feat: update arcad/edge dependency

Jenkinsfile

@@ -10,14 +10,24 @@ pipeline {
     }
 
     stages {
+        stage('Cancel older jobs') {
+            steps {
+                script {
+                    def buildNumber = env.BUILD_NUMBER as int
+                    if (buildNumber > 1) milestone(buildNumber - 1)
+                    milestone(buildNumber)
+                }
+            }
+        }
+        
         stage('Run unit tests') {
             steps {
                 script {
                     withCredentials([
                         usernamePassword([
-                        credentialsId: 'forge-jenkins',
-                        usernameVariable: 'GIT_USERNAME',
-                        passwordVariable: 'GIT_PASSWORD'
+                            credentialsId: 'forge-jenkins',
+                            usernameVariable: 'GIT_USERNAME',
+                            passwordVariable: 'GIT_PASSWORD'
                         ])
                     ]) {
                         sh '''
@@ -43,20 +53,25 @@ pipeline {
                 script {
                     withCredentials([
                         usernamePassword([
-                        credentialsId: 'forge-jenkins',
-                        usernameVariable: 'GITEA_RELEASE_USERNAME',
-                        passwordVariable: 'GITEA_RELEASE_PASSWORD'
+                            credentialsId: 'forge-jenkins',
+                            usernameVariable: 'GITEA_RELEASE_USERNAME',
+                            passwordVariable: 'GITEA_RELEASE_PASSWORD'
                         ])
                     ]) {
                         sh 'make gitea-release'
                     }
                     def currentVersion = sh(returnStdout: true, script: 'make full-version').trim()
-                    build(
-                        job: "../emissary-firmware/${env.GIT_BRANCH}",
-                        parameters: [
-                            [$class: 'StringParameterValue', name: 'emissaryRelease', value: currentVersion]
-                        ]
-                    )
+                    if (currentVersion.endsWith('-dirty')) {
+                        unstable('Could not trigger emissary-firmware build, dirty version !')
+                    } else {
+                        build(
+                            job: "../emissary-firmware/${env.GIT_BRANCH}",
+                            parameters: [
+                                [$class: 'StringParameterValue', name: 'emissaryRelease', value: currentVersion]
+                            ],
+                            wait: false
+                        )
+                    }
                 }
             }
         }

Makefile

@@ -154,4 +154,13 @@ load-sample-specs:
 	cat misc/spec-samples/mdns.emissary.cadoles.com.json | ./bin/server api agent spec update -a $(AGENT_ID) --no-patch --spec-data - --spec-name mdns.emissary.cadoles.com
 
 full-version:
-	@echo $(FULL_VERSION)
+	@echo $(FULL_VERSION)
+
+update-edge-lib:
+	git pull --rebase
+	GOPRIVATE=forge.cadoles.com/arcad/edge go get -u forge.cadoles.com/arcad/edge
+	go mod tidy
+	$(MAKE) test
+	git add go.mod go.sum
+	git commit -m "feat: update arcad/edge dependency"
+	git push

go.mod

@@ -3,10 +3,11 @@ module forge.cadoles.com/Cadoles/emissary
 go 1.19
 
 require (
-	forge.cadoles.com/arcad/edge v0.0.0-20230402160147-f08f645432c6
+	forge.cadoles.com/arcad/edge v0.0.0-20230414142434-9e3fc427bb8d
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/alecthomas/participle/v2 v2.0.0-beta.5
 	github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
+	github.com/brutella/dnssd v1.2.6
 	github.com/btcsuite/btcd/btcutil v1.1.3
 	github.com/davecgh/go-spew v1.1.1
 	github.com/denisbrodbeck/machineid v1.0.1
@@ -33,7 +34,6 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/barnybug/go-cast v0.0.0-20201201064555-a87ccbc26692 // indirect
-	github.com/brutella/dnssd v1.2.6 // indirect
 	github.com/dop251/goja_nodejs v0.0.0-20230320130059-dcf93ba651dd // indirect
 	github.com/gabriel-vasile/mimetype v1.4.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect

go.sum

@@ -54,10 +54,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-forge.cadoles.com/arcad/edge v0.0.0-20230328183829-d8ce2901d2ab h1:xOtzLAYOUcKd/VBx/PzL2riC0zNuQ/cxxf5r3AmEvJE=
-forge.cadoles.com/arcad/edge v0.0.0-20230328183829-d8ce2901d2ab/go.mod h1:ONd6vyQ0IM0vHi1i+bmZBRc1Fd0BoXMuDdY/+0sZefw=
-forge.cadoles.com/arcad/edge v0.0.0-20230402160147-f08f645432c6 h1:MxMEBSEvwagUrFORUJ9snZekFIKkaV3OB0EplXra+LU=
-forge.cadoles.com/arcad/edge v0.0.0-20230402160147-f08f645432c6/go.mod h1:ONd6vyQ0IM0vHi1i+bmZBRc1Fd0BoXMuDdY/+0sZefw=
+forge.cadoles.com/arcad/edge v0.0.0-20230414142434-9e3fc427bb8d h1:CjE2/xE+MfhE2N08j+GsUQTdnlwEzUzkLZ7VjGhOM7I=
+forge.cadoles.com/arcad/edge v0.0.0-20230414142434-9e3fc427bb8d/go.mod h1:Vx4iq/oewXUOkGyi8QKc14clTLNO1sWpb0SjBYELlAs=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
 github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=

internal/agent/controller/app/app_handler.go

@@ -4,8 +4,8 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
+	"net"
 	"path/filepath"
-	"sync"
 	"text/template"
 
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app/spec"
@@ -17,19 +17,18 @@ import (
 	edgeHTTP "forge.cadoles.com/arcad/edge/pkg/http"
 	"forge.cadoles.com/arcad/edge/pkg/module"
 	appModule "forge.cadoles.com/arcad/edge/pkg/module/app"
-	"forge.cadoles.com/arcad/edge/pkg/module/auth"
 	"forge.cadoles.com/arcad/edge/pkg/module/blob"
 	"forge.cadoles.com/arcad/edge/pkg/module/cast"
 	fetchModule "forge.cadoles.com/arcad/edge/pkg/module/fetch"
-	"forge.cadoles.com/arcad/edge/pkg/module/net"
+	netModule "forge.cadoles.com/arcad/edge/pkg/module/net"
 	"forge.cadoles.com/arcad/edge/pkg/storage/sqlite"
 	"github.com/Masterminds/sprig/v3"
-	"github.com/dop251/goja"
 	"github.com/lestrrat-go/jwx/v2/jwa"
 	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
 )
 
-const defaultSQLiteParams = "?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)&_txlock=immediate"
+const defaultSQLiteParams = "?_pragma=foreign_keys(1)&_pragma=busy_timeout=60000"
 
 func (c *Controller) getHandlerOptions(ctx context.Context, appKey string, specs *spec.Spec) ([]edgeHTTP.HandlerOptionFunc, error) {
 	dataDir, err := c.ensureAppDataDir(ctx, appKey)
@@ -48,12 +47,6 @@ func (c *Controller) getHandlerOptions(ctx context.Context, appKey string, specs
 		return nil, errors.Wrap(err, "could not retrieve auth key set")
 	}
 
-	bundles := make([]string, 0, len(specs.Apps))
-	for appKey, app := range specs.Apps {
-		path := c.getAppBundlePath(appKey, app.Format)
-		bundles = append(bundles, path)
-	}
-
 	bus := memory.NewBus()
 	modules := c.getAppModules(bus, db, specs, keySet)
 
@@ -107,46 +100,135 @@ func getAuthKeySet(config *spec.Config) (jwk.Set, error) {
 	return keySet, nil
 }
 
-func createGetAppURL(specs *spec.Spec) GetURLFunc {
-	var (
-		compileOnce sync.Once
-		urlTemplate *template.Template
-		err         error
-	)
+func createResolveAppURL(specs *spec.Spec) (ResolveAppURLFunc, error) {
+	rawIfaceMappings := make(map[string]string, 0)
+	if specs.Config != nil && specs.Config.AppURLResolving != nil && specs.Config.AppURLResolving.IfaceMappings != nil {
+		rawIfaceMappings = specs.Config.AppURLResolving.IfaceMappings
+	}
 
