diff --git a/CLEARNET.md b/CLEARNET.md
deleted file mode 100644
index 457a2e4f7..000000000
--- a/CLEARNET.md
+++ /dev/null
@@ -1,40 +0,0 @@
-# Setting up clearnet for a service interface
-
-NOTE: this guide is for HTTPS only! Other configurations may require a more bespoke setup depending on the service. Please consult the service documentation or the Start9 Community for help with non-HTTPS applications
-
-## Initialize ACME certificate generation
-
-The following command will register your device with an ACME certificate provider, such as letsencrypt
-
-This only needs to be done once.
-
-```
-start-cli net acme init --provider=letsencrypt --contact="mailto:me@drbonez.dev"
-```
-
-- `provider` can be `letsencrypt`, `letsencrypt-staging` (useful if you're doing a lot of testing and want to avoid being rate limited), or the url of any provider that supports the [RFC8555](https://datatracker.ietf.org/doc/html/rfc8555) ACME api
-- `contact` can be any valid contact url, typically `mailto:` urls. it can be specified multiple times to set multiple contacts
-
-## Whitelist a domain for ACME certificate acquisition
-
-The following command will tell the OS to use ACME certificates instead of system signed ones for the provided url. In this example, `testing.drbonez.dev`
-
-This must be done for every domain you wish to host on clearnet.
-
-```
-start-cli net acme domain add "testing.drbonez.dev"
-```
-
-## Forward clearnet port
-
-Go into your router settings, and map port 443 on your router to port 5443 on your start-os device. This one port should cover most use cases
-
-## Add domain to service host
-
-The following command will tell the OS to route https requests from the WAN to the provided hostname to the specified service. In this example, we are adding `testing.drbonez.dev` to the host `ui-multi` on the package `hello-world`. To see a list of available host IDs for a given package, run `start-cli package host <PACKAGE> list`
-
-This must be done for every domain you wish to host on clearnet.
-
-```
-start-cli package host hello-world address ui-multi add testing.drbonez.dev
-```
diff --git a/Makefile b/Makefile
index e0f89f3f9..a00a5c1c9 100644
--- a/Makefile
+++ b/Makefile
@@ -26,6 +26,7 @@ GZIP_BIN := $(shell which pigz || which gzip)
 TAR_BIN := $(shell which gtar || which tar)
 COMPILED_TARGETS := core/target/$(ARCH)-unknown-linux-musl/release/startbox core/target/$(ARCH)-unknown-linux-musl/release/containerbox system-images/compat/docker-images/$(ARCH).tar system-images/utils/docker-images/$(ARCH).tar system-images/binfmt/docker-images/$(ARCH).tar container-runtime/rootfs.$(ARCH).squashfs
 ALL_TARGETS := $(STARTD_SRC) $(ENVIRONMENT_FILE) $(GIT_HASH_FILE) $(VERSION_FILE) $(COMPILED_TARGETS) cargo-deps/$(ARCH)-unknown-linux-musl/release/startos-backup-fs $(shell if [ "$(PLATFORM)" = "raspberrypi" ]; then echo cargo-deps/aarch64-unknown-linux-musl/release/pi-beep; fi)  $(shell /bin/bash -c 'if [[ "${ENVIRONMENT}" =~ (^|-)unstable($$|-) ]]; then echo cargo-deps/$(ARCH)-unknown-linux-musl/release/tokio-console; fi') $(PLATFORM_FILE) 
+REBUILD_TYPES = 1
 
 ifeq ($(REMOTE),)
 	mkdir = mkdir -p $1
@@ -226,7 +227,7 @@ container-runtime/node_modules/.package-lock.json: container-runtime/package.jso
 	npm --prefix container-runtime ci
 	touch container-runtime/node_modules/.package-lock.json
 
-sdk/base/lib/osBindings/index.ts: core/startos/bindings/index.ts
+sdk/base/lib/osBindings/index.ts: $(shell if [ "$(REBUILD_TYPES)" -ne 0 ]; then echo core/startos/bindings/index.ts; fi)
 	mkdir -p sdk/base/lib/osBindings
 	rsync -ac --delete core/startos/bindings/ sdk/base/lib/osBindings/
 	touch sdk/base/lib/osBindings/index.ts
diff --git a/build/dpkg-deps/depends b/build/dpkg-deps/depends
index f495df85d..4c2dbc557 100644
--- a/build/dpkg-deps/depends
+++ b/build/dpkg-deps/depends
@@ -11,6 +11,7 @@ cryptsetup
 curl
 dnsutils
 dmidecode
+dnsutils
 dosfstools
 e2fsprogs
 ecryptfs-utils
@@ -57,4 +58,5 @@ systemd-timesyncd
 tor
 util-linux
 vim
+wireguard-tools
 wireless-tools
diff --git a/build/lib/scripts/dhclient-exit-hook b/build/lib/scripts/dhclient-exit-hook
deleted file mode 100755
index 8c4a97746..000000000
--- a/build/lib/scripts/dhclient-exit-hook
+++ /dev/null
@@ -1 +0,0 @@
-start-cli net dhcp update $interface
\ No newline at end of file
diff --git a/build/lib/scripts/enable-kiosk b/build/lib/scripts/enable-kiosk
index 45bed5fe9..40753af40 100755
--- a/build/lib/scripts/enable-kiosk
+++ b/build/lib/scripts/enable-kiosk
@@ -4,7 +4,7 @@ set -e
 
 # install dependencies
 /usr/bin/apt update
-/usr/bin/apt install --no-install-recommends -y xserver-xorg x11-xserver-utils xinit firefox-esr matchbox-window-manager libnss3-tools
+/usr/bin/apt install --no-install-recommends -y xserver-xorg x11-xserver-utils xinit firefox-esr matchbox-window-manager libnss3-tools p11-kit-modules
 
 #Change a default preference set by stock debian firefox-esr
 sed -i 's|^pref("extensions.update.enabled", true);$|pref("extensions.update.enabled", false);|' /etc/firefox-esr/firefox-esr.js
@@ -83,6 +83,9 @@ user_pref("toolkit.telemetry.updatePing.enabled", false);
 user_pref("toolkit.telemetry.cachedClientID", "");
 EOF
 
+cp /usr/lib/firefox-esr/libnssckbi.so /usr/lib/firefox-esr/libnssckbi.so.bak
+ln -sf /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so /usr/lib/firefox-esr/libnssckbi.so
+
 # create kiosk script
 cat > /home/kiosk/kiosk.sh << 'EOF'
 #!/bin/sh
diff --git a/container-runtime/src/Adapters/EffectCreator.ts b/container-runtime/src/Adapters/EffectCreator.ts
index 0123b0cbc..4bda0ed5d 100644
--- a/container-runtime/src/Adapters/EffectCreator.ts
+++ b/container-runtime/src/Adapters/EffectCreator.ts
@@ -216,12 +216,6 @@ export function makeEffects(context: EffectContext): Effects {
       }) as ReturnType<T.Effects["getServiceInterface"]>
     },
 
-    getPrimaryUrl(...[options]: Parameters<T.Effects["getPrimaryUrl"]>) {
-      return rpcRound("get-primary-url", {
-        ...options,
-        callback: context.callbacks?.addCallback(options.callback) || null,
-      }) as ReturnType<T.Effects["getPrimaryUrl"]>
-    },
     getServicePortForward(
       ...[options]: Parameters<T.Effects["getServicePortForward"]>
     ) {
diff --git a/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts b/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts
index 531b30cd2..e74ef317d 100644
--- a/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts
+++ b/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts
@@ -425,7 +425,6 @@ export class SystemForEmbassy implements System {
               name: interfaceValue.name,
               id: `${id}-${internal}`,
               description: interfaceValue.description,
-              hasPrimary: false,
               type:
                 interfaceValue.ui &&
                 (origin.scheme === "http" || origin.sslScheme === "https")
diff --git a/core/Cargo.lock b/core/Cargo.lock
index cdafe81a1..26a839a78 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -92,9 +92,9 @@ dependencies = [
 
 [[package]]
 name = "allocator-api2"
-version = "0.2.20"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45862d1c77f2228b9e10bc609d5bc203d86ebc9b87ad8d5d5167a6c9abf739d9"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "android-tzdata"
@@ -162,9 +162,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.93"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c95c10ba0b00a02636238b814946408b1322d5ac4760326e6fb8ec956d85775"
+checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
 
 [[package]]
 name = "arrayref"
@@ -205,7 +205,7 @@ dependencies = [
  "nom 7.1.3",
  "num-traits",
  "rusticata-macros",
- "thiserror",
+ "thiserror 1.0.69",
  "time",
 ]
 
@@ -217,7 +217,7 @@ checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
  "synstructure",
 ]
 
@@ -229,13 +229,13 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
 name = "async-acme"
-version = "0.5.0"
-source = "git+https://github.com/dr-bonez/async-acme.git#b9ff31ad900adc9086c0d1437ce51661d30856d2"
+version = "0.6.0"
+source = "git+https://github.com/dr-bonez/async-acme.git#0ddf25152237b5fc1726d977a7931e44513ce309"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -245,15 +245,27 @@ dependencies = [
  "pem",
  "rcgen",
  "ring",
- "rustls 0.23.17",
+ "rustls 0.23.20",
  "rustls-pemfile 2.2.0",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
  "tokio",
  "x509-parser",
 ]
 
+[[package]]
+name = "async-broadcast"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20cd0e2e25ea8e5f7e9df04578dc6cf5c83577fd09b1a46aaf5c85e1c33f2a7e"
+dependencies = [
+ "event-listener 5.3.1",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "async-channel"
 version = "1.9.0"
@@ -261,15 +273,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
 dependencies = [
  "concurrent-queue 2.5.0",
- "event-listener",
+ "event-listener 2.5.3",
  "futures-core",
 ]
 
+[[package]]
+name = "async-channel"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89b47800b0be77592da0afd425cc03468052844aff33b84e33cc696f64e77b6a"
+dependencies = [
+ "concurrent-queue 2.5.0",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "async-compression"
-version = "0.4.17"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cb8f1d480b0ea3783ab015936d2a55c87e219676f0c0b7dec61494043f21857"
+checksum = "df895a515f70646414f4b45c0b79082783b80552b373a68283012928df56f522"
 dependencies = [
  "brotli",
  "flate2",
@@ -279,6 +303,108 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "async-executor"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30ca9a001c1e8ba5149f91a74362376cc6bc5b919d92d988668657bd570bdcec"
+dependencies = [
+ "async-task",
+ "concurrent-queue 2.5.0",
+ "fastrand",
+ "futures-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-fs"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebcd09b382f40fcd159c2d695175b2ae620ffa5f3bd6f664131efff4e8b9e04a"
+dependencies = [
+ "async-lock",
+ "blocking",
+ "futures-lite",
+]
+
+[[package]]
+name = "async-io"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43a2b323ccce0a1d90b449fd71f2a06ca7faa7c54c2751f06c9bd851fc061059"
+dependencies = [
+ "async-lock",
+ "cfg-if",
+ "concurrent-queue 2.5.0",
+ "futures-io",
+ "futures-lite",
+ "parking",
+ "polling",
+ "rustix",
+ "slab",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff6e472cdea888a4bd64f342f09b3f50e1886d32afe8df3d663c01140b811b18"
+dependencies = [
+ "event-listener 5.3.1",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-process"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63255f1dc2381611000436537bbedfe83183faa303a5a0edaf191edef06526bb"
+dependencies = [
+ "async-channel 2.3.1",
+ "async-io",
+ "async-lock",
+ "async-signal",
+ "async-task",
+ "blocking",
+ "cfg-if",
+ "event-listener 5.3.1",
+ "futures-lite",
+ "rustix",
+ "tracing",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.90",
+]
+
+[[package]]
+name = "async-signal"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "637e00349800c0bdf8bfc21ebbc0b6524abea702b0da4168ac00d070d0c0b9f3"
+dependencies = [
+ "async-io",
+ "async-lock",
+ "atomic-waker",
+ "cfg-if",
+ "futures-core",
+ "futures-io",
+ "rustix",
+ "signal-hook-registry",
+ "slab",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "async-stream"
 version = "0.3.6"
@@ -298,9 +424,15 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
 [[package]]
 name = "async-trait"
 version = "0.1.83"
@@ -309,7 +441,7 @@ checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -335,21 +467,20 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe7c2840b66236045acd2607d5866e274380afd87ef99d6226e961e2cb47df45"
+checksum = "f47bb8cc16b669d267eeccf585aea077d0882f4777b1c1f740217885d6e6e5a3"
 dependencies = [
  "aws-lc-sys",
- "mirai-annotations",
  "paste",
  "zeroize",
 ]
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.23.0"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad3a619a9de81e1d7de1f1186dcba4506ed661a0e483d84410fdef0ee87b2f96"
+checksum = "a2101df3813227bbaaaa0b04cd61c534c7954b22bd68d399b440be937dc63ff7"
 dependencies = [
  "bindgen",
  "cc",
@@ -399,10 +530,10 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-util",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "itoa",
  "matchit",
@@ -416,10 +547,10 @@ dependencies = [
  "serde_path_to_error",
  "serde_urlencoded",
  "sha1",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tokio-tungstenite 0.24.0",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -451,37 +582,18 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
  "pin-project-lite",
  "rustversion",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tower-layer",
  "tower-service",
  "tracing",
 ]
 
-[[package]]
-name = "axum-server"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1ad46c3ec4e12f4a4b6835e173ba21c25e484c9d02b49770bf006ce5367c036"
-dependencies = [
- "bytes",
- "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.5.1",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower 0.4.13",
- "tower-service",
-]
-
 [[package]]
 name = "backhand"
 version = "0.18.0"
@@ -491,7 +603,7 @@ dependencies = [
  "deku",
  "flate2",
  "rustc-hash",
- "thiserror",
+ "thiserror 1.0.69",
  "tracing",
  "xz2",
  "zstd",
@@ -520,7 +632,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be5951c75bdabb58753d140dd5802f12ff3a483cb2e16fb5276e111b94b19e87"
 dependencies = [
  "concurrent-queue 1.2.4",
- "event-listener",
+ "event-listener 2.5.3",
  "spin",
 ]
 
@@ -599,7 +711,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.87",
+ "syn 2.0.90",
  "which",
 ]
 
@@ -676,9 +788,9 @@ dependencies = [
 
 [[package]]
 name = "blake3"
-version = "1.5.4"
+version = "1.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d82033247fd8e890df8f740e407ad4d038debb9eb1f40533fffb32e7d17dc6f7"
+checksum = "b8ee0c1824c4dea5b5f81736aff91bae041d2c07ee1192bec91054e10e3e601e"
 dependencies = [
  "arrayref",
  "arrayvec 0.7.6",
@@ -707,6 +819,19 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "blocking"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703f41c54fc768e63e091340b424302bb1c29ef4aa0c7f10fe849dfb114d29ea"
+dependencies = [
+ "async-channel 2.3.1",
+ "async-task",
+ "futures-io",
+ "futures-lite",
+ "piper",
+]
+
 [[package]]
 name = "brotli"
 version = "7.0.0"
@@ -754,9 +879,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 
 [[package]]
 name = "bytes"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ac0150caa2ae65ca5bd83f25c7de183dea78d4d366469f148435e2acfbad0da"
+checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
 
 [[package]]
 name = "cache-padded"
@@ -766,9 +891,9 @@ checksum = "981520c98f422fcc584dc1a95c334e6953900b9106bc47a9839b81790009eb21"
 
 [[package]]
 name = "cc"
-version = "1.2.1"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd9de9f2205d5ef3fd67e685b0df337994ddd4495e2a28d185500d0e1edfea47"
+checksum = "27f657647bcff5394bf56c7317665bbf790a137a50eaaa5c6bfbb9e27a518f2d"
 dependencies = [
  "jobserver",
  "libc",
@@ -798,9 +923,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
-version = "0.4.38"
+version = "0.4.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -879,9 +1004,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.21"
+version = "4.5.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb3b4b9e5a7c7514dfa52869339ee98b3156b0bfb4e8a77c4ff4babb64b1604f"
+checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -889,9 +1014,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.21"
+version = "4.5.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b17a95aa67cc7b5ebd32aa5370189aa0d79069ef1c64ce893bd30fb24bff20ec"
+checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838"
 dependencies = [
  "anstream",
  "anstyle",
@@ -908,20 +1033,20 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afb84c814227b90d6895e01398aee0d8033c00e7466aca416fb6a8e0eb19d8a7"
+checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
 [[package]]
 name = "cmake"
-version = "0.1.51"
+version = "0.1.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb1e43aa7fd152b1f968787f7dbcdeb306d1867ff373c69955211876c053f91a"
+checksum = "c682c223677e0e5b6b7f63a64b9351844c3f1b1678a68b7ee617e30fb082620e"
 dependencies = [
  "cc",
 ]
@@ -1122,9 +1247,9 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca741a962e1b0bff6d724a1a0958b686406e853bb14061f218562e1896f95e6"
+checksum = "16b80225097f2e5ae4e7179dd2266824648f3e2f49d9134d584b76389d31c4c3"
 dependencies = [
  "libc",
 ]
@@ -1317,7 +1442,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1341,7 +1466,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim 0.11.1",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1352,7 +1477,7 @@ checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1383,7 +1508,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1420,7 +1545,7 @@ checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1443,7 +1568,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1496,7 +1621,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1676,6 +1801,12 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "endi"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d8a32ae18130a3c84dd492d4215c3d913c3b07c6b63c2eb3eb7ff1101ab7bf"
+
 [[package]]
 name = "enum-as-inner"
 version = "0.6.1"
@@ -1685,7 +1816,28 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
+]
+
+[[package]]
+name = "enumflags2"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d232db7f5956f3f14313dc2f87985c58bd2c695ce124c8cdd984e08e15ac133d"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de0d48a183585823424a4ce1aa132d174a6a81bd540895822eb4c8373a8e49e8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -1707,12 +1859,12 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.3.9"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+checksum = "33d852cb9b869c2a9b3df2f71a3074817f01e1844f839a144f5fcef059a4eb5d"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1742,6 +1894,27 @@ version = "2.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
+[[package]]
+name = "event-listener"
+version = "5.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6032be9bd27023a771701cc49f9f053c751055f71efb2e0ae5c15809093675ba"
+dependencies = [
+ "concurrent-queue 2.5.0",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3e4e0dd3673c1139bf041f3008816d9cf2946bbfac2945c09e523b8d7b05b2"
+dependencies = [
+ "event-listener 5.3.1",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "exver"
 version = "0.2.0"
@@ -1772,9 +1945,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
 name = "fd-lock-rs"
@@ -1956,6 +2129,19 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
 
+[[package]]
+name = "futures-lite"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cef40d21ae2c515b51041df9ed313ed21e572df340ea58a922a0aefe7e8891a1"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "futures-macro"
 version = "0.3.31"
@@ -1964,7 +2150,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -2027,7 +2213,7 @@ checksum = "75cec8bb4d3d32542cfcb9517f78366b52c17931e30d7ee1682c13686c19cee7"
 dependencies = [
  "futures",
  "futures-rustls",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "log",
  "serde",
  "serde_json",
@@ -2035,7 +2221,7 @@ dependencies = [
  "serde_urlencoded",
  "tokio",
  "tokio-rustls 0.25.0",
- "webpki-roots 0.26.6",
+ "webpki-roots 0.26.7",
 ]
 
 [[package]]
@@ -2107,7 +2293,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 0.2.12",
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -2125,8 +2311,8 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.1.0",
- "indexmap 2.6.0",
+ "http 1.2.0",
+ "indexmap 2.7.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -2176,9 +2362,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.1"
+version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a9bfc1af68b1726ea47d3d5109de126281def866b33970e10fbab11b5dafab3"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
 
 [[package]]
 name = "hashlink"
@@ -2298,9 +2484,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
+checksum = "f16ca2af56261c99fba8bac40a10251ce8188205a4c448fbb745a2e4daa76fea"
 dependencies = [
  "bytes",
  "fnv",
@@ -2325,7 +2511,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http 1.2.0",
 ]
 
 [[package]]
@@ -2336,7 +2522,7 @@ checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
 dependencies = [
  "bytes",
  "futures-util",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body 1.0.1",
  "pin-project-lite",
 ]
@@ -2385,15 +2571,15 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.5.1"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97818827ef4f364230e16705d4706e2897df2bb60617d6ca15d598025a3c481f"
+checksum = "256fb8d4bd6413123cc9d91832d78325c48ff41677595be797d90f42969beae0"
 dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
  "h2 0.4.7",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body 1.0.1",
  "httparse",
  "httpdate",
@@ -2411,13 +2597,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
 dependencies = [
  "futures-util",
- "http 1.1.0",
- "hyper 1.5.1",
+ "http 1.2.0",
+ "hyper 1.5.2",
  "hyper-util",
- "rustls 0.23.17",
+ "rustls 0.23.20",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.0",
+ "tokio-rustls 0.26.1",
  "tower-service",
 ]
 
@@ -2441,7 +2627,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -2458,9 +2644,9 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body 1.0.1",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -2606,7 +2792,7 @@ checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -2691,8 +2877,8 @@ dependencies = [
 
 [[package]]
 name = "imbl-value"
-version = "0.1.0"
-source = "git+https://github.com/Start9Labs/imbl-value.git#3ce01b17ae5e756fc829ee5e3513a1b19b2a03fc"
+version = "0.1.1"
+source = "git+https://github.com/Start9Labs/imbl-value.git#1900943e17116def03bf00bff05cf12e54d810bc"
 dependencies = [
  "imbl",
  "serde",
@@ -2739,12 +2925,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.6.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
+checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.1",
+ "hashbrown 0.15.2",
  "serde",
 ]
 
@@ -2824,7 +3010,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ea1dc4bf0fb4904ba83ffdb98af3d9c325274e92e6e295e4151e86c96363e04"
 dependencies = [
  "serde",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -2874,9 +3060,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.11"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
 
 [[package]]
 name = "jaq-core"
@@ -2939,16 +3125,17 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
  "time",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.72"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a88f1bda2bd75b0452a14784937d796722fdebfe50df998aeb3f0b7603019a9"
+checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7"
 dependencies = [
+ "once_cell",
  "wasm-bindgen",
 ]
 
@@ -2969,7 +3156,7 @@ dependencies = [
  "imbl",
  "imbl-value",
  "serde",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -3029,7 +3216,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06cf485d4867e0714e35c1652e736bcf892d28fceecca01036764575db64ba84"
 dependencies = [
- "async-channel",
+ "async-channel 1.9.0",
  "futures",
 ]
 
@@ -3069,15 +3256,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.164"
+version = "0.2.168"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "433bfe06b8c75da9b2e3fbea6e5329ff87748f0b144ef75306e674c3f6f7c13f"
+checksum = "5aaeb2981e0606ca11d79718f8bb01164f1d6ed75080182d3abf017e6d244b6d"
 
 [[package]]
 name = "libloading"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
+checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
 dependencies = [
  "cfg-if",
  "windows-targets 0.52.6",
@@ -3097,7 +3284,7 @@ checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
  "bitflags 2.6.0",
  "libc",
- "redox_syscall 0.5.7",
+ "redox_syscall 0.5.8",
 ]
 
 [[package]]
@@ -3125,9 +3312,9 @@ checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "litemap"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704"
+checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104"
 
 [[package]]
 name = "litrs"
@@ -3187,7 +3374,7 @@ dependencies = [
  "bitvec 1.0.1",
  "serde",
  "serde-big-array",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -3233,6 +3420,15 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -3265,23 +3461,16 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
+checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
 dependencies = [
- "hermit-abi 0.3.9",
  "libc",
  "log",
  "wasi 0.11.0+wasi-snapshot-preview1",
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "mirai-annotations"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9be0862c1b3f26a88803c4a49de6889c10e608b3ee9344e6ef5b45fb37ad3d1"
-
 [[package]]
 name = "models"
 version = "0.1.0"
@@ -3305,12 +3494,13 @@ dependencies = [
  "serde_json",
  "sqlx",
  "ssh-key",
- "thiserror",
+ "thiserror 1.0.69",
  "tokio",
  "torut",
  "tracing",
  "ts-rs",
  "yasi",
+ "zbus",
 ]
 
 [[package]]
@@ -3381,6 +3571,7 @@ dependencies = [
  "cfg-if",
  "cfg_aliases",
  "libc",
+ "memoffset 0.9.1",
 ]
 
 [[package]]
@@ -3550,7 +3741,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -3599,7 +3790,7 @@ dependencies = [
  "byteorder",
  "md-5",
  "sha2 0.10.8",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -3625,7 +3816,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -3656,6 +3847,16 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "overload"
 version = "0.1.1"
@@ -3706,6 +3907,12 @@ dependencies = [
  "sha2 0.10.8",
 ]
 
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.3"
@@ -3724,7 +3931,7 @@ checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.7",
+ "redox_syscall 0.5.8",
  "smallvec",
  "windows-targets 0.52.6",
 ]
@@ -3751,7 +3958,7 @@ dependencies = [
  "patch-db-macro",
  "serde",
  "serde_cbor",
- "thiserror",
+ "thiserror 1.0.69",
  "tokio",
  "tracing",
  "tracing-error",
@@ -3813,20 +4020,20 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pest"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879952a81a83930934cbf1786752d6dedc3b1f29e8f8fb2ad1d0a36f377cf442"
+checksum = "8b7cafe60d6cf8e62e1b9b2ea516a089c008945bb5a275416789e7db0bc199dc"
 dependencies = [
  "memchr",
- "thiserror",
+ "thiserror 2.0.6",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d214365f632b123a47fd913301e14c946c61d1c183ee245fa76eb752e59a02dd"
+checksum = "816518421cfc6887a0d62bf441b6ffb4536fcc926395a69e1a85852d4363f57e"
 dependencies = [
  "pest",
  "pest_generator",
@@ -3834,22 +4041,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb55586734301717aea2ac313f50b2eb8f60d2fc3dc01d190eefa2e625f60c4e"
+checksum = "7d1396fd3a870fc7838768d171b4616d5c91f6cc25e377b673d714567d99377b"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b75da2a70cf4d9cb76833c990ac9cd3923c9a8905a8929789ce347c84564d03d"
+checksum = "e1e58089ea25d717bfd31fb534e4f3afcc2cc569c70de3e239778991ea3b7dea"
 dependencies = [
  "once_cell",
  "pest",
@@ -3863,7 +4070,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
 dependencies = [
  "fixedbitset",
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
 ]
 
 [[package]]
@@ -3898,7 +4105,7 @@ checksum = "3c0f5fad0874fc7abcd4d750e76917eaebbecaa2c20bde22e1dbeeba8beb758c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -3913,6 +4120,17 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "piper"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c8c490f422ef9a4efd2cb5b42b76c8613d7e7dfc1caf667b8a3350a5acc066"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
+
 [[package]]
 name = "pkcs1"
 version = "0.7.5"
@@ -3940,11 +4158,26 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
 
+[[package]]
+name = "polling"
+version = "3.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a604568c3202727d1507653cb121dbd627a58684eb09a820fd746bee38b4442f"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue 2.5.0",
+ "hermit-abi 0.4.0",
+ "pin-project-lite",
+ "rustix",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "portable-atomic"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"
+checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
 
 [[package]]
 name = "powerfmt"
@@ -3974,7 +4207,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64d1ec885c64d0457d564db4ec299b2dae3f9c02808b8ad9c3a089c591b18033"
 dependencies = [
  "proc-macro2",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -4011,9 +4244,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.89"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
 dependencies = [
  "unicode-ident",
 ]
@@ -4072,7 +4305,7 @@ checksum = "6ff7ff745a347b87471d859a377a9a404361e7efc2a971d73424a6d183c0fc77"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -4095,7 +4328,7 @@ dependencies = [
  "itertools 0.12.1",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -4287,9 +4520,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
+checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
 dependencies = [
  "bitflags 2.6.0",
 ]
@@ -4302,7 +4535,7 @@ checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
  "getrandom 0.2.15",
  "libredox",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -4363,10 +4596,10 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2 0.4.7",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-rustls",
  "hyper-tls",
  "hyper-util",
@@ -4382,7 +4615,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "system-configuration",
  "tokio",
  "tokio-native-tls",
@@ -4455,7 +4688,7 @@ dependencies = [
  "axum 0.7.9",
  "clap",
  "futures",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body-util",
  "imbl-value",
  "itertools 0.12.1",
@@ -4466,7 +4699,7 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
  "tokio",
  "tokio-stream",
  "url",
@@ -4475,9 +4708,9 @@ dependencies = [
 
 [[package]]
 name = "rsa"
-version = "0.9.6"
+version = "0.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc"
+checksum = "47c75d7c5c6b673e58bf54d8544a9f432e3a925b0e80f7cd3602ab5c50c55519"
 dependencies = [
  "const-oid",
  "digest 0.10.7",
@@ -4547,15 +4780,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.41"
+version = "0.38.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6"
+checksum = "f93dc38ecbab2eb790ff964bb77fa94faf256fd3e73285fd7ba0903b76bedb85"
 dependencies = [
  "bitflags 2.6.0",
- "errno 0.3.9",
+ "errno 0.3.10",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4585,9 +4818,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.17"
+version = "0.23.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f1a745511c54ba6d4465e8d5dfbd81b45791756de28d4981af70d6dca128f1e"
+checksum = "5065c3f250cbd332cd894be57c40fa52387247659b14a2d6041d121547903b1b"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -4665,18 +4898,18 @@ dependencies = [
 
 [[package]]
 name = "rustyline-async"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc9396d834c31f9fddd716e7c279e7cb70207092a1e59767918610f5c560c6eb"
+checksum = "1b8a29112291cda41f18306ed8919c49360e5273328162445ca250aae37c8f89"
 dependencies = [
  "crossterm",
  "futures-channel",
  "futures-util",
  "pin-project",
  "thingbuf",
- "thiserror",
+ "thiserror 2.0.6",
  "unicode-segmentation",
- "unicode-width 0.1.12",
+ "unicode-width 0.2.0",
 ]
 
 [[package]]
@@ -4767,9 +5000,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.215"
+version = "1.0.216"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
+checksum = "0b9781016e935a97e8beecf0c933758c97a5520d32930e460142b4cd80c6338e"
 dependencies = [
  "serde_derive",
 ]
@@ -4793,13 +5026,13 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.215"
+version = "1.0.216"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+checksum = "46f859dbbf73865c6627ed570e78961cd3ac92407a2d117204c49232485da55e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -4808,7 +5041,7 @@ version = "1.0.133"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7fceb2473b9166b2294ef05efcb65a3db80803f0b03ef86a5fc88a2b85ee377"
 dependencies = [
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "itoa",
  "memchr",
  "ryu",
@@ -4833,7 +5066,18 @@ checksum = "0431a35568651e363364210c91983c1da5eb29404d9f0928b67d4ebcfa7d330c"
 dependencies = [
  "percent-encoding",
  "serde",
- "thiserror",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -4867,7 +5111,7 @@ dependencies = [
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "serde",
  "serde_derive",
  "serde_json",
@@ -4884,7 +5128,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -4893,7 +5137,7 @@ version = "0.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78ce6afeda22f0b55dde2c34897bce76a629587348480384231205c14b59a01f"
 dependencies = [
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "itoa",
  "libyml",
  "log",
@@ -5056,9 +5300,9 @@ checksum = "b7c388c1b5e93756d0c740965c41e8822f866621d41acbdf6336a6a168f8840c"
 
 [[package]]
 name = "socket2"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
+checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -5120,7 +5364,7 @@ dependencies = [
  "crc",
  "crossbeam-queue",
  "either",
- "event-listener",
+ "event-listener 2.5.3",
  "futures-channel",
  "futures-core",
  "futures-intrusive",
@@ -5128,7 +5372,7 @@ dependencies = [
  "futures-util",
  "hashlink",
  "hex",
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "log",
  "memchr",
  "once_cell",
@@ -5141,7 +5385,7 @@ dependencies = [
  "sha2 0.10.8",
  "smallvec",
  "sqlformat",
- "thiserror",
+ "thiserror 1.0.69",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -5226,7 +5470,7 @@ dependencies = [
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror",
+ "thiserror 1.0.69",
  "tracing",
  "whoami",
 ]
@@ -5265,7 +5509,7 @@ dependencies = [
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror",
+ "thiserror 1.0.69",
  "tracing",
  "whoami",
 ]
@@ -5317,7 +5561,7 @@ dependencies = [
  "quote",
  "regex-syntax 0.6.29",
  "strsim 0.10.0",
- "syn 2.0.87",
+ "syn 2.0.90",
  "unicode-width 0.1.12",
 ]
 
@@ -5371,7 +5615,7 @@ checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
 
 [[package]]
 name = "start-os"
-version = "0.3.6-alpha.9"
+version = "0.3.6-alpha.10"
 dependencies = [
  "aes",
  "async-acme",
@@ -5379,7 +5623,6 @@ dependencies = [
  "async-stream",
  "async-trait",
  "axum 0.7.9",
- "axum-server",
  "backhand",
  "barrage",
  "base32 0.5.1",
@@ -5410,14 +5653,15 @@ dependencies = [
  "helpers",
  "hex",
  "hmac",
- "http 1.1.0",
+ "http 1.2.0",
  "http-body-util",
+ "hyper 1.5.2",
  "hyper-util",
  "id-pool",
  "imbl",
  "imbl-value",
  "include_dir",
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "indicatif",
  "integer-encoding",
  "ipnet",
@@ -5434,6 +5678,7 @@ dependencies = [
  "libc",
  "log",
  "mbrman",
+ "mio",
  "models",
  "new_mime_guess",
  "nix 0.29.0",
@@ -5478,9 +5723,9 @@ dependencies = [
  "ssh-key",
  "tar",
  "textwrap",
- "thiserror",
+ "thiserror 1.0.69",
  "tokio",
- "tokio-rustls 0.26.0",
+ "tokio-rustls 0.26.1",
  "tokio-socks",
  "tokio-stream",
  "tokio-tar",
@@ -5502,6 +5747,7 @@ dependencies = [
  "url",
  "urlencoding",
  "uuid",
+ "zbus",
  "zeroize",
 ]
 
@@ -5566,9 +5812,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.87"
+version = "2.0.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
+checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5583,9 +5829,9 @@ checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "sync_wrapper"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
 dependencies = [
  "futures-core",
 ]
@@ -5598,7 +5844,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -5699,7 +5945,16 @@ version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fec2a1820ebd077e2b90c4df007bebf344cd394098a13c563957d0afc83ea47"
+dependencies = [
+ "thiserror-impl 2.0.6",
 ]
 
 [[package]]
@@ -5710,7 +5965,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d65750cab40f4ff1929fb1ba509e9914eb756131cef4210da8d5d700d26f6312"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -5736,9 +6002,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.36"
+version = "0.3.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
 dependencies = [
  "deranged",
  "itoa",
@@ -5757,9 +6023,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
 dependencies = [
  "num-conv",
  "time-core",
@@ -5801,9 +6067,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.41.1"
+version = "1.42.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cfb5bee7a6a52939ca9224d6ac897bb669134078daa8735560897f69de4d33"
+checksum = "5cec9b21b0450273377fc97bd4c33a8acffc8c996c987a7c5b319a0083707551"
 dependencies = [
  "backtrace",
  "bytes",
@@ -5836,7 +6102,7 @@ checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -5862,12 +6128,11 @@ dependencies = [
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.0"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
+checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
 dependencies = [
- "rustls 0.23.17",
- "rustls-pki-types",
+ "rustls 0.23.20",
  "tokio",
 ]
 
@@ -5879,15 +6144,15 @@ checksum = "0d4770b8024672c1101b3f6733eab95b18007dbe0847a8afe341fcf79e06043f"
 dependencies = [
  "either",
  "futures-util",
- "thiserror",
+ "thiserror 1.0.69",
  "tokio",
 ]
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.16"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f4e6ce100d0eb49a2734f8c0812bcd324cf357d21810932c5df6b96ef2b86f1"
+checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -5937,9 +6202,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.12"
+version = "0.7.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61e7c3654c13bcd040d4a03abee2c75b1d14a37b423cf5a813ceae1cc903ec6a"
+checksum = "d7fcaa8d55a2bdd6b83ace262b016eca0d79ee02818c5c1bcdf0305114081078"
 dependencies = [
  "bytes",
  "futures-core",
@@ -5987,7 +6252,7 @@ version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -6000,7 +6265,7 @@ version = "0.22.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
 dependencies = [
- "indexmap 2.6.0",
+ "indexmap 2.7.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -6075,14 +6340,14 @@ dependencies = [
 
 [[package]]
 name = "tower"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2873938d487c3cfb9aed7546dc9f2711d867c9f90c46b889989a2cb84eba6b4f"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper 0.1.2",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tower-layer",
  "tower-service",
@@ -6103,9 +6368,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.40"
+version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
+checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
  "log",
  "pin-project-lite",
@@ -6115,20 +6380,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.27"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
+checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.32"
+version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
 dependencies = [
  "once_cell",
  "valuable",
@@ -6136,9 +6401,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-error"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d686ec1c0f384b1277f097b2f279a2ecc11afe8c133c1aabf036a27cb4cd206e"
+checksum = "8b1581020d7a273442f5b45074a6a57d5757ad0a47dac0e9f0bd57b81936f3db"
 dependencies = [
  "tracing",
  "tracing-subscriber",
@@ -6156,9 +6421,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-journald"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba316a74e8fc3c3896a850dba2375928a9fa171b085ecddfc7c054d39970f3fd"
+checksum = "fc0b4143302cf1022dac868d521e36e8b27691f72c84b3311750d5188ebba657"
 dependencies = [
  "libc",
  "tracing-core",
@@ -6178,9 +6443,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.18"
+version = "0.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -6221,7 +6486,7 @@ dependencies = [
  "once_cell",
  "rand 0.8.5",
  "smallvec",
- "thiserror",
+ "thiserror 1.0.69",
  "tinyvec",
  "tokio",
  "tracing",
@@ -6242,7 +6507,7 @@ dependencies = [
  "futures-executor",
  "futures-util",
  "serde",
- "thiserror",
+ "thiserror 1.0.69",
  "time",
  "tokio",
  "toml 0.7.8",
@@ -6261,7 +6526,7 @@ name = "ts-rs"
 version = "8.1.0"
 source = "git+https://github.com/dr-bonez/ts-rs.git?branch=feature%2Ftop-level-as#7ae88ade90b5e724159048a663a0bdb04bed27f7"
 dependencies = [
- "thiserror",
+ "thiserror 1.0.69",
  "ts-rs-macros",
 ]
 
@@ -6273,7 +6538,7 @@ dependencies = [
  "Inflector",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
  "termcolor",
 ]
 
@@ -6297,13 +6562,13 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http 1.2.0",
  "httparse",
  "log",
  "native-tls",
  "rand 0.8.5",
  "sha1",
- "thiserror",
+ "thiserror 1.0.69",
  "url",
  "utf-8",
 ]
@@ -6317,12 +6582,12 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http 1.2.0",
  "httparse",
  "log",
  "rand 0.8.5",
  "sha1",
- "thiserror",
+ "thiserror 1.0.69",
  "utf-8",
 ]
 
@@ -6343,7 +6608,7 @@ checksum = "1f718dfaf347dcb5b983bfc87608144b0bad87970aebcbea5ce44d2a30c08e63"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -6358,6 +6623,17 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
 
+[[package]]
+name = "uds_windows"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89daebc3e6fd160ac4aa9fc8b3bf71e1f74fbf92367ae71fb83a037e8bf164b9"
+dependencies = [
+ "memoffset 0.9.1",
+ "tempfile",
+ "winapi",
+]
+
 [[package]]
 name = "unarray"
 version = "0.1.4"
@@ -6378,9 +6654,9 @@ checksum = "5ab17db44d7388991a428b2ee655ce0c212e862eff1768a455c58f9aad6e7893"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
 
 [[package]]
 name = "unicode-linebreak"
@@ -6451,9 +6727,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.3"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d157f1b96d14500ffdc1f10ba712e780825526c03d9a49b4d0324b0d9113ada"
+checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
 dependencies = [
  "form_urlencoded",
  "idna 1.0.3",
@@ -6566,9 +6842,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.95"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "128d1e363af62632b8eb57219c8fd7877144af57558fb2ef0368d0087bddeb2e"
+checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -6577,36 +6853,36 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.95"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb6dd4d3ca0ddffd1dd1c9c04f94b868c37ff5fac97c30b97cff2d74fce3a358"
+checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
 dependencies = [
  "bumpalo",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.45"
+version = "0.4.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc7ec4f8827a71586374db3e87abdb5a2bb3a15afed140221307c3ec06b1f63b"
+checksum = "38176d9b44ea84e9184eff0bc34cc167ed044f816accfe5922e54d84cf48eca2"
 dependencies = [
  "cfg-if",
  "js-sys",
+ "once_cell",
  "wasm-bindgen",
  "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.95"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e79384be7f8f5a9dd5d7167216f022090cf1f9ec128e6e6a482a2cb5c5422c56"
+checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -6614,22 +6890,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.95"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
+checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.95"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65fc09f10666a9f147042251e0dda9c18f166ff7de300607007e96bdebc1068d"
+checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6"
 
 [[package]]
 name = "wasm-streams"
@@ -6646,9 +6922,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.72"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6488b90108c040df0fe62fa815cbdee25124641df01814dd7282749234c6112"
+checksum = "04dd7223427d52553d3702c004d3b2fe07c148165faa56313cb00211e31c12bc"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -6672,9 +6948,9 @@ checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
 
 [[package]]
 name = "webpki-roots"
-version = "0.26.6"
+version = "0.26.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841c67bff177718f1d4dfefde8d8f0e78f9b6589319ba88312f567fc5841a958"
+checksum = "5d642ff16b7e79272ae451b7322067cdc17cadf68c23264be9d94a32319efe7e"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -6697,7 +6973,7 @@ version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "372d5b87f58ec45c384ba03563b03544dc5fadc3983e434b286913f5b4a9bb6d"
 dependencies = [
- "redox_syscall 0.5.7",
+ "redox_syscall 0.5.8",
  "wasite",
 ]
 
@@ -6977,7 +7253,7 @@ dependencies = [
  "nom 7.1.3",
  "oid-registry",
  "rusticata-macros",
- "thiserror",
+ "thiserror 1.0.69",
  "time",
 ]
 
@@ -7001,6 +7277,16 @@ dependencies = [
  "rustix",
 ]
 
+[[package]]
+name = "xdg-home"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec1cdab258fb55c0da61328dc52c8764709b249011b2cad0454c72f0bf10a1f6"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "xz2"
 version = "0.1.7"
@@ -7019,7 +7305,7 @@ dependencies = [
  "anyhow",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -7045,9 +7331,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5"
+checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
 dependencies = [
  "serde",
  "stable_deref_trait",
@@ -7057,16 +7343,79 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
+checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
  "synstructure",
 ]
 
+[[package]]
+name = "zbus"
+version = "5.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1162094dc63b1629fcc44150bcceeaa80798cd28bcbe7fa987b65a034c258608"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-fs",
+ "async-io",
+ "async-lock",
+ "async-process",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "blocking",
+ "enumflags2",
+ "event-listener 5.3.1",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "nix 0.29.0",
+ "ordered-stream",
+ "serde",
+ "serde_repr",
+ "static_assertions",
+ "tracing",
+ "uds_windows",
+ "windows-sys 0.59.0",
+ "winnow 0.6.20",
+ "xdg-home",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "5.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cd2dcdce3e2727f7d74b7e33b5a89539b3cc31049562137faf7ae4eb86cd16d"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.90",
+ "zbus_names",
+ "zvariant",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "856b7a38811f71846fd47856ceee8bccaec8399ff53fb370247e66081ace647b"
+dependencies = [
+ "serde",
+ "static_assertions",
+ "winnow 0.6.20",
+ "zvariant",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.7.35"
@@ -7085,27 +7434,27 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55"
+checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
+checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
  "synstructure",
 ]
 
