+			continue
+		}
+
+		services = append(services, service)
+	}
+
+	responder, err := dnssd.NewResponder()
+	if err != nil {
+		return errors.WithStack(err)
+	}
+
+	for _, service := range services {
+		if _, err := responder.Add(service); err != nil {
+			logger.Error(ctx, "could not add mdns service", logger.E(errors.WithStack(err)))
+
+			continue
+		}
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	c.responder = responder
+	c.cancel = cancel
+	c.serviceDefHash = newServerDefHash
+
+	go func() {
+		defer c.stopResponder(ctx)
+
+		if err := responder.Respond(ctx); err != nil && !errors.Is(err, context.Canceled) {
+			logger.Error(ctx, "could not respond to mdns queries", logger.E(errors.WithStack(err)))
+		}
+	}()
+
+	return nil
+}
+
+func (c *Controller) getDefaultIfaces() ([]string, error) {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	ifaceNames := make([]string, len(ifaces))
+
+	for idx, ifa := range ifaces {
+		ifaceNames[idx] = ifa.Name
+	}
+
+	return ifaceNames, nil
+}
+
+func NewController() *Controller {
+	return &Controller{
+		cancel:         nil,
+		responder:      nil,
+		serviceDefHash: 0,
+	}
+}
+
+var _ agent.Controller = &Controller{}

internal/agent/controller/mdns/spec/init.go

@@ -0,0 +1,17 @@
+package spec
+
+import (
+	_ "embed"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/spec"
+	"github.com/pkg/errors"
+)
+
+//go:embed schema.json
+var schema []byte
+
+func init() {
+	if err := spec.Register(Name, schema); err != nil {
+		panic(errors.WithStack(err))
+	}
+}

internal/agent/controller/mdns/spec/schema.json

@@ -0,0 +1,47 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://mdns.edge.emissary.cadoles.com/spec.json",
+    "title": "MDNSSpec",
+    "description": "Emissary 'MDNS' specification",
+    "type": "object",
+    "properties": {
+        "services": {
+            "type": "object",
+            "patternProperties": {
+                ".*": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string"
+                        },
+                        "domain": {
+                            "type": "string"
+                        },
+                        "host": {
+                            "type": "string"
+                        },
+                        "ifaces": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        },
+                        "port": {
+                            "type": "number"
+                        }
+                    },
+                    "required": [
+                        "type",
+                        "host",
+                        "port"
+                    ],
+                    "additionalProperties": false
+                }
+            }
+        }
+    },
+    "required": [
+        "services"
+    ],
+    "additionalProperties": false
+}

internal/agent/controller/mdns/spec/spec.go

@@ -0,0 +1,42 @@
+package spec
+
+import (
+	"forge.cadoles.com/Cadoles/emissary/internal/spec"
+)
+
+const Name spec.Name = "mdns.emissary.cadoles.com"
+
+type Spec struct {
+	Revision int                `json:"revision"`
+	Services map[string]Service `json:"services"`
+}
+
+type Service struct {
+	Type   string   `json:"type"`
+	Domain string   `json:"domain"`
+	Host   string   `json:"host"`
+	Ifaces []string `json:"ifaces"`
+	Port   int      `json:"port"`
+}
+
+func (s *Spec) SpecName() spec.Name {
+	return Name
+}
+
+func (s *Spec) SpecRevision() int {
+	return s.Revision
+}
+
+func (s *Spec) SpecData() map[string]any {
+	return map[string]any{
+		"services": s.Services,
+	}
+}
+
+func NewSpec() *Spec {
+	return &Spec{
+		Revision: -1,
+	}
+}
+
+var _ spec.Spec = &Spec{}

internal/agent/controller/mdns/spec/testdata/spec-ok.json

@@ -0,0 +1,15 @@
+{
+  "name": "mdns.emissary.cadoles.com",
+  "data": {
+    "services": {
+      "My Website": {
+        "type": "_http._tcp",
+        "domain": "local",
+        "host": "mywebsite",
+        "ifaces": ["lo", "eth0"],
+        "port": 80
+      }
+    }
+  },
+  "revision": 0
+}