-	return func(ctx context.Context, manifest *app.Manifest) (string, error) {
+	ifaceMappings := make(map[string]*template.Template, len(rawIfaceMappings))
+	for iface, rawTemplate := range rawIfaceMappings {
+		tmpl, err := template.New("").Funcs(sprig.TxtFuncMap()).Parse(rawTemplate)
+		if err != nil {
+			return nil, errors.Wrapf(err, "could not parse iface '%s' template", iface)
+		}
+
+		ifaceMappings[iface] = tmpl
+	}
+
+	defaultRawTemplate := `http://{{ .DeviceIP }}:{{ .AppPort }}`
+	if specs.Config != nil && specs.Config.AppURLResolving != nil && specs.Config.AppURLResolving.DefaultURLTemplate != "" {
+		defaultRawTemplate = specs.Config.AppURLResolving.DefaultURLTemplate
+	}
+
+	defaultTemplate, err := template.New("").Funcs(sprig.TxtFuncMap()).Parse(defaultRawTemplate)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	return func(ctx context.Context, manifest *app.Manifest, from string) (string, error) {
+		var (
+			urlTemplate *template.Template
+			deviceIP    net.IP
+		)
+
+		fromIP := net.ParseIP(from)
+
+		if fromIP != nil {
+		LOOP:
+			for ifaceName, ifaceTmpl := range ifaceMappings {
+				iface, err := net.InterfaceByName(ifaceName)
+				if err != nil {
+					logger.Error(
+						ctx, "could not find interface",
+						logger.E(errors.WithStack(err)), logger.F("iface", ifaceName),
+					)
+
+					continue
+				}
+
+				addresses, err := iface.Addrs()
+				if err != nil {
+					logger.Error(
+						ctx, "could not list interface addresses",
+						logger.E(errors.WithStack(err)),
+						logger.F("iface", iface.Name),
+					)
+
+					continue
+				}
+
+				for _, addr := range addresses {
+					ifaIP, network, err := net.ParseCIDR(addr.String())
+					if err != nil {
+						logger.Error(
+							ctx, "could not parse interface ip",
+							logger.E(errors.WithStack(err)),
+							logger.F("iface", iface.Name),
+						)
+
+						continue
+					}
+
+					if !network.Contains(fromIP) {
+						continue
+					}
+
+					deviceIP = ifaIP
+					urlTemplate = ifaceTmpl
+
+					break LOOP
+				}
+			}
+		}
+
+		if urlTemplate == nil {
+			urlTemplate = defaultTemplate
+		}
+
+		if deviceIP == nil {
+			deviceIP = net.ParseIP("127.0.0.1")
+		}
+
+		var appEntry *spec.AppEntry
+		for appID, entry := range specs.Apps {
+			if manifest.ID != app.ID(appID) {
+				continue
+			}
+
+			appEntry = &entry
+			break
+		}
+
+		if appEntry == nil {
+			return "", errors.Errorf("could not find app '%s' in specs", manifest.ID)
+		}
+
+		_, port, err := net.SplitHostPort(appEntry.Address)
 		if err != nil {
 			return "", errors.WithStack(err)
 		}
 
-		var appURLTemplate string
-
-		if specs.Config == nil || specs.Config.AppURLTemplate == "" {
-			appURLTemplate = `http://{{ last ( splitList "." ( toString .Manifest.ID ) ) }}.local`
-		} else {
-			appURLTemplate = specs.Config.AppURLTemplate
-		}
-
-		compileOnce.Do(func() {
-			urlTemplate, err = template.New("").Funcs(sprig.TxtFuncMap()).Parse(appURLTemplate)
-		})
-
-		var buf bytes.Buffer
-
 		data := struct {
 			Manifest *app.Manifest
 			Specs    *spec.Spec
+			DeviceIP string
+			AppPort  string
 		}{
 			Manifest: manifest,
 			Specs:    specs,
+			DeviceIP: deviceIP.String(),
+			AppPort:  port,
 		}
 
+		var buf bytes.Buffer
+
 		if err := urlTemplate.Execute(&buf, data); err != nil {
 			return "", errors.WithStack(err)
 		}
 
 		return buf.String(), nil
-	}
+	}, nil
 }
 
 func (c *Controller) getAppModules(bus bus.Bus, db *sql.DB, spec *appSpec.Spec, keySet jwk.Set) []app.ServerModuleFactory {
@@ -158,34 +240,11 @@ func (c *Controller) getAppModules(bus bus.Bus, db *sql.DB, spec *appSpec.Spec,
 		module.ConsoleModuleFactory(),
 		cast.CastModuleFactory(),
 		module.LifecycleModuleFactory(),
-		net.ModuleFactory(bus),
+		netModule.ModuleFactory(bus),
 		module.RPCModuleFactory(bus),
 		module.StoreModuleFactory(ds),
 		blob.ModuleFactory(bus, bs),
-		module.Extends(
-			auth.ModuleFactory(
-				auth.WithJWT(func() (jwk.Set, error) {
-					return keySet, nil
-				}),
-			),
-			func(o *goja.Object) {
-				if err := o.Set("CLAIM_TENANT", "arcad_tenant"); err != nil {
-					panic(errors.New("could not set 'CLAIM_TENANT' property"))
-				}
-
-				if err := o.Set("CLAIM_ENTRYPOINT", "arcad_entrypoint"); err != nil {
-					panic(errors.New("could not set 'CLAIM_ENTRYPOINT' property"))
-				}
-
-				if err := o.Set("CLAIM_ROLE", "arcad_role"); err != nil {
-					panic(errors.New("could not set 'CLAIM_ROLE' property"))
-				}
-
-				if err := o.Set("CLAIM_PREFERRED_USERNAME", "preferred_username"); err != nil {
-					panic(errors.New("could not set 'CLAIM_PREFERRED_USERNAME' property"))
-				}
-			},
-		),
+		authModule(keySet),
 		appModule.ModuleFactory(c.appRepository),
 		fetchModule.ModuleFactory(bus),
 	}

internal/agent/controller/app/app_handler_test.go

@@ -0,0 +1,73 @@
+package app
+
+import (
+	"context"
+	"testing"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app/spec"
+	"forge.cadoles.com/arcad/edge/pkg/app"
+	"github.com/pkg/errors"
+)
+
+func TestCreateResolveAppURL(t *testing.T) {
+	specs := &spec.Spec{
+		Apps: map[string]spec.AppEntry{
+			"app.arcad.test": {
+				Address: ":8080",
+			},
+			"app.arcad.foo": {
+				Address: ":8081",
+			},
+			"app.arcad.bar": {
+				Address: ":8082",
+			},
+		},
+		Config: &spec.Config{
+			AppURLResolving: &spec.AppURLResolving{
+				IfaceMappings: map[string]string{
+					"lo":              "http://{{ .DeviceIP }}:{{ .AppPort }}",
+					"does-not-exists": "http://{{ .DeviceIP }}:{{ .AppPort }}",
+				},
+				DefaultURLTemplate: `http://{{ last ( splitList "." ( toString .Manifest.ID ) ) }}.arcad.local`,
+			},
+		},
+	}
+
+	resolveAppURL, err := createResolveAppURL(specs)
+	if err != nil {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	manifest := &app.Manifest{
+		ID: "app.arcad.test",
+	}
+
+	ctx := context.Background()
+
+	url, err := resolveAppURL(ctx, manifest, "127.0.0.2")
+	if err != nil {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	if e, g := "http://127.0.0.1:8080", url; e != g {
+		t.Errorf("url: expected '%s', got '%s", e, g)
+	}
+
+	url, err = resolveAppURL(ctx, manifest, "")
+	if err != nil {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	if e, g := "http://test.arcad.local", url; e != g {
+		t.Errorf("url: expected '%s', got '%s", e, g)
+	}
+
+	url, err = resolveAppURL(ctx, manifest, "192.168.0.100")
+	if err != nil {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	if e, g := "http://test.arcad.local", url; e != g {
+		t.Errorf("url: expected '%s', got '%s", e, g)
+	}
+}

internal/agent/controller/app/app_repository.go

@@ -2,6 +2,7 @@ package app
 
 import (
 	"context"
+	"sort"
 	"sync"
 