@@ -7126,7 +7475,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -7148,7 +7497,7 @@ checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.87",
+ "syn 2.0.90",
 ]
 
 [[package]]
@@ -7178,3 +7527,45 @@ dependencies = [
  "cc",
  "pkg-config",
 ]
+
+[[package]]
+name = "zvariant"
+version = "5.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1200ee6ac32f1e5a312e455a949a4794855515d34f9909f4a3e082d14e1a56f"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "static_assertions",
+ "winnow 0.6.20",
+ "zvariant_derive",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "5.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687e3b97fae6c9104fbbd36c73d27d149abf04fb874e2efbd84838763daa8916"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.90",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20d1d011a38f12360e5fcccceeff5e2c42a8eb7f27f0dcba97a0862ede05c9c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "static_assertions",
+ "syn 2.0.90",
+ "winnow 0.6.20",
+]
diff --git a/core/models/Cargo.toml b/core/models/Cargo.toml
index 44295745d..b402cb219 100644
--- a/core/models/Cargo.toml
+++ b/core/models/Cargo.toml
@@ -39,3 +39,4 @@ tokio = { version = "1", features = ["full"] }
 torut = { git = "https://github.com/Start9Labs/torut.git", branch = "update/dependencies" }
 tracing = "0.1.39"
 yasi = "0.1.5"
+zbus = "5"
diff --git a/core/models/src/errors.rs b/core/models/src/errors.rs
index 2077a8bbd..eba2a377f 100644
--- a/core/models/src/errors.rs
+++ b/core/models/src/errors.rs
@@ -90,6 +90,7 @@ pub enum ErrorKind {
     Lxc = 72,
     Cancelled = 73,
     Git = 74,
+    DBus = 75,
 }
 impl ErrorKind {
     pub fn as_str(&self) -> &'static str {
@@ -169,6 +170,7 @@ impl ErrorKind {
             Lxc => "LXC Error",
             Cancelled => "Cancelled",
             Git => "Git Error",
+            DBus => "DBus Error",
         }
     }
 }
@@ -327,6 +329,11 @@ impl From<torut::onion::OnionAddressParseError> for Error {
         Error::new(e, ErrorKind::Tor)
     }
 }
+impl From<zbus::Error> for Error {
+    fn from(e: zbus::Error) -> Self {
+        Error::new(e, ErrorKind::DBus)
+    }
+}
 impl From<patch_db::value::Error> for Error {
     fn from(value: patch_db::value::Error) -> Self {
         match value.kind {
diff --git a/core/startos/Cargo.toml b/core/startos/Cargo.toml
index cba5bc6dc..29c781af2 100644
--- a/core/startos/Cargo.toml
+++ b/core/startos/Cargo.toml
@@ -14,7 +14,7 @@ keywords = [
 name = "start-os"
 readme = "README.md"
 repository = "https://github.com/Start9Labs/start-os"
-version = "0.3.6-alpha.9"
+version = "0.3.6-alpha.10"
 license = "MIT"
 
 [lib]
@@ -50,7 +50,7 @@ test = []
 
 [dependencies]
 aes = { version = "0.7.5", features = ["ctr"] }
-async-acme = { version = "0.5.0", git = "https://github.com/dr-bonez/async-acme.git", features = [
+async-acme = { version = "0.6.0", git = "https://github.com/dr-bonez/async-acme.git", features = [
   "use_rustls",
   "use_tokio",
 ] }
@@ -62,7 +62,6 @@ async-compression = { version = "0.4.4", features = [
 async-stream = "0.3.5"
 async-trait = "0.1.74"
 axum = { version = "0.7.3", features = ["ws"] }
-axum-server = "0.6.0"
 barrage = "0.2.3"
 backhand = "0.18.0"
 base32 = "0.5.0"
@@ -102,11 +101,15 @@ hex = "0.4.3"
 hmac = "0.12.1"
 http = "1.0.0"
 http-body-util = "0.1"
-hyper-util = { version = "0.1.5", features = [
-  "tokio",
+hyper = { version = "1.5", features = ["server", "http1", "http2"] }
+hyper-util = { version = "0.1.10", features = [
+  "server",
+  "server-auto",
+  "server-graceful",
   "service",
   "http1",
   "http2",
+  "tokio",
 ] }
 id-pool = { version = "0.2.2", default-features = false, features = [
   "serde",
@@ -131,12 +134,14 @@ lazy_format = "2.0"
 lazy_static = "1.4.0"
 libc = "0.2.149"
 log = "0.4.20"
+mio = "1"
 mbrman = "0.5.2"
 models = { version = "*", path = "../models" }
 new_mime_guess = "4"
 nix = { version = "0.29.0", features = [
   "fs",
   "mount",
+  "net",
   "process",
   "sched",
   "signal",
@@ -216,6 +221,7 @@ unix-named-pipe = "0.2.0"
 url = { version = "2.4.1", features = ["serde"] }
 urlencoding = "2.1.3"
 uuid = { version = "1.4.1", features = ["v4"] }
+zbus = "5.1.1"
 zeroize = "1.6.0"
 
 [profile.test]
diff --git a/core/startos/src/action.rs b/core/startos/src/action.rs
index 801360a44..b29768d73 100644
--- a/core/startos/src/action.rs
+++ b/core/startos/src/action.rs
@@ -1,4 +1,3 @@
-use std::collections::BTreeMap;
 use std::fmt;
 
 use clap::{CommandFactory, FromArgMatches, Parser};
diff --git a/core/startos/src/auth.rs b/core/startos/src/auth.rs
index a6b624b70..9085709ab 100644
--- a/core/startos/src/auth.rs
+++ b/core/startos/src/auth.rs
@@ -187,9 +187,8 @@ pub fn check_password_against_db(db: &DatabaseModel, password: &str) -> Result<(
     Ok(())
 }
 
-#[derive(Deserialize, Serialize, Parser, TS)]
+#[derive(Deserialize, Serialize, TS)]
 #[serde(rename_all = "camelCase")]
-#[command(rename_all = "kebab-case")]
 #[ts(export)]
 pub struct LoginParams {
     password: Option<PasswordType>,
diff --git a/core/startos/src/backup/restore.rs b/core/startos/src/backup/restore.rs
index 28d70653f..e2e9e2158 100644
--- a/core/startos/src/backup/restore.rs
+++ b/core/startos/src/backup/restore.rs
@@ -109,9 +109,10 @@ pub async fn recover_full_embassy(
     db.put(&ROOT, &Database::init(&os_backup.account)?).await?;
     drop(db);
 
-    let InitResult { net_ctrl } = init(&ctx.config, init_phases).await?;
+    let InitResult { net_ctrl } = init(&ctx.webserver, &ctx.config, init_phases).await?;
 
     let rpc_ctx = RpcContext::init(
+        &ctx.webserver,
         &ctx.config,
         disk_guid.clone(),
         Some(net_ctrl),
diff --git a/core/startos/src/bins/container_cli.rs b/core/startos/src/bins/container_cli.rs
index b0da1cb00..118133f55 100644
--- a/core/startos/src/bins/container_cli.rs
+++ b/core/startos/src/bins/container_cli.rs
@@ -4,7 +4,7 @@ use rpc_toolkit::CliApp;
 use serde_json::Value;
 
 use crate::service::cli::{ContainerCliContext, ContainerClientConfig};
-use crate::util::logger::EmbassyLogger;
+use crate::util::logger::LOGGER;
 use crate::version::{Current, VersionT};
 
 lazy_static::lazy_static! {
@@ -12,7 +12,7 @@ lazy_static::lazy_static! {
 }
 
 pub fn main(args: impl IntoIterator<Item = OsString>) {
-    EmbassyLogger::init();
+    LOGGER.enable();
     if let Err(e) = CliApp::new(
         |cfg: ContainerClientConfig| Ok(ContainerCliContext::init(cfg)),
         crate::service::effects::handler(),
diff --git a/core/startos/src/bins/registry.rs b/core/startos/src/bins/registry.rs
index 132e0984a..8a52b2485 100644
--- a/core/startos/src/bins/registry.rs
+++ b/core/startos/src/bins/registry.rs
@@ -1,20 +1,20 @@
 use std::ffi::OsString;
 
 use clap::Parser;
-use futures::FutureExt;
+use futures::{FutureExt, TryStreamExt};
 use tokio::signal::unix::signal;
 use tracing::instrument;
 
-use crate::net::web_server::WebServer;
+use crate::net::web_server::{Acceptor, WebServer};
 use crate::prelude::*;
 use crate::registry::context::{RegistryConfig, RegistryContext};
-use crate::util::logger::EmbassyLogger;
+use crate::util::logger::LOGGER;
 
 #[instrument(skip_all)]
 async fn inner_main(config: &RegistryConfig) -> Result<(), Error> {
     let server = async {
         let ctx = RegistryContext::init(config).await?;
-        let mut server = WebServer::new(ctx.listen);
+        let mut server = WebServer::new(Acceptor::bind([ctx.listen]).await?);
         server.serve_registry(ctx.clone());
 
         let mut shutdown_recv = ctx.shutdown.subscribe();
@@ -63,7 +63,7 @@ async fn inner_main(config: &RegistryConfig) -> Result<(), Error> {
 }
 
 pub fn main(args: impl IntoIterator<Item = OsString>) {
-    EmbassyLogger::init();
+    LOGGER.enable();
 
     let config = RegistryConfig::parse_from(args).load().unwrap();
 
diff --git a/core/startos/src/bins/start_cli.rs b/core/startos/src/bins/start_cli.rs
index 2e92e0cc0..bda5e00d3 100644
--- a/core/startos/src/bins/start_cli.rs
+++ b/core/startos/src/bins/start_cli.rs
@@ -5,7 +5,7 @@ use serde_json::Value;
 
 use crate::context::config::ClientConfig;
 use crate::context::CliContext;
-use crate::util::logger::EmbassyLogger;
+use crate::util::logger::LOGGER;
 use crate::version::{Current, VersionT};
 
 lazy_static::lazy_static! {
@@ -13,7 +13,8 @@ lazy_static::lazy_static! {
 }
 
 pub fn main(args: impl IntoIterator<Item = OsString>) {
-    EmbassyLogger::init();
+    LOGGER.enable();
+
     if let Err(e) = CliApp::new(
         |cfg: ClientConfig| Ok(CliContext::init(cfg.load()?)?),
         crate::expanded_api(),
diff --git a/core/startos/src/bins/start_init.rs b/core/startos/src/bins/start_init.rs
index 394d42c8d..aad29c0c5 100644
--- a/core/startos/src/bins/start_init.rs
+++ b/core/startos/src/bins/start_init.rs
@@ -11,7 +11,7 @@ use crate::disk::main::DEFAULT_PASSWORD;
 use crate::disk::REPAIR_DISK_PATH;
 use crate::firmware::{check_for_firmware_update, update_firmware};
 use crate::init::{InitPhases, InitResult, STANDBY_MODE_PATH};
-use crate::net::web_server::WebServer;
+use crate::net::web_server::{UpgradableListener, WebServer};
 use crate::prelude::*;
 use crate::progress::FullProgressTracker;
 use crate::shutdown::Shutdown;
@@ -20,7 +20,7 @@ use crate::PLATFORM;
 
 #[instrument(skip_all)]
 async fn setup_or_init(
-    server: &mut WebServer,
+    server: &mut WebServer<UpgradableListener>,
     config: &ServerConfig,
 ) -> Result<Result<(RpcContext, FullProgressTracker), Shutdown>, Error> {
     if let Some(firmware) = check_for_firmware_update()
@@ -111,7 +111,7 @@ async fn setup_or_init(
         .await
         .is_err()
     {
-        let ctx = SetupContext::init(config)?;
+        let ctx = SetupContext::init(server, config)?;
 
         server.serve_setup(ctx.clone());
 
@@ -178,6 +178,7 @@ async fn setup_or_init(
             tracing::info!("Loaded Disk");
 
             if requires_reboot.0 {
+                tracing::info!("Rebooting...");
                 let mut reboot_phase = handle.add_phase("Rebooting".into(), Some(1));
                 reboot_phase.start();
                 return Ok(Err(Shutdown {
@@ -186,10 +187,17 @@ async fn setup_or_init(
                 }));
             }
 
-            let InitResult { net_ctrl } = crate::init::init(config, init_phases).await?;
+            let InitResult { net_ctrl } =
+                crate::init::init(&server.acceptor_setter(), config, init_phases).await?;
 
-            let rpc_ctx =
-                RpcContext::init(config, disk_guid, Some(net_ctrl), rpc_ctx_phases).await?;
+            let rpc_ctx = RpcContext::init(
+                &server.acceptor_setter(),
+                config,
+                disk_guid,
+                Some(net_ctrl),
+                rpc_ctx_phases,
+            )
+            .await?;
 
             Ok::<_, Error>(Ok((rpc_ctx, handle)))
         }
@@ -203,7 +211,7 @@ async fn setup_or_init(
 
 #[instrument(skip_all)]
 pub async fn main(
-    server: &mut WebServer,
+    server: &mut WebServer<UpgradableListener>,
     config: &ServerConfig,
 ) -> Result<Result<(RpcContext, FullProgressTracker), Shutdown>, Error> {
     if &*PLATFORM == "raspberrypi" && tokio::fs::metadata(STANDBY_MODE_PATH).await.is_ok() {
diff --git a/core/startos/src/bins/startd.rs b/core/startos/src/bins/startd.rs
index d383f3091..2bf32724e 100644
--- a/core/startos/src/bins/startd.rs
+++ b/core/startos/src/bins/startd.rs
@@ -1,6 +1,6 @@
 use std::cmp::max;
 use std::ffi::OsString;
-use std::net::{Ipv6Addr, SocketAddr};
+use std::net::IpAddr;
 use std::sync::Arc;
 
 use clap::Parser;
@@ -12,21 +12,26 @@ use tracing::instrument;
 use crate::context::config::ServerConfig;
 use crate::context::rpc::InitRpcContextPhases;
 use crate::context::{DiagnosticContext, InitContext, RpcContext};
-use crate::net::web_server::WebServer;
+use crate::net::utils::ipv6_is_local;
+use crate::net::web_server::{Acceptor, UpgradableListener, WebServer};
 use crate::shutdown::Shutdown;
 use crate::system::launch_metrics_task;
-use crate::util::logger::EmbassyLogger;
+use crate::util::io::append_file;
+use crate::util::logger::LOGGER;
 use crate::{Error, ErrorKind, ResultExt};
 
 #[instrument(skip_all)]
 async fn inner_main(
-    server: &mut WebServer,
+    server: &mut WebServer<UpgradableListener>,
     config: &ServerConfig,
 ) -> Result<Option<Shutdown>, Error> {
     let rpc_ctx = if !tokio::fs::metadata("/run/startos/initialized")
         .await
         .is_ok()
     {
+        LOGGER.set_logfile(Some(
+            append_file("/run/startos/init.log").await?.into_std().await,
+        ));
         let (ctx, handle) = match super::start_init::main(server, &config).await? {
             Err(s) => return Ok(Some(s)),
             Ok(ctx) => ctx,
@@ -34,6 +39,7 @@ async fn inner_main(
         tokio::fs::write("/run/startos/initialized", "").await?;
 
         server.serve_main(ctx.clone());
+        LOGGER.set_logfile(None);
         handle.complete();
 
         ctx
@@ -44,6 +50,7 @@ async fn inner_main(
         server.serve_init(init_ctx);
 
         let ctx = RpcContext::init(
+            &server.acceptor_setter(),
             config,
             Arc::new(
                 tokio::fs::read_to_string("/media/startos/config/disk.guid") // unique identifier for volume group - keeps track of the disk that goes with your embassy
@@ -131,7 +138,7 @@ async fn inner_main(
 }
 
 pub fn main(args: impl IntoIterator<Item = OsString>) {
-    EmbassyLogger::init();
+    LOGGER.enable();
 
     let config = ServerConfig::parse_from(args).load().unwrap();
 
@@ -142,7 +149,18 @@ pub fn main(args: impl IntoIterator<Item = OsString>) {
             .build()
             .expect("failed to initialize runtime");
         rt.block_on(async {
-            let mut server = WebServer::new(SocketAddr::new(Ipv6Addr::UNSPECIFIED.into(), 80));
+            let addrs = crate::net::utils::all_socket_addrs_for(80).await?;
+            let mut server = WebServer::new(
+                Acceptor::bind_upgradable(addrs.into_iter().filter(|addr| match addr.ip() {
+                    IpAddr::V4(ip4) => {
+                        ip4.is_loopback()
+                        || (ip4.is_private() && !ip4.octets().starts_with(&[10, 59])) // reserving 10.59 for public wireguard configurations
+                        || ip4.is_link_local()
+                    }
+                    IpAddr::V6(ip6) => ipv6_is_local(ip6),
+                }))
+                .await?,
+            );
             match inner_main(&mut server, &config).await {
                 Ok(a) => {
                     server.shutdown().await;
diff --git a/core/startos/src/context/config.rs b/core/startos/src/context/config.rs
index e02648919..811819479 100644
--- a/core/startos/src/context/config.rs
+++ b/core/startos/src/context/config.rs
@@ -103,8 +103,6 @@ pub struct ServerConfig {
     #[arg(skip)]
     pub os_partitions: Option<OsPartitionInfo>,
     #[arg(long)]
-    pub bind_rpc: Option<SocketAddr>,
-    #[arg(long)]
     pub tor_control: Option<SocketAddr>,
     #[arg(long)]
     pub tor_socks: Option<SocketAddr>,
@@ -126,7 +124,6 @@ impl ContextConfig for ServerConfig {
     fn merge_with(&mut self, other: Self) {
         self.ethernet_interface = self.ethernet_interface.take().or(other.ethernet_interface);
         self.os_partitions = self.os_partitions.take().or(other.os_partitions);
-        self.bind_rpc = self.bind_rpc.take().or(other.bind_rpc);
         self.tor_control = self.tor_control.take().or(other.tor_control);
         self.tor_socks = self.tor_socks.take().or(other.tor_socks);
         self.dns_bind = self.dns_bind.take().or(other.dns_bind);
diff --git a/core/startos/src/context/rpc.rs b/core/startos/src/context/rpc.rs
index 73d103adc..87245b4fa 100644
--- a/core/startos/src/context/rpc.rs
+++ b/core/startos/src/context/rpc.rs
@@ -31,6 +31,7 @@ use crate::init::check_time_is_synchronized;
 use crate::lxc::{ContainerId, LxcContainer, LxcManager};
 use crate::net::net_controller::{NetController, PreInitNetController};
 use crate::net::utils::{find_eth_iface, find_wifi_iface};
+use crate::net::web_server::{UpgradableListener, WebServerAcceptorSetter};
 use crate::net::wifi::WpaCli;
 use crate::prelude::*;
 use crate::progress::{FullProgressTracker, PhaseProgressTrackerHandle};
@@ -117,6 +118,7 @@ pub struct RpcContext(Arc<RpcContextSeed>);
 impl RpcContext {
     #[instrument(skip_all)]
     pub async fn init(
+        webserver: &WebServerAcceptorSetter<UpgradableListener>,
         config: &ServerConfig,
         disk_guid: Arc<String>,
         net_ctrl: Option<PreInitNetController>,
@@ -149,7 +151,7 @@ impl RpcContext {
                 if let Some(net_ctrl) = net_ctrl {
                     net_ctrl
                 } else {
-                    PreInitNetController::init(
+                    let net_ctrl = PreInitNetController::init(
                         db.clone(),
                         config
                             .tor_control
@@ -158,7 +160,9 @@ impl RpcContext {
                         &account.hostname,
                         account.tor_key.clone(),
                     )
-                    .await?
+                    .await?;
+                    webserver.try_upgrade(|a| net_ctrl.net_iface.upgrade_listener(a))?;
+                    net_ctrl
                 },
                 config
                     .dns_bind
diff --git a/core/startos/src/context/setup.rs b/core/startos/src/context/setup.rs
index 96ec07700..2db5668b9 100644
--- a/core/startos/src/context/setup.rs
+++ b/core/startos/src/context/setup.rs
@@ -23,6 +23,7 @@ use crate::context::RpcContext;
 use crate::disk::OsPartitionInfo;
 use crate::hostname::Hostname;
 use crate::init::init_postgres;
+use crate::net::web_server::{UpgradableListener, WebServer, WebServerAcceptorSetter};
 use crate::prelude::*;
 use crate::progress::FullProgressTracker;
 use crate::rpc_continuations::{Guid, RpcContinuation, RpcContinuations};
@@ -61,6 +62,7 @@ impl TryFrom<&AccountInfo> for SetupResult {
 }
 
 pub struct SetupContextSeed {
+    pub webserver: WebServerAcceptorSetter<UpgradableListener>,
     pub config: ServerConfig,
     pub os_partitions: OsPartitionInfo,
     pub disable_encryption: bool,
@@ -76,10 +78,14 @@ pub struct SetupContextSeed {
 pub struct SetupContext(Arc<SetupContextSeed>);
 impl SetupContext {
     #[instrument(skip_all)]
-    pub fn init(config: &ServerConfig) -> Result<Self, Error> {
+    pub fn init(
+        webserver: &WebServer<UpgradableListener>,
+        config: &ServerConfig,
+    ) -> Result<Self, Error> {
         let (shutdown, _) = tokio::sync::broadcast::channel(1);
         let datadir = config.datadir().to_owned();
         Ok(Self(Arc::new(SetupContextSeed {
+            webserver: webserver.acceptor_setter(),
             config: config.clone(),
             os_partitions: config.os_partitions.clone().ok_or_else(|| {
                 Error::new(
diff --git a/core/startos/src/db/model/public.rs b/core/startos/src/db/model/public.rs
index 85978134d..92b9c8a88 100644
--- a/core/startos/src/db/model/public.rs
+++ b/core/startos/src/db/model/public.rs
@@ -1,10 +1,10 @@
 use std::collections::{BTreeMap, BTreeSet};
-use std::net::{Ipv4Addr, Ipv6Addr};
+use std::net::{IpAddr, Ipv4Addr};
 
 use chrono::{DateTime, Utc};
 use exver::{Version, VersionRange};
 use imbl_value::InternedString;
-use ipnet::{Ipv4Net, Ipv6Net};
+use ipnet::IpNet;
 use isocountry::CountryCode;
 use itertools::Itertools;
 use models::PackageId;
@@ -17,7 +17,8 @@ use ts_rs::TS;
 
 use crate::account::AccountInfo;
 use crate::db::model::package::AllPackageData;
-use crate::net::utils::{get_iface_ipv4_addr, get_iface_ipv6_addr};
+use crate::net::acme::AcmeProvider;
+use crate::net::utils::ipv6_is_local;
 use crate::prelude::*;
 use crate::progress::FullProgress;
 use crate::system::SmtpValue;
@@ -54,8 +55,8 @@ impl Public {
                 tor_address: format!("https://{}", account.tor_key.public().get_onion_address())
                     .parse()
                     .unwrap(),
-                ip_info: BTreeMap::new(),
-                acme: None,
+                network_interfaces: BTreeMap::new(),
+                acme: BTreeMap::new(),
                 status_info: ServerStatus {
                     backup_progress: None,
                     updated: false,
@@ -130,8 +131,11 @@ pub struct ServerInfo {
     /// for backwards compatibility
     #[ts(type = "string")]
     pub tor_address: Url,
-    pub ip_info: BTreeMap<String, IpInfo>,
-    pub acme: Option<AcmeSettings>,
+    #[ts(as = "BTreeMap::<String, NetworkInterfaceInfo>")]
+    #[serde(default)]
+    pub network_interfaces: BTreeMap<InternedString, NetworkInterfaceInfo>,
+    #[serde(default)]
+    pub acme: BTreeMap<AcmeProvider, AcmeSettings>,
     #[serde(default)]
     pub status_info: ServerStatus,
     pub wifi: WifiInfo,
@@ -151,43 +155,51 @@ pub struct ServerInfo {
     pub devices: Vec<LshwDevice>,
 }
 
-#[derive(Debug, Deserialize, Serialize, HasModel, TS)]
+#[derive(Clone, Debug, Default, Deserialize, Serialize, HasModel, TS)]
 #[serde(rename_all = "camelCase")]
 #[model = "Model<Self>"]
 #[ts(export)]
-pub struct IpInfo {
-    #[ts(type = "string | null")]
-    pub ipv4_range: Option<Ipv4Net>,
-    pub ipv4: Option<Ipv4Addr>,
-    #[ts(type = "string | null")]
-    pub ipv6_range: Option<Ipv6Net>,
-    pub ipv6: Option<Ipv6Addr>,
+pub struct NetworkInterfaceInfo {
+    pub public: Option<bool>,
+    pub ip_info: Option<IpInfo>,
 }
-impl IpInfo {
-    pub async fn for_interface(iface: &str) -> Result<Self, Error> {
-        let (ipv4, ipv4_range) = get_iface_ipv4_addr(iface).await?.unzip();
-        let (ipv6, ipv6_range) = get_iface_ipv6_addr(iface).await?.unzip();
-        Ok(Self {
-            ipv4_range,
-            ipv4,
-            ipv6_range,
-            ipv6,
+impl NetworkInterfaceInfo {
+    pub fn public(&self) -> bool {
+        self.public.unwrap_or_else(|| {
+            !self.ip_info.as_ref().map_or(true, |ip_info| {
+                ip_info.subnets.iter().all(|ipnet| {
+                    match ipnet.addr() {
+                        IpAddr::V4(ip4) => {
+                            ip4.is_loopback()
+                            || (ip4.is_private() && !ip4.octets().starts_with(&[10, 59])) // reserving 10.59 for public wireguard configurations
+                            || ip4.is_link_local()
+                        }
+                        IpAddr::V6(_) => true,
+                    }
+                })
+            })
         })
     }
 }
 
+#[derive(Clone, Debug, Default, PartialEq, Eq, Deserialize, Serialize, TS)]
+#[ts(export)]
+#[serde(rename_all = "camelCase")]
+pub struct IpInfo {
+    pub scope_id: u32,
+    #[ts(type = "string[]")]
+    pub subnets: BTreeSet<IpNet>,
+    pub wan_ip: Option<Ipv4Addr>,
+    #[ts(type = "string[]")]
+    pub ntp_servers: BTreeSet<InternedString>,
+}
+
 #[derive(Debug, Deserialize, Serialize, HasModel, TS)]
 #[serde(rename_all = "camelCase")]
 #[model = "Model<Self>"]
 #[ts(export)]
 pub struct AcmeSettings {
-    #[ts(type = "string")]
-    pub provider: Url,
-    /// email addresses for letsencrypt
     pub contact: Vec<String>,
-    #[ts(type = "string[]")]
-    /// domains to get letsencrypt certs for
-    pub domains: BTreeSet<InternedString>,
 }
 
 #[derive(Debug, Default, Deserialize, Serialize, HasModel, TS)]
diff --git a/core/startos/src/diagnostic.rs b/core/startos/src/diagnostic.rs
index f0c142706..71f76c379 100644
--- a/core/startos/src/diagnostic.rs
+++ b/core/startos/src/diagnostic.rs
@@ -1,4 +1,3 @@
-use std::path::Path;
 use std::sync::Arc;
 
 use rpc_toolkit::yajrc::RpcError;
diff --git a/core/startos/src/init.rs b/core/startos/src/init.rs
index a81e7e336..3652336dc 100644
--- a/core/startos/src/init.rs
+++ b/core/startos/src/init.rs
@@ -25,6 +25,7 @@ use crate::db::model::Database;
 use crate::disk::mount::util::unmount;
 use crate::middleware::auth::LOCAL_AUTH_COOKIE_PATH;
 use crate::net::net_controller::PreInitNetController;
+use crate::net::web_server::{UpgradableListener, WebServerAcceptorSetter};
 use crate::prelude::*;
 use crate::progress::{
     FullProgress, FullProgressTracker, PhaseProgressTrackerHandle, PhasedProgressBar,
@@ -274,6 +275,7 @@ pub async fn run_script<P: AsRef<Path>>(path: P, mut progress: PhaseProgressTrac
 
 #[instrument(skip_all)]
 pub async fn init(
+    webserver: &WebServerAcceptorSetter<UpgradableListener>,
     cfg: &ServerConfig,
     InitPhases {
         preinit,
@@ -356,6 +358,7 @@ pub async fn init(
         account.tor_key,
     )
     .await?;
+    webserver.try_upgrade(|a| net_ctrl.net_iface.upgrade_listener(a))?;
     start_net.complete();
 
     mount_logs.start();
@@ -419,7 +422,7 @@ pub async fn init(
     load_ca_cert.complete();
 
     load_wifi.start();
-    crate::net::wifi::synchronize_wpa_supplicant_conf(
+    crate::net::wifi::synchronize_network_manager(
         &cfg.datadir().join("main"),
         &mut server_info.wifi,
     )
@@ -509,7 +512,6 @@ pub async fn init(
     enable_zram.complete();
 
     update_server_info.start();
-    server_info.ip_info = crate::net::dhcp::init_ips().await?;
     server_info.ram = get_mem_info().await?.total.0 as u64 * 1024 * 1024;
     server_info.devices = lshw().await?;
     server_info.status_info = ServerStatus {
diff --git a/core/startos/src/lib.rs b/core/startos/src/lib.rs
index 3c5875e36..1285b4811 100644
--- a/core/startos/src/lib.rs
+++ b/core/startos/src/lib.rs
@@ -1,6 +1,6 @@
 pub const DEFAULT_REGISTRY: &str = "https://registry.start9.com";
 // pub const COMMUNITY_MARKETPLACE: &str = "https://community-registry.start9.com";
-pub const HOST_IP: [u8; 4] = [172, 18, 0, 1];
+pub const HOST_IP: [u8; 4] = [10, 0, 3, 1];
 pub use std::env::consts::ARCH;
 lazy_static::lazy_static! {
     pub static ref PLATFORM: String = {
diff --git a/core/startos/src/lxc/dev.rs b/core/startos/src/lxc/dev.rs
index 248546d88..a918672da 100644
--- a/core/startos/src/lxc/dev.rs
+++ b/core/startos/src/lxc/dev.rs
@@ -8,13 +8,11 @@ use rpc_toolkit::{
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
 
+use crate::context::{CliContext, RpcContext};
 use crate::lxc::{ContainerId, LxcConfig};
 use crate::prelude::*;
 use crate::rpc_continuations::Guid;
-use crate::{
-    context::{CliContext, RpcContext},
-    service::ServiceStats,
-};
+use crate::service::ServiceStats;
 
 pub fn lxc<C: Context>() -> ParentHandler<C> {
     ParentHandler::new()
diff --git a/core/startos/src/lxc/mod.rs b/core/startos/src/lxc/mod.rs
index c0fb6eaba..60f9f4301 100644
--- a/core/startos/src/lxc/mod.rs
+++ b/core/startos/src/lxc/mod.rs
@@ -1,8 +1,9 @@
+use std::collections::BTreeSet;
+use std::ffi::OsString;
 use std::net::Ipv4Addr;
 use std::path::Path;
 use std::sync::{Arc, Weak};
 use std::time::Duration;
-use std::{collections::BTreeSet, ffi::OsString};
 
 use clap::builder::ValueParserFactory;
 use futures::{AsyncWriteExt, StreamExt};
diff --git a/core/startos/src/net/acme.rs b/core/startos/src/net/acme.rs
index 95f9d4adb..5d8da41f1 100644
--- a/core/startos/src/net/acme.rs
+++ b/core/startos/src/net/acme.rs
@@ -1,6 +1,7 @@
 use std::collections::{BTreeMap, BTreeSet};
 use std::str::FromStr;
 
+use async_acme::acme::Identifier;
 use clap::builder::ValueParserFactory;
 use clap::Parser;
 use imbl_value::InternedString;
@@ -10,6 +11,7 @@ use openssl::pkey::{PKey, Private};
 use openssl::x509::X509;
 use rpc_toolkit::{from_fn_async, Context, HandlerExt, ParentHandler};
 use serde::{Deserialize, Serialize};
+use ts_rs::TS;
 use url::Url;
 
 use crate::context::{CliContext, RpcContext};
@@ -78,10 +80,18 @@ impl<'a> async_acme::cache::AcmeCache for AcmeCertCache<'a> {
 
     async fn read_certificate(
         &self,
-        domains: &[String],
+        identifiers: &[Identifier],
         directory_url: &str,
     ) -> Result<Option<(String, String)>, Self::Error> {
-        let domains = JsonKey::new(domains.into_iter().map(InternedString::intern).collect());
+        let identifiers = JsonKey::new(
+            identifiers
+                .into_iter()
+                .map(|d| match d {
+                    Identifier::Dns(d) => d.into(),
+                    Identifier::Ip(ip) => InternedString::from_display(ip),
+                })
+                .collect(),
+        );
         let directory_url = directory_url
             .parse::<Url>()
             .with_kind(ErrorKind::ParseUrl)?;
@@ -94,7 +104,7 @@ impl<'a> async_acme::cache::AcmeCache for AcmeCertCache<'a> {
             .into_acme()
             .into_certs()
             .into_idx(&directory_url)
-            .and_then(|a| a.into_idx(&domains))
+            .and_then(|a| a.into_idx(&identifiers))
         else {
             return Ok(None);
         };
@@ -120,13 +130,21 @@ impl<'a> async_acme::cache::AcmeCache for AcmeCertCache<'a> {
 
     async fn write_certificate(
         &self,
-        domains: &[String],
+        identifiers: &[Identifier],
         directory_url: &str,
         key_pem: &str,
         certificate_pem: &str,
     ) -> Result<(), Self::Error> {
-        tracing::info!("Saving new certificate for {domains:?}");
-        let domains = JsonKey::new(domains.into_iter().map(InternedString::intern).collect());
+        tracing::info!("Saving new certificate for {identifiers:?}");
+        let identifiers = JsonKey::new(
+            identifiers
+                .into_iter()
+                .map(|d| match d {
+                    Identifier::Dns(d) => d.into(),
+                    Identifier::Ip(ip) => InternedString::from_display(ip),
+                })
+                .collect(),
+        );
         let directory_url = directory_url
             .parse::<Url>()
             .with_kind(ErrorKind::ParseUrl)?;
@@ -146,7 +164,7 @@ impl<'a> async_acme::cache::AcmeCache for AcmeCertCache<'a> {
                     .as_acme_mut()
                     .as_certs_mut()
                     .upsert(&directory_url, || Ok(BTreeMap::new()))?
-                    .insert(&domains, &cert)
+                    .insert(&identifiers, &cert)
             })
             .await?;
 
@@ -155,22 +173,17 @@ impl<'a> async_acme::cache::AcmeCache for AcmeCertCache<'a> {
 }
 
 pub fn acme<C: Context>() -> ParentHandler<C> {
-    ParentHandler::new()
-        .subcommand(
-            "init",
-            from_fn_async(init)
-                .no_display()
-                .with_about("Setup ACME certificate acquisition")
-                .with_call_remote::<CliContext>(),
-        )
-        .subcommand(
-            "domain",
-            domain::<C>()
-                .with_about("Add, remove, or view domains for which to acquire ACME certificates"),
-        )
+    ParentHandler::new().subcommand(
+        "init",
+        from_fn_async(init)
+            .no_display()
+            .with_about("Setup ACME certificate acquisition")
+            .with_call_remote::<CliContext>(),
+    )
 }
 
-#[derive(Clone, Deserialize, Serialize)]
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, TS)]
+#[ts(type = "string")]
 pub struct AcmeProvider(pub Url);
 impl FromStr for AcmeProvider {
     type Err = <Url as FromStr>::Err;
@@ -183,6 +196,11 @@ impl FromStr for AcmeProvider {
         .map(Self)
     }
 }
+impl AsRef<str> for AcmeProvider {
+    fn as_ref(&self) -> &str {
+        self.0.as_str()
+    }
+}
 impl ValueParserFactory for AcmeProvider {
     type Parser = FromStrParser<Self>;
     fn value_parser() -> Self::Parser {
@@ -200,125 +218,15 @@ pub struct InitAcmeParams {
 
 pub async fn init(
     ctx: RpcContext,
-    InitAcmeParams {
-        provider: AcmeProvider(provider),
-        contact,
-    }: InitAcmeParams,
+    InitAcmeParams { provider, contact }: InitAcmeParams,
 ) -> Result<(), Error> {
     ctx.db
         .mutate(|db| {
             db.as_public_mut()
                 .as_server_info_mut()
                 .as_acme_mut()
-                .map_mutate(|acme| {
-                    Ok(Some(AcmeSettings {
-                        provider,
-                        contact,
-                        domains: acme.map(|acme| acme.domains).unwrap_or_default(),
-                    }))
-                })
+                .insert(&provider, &AcmeSettings { contact })
         })
         .await?;
     Ok(())
 }
-
-pub fn domain<C: Context>() -> ParentHandler<C> {
-    ParentHandler::new()
-        .subcommand(
-            "add",
-            from_fn_async(add_domain)
-                .no_display()
-                .with_about("Add a domain for which to acquire ACME certificates")
-                .with_call_remote::<CliContext>(),
-        )
-        .subcommand(
-            "remove",
-            from_fn_async(remove_domain)
-                .no_display()
-                .with_about("Remove a domain for which to acquire ACME certificates")
-                .with_call_remote::<CliContext>(),
-        )
-        .subcommand(
-            "list",
-            from_fn_async(list_domains)
-                .with_custom_display_fn(|_, res| {
-                    for domain in res {
-                        println!("{domain}")
-                    }
-                    Ok(())
-                })
-                .with_about("List domains for which to acquire ACME certificates")
-                .with_call_remote::<CliContext>(),
-        )
-}
-
-#[derive(Deserialize, Serialize, Parser)]
-pub struct DomainParams {
-    pub domain: InternedString,
-}
-
-pub async fn add_domain(
-    ctx: RpcContext,
-    DomainParams { domain }: DomainParams,
-) -> Result<(), Error> {
-    ctx.db
-        .mutate(|db| {
-            db.as_public_mut()
-                .as_server_info_mut()
-                .as_acme_mut()
-                .transpose_mut()
-                .ok_or_else(|| {
-                    Error::new(
-                        eyre!("Please call `start-cli net acme init` before adding a domain"),
-                        ErrorKind::InvalidRequest,
-                    )
-                })?
-                .as_domains_mut()
-                .mutate(|domains| {
-                    domains.insert(domain);
-                    Ok(())
-                })
-        })
-        .await?;
-    Ok(())
-}
-
-pub async fn remove_domain(
-    ctx: RpcContext,
-    DomainParams { domain }: DomainParams,
-) -> Result<(), Error> {
-    ctx.db
-        .mutate(|db| {
-            if let Some(acme) = db
-                .as_public_mut()
-                .as_server_info_mut()
-                .as_acme_mut()
-                .transpose_mut()
-            {
-                acme.as_domains_mut().mutate(|domains| {
-                    domains.remove(&domain);
-                    Ok(())
-                })
-            } else {
-                Ok(())
-            }
-        })
-        .await?;
-    Ok(())
-}
-
-pub async fn list_domains(ctx: RpcContext) -> Result<BTreeSet<InternedString>, Error> {
-    if let Some(acme) = ctx
-        .db
-        .peek()
-        .await
-        .into_public()
-        .into_server_info()
-        .into_acme()
-        .transpose()
-    {
-        acme.into_domains().de()
-    } else {
-        Ok(BTreeSet::new())
-    }
-}
diff --git a/core/startos/src/net/dhcp.rs b/core/startos/src/net/dhcp.rs
deleted file mode 100644
index e323ba371..000000000
--- a/core/startos/src/net/dhcp.rs
+++ /dev/null
@@ -1,99 +0,0 @@
-use std::collections::{BTreeMap, BTreeSet};
-use std::net::IpAddr;
-
-use clap::Parser;
-use futures::TryStreamExt;
-use rpc_toolkit::{from_fn_async, Context, HandlerExt, ParentHandler};
-use serde::{Deserialize, Serialize};
-use tokio::sync::RwLock;
-use ts_rs::TS;
-
-use crate::context::{CliContext, RpcContext};
-use crate::db::model::public::IpInfo;
-use crate::net::utils::{iface_is_physical, list_interfaces};
-use crate::prelude::*;
-use crate::Error;
-
-lazy_static::lazy_static! {
-    static ref CACHED_IPS: RwLock<BTreeSet<IpAddr>> = RwLock::new(BTreeSet::new());
-}
-
-async fn _ips() -> Result<BTreeSet<IpAddr>, Error> {
-    Ok(init_ips()
-        .await?
-        .values()
-        .flat_map(|i| {
-            std::iter::empty()
-                .chain(i.ipv4.map(IpAddr::from))
-                .chain(i.ipv6.map(IpAddr::from))
-        })
-        .collect())
-}
-
-pub async fn ips() -> Result<BTreeSet<IpAddr>, Error> {
-    let ips = CACHED_IPS.read().await.clone();
-    if !ips.is_empty() {
-        return Ok(ips);
-    }
-    let ips = _ips().await?;
-    *CACHED_IPS.write().await = ips.clone();
-    Ok(ips)
-}
-
-pub async fn init_ips() -> Result<BTreeMap<String, IpInfo>, Error> {
-    let mut res = BTreeMap::new();
-    let mut ifaces = list_interfaces();
-    while let Some(iface) = ifaces.try_next().await? {
-        if iface_is_physical(&iface).await {
-            let ip_info = IpInfo::for_interface(&iface).await?;
-            res.insert(iface, ip_info);
-        }
-    }
-    Ok(res)
-}
-
-// #[command(subcommands(update))]
-pub fn dhcp<C: Context>() -> ParentHandler<C> {
-    ParentHandler::new().subcommand(
-        "update",
-        from_fn_async::<_, _, (), Error, (RpcContext, UpdateParams)>(update)
-            .no_display()
-            .with_about("Update IP assigned by dhcp")
-            .with_call_remote::<CliContext>(),
-    )
-}
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[serde(rename_all = "camelCase")]
-#[command(rename_all = "kebab-case")]
-pub struct UpdateParams {
-    interface: String,
-}
-
-pub async fn update(
-    ctx: RpcContext,
-    UpdateParams { interface }: UpdateParams,
-) -> Result<(), Error> {
-    if iface_is_physical(&interface).await {
-        let ip_info = IpInfo::for_interface(&interface).await?;
-        ctx.db
-            .mutate(|db| {
-                db.as_public_mut()
-                    .as_server_info_mut()
-                    .as_ip_info_mut()
-                    .insert(&interface, &ip_info)
-            })
-            .await?;
-
-        let mut cached = CACHED_IPS.write().await;
-        if cached.is_empty() {
-            *cached = _ips().await?;
-        } else {
-            cached.extend(
-                std::iter::empty()
-                    .chain(ip_info.ipv4.map(IpAddr::from))
-                    .chain(ip_info.ipv6.map(IpAddr::from)),
-            );
-        }
-    }
-    Ok(())
-}
diff --git a/core/startos/src/net/forward.rs b/core/startos/src/net/forward.rs
index e954bc36a..ba62945a0 100644
--- a/core/startos/src/net/forward.rs
+++ b/core/startos/src/net/forward.rs
@@ -1,12 +1,16 @@
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 use std::net::SocketAddr;
 use std::sync::{Arc, Weak};
 