internal/agent/controller/mdns/spec/validator_test.go

@@ -0,0 +1,65 @@
+package spec
+
+import (
+	"context"
+	"encoding/json"
+	"io/ioutil"
+	"testing"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/spec"
+	"github.com/pkg/errors"
+)
+
+type validatorTestCase struct {
+	Name       string
+	Source     string
+	ShouldFail bool
+}
+
+var validatorTestCases = []validatorTestCase{
+	{
+		Name:       "SpecOK",
+		Source:     "testdata/spec-ok.json",
+		ShouldFail: false,
+	},
+}
+
+func TestValidator(t *testing.T) {
+	t.Parallel()
+
+	validator := spec.NewValidator()
+	if err := validator.Register(Name, schema); err != nil {
+		t.Fatalf("+%v", errors.WithStack(err))
+	}
+
+	for _, tc := range validatorTestCases {
+		func(tc validatorTestCase) {
+			t.Run(tc.Name, func(t *testing.T) {
+				t.Parallel()
+
+				rawSpec, err := ioutil.ReadFile(tc.Source)
+				if err != nil {
+					t.Fatalf("+%v", errors.WithStack(err))
+				}
+
+				var spec spec.RawSpec
+
+				if err := json.Unmarshal(rawSpec, &spec); err != nil {
+					t.Fatalf("+%v", errors.WithStack(err))
+				}
+
+				ctx := context.Background()
+
+				err = validator.Validate(ctx, &spec)
+
+				if !tc.ShouldFail && err != nil {
+					t.Errorf("+%v", errors.WithStack(err))
+				}
+
+				if tc.ShouldFail && err == nil {
+					t.Error("validation should have failed")
+				}
+			})
+		}(tc)
+	}
+}

internal/auth/agent/authenticator.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 	"strings"
+	"time"
 
 	"forge.cadoles.com/Cadoles/emissary/internal/auth"
 	"forge.cadoles.com/Cadoles/emissary/internal/datastore"
@@ -13,8 +14,11 @@ import (
 	"gitlab.com/wpetit/goweb/logger"
 )
 
+const DefaultAcceptableSkew = 5 * time.Minute
+
 type Authenticator struct {
-	repo datastore.AgentRepository
+	repo           datastore.AgentRepository
+	acceptableSkew time.Duration
 }
 
 // Authenticate implements auth.Authenticator.
@@ -71,11 +75,19 @@ func (a *Authenticator) Authenticate(ctx context.Context, r *http.Request) (auth
 		[]byte(rawToken),
 		jwt.WithKeySet(agent.KeySet.Set, jws.WithRequireKid(false)),
 		jwt.WithValidate(true),
+		jwt.WithAcceptableSkew(a.acceptableSkew),
 	)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
 
+	contactedAt := time.Now()
+
+	agent, err = a.repo.Update(ctx, agent.ID, datastore.WithAgentUpdateContactedAt(contactedAt))
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
 	user := &User{
 		agent: agent,
 	}
@@ -83,9 +95,10 @@ func (a *Authenticator) Authenticate(ctx context.Context, r *http.Request) (auth
 	return user, nil
 }
 
-func NewAuthenticator(repo datastore.AgentRepository) *Authenticator {
+func NewAuthenticator(repo datastore.AgentRepository, acceptableSkew time.Duration) *Authenticator {
 	return &Authenticator{
-		repo: repo,
+		repo:           repo,
+		acceptableSkew: acceptableSkew,
 	}
 }
 

internal/auth/agent/jwt.go

@@ -18,7 +18,7 @@ func GenerateToken(key jwk.Key, thumbprint string) (string, error) {
 		return "", errors.WithStack(err)
 	}
 
-	now := time.Now()
+	now := time.Now().UTC()
 
 	if err := token.Set(jwt.NotBeforeKey, now); err != nil {
 		return "", errors.WithStack(err)

internal/auth/thirdparty/authenticator.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 	"strings"
+	"time"
 
 	"forge.cadoles.com/Cadoles/emissary/internal/auth"
 	"forge.cadoles.com/Cadoles/emissary/internal/jwk"
@@ -11,9 +12,12 @@ import (
 	"gitlab.com/wpetit/goweb/logger"
 )
 