 	"forge.cadoles.com/arcad/edge/pkg/app"
@@ -11,12 +12,12 @@ import (
 	"gitlab.com/wpetit/goweb/logger"
 )
 
-type GetURLFunc func(context.Context, *app.Manifest) (string, error)
+type ResolveAppURLFunc func(context.Context, *app.Manifest, string) (string, error)
 
 type AppRepository struct {
-	getURL  GetURLFunc
-	bundles []string
-	mutex   sync.RWMutex
+	resolveAppURL ResolveAppURLFunc
+	bundles       []string
+	mutex         sync.RWMutex
 }
 
 // Get implements app.Repository
@@ -33,7 +34,7 @@ func (r *AppRepository) Get(ctx context.Context, id app.ID) (*app.Manifest, erro
 }
 
 // GetURL implements app.Repository
-func (r *AppRepository) GetURL(ctx context.Context, id app.ID) (string, error) {
+func (r *AppRepository) GetURL(ctx context.Context, id app.ID, from string) (string, error) {
 	r.mutex.RLock()
 	defer r.mutex.RUnlock()
 
@@ -42,7 +43,7 @@ func (r *AppRepository) GetURL(ctx context.Context, id app.ID) (string, error) {
 		return "", errors.WithStack(err)
 	}
 
-	url, err := r.getURL(ctx, manifest)
+	url, err := r.resolveAppURL(ctx, manifest, from)
 	if err != nil {
 		return "", errors.WithStack(err)
 	}
@@ -77,14 +78,16 @@ func (r *AppRepository) List(ctx context.Context) ([]*app.Manifest, error) {
 		manifests = append(manifests, manifest)
 	}
 
+	sort.Sort(ByID(manifests))
+
 	return manifests, nil
 }
 
-func (r *AppRepository) Update(getURL GetURLFunc, bundles []string) {
+func (r *AppRepository) Update(resolveAppURL ResolveAppURLFunc, bundles []string) {
 	r.mutex.Lock()
 	defer r.mutex.Unlock()
 
-	r.getURL = getURL
+	r.resolveAppURL = resolveAppURL
 	r.bundles = bundles
 }
 
@@ -118,7 +121,7 @@ func (r *AppRepository) findManifest(ctx context.Context, id app.ID) (*app.Manif
 
 func NewAppRepository() *AppRepository {
 	return &AppRepository{
-		getURL: func(ctx context.Context, m *app.Manifest) (string, error) {
+		resolveAppURL: func(ctx context.Context, m *app.Manifest, from string) (string, error) {
 			return "", errors.New("unavailable")
 		},
 		bundles: []string{},
@@ -126,3 +129,9 @@ func NewAppRepository() *AppRepository {
 }
 
 var _ appModule.Repository = &AppRepository{}
+
+type ByID []*app.Manifest
+
+func (a ByID) Len() int           { return len(a) }
+func (a ByID) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+func (a ByID) Less(i, j int) bool { return a[i].ID > a[j].ID }

internal/agent/controller/app/auth_module.go

@@ -0,0 +1,65 @@
+package app
+
+import (
+	"forge.cadoles.com/Cadoles/emissary/internal/jwk"
+	"forge.cadoles.com/arcad/edge/pkg/app"
+	"forge.cadoles.com/arcad/edge/pkg/module"
+	"forge.cadoles.com/arcad/edge/pkg/module/auth"
+	"github.com/dop251/goja"
+	"github.com/pkg/errors"
+)
+
+const (
+	RoleVisitor    string = "visitor"
+	RoleUser       string = "user"
+	RoleSuperuser  string = "superuser"
+	RoleAdmin      string = "admin"
+	RoleSuperadmin string = "superadmin"
+)
+
+func authModule(keySet jwk.Set) app.ServerModuleFactory {
+	return module.Extends(
+		auth.ModuleFactory(
+			auth.WithJWT(func() (jwk.Set, error) {
+				return keySet, nil
+			}),
+		),
+		func(o *goja.Object) {
+			if err := o.Set("CLAIM_TENANT", "arcad_tenant"); err != nil {
+				panic(errors.New("could not set 'CLAIM_TENANT' property"))
+			}
+
+			if err := o.Set("CLAIM_ENTRYPOINT", "arcad_entrypoint"); err != nil {
+				panic(errors.New("could not set 'CLAIM_ENTRYPOINT' property"))
+			}
+
+			if err := o.Set("CLAIM_ROLE", "arcad_role"); err != nil {
+				panic(errors.New("could not set 'CLAIM_ROLE' property"))
+			}
+
+			if err := o.Set("CLAIM_PREFERRED_USERNAME", "preferred_username"); err != nil {
+				panic(errors.New("could not set 'CLAIM_PREFERRED_USERNAME' property"))
+			}
+
+			if err := o.Set("ROLE_VISITOR", RoleVisitor); err != nil {
+				panic(errors.New("could not set 'ROLE_VISITOR' property"))
+			}
+
+			if err := o.Set("ROLE_USER", RoleUser); err != nil {
+				panic(errors.New("could not set 'ROLE_USER' property"))
+			}
+
+			if err := o.Set("ROLE_SUPERUSER", RoleSuperuser); err != nil {
+				panic(errors.New("could not set 'ROLE_SUPERUSER' property"))
+			}
+
+			if err := o.Set("ROLE_ADMIN", RoleAdmin); err != nil {
+				panic(errors.New("could not set 'ROLE_ADMIN' property"))
+			}
+
+			if err := o.Set("ROLE_SUPERADMIN", RoleSuperadmin); err != nil {
+				panic(errors.New("could not set 'ROLE_SUPERADMIN' property"))
+			}
+		},
+	)
+}

internal/agent/controller/app/controller.go

@@ -9,6 +9,7 @@ import (
 
 	"forge.cadoles.com/Cadoles/emissary/internal/agent"
 	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/app/spec"
+	"forge.cadoles.com/arcad/edge/pkg/app"
 	"forge.cadoles.com/arcad/edge/pkg/bundle"
 	"github.com/mitchellh/hashstructure/v2"
 	"github.com/pkg/errors"
@@ -96,7 +97,14 @@ func (c *Controller) updateApps(ctx context.Context, specs *spec.Spec) {
 		}
 	}
 
-	c.updateAppRepository(ctx, specs)
+	if err := c.updateAppRepository(ctx, specs); err != nil {
+		logger.Error(
+			ctx, "could not update app repository",
+			logger.E(errors.WithStack(err)),
+		)
+
+		return
+	}
 
 	// (Re)start apps if necessary
 	for appKey := range specs.Apps {
@@ -109,32 +117,32 @@ func (c *Controller) updateApps(ctx context.Context, specs *spec.Spec) {
 	}
 }
 
-func (c *Controller) updateAppRepository(ctx context.Context, specs *spec.Spec) {
+func (c *Controller) updateAppRepository(ctx context.Context, specs *spec.Spec) error {
 	bundles := make([]string, 0, len(specs.Apps))
 	for appKey, app := range specs.Apps {
 		path := c.getAppBundlePath(appKey, app.Format)
 		bundles = append(bundles, path)
 	}
 
-	getURL := createGetAppURL(specs)
+	resolveAppURL, err := createResolveAppURL(specs)
+	if err != nil {
+		return errors.WithStack(err)
+	}
 
-	c.appRepository.Update(getURL, bundles)
+	c.appRepository.Update(resolveAppURL, bundles)
+
+	return nil
 }
 
 func (c *Controller) updateApp(ctx context.Context, specs *spec.Spec, appKey string) (err error) {
 	appEntry := specs.Apps[appKey]
 