+use futures::channel::oneshot;
+use helpers::NonDetachingJoinHandle;
 use id_pool::IdPool;
+use imbl_value::InternedString;
 use serde::{Deserialize, Serialize};
 use tokio::process::Command;
-use tokio::sync::Mutex;
+use tokio::sync::{mpsc, watch};
 
+use crate::db::model::public::NetworkInterfaceInfo;
 use crate::prelude::*;
 use crate::util::Invoke;
 
@@ -34,144 +38,269 @@ impl AvailablePorts {
     }
 }
 
+#[derive(Debug)]
+struct ForwardRequest {
+    public: bool,
+    target: SocketAddr,
+    rc: Weak<()>,
+}
+
+#[derive(Debug, Default)]
+struct ForwardState {
+    requested: BTreeMap<u16, ForwardRequest>,
+    current: BTreeMap<u16, BTreeMap<InternedString, SocketAddr>>,
+}
+impl ForwardState {
+    async fn sync(&mut self, interfaces: &BTreeMap<InternedString, bool>) -> Result<(), Error> {
+        let private_interfaces = interfaces
+            .iter()
+            .filter(|(_, public)| !*public)
+            .map(|(i, _)| i)
+            .collect::<BTreeSet<_>>();
+        let all_interfaces = interfaces.keys().collect::<BTreeSet<_>>();
+        self.requested.retain(|_, req| req.rc.strong_count() > 0);
+        for external in self
+            .requested
+            .keys()
+            .chain(self.current.keys())
+            .copied()
+            .collect::<BTreeSet<_>>()
+        {
+            match (
+                self.requested.get(&external),
+                self.current.get_mut(&external),
+            ) {
+                (Some(req), Some(cur)) => {
+                    let expected = if req.public {
+                        &all_interfaces
+                    } else {
+                        &private_interfaces
+                    };
+                    let actual = cur.keys().collect::<BTreeSet<_>>();
+                    let mut to_rm = actual
+                        .difference(expected)
+                        .copied()
+                        .cloned()
+                        .collect::<BTreeSet<_>>();
+                    let mut to_add = expected
+                        .difference(&actual)
+                        .copied()
+                        .cloned()
+                        .collect::<BTreeSet<_>>();
+                    for interface in actual.intersection(expected).copied() {
+                        if cur[interface] != req.target {
+                            to_rm.insert(interface.clone());
+                            to_add.insert(interface.clone());
+                        }
+                    }
+                    for interface in to_rm {
+                        unforward(external, &*interface, cur[&interface]).await?;
+                        cur.remove(&interface);
+                    }
+                    for interface in to_add {
+                        forward(external, &*interface, req.target).await?;
+                        cur.insert(interface, req.target);
+                    }
+                }
+                (Some(req), None) => {
+                    let cur = self.current.entry(external).or_default();
+                    for interface in if req.public {
+                        &all_interfaces
+                    } else {
+                        &private_interfaces
+                    }
+                    .into_iter()
+                    .copied()
+                    .cloned()
+                    {
+                        forward(external, &*interface, req.target).await?;
+                        cur.insert(interface, req.target);
+                    }
+                }
+                (None, Some(cur)) => {
+                    let to_rm = cur.keys().cloned().collect::<BTreeSet<_>>();
+                    for interface in to_rm {
+                        unforward(external, &*interface, cur[&interface]).await?;
+                        cur.remove(&interface);
+                    }
+                    self.current.remove(&external);
+                }
+                _ => (),
+            }
+        }
+        Ok(())
+    }
+}
+
+fn err_has_exited<T>(_: T) -> Error {
+    Error::new(
+        eyre!("PortForwardController thread has exited"),
+        ErrorKind::Unknown,
+    )
+}
+
 pub struct LanPortForwardController {
-    forwards: Mutex<BTreeMap<u16, BTreeMap<SocketAddr, Weak<()>>>>,
+    req: mpsc::UnboundedSender<(
+        Option<(u16, ForwardRequest)>,
+        oneshot::Sender<Result<(), Error>>,
+    )>,
+    _thread: NonDetachingJoinHandle<()>,
 }
 impl LanPortForwardController {
-    pub fn new() -> Self {
+    pub fn new(
+        mut net_iface: watch::Receiver<BTreeMap<InternedString, NetworkInterfaceInfo>>,
+    ) -> Self {
+        let (req_send, mut req_recv) = mpsc::unbounded_channel();
+        let thread = NonDetachingJoinHandle::from(tokio::spawn(async move {
+            let mut state = ForwardState::default();
+            let mut interfaces = net_iface
+                .borrow_and_update()
+                .iter()
+                .map(|(iface, info)| (iface.clone(), info.public()))
+                .collect();
+            let mut reply: Option<oneshot::Sender<Result<(), Error>>> = None;
+            loop {
+                tokio::select! {
+                    msg = req_recv.recv() => {
+                        if let Some((msg, re)) = msg {
+                            if let Some((external, req)) = msg {
+                                state.requested.insert(external, req);
+                            }
+                            reply = Some(re);
+                        } else {
+                            break;
+                        }
+                    }
+                    _ = net_iface.changed() => {
+                        interfaces = net_iface
+                            .borrow()
+                            .iter()
+                            .map(|(iface, info)| (iface.clone(), info.public()))
+                            .collect();
+                    }
+                }
+                let res = state.sync(&interfaces).await;
+                if let Err(e) = &res {
+                    tracing::error!("Error in PortForwardController: {e}");
+                    tracing::debug!("{e:?}");
+                }
+                if let Some(re) = reply.take() {
+                    let _ = re.send(res);
+                }
+            }
+        }));
         Self {
-            forwards: Mutex::new(BTreeMap::new()),
+            req: req_send,
+            _thread: thread,
         }
     }
-    pub async fn add(&self, port: u16, addr: SocketAddr) -> Result<Arc<()>, Error> {
-        let mut writable = self.forwards.lock().await;
-        let (prev, mut forward) = if let Some(forward) = writable.remove(&port) {
-            (
-                forward.keys().next().cloned(),
-                forward
-                    .into_iter()
-                    .filter(|(_, rc)| rc.strong_count() > 0)
-                    .collect(),
-            )
-        } else {
-            (None, BTreeMap::new())
-        };
+    pub async fn add(&self, port: u16, public: bool, target: SocketAddr) -> Result<Arc<()>, Error> {
         let rc = Arc::new(());
-        forward.insert(addr, Arc::downgrade(&rc));
-        let next = forward.keys().next().cloned();
-        if !forward.is_empty() {
-            writable.insert(port, forward);
-        }
-
-        update_forward(port, prev, next).await?;
-        Ok(rc)
-    }
-    pub async fn gc(&self, external: u16) -> Result<(), Error> {
-        let mut writable = self.forwards.lock().await;
-        let (prev, forward) = if let Some(forward) = writable.remove(&external) {
-            (
-                forward.keys().next().cloned(),
-                forward
-                    .into_iter()
-                    .filter(|(_, rc)| rc.strong_count() > 0)
-                    .collect(),
-            )
-        } else {
-            (None, BTreeMap::new())
-        };
-        let next = forward.keys().next().cloned();
-        if !forward.is_empty() {
-            writable.insert(external, forward);
-        }
+        let (send, recv) = oneshot::channel();
+        self.req
+            .send((
+                Some((
+                    port,
+                    ForwardRequest {
+                        public,
+                        target,
+                        rc: Arc::downgrade(&rc),
+                    },
+                )),
+                send,
+            ))
+            .map_err(err_has_exited)?;
 
-        update_forward(external, prev, next).await
+        recv.await.map_err(err_has_exited)?.map(|_| rc)
     }
-}
+    pub async fn gc(&self) -> Result<(), Error> {
+        let (send, recv) = oneshot::channel();
+        self.req.send((None, send)).map_err(err_has_exited)?;
 
-async fn update_forward(
-    external: u16,
-    prev: Option<SocketAddr>,
-    next: Option<SocketAddr>,
-) -> Result<(), Error> {
-    if prev != next {
-        if let Some(prev) = prev {
-            unforward(START9_BRIDGE_IFACE, external, prev).await?;
-        }
-        if let Some(next) = next {
-            forward(START9_BRIDGE_IFACE, external, next).await?;
-        }
+        recv.await.map_err(err_has_exited)?
     }
-    Ok(())
 }
 
 // iptables -I FORWARD -o br-start9 -p tcp -d 172.18.0.2 --dport 8333 -j ACCEPT
 // iptables -t nat -I PREROUTING -p tcp --dport 32768 -j DNAT --to 172.18.0.2:8333
-async fn forward(iface: &str, external: u16, addr: SocketAddr) -> Result<(), Error> {
-    Command::new("iptables")
-        .arg("-I")
-        .arg("FORWARD")
-        .arg("-o")
-        .arg(iface)
-        .arg("-p")
-        .arg("tcp")
-        .arg("-d")
-        .arg(addr.ip().to_string())
-        .arg("--dport")
-        .arg(addr.port().to_string())
-        .arg("-j")
-        .arg("ACCEPT")
-        .invoke(crate::ErrorKind::Network)
-        .await?;
-    Command::new("iptables")
-        .arg("-t")
-        .arg("nat")
-        .arg("-I")
-        .arg("PREROUTING")
-        .arg("-p")
-        .arg("tcp")
-        .arg("--dport")
-        .arg(external.to_string())
-        .arg("-j")
-        .arg("DNAT")
-        .arg("--to")
-        .arg(addr.to_string())
-        .invoke(crate::ErrorKind::Network)
-        .await?;
+async fn forward(external: u16, interface: &str, target: SocketAddr) -> Result<(), Error> {
+    for proto in ["tcp", "udp"] {
+        Command::new("iptables")
+            .arg("-I")
+            .arg("FORWARD")
+            .arg("-i")
+            .arg(interface)
+            .arg("-o")
+            .arg(START9_BRIDGE_IFACE)
+            .arg("-p")
+            .arg(proto)
+            .arg("-d")
+            .arg(target.ip().to_string())
+            .arg("--dport")
+            .arg(target.port().to_string())
+            .arg("-j")
+            .arg("ACCEPT")
+            .invoke(crate::ErrorKind::Network)
+            .await?;
+        Command::new("iptables")
+            .arg("-t")
+            .arg("nat")
+            .arg("-I")
+            .arg("PREROUTING")
+            .arg("-i")
+            .arg(interface)
+            .arg("-p")
+            .arg(proto)
+            .arg("--dport")
+            .arg(external.to_string())
+            .arg("-j")
+            .arg("DNAT")
+            .arg("--to")
+            .arg(target.to_string())
+            .invoke(crate::ErrorKind::Network)
+            .await?;
+    }
     Ok(())
 }
 
 // iptables -D FORWARD -o br-start9 -p tcp -d 172.18.0.2 --dport 8333 -j ACCEPT
 // iptables -t nat -D PREROUTING -p tcp --dport 32768 -j DNAT --to 172.18.0.2:8333
-async fn unforward(iface: &str, external: u16, addr: SocketAddr) -> Result<(), Error> {
-    Command::new("iptables")
-        .arg("-D")
-        .arg("FORWARD")
-        .arg("-o")
-        .arg(iface)
-        .arg("-p")
-        .arg("tcp")
-        .arg("-d")
-        .arg(addr.ip().to_string())
-        .arg("--dport")
-        .arg(addr.port().to_string())
-        .arg("-j")
-        .arg("ACCEPT")
-        .invoke(crate::ErrorKind::Network)
-        .await?;
-    Command::new("iptables")
-        .arg("-t")
-        .arg("nat")
-        .arg("-D")
-        .arg("PREROUTING")
-        .arg("-p")
-        .arg("tcp")
-        .arg("--dport")
-        .arg(external.to_string())
-        .arg("-j")
-        .arg("DNAT")
-        .arg("--to")
-        .arg(addr.to_string())
-        .invoke(crate::ErrorKind::Network)
-        .await?;
+async fn unforward(external: u16, interface: &str, target: SocketAddr) -> Result<(), Error> {
+    for proto in ["tcp", "udp"] {
+        Command::new("iptables")
+            .arg("-D")
+            .arg("FORWARD")
+            .arg("-i")
+            .arg(interface)
+            .arg("-o")
+            .arg(START9_BRIDGE_IFACE)
+            .arg("-p")
+            .arg(proto)
+            .arg("-d")
+            .arg(target.ip().to_string())
+            .arg("--dport")
+            .arg(target.port().to_string())
+            .arg("-j")
+            .arg("ACCEPT")
+            .invoke(crate::ErrorKind::Network)
+            .await?;
+        Command::new("iptables")
+            .arg("-t")
+            .arg("nat")
+            .arg("-D")
+            .arg("PREROUTING")
+            .arg("-i")
+            .arg(interface)
+            .arg("-p")
+            .arg(proto)
+            .arg("--dport")
+            .arg(external.to_string())
+            .arg("-j")
+            .arg("DNAT")
+            .arg("--to")
+            .arg(target.to_string())
+            .invoke(crate::ErrorKind::Network)
+            .await?;
+    }
     Ok(())
 }
diff --git a/core/startos/src/net/host/address.rs b/core/startos/src/net/host/address.rs
index 05942ffa9..3d639b31e 100644
--- a/core/startos/src/net/host/address.rs
+++ b/core/startos/src/net/host/address.rs
@@ -1,57 +1,298 @@
-use std::fmt;
-use std::str::FromStr;
-
-use clap::builder::ValueParserFactory;
+use clap::Parser;
 use imbl_value::InternedString;
-use models::FromStrParser;
+use models::{HostId, PackageId};
+use rpc_toolkit::{from_fn_async, Context, Empty, HandlerArgs, HandlerExt, ParentHandler};
 use serde::{Deserialize, Serialize};
 use torut::onion::OnionAddressV3;
 use ts_rs::TS;
 
+use crate::context::{CliContext, RpcContext};
+use crate::net::acme::AcmeProvider;
 use crate::prelude::*;
+use crate::util::serde::{display_serializable, HandlerExtSerde};
 
-#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord, TS)]
-#[serde(rename_all = "camelCase")]
-#[serde(tag = "kind")]
-#[ts(export)]
+#[derive(Clone, Debug, Deserialize, Serialize)]
 pub enum HostAddress {
     Onion {
-        #[ts(type = "string")]
         address: OnionAddressV3,
     },
     Domain {
-        #[ts(type = "string")]
         address: InternedString,
+        public: bool,
+        acme: Option<AcmeProvider>,
     },
 }
 
-impl FromStr for HostAddress {
-    type Err = Error;
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        if let Some(addr) = s.strip_suffix(".onion") {
-            Ok(HostAddress::Onion {
-                address: addr
-                    .parse::<OnionAddressV3>()
-                    .with_kind(ErrorKind::ParseUrl)?,
-            })
-        } else {
-            Ok(HostAddress::Domain { address: s.into() })
-        }
-    }
-}
-
-impl fmt::Display for HostAddress {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Onion { address } => write!(f, "{address}"),
-            Self::Domain { address } => write!(f, "{address}"),
-        }
-    }
-}
-
-impl ValueParserFactory for HostAddress {
-    type Parser = FromStrParser<Self>;
-    fn value_parser() -> Self::Parser {
-        Self::Parser::new()
-    }
+#[derive(Debug, Deserialize, Serialize, TS)]
+pub struct DomainConfig {
+    pub public: bool,
+    pub acme: Option<AcmeProvider>,
+}
+
+#[derive(Deserialize, Serialize, Parser)]
+pub struct AddressApiParams {
+    host: HostId,
+}
+
+pub fn address<C: Context>() -> ParentHandler<C, AddressApiParams, PackageId> {
+    ParentHandler::<C, AddressApiParams, PackageId>::new()
+        .subcommand(
+            "domain",
+            ParentHandler::<C, Empty, (PackageId, HostId)>::new()
+                .subcommand(
+                    "add",
+                    from_fn_async(add_domain)
+                        .with_inherited(|_, a| a)
+                        .no_display()
+                        .with_about("Add an address to this host")
+                        .with_call_remote::<CliContext>(),
+                )
+                .subcommand(
+                    "remove",
+                    from_fn_async(remove_domain)
+                        .with_inherited(|_, a| a)
+                        .no_display()
+                        .with_about("Remove an address from this host")
+                        .with_call_remote::<CliContext>(),
+                )
+                .with_inherited(|AddressApiParams { host }, package| (package, host)),
+        )
+        .subcommand(
+            "onion",
+            ParentHandler::<C, Empty, (PackageId, HostId)>::new()
+                .subcommand(
+                    "add",
+                    from_fn_async(add_onion)
+                        .with_inherited(|_, a| a)
+                        .no_display()
+                        .with_about("Add an address to this host")
+                        .with_call_remote::<CliContext>(),
+                )
+                .subcommand(
+                    "remove",
+                    from_fn_async(remove_onion)
+                        .with_inherited(|_, a| a)
+                        .no_display()
+                        .with_about("Remove an address from this host")
+                        .with_call_remote::<CliContext>(),
+                )
+                .with_inherited(|AddressApiParams { host }, package| (package, host)),
+        )
+        .subcommand(
+            "list",
+            from_fn_async(list_addresses)
+                .with_inherited(|AddressApiParams { host }, package| (package, host))
+                .with_display_serializable()
+                .with_custom_display_fn(|HandlerArgs { params, .. }, res| {
+                    use prettytable::*;
+
+                    if let Some(format) = params.format {
+                        display_serializable(format, res);
+                        return Ok(());
+                    }
+
+                    let mut table = Table::new();
+                    table.add_row(row![bc => "ADDRESS", "PUBLIC", "ACME PROVIDER"]);
+                    for address in &res {
+                        match address {
+                            HostAddress::Onion { address } => {
+                                table.add_row(row![address, true, "N/A"]);
+                            }
+                            HostAddress::Domain {
+                                address,
+                                public,
+                                acme,
+                            } => {
+                                table.add_row(row![
+                                    address,
+                                    *public,
+                                    acme.as_ref().map(|a| a.0.as_str()).unwrap_or("NONE")
+                                ]);
+                            }
+                        }
+                    }
+
+                    table.print_tty(false)?;
+
+                    Ok(())
+                })
+                .with_about("List addresses for this host")
+                .with_call_remote::<CliContext>(),
+        )
+}
+
+#[derive(Deserialize, Serialize, Parser)]
+pub struct AddDomainParams {
+    pub domain: InternedString,
+    #[arg(long)]
+    pub private: bool,
+    #[arg(long)]
+    pub acme: Option<AcmeProvider>,
+}
+
+pub async fn add_domain(
+    ctx: RpcContext,
+    AddDomainParams {
+        domain,
+        private,
+        acme,
+    }: AddDomainParams,
+    (package, host): (PackageId, HostId),
+) -> Result<(), Error> {
+    ctx.db
+        .mutate(|db| {
+            if let Some(acme) = &acme {
+                if !db.as_public().as_server_info().as_acme().contains_key(&acme)? {
+                    return Err(Error::new(eyre!("unknown acme provider {}, please run acme.init for this provider first", acme.0), ErrorKind::InvalidRequest));
+                }
+            }
+
+            db.as_public_mut()
+                .as_package_data_mut()
+                .as_idx_mut(&package)
+                .or_not_found(&package)?
+                .as_hosts_mut()
+                .as_idx_mut(&host)
+                .or_not_found(&host)?
+                .as_domains_mut()
+                .insert(
+                    &domain,
+                    &DomainConfig {
+                        public: !private,
+                        acme,
+                    },
+                )
+        })
+        .await?;
+    let service = ctx.services.get(&package).await;
+    let service_ref = service.as_ref().or_not_found(&package)?;
+    service_ref.update_host(host).await?;
+
+    Ok(())
+}
+
+#[derive(Deserialize, Serialize, Parser)]
+pub struct RemoveDomainParams {
+    pub domain: InternedString,
+}
+
+pub async fn remove_domain(
+    ctx: RpcContext,
+    RemoveDomainParams { domain }: RemoveDomainParams,
+    (package, host): (PackageId, HostId),
+) -> Result<(), Error> {
+    ctx.db
+        .mutate(|db| {
+            db.as_public_mut()
+                .as_package_data_mut()
+                .as_idx_mut(&package)
+                .or_not_found(&package)?
+                .as_hosts_mut()
+                .as_idx_mut(&host)
+                .or_not_found(&host)?
+                .as_domains_mut()
+                .remove(&domain)
+        })
+        .await?;
+    let service = ctx.services.get(&package).await;
+    let service_ref = service.as_ref().or_not_found(&package)?;
+    service_ref.update_host(host).await?;
+
+    Ok(())
+}
+
+#[derive(Deserialize, Serialize, Parser)]
+pub struct OnionParams {
+    pub onion: String,
+}
+
+pub async fn add_onion(
+    ctx: RpcContext,
+    OnionParams { onion }: OnionParams,
+    (package, host): (PackageId, HostId),
+) -> Result<(), Error> {
+    let onion = onion
+        .strip_suffix(".onion")
+        .ok_or_else(|| {
+            Error::new(
+                eyre!("onion hostname must end in .onion"),
+                ErrorKind::InvalidOnionAddress,
+            )
+        })?
+        .parse::<OnionAddressV3>()?;
+    ctx.db
+        .mutate(|db| {
+            db.as_private().as_key_store().as_onion().get_key(&onion)?;
+
+            db.as_public_mut()
+                .as_package_data_mut()
+                .as_idx_mut(&package)
+                .or_not_found(&package)?
+                .as_hosts_mut()
+                .as_idx_mut(&host)
+                .or_not_found(&host)?
+                .as_onions_mut()
+                .mutate(|a| Ok(a.insert(onion)))
+        })
+        .await?;
+    let service = ctx.services.get(&package).await;
+    let service_ref = service.as_ref().or_not_found(&package)?;
+    service_ref.update_host(host).await?;
+
+    Ok(())
+}
+
+pub async fn remove_onion(
+    ctx: RpcContext,
+    OnionParams { onion }: OnionParams,
+    (package, host): (PackageId, HostId),
+) -> Result<(), Error> {
+    let onion = onion
+        .strip_suffix(".onion")
+        .ok_or_else(|| {
+            Error::new(
+                eyre!("onion hostname must end in .onion"),
+                ErrorKind::InvalidOnionAddress,
+            )
+        })?
+        .parse::<OnionAddressV3>()?;
+    ctx.db
+        .mutate(|db| {
+            db.as_public_mut()
+                .as_package_data_mut()
+                .as_idx_mut(&package)
+                .or_not_found(&package)?
+                .as_hosts_mut()
+                .as_idx_mut(&host)
+                .or_not_found(&host)?
+                .as_onions_mut()
+                .mutate(|a| Ok(a.remove(&onion)))
+        })
+        .await?;
+    let service = ctx.services.get(&package).await;
+    let service_ref = service.as_ref().or_not_found(&package)?;
+    service_ref.update_host(host).await?;
+
+    Ok(())
+}
+
+pub async fn list_addresses(
+    ctx: RpcContext,
+    _: Empty,
+    (package, host): (PackageId, HostId),
+) -> Result<Vec<HostAddress>, Error> {
+    Ok(ctx
+        .db
+        .peek()
+        .await
+        .into_public()
+        .into_package_data()
+        .into_idx(&package)
+        .or_not_found(&package)?
+        .into_hosts()
+        .into_idx(&host)
+        .or_not_found(&host)?
+        .de()?
+        .addresses()
+        .collect())
 }
diff --git a/core/startos/src/net/host/binding.rs b/core/startos/src/net/host/binding.rs
index 174f0330f..d56f607a9 100644
--- a/core/startos/src/net/host/binding.rs
+++ b/core/startos/src/net/host/binding.rs
@@ -1,13 +1,18 @@
+use std::collections::BTreeMap;
 use std::str::FromStr;
 
 use clap::builder::ValueParserFactory;
-use models::{FromStrParser, HostId};
+use clap::Parser;
+use models::{FromStrParser, HostId, PackageId};
+use rpc_toolkit::{from_fn_async, Context, Empty, HandlerArgs, HandlerExt, ParentHandler};
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
 
+use crate::context::{CliContext, RpcContext};
 use crate::net::forward::AvailablePorts;
 use crate::net::vhost::AlpnInfo;
 use crate::prelude::*;
+use crate::util::serde::{display_serializable, HandlerExtSerde};
 
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize, TS)]
 #[ts(export)]
@@ -41,12 +46,14 @@ impl FromStr for BindId {
 pub struct BindInfo {
     pub enabled: bool,
     pub options: BindOptions,
-    pub lan: LanInfo,
+    pub net: NetInfo,
 }
+
 #[derive(Clone, Copy, Debug, Deserialize, Serialize, TS, PartialEq, Eq, PartialOrd, Ord)]
 #[serde(rename_all = "camelCase")]
 #[ts(export)]
-pub struct LanInfo {
+pub struct NetInfo {
+    pub public: bool,
     pub assigned_port: Option<u16>,
     pub assigned_ssl_port: Option<u16>,
 }
@@ -63,7 +70,8 @@ impl BindInfo {
         Ok(Self {
             enabled: true,
             options,
-            lan: LanInfo {
+            net: NetInfo {
+                public: false,
                 assigned_port,
                 assigned_ssl_port,
             },
@@ -74,7 +82,7 @@ impl BindInfo {
         available_ports: &mut AvailablePorts,
         options: BindOptions,
     ) -> Result<Self, Error> {
-        let Self { mut lan, .. } = self;
+        let Self { net: mut lan, .. } = self;
         if options
             .secure
             .map_or(false, |s| !(s.ssl && options.add_ssl.is_some()))
@@ -104,7 +112,7 @@ impl BindInfo {
         Ok(Self {
             enabled: true,
             options,
-            lan,
+            net: lan,
         })
     }
     pub fn disable(&mut self) {
@@ -137,3 +145,122 @@ pub struct AddSslOptions {
     // pub add_x_forwarded_headers: bool, // TODO
     pub alpn: Option<AlpnInfo>,
 }
+
+#[derive(Deserialize, Serialize, Parser)]
+pub struct BindingApiParams {
+    host: HostId,
+}
+
+pub fn binding<C: Context>() -> ParentHandler<C, BindingApiParams, PackageId> {
+    ParentHandler::<C, BindingApiParams, PackageId>::new()
+        .subcommand(
+            "list",
+            from_fn_async(list_bindings)
+                .with_inherited(|BindingApiParams { host }, package| (package, host))
+                .with_display_serializable()
+                .with_custom_display_fn(|HandlerArgs { params, .. }, res| {
+                    use prettytable::*;
+
+                    if let Some(format) = params.format {
+                        return Ok(display_serializable(format, res));
+                    }
+
+                    let mut table = Table::new();
+                    table.add_row(row![bc => "INTERNAL PORT", "ENABLED", "PUBLIC", "EXTERNAL PORT", "EXTERNAL SSL PORT"]);
+                    for (internal, info) in res {
+                        table.add_row(row![
+                            internal,
+                            info.enabled,
+                            info.net.public,
+                            if let Some(port) = info.net.assigned_port {
+                                port.to_string()
+                            } else {
+                                "N/A".to_owned()
+                            },
+                            if let Some(port) = info.net.assigned_ssl_port {
+                                port.to_string()
+                            } else {
+                                "N/A".to_owned()
+                            },
+                        ]);
+                    }
+
+                    table.print_tty(false).unwrap();
+
+                    Ok(())
+                })
+                .with_about("List bindinges for this host")
+                .with_call_remote::<CliContext>(),
+        )
+        .subcommand(
+            "set-public",
+            from_fn_async(set_public)
+                .with_inherited(|BindingApiParams { host }, package| (package, host))
+                .no_display()
+                .with_about("Add an binding to this host")
+                .with_call_remote::<CliContext>(),
+        )
+}
+
+pub async fn list_bindings(
+    ctx: RpcContext,
+    _: Empty,
+    (package, host): (PackageId, HostId),
+) -> Result<BTreeMap<u16, BindInfo>, Error> {
+    ctx.db
+        .peek()
+        .await
+        .into_public()
+        .into_package_data()
+        .into_idx(&package)
+        .or_not_found(&package)?
+        .into_hosts()
+        .into_idx(&host)
+        .or_not_found(&host)?
+        .into_bindings()
+        .de()
+}
+
+#[derive(Deserialize, Serialize, Parser)]
+#[serde(rename_all = "camelCase")]
+pub struct SetPublicParams {
+    internal_port: u16,
+    #[arg(long)]
+    public: Option<bool>,
+}
+
+pub async fn set_public(
+    ctx: RpcContext,
+    SetPublicParams {
+        internal_port,
+        public,
+    }: SetPublicParams,
+    (package, host): (PackageId, HostId),
+) -> Result<(), Error> {
+    ctx.db
+        .mutate(|db| {
+            db.as_public_mut()
+                .as_package_data_mut()
+                .as_idx_mut(&package)
+                .or_not_found(&package)?
+                .as_hosts_mut()
+                .as_idx_mut(&host)
+                .or_not_found(&host)?
+                .as_bindings_mut()
+                .mutate(|b| {
+                    b.get_mut(&internal_port)
+                        .or_not_found(internal_port)?
+                        .net
+                        .public = public.unwrap_or(true);
+                    Ok(())
+                })
+        })
+        .await?;
+    ctx.services
+        .get(&package)
+        .await
+        .as_ref()
+        .or_not_found(&package)?
+        .update_host(host)
+        .await
+}
diff --git a/core/startos/src/net/host/mod.rs b/core/startos/src/net/host/mod.rs
index be5db0f2d..9f4194866 100644
--- a/core/startos/src/net/host/mod.rs
+++ b/core/startos/src/net/host/mod.rs
@@ -5,13 +5,14 @@ use imbl_value::InternedString;
 use models::{HostId, PackageId};
 use rpc_toolkit::{from_fn_async, Context, Empty, HandlerExt, ParentHandler};
 use serde::{Deserialize, Serialize};
+use torut::onion::OnionAddressV3;
 use ts_rs::TS;
 
-use crate::context::{CliContext, RpcContext};
+use crate::context::RpcContext;
 use crate::db::model::DatabaseModel;
 use crate::net::forward::AvailablePorts;
-use crate::net::host::address::HostAddress;
-use crate::net::host::binding::{BindInfo, BindOptions};
+use crate::net::host::address::{address, DomainConfig, HostAddress};
+use crate::net::host::binding::{binding, BindInfo, BindOptions};
 use crate::net::service_interface::HostnameInfo;
 use crate::prelude::*;
 
@@ -25,7 +26,10 @@ pub mod binding;
 pub struct Host {
     pub kind: HostKind,
     pub bindings: BTreeMap<u16, BindInfo>,
-    pub addresses: BTreeSet<HostAddress>,
+    #[ts(type = "string[]")]
+    pub onions: BTreeSet<OnionAddressV3>,
+    #[ts(as = "BTreeMap::<String, DomainConfig>")]
+    pub domains: BTreeMap<InternedString, DomainConfig>,
     /// COMPUTED: NetService::update
     pub hostname_info: BTreeMap<u16, Vec<HostnameInfo>>, // internal port -> Hostnames
 }
@@ -39,13 +43,27 @@ impl Host {
         Self {
             kind,
             bindings: BTreeMap::new(),
-            addresses: BTreeSet::new(),
+            onions: BTreeSet::new(),
+            domains: BTreeMap::new(),
             hostname_info: BTreeMap::new(),
         }
     }
-    pub fn addresses(&self) -> impl Iterator<Item = &HostAddress> {
-        // TODO: handle primary
-        self.addresses.iter()
+    pub fn addresses<'a>(&'a self) -> impl Iterator<Item = HostAddress> + 'a {
+        self.onions
+            .iter()
+            .cloned()
+            .map(|address| HostAddress::Onion { address })
+            .chain(
+                self.domains
+                    .iter()
+                    .map(
+                        |(address, DomainConfig { public, acme })| HostAddress::Domain {
+                            address: address.clone(),
+                            public: *public,
+                            acme: acme.clone(),
+                        },
+                    ),
+            )
     }
 }
 
@@ -104,12 +122,12 @@ pub fn host_for<'a>(
     };
     host_info(db, package_id)?.upsert(host_id, || {
         let mut h = Host::new(host_kind);
-        h.addresses.insert(HostAddress::Onion {
-            address: tor_key
+        h.onions.insert(
+            tor_key
                 .or_not_found("generated tor key")?
                 .public()
                 .get_onion_address(),
-        });
+        );
         Ok(h)
     })
 }
@@ -161,6 +179,10 @@ pub fn host<C: Context>() -> ParentHandler<C, HostParams> {
             "address",
             address::<C>().with_inherited(|HostParams { package }, _| package),
         )
+        .subcommand(
+            "binding",
+            binding::<C>().with_inherited(|HostParams { package }, _| package),
+        )
 }
 
 pub async fn list_hosts(
@@ -178,122 +200,3 @@ pub async fn list_hosts(
         .into_hosts()
         .keys()
 }
-
-#[derive(Deserialize, Serialize, Parser)]
-pub struct AddressApiParams {
-    host: HostId,
-}
-
-pub fn address<C: Context>() -> ParentHandler<C, AddressApiParams, PackageId> {
-    ParentHandler::<C, AddressApiParams, PackageId>::new()
-        .subcommand(
-            "add",
-            from_fn_async(add_address)
-                .with_inherited(|AddressApiParams { host }, package| (package, host))
-                .no_display()
-                .with_about("Add an address to this host")
-                .with_call_remote::<CliContext>(),
-        )
-        .subcommand(
-            "remove",
-            from_fn_async(remove_address)
-                .with_inherited(|AddressApiParams { host }, package| (package, host))
-                .no_display()
-                .with_about("Remove an address from this host")
-                .with_call_remote::<CliContext>(),
-        )
-        .subcommand(
-            "list",
-            from_fn_async(list_addresses)
-                .with_inherited(|AddressApiParams { host }, package| (package, host))
-                .with_custom_display_fn(|_, res| {
-                    for address in res {
-                        println!("{address}")
-                    }
-                    Ok(())
-                })
-                .with_about("List addresses for this host")
-                .with_call_remote::<CliContext>(),
-        )
-}
-
-#[derive(Deserialize, Serialize, Parser)]
-pub struct AddressParams {
-    pub address: HostAddress,
-}
-
-pub async fn add_address(
-    ctx: RpcContext,
-    AddressParams { address }: AddressParams,
-    (package, host): (PackageId, HostId),
-) -> Result<(), Error> {
-    ctx.db
-        .mutate(|db| {
-            if let HostAddress::Onion { address } = address {
-                db.as_private()
-                    .as_key_store()
-                    .as_onion()
-                    .get_key(&address)?;
-            }
-
-            db.as_public_mut()
-                .as_package_data_mut()
-                .as_idx_mut(&package)
-                .or_not_found(&package)?
-                .as_hosts_mut()
-                .as_idx_mut(&host)
-                .or_not_found(&host)?
-                .as_addresses_mut()
-                .mutate(|a| Ok(a.insert(address)))
-        })
-        .await?;
-    let service = ctx.services.get(&package).await;
-    let service_ref = service.as_ref().or_not_found(&package)?;
-    service_ref.update_host(host).await?;
-
-    Ok(())
-}
-
-pub async fn remove_address(
-    ctx: RpcContext,
-    AddressParams { address }: AddressParams,
-    (package, host): (PackageId, HostId),
-) -> Result<(), Error> {
-    ctx.db
-        .mutate(|db| {
-            db.as_public_mut()
-                .as_package_data_mut()
-                .as_idx_mut(&package)
-                .or_not_found(&package)?
-                .as_hosts_mut()
-                .as_idx_mut(&host)
-                .or_not_found(&host)?
-                .as_addresses_mut()
-                .mutate(|a| Ok(a.remove(&address)))
-        })
-        .await?;
-    let service = ctx.services.get(&package).await;
-    let service_ref = service.as_ref().or_not_found(&package)?;
-    service_ref.update_host(host).await?;
-
-    Ok(())
-}
-
-pub async fn list_addresses(
-    ctx: RpcContext,
-    _: Empty,
-    (package, host): (PackageId, HostId),
-) -> Result<BTreeSet<HostAddress>, Error> {
-    ctx.db
-        .peek()
-        .await
-        .into_public()
-        .into_package_data()
-        .into_idx(&package)
-        .or_not_found(&package)?
-        .into_hosts()
-        .into_idx(&host)
-        .or_not_found(&host)?
-        .into_addresses()
-        .de()
-}
diff --git a/core/startos/src/net/mod.rs b/core/startos/src/net/mod.rs
index 53b94454d..fc0236300 100644
--- a/core/startos/src/net/mod.rs
+++ b/core/startos/src/net/mod.rs
@@ -1,13 +1,13 @@
 use rpc_toolkit::{Context, HandlerExt, ParentHandler};
 
 pub mod acme;
-pub mod dhcp;
 pub mod dns;
 pub mod forward;
 pub mod host;
 pub mod keys;
 pub mod mdns;
 pub mod net_controller;
+pub mod network_interface;
 pub mod service_interface;
 pub mod ssl;
 pub mod static_server;
@@ -25,12 +25,21 @@ pub fn net<C: Context>() -> ParentHandler<C> {
             "tor",
             tor::tor::<C>().with_about("Tor commands such as list-services, logs, and reset"),
         )
-        .subcommand(
-            "dhcp",
-            dhcp::dhcp::<C>().with_about("Command to update IP assigned from dhcp"),
-        )
+        // .subcommand(
+        //     "dhcp",
+        //     network_interface::dhcp::<C>().with_about("Command to update IP assigned from dhcp"),
+        // )
         .subcommand(
             "acme",
             acme::acme::<C>().with_about("Setup automatic clearnet certificate acquisition"),
         )
+        .subcommand(
+            "network-interface",
+            network_interface::network_interface_api::<C>()
+                .with_about("View and edit network interface configurations"),
+        )
+        .subcommand(
+            "vhost",
+            vhost::vhost_api::<C>().with_about("Manage ssl virtual host proxy"),
+        )
 }
diff --git a/core/startos/src/net/net_controller.rs b/core/startos/src/net/net_controller.rs
index a8beaf55f..322e0dedc 100644
--- a/core/startos/src/net/net_controller.rs
+++ b/core/startos/src/net/net_controller.rs
@@ -5,6 +5,7 @@ use std::sync::{Arc, Weak};
 use color_eyre::eyre::eyre;
 use imbl::OrdMap;
 use imbl_value::InternedString;
+use ipnet::IpNet;
 use models::{HostId, OptionExt, PackageId};
 use torut::onion::{OnionAddressV3, TorSecretKeyV3};
 use tracing::instrument;
@@ -15,11 +16,13 @@ use crate::hostname::Hostname;
 use crate::net::dns::DnsController;
 use crate::net::forward::LanPortForwardController;
 use crate::net::host::address::HostAddress;
-use crate::net::host::binding::{AddSslOptions, BindId, BindOptions, LanInfo};
+use crate::net::host::binding::{BindId, BindOptions};
 use crate::net::host::{host_for, Host, HostKind, Hosts};
+use crate::net::network_interface::NetworkInterfaceController;
 use crate::net::service_interface::{HostnameInfo, IpHostname, OnionHostname};
 use crate::net::tor::TorController;
-use crate::net::vhost::{AlpnInfo, VHostController};
+use crate::net::utils::ipv6_is_local;
+use crate::net::vhost::{AlpnInfo, TargetInfo, VHostController};
 use crate::prelude::*;
 use crate::util::serde::MaybeUtf8String;
 use crate::HOST_IP;
@@ -28,6 +31,7 @@ pub struct PreInitNetController {
     pub db: TypedPatchDb<Database>,
     tor: TorController,
     vhost: VHostController,
+    pub net_iface: Arc<NetworkInterfaceController>,
     os_bindings: Vec<Arc<()>>,
     server_hostnames: Vec<Option<InternedString>>,
 }
@@ -40,10 +44,12 @@ impl PreInitNetController {
         hostname: &Hostname,
         os_tor_key: TorSecretKeyV3,
     ) -> Result<Self, Error> {
+        let net_iface = Arc::new(NetworkInterfaceController::new(db.clone()));
         let mut res = Self {
             db: db.clone(),
             tor: TorController::new(tor_control, tor_socks),
-            vhost: VHostController::new(db),
+            vhost: VHostController::new(db, net_iface.clone()),
+            net_iface,
             os_bindings: Vec::new(),
             server_hostnames: Vec::new(),
         };
@@ -56,11 +62,6 @@ impl PreInitNetController {
         hostname: &Hostname,
         tor_key: TorSecretKeyV3,
     ) -> Result<(), Error> {
-        let alpn = Err(AlpnInfo::Specified(vec![
-            MaybeUtf8String("http/1.1".into()),
-            MaybeUtf8String("h2".into()),
-        ]));
-
         self.server_hostnames = vec![
             // LAN IP
             None,
@@ -74,27 +75,29 @@ impl PreInitNetController {
             Some(hostname.local_domain_name()),
         ];
 
+        let vhost_target = TargetInfo {
+            public: false,
+            acme: None,
+            addr: ([127, 0, 0, 1], 80).into(),
+            connect_ssl: Err(AlpnInfo::Specified(vec![
+                MaybeUtf8String("http/1.1".into()),
+                MaybeUtf8String("h2".into()),
+            ])),
+        };
+
         for hostname in self.server_hostnames.iter().cloned() {
-            self.os_bindings.push(
-                self.vhost
-                    .add(hostname, 443, ([127, 0, 0, 1], 80).into(), alpn.clone())
-                    .await?,
-            );
+            self.os_bindings
+                .push(self.vhost.add(hostname, 443, vhost_target.clone())?);
         }
 
         // Tor
-        self.os_bindings.push(
-            self.vhost
-                .add(
-                    Some(InternedString::from_display(
-                        &tor_key.public().get_onion_address(),
-                    )),
-                    443,
-                    ([127, 0, 0, 1], 80).into(),
-                    alpn.clone(),
-                )
-                .await?,
-        );
+        self.os_bindings.push(self.vhost.add(
+            Some(InternedString::from_display(
+                &tor_key.public().get_onion_address(),
+            )),
+            443,
+            vhost_target,
+        )?);
         self.os_bindings.extend(
             self.tor
                 .add(
@@ -115,6 +118,7 @@ pub struct NetController {
     db: TypedPatchDb<Database>,
     pub(super) tor: TorController,
     pub(super) vhost: VHostController,
+    pub(super) net_iface: Arc<NetworkInterfaceController>,
     pub(super) dns: DnsController,
     pub(super) forward: LanPortForwardController,
     pub(super) os_bindings: Vec<Arc<()>>,
@@ -127,6 +131,7 @@ impl NetController {
             db,
             tor,
             vhost,
+            net_iface,
             os_bindings,
             server_hostnames,
         }: PreInitNetController,
@@ -137,7 +142,8 @@ impl NetController {
             tor,
             vhost,
             dns: DnsController::init(dns_bind).await?,
-            forward: LanPortForwardController::new(),
+            forward: LanPortForwardController::new(net_iface.subscribe()),
+            net_iface,
             os_bindings,
             server_hostnames,
         };
@@ -169,15 +175,8 @@ impl NetController {
 
 #[derive(Default, Debug)]
 struct HostBinds {
-    lan: BTreeMap<
-        u16,
-        (
-            LanInfo,
-            Option<AddSslOptions>,
-            BTreeSet<InternedString>,
-            Vec<Arc<()>>,
-        ),
-    >,
+    forwards: BTreeMap<u16, (SocketAddr, bool, Arc<()>)>,
+    vhosts: BTreeMap<(Option<InternedString>, u16), (TargetInfo, Arc<()>)>,
     tor: BTreeMap<OnionAddressV3, (OrdMap<u16, SocketAddr>, Vec<Arc<()>>)>,
 }
 