+const DefaultAcceptableSkew = 5 * time.Minute
+
 type Authenticator struct {
-	keys   jwk.Set
-	issuer string
+	keys           jwk.Set
+	issuer         string
+	acceptableSkew time.Duration
 }
 
 // Authenticate implements auth.Authenticator.
@@ -30,7 +34,7 @@ func (a *Authenticator) Authenticate(ctx context.Context, r *http.Request) (auth
 		return nil, errors.WithStack(auth.ErrUnauthenticated)
 	}
 
-	token, err := parseToken(ctx, a.keys, a.issuer, rawToken)
+	token, err := parseToken(ctx, a.keys, a.issuer, rawToken, a.acceptableSkew)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
@@ -57,10 +61,11 @@ func (a *Authenticator) Authenticate(ctx context.Context, r *http.Request) (auth
 	return user, nil
 }
 
-func NewAuthenticator(keys jwk.Set, issuer string) *Authenticator {
+func NewAuthenticator(keys jwk.Set, issuer string, acceptableSkew time.Duration) *Authenticator {
 	return &Authenticator{
-		keys:   keys,
-		issuer: issuer,
+		keys:           keys,
+		issuer:         issuer,
+		acceptableSkew: acceptableSkew,
 	}
 }
 

internal/auth/thirdparty/jwt.go

@@ -13,12 +13,13 @@ import (
 
 const keyRole = "role"
 
-func parseToken(ctx context.Context, keys jwk.Set, issuer string, rawToken string) (jwt.Token, error) {
+func parseToken(ctx context.Context, keys jwk.Set, issuer string, rawToken string, acceptableSkew time.Duration) (jwt.Token, error) {
 	token, err := jwt.Parse(
 		[]byte(rawToken),
 		jwt.WithKeySet(keys, jws.WithRequireKid(false)),
 		jwt.WithIssuer(issuer),
 		jwt.WithValidate(true),
+		jwt.WithAcceptableSkew(acceptableSkew),
 	)
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -42,7 +43,7 @@ func GenerateToken(ctx context.Context, key jwk.Key, issuer, subject string, rol
 		return "", errors.WithStack(err)
 	}
 
-	now := time.Now()
+	now := time.Now().UTC()
 
 	if err := token.Set(jwt.NotBeforeKey, now); err != nil {
 		return "", errors.WithStack(err)

internal/client/update_agent.go

@@ -10,6 +10,7 @@ import (
 
 type UpdateAgentOptions struct {
 	Status  *int
+	Label   *string
 	Options []OptionFunc
 }
 
@@ -21,6 +22,12 @@ func WithAgentStatus(status int) UpdateAgentOptionFunc {
 	}
 }
 
+func WithAgentLabel(label string) UpdateAgentOptionFunc {
+	return func(opts *UpdateAgentOptions) {
+		opts.Label = &label
+	}
+}
+
 func WithUpdateAgentsOptions(funcs ...OptionFunc) UpdateAgentOptionFunc {
 	return func(opts *UpdateAgentOptions) {
 		opts.Options = funcs
@@ -39,6 +46,10 @@ func (c *Client) UpdateAgent(ctx context.Context, agentID datastore.AgentID, fun
 		payload["status"] = *opts.Status
 	}
 
+	if opts.Label != nil {
+		payload["label"] = *opts.Label
+	}
+
 	response := withResponse[struct {
 		Agent *datastore.Agent `json:"agent"`
 	}]()

internal/command/agent/run.go

@@ -5,6 +5,7 @@ import (
 
 	"forge.cadoles.com/Cadoles/emissary/internal/agent"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app"
+	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/mdns"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/openwrt"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/persistence"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/proxy"
@@ -49,10 +50,6 @@ func RunCommand() *cli.Command {
 				controllers = append(controllers, spec.NewController())
 			}
 
-			if ctrlConf.Proxy.Enabled {
-				controllers = append(controllers, proxy.NewController())
-			}
-
 			if ctrlConf.UCI.Enabled {
 				controllers = append(controllers, openwrt.NewUCIController(
 					string(ctrlConf.UCI.BinPath),
@@ -66,6 +63,14 @@ func RunCommand() *cli.Command {
 				))
 			}
 