-	var auth *spec.Auth
-	if specs.Config != nil {
-		auth = specs.Config.Auth
-	}
-
 	appDef := struct {
-		App  spec.AppEntry
-		Auth *spec.Auth
+		App    spec.AppEntry
+		Config *spec.Config
 	}{
-		App:  appEntry,
-		Auth: auth,
+		App:    appEntry,
+		Config: specs.Config,
 	}
 
 	newAppDefHash, err := hashstructure.Hash(appDef, hashstructure.FormatV2, nil)
@@ -164,27 +172,30 @@ func (c *Controller) updateApp(ctx context.Context, specs *spec.Spec, appKey str
 		server = nil
 	}
 
-	if server == nil {
+	newServerEntry := func() (*serverEntry, error) {
 		options, err := c.getHandlerOptions(ctx, appKey, specs)
 		if err != nil {
-			return errors.Wrap(err, "could not create handler options")
-		}
-
-		var auth *spec.Auth
-		if specs.Config != nil {
-			auth = specs.Config.Auth
+			return nil, errors.Wrap(err, "could not create handler options")
 		}
 
 		server = &serverEntry{
-			Server:     NewServer(bundle, auth, options...),
+			Server:     NewServer(bundle, specs.Config, options...),
 			AppDefHash: 0,
 		}
 
-		c.servers[appKey] = server
+		return server, nil
+	}
+
+	if server == nil {
+		serverEntry, err := newServerEntry()
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		c.servers[appKey] = serverEntry
 	}
 
 	defChanged := newAppDefHash != server.AppDefHash
-
 	if server.Server.Running() && !defChanged {
 		return nil
 	}
@@ -194,6 +205,17 @@ func (c *Controller) updateApp(ctx context.Context, specs *spec.Spec, appKey str
 			ctx, "restarting app",
 			logger.F("address", appEntry.Address),
 		)
+
+		if err := server.Server.Stop(); err != nil {
+			return errors.WithStack(err)
+		}
+
+		serverEntry, err := newServerEntry()
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		c.servers[appKey] = serverEntry
 	} else {
 		logger.Info(
 			ctx, "starting app",
@@ -255,7 +277,21 @@ func (c *Controller) ensureAppBundle(ctx context.Context, appID string, spec spe
 		return nil, "", errors.WithStack(err)
 	}
 
-	return bdle, "", nil
+	manifest, err := app.LoadManifest(bdle)
+	if err != nil {
+		return nil, "", errors.WithStack(err)
+	}
+
+	valid, err := validateManifest(manifest)
+	if err != nil {
+		return nil, "", errors.WithStack(err)
+	}
+
+	if !valid {
+		return nil, "", errors.New("bundle's manifest is invalid")
+	}
+
+	return bdle, spec.SHA256Sum, nil
 }
 
 func (c *Controller) downloadFile(url string, sha256sum string, dest string) error {

internal/agent/controller/app/manifest.go

@@ -0,0 +1,19 @@
+package app
+
+import (
+	"forge.cadoles.com/arcad/edge/pkg/app"
+	"forge.cadoles.com/arcad/edge/pkg/app/metadata"
+	"github.com/pkg/errors"
+)
+
+func validateManifest(manifest *app.Manifest) (bool, error) {
+	valid, err := manifest.Validate(
+		metadata.WithMinimumRoleValidator(RoleVisitor, RoleUser, RoleSuperuser, RoleAdmin, RoleSuperadmin),
+		metadata.WithNamedPathsValidator(metadata.NamedPathAdmin, metadata.NamedPathIcon),
+	)
+	if err != nil {
+		return false, errors.WithStack(err)
+	}
+
+	return valid, nil
+}

internal/agent/controller/app/server.go

@@ -2,6 +2,7 @@ package app
 
 import (
 	"context"
+	"net"
 	"net/http"
 	"strings"
 	"sync"
@@ -31,7 +32,7 @@ type Server struct {
 	handlerOptions []edgeHTTP.HandlerOptionFunc
 	server         *http.Server
 	serverMutex    sync.RWMutex
-	auth           *appSpec.Auth
+	config         *appSpec.Config
 }
 
 func (s *Server) Start(ctx context.Context, addr string) (err error) {
@@ -53,8 +54,19 @@ func (s *Server) Start(ctx context.Context, addr string) (err error) {
 		return errors.Wrap(err, "could not load app bundle")
 	}
 
-	if err := s.configureAuth(router, s.auth); err != nil {
-		return errors.WithStack(err)
+	if s.config != nil {
+		if s.config.UnexpectedHostRedirect != nil {
+			router.Use(unexpectedHostRedirect(
+				s.config.UnexpectedHostRedirect.HostTarget,
+				s.config.UnexpectedHostRedirect.AcceptedHostPatterns...,
+			))
+		}
+
+		if s.config.Auth != nil {
+			if err := s.configureAuth(router, s.config.Auth); err != nil {
+				return errors.WithStack(err)
+			}
+		}
 	}
 
 	router.Handle("/*", handler)
@@ -124,13 +136,9 @@ func (s *Server) Stop() error {
 }
 
 func (s *Server) configureAuth(router chi.Router, auth *spec.Auth) error {
-	if auth == nil {
-		return nil
-	}
-
 	switch {
 	case auth.Local != nil:
-		var rawKey any = s.auth.Local.Key
+		var rawKey any = auth.Local.Key
 		if strKey, ok := rawKey.(string); ok {
 			rawKey = []byte(strKey)
 		}
@@ -141,54 +149,72 @@ func (s *Server) configureAuth(router chi.Router, auth *spec.Auth) error {
 		}
 
 		cookieDuration := defaultCookieDuration
-		if s.auth.Local.CookieDuration != "" {
-			cookieDuration, err = time.ParseDuration(s.auth.Local.CookieDuration)
+		if auth.Local.CookieDuration != "" {
+			cookieDuration, err = time.ParseDuration(auth.Local.CookieDuration)
 			if err != nil {
 				return errors.WithStack(err)
 			}
 		}
 
-		if s.auth.Local.CookieDomain != "" {
-			router.Use(invalidCookieDomainRedirect(s.auth.Local.CookieDomain))
-		}
-
 		router.Handle("/auth/*", authHTTP.NewLocalHandler(
 			jwa.HS256, key,
 			authHTTP.WithRoutePrefix("/auth"),
-			authHTTP.WithAccounts(s.auth.Local.Accounts...),
-			authHTTP.WithCookieOptions(s.auth.Local.CookieDomain, cookieDuration),
+			authHTTP.WithAccounts(auth.Local.Accounts...),
+			authHTTP.WithCookieOptions(getCookieDomain, cookieDuration),
 		))
 	}
 
 	return nil
 }
 
-func NewServer(bundle bundle.Bundle, auth *appSpec.Auth, handlerOptions ...edgeHTTP.HandlerOptionFunc) *Server {
+func NewServer(bundle bundle.Bundle, config *spec.Config, handlerOptions ...edgeHTTP.HandlerOptionFunc) *Server {
 	return &Server{
 		bundle:         bundle,
-		auth:           auth,
+		config:         config,
 		handlerOptions: handlerOptions,
 	}
 }
 
-func invalidCookieDomainRedirect(cookieDomain string) func(http.Handler) http.Handler {
-	domain := strings.TrimPrefix(cookieDomain, ".")
-	hostPattern := "*" + domain
+func getCookieDomain(r *http.Request) (string, error) {
+	host, _, err := net.SplitHostPort(r.Host)
+	if err != nil {
+		host = r.Host
+	}
 
+	// If host is an IP address
+	if wildcard.Match(host, "*.*.*.*") {
+		return "", nil
+	}
+
+	// If host is an domain, return top level domain
+	domainParts := strings.Split(host, ".")
+	if len(domainParts) >= 2 {
+		topLevelDomain := strings.Join(domainParts[len(domainParts)-2:], ".")
+		return topLevelDomain, nil
+	}
+
+	// By default, return host
+	return host, nil
+}
+
+func unexpectedHostRedirect(hostTarget string, acceptedHostPatterns ...string) func(http.Handler) http.Handler {
 	return func(h http.Handler) http.Handler {
 		fn := func(w http.ResponseWriter, r *http.Request) {
-			hostParts := strings.SplitN(r.Host, ":", 2)
+			host, port, err := net.SplitHostPort(r.Host)
+			if err != nil {
+				host = r.Host
+			}
 