@@ -206,7 +205,7 @@ impl NetService {
         internal_port: u16,
         options: BindOptions,
     ) -> Result<(), Error> {
-        dbg!("bind", &kind, &id, internal_port, &options);
+        crate::dbg!("bind", &kind, &id, internal_port, &options);
         let pkg_id = &self.id;
         let host = self
             .net_controller()?
@@ -263,134 +262,161 @@ impl NetService {
 
     pub async fn update(&mut self, id: HostId, host: Host) -> Result<(), Error> {
         let ctrl = self.net_controller()?;
-        let mut hostname_info = BTreeMap::new();
+        let mut forwards: BTreeMap<u16, (SocketAddr, bool)> = BTreeMap::new();
+        let mut vhosts: BTreeMap<(Option<InternedString>, u16), TargetInfo> = BTreeMap::new();
+        let mut tor: BTreeMap<OnionAddressV3, (TorSecretKeyV3, OrdMap<u16, SocketAddr>)> =
+            BTreeMap::new();
+        let mut hostname_info: BTreeMap<u16, Vec<HostnameInfo>> = BTreeMap::new();
         let binds = self.binds.entry(id.clone()).or_default();
 
         let peek = ctrl.db.peek().await;
 
         // LAN
         let server_info = peek.as_public().as_server_info();
-        let ip_info = server_info.as_ip_info().de()?;
+        let net_ifaces = server_info.as_network_interfaces().de()?;
         let hostname = server_info.as_hostname().de()?;
         for (port, bind) in &host.bindings {
             if !bind.enabled {
                 continue;
             }
-            let old_lan_bind = binds.lan.remove(port);
-            let lan_bind = old_lan_bind
-                .as_ref()
-                .filter(|(external, ssl, _, _)| {
-                    ssl == &bind.options.add_ssl && bind.lan == *external
-                })
-                .cloned(); // only keep existing binding if relevant details match
-            if bind.lan.assigned_port.is_some() || bind.lan.assigned_ssl_port.is_some() {
-                let new_lan_bind = if let Some(b) = lan_bind {
-                    b
-                } else {
-                    let mut rcs = Vec::with_capacity(2 + host.addresses.len());
-                    let mut hostnames = BTreeSet::new();
-                    if let Some(ssl) = &bind.options.add_ssl {
-                        let external = bind
-                            .lan
-                            .assigned_ssl_port
-                            .or_not_found("assigned ssl port")?;
-                        let target = (self.ip, *port).into();
-                        let connect_ssl = if let Some(alpn) = ssl.alpn.clone() {
-                            Err(alpn)
+            if bind.net.assigned_port.is_some() || bind.net.assigned_ssl_port.is_some() {
+                let mut hostnames = BTreeSet::new();
+                if let Some(ssl) = &bind.options.add_ssl {
+                    let external = bind
+                        .net
+                        .assigned_ssl_port
+                        .or_not_found("assigned ssl port")?;
+                    let addr = (self.ip, *port).into();
+                    let connect_ssl = if let Some(alpn) = ssl.alpn.clone() {
+                        Err(alpn)
+                    } else {
+                        if bind.options.secure.as_ref().map_or(false, |s| s.ssl) {
+                            Ok(())
                         } else {
-                            if bind.options.secure.as_ref().map_or(false, |s| s.ssl) {
-                                Ok(())
-                            } else {
-                                Err(AlpnInfo::Reflect)
-                            }
-                        };
-                        for hostname in ctrl.server_hostnames.iter().cloned() {
-                            rcs.push(
-                                ctrl.vhost
-                                    .add(hostname, external, target, connect_ssl.clone())
-                                    .await?,
-                            );
+                            Err(AlpnInfo::Reflect)
                         }
-                        for address in host.addresses() {
-                            match address {
-                                HostAddress::Onion { address } => {
-                                    let hostname = InternedString::from_display(address);
-                                    if hostnames.insert(hostname.clone()) {
-                                        rcs.push(
-                                            ctrl.vhost
-                                                .add(
-                                                    Some(hostname),
-                                                    external,
-                                                    target,
-                                                    connect_ssl.clone(),
-                                                )
-                                                .await?,
-                                        );
-                                    }
+                    };
+                    for hostname in ctrl.server_hostnames.iter().cloned() {
+                        vhosts.insert(
+                            (hostname, external),
+                            TargetInfo {
+                                public: bind.net.public,
+                                acme: None,
+                                addr,
+                                connect_ssl: connect_ssl.clone(),
+                            },
+                        );
+                    }
+                    for address in host.addresses() {
+                        match address {
+                            HostAddress::Onion { address } => {
+                                let hostname = InternedString::from_display(&address);
+                                if hostnames.insert(hostname.clone()) {
+                                    vhosts.insert(
+                                        (Some(hostname), external),
+                                        TargetInfo {
+                                            public: false,
+                                            acme: None,
+                                            addr,
+                                            connect_ssl: connect_ssl.clone(),
+                                        },
+                                    );
                                 }
-                                HostAddress::Domain { address } => {
-                                    if hostnames.insert(address.clone()) {
-                                        let address = Some(address.clone());
-                                        rcs.push(
-                                            ctrl.vhost
-                                                .add(
-                                                    address.clone(),
-                                                    external,
-                                                    target,
-                                                    connect_ssl.clone(),
-                                                )
-                                                .await?,
-                                        );
-                                        if ssl.preferred_external_port == 443 {
-                                            rcs.push(
-                                                ctrl.vhost
-                                                    .add(
-                                                        address.clone(),
-                                                        5443,
-                                                        target,
-                                                        connect_ssl.clone(),
-                                                    )
-                                                    .await?,
+                            }
+                            HostAddress::Domain {
+                                address,
+                                public,
+                                acme,
+                            } => {
+                                if hostnames.insert(address.clone()) {
+                                    let address = Some(address.clone());
+                                    if ssl.preferred_external_port == 443 {
+                                        if public && bind.net.public {
+                                            vhosts.insert(
+                                                (address.clone(), 5443),
+                                                TargetInfo {
+                                                    public: false,
+                                                    acme: acme.clone(),
+                                                    addr,
+                                                    connect_ssl: connect_ssl.clone(),
+                                                },
                                             );
                                         }
+                                        vhosts.insert(
+                                            (address.clone(), 443),
+                                            TargetInfo {
+                                                public: public && bind.net.public,
+                                                acme,
+                                                addr,
+                                                connect_ssl: connect_ssl.clone(),
+                                            },
+                                        );
+                                    } else {
+                                        vhosts.insert(
+                                            (address.clone(), external),
+                                            TargetInfo {
+                                                public: public && bind.net.public,
+                                                acme,
+                                                addr,
+                                                connect_ssl: connect_ssl.clone(),
+                                            },
+                                        );
                                     }
                                 }
                             }
                         }
                     }
-                    if let Some(security) = bind.options.secure {
-                        if bind.options.add_ssl.is_some() && security.ssl {
-                            // doesn't make sense to have 2 listening ports, both with ssl
-                        } else {
-                            let external =
-                                bind.lan.assigned_port.or_not_found("assigned lan port")?;
-                            rcs.push(ctrl.forward.add(external, (self.ip, *port).into()).await?);
-                        }
+                }
+                if let Some(security) = bind.options.secure {
+                    if bind.options.add_ssl.is_some() && security.ssl {
+                        // doesn't make sense to have 2 listening ports, both with ssl
+                    } else {
+                        let external = bind.net.assigned_port.or_not_found("assigned lan port")?;
+                        forwards.insert(external, ((self.ip, *port).into(), bind.net.public));
                     }
-                    (bind.lan, bind.options.add_ssl.clone(), hostnames, rcs)
-                };
+                }
                 let mut bind_hostname_info: Vec<HostnameInfo> =
                     hostname_info.remove(port).unwrap_or_default();
-                for (interface, ip_info) in &ip_info {
-                    bind_hostname_info.push(HostnameInfo::Ip {
-                        network_interface_id: interface.clone(),
-                        public: false,
-                        hostname: IpHostname::Local {
-                            value: InternedString::from_display(&{
-                                let hostname = &hostname;
-                                lazy_format!("{hostname}.local")
-                            }),
-                            port: new_lan_bind.0.assigned_port,
-                            ssl_port: new_lan_bind.0.assigned_ssl_port,
-                        },
-                    });
+                for (interface, public, ip_info) in
+                    net_ifaces.iter().filter_map(|(interface, info)| {
+                        if let Some(ip_info) = &info.ip_info {
+                            Some((interface, info.public(), ip_info))
+                        } else {
+                            None
+                        }
+                    })
+                {
+                    if !public {
+                        bind_hostname_info.push(HostnameInfo::Ip {
+                            network_interface_id: interface.clone(),
+                            public: false,
+                            hostname: IpHostname::Local {
+                                value: InternedString::from_display(&{
+                                    let hostname = &hostname;
+                                    lazy_format!("{hostname}.local")
+                                }),
+                                port: bind.net.assigned_port,
+                                ssl_port: bind.net.assigned_ssl_port,
+                            },
+                        });
+                    }
                     for address in host.addresses() {
-                        if let HostAddress::Domain { address } = address {
-                            if let Some(ssl) = &new_lan_bind.1 {
-                                if ssl.preferred_external_port == 443 {
+                        if let HostAddress::Domain {
+                            address,
+                            public: domain_public,
+                            ..
+                        } = address
+                        {
+                            if !public || (domain_public && bind.net.public) {
+                                if bind
+                                    .options
+                                    .add_ssl
+                                    .as_ref()
+                                    .map_or(false, |ssl| ssl.preferred_external_port == 443)
+                                {
                                     bind_hostname_info.push(HostnameInfo::Ip {
                                         network_interface_id: interface.clone(),
-                                        public: false,
+                                        public: public && domain_public && bind.net.public, // TODO: check if port forward is active
                                         hostname: IpHostname::Domain {
                                             domain: address.clone(),
                                             subdomain: None,
@@ -398,71 +424,65 @@ impl NetService {
                                             ssl_port: Some(443),
                                         },
                                     });
+                                } else {
+                                    bind_hostname_info.push(HostnameInfo::Ip {
+                                        network_interface_id: interface.clone(),
+                                        public,
+                                        hostname: IpHostname::Domain {
+                                            domain: address.clone(),
+                                            subdomain: None,
+                                            port: bind.net.assigned_port,
+                                            ssl_port: bind.net.assigned_ssl_port,
+                                        },
+                                    });
                                 }
                             }
                         }
                     }
-                    if let Some(ipv4) = ip_info.ipv4 {
-                        bind_hostname_info.push(HostnameInfo::Ip {
-                            network_interface_id: interface.clone(),
-                            public: false,
-                            hostname: IpHostname::Ipv4 {
-                                value: ipv4,
-                                port: new_lan_bind.0.assigned_port,
-                                ssl_port: new_lan_bind.0.assigned_ssl_port,
-                            },
-                        });
-                    }
-                    if let Some(ipv6) = ip_info.ipv6 {
-                        bind_hostname_info.push(HostnameInfo::Ip {
-                            network_interface_id: interface.clone(),
-                            public: false,
-                            hostname: IpHostname::Ipv6 {
-                                value: ipv6,
-                                port: new_lan_bind.0.assigned_port,
-                                ssl_port: new_lan_bind.0.assigned_ssl_port,
-                            },
-                        });
+                    if !public || bind.net.public {
+                        if let Some(wan_ip) = ip_info.wan_ip.filter(|_| public) {
+                            bind_hostname_info.push(HostnameInfo::Ip {
+                                network_interface_id: interface.clone(),
+                                public,
+                                hostname: IpHostname::Ipv4 {
+                                    value: wan_ip,
+                                    port: bind.net.assigned_port,
+                                    ssl_port: bind.net.assigned_ssl_port,
+                                },
+                            });
+                        }
+                        for ipnet in &ip_info.subnets {
+                            match ipnet {
+                                IpNet::V4(net) => {
+                                    if !public {
+                                        bind_hostname_info.push(HostnameInfo::Ip {
+                                            network_interface_id: interface.clone(),
+                                            public,
+                                            hostname: IpHostname::Ipv4 {
+                                                value: net.addr(),
+                                                port: bind.net.assigned_port,
+                                                ssl_port: bind.net.assigned_ssl_port,
+                                            },
+                                        });
+                                    }
+                                }
+                                IpNet::V6(net) => {
+                                    bind_hostname_info.push(HostnameInfo::Ip {
+                                        network_interface_id: interface.clone(),
+                                        public: public && !ipv6_is_local(net.addr()),
+                                        hostname: IpHostname::Ipv6 {
+                                            value: net.addr(),
+                                            scope_id: ip_info.scope_id,
+                                            port: bind.net.assigned_port,
+                                            ssl_port: bind.net.assigned_ssl_port,
+                                        },
+                                    });
+                                }
+                            }
+                        }
                     }
                 }
                 hostname_info.insert(*port, bind_hostname_info);
-                binds.lan.insert(*port, new_lan_bind);
-            }
-            if let Some((lan, _, hostnames, _)) = old_lan_bind {
-                if let Some(external) = lan.assigned_ssl_port {
-                    for hostname in ctrl.server_hostnames.iter().cloned() {
-                        ctrl.vhost.gc(hostname, external).await?;
-                    }
-                    for hostname in hostnames {
-                        ctrl.vhost.gc(Some(hostname), external).await?;
-                    }
-                }
-                if let Some(external) = lan.assigned_port {
-                    ctrl.forward.gc(external).await?;
-                }
-            }
-        }
-        let mut removed = BTreeSet::new();
-        binds.lan.retain(|internal, (external, _, hostnames, _)| {
-            if host.bindings.get(internal).map_or(false, |b| b.enabled) {
-                true
-            } else {
-                removed.insert((*external, std::mem::take(hostnames)));
-
-                false
-            }
-        });
-        for (lan, hostnames) in removed {
-            if let Some(external) = lan.assigned_ssl_port {
-                for hostname in ctrl.server_hostnames.iter().cloned() {
-                    ctrl.vhost.gc(hostname, external).await?;
-                }
-                for hostname in hostnames {
-                    ctrl.vhost.gc(Some(hostname), external).await?;
-                }
-            }
-            if let Some(external) = lan.assigned_port {
-                ctrl.forward.gc(external).await?;
             }
         }
 
@@ -481,7 +501,7 @@ impl NetService {
                 SocketAddr::from((self.ip, *internal)),
             );
             if let (Some(ssl), Some(ssl_internal)) =
-                (&info.options.add_ssl, info.lan.assigned_ssl_port)
+                (&info.options.add_ssl, info.net.assigned_ssl_port)
             {
                 tor_binds.insert(
                     ssl.preferred_external_port,
@@ -506,31 +526,13 @@ impl NetService {
             }
         }
 
-        let mut keep_tor_addrs = BTreeSet::new();
-        for tor_addr in host.addresses().filter_map(|a| {
-            if let HostAddress::Onion { address } = a {
-                Some(address)
-            } else {
-                None
-            }
-        }) {
-            keep_tor_addrs.insert(tor_addr);
-            let old_tor_bind = binds.tor.remove(tor_addr);
-            let tor_bind = old_tor_bind.filter(|(ports, _)| ports == &tor_binds);
-            let new_tor_bind = if let Some(tor_bind) = tor_bind {
-                tor_bind
-            } else {
-                let key = peek
-                    .as_private()
-                    .as_key_store()
-                    .as_onion()
-                    .get_key(tor_addr)?;
-                let rcs = ctrl
-                    .tor
-                    .add(key, tor_binds.clone().into_iter().collect())
-                    .await?;
-                (tor_binds.clone(), rcs)
-            };
+        for tor_addr in host.onions.iter() {
+            let key = peek
+                .as_private()
+                .as_key_store()
+                .as_onion()
+                .get_key(tor_addr)?;
+            tor.insert(key.public().get_onion_address(), (key, tor_binds.clone()));
             for (internal, ports) in &tor_hostname_ports {
                 let mut bind_hostname_info = hostname_info.remove(internal).unwrap_or_default();
                 bind_hostname_info.push(HostnameInfo::Onion {
@@ -542,16 +544,91 @@ impl NetService {
                 });
                 hostname_info.insert(*internal, bind_hostname_info);
             }
-            binds.tor.insert(tor_addr.clone(), new_tor_bind);
         }
-        for addr in binds.tor.keys() {
-            if !keep_tor_addrs.contains(addr) {
-                ctrl.tor.gc(Some(addr.clone()), None).await?;
+
+        let all = binds
+            .forwards
+            .keys()
+            .chain(forwards.keys())
+            .copied()
+            .collect::<BTreeSet<_>>();
+        for external in all {
+            let mut prev = binds.forwards.remove(&external);
+            if let Some((internal, public)) = forwards.remove(&external) {
+                prev = prev.filter(|(i, p, _)| i == &internal && *p == public);
+                binds.forwards.insert(
+                    external,
+                    if let Some(prev) = prev {
+                        prev
+                    } else {
+                        (
+                            internal,
+                            public,
+                            ctrl.forward.add(external, public, internal).await?,
+                        )
+                    },
+                );
             }
         }
+        ctrl.forward.gc().await?;
 
-        self.net_controller()?
-            .db
+        let all = binds
+            .vhosts
+            .keys()
+            .chain(vhosts.keys())
+            .cloned()
+            .collect::<BTreeSet<_>>();
+        for key in all {
+            let mut prev = binds.vhosts.remove(&key);
+            if let Some(target) = vhosts.remove(&key) {
+                prev = prev.filter(|(t, _)| t == &target);
+                binds.vhosts.insert(
+                    key.clone(),
+                    if let Some(prev) = prev {
+                        prev
+                    } else {
+                        (target.clone(), ctrl.vhost.add(key.0, key.1, target)?)
+                    },
+                );
+            } else {
+                if let Some((_, rc)) = prev {
+                    drop(rc);
+                    ctrl.vhost.gc(key.0, key.1);
+                }
+            }
+        }
+
+        let all = binds
+            .tor
+            .keys()
+            .chain(tor.keys())
+            .cloned()
+            .collect::<BTreeSet<_>>();
+        for onion in all {
+            let mut prev = binds.tor.remove(&onion);
+            if let Some((key, tor_binds)) = tor.remove(&onion) {
+                prev = prev.filter(|(b, _)| b == &tor_binds);
+                binds.tor.insert(
+                    onion,
+                    if let Some(prev) = prev {
+                        prev
+                    } else {
+                        let rcs = ctrl
+                            .tor
+                            .add(key, tor_binds.iter().map(|(k, v)| (*k, *v)).collect())
+                            .await?;
+                        (tor_binds, rcs)
+                    },
+                );
+            } else {
+                if let Some((_, rc)) = prev {
+                    drop(rc);
+                    ctrl.tor.gc(Some(onion), None).await?;
+                }
+            }
+        }
+
+        ctrl.db
             .mutate(|db| {
                 host_for(db, &self.id, &id, host.kind)?
                     .as_hostname_info_mut()
@@ -579,29 +656,6 @@ impl NetService {
     pub fn get_ip(&self) -> Ipv4Addr {
         self.ip
     }
-
-    pub fn get_lan_port(&self, host_id: HostId, internal_port: u16) -> Result<LanInfo, Error> {
-        let host_id_binds = self.binds.get_key_value(&host_id);
-        match host_id_binds {
-            Some((_, binds)) => {
-                if let Some((lan, _, _, _)) = binds.lan.get(&internal_port) {
-                    Ok(*lan)
-                } else {
-                    Err(Error::new(
-                        eyre!(
-                            "Internal Port {} not found in NetService binds",
-                            internal_port
-                        ),
-                        crate::ErrorKind::NotFound,
-                    ))
-                }
-            }
-            None => Err(Error::new(
-                eyre!("HostID {} not found in NetService binds", host_id),
-                crate::ErrorKind::NotFound,
-            )),
-        }
-    }
 }
 
 impl Drop for NetService {
diff --git a/core/startos/src/net/network_interface.rs b/core/startos/src/net/network_interface.rs
new file mode 100644
index 000000000..d39a9861a
--- /dev/null
+++ b/core/startos/src/net/network_interface.rs
@@ -0,0 +1,1097 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::future::Future;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV6};
+use std::pin::Pin;
+use std::sync::{Arc, Weak};
+use std::task::Poll;
+use std::time::Duration;
+
+use clap::Parser;
+use futures::{FutureExt, Stream, StreamExt, TryStreamExt};
+use helpers::NonDetachingJoinHandle;
+use imbl_value::InternedString;
+use ipnet::IpNet;
+use itertools::Itertools;
+use nix::net::if_::if_nametoindex;
+use patch_db::json_ptr::JsonPointer;
+use rpc_toolkit::{from_fn_async, Context, HandlerArgs, HandlerExt, ParentHandler};
+use serde::{Deserialize, Serialize};
+use tokio::io::{AsyncBufReadExt, BufReader};
+use tokio::net::{TcpListener, TcpStream};
+use tokio::process::Command;
+use tokio::sync::watch;
+use ts_rs::TS;
+use zbus::proxy::{PropertyChanged, PropertyStream, SignalStream};
+use zbus::zvariant::{
+    DeserializeDict, Dict, OwnedObjectPath, OwnedValue, Type as ZType, Value as ZValue,
+};
+use zbus::{proxy, Connection};
+
+use crate::context::{CliContext, RpcContext};
+use crate::db::model::public::{IpInfo, NetworkInterfaceInfo};
+use crate::db::model::Database;
+use crate::net::utils::{ipv6_is_link_local, ipv6_is_local};
+use crate::prelude::*;
+use crate::util::future::Until;
+use crate::util::io::open_file;
+use crate::util::serde::{display_serializable, HandlerExtSerde};
+use crate::util::sync::SyncMutex;
+use crate::util::Invoke;
+
+pub fn network_interface_api<C: Context>() -> ParentHandler<C> {
+    ParentHandler::new()
+        .subcommand(
+            "list",
+            from_fn_async(list_interfaces)
+                .with_display_serializable()
+                .with_custom_display_fn(|HandlerArgs { params, .. }, res| {
+                    use prettytable::*;
+
+                    if let Some(format) = params.format {
+                        return Ok(display_serializable(format, res));
+                    }
+
+                    let mut table = Table::new();
+                    table.add_row(row![bc => "INTERFACE", "PUBLIC", "ADDRESSES", "WAN IP"]);
+                    for (iface, info) in res {
+                        table.add_row(row![
+                            iface,
+                            info.public(),
+                            info.ip_info.as_ref().map_or_else(
+                                || "<DISCONNECTED>".to_owned(),
+                                |ip_info| ip_info.subnets
+                                    .iter()
+                                    .map(|ipnet| match ipnet.addr() {
+                                        IpAddr::V4(ip) => format!("{ip}/{}", ipnet.prefix_len()),
+                                        IpAddr::V6(ip) => format!(
+                                            "[{ip}%{}]/{}",
+                                            ip_info.scope_id,
+                                            ipnet.prefix_len()
+                                        ),
+                                    })
+                                    .join(", ")),
+                            info.ip_info.as_ref()
+                                .and_then(|ip_info| ip_info.wan_ip)
+                                .map_or_else(|| "N/A".to_owned(), |ip| ip.to_string())
+                        ]);
+                    }
+
+                    table.print_tty(false).unwrap();
+
+                    Ok(())
+                })
+                .with_about("Show network interfaces StartOS can listen on")
+                .with_call_remote::<CliContext>(),
+        )
+        .subcommand(
+            "set-public",
+            from_fn_async(set_public)
+                .with_metadata("sync_db", Value::Bool(true))
+                .no_display()
+                .with_about("Indicate whether this interface is publicly addressable")
+                .with_call_remote::<CliContext>(),
+        ).subcommand(
+            "unset-public",
+            from_fn_async(unset_public)
+                .with_metadata("sync_db", Value::Bool(true))
+                .no_display()
+                .with_about("Allow this interface to infer whether it is publicly addressable based on its IPv4 address")
+                .with_call_remote::<CliContext>(),
+        ).subcommand("forget",
+            from_fn_async(forget_iface)
+                .with_metadata("sync_db", Value::Bool(true))
+                .no_display()
+                .with_about("Forget a disconnected interface")
+                .with_call_remote::<CliContext>()
+        )
+}
+
+async fn list_interfaces(
+    ctx: RpcContext,
+) -> Result<BTreeMap<InternedString, NetworkInterfaceInfo>, Error> {
+    Ok(ctx.net_controller.net_iface.ip_info.borrow().clone())
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, Parser, TS)]
+#[ts(export)]
+struct SetPublicParams {
+    #[ts(type = "string")]
+    interface: InternedString,
+    public: Option<bool>,
+}
+
+async fn set_public(
+    ctx: RpcContext,
+    SetPublicParams { interface, public }: SetPublicParams,
+) -> Result<(), Error> {
+    ctx.net_controller
+        .net_iface
+        .set_public(&interface, Some(public.unwrap_or(true)))
+        .await
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, Parser, TS)]
+#[ts(export)]
+struct UnsetPublicParams {
+    #[ts(type = "string")]
+    interface: InternedString,
+}
+
+async fn unset_public(
+    ctx: RpcContext,
+    UnsetPublicParams { interface }: UnsetPublicParams,
+) -> Result<(), Error> {
+    ctx.net_controller
+        .net_iface
+        .set_public(&interface, None)
+        .await
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, Parser, TS)]
+#[ts(export)]
+struct ForgetInterfaceParams {
+    #[ts(type = "string")]
+    interface: InternedString,
+}
+
+async fn forget_iface(
+    ctx: RpcContext,
+    ForgetInterfaceParams { interface }: ForgetInterfaceParams,
+) -> Result<(), Error> {
+    ctx.net_controller.net_iface.forget(&interface).await
+}
+
+#[proxy(
+    interface = "org.freedesktop.NetworkManager",
+    default_service = "org.freedesktop.NetworkManager",
+    default_path = "/org/freedesktop/NetworkManager"
+)]
+trait NetworkManager {
+    #[zbus(property)]
+    fn all_devices(&self) -> Result<Vec<OwnedObjectPath>, Error>;
+
+    #[zbus(signal)]
+    fn device_added(&self) -> Result<(), Error>;
+
+    #[zbus(signal)]
+    fn device_removed(&self) -> Result<(), Error>;
+
+    #[zbus(signal)]
+    fn state_changed(&self) -> Result<(), Error>;
+}
+
+mod active_connection {
+    use zbus::proxy;
+    use zbus::zvariant::OwnedObjectPath;
+
+    use crate::prelude::*;
+
+    #[proxy(
+        interface = "org.freedesktop.NetworkManager.Connection.Active",
+        default_service = "org.freedesktop.NetworkManager"
+    )]
+    pub trait ActiveConnection {
+        #[zbus(property)]
+        fn state_flags(&self) -> Result<u32, Error>;
+
+        #[zbus(property, name = "Type")]
+        fn connection_type(&self) -> Result<String, Error>;
+
+        #[zbus(signal)]
+        fn state_changed(&self) -> Result<(), Error>;
+
+        #[zbus(property)]
+        fn dhcp4_config(&self) -> Result<OwnedObjectPath, Error>;
+    }
+}
+
+#[proxy(
+    interface = "org.freedesktop.NetworkManager.IP4Config",
+    default_service = "org.freedesktop.NetworkManager"
+)]
+trait Ip4Config {
+    #[zbus(property)]
+    fn address_data(&self) -> Result<Vec<AddressData>, Error>;
+}
+
+#[proxy(
+    interface = "org.freedesktop.NetworkManager.IP6Config",
+    default_service = "org.freedesktop.NetworkManager"
+)]
+trait Ip6Config {
+    #[zbus(property)]
+    fn address_data(&self) -> Result<Vec<AddressData>, Error>;
+}
+
+#[derive(Clone, Debug, DeserializeDict, ZValue, ZType)]
+#[zvariant(signature = "dict")]
+struct AddressData {
+    address: String,
+    prefix: u32,
+}
+impl TryFrom<AddressData> for IpNet {
+    type Error = Error;
+    fn try_from(value: AddressData) -> Result<Self, Self::Error> {
+        IpNet::new(value.address.parse()?, value.prefix as u8).with_kind(ErrorKind::ParseNetAddress)
+    }
+}
+
+#[proxy(
+    interface = "org.freedesktop.NetworkManager.DHCP4Config",
+    default_service = "org.freedesktop.NetworkManager"
+)]
+trait Dhcp4Config {
+    #[zbus(property)]
+    fn options(&self) -> Result<Dhcp4Options, Error>;
+}
+
+#[derive(Clone, Debug, DeserializeDict, ZType)]
+#[zvariant(signature = "dict")]
+struct Dhcp4Options {
+    ntp_servers: Option<String>,
+}
+impl TryFrom<OwnedValue> for Dhcp4Options {
+    type Error = zbus::Error;
+    fn try_from(value: OwnedValue) -> Result<Self, Self::Error> {
+        let dict = value.downcast_ref::<Dict>()?;
+        Ok(Self {
+            ntp_servers: dict.get::<_, String>(&zbus::zvariant::Str::from_static("ntp_servers"))?,
+        })
+    }
+}
+
+mod device {
+    use zbus::proxy;
+    use zbus::zvariant::OwnedObjectPath;
+
+    use crate::prelude::*;
+
+    #[proxy(
+        interface = "org.freedesktop.NetworkManager.Device",
+        default_service = "org.freedesktop.NetworkManager"
+    )]
+    pub trait Device {
+        #[zbus(property)]
+        fn ip_interface(&self) -> Result<String, Error>;
+
+        #[zbus(property)]
+        fn managed(&self) -> Result<bool, Error>;
+
+        #[zbus(property)]
+        fn active_connection(&self) -> Result<OwnedObjectPath, Error>;
+
+        #[zbus(property)]
+        fn ip4_config(&self) -> Result<OwnedObjectPath, Error>;
+
+        #[zbus(property)]
+        fn ip6_config(&self) -> Result<OwnedObjectPath, Error>;
+
+        #[zbus(property, name = "State")]
+        fn _state(&self) -> Result<u32, Error>;
+
+        #[zbus(signal)]
+        fn state_changed(&self) -> Result<(), Error>;
+    }
+}
+
+trait StubStream<'a> {
+    fn stub(self) -> impl Stream<Item = Result<(), Error>> + 'a;
+}
+impl<'a, T> StubStream<'a> for PropertyStream<'a, T>
+where
+    T: Unpin + TryFrom<OwnedValue> + std::fmt::Debug + 'a,
+    T::Error: Into<zbus::Error>,
+{
+    fn stub(self) -> impl Stream<Item = Result<(), Error>> + 'a {
+        StreamExt::then(self, |d| async move {
+            PropertyChanged::get(&d).await.map(|_| ())
+        })
+        .map_err(Error::from)
+    }
+}
+impl<'a> StubStream<'a> for SignalStream<'a> {
+    fn stub(self) -> impl Stream<Item = Result<(), Error>> + 'a {
+        self.map(|_| Ok(()))
+    }
+}
+
+#[instrument(skip_all)]
+async fn watcher(write_to: watch::Sender<BTreeMap<InternedString, NetworkInterfaceInfo>>) {
+    loop {
+        let res: Result<(), Error> = async {
+            let connection = Connection::system().await?;
+
+            let netman_proxy = NetworkManagerProxy::new(&connection).await?;
+
+            let mut until = Until::new()
+                .with_stream(netman_proxy.receive_all_devices_changed().await.stub())
+                .with_stream(
+                    netman_proxy
+                        .receive_device_added()
+                        .await?
+                        .into_inner()
+                        .stub(),
+                )
+                .with_stream(
+                    netman_proxy
+                        .receive_device_removed()
+                        .await?
+                        .into_inner()
+                        .stub(),
+                )
+                .with_stream(
+                    netman_proxy
+                        .receive_state_changed()
+                        .await?
+                        .into_inner()
+                        .stub(),
+                );
+
+            loop {
+                until
+                    .run(async {
+                        let devices = netman_proxy.all_devices().await?;
+                        let mut ifaces = BTreeSet::new();
+                        let mut jobs = Vec::new();
+                        for device in devices {
+                            let device_proxy =
+                                device::DeviceProxy::new(&connection, device.clone()).await?;
+                            let iface = InternedString::intern(device_proxy.ip_interface().await?);
+                            if iface.is_empty() {
+                                continue;
+                            }
+
+                            jobs.push(watch_ip(
+                                &connection,
+                                device_proxy.clone(),
+                                iface.clone(),
+                                &write_to,
+                            ));
+                            ifaces.insert(iface);
+                        }
+
+                        write_to.send_if_modified(|m| {
+                            let mut changed = false;
+                            for (iface, info) in m {
+                                if !ifaces.contains(iface) {
+                                    info.ip_info = None;
+                                    changed = true;
+                                }
+                            }
+                            changed
+                        });
+                        futures::future::try_join_all(jobs).await?;
+
+                        Ok::<_, Error>(())
+                    })
+                    .await?;
+            }
+        }
+        .await;
+        if let Err(e) = res {
+            tracing::error!("{e}");
+            tracing::debug!("{e:?}");
+        }
+    }
+}
+
+async fn get_wan_ipv4(iface: &str) -> Result<Option<Ipv4Addr>, Error> {
+    Ok(reqwest::Client::builder()
+        .interface(iface)
+        .build()?
+        .get("http://ip4only.me/api/")
+        .timeout(Duration::from_secs(10))
+        .send()
+        .await?
+        .error_for_status()?
+        .text()
+        .await?
+        .split(",")
+        .skip(1)
+        .next()
+        .filter(|s| !s.is_empty())
+        .map(|s| s.parse())
+        .transpose()?)
+}
+
+#[instrument(skip(connection, device_proxy, write_to))]
+async fn watch_ip(
+    connection: &Connection,
+    device_proxy: device::DeviceProxy<'_>,
+    iface: InternedString,
+    write_to: &watch::Sender<BTreeMap<InternedString, NetworkInterfaceInfo>>,
+) -> Result<(), Error> {
+    let mut until = Until::new()
+        .with_stream(
+            device_proxy
+                .receive_active_connection_changed()
+                .await
+                .stub(),
+        )
+        .with_stream(
+            device_proxy
+                .receive_state_changed()
+                .await?
+                .into_inner()
+                .stub(),
+        )
+        .with_stream(device_proxy.receive_ip4_config_changed().await.stub())
+        .with_stream(device_proxy.receive_ip6_config_changed().await.stub())
+        .with_async_fn(|| {
+            async {
+                tokio::time::sleep(Duration::from_secs(300)).await;
+                Ok(())
+            }
+            .fuse()
+        });
+
+    loop {
+        until
+            .run(async {
+                let ip4_config = device_proxy.ip4_config().await?;
+                let ip6_config = device_proxy.ip6_config().await?;
+
+                let managed = device_proxy.managed().await?;
+                if !managed {
+                    return Ok(());
+                }
+                let dac = device_proxy.active_connection().await?;
+                if &*dac == "/" {
+                    return Ok(());
+                }
+
+                let active_connection_proxy =
+                    active_connection::ActiveConnectionProxy::new(&connection, dac).await?;
+
+                let mut until = Until::new()
+                    .with_stream(
+                        active_connection_proxy
+                            .receive_state_changed()
+                            .await?
+                            .into_inner()
+                            .stub(),
+                    )
+                    .with_stream(
+                        active_connection_proxy
+                            .receive_dhcp4_config_changed()
+                            .await
+                            .stub(),
+                    );
+
+                loop {
+                    until
+                        .run(async {
+                            let external = active_connection_proxy.state_flags().await? & 0x80 != 0;
+                            if external {
+                                return Ok(());
+                            }
+
+                            let dhcp4_config = active_connection_proxy.dhcp4_config().await?;
+                            let ip4_proxy =
+                                Ip4ConfigProxy::new(&connection, ip4_config.clone()).await?;
+                            let ip6_proxy =
+                                Ip6ConfigProxy::new(&connection, ip6_config.clone()).await?;
+                            let mut until = Until::new()
+                                .with_stream(ip4_proxy.receive_address_data_changed().await.stub())
+                                .with_stream(ip6_proxy.receive_address_data_changed().await.stub());
+
+                            let dhcp4_proxy = if &*dhcp4_config != "/" {
+                                let dhcp4_proxy =
+                                    Dhcp4ConfigProxy::new(&connection, dhcp4_config).await?;
+                                until = until.with_stream(
+                                    dhcp4_proxy.receive_options_changed().await.stub(),
+                                );
+                                Some(dhcp4_proxy)
+                            } else {
+                                None
+                            };
+
+                            loop {
+                                until
+                                    .run(async {
+                                        let addresses = ip4_proxy
+                                            .address_data()
+                                            .await?
+                                            .into_iter()
+                                            .chain(ip6_proxy.address_data().await?)
+                                            .collect_vec();
+                                        let mut ntp_servers = BTreeSet::new();
+                                        if let Some(dhcp4_proxy) = &dhcp4_proxy {
+                                            let dhcp = dhcp4_proxy.options().await?;
+                                            if let Some(ntp) = dhcp.ntp_servers {
+                                                ntp_servers.extend(
+                                                    ntp.split_whitespace()
+                                                        .map(InternedString::intern),
+                                                );
+                                            }
+                                        }
+                                        let scope_id = if_nametoindex(&*iface)
+                                            .with_kind(ErrorKind::Network)?;
+                                        let subnets: BTreeSet<IpNet> = addresses
+                                            .into_iter()
+                                            .map(TryInto::try_into)
+                                            .try_collect()?;
+                                        let ip_info = if !subnets.is_empty() {
+                                            let wan_ip = match get_wan_ipv4(&*iface).await {
+                                                Ok(a) => a,
+                                                Err(e) => {
+                                                    tracing::error!(
+                                                    "Failed to determine WAN IP for {iface}: {e}"
+                                                );
+                                                    tracing::debug!("{e:?}");
+                                                    None
+                                                }
+                                            };
+                                            Some(IpInfo {
+                                                scope_id,
+                                                subnets,
+                                                wan_ip,
+                                                ntp_servers,
+                                            })
+                                        } else {
+                                            None
+                                        };
+
+                                        write_to.send_if_modified(|m| {
+                                            let public = m.get(&iface).map_or(None, |i| i.public);
+                                            m.insert(
+                                                iface.clone(),
+                                                NetworkInterfaceInfo {
+                                                    public,
+                                                    ip_info: ip_info.clone(),
+                                                },
+                                            )
+                                            .filter(|old| &old.ip_info == &ip_info)
+                                            .is_none()
+                                        });
+
+                                        Ok::<_, Error>(())
+                                    })
+                                    .await?;
+                            }
+                        })
+                        .await?;
+                }
+            })
+            .await?;
+    }
+}
+
+pub struct NetworkInterfaceController {
+    db: TypedPatchDb<Database>,
+    ip_info: watch::Sender<BTreeMap<InternedString, NetworkInterfaceInfo>>,
+    _watcher: NonDetachingJoinHandle<()>,
+    listeners: SyncMutex<BTreeMap<u16, Weak<()>>>,
+}
+impl NetworkInterfaceController {
+    pub fn subscribe(&self) -> watch::Receiver<BTreeMap<InternedString, NetworkInterfaceInfo>> {
+        self.ip_info.subscribe()
+    }
+
+    async fn sync(
+        db: &TypedPatchDb<Database>,
+        info: &BTreeMap<InternedString, NetworkInterfaceInfo>,
+    ) -> Result<(), Error> {
+        tracing::debug!("syncronizing {info:?} to db");
+
+        db.mutate(|db| {
+            db.as_public_mut()
+                .as_server_info_mut()
+                .as_network_interfaces_mut()
+                .ser(info)
+        })
+        .await?;
+
+        let ntp: BTreeSet<_> = info
+            .values()
+            .filter_map(|i| i.ip_info.as_ref())
+            .flat_map(|i| &i.ntp_servers)
+            .cloned()
+            .collect();
+        let prev_ntp = tokio_stream::wrappers::LinesStream::new(
+            BufReader::new(open_file("/etc/systemd/timesyncd.conf").await?).lines(),
+        )
+        .try_filter_map(|l| async move {
+            Ok(l.strip_prefix("NTP=").map(|s| {
+                s.split_whitespace()
+                    .map(InternedString::intern)
+                    .collect::<BTreeSet<_>>()
+            }))
+        })
+        .boxed()
+        .try_next()
+        .await?
+        .unwrap_or_default();
+        if ntp != prev_ntp {
+            // sed -i '/\(^\|#\)NTP=/c\NTP='"${servers}" /etc/systemd/timesyncd.conf
+            Command::new("sed")
+                .arg("-i")
+                .arg(
+                    [r#"/\(^\|#\)NTP=/c\NTP="#]
+                        .into_iter()
+                        .chain(Itertools::intersperse(
+                            {
+                                fn to_str(ntp: &InternedString) -> &str {
+                                    &*ntp
+                                }
+                                ntp.iter().map(to_str)
+                            },
+                            " ",
+                        ))
+                        .join(""),
+                )
+                .arg("/etc/systemd/timesyncd.conf")
+                .invoke(ErrorKind::Filesystem)
+                .await?;
+            Command::new("systemctl")
+                .arg("restart")
+                .arg("systemd-timesyncd")
+                .invoke(ErrorKind::Systemd)
+                .await?;
+        }
+
+        Ok(())
+    }
+    pub fn new(db: TypedPatchDb<Database>) -> Self {
+        let (ip_info, mut recv) = watch::channel(BTreeMap::new());
+        Self {
+            db: db.clone(),
+            ip_info: ip_info.clone(),
+            _watcher: tokio::spawn(async move {
+                match db
+                    .peek()
+                    .await
+                    .as_public()
+                    .as_server_info()
+                    .as_network_interfaces()
+                    .de()
+                {
+                    Ok(mut info) => {
+                        for info in info.values_mut() {
+                            info.ip_info = None;
+                        }
+                        ip_info.send_replace(info);
+                    }
+                    Err(e) => {
+                        tracing::error!("Error loading network interface info: {e}");
+                        tracing::debug!("{e:?}");
+                    }
+                };
+                tokio::join!(watcher(ip_info.clone()), async {
+                    let res: Result<(), Error> = async {
+                        loop {
+                            if let Err(e) = async {
+                                let ip_info = { recv.borrow().clone() };
+                                Self::sync(&db, &ip_info).boxed().await?;
+
+                                Ok::<_, Error>(())
+                            }
+                            .await
+                            {
+                                tracing::error!("Error syncing ip info to db: {e}");
+                                tracing::debug!("{e:?}");
+                            }
+
+                            let _ = recv.changed().await;
+                        }
+                    }
+                    .await;
+                    if let Err(e) = res {
+                        tracing::error!("Error syncing ip info to db: {e}");
+                        tracing::debug!("{e:?}");
+                    }
+                });
+            })
+            .into(),
+            listeners: SyncMutex::new(BTreeMap::new()),
+        }
+    }
+
+    pub fn bind(&self, port: u16) -> Result<NetworkInterfaceListener, Error> {
+        let arc = Arc::new(());
+        self.listeners.mutate(|l| {
+            if l.get(&port).filter(|w| w.strong_count() > 0).is_some() {
+                return Err(Error::new(
+                    std::io::Error::from_raw_os_error(libc::EADDRINUSE),
+                    ErrorKind::Network,
+                ));
+            }
+            l.insert(port, Arc::downgrade(&arc));
+            Ok(())
+        })?;
+        Ok(NetworkInterfaceListener {
+            _arc: arc,
+            ip_info: self.ip_info.subscribe(),
+            changed: None,
+            listeners: ListenerMap::new(port),
+        })
+    }
+
+    pub fn upgrade_listener(
+        &self,
+        listener: impl IntoIterator<Item = TcpListener>,
+    ) -> Result<NetworkInterfaceListener, Error> {
+        let listeners = ListenerMap::from_listener(listener)?;
+        let port = listeners.port;
+        let arc = Arc::new(());
+        self.listeners.mutate(|l| {
+            if l.get(&port).filter(|w| w.strong_count() > 0).is_some() {
+                return Err(Error::new(
+                    std::io::Error::from_raw_os_error(libc::EADDRINUSE),
+                    ErrorKind::Network,
+                ));
+            }
+            l.insert(port, Arc::downgrade(&arc));
+            Ok(())
+        })?;
+        Ok(NetworkInterfaceListener {
+            _arc: arc,
+            ip_info: self.ip_info.subscribe(),
+            changed: None,
+            listeners,
+        })
+    }
+
+    pub async fn set_public(
+        &self,
+        interface: &InternedString,
+        public: Option<bool>,
+    ) -> Result<(), Error> {
+        let mut sub = self
+            .db
+            .subscribe(
+                "/public/serverInfo/networkInterfaces"
+                    .parse::<JsonPointer<_, _>>()
+                    .with_kind(ErrorKind::Database)?,
+            )
+            .await;
+        let mut err = None;
+        let changed = self.ip_info.send_if_modified(|ip_info| {
+            let prev = std::mem::replace(
+                &mut match ip_info.get_mut(interface).or_not_found(interface) {
+                    Ok(a) => a,
+                    Err(e) => {
+                        err = Some(e);
+                        return false;
+                    }
+                }
+                .public,
+                public,
+            );
+            prev != public
+        });
+        if let Some(e) = err {
+            return Err(e);
+        }
+        if changed {
+            sub.recv().await;
+        }
+        Ok(())
+    }
+
+    pub async fn forget(&self, interface: &InternedString) -> Result<(), Error> {
+        let mut sub = self
+            .db
+            .subscribe(
+                "/public/serverInfo/networkInterfaces"
+                    .parse::<JsonPointer<_, _>>()
+                    .with_kind(ErrorKind::Database)?,
+            )
+            .await;
+        let mut err = None;
+        let changed = self.ip_info.send_if_modified(|ip_info| {
+            if ip_info
+                .get(interface)
+                .map_or(false, |i| i.ip_info.is_some())
+            {
+                err = Some(Error::new(
+                    eyre!("Cannot forget currently connected interface"),
+                    ErrorKind::InvalidRequest,
+                ));
+                return false;
+            }
+            ip_info.remove(interface).is_some()
+        });
+        if let Some(e) = err {
+            return Err(e);
+        }
+        if changed {
+            sub.recv().await;
+        }
+        Ok(())
+    }
+}
+
+struct ListenerMap {
+    prev_public: bool,
+    port: u16,
+    listeners: BTreeMap<SocketAddr, (TcpListener, bool, Option<Ipv4Addr>)>,
+}
+impl ListenerMap {
+    fn from_listener(listener: impl IntoIterator<Item = TcpListener>) -> Result<Self, Error> {
+        let mut prev_public = false;
+        let mut port = 0;
+        let mut listeners = BTreeMap::<SocketAddr, (TcpListener, bool, Option<Ipv4Addr>)>::new();
+        for listener in listener {
+            let mut local = listener.local_addr().with_kind(ErrorKind::Network)?;
+            if let SocketAddr::V6(l) = &mut local {
+                if ipv6_is_link_local(*l.ip()) && l.scope_id() == 0 {
+                    continue; // TODO determine scope id
+                }
+            }
+            if port != 0 && port != local.port() {
+                return Err(Error::new(
+                    eyre!("Provided listeners are bound to different ports"),
+                    ErrorKind::InvalidRequest,
+                ));
+            }
+            let public = match local.ip() {
+                IpAddr::V4(ip4) => {
+                    !ip4.is_loopback()
+                    && (!ip4.is_private() || ip4.octets().starts_with(&[10, 59])) // reserving 10.59 for public wireguard configurations
+                    && !ip4.is_link_local()
+                }
+                IpAddr::V6(ip6) => !ipv6_is_local(ip6),
+            };
+            prev_public |= public;
+            port = local.port();
+            listeners.insert(local, (listener, public, None));
+        }
+        if port == 0 {
+            return Err(Error::new(
+                eyre!("Listener array cannot be empty"),
+                ErrorKind::InvalidRequest,
+            ));
+        }
+        Ok(Self {
+            prev_public,
+            port,
+            listeners,
+        })
+    }
+}
+impl ListenerMap {
+    fn new(port: u16) -> Self {
+        Self {
+            prev_public: false,
+            port,
+            listeners: BTreeMap::new(),
+        }
+    }
+
+    #[instrument(skip(self))]
+    fn update(
+        &mut self,
+        ip_info: &BTreeMap<InternedString, NetworkInterfaceInfo>,
+        public: bool,
+    ) -> Result<(), Error> {
+        let mut keep = BTreeSet::<SocketAddr>::new();
+        for info in ip_info.values().chain([&NetworkInterfaceInfo {
+            public: Some(false),
+            ip_info: Some(IpInfo {
+                scope_id: 1,
+                subnets: [
+                    IpNet::new(Ipv4Addr::LOCALHOST.into(), 8).unwrap(),
+                    IpNet::new(Ipv6Addr::LOCALHOST.into(), 128).unwrap(),
+                ]
+                .into_iter()
+                .collect(),
+                wan_ip: None,
+                ntp_servers: Default::default(),
+            }),
+        }]) {
+            if public || !info.public() {
+                if let Some(ip_info) = &info.ip_info {
+                    for ipnet in &ip_info.subnets {
+                        let addr = match ipnet.addr() {
+                            IpAddr::V6(ip6) => SocketAddrV6::new(
+                                ip6,
+                                self.port,
+                                0,
+                                if ipv6_is_link_local(ip6) {
+                                    ip_info.scope_id
+                                } else {
+                                    0
+                                },
+                            )
+                            .into(),
+                            ip => SocketAddr::new(ip, self.port),
+                        };
+                        keep.insert(addr);
+                        if let Some((_, is_public, wan_ip)) = self.listeners.get_mut(&addr) {
+                            *is_public = info.public();
+                            *wan_ip = info.ip_info.as_ref().and_then(|i| i.wan_ip);
+                            continue;
+                        }
+                        self.listeners.insert(
+                            addr,
+                            (
+                                TcpListener::from_std(
+                                    mio::net::TcpListener::bind(addr)
+                                        .with_ctx(|_| {
+                                            (
+                                                ErrorKind::Network,
+                                                lazy_format!("binding to {addr:?}"),
+                                            )
+                                        })?
+                                        .into(),
+                                )
+                                .with_kind(ErrorKind::Network)?,
+                                info.public(),
+                                info.ip_info.as_ref().and_then(|i| i.wan_ip),
+                            ),
+                        );
+                    }
+                }
+            }
+        }
+        self.listeners.retain(|key, _| keep.contains(key));
+        self.prev_public = public;
+        Ok(())
+    }
+    fn poll_accept(&self, cx: &mut std::task::Context<'_>) -> Poll<Result<Accepted, Error>> {
+        for (bind_addr, listener) in self.listeners.iter() {
+            if let Poll::Ready((stream, addr)) = listener.0.poll_accept(cx)? {
+                return Poll::Ready(Ok(Accepted {
+                    stream,
+                    peer: addr,
+                    is_public: listener.1,
+                    wan_ip: listener.2,
+                    bind: *bind_addr,
+                }));
+            }
+        }
+        Poll::Pending
+    }
+}
+
+pub struct NetworkInterfaceListener {
+    ip_info: watch::Receiver<BTreeMap<InternedString, NetworkInterfaceInfo>>,
+    listeners: ListenerMap,
+    changed: Option<Pin<Box<dyn Future<Output = ()> + Send + Sync + 'static>>>,
+    _arc: Arc<()>,
+}
+impl NetworkInterfaceListener {
+    pub fn port(&self) -> u16 {
+        self.listeners.port
+    }
+
+    fn poll_ip_info_changed(&mut self, cx: &mut std::task::Context<'_>) -> Poll<()> {
+        let mut changed = if let Some(changed) = self.changed.take() {
+            changed
+        } else {
+            let mut ip_info = self.ip_info.clone();
+            Box::pin(async move {
+                let _ = ip_info.changed().await;
+            })
+        };
+        let res = changed.poll_unpin(cx);
+        if res.is_pending() {
+            self.changed = Some(changed);
+        }
+        res
+    }
+
+    pub fn poll_accept(
+        &mut self,
+        cx: &mut std::task::Context<'_>,
+        public: bool,
+    ) -> Poll<Result<Accepted, Error>> {
+        if self.poll_ip_info_changed(cx).is_ready() || public != self.listeners.prev_public {
+            self.listeners.update(&*self.ip_info.borrow(), public)?;
+        }
+        self.listeners.poll_accept(cx)
+    }
+
+    pub async fn accept(&mut self, public: bool) -> Result<Accepted, Error> {
+        futures::future::poll_fn(|cx| self.poll_accept(cx, public)).await
+    }
+}
+
+pub struct Accepted {
+    pub stream: TcpStream,
+    pub peer: SocketAddr,
+    pub is_public: bool,
+    pub wan_ip: Option<Ipv4Addr>,
+    pub bind: SocketAddr,
+}
+
+// async fn _ips() -> Result<BTreeSet<IpAddr>, Error> {
+//     Ok(init_ips()
+//         .await?
+//         .values()
+//         .flat_map(|i| {
+//             std::iter::empty()
+//                 .chain(i.ipv4.map(IpAddr::from))
+//                 .chain(i.ipv6.map(IpAddr::from))
+//         })
+//         .collect())
+// }
+
+// pub async fn ips() -> Result<BTreeSet<IpAddr>, Error> {
+//     let ips = CACHED_IPS.read().await.clone();
+//     if !ips.is_empty() {
+//         return Ok(ips);
+//     }
+//     let ips = _ips().await?;
+//     *CACHED_IPS.write().await = ips.clone();
+//     Ok(ips)
+// }
+
+// pub async fn init_ips() -> Result<BTreeMap<String, IpInfo>, Error> {
+//     let mut res = BTreeMap::new();
+//     let mut ifaces = list_interfaces();
+//     while let Some(iface) = ifaces.try_next().await? {
+//         if iface_is_physical(&iface).await {
+//             let ip_info = IpInfo::for_interface(&iface).await?;
+//             res.insert(iface, ip_info);
+//         }
+//     }
+//     Ok(res)
+// }
+
+// // #[command(subcommands(update))]
+// pub fn dhcp<C: Context>() -> ParentHandler<C> {
+//     ParentHandler::new().subcommand(
+//         "update",
+//         from_fn_async::<_, _, (), Error, (RpcContext, UpdateParams)>(update)
+//             .no_display()
+//             .with_about("Update IP assigned by dhcp")
+//             .with_call_remote::<CliContext>(),
+//     )
+// }
+// #[derive(Deserialize, Serialize, Parser, TS)]
+// #[serde(rename_all = "camelCase")]
+// #[command(rename_all = "kebab-case")]
+// pub struct UpdateParams {
+//     interface: String,
+// }
+
+// pub async fn update(
+//     ctx: RpcContext,
+//     UpdateParams { interface }: UpdateParams,
+// ) -> Result<(), Error> {
+//     if iface_is_physical(&interface).await {
+//         let ip_info = IpInfo::for_interface(&interface).await?;
+//         ctx.db
+//             .mutate(|db| {
+//                 db.as_public_mut()
+//                     .as_server_info_mut()
+//                     .as_ip_info_mut()
+//                     .insert(&interface, &ip_info)
+//             })
+//             .await?;
+
+//         let mut cached = CACHED_IPS.write().await;
+//         if cached.is_empty() {
+//             *cached = _ips().await?;
+//         } else {
+//             cached.extend(
+//                 std::iter::empty()
+//                     .chain(ip_info.ipv4.map(IpAddr::from))
+//                     .chain(ip_info.ipv6.map(IpAddr::from)),
+//             );
+//         }
+//     }
+//     Ok(())
+// }
diff --git a/core/startos/src/net/service_interface.rs b/core/startos/src/net/service_interface.rs
index ade10d959..ad2900da7 100644
--- a/core/startos/src/net/service_interface.rs
+++ b/core/startos/src/net/service_interface.rs
@@ -12,7 +12,8 @@ use ts_rs::TS;
 #[serde(tag = "kind")]
 pub enum HostnameInfo {
     Ip {
-        network_interface_id: String,
+        #[ts(type = "string")]
+        network_interface_id: InternedString,
         public: bool,
         hostname: IpHostname,
     },
@@ -43,6 +44,8 @@ pub enum IpHostname {
     },
     Ipv6 {
         value: Ipv6Addr,
+        #[serde(default)]
+        scope_id: u32,
         port: Option<u16>,
         ssl_port: Option<u16>,
     },
@@ -69,7 +72,6 @@ pub struct ServiceInterface {
     pub id: ServiceInterfaceId,
     pub name: String,
     pub description: String,
-    pub has_primary: bool,
     pub masked: bool,
     pub address_info: AddressInfo,
     #[serde(rename = "type")]
diff --git a/core/startos/src/net/ssl.rs b/core/startos/src/net/ssl.rs
index 29bcd9652..a89853591 100644
--- a/core/startos/src/net/ssl.rs
+++ b/core/startos/src/net/ssl.rs
@@ -17,7 +17,6 @@ use openssl::x509::{X509Builder, X509Extension, X509NameBuilder, X509};
 use openssl::*;
 use patch_db::HasModel;
 use serde::{Deserialize, Serialize};
-use tokio::time::Instant;
 use tracing::instrument;
 