+			if ctrlConf.Proxy.Enabled {
+				controllers = append(controllers, proxy.NewController())
+			}
+
+			if ctrlConf.MDNS.Enabled {
+				controllers = append(controllers, mdns.NewController())
+			}
+
 			if ctrlConf.SysUpgrade.Enabled {
 				sysUpgradeArgs := make([]string, 0)
 				if len(ctrlConf.SysUpgrade.SysUpgradeCommand) > 1 {

internal/command/api/agent/update.go

@@ -22,6 +22,11 @@ func UpdateCommand() *cli.Command {
 				Usage: "Set `STATUS` to selected agent",
 				Value: -1,
 			},
+			&cli.StringFlag{
+				Name:  "label",
+				Usage: "Set `LABEL` to selected agent",
+				Value: "",
+			},
 		),
 		Action: func(ctx *cli.Context) error {
 			baseFlags := clientFlag.GetBaseFlags(ctx)
@@ -43,6 +48,11 @@ func UpdateCommand() *cli.Command {
 				options = append(options, client.WithAgentStatus(status))
 			}
 
+			label := ctx.String("label")
+			if label != "" {
+				options = append(options, client.WithAgentLabel(label))
+			}
+
 			client := client.New(baseFlags.ServerURL, client.WithToken(token))
 
 			agent, err := client.UpdateAgent(ctx.Context, agentID, options...)

internal/command/api/agent/util.go

@@ -7,9 +7,10 @@ func agentHints(outputMode format.OutputMode) format.Hints {
 		OutputMode: outputMode,
 		Props: []format.Prop{
 			format.NewProp("ID", "ID"),
+			format.NewProp("Label", "Label"),
 			format.NewProp("Thumbprint", "Thumbprint"),
 			format.NewProp("Status", "Status"),
-			format.NewProp("CreatedAt", "CreatedAt"),
+			format.NewProp("ContactedAt", "ContactedAt"),
 			format.NewProp("UpdatedAt", "UpdatedAt"),
 		},
 	}

internal/config/agent.go

@@ -23,6 +23,7 @@ type ControllersConfig struct {
 	UCI         UCIControllerConfig         `yaml:"uci"`
 	App         AppControllerConfig         `yaml:"app"`
 	SysUpgrade  SysUpgradeControllerConfig  `yaml:"sysupgrade"`
+	MDNS        MDNSControllerConfig        `yaml:"mdns"`
 }
 
 type PersistenceControllerConfig struct {
@@ -55,6 +56,10 @@ type SysUpgradeControllerConfig struct {
 	FirmwareVersionCommand InterpolatedStringSlice `yaml:"firmwareVersionCommand"`
 }
 
+type MDNSControllerConfig struct {
+	Enabled InterpolatedBool `yaml:"enabled"`
+}
+
 func NewDefaultAgentConfig() AgentConfig {
 	return AgentConfig{
 		ServerURL:              "http://127.0.0.1:3000",
@@ -86,6 +91,9 @@ func NewDefaultAgentConfig() AgentConfig {
 				SysUpgradeCommand:      InterpolatedStringSlice{"sysupgrade", "--force", "-u", "-v", openwrt.FirmwareFileTemplate},
 				FirmwareVersionCommand: InterpolatedStringSlice{"sh", "-c", `source /etc/openwrt_release && echo "$DISTRIB_ID-$DISTRIB_RELEASE-$DISTRIB_REVISION"`},
 			},
+			MDNS: MDNSControllerConfig{
+				Enabled: true,
+			},
 		},
 		Collectors: []ShellCollectorConfig{
 			{

internal/config/database.go

@@ -15,6 +15,6 @@ type DatabaseConfig struct {
 func NewDefaultDatabaseConfig() DatabaseConfig {
 	return DatabaseConfig{
 		Driver: "sqlite",
-		DSN:    "sqlite://emissary.sqlite",
+		DSN:    "sqlite://emissary.sqlite?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)&_txlock=immediate",
 	}
 }

internal/datastore/agent.go

@@ -20,13 +20,15 @@ const (
 )
 