-			if !wildcard.Match(hostParts[0], hostPattern) {
+			matched := wildcard.MatchAny(host, acceptedHostPatterns...)
+
+			if !matched {
 				url := r.URL
 
-				newHost := domain
-				if len(hostParts) > 1 {
-					newHost += ":" + hostParts[1]
+				url.Host = hostTarget
+				if port != "" {
+					url.Host += ":" + port
 				}
 
-				url.Host = newHost
-
 				http.Redirect(w, r, url.String(), http.StatusTemporaryRedirect)
 
 				return

internal/agent/controller/app/spec/schema.json

@@ -38,57 +38,94 @@
                 }
             }
         },
-        "auth": {
+        "config": {
             "type": "object",
             "properties": {
-                "local": {
+                "appUrlResolving": {
                     "type": "object",
                     "properties": {
-                        "key": {
-                            "type": ["object", "string"]
-                        },
-                        "accounts": {
-                            "type": "array",
-                            "items": {
-                                "type": "object",
-                                "properties": {
-                                    "username": {
-                                        "type": "string"
-                                    },
-                                    "password": {
-                                        "type": "string"
-                                    },
-                                    "algo": {
-                                        "type": "string"
-                                    },
-                                    "claims": {
-                                        "type": "object"
-                                    }
-                                },
-                                "required": [
-                                    "username",
-                                    "password",
-                                    "algo"
-                                ]
+                        "ifaceMappings": {
+                            "type": "object",
+                            "patternProperties": {
+                                ".*": {
+                                    "type": "string"
+                                }
                             }
                         },
-                        "cookieDomain": {
-                            "type": "string"
-                        },
-                        "cookieDuration": {
+                        "defaultUrlTemplate": {
                             "type": "string"
                         }
                     },
-                    "required": [
-                        "key"
-                    ]
+                    "required": ["defaultUrlTemplate"],
+                    "additionalProperties": false
+                },
+                "unexpectedHostRedirect": {
+                    "type": "object",
+                    "properties": {
+                        "acceptedHostPatterns": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        },
+                        "hostTarget": {
+                            "type": "string"
+                        }
+                    },
+                    "required": ["acceptedHostPatterns", "hostTarget"],
+                    "additionalProperties": false
+                },
+                "auth": {
+                    "type": "object",
+                    "properties": {
+                        "local": {
+                            "type": "object",
+                            "properties": {
+                                "key": {
+                                    "type": ["object", "string"]
+                                },
+                                "accounts": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "object",
+                                        "properties": {
+                                            "username": {
+                                                "type": "string"
+                                            },
+                                            "password": {
+                                                "type": "string"
+                                            },
+                                            "algo": {
+                                                "type": "string"
+                                            },
+                                            "claims": {
+                                                "type": "object"
+                                            }
+                                        },
+                                        "required": [
+                                            "username",
+                                            "password",
+                                            "algo"
+                                        ]
+                                    }
+                                },
+                                "cookieDomain": {
+                                    "type": "string"
+                                },
+                                "cookieDuration": {
+                                    "type": "string"
+                                }
+                            },
+                            "required": [
+                                "key"
+                            ],
+                            "additionalProperties": false
+                        }
+                    },
+                    "additionalProperties": false
                 }
-            }
-        },
-        "config": {
-            "appUrlTemplate": {
-                "type": "string"
-            }
+            },
+            "additionalProperties": false
         }
     },
     "required": [

internal/agent/controller/app/spec/spec.go

@@ -32,8 +32,19 @@ type LocalAuth struct {
 }
 
 type Config struct {
-	Auth           *Auth  `json:"auth"`
-	AppURLTemplate string `json:"appUrlTemplate"`
+	Auth                   *Auth                   `json:"auth"`
+	UnexpectedHostRedirect *UnexpectedHostRedirect `json:"unexpectedHostRedirect"`
+	AppURLResolving        *AppURLResolving        `json:"appUrlResolving"`
+}
+
+type UnexpectedHostRedirect struct {
+	AcceptedHostPatterns []string `json:"acceptedHostPatterns"`
+	HostTarget           string   `json:"hostTarget"`
+}
+
+type AppURLResolving struct {
+	IfaceMappings      map[string]string `json:"ifaceMappings"`
+	DefaultURLTemplate string            `json:"defaultUrlTemplate"`
 }
 