 use crate::account::AccountInfo;
diff --git a/core/startos/src/net/static_server.rs b/core/startos/src/net/static_server.rs
index c070d7920..386f64d7b 100644
--- a/core/startos/src/net/static_server.rs
+++ b/core/startos/src/net/static_server.rs
@@ -8,15 +8,15 @@ use std::time::UNIX_EPOCH;
 use async_compression::tokio::bufread::GzipEncoder;
 use axum::body::Body;
 use axum::extract::{self as x, Request};
-use axum::response::Response;
-use axum::routing::{any, get, post};
+use axum::response::{Redirect, Response};
+use axum::routing::{any, get};
 use axum::Router;
 use base64::display::Base64Display;
 use digest::Digest;
 use futures::future::ready;
 use http::header::{
     ACCEPT_ENCODING, ACCEPT_RANGES, CACHE_CONTROL, CONNECTION, CONTENT_ENCODING, CONTENT_LENGTH,
-    CONTENT_RANGE, CONTENT_TYPE, ETAG, RANGE,
+    CONTENT_RANGE, CONTENT_TYPE, ETAG, HOST, RANGE,
 };
 use http::request::Parts as RequestParts;
 use http::{HeaderValue, Method, StatusCode};
@@ -26,7 +26,6 @@ use new_mime_guess::MimeGuess;
 use openssl::hash::MessageDigest;
 use openssl::x509::X509;
 use rpc_toolkit::{Context, HttpServer, Server};
-use sqlx::query;
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncSeekExt, BufReader};
 use tokio_util::io::ReaderStream;
 use url::Url;
@@ -230,6 +229,20 @@ pub fn refresher() -> Router {
     }))
 }
 
+pub fn redirecter() -> Router {
+    Router::new().fallback(get(|request: Request| async move {
+        Redirect::temporary(&format!(
+            "https://{}{}",
+            request
+                .headers()
+                .get(HOST)
+                .and_then(|s| s.to_str().ok())
+                .unwrap_or("localhost"),
+            request.uri()
+        ))
+    }))
+}
+
 async fn proxy_request(ctx: RpcContext, request: Request, url: String) -> Result<Response, Error> {
     if_authorized(&ctx, request, |mut request| async {
         for header in PROXY_STRIP_HEADERS {
diff --git a/core/startos/src/net/utils.rs b/core/startos/src/net/utils.rs
index 9cba8a0cd..d6dcdde15 100644
--- a/core/startos/src/net/utils.rs
+++ b/core/startos/src/net/utils.rs
@@ -1,16 +1,25 @@
-use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV6};
 use std::path::Path;
 
 use async_stream::try_stream;
 use color_eyre::eyre::eyre;
 use futures::stream::BoxStream;
 use futures::{StreamExt, TryStreamExt};
-use ipnet::{Ipv4Net, Ipv6Net};
+use ipnet::{IpNet, Ipv4Net, Ipv6Net};
+use nix::net::if_::if_nametoindex;
 use tokio::net::{TcpListener, TcpStream};
 use tokio::process::Command;
 
+use crate::prelude::*;
 use crate::util::Invoke;
-use crate::Error;
+
+pub fn ipv6_is_link_local(addr: Ipv6Addr) -> bool {
+    (addr.segments()[0] & 0xffc0) == 0xfe80
+}
+
+pub fn ipv6_is_local(addr: Ipv6Addr) -> bool {
+    addr.is_loopback() || (addr.segments()[0] & 0xfe00) == 0xfc00 || ipv6_is_link_local(addr)
+}
 
 fn parse_iface_ip(output: &str) -> Result<Vec<&str>, Error> {
     let output = output.trim();
@@ -112,6 +121,52 @@ pub async fn find_eth_iface() -> Result<String, Error> {
     ))
 }
 
+pub async fn all_socket_addrs_for(port: u16) -> Result<Vec<SocketAddr>, Error> {
+    let mut res = Vec::new();
+
+    let raw = String::from_utf8(
+        Command::new("ip")
+            .arg("-o")
+            .arg("addr")
+            .arg("show")
+            .invoke(ErrorKind::ParseSysInfo)
+            .await?,
+    )?;
+    let err = |item: &str, lineno: usize, line: &str| {
+        Error::new(
+            eyre!("failed to parse ip info ({item}[line:{lineno}]) from {line:?}"),
+            ErrorKind::ParseSysInfo,
+        )
+    };
+    for (idx, line) in raw
+        .lines()
+        .map(|l| l.trim())
+        .enumerate()
+        .filter(|(_, l)| !l.is_empty())
+    {
+        let mut split = line.split_whitespace();
+        let _num = split.next();
+        let ifname = split.next().ok_or_else(|| err("ifname", idx, line))?;
+        let _kind = split.next();
+        let ipnet_str = split.next().ok_or_else(|| err("ipnet", idx, line))?;
+        let ipnet = ipnet_str
+            .parse::<IpNet>()
+            .with_ctx(|_| (ErrorKind::ParseSysInfo, err("ipnet", idx, ipnet_str)))?;
+        match ipnet.addr() {
+            IpAddr::V4(ip4) => res.push(SocketAddr::new(ip4.into(), port)),
+            IpAddr::V6(ip6) => res.push(SocketAddr::V6(SocketAddrV6::new(
+                ip6,
+                port,
+                0,
+                if_nametoindex(ifname)
+                    .with_ctx(|_| (ErrorKind::ParseSysInfo, "reading scope_id"))?,
+            ))),
+        }
+    }
+
+    Ok(res)
+}
+
 pub struct TcpListeners {
     listeners: Vec<TcpListener>,
 }
diff --git a/core/startos/src/net/vhost.rs b/core/startos/src/net/vhost.rs
index 7d48b1469..dc6f422bf 100644
--- a/core/startos/src/net/vhost.rs
+++ b/core/startos/src/net/vhost.rs
@@ -1,22 +1,24 @@
-use std::collections::BTreeMap;
-use std::net::{IpAddr, Ipv6Addr, SocketAddr};
+use std::collections::{BTreeMap, BTreeSet};
+use std::net::{IpAddr, SocketAddr};
 use std::str::FromStr;
 use std::sync::{Arc, Weak};
 use std::time::Duration;
 
-use async_acme::acme::ACME_TLS_ALPN_NAME;
+use async_acme::acme::{Identifier, ACME_TLS_ALPN_NAME};
 use axum::body::Body;
 use axum::extract::Request;
 use axum::response::Response;
 use color_eyre::eyre::eyre;
+use futures::FutureExt;
 use helpers::NonDetachingJoinHandle;
 use http::Uri;
 use imbl_value::InternedString;
 use models::ResultExt;
+use rpc_toolkit::{from_fn, Context, HandlerArgs, HandlerExt, ParentHandler};
 use serde::{Deserialize, Serialize};
 use tokio::io::AsyncWriteExt;
-use tokio::net::{TcpListener, TcpStream};
-use tokio::sync::{watch, Mutex, RwLock};
+use tokio::net::TcpStream;
+use tokio::sync::watch;
 use tokio_rustls::rustls::crypto::CryptoProvider;
 use tokio_rustls::rustls::pki_types::{
     CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer, ServerName,
@@ -30,13 +32,60 @@ use tokio_stream::StreamExt;
 use tracing::instrument;
 use ts_rs::TS;
 
+use crate::context::{CliContext, RpcContext};
 use crate::db::model::Database;
-use crate::net::acme::AcmeCertCache;
+use crate::net::acme::{AcmeCertCache, AcmeProvider};
+use crate::net::network_interface::{
+    Accepted, NetworkInterfaceController, NetworkInterfaceListener,
+};
 use crate::net::static_server::server_error;
 use crate::prelude::*;
 use crate::util::io::BackTrackingIO;
+use crate::util::serde::{display_serializable, HandlerExtSerde, MaybeUtf8String};
 use crate::util::sync::SyncMutex;
-use crate::util::serde::MaybeUtf8String;
+
+pub fn vhost_api<C: Context>() -> ParentHandler<C> {
+    ParentHandler::new().subcommand(
+        "dump-table",
+        from_fn(|ctx: RpcContext| Ok(ctx.net_controller.vhost.dump_table()))
+            .with_display_serializable()
+            .with_custom_display_fn(|HandlerArgs { params, .. }, res| {
+                use prettytable::*;
+
+                if let Some(format) = params.format {
+                    display_serializable(format, res);
+                    return Ok::<_, Error>(());
+                }
+
+                let mut table = Table::new();
+                table.add_row(row![bc => "FROM", "TO", "PUBLIC", "ACME", "CONNECT SSL", "ACTIVE"]);
+
+                for (external, targets) in res {
+                    for (host, targets) in targets {
+                        for (idx, target) in targets.into_iter().enumerate() {
+                            table.add_row(row![
+                                format!(
+                                    "{}:{}",
+                                    host.as_ref().map(|s| &**s).unwrap_or("*"),
+                                    external.0
+                                ),
+                                target.addr,
+                                target.public,
+                                target.acme.as_ref().map(|a| a.0.as_str()).unwrap_or("NONE"),
+                                target.connect_ssl.is_ok(),
+                                idx == 0
+                            ]);
+                        }
+                    }
+                }
+
+                table.print_tty(false)?;
+
+                Ok(())
+            })
+            .with_call_remote::<CliContext>(),
+    )
+}
 
 #[derive(Debug)]
 struct SingleCertResolver(Arc<CertifiedKey>);
@@ -49,62 +98,108 @@ impl ResolvesServerCert for SingleCertResolver {
 // not allowed: <=1024, >=32768, 5355, 5432, 9050, 6010, 9051, 5353
 
 pub struct VHostController {
-    crypto_provider: Arc<CryptoProvider>,
     db: TypedPatchDb<Database>,
-    servers: Mutex<BTreeMap<u16, VHostServer>>,
+    interfaces: Arc<NetworkInterfaceController>,
+    crypto_provider: Arc<CryptoProvider>,
+    acme_tls_alpn_cache: AcmeTlsAlpnCache,
+    servers: SyncMutex<BTreeMap<u16, VHostServer>>,
 }
 impl VHostController {
-    pub fn new(db: TypedPatchDb<Database>) -> Self {
+    pub fn new(db: TypedPatchDb<Database>, interfaces: Arc<NetworkInterfaceController>) -> Self {
         Self {
-            crypto_provider: Arc::new(tokio_rustls::rustls::crypto::ring::default_provider()),
             db,
-            servers: Mutex::new(BTreeMap::new()),
+            interfaces,
+            crypto_provider: Arc::new(tokio_rustls::rustls::crypto::ring::default_provider()),
+            acme_tls_alpn_cache: Arc::new(SyncMutex::new(BTreeMap::new())),
+            servers: SyncMutex::new(BTreeMap::new()),
         }
     }
     #[instrument(skip_all)]
-    pub async fn add(
+    pub fn add(
         &self,
         hostname: Option<InternedString>,
         external: u16,
-        target: SocketAddr,
-        connect_ssl: Result<(), AlpnInfo>, // Ok: yes, connect using ssl, pass through alpn; Err: connect tcp, use provided strategy for alpn
+        TargetInfo {
+            public,
+            acme,
+            addr,
+            connect_ssl,
+        }: TargetInfo,
     ) -> Result<Arc<()>, Error> {
-        let mut writable = self.servers.lock().await;
-        let server = if let Some(server) = writable.remove(&external) {
-            server
-        } else {
-            tracing::info!("Listening on {external}");
-            VHostServer::new(external, self.db.clone(), self.crypto_provider.clone()).await?
-        };
-        let rc = server
-            .add(
+        self.servers.mutate(|writable| {
+            let server = if let Some(server) = writable.remove(&external) {
+                server
+            } else {
+                VHostServer::new(
+                    external,
+                    self.db.clone(),
+                    self.interfaces.clone(),
+                    self.crypto_provider.clone(),
+                    self.acme_tls_alpn_cache.clone(),
+                )?
+            };
+            let rc = server.add(
                 hostname,
                 TargetInfo {
-                    addr: target,
+                    public,
+                    acme,
+                    addr,
                     connect_ssl,
                 },
-            )
-            .await;
-        writable.insert(external, server);
-        Ok(rc?)
+            );
+            writable.insert(external, server);
+            Ok(rc?)
+        })
     }
+
+    pub fn dump_table(
+        &self,
+    ) -> BTreeMap<JsonKey<u16>, BTreeMap<JsonKey<Option<InternedString>>, BTreeSet<TargetInfo>>>
+    {
+        self.servers.peek(|s| {
+            s.iter()
+                .map(|(k, v)| {
+                    (
+                        JsonKey::new(*k),
+                        v.mapping
+                            .borrow()
+                            .iter()
+                            .map(|(k, v)| {
+                                (
+                                    JsonKey::new(k.clone()),
+                                    v.iter()
+                                        .filter(|(_, v)| v.strong_count() > 0)
+                                        .map(|(k, _)| k)
+                                        .cloned()
+                                        .collect(),
+                                )
+                            })
+                            .collect(),
+                    )
+                })
+                .collect()
+        })
+    }
+
     #[instrument(skip_all)]
-    pub async fn gc(&self, hostname: Option<InternedString>, external: u16) -> Result<(), Error> {
-        let mut writable = self.servers.lock().await;
-        if let Some(server) = writable.remove(&external) {
-            server.gc(hostname).await?;
-            if !server.is_empty().await? {
-                writable.insert(external, server);
+    pub fn gc(&self, hostname: Option<InternedString>, external: u16) {
+        self.servers.mutate(|writable| {
+            if let Some(server) = writable.remove(&external) {
+                server.gc(hostname);
+                if !server.is_empty() {
+                    writable.insert(external, server);
+                }
             }
-        }
-        Ok(())
+        })
     }
 }
 
-#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
-struct TargetInfo {
-    addr: SocketAddr,
-    connect_ssl: Result<(), AlpnInfo>,
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+pub struct TargetInfo {
+    pub public: bool,
+    pub acme: Option<AcmeProvider>,
+    pub addr: SocketAddr,
+    pub connect_ssl: Result<(), AlpnInfo>, // Ok: yes, connect using ssl, pass through alpn; Err: connect tcp, use provided strategy for alpn
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, TS)]
@@ -120,421 +215,498 @@ impl Default for AlpnInfo {
     }
 }
 
+type AcmeTlsAlpnCache =
+    Arc<SyncMutex<BTreeMap<InternedString, watch::Receiver<Option<Arc<CertifiedKey>>>>>>;
+type Mapping = BTreeMap<Option<InternedString>, BTreeMap<TargetInfo, Weak<()>>>;
+
 struct VHostServer {
-    mapping: Weak<RwLock<BTreeMap<Option<InternedString>, BTreeMap<TargetInfo, Weak<()>>>>>,
+    mapping: watch::Sender<Mapping>,
     _thread: NonDetachingJoinHandle<()>,
 }
+
 impl VHostServer {
-    #[instrument(skip_all)]
-    async fn new(port: u16, db: TypedPatchDb<Database>, crypto_provider: Arc<CryptoProvider>) -> Result<Self, Error> {
-        let acme_tls_alpn_cache = Arc::new(SyncMutex::new(BTreeMap::<
-            InternedString,
-            watch::Receiver<Option<Arc<CertifiedKey>>>,
-        >::new()));
-        // check if port allowed
-        let listener = TcpListener::bind(SocketAddr::new(Ipv6Addr::UNSPECIFIED.into(), port))
-            .await
-            .with_kind(crate::ErrorKind::Network)?;
-        let mapping = Arc::new(RwLock::new(BTreeMap::new()));
-        Ok(Self {
-            mapping: Arc::downgrade(&mapping),
-            _thread: tokio::spawn(async move {
-                loop {
-                    match listener.accept().await {
-                        Ok((stream, _)) => {
-                            if let Err(e) = socket2::SockRef::from(&stream).set_tcp_keepalive(
-                                &socket2::TcpKeepalive::new()
-                                    .with_time(Duration::from_secs(900))
-                                    .with_interval(Duration::from_secs(60))
-                                    .with_retries(5),
-                            ) {
-                                tracing::error!("Failed to set tcp keepalive: {e}");
-                                tracing::debug!("{e:?}");
-                            }
+    async fn accept(
+        listener: &mut NetworkInterfaceListener,
+        mut mapping: watch::Receiver<Mapping>,
+        db: TypedPatchDb<Database>,
+        acme_tls_alpn_cache: AcmeTlsAlpnCache,
+        crypto_provider: Arc<CryptoProvider>,
+    ) -> Result<(), Error> {
+        let accepted;
 
-                            let mut stream = BackTrackingIO::new(stream);
-                            let mapping = mapping.clone();
-                            let db = db.clone();
-                            let acme_tls_alpn_cache = acme_tls_alpn_cache.clone();
-                            let crypto_provider = crypto_provider.clone();
-                            tokio::spawn(async move {
-                                if let Err(e) = async {
-                                    let mid: tokio_rustls::StartHandshake<&mut BackTrackingIO<TcpStream>> = match LazyConfigAcceptor::new(
-                                        Acceptor::default(),
-                                        &mut stream,
-                                    )
-                                    .await
-                                    {
-                                        Ok(a) => a,
-                                        Err(_) => {
-                                            stream.rewind();
-                                            return hyper_util::server::conn::auto::Builder::new(hyper_util::rt::TokioExecutor::new())
-                                                .serve_connection(
-                                                    hyper_util::rt::TokioIo::new(stream),
-                                                    hyper_util::service::TowerToHyperService::new(axum::Router::new().fallback(
-                                                        axum::routing::method_routing::any(move |req: Request| async move {
-                                                            match async move {
-                                                                let host = req
-                                                                    .headers()
-                                                                    .get(http::header::HOST)
-                                                                    .and_then(|host| host.to_str().ok());
-                                                                let uri = Uri::from_parts({
-                                                                    let mut parts = req.uri().to_owned().into_parts();
-                                                                    parts.scheme = Some("https".parse()?);
-                                                                    parts.authority = host.map(FromStr::from_str).transpose()?;
-                                                                    parts
-                                                                })?;
-                                                                Response::builder()
-                                                                    .status(http::StatusCode::TEMPORARY_REDIRECT)
-                                                                    .header(http::header::LOCATION, uri.to_string())
-                                                                    .body(Body::default())
-                                                            }.await {
-                                                                Ok(a) => a,
-                                                                Err(e) => {
-                                                                    tracing::warn!("Error redirecting http request on ssl port: {e}");
-                                                                    tracing::error!("{e:?}");
-                                                                    server_error(Error::new(e, ErrorKind::Network))
-                                                                }
-                                                            }
-                                                        }),
-                                                    )),
-                                                )
-                                                .await
-                                                .map_err(|e| Error::new(color_eyre::eyre::Report::msg(e), ErrorKind::Network));
-                                        }
-                                    };
-                                    let target_name =
-                                        mid.client_hello().server_name().map(|s| s.into());
-                                    let target = {
-                                        let mapping = mapping.read().await;
-                                        mapping
-                                            .get(&target_name)
-                                            .into_iter()
-                                            .flatten()
-                                            .find(|(_, rc)| rc.strong_count() > 0)
-                                            .or_else(|| {
-                                                if target_name
-                                                    .as_ref()
-                                                    .map(|s| s.parse::<IpAddr>().is_ok())
-                                                    .unwrap_or(true)
-                                                {
-                                                    mapping
-                                                        .get(&None)
-                                                        .into_iter()
-                                                        .flatten()
-                                                        .find(|(_, rc)| rc.strong_count() > 0)
-                                                } else {
-                                                    None
-                                                }
-                                            })
-                                            .map(|(target, _)| target.clone())
-                                    };
-                                    if let Some(target) = target {
-                                        let peek = db.peek().await;
-                                        let root = peek.as_private().as_key_store().as_local_certs().as_root_cert().de()?;
-                                        let mut cfg = match async {
-                                            if let Some(acme_settings) = peek.as_public().as_server_info().as_acme().de()? {
-                                                if let Some(domain) = target_name.as_ref().filter(|target_name| acme_settings.domains.contains(*target_name)) {
-                                                    if mid
-                                                        .client_hello()
-                                                        .alpn()
-                                                        .into_iter()
-                                                        .flatten()
-                                                        .any(|alpn| alpn == ACME_TLS_ALPN_NAME)
-                                                    {
-                                                        let cert = WatchStream::new(
-                                                            acme_tls_alpn_cache.peek(|c| c.get(&**domain).cloned())
-                                                                .ok_or_else(|| {
-                                                                    Error::new(
-                                                                        eyre!("No challenge recv available for {domain}"),
-                                                                        ErrorKind::OpenSsl
-                                                                    )
-                                                                })?,
-                                                        );
-                                                        tracing::info!("Waiting for verification cert for {domain}");
-                                                        let cert = cert
-                                                            .filter(|c| c.is_some())
-                                                            .next()
-                                                            .await
-                                                            .flatten()
-                                                            .ok_or_else(|| {
-                                                                Error::new(eyre!("No challenge available for {domain}"), ErrorKind::OpenSsl)
-                                                            })?;
-                                                        tracing::info!("Verification cert received for {domain}");
-                                                        let mut cfg = ServerConfig::builder_with_provider(crypto_provider.clone())
-                                                            .with_safe_default_protocol_versions()
-                                                            .with_kind(crate::ErrorKind::OpenSsl)?
-                                                            .with_no_client_auth()
-                                                            .with_cert_resolver(Arc::new(SingleCertResolver(cert)));
+        loop {
+            let any_public = mapping
+                .borrow()
+                .iter()
+                .any(|(_, targets)| targets.iter().any(|(target, _)| target.public));
 