 type Agent struct {
-	ID         AgentID             `json:"id"`
-	Thumbprint string              `json:"thumbprint"`
-	KeySet     *SerializableKeySet `json:"keyset,omitempty"`
-	Metadata   map[string]any      `json:"metadata,omitempty"`
-	Status     AgentStatus         `json:"status"`
-	CreatedAt  time.Time           `json:"createdAt"`
-	UpdatedAt  time.Time           `json:"updatedAt"`
+	ID          AgentID             `json:"id"`
+	Label       string              `json:"label"`
+	Thumbprint  string              `json:"thumbprint"`
+	KeySet      *SerializableKeySet `json:"keyset,omitempty"`
+	Metadata    map[string]any      `json:"metadata,omitempty"`
+	Status      AgentStatus         `json:"status"`
+	CreatedAt   time.Time           `json:"createdAt"`
+	UpdatedAt   time.Time           `json:"updatedAt"`
+	ContactedAt *time.Time          `json:"contactedAt,omitempty"`
 }
 
 type SerializableKeySet struct {

internal/datastore/agent_repository.go

@@ -2,6 +2,7 @@ package datastore
 
 import (
 	"context"
+	"time"
 
 	"github.com/lestrrat-go/jwx/v2/jwk"
 )
@@ -68,10 +69,12 @@ func WithAgentQueryThumbprints(thumbprints ...string) AgentQueryOptionFunc {
 type AgentUpdateOptionFunc func(*AgentUpdateOptions)
 
 type AgentUpdateOptions struct {
-	Status     *AgentStatus
-	Metadata   *map[string]any
-	KeySet     *jwk.Set
-	Thumbprint *string
+	Label       *string
+	Status      *AgentStatus
+	ContactedAt *time.Time
+	Metadata    *map[string]any
+	KeySet      *jwk.Set
+	Thumbprint  *string
 }
 
 func WithAgentUpdateStatus(status AgentStatus) AgentUpdateOptionFunc {
@@ -97,3 +100,15 @@ func WithAgentUpdateThumbprint(thumbprint string) AgentUpdateOptionFunc {
 		opts.Thumbprint = &thumbprint
 	}
 }
+
+func WithAgentUpdateLabel(label string) AgentUpdateOptionFunc {
+	return func(opts *AgentUpdateOptions) {
+		opts.Label = &label
+	}
+}
+
+func WithAgentUpdateContactedAt(contactedAt time.Time) AgentUpdateOptionFunc {
+	return func(opts *AgentUpdateOptions) {
+		opts.ContactedAt = &contactedAt
+	}
+}

internal/datastore/sqlite/agent_repository.go

@@ -45,7 +45,11 @@ func (r *AgentRepository) GetSpecs(ctx context.Context, agentID datastore.AgentI
 		return nil, errors.WithStack(err)
 	}
 
-	defer rows.Close()
+	defer func() {
+		if err := rows.Close(); err != nil {
+			logger.Error(ctx, "could not close rows", logger.E(errors.WithStack(err)))
+		}
+	}()
 
 	for rows.Next() {
 		spec := &datastore.Spec{}
@@ -61,6 +65,10 @@ func (r *AgentRepository) GetSpecs(ctx context.Context, agentID datastore.AgentI
 		specs = append(specs, spec)
 	}
 
+	if err := rows.Err(); err != nil {
+		return nil, errors.WithStack(err)
+	}
+
 	return specs, nil
 }
 
@@ -119,7 +127,7 @@ func (r *AgentRepository) Query(ctx context.Context, opts ...datastore.AgentQuer
 	count := 0
 
 	err := r.withTx(ctx, func(tx *sql.Tx) error {
-		query := `SELECT id, thumbprint, status, created_at, updated_at FROM agents`
+		query := `SELECT id, label, thumbprint, status, contacted_at, created_at, updated_at FROM agents`
 
 		limit := 10
 		if options.Limit != nil {
@@ -176,22 +184,34 @@ func (r *AgentRepository) Query(ctx context.Context, opts ...datastore.AgentQuer
 			return errors.WithStack(err)
 		}
 