 func (s *Spec) SpecName() spec.Name {

internal/agent/controller/app/spec/testdata/spec-ok.json

@@ -9,32 +9,44 @@
         "format": "zip"
       }
     },
-    "auth": {
-      "local": {
-        "key": {
-          "d": "YOre0WZefGfUGFvDg42oL5Oad5Zsb1N_hqPyLVM5ajpTZzcHpB3wT6In9tFO_VshB6lxVtPA9ckPkpMTFY7ygt1Yomc1HkoOKRtmIaqdr4VgNQifU-4yiLiJkSbdYSeMV-KkkN8mGR1keJpJeS34W1X0W6CkU2nw7F5VueBCJfWJA0funRfuWdI68MTUgT9kRZFp-SfvptvRL6jVYHV_5hqxzHCvgEdBSF6QKwx4M6P6QBMt7ft6uMLmFx9abKFw2V51hX3PkxiSepVB3w5CYg4HtS3AHX6bILL4m0R2pdTIkap7i3tkH_xAOuKWt8D6JhadI8X1rEAwXmCS5KrRgQ",
-          "dp": "U0HfvBC6hk-SCpuotGIv3vbHCVt1aF3SHK0y32EYCOe8e_9G6YCEILfcvEJ5fiOCc2kvx6TasHQu4qj1uWRKenZlK1sJ6KDybGCkZL1D3jYnbeLZYBuWBL__YbZiST3ewbxzj_EDMWiZ8sUltahza_1weSgg8auSzTHS2LJBHIE",
-          "dq": "hVom4ScDxgqhCsQNVpZlN7M3v0tgWjl_gTOHjOyzKCHQJeC0QmJJaMKkQZPWJ8jjLqy7VwVpqC2nZU7QDuX1Cq5eJDQcXi9XtaAfIBico9WcYDre6mDyhL588YHpekyRke8HnZ810iesr0G3gU1h0QvZVVuW-pXTJOXhZTt6nFc",
-          "e": "AQAB",
-          "kty": "RSA",
-          "n": "vPnpkE3-HfNgJSru_K40LstkjiG2Bq_Tt-m0d_yUBBSbirFxF3qH4EXi7WrtZdeDahg2iV2BvpbVVj9GlmGo9OLol6jc7AP2yvZrkbABiiJhCbuPdkYbNpx6B7Itl8RT_bUSYAMZhmux5lpsn4weQ01fzjICi1rA-bIJpOfotdOjP4_lol-LxGZOGJQv9kndP8bgmssJb3Y_2s4gPtkmXySLrhpr5So-_6dVksyuBD9aLcnsMLDbywusjEMCdhqzQbvOjryomnmEXwyz_Ewb5HFK2PfgFtoHkdjqDz-mrEs3tw5g4TdYhCftzJxgbyNAEq4aEiOQrAncYyrXlotP_w",
-          "p": "8TNMF0WUe7CEeNVUTsuEcBAAXRguNtpvVifIjlwzFRGOYVGIpKuHsqQPKlZL07I9gPr9LifQnyQus3oEmTOrVs6LB9sfbukbg43ZRKoGVM40JYF5Xjs7R3mEZhgU0WaYOVe3iLtBGMfXNWFwlbfQP-zEb-dPCBX1jWT3LdgNBcE",
-          "q": "yJJLNc9w6O4y2icME8k99FugV9E7ObwUxF3v5JN3y1cmAT0h2njyE3iAGqaDZwcY1_jGCisjwoqX6i5E8xqhxX3Gcy3J7SmUAf8fhY8wU3zv9DK7skg2IdvanDb8Y1OM6GchbYZAOVPEg2IvVio8zI-Ih3DDwDk8Df0ufzoHRb8",
-          "qi": "zOE-4R3cjPesm3MX-4PdwmsaF9QZLUVRUvvHJ08pKs6kAXP18hzjctAoOjhQDxlTYqNYNePfKzKwost3OJoPgRIc9w9qwUCK1gNOS4Z_xozCIaXgMddNFhkoAfZ4JaKjNCiinzjGfqG99Lf-yzmmREuuhRv7SdS3ST4VQjiJQew"
-        },
-        "accounts": [
-          {
-            "username": "foo",
-            "algo": "plain",
-            "password": "bar",
-            "claims": {
-              "arcad_role": "user",
-              "arcad_tenant": "dev.cli",
-              "preferred_username": "Foo",
-              "sub": "foo"
+    "config": {
+      "auth": {
+        "local": {
+          "key": {
+            "d": "YOre0WZefGfUGFvDg42oL5Oad5Zsb1N_hqPyLVM5ajpTZzcHpB3wT6In9tFO_VshB6lxVtPA9ckPkpMTFY7ygt1Yomc1HkoOKRtmIaqdr4VgNQifU-4yiLiJkSbdYSeMV-KkkN8mGR1keJpJeS34W1X0W6CkU2nw7F5VueBCJfWJA0funRfuWdI68MTUgT9kRZFp-SfvptvRL6jVYHV_5hqxzHCvgEdBSF6QKwx4M6P6QBMt7ft6uMLmFx9abKFw2V51hX3PkxiSepVB3w5CYg4HtS3AHX6bILL4m0R2pdTIkap7i3tkH_xAOuKWt8D6JhadI8X1rEAwXmCS5KrRgQ",
+            "dp": "U0HfvBC6hk-SCpuotGIv3vbHCVt1aF3SHK0y32EYCOe8e_9G6YCEILfcvEJ5fiOCc2kvx6TasHQu4qj1uWRKenZlK1sJ6KDybGCkZL1D3jYnbeLZYBuWBL__YbZiST3ewbxzj_EDMWiZ8sUltahza_1weSgg8auSzTHS2LJBHIE",
+            "dq": "hVom4ScDxgqhCsQNVpZlN7M3v0tgWjl_gTOHjOyzKCHQJeC0QmJJaMKkQZPWJ8jjLqy7VwVpqC2nZU7QDuX1Cq5eJDQcXi9XtaAfIBico9WcYDre6mDyhL588YHpekyRke8HnZ810iesr0G3gU1h0QvZVVuW-pXTJOXhZTt6nFc",
+            "e": "AQAB",
+            "kty": "RSA",
+            "n": "vPnpkE3-HfNgJSru_K40LstkjiG2Bq_Tt-m0d_yUBBSbirFxF3qH4EXi7WrtZdeDahg2iV2BvpbVVj9GlmGo9OLol6jc7AP2yvZrkbABiiJhCbuPdkYbNpx6B7Itl8RT_bUSYAMZhmux5lpsn4weQ01fzjICi1rA-bIJpOfotdOjP4_lol-LxGZOGJQv9kndP8bgmssJb3Y_2s4gPtkmXySLrhpr5So-_6dVksyuBD9aLcnsMLDbywusjEMCdhqzQbvOjryomnmEXwyz_Ewb5HFK2PfgFtoHkdjqDz-mrEs3tw5g4TdYhCftzJxgbyNAEq4aEiOQrAncYyrXlotP_w",
+            "p": "8TNMF0WUe7CEeNVUTsuEcBAAXRguNtpvVifIjlwzFRGOYVGIpKuHsqQPKlZL07I9gPr9LifQnyQus3oEmTOrVs6LB9sfbukbg43ZRKoGVM40JYF5Xjs7R3mEZhgU0WaYOVe3iLtBGMfXNWFwlbfQP-zEb-dPCBX1jWT3LdgNBcE",
+            "q": "yJJLNc9w6O4y2icME8k99FugV9E7ObwUxF3v5JN3y1cmAT0h2njyE3iAGqaDZwcY1_jGCisjwoqX6i5E8xqhxX3Gcy3J7SmUAf8fhY8wU3zv9DK7skg2IdvanDb8Y1OM6GchbYZAOVPEg2IvVio8zI-Ih3DDwDk8Df0ufzoHRb8",
+            "qi": "zOE-4R3cjPesm3MX-4PdwmsaF9QZLUVRUvvHJ08pKs6kAXP18hzjctAoOjhQDxlTYqNYNePfKzKwost3OJoPgRIc9w9qwUCK1gNOS4Z_xozCIaXgMddNFhkoAfZ4JaKjNCiinzjGfqG99Lf-yzmmREuuhRv7SdS3ST4VQjiJQew"
+          },
+          "accounts": [
+            {
+              "username": "foo",
+              "algo": "plain",
+              "password": "bar",
+              "claims": {
+                "arcad_role": "user",
+                "arcad_tenant": "dev.cli",
+                "preferred_username": "Foo",
+                "sub": "foo"
+              }
             }
-          }
-        ]
+          ]
+        }
+      },
+      "unexpectedHostRedirect": {
+        "acceptedHostPatterns": ["arcad.local", "*.arcad.local", "arcad-*.local", "*.*.*.*"],
+        "hostTarget": "arcad.local"
+      },
+      "appUrlResolving": {
+        "ifaceMappings": {
+          "eth0": "http://{{ .DeviceIP }}:{{ .AppHost }}"
+        },
+        "defaultUrlTemplate": "http://{{ last ( splitList \".\" ( toString .Manifest.ID ) ) }}.arcad.local"
       }
     }
   },

internal/config/database.go

@@ -15,6 +15,6 @@ type DatabaseConfig struct {
 func NewDefaultDatabaseConfig() DatabaseConfig {
 	return DatabaseConfig{
 		Driver: "sqlite",
-		DSN:    "sqlite://emissary.sqlite?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)&_txlock=immediate",
+		DSN:    "sqlite://emissary.sqlite?_pragma=foreign_keys(1)&_pragma=busy_timeout=60000",
 	}
 }

internal/datastore/sqlite/agent_repository.go

@@ -20,9 +20,24 @@ type AgentRepository struct {
 
 // DeleteSpec implements datastore.AgentRepository.
 func (r *AgentRepository) DeleteSpec(ctx context.Context, agentID datastore.AgentID, name string) error {
-	query := `DELETE FROM specs WHERE agent_id = $1 AND name = $2`
+	err := r.withTx(ctx, func(tx *sql.Tx) error {
+		exists, err := r.agentExists(ctx, tx, agentID)
+		if err != nil {
+			return errors.WithStack(err)
+		}
 
-	_, err := r.db.ExecContext(ctx, query, agentID, name)
+		if !exists {
+			return errors.WithStack(datastore.ErrNotFound)
+		}
+
+		query := `DELETE FROM specs WHERE agent_id = $1 AND name = $2`
+
+		if _, err = tx.ExecContext(ctx, query, agentID, name); err != nil {
+			return errors.WithStack(err)
+		}
+
+		return nil
+	})
 	if err != nil {
 		return errors.WithStack(err)
 	}
@@ -34,41 +49,57 @@ func (r *AgentRepository) DeleteSpec(ctx context.Context, agentID datastore.Agen
 func (r *AgentRepository) GetSpecs(ctx context.Context, agentID datastore.AgentID) ([]*datastore.Spec, error) {
 	specs := make([]*datastore.Spec, 0)
 
-	query := `
+	err := r.withTx(ctx, func(tx *sql.Tx) error {
+		exists, err := r.agentExists(ctx, tx, agentID)
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		if !exists {
+			return errors.WithStack(datastore.ErrNotFound)
+		}
+
+		query := `
 		SELECT id, name, revision, data, created_at, updated_at
 		FROM specs
 		WHERE agent_id = $1
-	`
+		`
 