-                                                        cfg.alpn_protocols = vec![ACME_TLS_ALPN_NAME.to_vec()];
-                                                        return Ok(Err(cfg));
-                                                    } else {
-                                                        let domains = [domain.to_string()];
-                                                        let (send, recv) = watch::channel(None);
-                                                        acme_tls_alpn_cache.mutate(|c| c.insert(domain.clone(), recv));
-                                                        let cert = 
-                                                            async_acme::rustls_helper::order(
-                                                                |_, cert| {
-                                                                    send.send_replace(Some(Arc::new(cert)));
-                                                                    Ok(())
-                                                                },
-                                                                acme_settings.provider.as_str(),
-                                                                &domains,
-                                                                Some(&AcmeCertCache(&db)),
-                                                                &acme_settings.contact,
-                                                            )
-                                                            .await
-                                                            .with_kind(ErrorKind::OpenSsl)?;
-                                                        return Ok(Ok(
-                                                                ServerConfig::builder_with_provider(crypto_provider.clone())
-                                                                    .with_safe_default_protocol_versions()
-                                                                    .with_kind(crate::ErrorKind::OpenSsl)?
-                                                                    .with_no_client_auth()
-                                                                    .with_cert_resolver(Arc::new(SingleCertResolver(Arc::new(cert))))
-                                                            ));
-                                                    }
-                                                }
-                                            }
-                                            let hostnames = target_name
-                                                .into_iter()
-                                                .chain(
-                                                    peek
-                                                        .as_public()
-                                                        .as_server_info()
-                                                        .as_ip_info()
-                                                        .as_entries()?
-                                                        .into_iter()
-                                                        .flat_map(|(_, ips)| [
-                                                            ips.as_ipv4().de().map(|ip| ip.map(IpAddr::V4)),
-                                                            ips.as_ipv6().de().map(|ip| ip.map(IpAddr::V6))
-                                                        ])
-                                                        .filter_map(|a| a.transpose())
-                                                        .map(|a| a.map(|ip| InternedString::from_display(&ip)))
-                                                        .collect::<Result<Vec<_>, _>>()?,
-                                                )
-                                                .collect();
-                                            let key = db
-                                                .mutate(|v| {
-                                                    v.as_private_mut()
-                                                        .as_key_store_mut()
-                                                        .as_local_certs_mut()
-                                                        .cert_for(&hostnames)
-                                                })
-                                                .await?;
-                                            let cfg = ServerConfig::builder_with_provider(crypto_provider.clone())
-                                                .with_safe_default_protocol_versions()
-                                                .with_kind(crate::ErrorKind::OpenSsl)?
-                                                .with_no_client_auth();
-                                            if mid.client_hello().signature_schemes().contains(
-                                                &tokio_rustls::rustls::SignatureScheme::ED25519,
-                                            ) {
-                                                cfg.with_single_cert(
-                                                    key.fullchain_ed25519()
-                                                        .into_iter()
-                                                        .map(|c| {
-                                                            Ok(tokio_rustls::rustls::pki_types::CertificateDer::from(
-                                                                c.to_der()?,
-                                                            ))
-                                                        })
-                                                        .collect::<Result<_, Error>>()?,
-                                                    PrivateKeyDer::from(PrivatePkcs8KeyDer::from(
-                                                        key.leaf
-                                                            .keys
-                                                            .ed25519
-                                                            .private_key_to_pkcs8()?,
-                                                    )),
-                                                )
-                                            } else {
-                                                cfg.with_single_cert(
-                                                    key.fullchain_nistp256()
-                                                        .into_iter()
-                                                        .map(|c| {
-                                                            Ok(tokio_rustls::rustls::pki_types::CertificateDer::from(
-                                                                c.to_der()?,
-                                                            ))
-                                                        })
-                                                        .collect::<Result<_, Error>>()?,
-                                                    PrivateKeyDer::from(PrivatePkcs8KeyDer::from(
-                                                        key.leaf
-                                                            .keys
-                                                            .nistp256
-                                                            .private_key_to_pkcs8()?,
-                                                    )),
-                                                )
-                                            }
-                                            .with_kind(crate::ErrorKind::OpenSsl)
-                                            .map(Ok)
-                                        }.await? {
+            let changed_public = mapping
+                .wait_for(|m| {
+                    m.iter()
+                        .any(|(_, targets)| targets.iter().any(|(target, _)| target.public))
+                        != any_public
+                })
+                .boxed();
+
+            tokio::select! {
+                a = listener.accept(any_public) => {
+                    accepted = a?;
+                    break;
+                }
+                _ = changed_public => {
+                    tracing::debug!("port {} {} public bindings", listener.port(), if any_public { "no longer has" } else { "now has" });
+                }
+            }
+        }
+
+        if let Err(e) = socket2::SockRef::from(&accepted.stream).set_tcp_keepalive(
+            &socket2::TcpKeepalive::new()
+                .with_time(Duration::from_secs(900))
+                .with_interval(Duration::from_secs(60))
+                .with_retries(5),
+        ) {
+            tracing::error!("Failed to set tcp keepalive: {e}");
+            tracing::debug!("{e:?}");
+        }
+
+        tokio::spawn(async move {
+            let bind = accepted.bind;
+            if let Err(e) =
+                Self::handle_stream(accepted, mapping, db, acme_tls_alpn_cache, crypto_provider)
+                    .await
+            {
+                tracing::error!("Error in VHostController on {bind}: {e}");
+                tracing::debug!("{e:?}")
+            }
+        });
+        Ok(())
+    }
+
+    async fn handle_stream(
+        Accepted {
+            stream,
+            is_public,
+            wan_ip,
+            bind,
+            ..
+        }: Accepted,
+        mapping: watch::Receiver<Mapping>,
+        db: TypedPatchDb<Database>,
+        acme_tls_alpn_cache: AcmeTlsAlpnCache,
+        crypto_provider: Arc<CryptoProvider>,
+    ) -> Result<(), Error> {
+        let mut stream = BackTrackingIO::new(stream);
+        let mid: tokio_rustls::StartHandshake<&mut BackTrackingIO<TcpStream>> =
+            match LazyConfigAcceptor::new(Acceptor::default(), &mut stream).await {
+                Ok(a) => a,
+                Err(e) => {
+                    let (_, buf) = stream.rewind();
+                    if std::str::from_utf8(buf)
+                        .ok()
+                        .and_then(|buf| {
+                            buf.lines()
+                                .map(|l| l.trim())
+                                .filter(|l| !l.is_empty())
+                                .next()
+                        })
+                        .map_or(false, |buf| {
+                            regex::Regex::new("[A-Z]+ (.+) HTTP/1")
+                                .unwrap()
+                                .is_match(buf)
+                        })
+                    {
+                        return hyper_util::server::conn::auto::Builder::new(
+                            hyper_util::rt::TokioExecutor::new(),
+                        )
+                        .serve_connection(
+                            hyper_util::rt::TokioIo::new(stream),
+                            hyper_util::service::TowerToHyperService::new(
+                                axum::Router::new().fallback(axum::routing::method_routing::any(
+                                    move |req: Request| async move {
+                                        match async move {
+                                            let host = req
+                                                .headers()
+                                                .get(http::header::HOST)
+                                                .and_then(|host| host.to_str().ok());
+                                            let uri = Uri::from_parts({
+                                                let mut parts = req.uri().to_owned().into_parts();
+                                                parts.scheme = Some("https".parse()?);
+                                                parts.authority =
+                                                    host.map(FromStr::from_str).transpose()?;
+                                                parts
+                                            })?;
+                                            Response::builder()
+                                                .status(http::StatusCode::TEMPORARY_REDIRECT)
+                                                .header(http::header::LOCATION, uri.to_string())
+                                                .body(Body::default())
+                                        }
+                                        .await
+                                        {
                                             Ok(a) => a,
-                                            Err(cfg) => {
-                                                tracing::info!("performing ACME auth challenge");
-                                                let mut accept = mid.into_stream(Arc::new(cfg));
-                                                let io = accept.get_mut().unwrap();
-                                                let buffered = io.stop_buffering();
-                                                io.write_all(&buffered).await?;
-                                                accept.await?;
-                                                tracing::info!("ACME auth challenge completed");
-                                                return Ok(());
-                                            }
-                                        };
-                                        let mut tcp_stream =
-                                            TcpStream::connect(target.addr).await?;
-                                        match target.connect_ssl {
-                                            Ok(()) => {
-                                                let mut client_cfg =
-                                                tokio_rustls::rustls::ClientConfig::builder_with_provider(crypto_provider)
-                                                        .with_safe_default_protocol_versions()
-                                                        .with_kind(crate::ErrorKind::OpenSsl)?
-                                                        .with_root_certificates({
-                                                            let mut store = RootCertStore::empty();
-                                                            store.add(
-                                                        CertificateDer::from(
-                                                            root.to_der()?,
-                                                        ),
-                                                    ).with_kind(crate::ErrorKind::OpenSsl)?;
-                                                            store
-                                                        })
-                                                        .with_no_client_auth();
-                                                client_cfg.alpn_protocols = mid
-                                                    .client_hello()
-                                                    .alpn()
-                                                    .into_iter()
-                                                    .flatten()
-                                                    .map(|x| x.to_vec())
-                                                    .collect();
-                                                let mut target_stream =
-                                                    TlsConnector::from(Arc::new(client_cfg))
-                                                        .connect_with(
-                                                            ServerName::IpAddress(
-                                                                target.addr.ip().into(),
-                                                            ),
-                                                            tcp_stream,
-                                                            |conn| {
-                                                                cfg.alpn_protocols.extend(
-                                                                    conn.alpn_protocol()
-                                                                        .into_iter()
-                                                                        .map(|p| p.to_vec()),
-                                                                )
-                                                            },
-                                                        )
-                                                        .await
-                                                        .with_kind(crate::ErrorKind::OpenSsl)?;
-                                                let mut accept = mid.into_stream(Arc::new(cfg));
-                                                let io = accept.get_mut().unwrap();
-                                                let buffered = io.stop_buffering();
-                                                io.write_all(&buffered).await?;
-                                                let mut tls_stream =
-                                                    match accept.await {
-                                                        Ok(a) => a,
-                                                        Err(e) => {
-                                                            tracing::trace!( "VHostController: failed to accept TLS connection on port {port}: {e}");
-                                                            tracing::trace!("{e:?}");
-                                                            return Ok(())
-                                                        }
-                                                    };
-                                                tokio::io::copy_bidirectional(
-                                                    &mut tls_stream,
-                                                    &mut target_stream,
-                                                )
-                                                .await
-                                            }
-                                            Err(AlpnInfo::Reflect) => {
-                                                for proto in
-                                                    mid.client_hello().alpn().into_iter().flatten()
-                                                {
-                                                    cfg.alpn_protocols.push(proto.into());
-                                                }
-                                                let mut accept = mid.into_stream(Arc::new(cfg));
-                                                let io = accept.get_mut().unwrap();
-                                                let buffered = io.stop_buffering();
-                                                io.write_all(&buffered).await?;
-                                                let mut tls_stream =
-                                                    match accept.await {
-                                                        Ok(a) => a,
-                                                        Err(e) => {
-                                                            tracing::trace!( "VHostController: failed to accept TLS connection on port {port}: {e}");
-                                                            tracing::trace!("{e:?}");
-                                                            return Ok(())
-                                                        }
-                                                    };
-                                                tokio::io::copy_bidirectional(
-                                                    &mut tls_stream,
-                                                    &mut tcp_stream,
-                                                )
-                                                .await
-                                            }
-                                            Err(AlpnInfo::Specified(alpn)) => {
-                                                cfg.alpn_protocols = alpn.into_iter().map(|a| a.0).collect();
-                                                let mut accept = mid.into_stream(Arc::new(cfg));
-                                                let io = accept.get_mut().unwrap();
-                                                let buffered = io.stop_buffering();
-                                                io.write_all(&buffered).await?;
-                                                let mut tls_stream =
-                                                    match accept.await {
-                                                        Ok(a) => a,
-                                                        Err(e) => {
-                                                            tracing::trace!( "VHostController: failed to accept TLS connection on port {port}: {e}");
-                                                            tracing::trace!("{e:?}");
-                                                            return Ok(())
-                                                        }
-                                                    };
-                                                tokio::io::copy_bidirectional(
-                                                    &mut tls_stream,
-                                                    &mut tcp_stream,
-                                                )
-                                                .await
+                                            Err(e) => {
+                                                tracing::warn!(
+                                                "Error redirecting http request on ssl port: {e}"
+                                            );
+                                                tracing::error!("{e:?}");
+                                                server_error(Error::new(e, ErrorKind::Network))
                                             }
                                         }
-                                        .map_or_else(
-                                            |e| {
-                                                use std::io::ErrorKind as E;
-                                                match e.kind() {
-                                                    E::UnexpectedEof | E::BrokenPipe | E::ConnectionAborted | E::ConnectionReset | E::ConnectionRefused | E::TimedOut | E::Interrupted | E::NotConnected => Ok(()),
-                                                _ => Err(e),
-                                            }},
-                                            |_| Ok(()),
-                                        )?;
-                                    } else {
-                                        // 503
-                                    }
-                                    Ok::<_, Error>(())
-                                }
-                                .await
-                                {
-                                    tracing::error!("Error in VHostController on port {port}: {e}");
-                                    tracing::debug!("{e:?}")
-                                }
-                            });
+                                    },
+                                )),
+                            ),
+                        )
+                        .await
+                        .map_err(|e| {
+                            Error::new(color_eyre::eyre::Report::msg(e), ErrorKind::Network)
+                        });
+                    } else {
+                        return Err(e).with_kind(ErrorKind::Network);
+                    }
+                }
+            };
+        let target_name: Option<InternedString> =
+            mid.client_hello().server_name().map(|s| s.into());
+        if let Some(domain) = target_name.as_ref() {
+            if mid
+                .client_hello()
+                .alpn()
+                .into_iter()
+                .flatten()
+                .any(|alpn| alpn == ACME_TLS_ALPN_NAME)
+            {
+                let cert = WatchStream::new(
+                    acme_tls_alpn_cache
+                        .peek(|c| c.get(&**domain).cloned())
+                        .ok_or_else(|| {
+                            Error::new(
+                                eyre!("No challenge recv available for {domain}"),
+                                ErrorKind::OpenSsl,
+                            )
+                        })?,
+                );
+                tracing::info!("Waiting for verification cert for {domain}");
+                let cert = cert
+                    .filter(|c| c.is_some())
+                    .next()
+                    .await
+                    .flatten()
+                    .ok_or_else(|| {
+                        Error::new(
+                            eyre!("No challenge available for {domain}"),
+                            ErrorKind::OpenSsl,
+                        )
+                    })?;
+                tracing::info!("Verification cert received for {domain}");
+                let mut cfg = ServerConfig::builder_with_provider(crypto_provider.clone())
+                    .with_safe_default_protocol_versions()
+                    .with_kind(crate::ErrorKind::OpenSsl)?
+                    .with_no_client_auth()
+                    .with_cert_resolver(Arc::new(SingleCertResolver(cert)));
+
+                cfg.alpn_protocols = vec![ACME_TLS_ALPN_NAME.to_vec()];
+                tracing::info!("performing ACME auth challenge");
+                let mut accept = mid.into_stream(Arc::new(cfg));
+                let io = accept.get_mut().unwrap();
+                let buffered = io.stop_buffering();
+                io.write_all(&buffered).await?;
+                accept.await?;
+                tracing::info!("ACME auth challenge completed");
+                return Ok(());
+            }
+        }
+        let target = {
+            let m = mapping.borrow();
+            m.get(&target_name)
+                .into_iter()
+                .flatten()
+                .find(|(_, rc)| rc.strong_count() > 0)
+                .or_else(|| {
+                    if target_name
+                        .as_ref()
+                        .map(|s| s.parse::<IpAddr>().is_ok())
+                        .unwrap_or(true)
+                    {
+                        m.get(&None)
+                            .into_iter()
+                            .flatten()
+                            .find(|(_, rc)| rc.strong_count() > 0)
+                    } else {
+                        None
+                    }
+                })
+                .map(|(target, _)| target.clone())
+        };
+        if let Some(target) = target {
+            if is_public && !target.public {
+                log::warn!(
+                    "Rejecting connection from public interface to private bind: {bind} -> {target:?}"
+                );
+                return Ok(());
+            }
+            let peek = db.peek().await;
+            let root = peek
+                .as_private()
+                .as_key_store()
+                .as_local_certs()
+                .as_root_cert()
+                .de()?;
+            let mut cfg = async {
+                if let Some((domain, provider, settings)) =
+                    target_name.as_ref().and_then(|domain| {
+                        target.acme.as_ref().and_then(|a| {
+                            peek.as_public()
+                                .as_server_info()
+                                .as_acme()
+                                .as_idx(a)
+                                .map(|s| (domain, a, s))
+                        })
+                    })
+                {
+                    let acme_settings = settings.de()?;
+                    let mut identifiers = vec![Identifier::Dns(domain.to_string())];
+                    if false
+                    // Requires RFC 8738
+                    {
+                        if let Some(wan_ip) = wan_ip {
+                            identifiers.push(Identifier::Ip(wan_ip.into()));
+                        }
+                    }
+                    let (send, recv) = watch::channel(None);
+                    acme_tls_alpn_cache.mutate(|c| c.insert(domain.clone(), recv));
+                    let cert = async_acme::rustls_helper::order(
+                        |_, cert| {
+                            send.send_replace(Some(Arc::new(cert)));
+                            Ok(())
+                        },
+                        provider.0.as_str(),
+                        &identifiers,
+                        Some(&AcmeCertCache(&db)),
+                        &acme_settings.contact,
+                    )
+                    .await
+                    .with_kind(ErrorKind::OpenSsl)?;
+                    return Ok(ServerConfig::builder_with_provider(crypto_provider.clone())
+                        .with_safe_default_protocol_versions()
+                        .with_kind(crate::ErrorKind::OpenSsl)?
+                        .with_no_client_auth()
+                        .with_cert_resolver(Arc::new(SingleCertResolver(Arc::new(cert)))));
+                }
+
+                let hostnames = target_name
+                    .into_iter()
+                    .chain([InternedString::from_display(&bind.ip())])
+                    .chain(wan_ip.as_ref().map(InternedString::from_display))
+                    .collect();
+                let key = db
+                    .mutate(|v| {
+                        v.as_private_mut()
+                            .as_key_store_mut()
+                            .as_local_certs_mut()
+                            .cert_for(&hostnames)
+                    })
+                    .await?;
+                let cfg = ServerConfig::builder_with_provider(crypto_provider.clone())
+                    .with_safe_default_protocol_versions()
+                    .with_kind(crate::ErrorKind::OpenSsl)?
+                    .with_no_client_auth();
+                if mid
+                    .client_hello()
+                    .signature_schemes()
+                    .contains(&tokio_rustls::rustls::SignatureScheme::ED25519)
+                {
+                    cfg.with_single_cert(
+                        key.fullchain_ed25519()
+                            .into_iter()
+                            .map(|c| {
+                                Ok(tokio_rustls::rustls::pki_types::CertificateDer::from(
+                                    c.to_der()?,
+                                ))
+                            })
+                            .collect::<Result<_, Error>>()?,
+                        PrivateKeyDer::from(PrivatePkcs8KeyDer::from(
+                            key.leaf.keys.ed25519.private_key_to_pkcs8()?,
+                        )),
+                    )
+                } else {
+                    cfg.with_single_cert(
+                        key.fullchain_nistp256()
+                            .into_iter()
+                            .map(|c| {
+                                Ok(tokio_rustls::rustls::pki_types::CertificateDer::from(
+                                    c.to_der()?,
+                                ))
+                            })
+                            .collect::<Result<_, Error>>()?,
+                        PrivateKeyDer::from(PrivatePkcs8KeyDer::from(
+                            key.leaf.keys.nistp256.private_key_to_pkcs8()?,
+                        )),
+                    )
+                }
+                .with_kind(crate::ErrorKind::OpenSsl)
+            }
+            .await?;
+            let mut tcp_stream = TcpStream::connect(target.addr).await?;
+            match target.connect_ssl {
+                Ok(()) => {
+                    let mut client_cfg =
+                        tokio_rustls::rustls::ClientConfig::builder_with_provider(crypto_provider)
+                            .with_safe_default_protocol_versions()
+                            .with_kind(crate::ErrorKind::OpenSsl)?
+                            .with_root_certificates({
+                                let mut store = RootCertStore::empty();
+                                store
+                                    .add(CertificateDer::from(root.to_der()?))
+                                    .with_kind(crate::ErrorKind::OpenSsl)?;
+                                store
+                            })
+                            .with_no_client_auth();
+                    client_cfg.alpn_protocols = mid
+                        .client_hello()
+                        .alpn()
+                        .into_iter()
+                        .flatten()
+                        .map(|x| x.to_vec())
+                        .collect();
+                    let mut target_stream = TlsConnector::from(Arc::new(client_cfg))
+                        .connect_with(
+                            ServerName::IpAddress(target.addr.ip().into()),
+                            tcp_stream,
+                            |conn| {
+                                cfg.alpn_protocols
+                                    .extend(conn.alpn_protocol().into_iter().map(|p| p.to_vec()))
+                            },
+                        )
+                        .await
+                        .with_kind(crate::ErrorKind::OpenSsl)?;
+                    let mut accept = mid.into_stream(Arc::new(cfg));
+                    let io = accept.get_mut().unwrap();
+                    let buffered = io.stop_buffering();
+                    io.write_all(&buffered).await?;
+                    let mut tls_stream = match accept.await {
+                        Ok(a) => a,
+                        Err(e) => {
+                            tracing::trace!(
+                                "VHostController: failed to accept TLS connection on {bind}: {e}"
+                            );
+                            tracing::trace!("{e:?}");
+                            return Ok(());
+                        }
+                    };
+                    tokio::io::copy_bidirectional(&mut tls_stream, &mut target_stream).await
+                }
+                Err(AlpnInfo::Reflect) => {
+                    for proto in mid.client_hello().alpn().into_iter().flatten() {
+                        cfg.alpn_protocols.push(proto.into());
+                    }
+                    let mut accept = mid.into_stream(Arc::new(cfg));
+                    let io = accept.get_mut().unwrap();
+                    let buffered = io.stop_buffering();
+                    io.write_all(&buffered).await?;
+                    let mut tls_stream = match accept.await {
+                        Ok(a) => a,
+                        Err(e) => {
+                            tracing::trace!(
+                                "VHostController: failed to accept TLS connection on {bind}: {e}"
+                            );
+                            tracing::trace!("{e:?}");
+                            return Ok(());
                         }
+                    };
+                    tokio::io::copy_bidirectional(&mut tls_stream, &mut tcp_stream).await
+                }
+                Err(AlpnInfo::Specified(alpn)) => {
+                    cfg.alpn_protocols = alpn.into_iter().map(|a| a.0).collect();
+                    let mut accept = mid.into_stream(Arc::new(cfg));
+                    let io = accept.get_mut().unwrap();
+                    let buffered = io.stop_buffering();
+                    io.write_all(&buffered).await?;
+                    let mut tls_stream = match accept.await {
+                        Ok(a) => a,
                         Err(e) => {
                             tracing::trace!(
-                                "VHostController: failed to accept connection on port {port}: {e}"
+                                "VHostController: failed to accept TLS connection on {bind}: {e}"
                             );
                             tracing::trace!("{e:?}");
+                            return Ok(());
                         }
+                    };
+                    tokio::io::copy_bidirectional(&mut tls_stream, &mut tcp_stream).await
+                }
+            }
+            .map_or_else(
+                |e| {
+                    use std::io::ErrorKind as E;
+                    match e.kind() {
+                        E::UnexpectedEof
+                        | E::BrokenPipe
+                        | E::ConnectionAborted
+                        | E::ConnectionReset
+                        | E::ConnectionRefused
+                        | E::TimedOut
+                        | E::Interrupted
+                        | E::NotConnected => Ok(()),
+                        _ => Err(e),
+                    }
+                },
+                |_| Ok(()),
+            )?;
+        } else {
+            // 503
+        }
+        Ok::<_, Error>(())
+    }
+
+    #[instrument(skip_all)]
+    fn new(
+        port: u16,
+        db: TypedPatchDb<Database>,
+        iface_ctrl: Arc<NetworkInterfaceController>,
+        crypto_provider: Arc<CryptoProvider>,
+        acme_tls_alpn_cache: AcmeTlsAlpnCache,
+    ) -> Result<Self, Error> {
+        let mut listener = iface_ctrl.bind(port).with_kind(crate::ErrorKind::Network)?;
+        let (map_send, map_recv) = watch::channel(BTreeMap::new());
+        Ok(Self {
+            mapping: map_send,
+            _thread: tokio::spawn(async move {
+                loop {
+                    if let Err(e) = Self::accept(
+                        &mut listener,
+                        map_recv.clone(),
+                        db.clone(),
+                        acme_tls_alpn_cache.clone(),
+                        crypto_provider.clone(),
+                    )
+                    .await
+                    {
+                        tracing::error!(
+                            "VHostController: failed to accept connection on {port}: {e}"
+                        );
+                        tracing::debug!("{e:?}");
                     }
                 }
             })
             .into(),
         })
     }
-    async fn add(
-        &self,
-        hostname: Option<InternedString>,
-        target: TargetInfo,
-    ) -> Result<Arc<()>, Error> {
-        if let Some(mapping) = Weak::upgrade(&self.mapping) {
-            let mut writable = mapping.write().await;
+    fn add(&self, hostname: Option<InternedString>, target: TargetInfo) -> Result<Arc<()>, Error> {
+        let mut res = Ok(Arc::new(()));
+        self.mapping.send_if_modified(|writable| {
+            let mut changed = false;
             let mut targets = writable.remove(&hostname).unwrap_or_default();
             let rc = if let Some(rc) = Weak::upgrade(&targets.remove(&target).unwrap_or_default()) {
                 rc
             } else {
+                changed = true;
                 Arc::new(())
             };
             targets.insert(target, Arc::downgrade(&rc));
             writable.insert(hostname, targets);
-            Ok(rc)
+            res = Ok(rc);
+            changed
+        });
+        if !self.mapping.is_closed() {
+            res
         } else {
             Err(Error::new(
                 eyre!("VHost Service Thread has exited"),
@@ -542,33 +714,22 @@ impl VHostServer {
             ))
         }
     }
-    async fn gc(&self, hostname: Option<InternedString>) -> Result<(), Error> {
-        if let Some(mapping) = Weak::upgrade(&self.mapping) {
-            let mut writable = mapping.write().await;
+    fn gc(&self, hostname: Option<InternedString>) {
+        self.mapping.send_if_modified(|writable| {
             let mut targets = writable.remove(&hostname).unwrap_or_default();
+            let pre = targets.len();
             targets = targets
                 .into_iter()
                 .filter(|(_, rc)| rc.strong_count() > 0)
                 .collect();
+            let post = targets.len();
             if !targets.is_empty() {
                 writable.insert(hostname, targets);
             }
-            Ok(())
-        } else {
-            Err(Error::new(
-                eyre!("VHost Service Thread has exited"),
-                crate::ErrorKind::Network,
-            ))
-        }
+            pre == post
+        });
     }
-    async fn is_empty(&self) -> Result<bool, Error> {
-        if let Some(mapping) = Weak::upgrade(&self.mapping) {
-            Ok(mapping.read().await.is_empty())
-        } else {
-            Err(Error::new(
-                eyre!("VHost Service Thread has exited"),
-                crate::ErrorKind::Network,
-            ))
-        }
+    fn is_empty(&self) -> bool {
+        self.mapping.borrow().is_empty()
     }
 }
diff --git a/core/startos/src/net/web_server.rs b/core/startos/src/net/web_server.rs
index d1ad64d01..b38a7ee56 100644
--- a/core/startos/src/net/web_server.rs
+++ b/core/startos/src/net/web_server.rs
@@ -1,134 +1,299 @@
-use std::convert::Infallible;
+use std::future::Future;
 use std::net::SocketAddr;
+use std::ops::Deref;
+use std::sync::atomic::AtomicBool;
+use std::sync::{Arc, RwLock};
 use std::task::Poll;
 use std::time::Duration;
 
-use axum::extract::Request;
 use axum::Router;
-use axum_server::Handle;
-use bytes::Bytes;
-use futures::future::{ready, BoxFuture};
+use futures::future::{BoxFuture, Either};
 use futures::FutureExt;
 use helpers::NonDetachingJoinHandle;
+use hyper_util::rt::{TokioIo, TokioTimer};
+use hyper_util::service::TowerToHyperService;
+use tokio::net::{TcpListener, TcpStream};
 use tokio::sync::{oneshot, watch};
 
 use crate::context::{DiagnosticContext, InitContext, InstallContext, RpcContext, SetupContext};
+use crate::net::network_interface::NetworkInterfaceListener;
 use crate::net::static_server::{
-    diagnostic_ui_router, init_ui_router, install_ui_router, main_ui_router, refresher,
+    diagnostic_ui_router, init_ui_router, install_ui_router, main_ui_router, redirecter, refresher,
     setup_ui_router,
 };
 use crate::prelude::*;
+use crate::util::actor::background::BackgroundJobQueue;
 
-#[derive(Clone)]
-pub struct SwappableRouter(watch::Sender<Router>);
-impl SwappableRouter {
-    pub fn new(router: Router) -> Self {
-        Self(watch::channel(router).0)
+pub struct Accepted {
+    pub https_redirect: bool,
+    pub stream: TcpStream,
+}
+
+pub trait Accept {
+    fn poll_accept(&mut self, cx: &mut std::task::Context<'_>) -> Poll<Result<Accepted, Error>>;
+}
+
+impl Accept for Vec<TcpListener> {
+    fn poll_accept(&mut self, cx: &mut std::task::Context<'_>) -> Poll<Result<Accepted, Error>> {
+        for listener in &*self {
+            if let Poll::Ready((stream, _)) = listener.poll_accept(cx)? {
+                return Poll::Ready(Ok(Accepted {
+                    https_redirect: false,
+                    stream,
+                }));
+            }
+        }
+        Poll::Pending
     }
-    pub fn swap(&self, router: Router) {
-        let _ = self.0.send_replace(router);
+}
+impl Accept for NetworkInterfaceListener {
+    fn poll_accept(&mut self, cx: &mut std::task::Context<'_>) -> Poll<Result<Accepted, Error>> {
+        NetworkInterfaceListener::poll_accept(self, cx, true).map(|res| {
+            res.map(|a| Accepted {
+                https_redirect: a.is_public,
+                stream: a.stream,
+            })
+        })
     }
 }
 
-pub struct SwappableRouterService {
-    router: watch::Receiver<Router>,
+impl<A: Accept, B: Accept> Accept for Either<A, B> {
+    fn poll_accept(&mut self, cx: &mut std::task::Context<'_>) -> Poll<Result<Accepted, Error>> {
+        match self {
+            Either::Left(a) => a.poll_accept(cx),
+            Either::Right(b) => b.poll_accept(cx),
+        }
+    }
+}
+impl<A: Accept> Accept for Option<A> {
+    fn poll_accept(&mut self, cx: &mut std::task::Context<'_>) -> Poll<Result<Accepted, Error>> {
+        match self {
+            None => Poll::Pending,
+            Some(a) => a.poll_accept(cx),
+        }
+    }
+}
+
+#[pin_project::pin_project]
+pub struct Acceptor<A: Accept> {
+    acceptor: (watch::Sender<A>, watch::Receiver<A>),
     changed: Option<BoxFuture<'static, ()>>,
 }
-impl SwappableRouterService {
-    fn router(&self) -> Router {
-        self.router.borrow().clone()
+impl<A: Accept + Send + Sync + 'static> Acceptor<A> {
+    pub fn new(acceptor: A) -> Self {
+        Self {
+            acceptor: watch::channel(acceptor),
+            changed: None,
+        }
     }
-    fn changed(&mut self, cx: &mut std::task::Context<'_>) -> Poll<()> {
+
+    fn poll_changed(&mut self, cx: &mut std::task::Context<'_>) -> Poll<()> {
         let mut changed = if let Some(changed) = self.changed.take() {
             changed
         } else {
-            let mut router = self.router.clone();
+            let mut recv = self.acceptor.1.clone();
             async move {
-                router.changed().await;
+                let _ = recv.changed().await;
             }
             .boxed()
         };
-        if changed.poll_unpin(cx).is_ready() {
-            return Poll::Ready(());
+        let res = changed.poll_unpin(cx);
+        if res.is_pending() {
+            self.changed = Some(changed);
         }
-        self.changed = Some(changed);
-        Poll::Pending
+        res
     }
-}
-impl Clone for SwappableRouterService {
-    fn clone(&self) -> Self {
-        Self {
-            router: self.router.clone(),
-            changed: None,
-        }
+
+    fn poll_accept(&mut self, cx: &mut std::task::Context<'_>) -> Poll<Result<Accepted, Error>> {
+        let _ = self.poll_changed(cx);
+        let mut res = Poll::Pending;
+        self.acceptor.0.send_if_modified(|a| {
+            res = a.poll_accept(cx);
+            false
+        });
+        res
+    }
+
+    async fn accept(&mut self) -> Result<Accepted, Error> {
+        std::future::poll_fn(|cx| self.poll_accept(cx)).await
     }
 }
-impl<B> tower_service::Service<Request<B>> for SwappableRouterService
-where
-    B: axum::body::HttpBody<Data = Bytes> + Send + 'static,
-    B::Error: Into<axum::BoxError>,
-{
-    type Response = <Router as tower_service::Service<Request<B>>>::Response;
-    type Error = <Router as tower_service::Service<Request<B>>>::Error;
-    type Future = <Router as tower_service::Service<Request<B>>>::Future;
-    #[inline]
-    fn poll_ready(&mut self, cx: &mut std::task::Context<'_>) -> Poll<Result<(), Self::Error>> {
-        if self.changed(cx).is_ready() {
-            return Poll::Ready(Ok(()));
-        }
-        tower_service::Service::<Request<B>>::poll_ready(&mut self.router(), cx)
+impl Acceptor<Vec<TcpListener>> {
+    pub async fn bind(listen: impl IntoIterator<Item = SocketAddr>) -> Result<Self, Error> {
+        Ok(Self::new(
+            futures::future::try_join_all(listen.into_iter().map(TcpListener::bind)).await?,
+        ))
     }
-    fn call(&mut self, req: Request<B>) -> Self::Future {
-        self.router().call(req)
+}
+
+pub type UpgradableListener = Option<Either<Vec<TcpListener>, NetworkInterfaceListener>>;
+
+impl Acceptor<UpgradableListener> {
+    pub async fn bind_upgradable(
+        listen: impl IntoIterator<Item = SocketAddr>,
+    ) -> Result<Self, Error> {
+        Ok(Self::new(Some(Either::Left(
+            futures::future::try_join_all(listen.into_iter().map(TcpListener::bind)).await?,
+        ))))
     }
 }
 
-impl<T> tower_service::Service<T> for SwappableRouter {
-    type Response = SwappableRouterService;
-    type Error = Infallible;
-    type Future = futures::future::Ready<Result<Self::Response, Self::Error>>;
-    #[inline]
-    fn poll_ready(
-        &mut self,
-        _: &mut std::task::Context<'_>,
-    ) -> std::task::Poll<Result<(), Self::Error>> {
-        Poll::Ready(Ok(()))
-    }
-    fn call(&mut self, _: T) -> Self::Future {
-        ready(Ok(SwappableRouterService {
-            router: self.0.subscribe(),
-            changed: None,
-        }))
+pub struct WebServerAcceptorSetter<A: Accept> {
+    acceptor: watch::Sender<A>,
+}
+impl<A: Accept, B: Accept> WebServerAcceptorSetter<Option<Either<A, B>>> {
+    pub fn try_upgrade<F: FnOnce(A) -> Result<B, Error>>(&self, f: F) -> Result<(), Error> {
+        let mut res = Ok(());
+        self.acceptor.send_modify(|a| {
+            *a = match a.take() {
+                Some(Either::Left(a)) => match f(a) {
+                    Ok(b) => Some(Either::Right(b)),
+                    Err(e) => {
+                        res = Err(e);
+                        None
+                    }
+                },
+                x => x,
+            }
+        });
+        res
+    }
+}
+impl<A: Accept> Deref for WebServerAcceptorSetter<A> {
+    type Target = watch::Sender<A>;
+    fn deref(&self) -> &Self::Target {
+        &self.acceptor
     }
 }
 
-pub struct WebServer {
+pub struct WebServer<A: Accept> {
     shutdown: oneshot::Sender<()>,
-    router: SwappableRouter,
+    router: watch::Sender<Option<Router>>,
+    acceptor: watch::Sender<A>,
     thread: NonDetachingJoinHandle<()>,
 }
-impl WebServer {
-    pub fn new(bind: SocketAddr) -> Self {
-        let router = SwappableRouter::new(refresher());
-        let thread_router = router.clone();
+impl<A: Accept + Send + Sync + 'static> WebServer<A> {
+    pub fn acceptor_setter(&self) -> WebServerAcceptorSetter<A> {
+        WebServerAcceptorSetter {
+            acceptor: self.acceptor.clone(),
+        }
+    }
+
+    pub fn new(mut acceptor: Acceptor<A>) -> Self {
+        let acceptor_send = acceptor.acceptor.0.clone();
+        let (router, service) = watch::channel::<Option<Router>>(None);
         let (shutdown, shutdown_recv) = oneshot::channel();
         let thread = NonDetachingJoinHandle::from(tokio::spawn(async move {
-            let handle = Handle::new();
-            let mut server = axum_server::bind(bind).handle(handle.clone());
-            server.http_builder().http1().preserve_header_case(true);
-            server.http_builder().http1().title_case_headers(true);
-
-            if let (Err(e), _) = tokio::join!(server.serve(thread_router), async {
-                let _ = shutdown_recv.await;
-                handle.graceful_shutdown(Some(Duration::from_secs(0)));
-            }) {
-                tracing::error!("Spawning hyper server error: {}", e);
+            #[derive(Clone)]
+            struct QueueRunner {
+                queue: Arc<RwLock<Option<BackgroundJobQueue>>>,
+            }
+            impl<Fut> hyper::rt::Executor<Fut> for QueueRunner
+            where
+                Fut: Future + Send + 'static,
+            {
+                fn execute(&self, fut: Fut) {
+                    if let Some(q) = &*self.queue.read().unwrap() {
+                        q.add_job(fut);
+                    } else {
+                        tracing::warn!("job queued after shutdown");
+                    }
+                }
+            }
+
+            let accept = AtomicBool::new(true);
+            let queue_cell = Arc::new(RwLock::new(None));
+            let graceful = hyper_util::server::graceful::GracefulShutdown::new();
+            let mut server = hyper_util::server::conn::auto::Builder::new(QueueRunner {
+                queue: queue_cell.clone(),
+            });
+            server
+                .http1()
+                .timer(TokioTimer::new())
+                .title_case_headers(true)
+                .preserve_header_case(true)
+                .http2()
+                .timer(TokioTimer::new())
+                .enable_connect_protocol()
+                .keep_alive_interval(Duration::from_secs(60))
+                .keep_alive_timeout(Duration::from_secs(300));
+            let (queue, mut runner) = BackgroundJobQueue::new();
+            *queue_cell.write().unwrap() = Some(queue.clone());
+
+            let handler = async {
+                loop {
+                    if let Err(e) = async {
+                        let accepted = acceptor.accept().await?;
+                        if accepted.https_redirect {
+                            queue.add_job(
+                                graceful.watch(
+                                    server
+                                        .serve_connection_with_upgrades(
+                                            TokioIo::new(accepted.stream),
+                                            TowerToHyperService::new(redirecter().into_service()),
+                                        )
+                                        .into_owned(),
+                                ),
+                            );
+                        } else {
+                            let service = { service.borrow().clone() };
+                            if let Some(service) = service {
+                                queue.add_job(
+                                    graceful.watch(
+                                        server
+                                            .serve_connection_with_upgrades(
+                                                TokioIo::new(accepted.stream),
+                                                TowerToHyperService::new(service.into_service()),
+                                            )
+                                            .into_owned(),
+                                    ),
+                                );
+                            } else {
+                                queue.add_job(
+                                    graceful.watch(
+                                        server
+                                            .serve_connection_with_upgrades(
+                                                TokioIo::new(accepted.stream),
+                                                TowerToHyperService::new(
+                                                    refresher().into_service(),
+                                                ),
+                                            )
+                                            .into_owned(),
+                                    ),
+                                );
+                            }
+                        }
+
+                        Ok::<_, Error>(())
+                    }
+                    .await
+                    {
+                        tracing::error!("Error accepting HTTP connection: {e}");
+                        tracing::debug!("{e:?}");
+                    }
+                }
+            }
+            .boxed();
+
+            tokio::select! {
+                _ = shutdown_recv => (),
+                _ = handler => (),
+                _ = &mut runner => (),
+            }
+
+            accept.store(false, std::sync::atomic::Ordering::SeqCst);
+            drop(queue);
+            drop(queue_cell.write().unwrap().take());
+
+            if !runner.is_empty() {
+                runner.await;
             }
         }));
         Self {
             shutdown,
             router,
             thread,
+            acceptor: acceptor_send,
         }
     }
 
@@ -138,7 +303,7 @@ impl WebServer {
     }
 
     pub fn serve_router(&mut self, router: Router) {
-        self.router.swap(router)
+        self.router.send_replace(Some(router));
     }
 
     pub fn serve_main(&mut self, ctx: RpcContext) {
diff --git a/core/startos/src/net/wifi.rs b/core/startos/src/net/wifi.rs
index 056a403de..b2e59c20f 100644
--- a/core/startos/src/net/wifi.rs
+++ b/core/startos/src/net/wifi.rs
@@ -298,7 +298,7 @@ fn display_wifi_info(params: WithIoFormat<Empty>, info: WifiListInfo) {
     let mut table_global = Table::new();
     table_global.add_row(row![bc =>
         "CONNECTED",
-        "SIGNAL_STRENGTH",
+        "SIGNAL STRENGTH",
         "COUNTRY",
         "ETHERNET",
     ]);
@@ -306,12 +306,12 @@ fn display_wifi_info(params: WithIoFormat<Empty>, info: WifiListInfo) {
         &info
             .connected
             .as_ref()
-            .map_or("[N/A]".to_owned(), |c| c.0.clone()),
+            .map_or("N/A".to_owned(), |c| c.0.clone()),
         &info
             .connected
             .as_ref()
             .and_then(|x| info.ssids.get(x))
-            .map_or("[N/A]".to_owned(), |ss| format!("{}", ss.0)),
+            .map_or("N/A".to_owned(), |ss| format!("{}", ss.0)),
         info.country.as_ref().map(|c| c.alpha2()).unwrap_or("00"),
         &format!("{}", info.ethernet)
     ]);
@@ -897,32 +897,29 @@ impl TypedValueParser for CountryCodeParser {
 }
 
 #[instrument(skip_all)]
-pub async fn synchronize_wpa_supplicant_conf<P: AsRef<Path>>(
+pub async fn synchronize_network_manager<P: AsRef<Path>>(
     main_datadir: P,
     wifi: &mut WifiInfo,
 ) -> Result<(), Error> {
     wifi.interface = find_wifi_iface().await?;
-    let Some(wifi_iface) = &wifi.interface else {
-        return Ok(());
-    };
     let persistent = main_datadir.as_ref().join("system-connections");
-    tracing::debug!("persistent: {:?}", persistent);
-    // let supplicant = Path::new("/etc/wpa_supplicant.conf");
 
     if tokio::fs::metadata(&persistent).await.is_err() {
         tokio::fs::create_dir_all(&persistent).await?;
     }
     crate::disk::mount::util::bind(&persistent, "/etc/NetworkManager/system-connections", false)
         .await?;
-    // if tokio::fs::metadata(&supplicant).await.is_err() {
-    //     tokio::fs::write(&supplicant, include_str!("wpa_supplicant.conf.base")).await?;
-    // }
 
     Command::new("systemctl")
         .arg("restart")
         .arg("NetworkManager")
         .invoke(ErrorKind::Wifi)
         .await?;
+
+    let Some(wifi_iface) = &wifi.interface else {
+        return Ok(());
+    };
+
     Command::new("ifconfig")
         .arg(wifi_iface)
         .arg("up")
diff --git a/core/startos/src/notifications.rs b/core/startos/src/notifications.rs
index 4b45531a4..3ac09de0f 100644
--- a/core/startos/src/notifications.rs
+++ b/core/startos/src/notifications.rs
@@ -13,11 +13,11 @@ use serde::{Deserialize, Serialize};
 use tracing::instrument;
 use ts_rs::TS;
 
+use crate::backup::BackupReport;
 use crate::context::{CliContext, RpcContext};
 use crate::db::model::DatabaseModel;
 use crate::prelude::*;
 use crate::util::serde::HandlerExtSerde;
-use crate::{backup::BackupReport, db::model::Database};
 
 // #[command(subcommands(list, delete, delete_before, create))]
 pub fn notification<C: Context>() -> ParentHandler<C> {
diff --git a/core/startos/src/prelude.rs b/core/startos/src/prelude.rs
index dddc1ecda..702d77c2d 100644
--- a/core/startos/src/prelude.rs
+++ b/core/startos/src/prelude.rs
@@ -6,3 +6,20 @@ pub use tracing::instrument;
 pub use crate::db::prelude::*;
 pub use crate::ensure_code;
 pub use crate::error::{Error, ErrorCollection, ErrorKind, ResultExt};
+
+#[macro_export]
+macro_rules! dbg {
+    () => {{
+        tracing::debug!("[{}:{}:{}]", file!(), line!(), column!());
+    }};
+    ($e:expr) => {{
+        let e = $e;
+        tracing::debug!("[{}:{}:{}] {} = {e:?}", file!(), line!(), column!(), stringify!($e));
+        e
+    }};
+    ($($e:expr),+) => {
+        ($(
+            crate::dbg!($e)
+        ),+)
+    }
+}
diff --git a/core/startos/src/registry/context.rs b/core/startos/src/registry/context.rs
index 16c6465ed..d78fde50e 100644
--- a/core/startos/src/registry/context.rs
+++ b/core/startos/src/registry/context.rs
@@ -19,7 +19,6 @@ use crate::context::config::{ContextConfig, CONFIG_PATH};
 use crate::context::{CliContext, RpcContext};
 use crate::prelude::*;
 use crate::registry::auth::{SignatureHeader, AUTH_SIG_HEADER};
-use crate::registry::device_info::{DeviceInfo, DEVICE_INFO_HEADER};
 use crate::registry::signer::sign::AnySigningKey;
 use crate::registry::RegistryDatabase;
 use crate::rpc_continuations::RpcContinuations;
diff --git a/core/startos/src/registry/mod.rs b/core/startos/src/registry/mod.rs
index 0cbbce4e0..4e1411ea9 100644
--- a/core/startos/src/registry/mod.rs
+++ b/core/startos/src/registry/mod.rs
@@ -2,7 +2,6 @@ use std::collections::{BTreeMap, BTreeSet};
 
 use axum::Router;
 use futures::future::ready;
-use imbl_value::InternedString;
 use models::DataUrl;
 use rpc_toolkit::{from_fn_async, Context, HandlerExt, ParentHandler, Server};
 use serde::{Deserialize, Serialize};
@@ -11,13 +10,13 @@ use ts_rs::TS;
 use crate::context::CliContext;
 use crate::middleware::cors::Cors;
 use crate::net::static_server::{bad_request, not_found, server_error};
-use crate::net::web_server::WebServer;
+use crate::net::web_server::{Accept, WebServer};
 use crate::prelude::*;
 use crate::registry::auth::Auth;
 use crate::registry::context::RegistryContext;
 use crate::registry::device_info::DeviceInfoMiddleware;
 use crate::registry::os::index::OsIndex;
-use crate::registry::package::index::{Category, PackageIndex};
+use crate::registry::package::index::PackageIndex;
 use crate::registry::signer::SignerInfo;
 use crate::rpc_continuations::Guid;
 use crate::util::serde::HandlerExtSerde;
@@ -144,7 +143,7 @@ pub fn registry_router(ctx: RegistryContext) -> Router {
         )
 }
 
-impl WebServer {
+impl<A: Accept + Send + Sync + 'static> WebServer<A> {
     pub fn serve_registry(&mut self, ctx: RegistryContext) {
         self.serve_router(registry_router(ctx))
     }
diff --git a/core/startos/src/registry/package/index.rs b/core/startos/src/registry/package/index.rs
index 428200165..9973bae7e 100644
--- a/core/startos/src/registry/package/index.rs
+++ b/core/startos/src/registry/package/index.rs
@@ -72,7 +72,6 @@ pub struct PackageVersionInfo {
     pub icon: DataUrl<'static>,
     pub description: Description,
     pub release_notes: String,
-    #[ts(type = "string")]
     pub git_hash: GitHash,
     #[ts(type = "string")]
     pub license: InternedString,
diff --git a/core/startos/src/registry/signer/commitment/merkle_archive.rs b/core/startos/src/registry/signer/commitment/merkle_archive.rs
index 1b9d7d1e0..b27fb7ef4 100644
--- a/core/startos/src/registry/signer/commitment/merkle_archive.rs
+++ b/core/startos/src/registry/signer/commitment/merkle_archive.rs
@@ -24,10 +24,10 @@ impl MerkleArchiveCommitment {
     pub fn from_query(query: &str) -> Result<Option<Self>, Error> {
         let mut root_sighash = None;
         let mut root_maxsize = None;
-        for (k, v) in form_urlencoded::parse(dbg!(query).as_bytes()) {
+        for (k, v) in form_urlencoded::parse(query.as_bytes()) {
             match &*k {
                 "rootSighash" => {
-                    root_sighash = Some(dbg!(v).parse()?);
+                    root_sighash = Some(v.parse()?);
                 }
                 "rootMaxsize" => {
                     root_maxsize = Some(v.parse()?);
diff --git a/core/startos/src/s9pk/git_hash.rs b/core/startos/src/s9pk/git_hash.rs
index 02f83bf4a..762ef8704 100644
--- a/core/startos/src/s9pk/git_hash.rs
+++ b/core/startos/src/s9pk/git_hash.rs
@@ -1,11 +1,13 @@
 use std::path::Path;
 
 use tokio::process::Command;
+use ts_rs::TS;
 
 use crate::prelude::*;
 use crate::util::Invoke;
 