-		defer rows.Close()
+		defer func() {
+			if err := rows.Close(); err != nil {
+				logger.Error(ctx, "could not close rows", logger.E(errors.WithStack(err)))
+			}
+		}()
 
 		for rows.Next() {
 			agent := &datastore.Agent{}
 
 			metadata := JSONMap{}
+			contactedAt := sql.NullTime{}
 
-			if err := rows.Scan(&agent.ID, &agent.Thumbprint, &agent.Status, &agent.CreatedAt, &agent.UpdatedAt); err != nil {
+			if err := rows.Scan(&agent.ID, &agent.Label, &agent.Thumbprint, &agent.Status, &contactedAt, &agent.CreatedAt, &agent.UpdatedAt); err != nil {
 				return errors.WithStack(err)
 			}
 
 			agent.Metadata = metadata
+			if contactedAt.Valid {
+				agent.ContactedAt = &contactedAt.Time
+			}
 
 			agents = append(agents, agent)
 		}
 
+		if err := rows.Err(); err != nil {
+			return errors.WithStack(err)
+		}
+
 		row := tx.QueryRowContext(ctx, `SELECT count(id) FROM agents `+filters, args...)
 		if err := row.Scan(&count); err != nil {
 			return errors.WithStack(err)
@@ -299,7 +319,7 @@ func (r *AgentRepository) Get(ctx context.Context, id datastore.AgentID) (*datas
 
 	err := r.withTx(ctx, func(tx *sql.Tx) error {
 		query := `
-		SELECT "id", "thumbprint", "keyset", "metadata", "status", "created_at", "updated_at"
+		SELECT "id", "label", "thumbprint", "keyset", "metadata", "status", "contacted_at", "created_at", "updated_at"
 		FROM agents
 		WHERE id = $1
 		`
@@ -307,9 +327,10 @@ func (r *AgentRepository) Get(ctx context.Context, id datastore.AgentID) (*datas
 		row := r.db.QueryRowContext(ctx, query, id)
 
 		metadata := JSONMap{}
+		contactedAt := sql.NullTime{}
 		var rawKeySet []byte
 
-		if err := row.Scan(&agent.ID, &agent.Thumbprint, &rawKeySet, &metadata, &agent.Status, &agent.CreatedAt, &agent.UpdatedAt); err != nil {
+		if err := row.Scan(&agent.ID, &agent.Label, &agent.Thumbprint, &rawKeySet, &metadata, &agent.Status, &contactedAt, &agent.CreatedAt, &agent.UpdatedAt); err != nil {
 			if errors.Is(err, sql.ErrNoRows) {
 				return datastore.ErrNotFound
 			}
@@ -318,6 +339,9 @@ func (r *AgentRepository) Get(ctx context.Context, id datastore.AgentID) (*datas
 		}
 
 		agent.Metadata = metadata
+		if contactedAt.Valid {
+			agent.ContactedAt = &contactedAt.Time
+		}
 
 		keySet := jwk.NewSet()
 		if err := json.Unmarshal(rawKeySet, &keySet); err != nil {
@@ -346,15 +370,11 @@ func (r *AgentRepository) Update(ctx context.Context, id datastore.AgentID, opts
 
 	err := r.withTx(ctx, func(tx *sql.Tx) error {
 		query := `
-			UPDATE agents SET updated_at = $2
+			UPDATE agents SET id = $1
 		`
 
-		now := time.Now().UTC()
-
-		args := []any{
-			id, now,
-		}
-		index := 3
+		args := []any{id}
+		index := 2
 
 		if options.Status != nil {
 			query += fmt.Sprintf(`, status = $%d`, index)
@@ -379,23 +399,51 @@ func (r *AgentRepository) Update(ctx context.Context, id datastore.AgentID, opts
 			index++
 		}
 
+		if options.Label != nil {
+			query += fmt.Sprintf(`, label = $%d`, index)
+			args = append(args, *options.Label)
+			index++
+		}
+
+		if options.ContactedAt != nil {
+			query += fmt.Sprintf(`, contacted_at = $%d`, index)
+			utc := options.ContactedAt.UTC()
+			args = append(args, utc)
+			index++
+		}
+
 		if options.Metadata != nil {
 			query += fmt.Sprintf(`, metadata = $%d`, index)
 			args = append(args, JSONMap(*options.Metadata))
 			index++
 		}
 