-	rows, err := r.db.QueryContext(ctx, query, agentID)
+		rows, err := tx.QueryContext(ctx, query, agentID)
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		defer func() {
+			if err := rows.Close(); err != nil {
+				logger.Error(ctx, "could not close rows", logger.E(errors.WithStack(err)))
+			}
+		}()
+
+		for rows.Next() {
+			spec := &datastore.Spec{}
+
+			data := JSONMap{}
+
+			if err := rows.Scan(&spec.ID, &spec.Name, &spec.Revision, &data, &spec.CreatedAt, &spec.UpdatedAt); err != nil {
+				return errors.WithStack(err)
+			}
+
+			spec.Data = data
+
+			specs = append(specs, spec)
+		}
+
+		if err := rows.Err(); err != nil {
+			return errors.WithStack(err)
+		}
+
+		return nil
+	})
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
 
-	defer func() {
-		if err := rows.Close(); err != nil {
-			logger.Error(ctx, "could not close rows", logger.E(errors.WithStack(err)))
-		}
-	}()
-
-	for rows.Next() {
-		spec := &datastore.Spec{}
-
-		data := JSONMap{}
-
-		if err := rows.Scan(&spec.ID, &spec.Name, &spec.Revision, &data, &spec.CreatedAt, &spec.UpdatedAt); err != nil {
-			return nil, errors.WithStack(err)
-		}
-
-		spec.Data = data
-
-		specs = append(specs, spec)
-	}
-
-	if err := rows.Err(); err != nil {
-		return nil, errors.WithStack(err)
-	}
-
 	return specs, nil
 }
 
@@ -77,6 +108,15 @@ func (r *AgentRepository) UpdateSpec(ctx context.Context, agentID datastore.Agen
 	spec := &datastore.Spec{}
 
 	err := r.withTx(ctx, func(tx *sql.Tx) error {
+		exists, err := r.agentExists(ctx, tx, agentID)
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		if !exists {
+			return errors.WithStack(datastore.ErrNotFound)
+		}
+
 		now := time.Now().UTC()
 
 		query := `
@@ -96,7 +136,7 @@ func (r *AgentRepository) UpdateSpec(ctx context.Context, agentID datastore.Agen
 
 		data := JSONMap{}
 
-		err := row.Scan(&spec.ID, &spec.Name, &spec.Revision, &data, &spec.CreatedAt, &spec.UpdatedAt)
+		err = row.Scan(&spec.ID, &spec.Name, &spec.Revision, &data, &spec.CreatedAt, &spec.UpdatedAt)
 		if err != nil {
 			if errors.Is(err, sql.ErrNoRows) {
 				return errors.WithStack(datastore.ErrUnexpectedRevision)
@@ -472,8 +512,28 @@ func (r *AgentRepository) Update(ctx context.Context, id datastore.AgentID, opts
 	return agent, nil
 }
 
+func (r *AgentRepository) agentExists(ctx context.Context, tx *sql.Tx, agentID datastore.AgentID) (bool, error) {
+	row := tx.QueryRowContext(ctx, `SELECT count(id) FROM agents WHERE id = $1`, agentID)
+
+	var count int
+
+	if err := row.Scan(&count); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return false, errors.WithStack(datastore.ErrNotFound)
+		}
+
+		return false, errors.WithStack(err)
+	}
+
+	if count == 0 {
+		return false, errors.WithStack(datastore.ErrNotFound)
+	}
+
+	return true, nil
+}
+
 func (r *AgentRepository) withTx(ctx context.Context, fn func(*sql.Tx) error) error {
-	tx, err := r.db.Begin()
+	tx, err := r.db.BeginTx(ctx, nil)
 	if err != nil {
 		return errors.WithStack(err)
 	}

internal/datastore/sqlite/agent_repository_test.go

@@ -0,0 +1,46 @@
+package sqlite
+
+import (
+	"database/sql"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/datastore/testsuite"
+	"forge.cadoles.com/Cadoles/emissary/internal/migrate"
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestSQLiteAgentRepository(t *testing.T) {
+	logger.SetLevel(logger.LevelDebug)
+
+	file := "testdata/agent_repository_test.sqlite"
+
+	if err := os.Remove(file); err != nil && !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	dsn := fmt.Sprintf("%s?_pragma=foreign_keys(1)&_pragma=busy_timeout=%d", file, (60 * time.Second).Milliseconds())
+
+	migr, err := migrate.New("../../../migrations", "sqlite", "sqlite://"+dsn)
+	if err != nil {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	if err := migr.Up(); err != nil {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	db, err := sql.Open("sqlite", dsn)
+	if err != nil {
+		t.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	repo := NewAgentRepository(db)
+
+	testsuite.TestAgentRepository(t, repo)
+}

internal/datastore/sqlite/testdata/.gitignore

@@ -0,0 +1 @@
+*.sqlite*

internal/datastore/testsuite/agent_repository.go

@@ -0,0 +1,14 @@
+package testsuite
+
+import (
+	"testing"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/datastore"
+)
+
+func TestAgentRepository(t *testing.T, repo datastore.AgentRepository) {
+	t.Run("Cases", func(t *testing.T) {
+		t.Parallel()
+		runAgentRepositoryTests(t, repo)
+	})
+}

internal/datastore/testsuite/agent_repository_cases.go

@@ -0,0 +1,129 @@
+package testsuite
+
+import (
+	"context"
+	"testing"
+
+	"forge.cadoles.com/Cadoles/emissary/internal/agent/controller/mdns/spec"
+	"forge.cadoles.com/Cadoles/emissary/internal/datastore"
+	"forge.cadoles.com/Cadoles/emissary/internal/jwk"
+	"github.com/pkg/errors"
+)
+
+type agentRepositoryTestCase struct {
+	Name string
+	Skip bool
+	Run  func(ctx context.Context, repo datastore.AgentRepository) error
+}
+
+var agentRepositoryTestCases = []agentRepositoryTestCase{
+	{
+		Name: "Create a new agent",
+		Run: func(ctx context.Context, repo datastore.AgentRepository) error {
+			thumbprint := "foo"
+			keySet := jwk.NewSet()
+			var metadata map[string]any
+
+			agent, err := repo.Create(ctx, thumbprint, keySet, metadata)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			if agent.CreatedAt.IsZero() {
+				return errors.Errorf("agent.CreatedAt should not be zero time")
+			}
+
+			if agent.UpdatedAt.IsZero() {
+				return errors.Errorf("agent.UpdatedAt should not be zero time")
+			}
+
+			if e, g := datastore.AgentStatusPending, agent.Status; e != g {
+				return errors.Errorf("agent.Status: expected '%v', got '%v'", e, g)
+			}
+
+			return nil
+		},
+	},
+	{
+		Name: "Try to update spec for an unexistant agent",
+		Run: func(ctx context.Context, repo datastore.AgentRepository) error {
+			var unexistantAgentID datastore.AgentID = 9999
+			var specData map[string]any
+
+			agent, err := repo.UpdateSpec(ctx, unexistantAgentID, string(spec.Name), 0, specData)
+			if err == nil {
+				return errors.New("error should not be nil")
+			}
+
+			if !errors.Is(err, datastore.ErrNotFound) {
+				return errors.Errorf("error should be datastore.ErrNotFound, got '%+v'", err)
+			}
+
+			if agent != nil {
+				return errors.New("agent should be nil")
+			}
+
+			return nil
+		},
+	},
+	{
+		Name: "Try to delete spec of an unexistant agent",
+		Run: func(ctx context.Context, repo datastore.AgentRepository) error {
+			var unexistantAgentID datastore.AgentID = 9999
+
+			err := repo.DeleteSpec(ctx, unexistantAgentID, string(spec.Name))
+			if err == nil {
+				return errors.New("error should not be nil")
+			}
+
+			if !errors.Is(err, datastore.ErrNotFound) {
+				return errors.Errorf("error should be datastore.ErrNotFound, got '%+v'", err)
+			}
+
+			return nil
+		},
+	},
+	{
+		Name: "Try to get specs of an unexistant agent",
+		Run: func(ctx context.Context, repo datastore.AgentRepository) error {
+			var unexistantAgentID datastore.AgentID = 9999
+
+			specs, err := repo.GetSpecs(ctx, unexistantAgentID)
+			if err == nil {
+				return errors.New("error should not be nil")
+			}
+
+			if !errors.Is(err, datastore.ErrNotFound) {
+				return errors.Errorf("error should be datastore.ErrNotFound, got '%+v'", err)
+			}
+
+			if specs != nil {
+				return errors.Errorf("specs should be nil, got '%+v'", err)
+			}
+
+			return nil
+		},
+	},
+}
+
+func runAgentRepositoryTests(t *testing.T, repo datastore.AgentRepository) {
+	for _, tc := range agentRepositoryTestCases {
+		func(tc agentRepositoryTestCase) {
+			t.Run(tc.Name, func(t *testing.T) {
+				t.Parallel()
+
+				if tc.Skip {
+					t.SkipNow()
+
+					return
+				}
+
+				ctx := context.Background()
+
+				if err := tc.Run(ctx, repo); err != nil {
+					t.Errorf("%+v", errors.WithStack(err))
+				}
+			})
+		}(tc)
+	}
+}

internal/migrate/migrate.go

@@ -2,7 +2,6 @@ package migrate
 
 import (
 	"fmt"
-	"log"
 