-#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Debug, serde::Serialize, serde::Deserialize, TS)]
+#[ts(type = "string")]
 pub struct GitHash(String);
 
 impl GitHash {
@@ -31,6 +33,31 @@ impl GitHash {
         }
         Ok(GitHash(hash))
     }
+    pub fn load_sync() -> Option<GitHash> {
+        let mut hash = String::from_utf8(
+            std::process::Command::new("git")
+                .arg("rev-parse")
+                .arg("HEAD")
+                .output()
+                .ok()?
+                .stdout,
+        )
+        .ok()?;
+        if !std::process::Command::new("git")
+            .arg("diff-index")
+            .arg("--quiet")
+            .arg("HEAD")
+            .arg("--")
+            .output()
+            .ok()?
+            .status
+            .success()
+        {
+            hash += "-modified";
+        }
+
+        Some(GitHash(hash))
+    }
 }
 
 impl AsRef<str> for GitHash {
diff --git a/core/startos/src/s9pk/v2/manifest.rs b/core/startos/src/s9pk/v2/manifest.rs
index 85f3cd796..11ea0d9af 100644
--- a/core/startos/src/s9pk/v2/manifest.rs
+++ b/core/startos/src/s9pk/v2/manifest.rs
@@ -3,7 +3,6 @@ use std::path::Path;
 
 use color_eyre::eyre::eyre;
 use exver::{Version, VersionRange};
-use helpers::const_true;
 use imbl_value::InternedString;
 pub use models::PackageId;
 use models::{mime, ImageId, VolumeId};
@@ -62,8 +61,8 @@ pub struct Manifest {
     pub dependencies: Dependencies,
     #[serde(default)]
     pub hardware_requirements: HardwareRequirements,
-    #[serde(default)]
-    #[ts(type = "string | null")]
+    #[ts(optional)]
+    #[serde(default = "GitHash::load_sync")]
     pub git_hash: Option<GitHash>,
     #[serde(default = "current_version")]
     #[ts(type = "string")]
diff --git a/core/startos/src/service/effects/callbacks.rs b/core/startos/src/service/effects/callbacks.rs
index 65eb707d8..19946672c 100644
--- a/core/startos/src/service/effects/callbacks.rs
+++ b/core/startos/src/service/effects/callbacks.rs
@@ -294,7 +294,7 @@ impl CallbackHandler {
         }
     }
     pub async fn call(mut self, args: Vector<Value>) -> Result<(), Error> {
-        dbg!(eyre!("callback fired: {}", self.handle.is_active()));
+        crate::dbg!(eyre!("callback fired: {}", self.handle.is_active()));
         if let Some(seed) = self.seed.upgrade() {
             seed.persistent_container
                 .callback(self.handle.take(), args)
diff --git a/core/startos/src/service/effects/mod.rs b/core/startos/src/service/effects/mod.rs
index f68985268..e9df6f9f2 100644
--- a/core/startos/src/service/effects/mod.rs
+++ b/core/startos/src/service/effects/mod.rs
@@ -130,10 +130,6 @@ pub fn handler<C: Context>() -> ParentHandler<C> {
             "get-host-info",
             from_fn_async(net::host::get_host_info).no_cli(),
         )
-        .subcommand(
-            "get-primary-url",
-            from_fn_async(net::host::get_primary_url).no_cli(),
-        )
         .subcommand(
             "get-container-ip",
             from_fn_async(net::info::get_container_ip).no_cli(),
diff --git a/core/startos/src/service/effects/net/bind.rs b/core/startos/src/service/effects/net/bind.rs
index 5619375eb..2f3edb07b 100644
--- a/core/startos/src/service/effects/net/bind.rs
+++ b/core/startos/src/service/effects/net/bind.rs
@@ -1,6 +1,6 @@
 use models::{HostId, PackageId};
 
-use crate::net::host::binding::{BindId, BindOptions, LanInfo};
+use crate::net::host::binding::{BindId, BindOptions, NetInfo};
 use crate::net::host::HostKind;
 use crate::service::effects::prelude::*;
 
@@ -53,15 +53,36 @@ pub struct GetServicePortForwardParams {
     #[ts(optional)]
     package_id: Option<PackageId>,
     host_id: HostId,
-    internal_port: u32,
+    internal_port: u16,
 }
 pub async fn get_service_port_forward(
     context: EffectContext,
-    data: GetServicePortForwardParams,
-) -> Result<LanInfo, Error> {
-    let internal_port = data.internal_port as u16;
-
+    GetServicePortForwardParams {
+        package_id,
+        host_id,
+        internal_port,
+    }: GetServicePortForwardParams,
+) -> Result<NetInfo, Error> {
     let context = context.deref()?;
-    let net_service = context.seed.persistent_container.net_service.lock().await;
-    net_service.get_lan_port(data.host_id, internal_port)
+
+    let package_id = package_id.unwrap_or_else(|| context.seed.id.clone());
+
+    Ok(context
+        .seed
+        .ctx
+        .db
+        .peek()
+        .await
+        .as_public()
+        .as_package_data()
+        .as_idx(&package_id)
+        .or_not_found(&package_id)?
+        .as_hosts()
+        .as_idx(&host_id)
+        .or_not_found(&host_id)?
+        .as_bindings()
+        .de()?
+        .get(&internal_port)
+        .or_not_found(lazy_format!("binding for port {internal_port}"))?
+        .net)
 }
diff --git a/core/startos/src/service/effects/net/host.rs b/core/startos/src/service/effects/net/host.rs
index d320e7fe9..570d5033d 100644
--- a/core/startos/src/service/effects/net/host.rs
+++ b/core/startos/src/service/effects/net/host.rs
@@ -1,35 +1,10 @@
 use models::{HostId, PackageId};
 
-use crate::net::host::address::HostAddress;
 use crate::net::host::Host;
 use crate::service::effects::callbacks::CallbackHandler;
 use crate::service::effects::prelude::*;
 use crate::service::rpc::CallbackId;
 
-#[derive(Debug, Clone, Serialize, Deserialize, TS)]
-#[ts(export)]
-#[serde(rename_all = "camelCase")]
-pub struct GetPrimaryUrlParams {
-    #[ts(optional)]
-    package_id: Option<PackageId>,
-    host_id: HostId,
-    #[ts(optional)]
-    callback: Option<CallbackId>,
-}
-pub async fn get_primary_url(
-    context: EffectContext,
-    GetPrimaryUrlParams {
-        package_id,
-        host_id,
-        callback,
-    }: GetPrimaryUrlParams,
-) -> Result<Option<HostAddress>, Error> {
-    let context = context.deref()?;
-    let package_id = package_id.unwrap_or_else(|| context.seed.id.clone());
-
-    Ok(None) // TODO
-}
-
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export)]
diff --git a/core/startos/src/service/effects/net/interface.rs b/core/startos/src/service/effects/net/interface.rs
index 44258c36a..5de9638c4 100644
--- a/core/startos/src/service/effects/net/interface.rs
+++ b/core/startos/src/service/effects/net/interface.rs
@@ -15,7 +15,6 @@ pub struct ExportServiceInterfaceParams {
     id: ServiceInterfaceId,
     name: String,
     description: String,
-    has_primary: bool,
     masked: bool,
     address_info: AddressInfo,
     r#type: ServiceInterfaceType,
@@ -26,7 +25,6 @@ pub async fn export_service_interface(
         id,
         name,
         description,
-        has_primary,
         masked,
         address_info,
         r#type,
@@ -39,7 +37,6 @@ pub async fn export_service_interface(
         id: id.clone(),
         name,
         description,
-        has_primary,
         masked,
         address_info,
         interface_type: r#type,
diff --git a/core/startos/src/service/effects/net/ssl.rs b/core/startos/src/service/effects/net/ssl.rs
index d37a2d241..66b4fa1e6 100644
--- a/core/startos/src/service/effects/net/ssl.rs
+++ b/core/startos/src/service/effects/net/ssl.rs
@@ -51,10 +51,16 @@ pub async fn get_ssl_certificate(
                 .iter()
                 .map(|(_, m)| m.as_hosts().as_entries())
                 .flatten_ok()
-                .map_ok(|(_, m)| m.as_addresses().de())
+                .map_ok(|(_, m)| {
+                    Ok(m.as_onions()
+                        .de()?
+                        .iter()
+                        .map(InternedString::from_display)
+                        .chain(m.as_domains().keys()?)
+                        .collect::<Vec<_>>())
+                })
                 .map(|a| a.and_then(|a| a))
                 .flatten_ok()
-                .map_ok(|a| InternedString::from_display(&a))
                 .try_collect::<_, BTreeSet<_>, _>()?;
             for hostname in &hostnames {
                 if let Some(internal) = hostname
@@ -135,10 +141,16 @@ pub async fn get_ssl_key(
                 .into_iter()
                 .map(|m| m.as_hosts().as_entries())
                 .flatten_ok()
-                .map_ok(|(_, m)| m.as_addresses().de())
+                .map_ok(|(_, m)| {
+                    Ok(m.as_onions()
+                        .de()?
+                        .iter()
+                        .map(InternedString::from_display)
+                        .chain(m.as_domains().keys()?)
+                        .collect::<Vec<_>>())
+                })
                 .map(|a| a.and_then(|a| a))
                 .flatten_ok()
-                .map_ok(|a| InternedString::from_display(&a))
                 .try_collect::<_, BTreeSet<_>, _>()?;
             for hostname in &hostnames {
                 if let Some(internal) = hostname
diff --git a/core/startos/src/service/effects/store.rs b/core/startos/src/service/effects/store.rs
index 1d4a07086..39166c333 100644
--- a/core/startos/src/service/effects/store.rs
+++ b/core/startos/src/service/effects/store.rs
@@ -26,7 +26,7 @@ pub async fn get_store(
         callback,
     }: GetStoreParams,
 ) -> Result<Value, Error> {
-    dbg!(&callback);
+    crate::dbg!(&callback);
     let context = context.deref()?;
     let peeked = context.seed.ctx.db.peek().await;
     let package_id = package_id.unwrap_or(context.seed.id.clone());
diff --git a/core/startos/src/service/effects/subcontainer/mod.rs b/core/startos/src/service/effects/subcontainer/mod.rs
index 65fcbd387..943c70dbf 100644
--- a/core/startos/src/service/effects/subcontainer/mod.rs
+++ b/core/startos/src/service/effects/subcontainer/mod.rs
@@ -4,12 +4,11 @@ use imbl_value::InternedString;
 use models::ImageId;
 use tokio::process::Command;
 
+use crate::disk::mount::filesystem::overlayfs::OverlayGuard;
 use crate::rpc_continuations::Guid;
 use crate::service::effects::prelude::*;
+use crate::service::persistent_container::Subcontainer;
 use crate::util::Invoke;
-use crate::{
-    disk::mount::filesystem::overlayfs::OverlayGuard, service::persistent_container::Subcontainer,
-};
 
 #[cfg(feature = "container-runtime")]
 mod sync;
diff --git a/core/startos/src/service/mod.rs b/core/startos/src/service/mod.rs
index d73c51beb..6242e3b12 100644
--- a/core/startos/src/service/mod.rs
+++ b/core/startos/src/service/mod.rs
@@ -149,10 +149,10 @@ impl ServiceRef {
                                     .values()
                                     .flat_map(|h| h.bindings.values())
                                     .flat_map(|b| {
-                                        b.lan
+                                        b.net
                                             .assigned_port
                                             .into_iter()
-                                            .chain(b.lan.assigned_ssl_port)
+                                            .chain(b.net.assigned_ssl_port)
                                     }),
                             );
                             Ok(())
@@ -934,7 +934,6 @@ pub async fn attach(
                                 .with_kind(ErrorKind::Network)?;
                             current_out = "stdout";
                         }
-                        dbg!(&current_out);
                         ws.send(Message::Binary(out))
                             .await
                             .with_kind(ErrorKind::Network)?;
@@ -948,7 +947,6 @@ pub async fn attach(
                                 .with_kind(ErrorKind::Network)?;
                             current_out = "stderr";
                         }
-                        dbg!(&current_out);
                         ws.send(Message::Binary(err))
                             .await
                             .with_kind(ErrorKind::Network)?;
diff --git a/core/startos/src/service/persistent_container.rs b/core/startos/src/service/persistent_container.rs
index 13cb7688c..c99e1cac6 100644
--- a/core/startos/src/service/persistent_container.rs
+++ b/core/startos/src/service/persistent_container.rs
@@ -452,7 +452,7 @@ impl PersistentContainer {
     #[instrument(skip_all)]
     pub async fn exit(mut self) -> Result<(), Error> {
         if let Some(destroy) = self.destroy(false) {
-            dbg!(destroy.await)?;
+            destroy.await?;
         }
         tracing::info!("Service for {} exited", self.s9pk.as_manifest().id);
 
diff --git a/core/startos/src/service/rpc.rs b/core/startos/src/service/rpc.rs
index f008de5c7..61eb5d592 100644
--- a/core/startos/src/service/rpc.rs
+++ b/core/startos/src/service/rpc.rs
@@ -155,7 +155,7 @@ impl serde::Serialize for Sandbox {
 pub struct CallbackId(u64);
 impl CallbackId {
     pub fn register(self, container: &PersistentContainer) -> CallbackHandle {
-        dbg!(eyre!(
+        crate::dbg!(eyre!(
             "callback {} registered for {}",
             self.0,
             container.s9pk.as_manifest().id
diff --git a/core/startos/src/service/transition/backup.rs b/core/startos/src/service/transition/backup.rs
index 0d4116078..6205cdd61 100644
--- a/core/startos/src/service/transition/backup.rs
+++ b/core/startos/src/service/transition/backup.rs
@@ -15,6 +15,7 @@ use crate::service::ServiceActor;
 use crate::util::actor::background::BackgroundJobQueue;
 use crate::util::actor::{ConflictBuilder, Handler};
 use crate::util::future::RemoteCancellable;
+use crate::util::serde::NoOutput;
 
 pub(in crate::service) struct Backup {
     pub path: PathBuf,
@@ -48,7 +49,7 @@ impl Handler<Backup> for ServiceActor {
                 .mount_backup(path, ReadWrite)
                 .await?;
             seed.persistent_container
-                .execute(id, ProcedureName::CreateBackup, Value::Null, None)
+                .execute::<NoOutput>(id, ProcedureName::CreateBackup, Value::Null, None)
                 .await?;
             backup_guard.unmount(true).await?;
 
diff --git a/core/startos/src/service/transition/restore.rs b/core/startos/src/service/transition/restore.rs
index 1c4020ea4..7061b0c1e 100644
--- a/core/startos/src/service/transition/restore.rs
+++ b/core/startos/src/service/transition/restore.rs
@@ -11,6 +11,7 @@ use crate::service::ServiceActor;
 use crate::util::actor::background::BackgroundJobQueue;
 use crate::util::actor::{ConflictBuilder, Handler};
 use crate::util::future::RemoteCancellable;
+use crate::util::serde::NoOutput;
 
 pub(in crate::service) struct Restore {
     pub path: PathBuf,
@@ -38,7 +39,7 @@ impl Handler<Restore> for ServiceActor {
                     .mount_backup(path, ReadOnly)
                     .await?;
                 seed.persistent_container
-                    .execute(id, ProcedureName::RestoreBackup, Value::Null, None)
+                    .execute::<NoOutput>(id, ProcedureName::RestoreBackup, Value::Null, None)
                     .await?;
                 backup_guard.unmount(true).await?;
 
@@ -48,7 +49,7 @@ impl Handler<Restore> for ServiceActor {
                 Ok::<_, Error>(())
             }
             .map(|x| {
-                if let Err(err) = dbg!(x) {
+                if let Err(err) = x {
                     tracing::debug!("{:?}", err);
                     tracing::warn!("{}", err);
                 }
diff --git a/core/startos/src/setup.rs b/core/startos/src/setup.rs
index 1319ffae4..f2aba4328 100644
--- a/core/startos/src/setup.rs
+++ b/core/startos/src/setup.rs
@@ -80,7 +80,7 @@ async fn setup_init(
     password: Option<String>,
     init_phases: InitPhases,
 ) -> Result<(AccountInfo, PreInitNetController), Error> {
-    let InitResult { net_ctrl } = init(&ctx.config, init_phases).await?;
+    let InitResult { net_ctrl } = init(&ctx.webserver, &ctx.config, init_phases).await?;
 
     let account = net_ctrl
         .db
@@ -167,7 +167,7 @@ pub async fn attach(
 
             let (account, net_ctrl) = setup_init(&setup_ctx, password, init_phases).await?;
 
-            let rpc_ctx = RpcContext::init(&setup_ctx.config, disk_guid, Some(net_ctrl), rpc_ctx_phases).await?;
+            let rpc_ctx = RpcContext::init(&setup_ctx.webserver, &setup_ctx.config, disk_guid, Some(net_ctrl), rpc_ctx_phases).await?;
 
             Ok(((&account).try_into()?, rpc_ctx))
         })?;
@@ -456,9 +456,16 @@ async fn fresh_setup(
     db.put(&ROOT, &Database::init(&account)?).await?;
     drop(db);
 
-    let InitResult { net_ctrl } = init(&ctx.config, init_phases).await?;
+    let InitResult { net_ctrl } = init(&ctx.webserver, &ctx.config, init_phases).await?;
 
-    let rpc_ctx = RpcContext::init(&ctx.config, guid, Some(net_ctrl), rpc_ctx_phases).await?;
+    let rpc_ctx = RpcContext::init(
+        &ctx.webserver,
+        &ctx.config,
+        guid,
+        Some(net_ctrl),
+        rpc_ctx_phases,
+    )
+    .await?;
 
     Ok(((&account).try_into()?, rpc_ctx))
 }
@@ -571,7 +578,14 @@ async fn migrate(
 
     let (account, net_ctrl) = setup_init(&ctx, Some(start_os_password), init_phases).await?;
 
-    let rpc_ctx = RpcContext::init(&ctx.config, guid, Some(net_ctrl), rpc_ctx_phases).await?;
+    let rpc_ctx = RpcContext::init(
+        &ctx.webserver,
+        &ctx.config,
+        guid,
+        Some(net_ctrl),
+        rpc_ctx_phases,
+    )
+    .await?;
 
     Ok(((&account).try_into()?, rpc_ctx))
 }
diff --git a/core/startos/src/update/mod.rs b/core/startos/src/update/mod.rs
index 51d8d77ae..d88838d4a 100644
--- a/core/startos/src/update/mod.rs
+++ b/core/startos/src/update/mod.rs
@@ -20,7 +20,7 @@ use ts_rs::TS;
 use crate::context::{CliContext, RpcContext};
 use crate::disk::mount::filesystem::bind::Bind;
 use crate::disk::mount::filesystem::block_dev::BlockDev;
-use crate::disk::mount::filesystem::efivarfs::{self, EfiVarFs};
+use crate::disk::mount::filesystem::efivarfs::{ EfiVarFs};
 use crate::disk::mount::filesystem::overlayfs::OverlayGuard;
 use crate::disk::mount::filesystem::MountType;
 use crate::disk::mount::guard::{GenericMountGuard, MountGuard, TmpMountGuard};
diff --git a/core/startos/src/util/actor/background.rs b/core/startos/src/util/actor/background.rs
index f37e10c14..7666cbf04 100644
--- a/core/startos/src/util/actor/background.rs
+++ b/core/startos/src/util/actor/background.rs
@@ -15,8 +15,13 @@ impl BackgroundJobQueue {
             },
         )
     }
-    pub fn add_job(&self, fut: impl Future<Output = ()> + Send + 'static) {
-        let _ = self.0.send(fut.boxed());
+    pub fn add_job(&self, fut: impl Future + Send + 'static) {
+        let _ = self.0.send(
+            async {
+                fut.await;
+            }
+            .boxed(),
+        );
     }
 }
 
diff --git a/core/startos/src/util/future.rs b/core/startos/src/util/future.rs
index f40e847bf..c690f9754 100644
--- a/core/startos/src/util/future.rs
+++ b/core/startos/src/util/future.rs
@@ -1,11 +1,13 @@
 use std::pin::Pin;
 use std::task::{Context, Poll};
 
-use futures::future::abortable;
-use futures::stream::{AbortHandle, Abortable};
-use futures::Future;
+use futures::future::{abortable, pending, BoxFuture, FusedFuture};
+use futures::stream::{AbortHandle, Abortable, BoxStream};
+use futures::{Future, FutureExt, Stream, StreamExt};
 use tokio::sync::watch;
 
+use crate::prelude::*;
+
 #[pin_project::pin_project(PinnedDrop)]
 pub struct DropSignaling<F> {
     #[pin]
@@ -102,6 +104,60 @@ impl CancellationHandle {
     }
 }
 
+#[derive(Default)]
+pub struct Until<'a> {
+    streams: Vec<BoxStream<'a, Result<(), Error>>>,
+    async_fns: Vec<Box<dyn FnMut() -> BoxFuture<'a, Result<(), Error>> + Send + 'a>>,
+}
+impl<'a> Until<'a> {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn with_stream(
+        mut self,
+        stream: impl Stream<Item = Result<(), Error>> + Send + 'a,
+    ) -> Self {
+        self.streams.push(stream.boxed());
+        self
+    }
+
+    pub fn with_async_fn<F, Fut>(mut self, mut f: F) -> Self
+    where
+        F: FnMut() -> Fut + Send + 'a,
+        Fut: Future<Output = Result<(), Error>> + FusedFuture + Send + 'a,
+    {
+        self.async_fns.push(Box::new(move || f().boxed()));
+        self
+    }
+
+    pub async fn run<Fut: Future<Output = Result<(), Error>> + Send>(
+        &mut self,
+        fut: Fut,
+    ) -> Result<(), Error> {
+        let (res, _, _) = futures::future::select_all(
+            self.streams
+                .iter_mut()
+                .map(|s| {
+                    async {
+                        s.next().await.transpose()?.ok_or_else(|| {
+                            Error::new(eyre!("stream is empty"), ErrorKind::Cancelled)
+                        })
+                    }
+                    .boxed()
+                })
+                .chain(self.async_fns.iter_mut().map(|f| f()))
+                .chain([async {
+                    fut.await?;
+                    pending().await
+                }
+                .boxed()]),
+        )
+        .await;
+        res
+    }
+}
+
 #[tokio::test]
 async fn test_cancellable() {
     use std::sync::Arc;
diff --git a/core/startos/src/util/io.rs b/core/startos/src/util/io.rs
index 0e7aada54..f0bae7a0a 100644
--- a/core/startos/src/util/io.rs
+++ b/core/startos/src/util/io.rs
@@ -15,7 +15,7 @@ use futures::future::{BoxFuture, Fuse};
 use futures::{AsyncSeek, FutureExt, Stream, TryStreamExt};
 use helpers::NonDetachingJoinHandle;
 use nix::unistd::{Gid, Uid};
-use tokio::fs::File;
+use tokio::fs::{File, OpenOptions};
 use tokio::io::{
     duplex, AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt, DuplexStream, ReadBuf, WriteHalf,
 };
@@ -460,18 +460,30 @@ impl<T> BackTrackingIO<T> {
             }
         }
     }
-    pub fn rewind(&mut self) -> Vec<u8> {
+    pub fn rewind<'a>(&'a mut self) -> (Vec<u8>, &'a [u8]) {
         match std::mem::take(&mut self.buffer) {
             BTBuffer::Buffering { read, write } => {
                 self.buffer = BTBuffer::Rewound {
                     read: Cursor::new(read),
                 };
-                write
+                (
+                    write,
+                    match &self.buffer {
+                        BTBuffer::Rewound { read } => read.get_ref(),
+                        _ => unreachable!(),
+                    },
+                )
             }
-            BTBuffer::NotBuffering => Vec::new(),
+            BTBuffer::NotBuffering => (Vec::new(), &[]),
             BTBuffer::Rewound { read } => {
                 self.buffer = BTBuffer::Rewound { read };
-                Vec::new()
+                (
+                    Vec::new(),
+                    match &self.buffer {
+                        BTBuffer::Rewound { read } => read.get_ref(),
+                        _ => unreachable!(),
+                    },
+                )
             }
         }
     }
@@ -529,7 +541,6 @@ impl<T: std::io::Read> std::io::Read for BackTrackingIO<T> {
             }
             BTBuffer::NotBuffering => self.io.read(buf),
             BTBuffer::Rewound { read } => {
-                let mut ready = false;
                 if (read.position() as usize) < read.get_ref().len() {
                     let n = std::io::Read::read(read, buf)?;
                     if n != 0 {
@@ -923,6 +934,21 @@ pub async fn create_file(path: impl AsRef<Path>) -> Result<File, Error> {
         .with_ctx(|_| (ErrorKind::Filesystem, lazy_format!("create {path:?}")))
 }
 
+pub async fn append_file(path: impl AsRef<Path>) -> Result<File, Error> {
+    let path = path.as_ref();
+    if let Some(parent) = path.parent() {
+        tokio::fs::create_dir_all(parent)
+            .await
+            .with_ctx(|_| (ErrorKind::Filesystem, lazy_format!("mkdir -p {parent:?}")))?;
+    }
+    OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(path)
+        .await
+        .with_ctx(|_| (ErrorKind::Filesystem, lazy_format!("create {path:?}")))
+}
+
 pub async fn delete_file(path: impl AsRef<Path>) -> Result<(), Error> {
     let path = path.as_ref();
     tokio::fs::remove_file(path)
diff --git a/core/startos/src/util/logger.rs b/core/startos/src/util/logger.rs
index c464b328d..816721d5b 100644
--- a/core/startos/src/util/logger.rs
+++ b/core/startos/src/util/logger.rs
@@ -1,13 +1,62 @@
-use std::io;
+use std::fs::File;
+use std::io::{self, Write};
+use std::sync::{Arc, Mutex, MutexGuard};
 
+use lazy_static::lazy_static;
 use tracing::Subscriber;
+use tracing_subscriber::fmt::MakeWriter;
 use tracing_subscriber::util::SubscriberInitExt;
 
+lazy_static! {
+    pub static ref LOGGER: StartOSLogger = StartOSLogger::init();
+}
+
 #[derive(Clone)]
-pub struct EmbassyLogger {}
+pub struct StartOSLogger {
+    logfile: LogFile,
+}
+
+#[derive(Clone, Default)]
+struct LogFile(Arc<Mutex<Option<File>>>);
+impl<'a> MakeWriter<'a> for LogFile {
+    type Writer = Box<dyn Write + 'a>;
+    fn make_writer(&'a self) -> Self::Writer {
+        let f = self.0.lock().unwrap();
+        if f.is_some() {
+            struct TeeWriter<'a>(MutexGuard<'a, Option<File>>);
+            impl<'a> Write for TeeWriter<'a> {
+                fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+                    let n = if let Some(f) = &mut *self.0 {
+                        f.write(buf)?
+                    } else {
+                        buf.len()
+                    };
+                    io::stderr().write_all(&buf[..n])?;
+                    Ok(n)
+                }
+                fn flush(&mut self) -> io::Result<()> {
+                    if let Some(f) = &mut *self.0 {
+                        f.flush()?;
+                    }
+                    Ok(())
+                }
+            }
+            Box::new(TeeWriter(f))
+        } else {
+            drop(f);
+            Box::new(io::stderr())
+        }
+    }
+}
+
+impl StartOSLogger {
+    pub fn enable(&self) {}
+
+    pub fn set_logfile(&self, logfile: Option<File>) {
+        *self.logfile.0.lock().unwrap() = logfile;
+    }
 
-impl EmbassyLogger {
-    fn base_subscriber() -> impl Subscriber {
+    fn base_subscriber(logfile: LogFile) -> impl Subscriber {
         use tracing_error::ErrorLayer;
         use tracing_subscriber::prelude::*;
         use tracing_subscriber::{fmt, EnvFilter};
@@ -24,7 +73,7 @@ impl EmbassyLogger {
             .add_directive("tokio=trace".parse().unwrap())
             .add_directive("runtime=trace".parse().unwrap());
         let fmt_layer = fmt::layer()
-            .with_writer(io::stderr)
+            .with_writer(logfile)
             .with_line_number(true)
             .with_file(true)
             .with_target(true);
@@ -39,11 +88,12 @@ impl EmbassyLogger {
 
         sub
     }
-    pub fn init() -> Self {
-        Self::base_subscriber().init();
+    fn init() -> Self {
+        let logfile = LogFile::default();
+        Self::base_subscriber(logfile.clone()).init();
         color_eyre::install().unwrap_or_else(|_| tracing::warn!("tracing too many times"));
 
-        EmbassyLogger {}
+        StartOSLogger { logfile }
     }
 }
 
diff --git a/core/startos/src/util/rpc.rs b/core/startos/src/util/rpc.rs
index b2dea340e..f7c91eb82 100644
--- a/core/startos/src/util/rpc.rs
+++ b/core/startos/src/util/rpc.rs
@@ -3,7 +3,6 @@ use std::path::Path;
 use clap::Parser;
 use rpc_toolkit::{from_fn_async, Context, HandlerExt, ParentHandler};
 use serde::{Deserialize, Serialize};
-use url::Url;
 
 use crate::context::CliContext;
 use crate::prelude::*;
diff --git a/core/startos/src/util/rpc_client.rs b/core/startos/src/util/rpc_client.rs
index fc93e4c64..82ce11e20 100644
--- a/core/startos/src/util/rpc_client.rs
+++ b/core/startos/src/util/rpc_client.rs
@@ -47,7 +47,7 @@ impl RpcClient {
                 let mut lines = BufReader::new(reader).lines();
                 while let Some(line) = lines.next_line().await.transpose() {
                     match line.map_err(Error::from).and_then(|l| {
-                        serde_json::from_str::<RpcResponse>(dbg!(&l))
+                        serde_json::from_str::<RpcResponse>(crate::dbg!(&l))
                             .with_kind(ErrorKind::Deserialization)
                     }) {
                         Ok(l) => {
@@ -114,7 +114,7 @@ impl RpcClient {
             let (send, recv) = oneshot::channel();
             w.lock().await.insert(id.clone(), send);
             self.writer
-                .write_all((dbg!(serde_json::to_string(&request))? + "\n").as_bytes())
+                .write_all((crate::dbg!(serde_json::to_string(&request))? + "\n").as_bytes())
                 .await
                 .map_err(|e| {
                     let mut err = rpc_toolkit::yajrc::INTERNAL_ERROR.clone();
@@ -154,7 +154,7 @@ impl RpcClient {
             params,
         };
         self.writer
-            .write_all((dbg!(serde_json::to_string(&request))? + "\n").as_bytes())
+            .write_all((crate::dbg!(serde_json::to_string(&request))? + "\n").as_bytes())
             .await
             .map_err(|e| {
                 let mut err = rpc_toolkit::yajrc::INTERNAL_ERROR.clone();
diff --git a/core/startos/src/util/sync.rs b/core/startos/src/util/sync.rs
index 1edd21ce1..2630858a9 100644
--- a/core/startos/src/util/sync.rs
+++ b/core/startos/src/util/sync.rs
@@ -1,3 +1,4 @@
+#[derive(Debug, Default)]
 pub struct SyncMutex<T>(std::sync::Mutex<T>);
 impl<T> SyncMutex<T> {
     pub fn new(t: T) -> Self {
diff --git a/core/startos/src/version/mod.rs b/core/startos/src/version/mod.rs
index 94b61176b..2fd3e492b 100644
--- a/core/startos/src/version/mod.rs
+++ b/core/startos/src/version/mod.rs
@@ -29,7 +29,9 @@ mod v0_3_6_alpha_7;
 mod v0_3_6_alpha_8;
 mod v0_3_6_alpha_9;
 
-pub type Current = v0_3_6_alpha_9::Version; // VERSION_BUMP
+mod v0_3_6_alpha_10;
+
+pub type Current = v0_3_6_alpha_10::Version; // VERSION_BUMP
 
 impl Current {
     #[instrument(skip(self, db))]
@@ -108,6 +110,7 @@ enum Version {
     V0_3_6_alpha_7(Wrapper<v0_3_6_alpha_7::Version>),
     V0_3_6_alpha_8(Wrapper<v0_3_6_alpha_8::Version>),
     V0_3_6_alpha_9(Wrapper<v0_3_6_alpha_9::Version>),
+    V0_3_6_alpha_10(Wrapper<v0_3_6_alpha_10::Version>),
     Other(exver::Version),
 }
 
@@ -141,6 +144,7 @@ impl Version {
             Self::V0_3_6_alpha_7(v) => DynVersion(Box::new(v.0)),
             Self::V0_3_6_alpha_8(v) => DynVersion(Box::new(v.0)),
             Self::V0_3_6_alpha_9(v) => DynVersion(Box::new(v.0)),
+            Self::V0_3_6_alpha_10(v) => DynVersion(Box::new(v.0)),
             Self::Other(v) => {
                 return Err(Error::new(
                     eyre!("unknown version {v}"),
@@ -166,6 +170,7 @@ impl Version {
             Version::V0_3_6_alpha_7(Wrapper(x)) => x.semver(),
             Version::V0_3_6_alpha_8(Wrapper(x)) => x.semver(),
             Version::V0_3_6_alpha_9(Wrapper(x)) => x.semver(),
+            Version::V0_3_6_alpha_10(Wrapper(x)) => x.semver(),
             Version::Other(x) => x.clone(),
         }
     }
diff --git a/core/startos/src/version/v0_3_6_alpha_0.rs b/core/startos/src/version/v0_3_6_alpha_0.rs
index 7a6045a3a..64c7d2e12 100644
--- a/core/startos/src/version/v0_3_6_alpha_0.rs
+++ b/core/startos/src/version/v0_3_6_alpha_0.rs
@@ -191,7 +191,6 @@ async fn init_postgres(datadir: impl AsRef<Path>) -> Result<PgPool, Error> {
         .run(&secret_store)
         .await
         .with_kind(crate::ErrorKind::Database)?;
-    dbg!("Init Postgres Done");
     Ok(secret_store)
 }
 
@@ -315,7 +314,6 @@ impl VersionT for Version {
             "private": private,
         });
 
-        dbg!("Should be done with the up");
         *db = next;
         Ok(())
     }
diff --git a/core/startos/src/version/v0_3_6_alpha_10.rs b/core/startos/src/version/v0_3_6_alpha_10.rs
new file mode 100644
index 000000000..f65479488
--- /dev/null
+++ b/core/startos/src/version/v0_3_6_alpha_10.rs
@@ -0,0 +1,95 @@
+use std::collections::{BTreeMap, BTreeSet};
+
+use exver::{PreReleaseSegment, VersionRange};
+use imbl_value::InternedString;
+use serde::{Deserialize, Serialize};
+use torut::onion::OnionAddressV3;
+
+use super::v0_3_5::V0_3_0_COMPAT;
+use super::{v0_3_6_alpha_9, VersionT};
+use crate::db::model::Database;
+use crate::net::host::address::DomainConfig;
+use crate::prelude::*;
+
+lazy_static::lazy_static! {
+    static ref V0_3_6_alpha_10: exver::Version = exver::Version::new(
+        [0, 3, 6],
+        [PreReleaseSegment::String("alpha".into()), 10.into()]
+    );
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase")]
+#[serde(tag = "kind")]
+enum HostAddress {
+    Onion { address: OnionAddressV3 },
+    Domain { address: InternedString },
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+pub struct Version;
+
+impl VersionT for Version {
+    type Previous = v0_3_6_alpha_9::Version;
+    type PreUpRes = ();
+
+    async fn pre_up(self) -> Result<Self::PreUpRes, Error> {
+        Ok(())
+    }
+    fn semver(self) -> exver::Version {
+        V0_3_6_alpha_10.clone()
+    }
+    fn compat(self) -> &'static VersionRange {
+        &V0_3_0_COMPAT
+    }
+    fn up(self, db: &mut Value, _: Self::PreUpRes) -> Result<(), Error> {
+        for (_, package) in db["public"]["packageData"]
+            .as_object_mut()
+            .ok_or_else(|| {
+                Error::new(
+                    eyre!("expected public.packageData to be an object"),
+                    ErrorKind::Database,
+                )
+            })?
+            .iter_mut()
+        {
+            for (_, host) in package["hosts"]
+                .as_object_mut()
+                .ok_or_else(|| {
+                    Error::new(
+                        eyre!("expected public.packageData[id].hosts to be an object"),
+                        ErrorKind::Database,
+                    )
+                })?
+                .iter_mut()
+            {
+                let mut onions = BTreeSet::new();
+                let mut domains = BTreeMap::new();
+                let addresses = from_value::<BTreeSet<HostAddress>>(host["addresses"].clone())?;
+                for address in addresses {
+                    match address {
+                        HostAddress::Onion { address } => {
+                            onions.insert(address);
+                        }
+                        HostAddress::Domain { address } => {
+                            domains.insert(
+                                address,
+                                DomainConfig {
+                                    public: true,
+                                    acme: None,
+                                },
+                            );
+                        }
+                    }
+                }
+                host["onions"] = to_value(&onions)?;
+                host["domains"] = to_value(&domains)?;
+            }
+        }
+
+        Ok(())
+    }
+    fn down(self, _db: &mut Value) -> Result<(), Error> {
+        Ok(())
+    }
+}
diff --git a/debian/postinst b/debian/postinst
index 3714df8d4..176bdb6b2 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -86,6 +86,8 @@ sed -i '/^\s*#\?\s*issue_discards\s*=\s*/c\issue_discards = 1' /etc/lvm/lvm.conf
 sed -i '/\(^\|#\)\s*unqualified-search-registries\s*=\s*/c\unqualified-search-registries = ["docker.io"]' /etc/containers/registries.conf
 sed -i 's/\(#\|\^\)\s*\([^=]\+\)=\(suspend\|hibernate\)\s*$/\2=ignore/g' /etc/systemd/logind.conf
 sed -i '/\(^\|#\)MulticastDNS=/c\MulticastDNS=no' /etc/systemd/resolved.conf
+sed -i 's/\[Service\]/[Service]\nEnvironment=SYSTEMD_LOG_LEVEL=debug/' /lib/systemd/system/systemd-timesyncd.service
+sed -i '/\(^\|#\)RootDistanceMaxSec=/c\RootDistanceMaxSec=10' /etc/systemd/timesyncd.conf
 
 mkdir -p /etc/nginx/ssl
 
diff --git a/patch-db b/patch-db
index 99076d349..2600a784a 160000
--- a/patch-db
+++ b/patch-db
@@ -1 +1 @@
-Subproject commit 99076d349c6768000483ea8d47216d273586552e
+Subproject commit 2600a784a9899a6f8e0c9abe0bf4c4ce48cb85a9
diff --git a/sdk/base/lib/Effects.ts b/sdk/base/lib/Effects.ts
index e4424fafb..dcb03af4e 100644
--- a/sdk/base/lib/Effects.ts
+++ b/sdk/base/lib/Effects.ts
@@ -8,7 +8,7 @@ import {
   SetHealth,
   BindParams,
   HostId,
-  LanInfo,
+  NetInfo,
   Host,
   ExportServiceInterfaceParams,
   ServiceInterface,
@@ -117,7 +117,7 @@ export type Effects = {
     packageId?: PackageId
     hostId: HostId
     internalPort: number
-  }): Promise<LanInfo>
+  }): Promise<NetInfo>
   /** Removes all network bindings, called in the setupInputSpec */
   clearBindings(options: {
     except: { id: HostId; internalPort: number }[]
@@ -129,12 +129,6 @@ export type Effects = {
     hostId: HostId
     callback?: () => void
   }): Promise<Host | null>
-  /** Returns the primary url that a user has selected for a host, if it exists */
-  getPrimaryUrl(options: {
-    packageId?: PackageId
-    hostId: HostId
-    callback?: () => void
-  }): Promise<UrlString | null>
   /** Returns the IP address of the container */
   getContainerIp(): Promise<string>
   // interface
diff --git a/sdk/base/lib/actions/input/builder/inputSpec.ts b/sdk/base/lib/actions/input/builder/inputSpec.ts
index 31e06df4f..5d4d5c6bb 100644
--- a/sdk/base/lib/actions/input/builder/inputSpec.ts
+++ b/sdk/base/lib/actions/input/builder/inputSpec.ts
@@ -94,8 +94,8 @@ export class InputSpec<Type extends Record<string, any>, Store = never> {
     },
     public validator: Parser<unknown, Type>,
   ) {}
-  _TYPE: Type = null as any as Type
-  _PARTIAL: DeepPartial<Type> = null as any as DeepPartial<Type>
+  public _TYPE: Type = null as any as Type
+  public _PARTIAL: DeepPartial<Type> = null as any as DeepPartial<Type>
   async build(options: LazyBuildOptions<Store>) {
     const answer = {} as {
       [K in keyof Type]: ValueSpec
diff --git a/sdk/base/lib/actions/input/builder/value.ts b/sdk/base/lib/actions/input/builder/value.ts
index 676c4aac1..3ff3c2d24 100644
--- a/sdk/base/lib/actions/input/builder/value.ts
+++ b/sdk/base/lib/actions/input/builder/value.ts
@@ -49,6 +49,9 @@ export class Value<Type, Store> {
     public build: LazyBuild<Store, ValueSpec>,
     public validator: Parser<unknown, Type>,
   ) {}
+  public _TYPE: Type = null as any as Type
+  public _PARTIAL: DeepPartial<Type> = null as any as DeepPartial<Type>
+
   static toggle(a: {
     name: string
     description?: string | null
diff --git a/sdk/base/lib/dependencies/setupDependencies.ts b/sdk/base/lib/dependencies/setupDependencies.ts
index 6b15ef0d1..710ec96ed 100644
--- a/sdk/base/lib/dependencies/setupDependencies.ts
+++ b/sdk/base/lib/dependencies/setupDependencies.ts
@@ -51,7 +51,7 @@ export function setupDependencies<Manifest extends T.SDKManifest>(
       dependencies: Object.entries(dependencyType).map(
         ([id, { versionRange, ...x }, ,]) =>
           ({
-            // id,
+            id,
             ...x,
             versionRange: versionRange.toString(),
           }) as T.DependencyRequirement,
diff --git a/sdk/base/lib/interfaces/Origin.ts b/sdk/base/lib/interfaces/Origin.ts
index 5e12713e6..9985176e4 100644
--- a/sdk/base/lib/interfaces/Origin.ts
+++ b/sdk/base/lib/interfaces/Origin.ts
@@ -46,7 +46,6 @@ export class Origin<T extends Host> {
       const {
         name,
         description,
-        hasPrimary,
         id,
         type,
         username,
@@ -67,7 +66,6 @@ export class Origin<T extends Host> {
         id,
         name,
         description,
-        hasPrimary,
         addressInfo,
         type,
         masked,
diff --git a/sdk/base/lib/interfaces/ServiceInterfaceBuilder.ts b/sdk/base/lib/interfaces/ServiceInterfaceBuilder.ts
index 4ef294b4f..036180ad3 100644
--- a/sdk/base/lib/interfaces/ServiceInterfaceBuilder.ts
+++ b/sdk/base/lib/interfaces/ServiceInterfaceBuilder.ts
@@ -20,7 +20,6 @@ export class ServiceInterfaceBuilder {
       name: string
       id: string
       description: string
-      hasPrimary: boolean
       type: ServiceInterfaceType
       username: string | null
       path: string
diff --git a/sdk/base/lib/osBindings/HostAddress.ts b/sdk/base/lib/osBindings/AcmeProvider.ts
similarity index 51%
rename from sdk/base/lib/osBindings/HostAddress.ts
rename to sdk/base/lib/osBindings/AcmeProvider.ts
index 73b46d8e5..0ad3f0052 100644
--- a/sdk/base/lib/osBindings/HostAddress.ts
+++ b/sdk/base/lib/osBindings/AcmeProvider.ts
@@ -1,5 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type HostAddress =
-  | { kind: "onion"; address: string }
-  | { kind: "domain"; address: string }
+export type AcmeProvider = string
diff --git a/sdk/base/lib/osBindings/AcmeSettings.ts b/sdk/base/lib/osBindings/AcmeSettings.ts
index bdf151ec7..44e70d9df 100644
--- a/sdk/base/lib/osBindings/AcmeSettings.ts
+++ b/sdk/base/lib/osBindings/AcmeSettings.ts
@@ -1,13 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type AcmeSettings = {
-  provider: string
-  /**
-   * email addresses for letsencrypt
-   */
-  contact: Array<string>
-  /**
-   * domains to get letsencrypt certs for
-   */
-  domains: string[]
-}
+export type AcmeSettings = { contact: Array<string> }
diff --git a/sdk/base/lib/osBindings/BindInfo.ts b/sdk/base/lib/osBindings/BindInfo.ts
index 85fc38e94..b03dbe6b2 100644
--- a/sdk/base/lib/osBindings/BindInfo.ts
+++ b/sdk/base/lib/osBindings/BindInfo.ts
@@ -1,5 +1,5 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { BindOptions } from "./BindOptions"
-import type { LanInfo } from "./LanInfo"
+import type { NetInfo } from "./NetInfo"
 