+		updated := options.Metadata != nil ||
+			options.Status != nil ||
+			options.Label != nil ||
+			options.KeySet != nil ||
+			options.Thumbprint != nil
+		if updated {
+			now := time.Now().UTC()
+			query += fmt.Sprintf(`, updated_at = $%d`, index)
+			args = append(args, now)
+			index++
+		}
+
 		query += `
 			WHERE id = $1 
-			RETURNING "id", "thumbprint", "keyset", "metadata", "status", "created_at", "updated_at"
+			RETURNING "id", "label", "thumbprint", "keyset", "metadata", "status", "contacted_at", "created_at", "updated_at"
 		`
 
+		logger.Debug(ctx, "executing query", logger.F("query", query), logger.F("args", args))
+
 		row := tx.QueryRowContext(ctx, query, args...)
 
 		metadata := JSONMap{}
+		contactedAt := sql.NullTime{}
 		var rawKeySet []byte
 
-		if err := row.Scan(&agent.ID, &agent.Thumbprint, &rawKeySet, &metadata, &agent.Status, &agent.CreatedAt, &agent.UpdatedAt); err != nil {
+		if err := row.Scan(&agent.ID, &agent.Label, &agent.Thumbprint, &rawKeySet, &metadata, &agent.Status, &contactedAt, &agent.CreatedAt, &agent.UpdatedAt); err != nil {
 			if errors.Is(err, sql.ErrNoRows) {
 				return datastore.ErrNotFound
 			}
@@ -404,6 +452,9 @@ func (r *AgentRepository) Update(ctx context.Context, id datastore.AgentID, opts
 		}
 
 		agent.Metadata = metadata
+		if contactedAt.Valid {
+			agent.ContactedAt = &contactedAt.Time
+		}
 
 		keySet := jwk.NewSet()
 		if err := json.Unmarshal(rawKeySet, &keySet); err != nil {

internal/imports/spec/spec_import.go

@@ -2,6 +2,7 @@ package spec
 
 import (
 	_ "forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app/spec"
+	_ "forge.cadoles.com/Cadoles/emissary/internal/agent/controller/mdns/spec"
 	_ "forge.cadoles.com/Cadoles/emissary/internal/agent/controller/openwrt/spec/sysupgrade"
 	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/proxy"
 	_ "forge.cadoles.com/Cadoles/emissary/internal/spec/uci"

internal/server/agent_api.go

@@ -145,6 +145,7 @@ func (s *Server) registerAgent(w http.ResponseWriter, r *http.Request) {
 
 type updateAgentRequest struct {
 	Status *datastore.AgentStatus `json:"status" validate:"omitempty,oneof=0 1 2 3"`
+	Label  *string                `json:"label" validate:"omitempty"`
 }
 
 func (s *Server) updateAgent(w http.ResponseWriter, r *http.Request) {
@@ -166,6 +167,10 @@ func (s *Server) updateAgent(w http.ResponseWriter, r *http.Request) {
 		options = append(options, datastore.WithAgentUpdateStatus(*updateAgentReq.Status))
 	}
 
+	if updateAgentReq.Label != nil {
+		options = append(options, datastore.WithAgentUpdateLabel(*updateAgentReq.Label))
+	}
+
 	agent, err := s.agentRepo.Update(
 		ctx,
 		datastore.AgentID(agentID),

internal/server/server.go

@@ -105,8 +105,8 @@ func (s *Server) run(parentCtx context.Context, addrs chan net.Addr, errs chan e
 
 		r.Group(func(r chi.Router) {
 			r.Use(auth.Middleware(
-				thirdparty.NewAuthenticator(keys, string(s.conf.Issuer)),
-				agent.NewAuthenticator(s.agentRepo),
+				thirdparty.NewAuthenticator(keys, string(s.conf.Issuer), thirdparty.DefaultAcceptableSkew),
+				agent.NewAuthenticator(s.agentRepo, agent.DefaultAcceptableSkew),
 			))
 
 			r.Route("/agents", func(r chi.Router) {

migrations/sqlite/0000001_agent_label.down.sql

@@ -0,0 +1 @@
+ALTER TABLE agents DROP COLUMN label;

migrations/sqlite/0000001_agent_label.up.sql

@@ -0,0 +1 @@
+ALTER TABLE agents ADD COLUMN label TEXT DEFAULT "";

migrations/sqlite/0000002_agent_contactedat.down.sql

@@ -0,0 +1 @@
+ALTER TABLE agents DROP COLUMN contacted_at;

migrations/sqlite/0000002_agent_contactedat.up.sql

@@ -0,0 +1 @@
+ALTER TABLE agents ADD COLUMN contacted_at datetime;

misc/jenkins/Dockerfile

@@ -0,0 +1,24 @@
+FROM reg.cadoles.com/proxy_cache/library/ubuntu:22.04
+
+ARG HTTP_PROXY=
+ARG HTTPS_PROXY=
+ARG http_proxy=
+ARG https_proxy=
+ARG GO_VERSION=1.19.2
+
+# Install dev environment dependencies
+RUN export DEBIAN_FRONTEND=noninteractive &&\
+    apt-get update -y &&\
+    apt-get install -y --no-install-recommends curl ca-certificates build-essential wget unzip tar git jq
+
+# Install Go
+RUN mkdir -p /tmp \
+    && wget -O /tmp/go${GO_VERSION}.linux-amd64.tar.gz https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz \
+    && rm -rf /usr/local/go \
+    && mkdir -p /usr/local \
+    && tar -C /usr/local -xzf /tmp/go${GO_VERSION}.linux-amd64.tar.gz
+
+ENV PATH="${PATH}:/usr/local/go/bin"
+
+# Add LetsEncrypt certificates
+RUN curl -k https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash

misc/packaging/common/config-server.yml

@@ -9,7 +9,7 @@ server:
     port: 3000
   database:
     driver: sqlite
-    dsn: sqlite:///var/lib/emissary/data.sqlite
+    dsn: sqlite:///var/lib/emissary/data.sqlite?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)&_txlock=immediate
   cors:
     allowedOrigins: []
     allowCredentials: true

misc/spec-samples/mdns.emissary.cadoles.com.json

@@ -0,0 +1,38 @@
+{
+    "services": {
+        "arcad": {
+            "type": "_http._tcp",
+            "port": 8080,
+            "host": "arcad",
+            "ifaces": ["wlp4s0"]
+        },
+        "portal": {
+            "type": "_http._tcp",
+            "port": 8080,
+            "host": "portal",
+            "domain": "arcad.local",
+            "ifaces": ["wlp4s0"]
+        },
+        "hextris": {
+            "type": "_http._tcp",
+            "port": 8080,
+            "host": "hextris",
+            "domain": "arcad.local",
+            "ifaces": ["wlp4s0"]
+        },
+        "test": {
+            "type": "_http._tcp",
+            "port": 8080,
+            "host": "test",
+            "domain": "arcad.local",
+            "ifaces": ["wlp4s0"]
+        },
+        "diffusion": {
+            "type": "_http._tcp",
+            "port": 8080,
+            "host": "diffusion",
+            "domain": "arcad.local",
+            "ifaces": ["wlp4s0"]
+        }
+    }
+}

misc/spec-samples/proxy.emissary.cadoles.com.json

@@ -19,6 +19,22 @@
                     "hostPattern": "diffusion.arcad.local:*",
                     "target": "http://localhost:8085"
                 },
+                {
+                    "hostPattern": "arcad-portal.local:*",
+                    "target": "http://localhost:8082"
+                },
+                {
+                    "hostPattern": "arcad-hextris.local:*",
+                    "target": "http://localhost:8083"
+                },
+                {
+                    "hostPattern": "arcad-test.local:*",
+                    "target": "http://localhost:8084"
+                },
+                {
+                    "hostPattern": "arcad-diffusion.local:*",
+                    "target": "http://localhost:8085"
+                },
                 {
                     "hostPattern": "*",
                     "target": "http://localhost:8082"