 	"github.com/golang-migrate/migrate/v4"
 	_ "github.com/golang-migrate/migrate/v4/database/postgres"
@@ -23,8 +22,6 @@ func New(migrationDir, driver, dsn string) (*migrate.Migrate, error) {
 		fmt.Sprintf("file://%s/%s", migrationDir, driver),
 		dsn,
 	)
-
-	log.Println(migrationDir, driver, dsn)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}

misc/packaging/common/config-server.yml

@@ -9,7 +9,7 @@ server:
     port: 3000
   database:
     driver: sqlite
-    dsn: sqlite:///var/lib/emissary/data.sqlite?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)&_txlock=immediate
+    dsn: sqlite:///var/lib/emissary/data.sqlite?_pragma=foreign_keys(1)&_pragma=busy_timeout=60000
   cors:
     allowedOrigins: []
     allowCredentials: true

misc/spec-samples/app.emissary.cadoles.com.json

@@ -1,36 +1,46 @@
 {
     "apps": {
-        "portal": {
-            "url": "https://emissary.cadol.es/files/apps/arcad.portal_v2023.3.28-3feda80.zip",
-            "sha256sum": "921402c44a5fa554d5b630d1284957b05416aa6872b402314cf52e964e06fac5",
-            "address": "127.0.0.1:8082",
+        "edge.portal": {
+            "url": "https://emissary.cadol.es/files/apps/edge.portal_v2023.4.9-41c100d.zip",
+            "sha256sum": "b73a6741654f3e24281e354b3b506b109dac6ada8a9698452f52b03a53299a7d",
+            "address": ":8082",
             "format": "zip"
         },
-        "hextris": {
-            "url": "https://emissary.cadol.es/files/apps/app.arcad.edge.hextris_v2023.3.22-33ece28.zip",
-            "sha256sum": "5f9f3c8d6f22796beb051d747d7ff12efa17af9d1552c0ab08baef13703a2aba",
-            "address": "127.0.0.1:8083",
+        "app.arcad.edge.hextris": {
+            "url": "https://emissary.cadol.es/files/apps/app.arcad.edge.hextris_v2023.4.11-81fb4c4.zip",
+            "sha256sum": "6d70f65971b3dd288da32d8d004ab8fbca030398b5c12e3c052ef98c53a6b81a",
+            "address": ":8083",
             "format": "zip"
         },
-        "test": {
-            "url": "https://emissary.cadol.es/files/apps/edge.sdk.client.test_v2023.3.24-ed535b6.zip",
-            "sha256sum": "e97b7b79159bb5d6a13b05644c091272b02a1a3cbb1b613dd5eda37e1eb84623",
-            "address": "127.0.0.1:8084",
+        "edge.sdk.client.test": {
+            "url": "https://emissary.cadol.es/files/apps/edge.sdk.client.test_v2023.4.11-f5283b8.zip",
+            "sha256sum": "785d9f8d427900e1bb27ab85a33e8b1cbd1b6a1f8b2eab6366dc215a69655ade",
+            "address": ":8084",
             "format": "zip"
         },
-        "diffusion": {
-            "url": "https://emissary.cadol.es/files/apps/arcad.diffusion_v2023.3.29-5b3fab4.zip",
-            "sha256sum": "1282e75719beedbc7c7e67879389d0f3e11c86d3d2c37cf13da624a66faaeb58",
-            "address": "127.0.0.1:8085",
+        "arcad.diffusion": {
+            "url": "https://emissary.cadol.es/files/apps/arcad.diffusion_v2023.4.9-81046a2.zip",
+            "sha256sum": "b8770adfaaf60e6d3e7776e0a090e6e7a0b31f3f9425b91168b42144d0346513",
+            "address": ":8085",
             "format": "zip"
         }
     },
     "config": {
-        "appUrlTemplate": "http://{{ last ( splitList \".\" ( toString .Manifest.ID ) ) }}.arcad.local:8080",
+        "appUrlResolving": {
+            "ifaceMappings": {
+                "lo": "http://{{ .DeviceIP }}:{{ .AppPort }}",
+                "wlp4s0": "http://{{ .DeviceIP }}:{{ .AppPort }}",
+                "enp0s31f6": "http://{{ .DeviceIP }}:{{ .AppPort }}"
+            },
+            "defaultUrlTemplate": "http://{{ last ( splitList \".\" ( toString .Manifest.ID ) ) }}.localhost.arcad.lan:8080"
+        },
+        "unexpectedHostRedirect": {
+            "acceptedHostPatterns": ["arcad.lan", "*.arcad.lan", "arcad-*.local", "*.*.*.*"],
+            "hostTarget": "localhost.arcad.lan"
+        },
         "auth": {
             "local": {
                 "key": "absolutlynotsecret",
-                "cookieDomain": ".arcad.local",
                 "cookieDuration": "1h",
                 "accounts": [
                     {

misc/spec-samples/mdns.emissary.cadoles.com.json

@@ -3,36 +3,27 @@
         "arcad": {
             "type": "_http._tcp",
             "port": 8080,
-            "host": "arcad",
-            "ifaces": ["wlp4s0"]
+            "host": "arcad"
         },
         "portal": {
             "type": "_http._tcp",
             "port": 8080,
-            "host": "portal",
-            "domain": "arcad.local",
-            "ifaces": ["wlp4s0"]
+            "host": "arcad-portal"
         },
         "hextris": {
             "type": "_http._tcp",
             "port": 8080,
-            "host": "hextris",
-            "domain": "arcad.local",
-            "ifaces": ["wlp4s0"]
+            "host": "arcad-hextris"
         },
         "test": {
             "type": "_http._tcp",
             "port": 8080,
-            "host": "test",
-            "domain": "arcad.local",
-            "ifaces": ["wlp4s0"]
+            "host": "arcad-test"
         },
         "diffusion": {
             "type": "_http._tcp",
             "port": 8080,
-            "host": "diffusion",
-            "domain": "arcad.local",
-            "ifaces": ["wlp4s0"]
+            "host": "arcad-diffusion"
         }
     }
 }

misc/spec-samples/proxy.emissary.cadoles.com.json

@@ -4,19 +4,19 @@
             "address": ":8080",
             "mappings": [
                 {
-                    "hostPattern": "portal.arcad.local:*",
+                    "hostPattern": "portal.localhost.arcad.lan:*",
                     "target": "http://localhost:8082"
                 },
                 {
-                    "hostPattern": "hextris.arcad.local:*",
+                    "hostPattern": "hextris.localhost.arcad.lan:*",
                     "target": "http://localhost:8083"
                 },
                 {
-                    "hostPattern": "test.arcad.local:*",
+                    "hostPattern": "test.localhost.arcad.lan:*",
                     "target": "http://localhost:8084"
                 },
                 {
-                    "hostPattern": "diffusion.arcad.local:*",
+                    "hostPattern": "diffusion.localhost.arcad.lan:*",
                     "target": "http://localhost:8085"
                 },
                 {