-export type BindInfo = { enabled: boolean; options: BindOptions; lan: LanInfo }
+export type BindInfo = { enabled: boolean; options: BindOptions; net: NetInfo }
diff --git a/sdk/base/lib/osBindings/DomainConfig.ts b/sdk/base/lib/osBindings/DomainConfig.ts
new file mode 100644
index 000000000..433bc65f5
--- /dev/null
+++ b/sdk/base/lib/osBindings/DomainConfig.ts
@@ -0,0 +1,4 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AcmeProvider } from "./AcmeProvider"
+
+export type DomainConfig = { public: boolean; acme: AcmeProvider | null }
diff --git a/sdk/base/lib/osBindings/ExportServiceInterfaceParams.ts b/sdk/base/lib/osBindings/ExportServiceInterfaceParams.ts
index 28ac89916..675c3e06d 100644
--- a/sdk/base/lib/osBindings/ExportServiceInterfaceParams.ts
+++ b/sdk/base/lib/osBindings/ExportServiceInterfaceParams.ts
@@ -7,7 +7,6 @@ export type ExportServiceInterfaceParams = {
   id: ServiceInterfaceId
   name: string
   description: string
-  hasPrimary: boolean
   masked: boolean
   addressInfo: AddressInfo
   type: ServiceInterfaceType
diff --git a/sdk/base/lib/osBindings/ForgetInterfaceParams.ts b/sdk/base/lib/osBindings/ForgetInterfaceParams.ts
new file mode 100644
index 000000000..b3532602c
--- /dev/null
+++ b/sdk/base/lib/osBindings/ForgetInterfaceParams.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ForgetInterfaceParams = { interface: string }
diff --git a/sdk/base/lib/osBindings/GetPrimaryUrlParams.ts b/sdk/base/lib/osBindings/GetPrimaryUrlParams.ts
deleted file mode 100644
index 06bf73976..000000000
--- a/sdk/base/lib/osBindings/GetPrimaryUrlParams.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { CallbackId } from "./CallbackId"
-import type { HostId } from "./HostId"
-import type { PackageId } from "./PackageId"
-
-export type GetPrimaryUrlParams = {
-  packageId?: PackageId
-  hostId: HostId
-  callback?: CallbackId
-}
diff --git a/sdk/base/lib/osBindings/GitHash.ts b/sdk/base/lib/osBindings/GitHash.ts
new file mode 100644
index 000000000..43f6adde3
--- /dev/null
+++ b/sdk/base/lib/osBindings/GitHash.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type GitHash = string
diff --git a/sdk/base/lib/osBindings/Host.ts b/sdk/base/lib/osBindings/Host.ts
index 7d8cf3a90..5436e9955 100644
--- a/sdk/base/lib/osBindings/Host.ts
+++ b/sdk/base/lib/osBindings/Host.ts
@@ -1,13 +1,14 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { BindInfo } from "./BindInfo"
-import type { HostAddress } from "./HostAddress"
+import type { DomainConfig } from "./DomainConfig"
 import type { HostKind } from "./HostKind"
 import type { HostnameInfo } from "./HostnameInfo"
 
 export type Host = {
   kind: HostKind
   bindings: { [key: number]: BindInfo }
-  addresses: Array<HostAddress>
+  onions: string[]
+  domains: { [key: string]: DomainConfig }
   /**
    * COMPUTED: NetService::update
    */
diff --git a/sdk/base/lib/osBindings/IpHostname.ts b/sdk/base/lib/osBindings/IpHostname.ts
index 4a6b5e87c..9b3ddd6d1 100644
--- a/sdk/base/lib/osBindings/IpHostname.ts
+++ b/sdk/base/lib/osBindings/IpHostname.ts
@@ -2,7 +2,13 @@
 
 export type IpHostname =
   | { kind: "ipv4"; value: string; port: number | null; sslPort: number | null }
-  | { kind: "ipv6"; value: string; port: number | null; sslPort: number | null }
+  | {
+      kind: "ipv6"
+      value: string
+      scopeId: number
+      port: number | null
+      sslPort: number | null
+    }
   | {
       kind: "local"
       value: string
diff --git a/sdk/base/lib/osBindings/IpInfo.ts b/sdk/base/lib/osBindings/IpInfo.ts
index ae8c88d1b..e9b0c9fb3 100644
--- a/sdk/base/lib/osBindings/IpInfo.ts
+++ b/sdk/base/lib/osBindings/IpInfo.ts
@@ -1,8 +1,8 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
 export type IpInfo = {
-  ipv4Range: string | null
-  ipv4: string | null
-  ipv6Range: string | null
-  ipv6: string | null
+  scopeId: number
+  subnets: string[]
+  wanIp: string | null
+  ntpServers: string[]
 }
diff --git a/sdk/base/lib/osBindings/Manifest.ts b/sdk/base/lib/osBindings/Manifest.ts
index 8007b565b..2c9a2457e 100644
--- a/sdk/base/lib/osBindings/Manifest.ts
+++ b/sdk/base/lib/osBindings/Manifest.ts
@@ -2,6 +2,7 @@
 import type { Alerts } from "./Alerts"
 import type { Dependencies } from "./Dependencies"
 import type { Description } from "./Description"
+import type { GitHash } from "./GitHash"
 import type { HardwareRequirements } from "./HardwareRequirements"
 import type { ImageConfig } from "./ImageConfig"
 import type { ImageId } from "./ImageId"
@@ -30,6 +31,6 @@ export type Manifest = {
   alerts: Alerts
   dependencies: Dependencies
   hardwareRequirements: HardwareRequirements
-  gitHash: string | null
+  gitHash?: GitHash
   osVersion: string
 }
diff --git a/sdk/base/lib/osBindings/LanInfo.ts b/sdk/base/lib/osBindings/NetInfo.ts
similarity index 80%
rename from sdk/base/lib/osBindings/LanInfo.ts
rename to sdk/base/lib/osBindings/NetInfo.ts
index 59b8a5519..e790cadaa 100644
--- a/sdk/base/lib/osBindings/LanInfo.ts
+++ b/sdk/base/lib/osBindings/NetInfo.ts
@@ -1,6 +1,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type LanInfo = {
+export type NetInfo = {
+  public: boolean
   assignedPort: number | null
   assignedSslPort: number | null
 }
diff --git a/sdk/base/lib/osBindings/NetworkInterfaceInfo.ts b/sdk/base/lib/osBindings/NetworkInterfaceInfo.ts
new file mode 100644
index 000000000..796046b93
--- /dev/null
+++ b/sdk/base/lib/osBindings/NetworkInterfaceInfo.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { IpInfo } from "./IpInfo"
+
+export type NetworkInterfaceInfo = {
+  public: boolean | null
+  ipInfo: IpInfo | null
+}
diff --git a/sdk/base/lib/osBindings/PackageVersionInfo.ts b/sdk/base/lib/osBindings/PackageVersionInfo.ts
index 80481acb3..c71fd5921 100644
--- a/sdk/base/lib/osBindings/PackageVersionInfo.ts
+++ b/sdk/base/lib/osBindings/PackageVersionInfo.ts
@@ -3,6 +3,7 @@ import type { Alerts } from "./Alerts"
 import type { DataUrl } from "./DataUrl"
 import type { DependencyMetadata } from "./DependencyMetadata"
 import type { Description } from "./Description"
+import type { GitHash } from "./GitHash"
 import type { HardwareRequirements } from "./HardwareRequirements"
 import type { MerkleArchiveCommitment } from "./MerkleArchiveCommitment"
 import type { PackageId } from "./PackageId"
@@ -13,7 +14,7 @@ export type PackageVersionInfo = {
   icon: DataUrl
   description: Description
   releaseNotes: string
-  gitHash: string
+  gitHash: GitHash
   license: string
   wrapperRepo: string
   upstreamRepo: string
diff --git a/sdk/base/lib/osBindings/ServerInfo.ts b/sdk/base/lib/osBindings/ServerInfo.ts
index 89d7fc1b0..6eec14745 100644
--- a/sdk/base/lib/osBindings/ServerInfo.ts
+++ b/sdk/base/lib/osBindings/ServerInfo.ts
@@ -1,8 +1,9 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AcmeProvider } from "./AcmeProvider"
 import type { AcmeSettings } from "./AcmeSettings"
 import type { Governor } from "./Governor"
-import type { IpInfo } from "./IpInfo"
 import type { LshwDevice } from "./LshwDevice"
+import type { NetworkInterfaceInfo } from "./NetworkInterfaceInfo"
 import type { ServerStatus } from "./ServerStatus"
 import type { SmtpValue } from "./SmtpValue"
 import type { WifiInfo } from "./WifiInfo"
@@ -22,8 +23,8 @@ export type ServerInfo = {
    * for backwards compatibility
    */
   torAddress: string
-  ipInfo: { [key: string]: IpInfo }
-  acme: AcmeSettings | null
+  networkInterfaces: { [key: string]: NetworkInterfaceInfo }
+  acme: { [key: AcmeProvider]: AcmeSettings }
   statusInfo: ServerStatus
   wifi: WifiInfo
   unreadNotificationCount: number
diff --git a/sdk/base/lib/osBindings/ServiceInterface.ts b/sdk/base/lib/osBindings/ServiceInterface.ts
index 9bcec0056..6a58675a4 100644
--- a/sdk/base/lib/osBindings/ServiceInterface.ts
+++ b/sdk/base/lib/osBindings/ServiceInterface.ts
@@ -7,7 +7,6 @@ export type ServiceInterface = {
   id: ServiceInterfaceId
   name: string
   description: string
-  hasPrimary: boolean
   masked: boolean
   addressInfo: AddressInfo
   type: ServiceInterfaceType
diff --git a/sdk/base/lib/osBindings/SetPublicParams.ts b/sdk/base/lib/osBindings/SetPublicParams.ts
new file mode 100644
index 000000000..03bc3082b
--- /dev/null
+++ b/sdk/base/lib/osBindings/SetPublicParams.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type SetPublicParams = { interface: string; public: boolean | null }
diff --git a/sdk/base/lib/osBindings/UnsetPublicParams.ts b/sdk/base/lib/osBindings/UnsetPublicParams.ts
new file mode 100644
index 000000000..db8f730e1
--- /dev/null
+++ b/sdk/base/lib/osBindings/UnsetPublicParams.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type UnsetPublicParams = { interface: string }
diff --git a/sdk/base/lib/osBindings/index.ts b/sdk/base/lib/osBindings/index.ts
index f76f595c9..f3fec0b71 100644
--- a/sdk/base/lib/osBindings/index.ts
+++ b/sdk/base/lib/osBindings/index.ts
@@ -1,4 +1,5 @@
 export { AcceptSigners } from "./AcceptSigners"
+export { AcmeProvider } from "./AcmeProvider"
 export { AcmeSettings } from "./AcmeSettings"
 export { ActionId } from "./ActionId"
 export { ActionInput } from "./ActionInput"
@@ -66,6 +67,7 @@ export { DepInfo } from "./DepInfo"
 export { Description } from "./Description"
 export { DestroySubcontainerFsParams } from "./DestroySubcontainerFsParams"
 export { DeviceFilter } from "./DeviceFilter"
+export { DomainConfig } from "./DomainConfig"
 export { Duration } from "./Duration"
 export { EchoParams } from "./EchoParams"
 export { EditSignerParams } from "./EditSignerParams"
@@ -73,6 +75,7 @@ export { EncryptedWire } from "./EncryptedWire"
 export { ExportActionParams } from "./ExportActionParams"
 export { ExportServiceInterfaceParams } from "./ExportServiceInterfaceParams"
 export { ExposeForDependentsParams } from "./ExposeForDependentsParams"
+export { ForgetInterfaceParams } from "./ForgetInterfaceParams"
 export { FullIndex } from "./FullIndex"
 export { FullProgress } from "./FullProgress"
 export { GetActionInputParams } from "./GetActionInputParams"
@@ -82,7 +85,6 @@ export { GetOsVersionParams } from "./GetOsVersionParams"
 export { GetPackageParams } from "./GetPackageParams"
 export { GetPackageResponseFull } from "./GetPackageResponseFull"
 export { GetPackageResponse } from "./GetPackageResponse"
-export { GetPrimaryUrlParams } from "./GetPrimaryUrlParams"
 export { GetServiceInterfaceParams } from "./GetServiceInterfaceParams"
 export { GetServicePortForwardParams } from "./GetServicePortForwardParams"
 export { GetSslCertificateParams } from "./GetSslCertificateParams"
@@ -90,11 +92,11 @@ export { GetSslKeyParams } from "./GetSslKeyParams"
 export { GetStatusParams } from "./GetStatusParams"
 export { GetStoreParams } from "./GetStoreParams"
 export { GetSystemSmtpParams } from "./GetSystemSmtpParams"
+export { GitHash } from "./GitHash"
 export { Governor } from "./Governor"
 export { Guid } from "./Guid"
 export { HardwareRequirements } from "./HardwareRequirements"
 export { HealthCheckId } from "./HealthCheckId"
-export { HostAddress } from "./HostAddress"
 export { HostId } from "./HostId"
 export { HostKind } from "./HostKind"
 export { HostnameInfo } from "./HostnameInfo"
@@ -112,7 +114,6 @@ export { InstallingState } from "./InstallingState"
 export { InstallParams } from "./InstallParams"
 export { IpHostname } from "./IpHostname"
 export { IpInfo } from "./IpInfo"
-export { LanInfo } from "./LanInfo"
 export { ListPackageSignersParams } from "./ListPackageSignersParams"
 export { ListServiceInterfacesParams } from "./ListServiceInterfacesParams"
 export { ListVersionSignersParams } from "./ListVersionSignersParams"
@@ -128,6 +129,8 @@ export { MountParams } from "./MountParams"
 export { MountTarget } from "./MountTarget"
 export { NamedHealthCheckResult } from "./NamedHealthCheckResult"
 export { NamedProgress } from "./NamedProgress"
+export { NetInfo } from "./NetInfo"
+export { NetworkInterfaceInfo } from "./NetworkInterfaceInfo"
 export { OnionHostname } from "./OnionHostname"
 export { OsIndex } from "./OsIndex"
 export { OsVersionInfoMap } from "./OsVersionInfoMap"
@@ -172,6 +175,7 @@ export { SetIconParams } from "./SetIconParams"
 export { SetMainStatusStatus } from "./SetMainStatusStatus"
 export { SetMainStatus } from "./SetMainStatus"
 export { SetNameParams } from "./SetNameParams"
+export { SetPublicParams } from "./SetPublicParams"
 export { SetStoreParams } from "./SetStoreParams"
 export { SetupExecuteParams } from "./SetupExecuteParams"
 export { SetupProgress } from "./SetupProgress"
@@ -181,6 +185,7 @@ export { SignAssetParams } from "./SignAssetParams"
 export { SignerInfo } from "./SignerInfo"
 export { SmtpValue } from "./SmtpValue"
 export { StartStop } from "./StartStop"
+export { UnsetPublicParams } from "./UnsetPublicParams"
 export { UpdatingState } from "./UpdatingState"
 export { VerifyCifsParams } from "./VerifyCifsParams"
 export { VersionSignerParams } from "./VersionSignerParams"
diff --git a/sdk/base/lib/test/startosTypeValidation.test.ts b/sdk/base/lib/test/startosTypeValidation.test.ts
index 509da0894..2de7b43a4 100644
--- a/sdk/base/lib/test/startosTypeValidation.test.ts
+++ b/sdk/base/lib/test/startosTypeValidation.test.ts
@@ -26,7 +26,6 @@ import { SetDependenciesParams } from ".././osBindings"
 import { GetSystemSmtpParams } from ".././osBindings"
 import { GetServicePortForwardParams } from ".././osBindings"
 import { ExportServiceInterfaceParams } from ".././osBindings"
-import { GetPrimaryUrlParams } from ".././osBindings"
 import { ListServiceInterfacesParams } from ".././osBindings"
 import { ExportActionParams } from ".././osBindings"
 import { MountParams } from ".././osBindings"
@@ -83,7 +82,6 @@ describe("startosTypeValidation ", () => {
       getServicePortForward: {} as GetServicePortForwardParams,
       clearServiceInterfaces: {} as ClearServiceInterfacesParams,
       exportServiceInterface: {} as ExportServiceInterfaceParams,
-      getPrimaryUrl: {} as WithCallback<GetPrimaryUrlParams>,
       listServiceInterfaces: {} as WithCallback<ListServiceInterfacesParams>,
       mount: {} as MountParams,
       checkDependencies: {} as CheckDependenciesParam,
diff --git a/sdk/base/lib/types.ts b/sdk/base/lib/types.ts
index 36d4bd293..85a8c4404 100644
--- a/sdk/base/lib/types.ts
+++ b/sdk/base/lib/types.ts
@@ -138,33 +138,6 @@ export declare const hostName: unique symbol
 // asdflkjadsf.onion | 1.2.3.4
 export type Hostname = string & { [hostName]: never }
 
-export type HostnameInfoIp = {
-  kind: "ip"
-  networkInterfaceId: string
-  public: boolean
-  hostname:
-    | {
-        kind: "ipv4" | "ipv6" | "local"
-        value: string
-        port: number | null
-        sslPort: number | null
-      }
-    | {
-        kind: "domain"
-        domain: string
-        subdomain: string | null
-        port: number | null
-        sslPort: number | null
-      }
-}
-
-export type HostnameInfoOnion = {
-  kind: "onion"
-  hostname: { value: string; port: number | null; sslPort: number | null }
-}
-
-export type HostnameInfo = HostnameInfoIp | HostnameInfoOnion
-
 export type ServiceInterfaceId = string
 
 export { ServiceInterface }
diff --git a/sdk/base/lib/util/getServiceInterface.ts b/sdk/base/lib/util/getServiceInterface.ts
index cbbb345cb..2e81e5ee2 100644
--- a/sdk/base/lib/util/getServiceInterface.ts
+++ b/sdk/base/lib/util/getServiceInterface.ts
@@ -1,15 +1,6 @@
 import { ServiceInterfaceType } from "../types"
 import { knownProtocols } from "../interfaces/Host"
-import {
-  AddressInfo,
-  Host,
-  HostAddress,
-  Hostname,
-  HostnameInfo,
-  HostnameInfoIp,
-  HostnameInfoOnion,
-  IpInfo,
-} from "../types"
+import { AddressInfo, Host, Hostname, HostnameInfo } from "../types"
 import { Effects } from "../Effects"
 
 export type UrlString = string
@@ -48,8 +39,6 @@ export type ServiceInterfaceFilled = {
   name: string
   /** Human readable description, used as tooltip usually */
   description: string
-  /** Whether or not the interface has a primary URL */
-  hasPrimary: boolean
   /** Whether or not to mask the URIs for this interface. Useful if the URIs contain sensitive information, such as a password, macaroon, or API key */
   masked: boolean
   /** Information about the host for this binding */
@@ -58,10 +47,6 @@ export type ServiceInterfaceFilled = {
   addressInfo: FilledAddressInfo | null
   /** Indicates if we are a ui/p2p/api for the kind of interface that this is representing */
   type: ServiceInterfaceType
-  /** The primary hostname for the service, as chosen by the user */
-  primaryHostname: Hostname | null
-  /** The primary URL for the service, as chosen by the user */
-  primaryUrl: UrlString | null
 }
 const either =
   <A>(...args: ((a: A) => boolean)[]) =>
@@ -89,7 +74,9 @@ export const addressHostToUrl = (
       if (host.hostname.kind === "domain") {
         hostname = `${host.hostname.subdomain ? `${host.hostname.subdomain}.` : ""}${host.hostname.domain}`
       } else if (host.hostname.kind === "ipv6") {
-        hostname = `[${host.hostname.value}]`
+        hostname = host.hostname.value.startsWith("fe80::")
+          ? `[${host.hostname.value}%${host.hostname.scopeId}]`
+          : `[${host.hostname.value}]`
       } else {
         hostname = host.hostname.value
       }
@@ -200,23 +187,13 @@ const makeInterfaceFilled = async ({
     hostId,
     callback,
   })
-  const primaryUrl = await effects.getPrimaryUrl({
-    hostId,
-    packageId,
-    callback,
-  })
 
   const interfaceFilled: ServiceInterfaceFilled = {
     ...serviceInterfaceValue,
-    primaryUrl: primaryUrl,
     host,
     addressInfo: host
       ? filledAddress(host, serviceInterfaceValue.addressInfo)
       : null,
-    get primaryHostname() {
-      if (primaryUrl == null) return null
-      return getHostname(primaryUrl)
-    },
   }
   return interfaceFilled
 }
diff --git a/sdk/base/lib/util/getServiceInterfaces.ts b/sdk/base/lib/util/getServiceInterfaces.ts
index 1d83684d6..faeb508b4 100644
--- a/sdk/base/lib/util/getServiceInterfaces.ts
+++ b/sdk/base/lib/util/getServiceInterfaces.ts
@@ -30,22 +30,10 @@ const makeManyInterfaceFilled = async ({
       if (!host) {
         throw new Error(`host ${hostId} not found!`)
       }
-      const primaryUrl = await effects
-        .getPrimaryUrl({
-          hostId,
-          packageId,
-          callback,
-        })
-        .catch(() => null)
       return {
         ...serviceInterfaceValue,
-        primaryUrl: primaryUrl,
         host,
         addressInfo: filledAddress(host, serviceInterfaceValue.addressInfo),
-        get primaryHostname() {
-          if (primaryUrl == null) return null
-          return getHostname(primaryUrl)
-        },
       }
     }),
   )
diff --git a/sdk/base/package-lock.json b/sdk/base/package-lock.json
index d7b491303..4d5625489 100644
--- a/sdk/base/package-lock.json
+++ b/sdk/base/package-lock.json
@@ -14,7 +14,7 @@
         "isomorphic-fetch": "^3.0.0",
         "lodash.merge": "^4.6.2",
         "mime-types": "^2.1.35",
-        "ts-matches": "^6.1.0",
+        "ts-matches": "^6.2.1",
         "yaml": "^2.2.2"
       },
       "devDependencies": {
@@ -3897,9 +3897,9 @@
       "dev": true
     },
     "node_modules/ts-matches": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/ts-matches/-/ts-matches-6.1.0.tgz",
-      "integrity": "sha512-01qvbIpOiKdbzzXDH84JeHunvCwBGFdZw94jS6kOGLSN5ms+1nBZtfe8WSuYMIPb1xPA+qyAiVgznFi2VCQ6UQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ts-matches/-/ts-matches-6.2.1.tgz",
+      "integrity": "sha512-qdnMgTHsGCEGGK6QiaNMY2vD9eQtRp2Q+pAxcOAzxHJKDKTBYsc1ISTg1zp8H2+EmtCB0eko/1TwYUA5/mUGug==",
       "license": "MIT"
     },
     "node_modules/ts-morph": {
diff --git a/sdk/base/package.json b/sdk/base/package.json
index 4cc2fc7ca..6eae719a7 100644
--- a/sdk/base/package.json
+++ b/sdk/base/package.json
@@ -27,7 +27,7 @@
     "isomorphic-fetch": "^3.0.0",
     "lodash.merge": "^4.6.2",
     "mime-types": "^2.1.35",
-    "ts-matches": "^6.1.0",
+    "ts-matches": "^6.2.1",
     "yaml": "^2.2.2"
   },
   "prettier": {
diff --git a/sdk/package/lib/StartSdk.ts b/sdk/package/lib/StartSdk.ts
index e7e87f963..390a5fe31 100644
--- a/sdk/package/lib/StartSdk.ts
+++ b/sdk/package/lib/StartSdk.ts
@@ -102,7 +102,6 @@ export class StartSdk<Manifest extends T.SDKManifest, Store> {
       | "clearServiceInterfaces"
       | "bind"
       | "getHostInfo"
-      | "getPrimaryUrl"
     type MainUsedEffects = "setMainStatus" | "setHealth"
     type CallbackEffects = "constRetry" | "clearCallbacks"
     type AlreadyExposed = "getSslCertificate" | "getSystemSmtp"
@@ -379,7 +378,6 @@ export class StartSdk<Manifest extends T.SDKManifest, Store> {
           id: 'ui',
           description: 'The primary web app for this service.',
           type: 'ui',
-          hasPrimary: false,
           masked: false,
           schemeOverride: null,
           username: null,
@@ -397,8 +395,6 @@ export class StartSdk<Manifest extends T.SDKManifest, Store> {
           id: string
           /** The human readable description. */
           description: string
-          /** No effect until StartOS v0.4.0. If true, forces the user to select one URL (i.e. .onion, .local, or IP address) as the primary URL. This is needed by some services to function properly. */
-          hasPrimary: boolean
           /** Affects how the interface appears to the user. One of: 'ui', 'api', 'p2p'. If 'ui', the user will see a "Launch UI" button */
           type: ServiceInterfaceType
           /** (optional) prepends the provided username to all URLs. */
@@ -562,7 +558,6 @@ export class StartSdk<Manifest extends T.SDKManifest, Store> {
               id: 'primary-ui',
               description: 'The primary web app for this service.',
               type: 'ui',
-              hasPrimary: false,
               masked: false,
               schemeOverride: null,
               username: null,
@@ -575,7 +570,6 @@ export class StartSdk<Manifest extends T.SDKManifest, Store> {
               id: 'admin-ui',
               description: 'The admin web app for this service.',
               type: 'ui',
-              hasPrimary: false,
               masked: false,
               schemeOverride: null,
               username: null,
@@ -596,7 +590,6 @@ export class StartSdk<Manifest extends T.SDKManifest, Store> {
               id: 'api',
               description: 'The advanced API for this service.',
               type: 'api',
-              hasPrimary: false,
               masked: false,
               schemeOverride: null,
               username: null,
@@ -1269,7 +1262,6 @@ export class StartSdk<Manifest extends T.SDKManifest, Store> {
                * @example default: 'radio1'
                */
               default: keyof Variants & string
-              required: boolean
               /**
                * @description A mapping of unique radio options to their human readable display format.
                * @example
diff --git a/sdk/package/lib/manifest/setupManifest.ts b/sdk/package/lib/manifest/setupManifest.ts
index 1a78c062c..3cd4f8bfb 100644
--- a/sdk/package/lib/manifest/setupManifest.ts
+++ b/sdk/package/lib/manifest/setupManifest.ts
@@ -26,16 +26,6 @@ export function setupManifest<
   return manifest
 }
 
-function gitHash(): string {
-  const hash = execSync("git rev-parse HEAD").toString().trim()
-  try {
-    execSync("git diff-index --quiet HEAD --")
-    return hash
-  } catch (e) {
-    return hash + "-modified"
-  }
-}
-
 export function buildManifest<
   Id extends string,
   Version extends string,
@@ -68,7 +58,6 @@ export function buildManifest<
   )
   return {
     ...manifest,
-    gitHash: gitHash(),
     osVersion: SDKVersion,
     version: versions.current.options.version,
     releaseNotes: versions.current.options.releaseNotes,
diff --git a/sdk/package/lib/test/host.test.ts b/sdk/package/lib/test/host.test.ts
index 87f22b8bd..4492804ec 100644
--- a/sdk/package/lib/test/host.test.ts
+++ b/sdk/package/lib/test/host.test.ts
@@ -15,7 +15,6 @@ describe("host", () => {
         name: "Foo",
         id: "foo",
         description: "A Foo",
-        hasPrimary: false,
         type: "ui",
         username: "bar",
         path: "/baz",
diff --git a/sdk/package/package-lock.json b/sdk/package/package-lock.json
index 9abc963fb..50efc6b57 100644
--- a/sdk/package/package-lock.json
+++ b/sdk/package/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@start9labs/start-sdk",
-  "version": "0.3.6-beta.0",
+  "version": "0.3.6-beta.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@start9labs/start-sdk",
-      "version": "0.3.6-beta.0",
+      "version": "0.3.6-beta.2",
       "license": "MIT",
       "dependencies": {
         "@iarna/toml": "^2.2.5",
@@ -15,7 +15,7 @@
         "isomorphic-fetch": "^3.0.0",
         "lodash.merge": "^4.6.2",
         "mime-types": "^2.1.35",
-        "ts-matches": "^6.1.0",
+        "ts-matches": "^6.2.1",
         "yaml": "^2.2.2"
       },
       "devDependencies": {
@@ -3918,9 +3918,9 @@
       "dev": true
     },
     "node_modules/ts-matches": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/ts-matches/-/ts-matches-6.1.0.tgz",
-      "integrity": "sha512-01qvbIpOiKdbzzXDH84JeHunvCwBGFdZw94jS6kOGLSN5ms+1nBZtfe8WSuYMIPb1xPA+qyAiVgznFi2VCQ6UQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ts-matches/-/ts-matches-6.2.1.tgz",
+      "integrity": "sha512-qdnMgTHsGCEGGK6QiaNMY2vD9eQtRp2Q+pAxcOAzxHJKDKTBYsc1ISTg1zp8H2+EmtCB0eko/1TwYUA5/mUGug==",
       "license": "MIT"
     },
     "node_modules/ts-morph": {
diff --git a/sdk/package/package.json b/sdk/package/package.json
index a5bb78159..6750ad372 100644
--- a/sdk/package/package.json
+++ b/sdk/package/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@start9labs/start-sdk",
-  "version": "0.3.6-beta.0",
+  "version": "0.3.6-beta.2",
   "description": "Software development kit to facilitate packaging services for StartOS",
   "main": "./package/lib/index.js",
   "types": "./package/lib/index.d.ts",
@@ -33,7 +33,7 @@
     "isomorphic-fetch": "^3.0.0",
     "lodash.merge": "^4.6.2",
     "mime-types": "^2.1.35",
-    "ts-matches": "^6.1.0",
+    "ts-matches": "^6.2.1",
     "yaml": "^2.2.2",
     "@iarna/toml": "^2.2.5",
     "@noble/curves": "^1.4.0",
diff --git a/web/package-lock.json b/web/package-lock.json
index a36b7511e..7f01cb133 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "startos-ui",
-  "version": "0.3.6-alpha.9",
+  "version": "0.3.6-alpha.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "startos-ui",
-      "version": "0.3.6-alpha.9",
+      "version": "0.3.6-alpha.10",
       "license": "MIT",
       "dependencies": {
         "@angular/animations": "^14.1.0",
diff --git a/web/package.json b/web/package.json
index 3f3709e11..b7a13a4b3 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "startos-ui",
-  "version": "0.3.6-alpha.9",
+  "version": "0.3.6-alpha.10",
   "author": "Start9 Labs, Inc",
   "homepage": "https://start9.com/",
   "license": "MIT",
diff --git a/web/projects/ui/src/app/pages/apps-routes/app-interfaces/app-interfaces.page.ts b/web/projects/ui/src/app/pages/apps-routes/app-interfaces/app-interfaces.page.ts
index 0b31dce4b..ca8645f18 100644
--- a/web/projects/ui/src/app/pages/apps-routes/app-interfaces/app-interfaces.page.ts
+++ b/web/projects/ui/src/app/pages/apps-routes/app-interfaces/app-interfaces.page.ts
@@ -121,9 +121,34 @@ function getAddresses(
 ): MappedAddress[] {
   const addressInfo = serviceInterface.addressInfo
 
-  const hostnames =
+  let hostnames =
     host.kind === 'multi' ? host.hostnameInfo[addressInfo.internalPort] : []
 
+  hostnames = hostnames.filter(
+    h =>
+      window.location.host === 'localhost' ||
+      h.kind !== 'ip' ||
+      h.hostname.kind !== 'ipv6' ||
+      !h.hostname.value.startsWith('fe80::'),
+  )
+  if (window.location.host === 'localhost') {
+    const local = hostnames.find(
+      h => h.kind === 'ip' && h.hostname.kind === 'local',
+    )
+    if (local) {
+      hostnames.unshift({
+        kind: 'ip',
+        networkInterfaceId: 'lo',
+        public: false,
+        hostname: {
+          kind: 'local',
+          port: local.hostname.port,
+          sslPort: local.hostname.sslPort,
+          value: 'localhost',
+        },
+      })
+    }
+  }
   const addressesWithNames = hostnames.flatMap(h => {
     let name = ''
 
@@ -144,14 +169,14 @@ function getAddresses(
 
     const addresses = utils.addressHostToUrl(addressInfo, h)
     if (addresses.length > 1) {
-      return utils.addressHostToUrl(addressInfo, h).map(url => ({
+      return addresses.map(url => ({
         name: `${name} (${new URL(url).protocol
           .replace(':', '')
           .toUpperCase()})`,
         url,
       }))
     } else {
-      return utils.addressHostToUrl(addressInfo, h).map(url => ({
+      return addresses.map(url => ({
         name,
         url,
       }))
diff --git a/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.html b/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.html
index 03d7ef3d7..c7bdf6a2a 100644
--- a/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.html
+++ b/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.html
@@ -58,25 +58,28 @@ <h2>LAN</h2>
         <ion-icon slot="icon-only" name="copy-outline"></ion-icon>
       </ion-button>
     </ion-item>
-    <ng-container *ngFor="let iface of server.ipInfo| keyvalue">
-      <ion-item *tuiLet="iface.value.ipv4 as ipv4">
-        <ion-label>
-          <h2>{{ iface.key }} (IPv4)</h2>
-          <p>{{ ipv4 || 'n/a' }}</p>
-        </ion-label>
-        <ion-button *ngIf="ipv4" slot="end" fill="clear" (click)="copy(ipv4)">
-          <ion-icon slot="icon-only" name="copy-outline"></ion-icon>
-        </ion-button>
-      </ion-item>
-      <ion-item *tuiLet="iface.value.ipv6 as ipv6">
-        <ion-label>
-          <h2>{{ iface.key }} (IPv6)</h2>
-          <p>{{ ipv6 || 'n/a' }}</p>
-        </ion-label>
-        <ion-button *ngIf="ipv6" slot="end" fill="clear" (click)="copy(ipv6)">
-          <ion-icon slot="icon-only" name="copy-outline"></ion-icon>
-        </ion-button>
-      </ion-item>
+    <ng-container *ngFor="let iface of server.networkInterfaces | keyvalue">
+      <ng-container *ngIf="(isLocalhost || iface.key !== 'lo') && iface.value.ipInfo">
+        <ng-container  *ngFor="let ipnet of iface.value.ipInfo.subnets">
+          <ng-container *ngIf="!ipnet.includes('fe80::') || isLocalhost">
+            <ion-item *tuiLet="ipnet.split('/')[0] as ipAddr">
+              <ion-label>
+                <h2>{{ iface.key }} ({{ ipAddr.includes("::") ? "IPv6" : "IPv4" }})</h2>
+                <p>{{
+                  ipAddr.includes("fe80::")
+                    ? "[" + ipAddr + "%" + iface.value.ipInfo.scopeId + "]"
+                    : ipAddr.includes("::")
+                      ? "[" + ipAddr + "]"
+                      : ipAddr 
+                }}</p>
+              </ion-label>
+              <ion-button slot="end" fill="clear" (click)="copy(ipAddr)">
+                <ion-icon slot="icon-only" name="copy-outline"></ion-icon>
+              </ion-button>
+            </ion-item>
+          </ng-container>
+        </ng-container>
+      </ng-container>
     </ng-container>
 
     <ion-item-divider>Device Credentials</ion-item-divider>
diff --git a/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.ts b/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.ts
index 0055ff6c1..6c7b41399 100644
--- a/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.ts
+++ b/web/projects/ui/src/app/pages/server-routes/server-specs/server-specs.page.ts
@@ -14,6 +14,7 @@ import { DataModel } from 'src/app/services/patch-db/data-model'
 })
 export class ServerSpecsPage {
   readonly server$ = this.patch.watch$('serverInfo')
+  readonly isLocalhost = window.location.host === 'localhost'
 
   constructor(
     private readonly toastCtrl: ToastController,
diff --git a/web/projects/ui/src/app/services/api/api.fixures.ts b/web/projects/ui/src/app/services/api/api.fixures.ts
index a3562caa6..a91976493 100644
--- a/web/projects/ui/src/app/services/api/api.fixures.ts
+++ b/web/projects/ui/src/app/services/api/api.fixures.ts
@@ -1721,7 +1721,6 @@ export module Mock {
     serviceInterfaces: {
       ui: {
         id: 'ui',
-        hasPrimary: false,
         masked: false,
         name: 'Web UI',
         description:
@@ -1738,7 +1737,6 @@ export module Mock {
       },
       rpc: {
         id: 'rpc',
-        hasPrimary: false,
         masked: false,
         name: 'RPC',
         description:
@@ -1755,7 +1753,6 @@ export module Mock {
       },
       p2p: {
         id: 'p2p',
-        hasPrimary: true,
         masked: false,
         name: 'P2P',
         description:
@@ -1776,7 +1773,8 @@ export module Mock {
       abcdefg: {
         kind: 'multi',
         bindings: [],
-        addresses: [],
+        onions: [],
+        domains: {},
         hostnameInfo: {
           80: [
             {
@@ -1829,7 +1827,8 @@ export module Mock {
               public: false,
               hostname: {
                 kind: 'ipv6',
-                value: '[FE80:CD00:0000:0CDE:1257:0000:211E:729CD]',
+                value: '[fe80:cd00:0000:0cde:1257:0000:211e:72cd]',
+                scopeId: 2,
                 port: null,
                 sslPort: 1234,
               },
@@ -1840,7 +1839,8 @@ export module Mock {
               public: false,
               hostname: {
                 kind: 'ipv6',
-                value: '[FE80:CD00:0000:0CDE:1257:0000:211E:1234]',
+                value: '[fe80:cd00:0000:0cde:1257:0000:211e:1234]',
+                scopeId: 3,
                 port: null,
                 sslPort: 1234,
               },
@@ -1859,7 +1859,8 @@ export module Mock {
       bcdefgh: {
         kind: 'multi',
         bindings: [],
-        addresses: [],
+        onions: [],
+        domains: {},
         hostnameInfo: {
           8332: [],
         },
@@ -1867,7 +1868,8 @@ export module Mock {
       cdefghi: {
         kind: 'multi',
         bindings: [],
-        addresses: [],
+        onions: [],
+        domains: {},
         hostnameInfo: {
           8333: [],
         },
@@ -1914,7 +1916,6 @@ export module Mock {
     serviceInterfaces: {
       ui: {
         id: 'ui',
-        hasPrimary: false,
         masked: false,
         name: 'Web UI',
         description: 'A launchable web app for Bitcoin Proxy',
@@ -1960,7 +1961,6 @@ export module Mock {
     serviceInterfaces: {
       grpc: {
         id: 'grpc',
-        hasPrimary: false,
         masked: false,
         name: 'GRPC',
         description:
@@ -1977,7 +1977,6 @@ export module Mock {
       },
       lndconnect: {
         id: 'lndconnect',
-        hasPrimary: false,
         masked: true,
         name: 'LND Connect',
         description:
@@ -1994,7 +1993,6 @@ export module Mock {
       },
       p2p: {
         id: 'p2p',
-        hasPrimary: true,
         masked: false,
         name: 'P2P',
         description:
diff --git a/web/projects/ui/src/app/services/api/mock-patch.ts b/web/projects/ui/src/app/services/api/mock-patch.ts
index 81e316b56..02ed582f1 100644
--- a/web/projects/ui/src/app/services/api/mock-patch.ts
+++ b/web/projects/ui/src/app/services/api/mock-patch.ts
@@ -41,21 +41,30 @@ export const mockPatchData: DataModel = {
     lastBackup: new Date(new Date().valueOf() - 604800001).toISOString(),
     lanAddress: 'https://adjective-noun.local',
     torAddress: 'https://myveryownspecialtoraddress.onion',
-    ipInfo: {
+    networkInterfaces: {
       eth0: {
-        ipv4: '10.0.0.1',
-        ipv4Range: '10.0.0.1/24',
-        ipv6: null,
-        ipv6Range: null,
+        public: false,
+        ipInfo: {
+          scopeId: 1,
+          subnets: ['10.0.0.1/24'],
+          wanIp: null,
+          ntpServers: [],
+        },
       },
       wlan0: {
-        ipv4: '10.0.90.12',
-        ipv4Range: '10.0.90.12/24',
-        ipv6: 'FE80:CD00:0000:0CDE:1257:0000:211E:729CD',
-        ipv6Range: 'FE80:CD00:0000:0CDE:1257:0000:211E:729CD/64',
+        public: false,
+        ipInfo: {
+          scopeId: 2,
+          subnets: [
+            '10.0.90.12/24',
+            'FE80:CD00:0000:0CDE:1257:0000:211E:729CD/64',
+          ],
+          wanIp: null,
+          ntpServers: [],
+        },
       },
     },
-    acme: null,
+    acme: {},
     unreadNotificationCount: 4,
     // password is asdfasdf
     passwordHash:
@@ -140,7 +149,6 @@ export const mockPatchData: DataModel = {
       serviceInterfaces: {
         ui: {
           id: 'ui',
-          hasPrimary: false,
           masked: false,
           name: 'Web UI',
           description:
@@ -157,7 +165,6 @@ export const mockPatchData: DataModel = {
         },
         rpc: {
           id: 'rpc',
-          hasPrimary: false,
           masked: false,
           name: 'RPC',
           description:
@@ -174,7 +181,6 @@ export const mockPatchData: DataModel = {
         },
         p2p: {
           id: 'p2p',
-          hasPrimary: true,
           masked: false,
           name: 'P2P',
           description:
@@ -195,7 +201,8 @@ export const mockPatchData: DataModel = {
         abcdefg: {
           kind: 'multi',
           bindings: [],
-          addresses: [],
+          onions: [],
+          domains: {},
           hostnameInfo: {
             80: [
               {
@@ -248,7 +255,8 @@ export const mockPatchData: DataModel = {
                 public: false,
                 hostname: {
                   kind: 'ipv6',
-                  value: '[FE80:CD00:0000:0CDE:1257:0000:211E:729CD]',
+                  value: '[fe80:cd00:0000:0cde:1257:0000:211e:72cd]',
+                  scopeId: 2,
                   port: null,
                   sslPort: 1234,
                 },
@@ -259,7 +267,8 @@ export const mockPatchData: DataModel = {
                 public: false,
                 hostname: {
                   kind: 'ipv6',
-                  value: '[FE80:CD00:0000:0CDE:1257:0000:211E:1234]',
+                  value: '[fe80:cd00:0000:0cde:1257:0000:211e:1234]',
+                  scopeId: 3,
                   port: null,
                   sslPort: 1234,
                 },
@@ -278,7 +287,8 @@ export const mockPatchData: DataModel = {
         bcdefgh: {
           kind: 'multi',
           bindings: [],
-          addresses: [],
+          onions: [],
+          domains: {},
           hostnameInfo: {
             8332: [],
           },
@@ -286,7 +296,8 @@ export const mockPatchData: DataModel = {
         cdefghi: {
           kind: 'multi',
           bindings: [],
-          addresses: [],
+          onions: [],
+          domains: {},
           hostnameInfo: {
             8333: [],
           },
@@ -335,7 +346,6 @@ export const mockPatchData: DataModel = {
       serviceInterfaces: {
         grpc: {
           id: 'grpc',
-          hasPrimary: false,
           masked: false,
           name: 'GRPC',
           description:
@@ -352,7 +362,6 @@ export const mockPatchData: DataModel = {
         },
         lndconnect: {
           id: 'lndconnect',
-          hasPrimary: false,
           masked: true,
           name: 'LND Connect',
           description:
@@ -369,7 +378,6 @@ export const mockPatchData: DataModel = {
         },
         p2p: {
           id: 'p2p',
-          hasPrimary: true,
           masked: false,
           name: 'P2P',
           description: