@wpelevator/tug 0.9.0 → 0.10.0

package/dist/control.js

@@ -23,8 +23,8 @@ import { ensureDir, errMessage, id, now } from "./util.js";
 import { ENROLL_DEFAULT_TTL_MS, NODE_LIFETIME_MS, Pki, SERVER_LIFETIME_MS, encodeCredential, identityUri, namesKey, parseIdentityUri, peerIdentity, serverNames, writeFileDurable, } from "./pki.js";
 import { EXPIRY_WARN_DAYS, certificateExpiry, diagnoseNode } from "./diagnostics.js";
 import { serverTlsOptions } from "./tls-server.js";
-import { DEFAULT_MESH_CIDR, DEFAULT_WG_PORT, WG_INTERFACE, WG_KEEPALIVE, allocateOverlayIp, isWgKey, parseCidr, wgEndpoint, isNodeEndpoint, isNodeHost, } from "./mesh.js";
-import { buildIngressWork, resolveServiceEndpoints } from "./ingress.js";
+import { isNodeHost } from "./node-address.js";
+import { buildIngressWork, ingressConfigHash, resolveServiceEndpoints } from "./ingress.js";
 import { parseStatusReport } from "./status-report.js";
 import { ACTIVE_DEPLOYMENT_STATES, LIVE_MAX_FRAME_BYTES, LIVE_MAX_BUFFERED_BYTES, LIVE_MAX_SESSIONS, LIVE_START_TIMEOUT_MS, BACKUP_COMMAND_TYPES, } from "./protocol.js";
 import { BACKUP_SECRET_PROJECT, isReservedProject, parseBackupDestination, projectRepository, repositoryPassword, redactSecrets, } from "./backup-destination.js";
@@ -431,14 +431,8 @@ export async function createApp(options = {}) {
     });
     const dbFile = path.join(DATA_DIR, 'tug.db');
     const masterKeyFile = path.join(DATA_DIR, 'master.key');
-    // Networking layers are opt-in; with all of them off the work response is unchanged.
-    const MESH = process.env.TUG_MESH === 'true';
-    const MESH_CIDR = process.env.TUG_MESH_CIDR || DEFAULT_MESH_CIDR;
-    const WG_PORT = Number(process.env.TUG_WG_PORT || DEFAULT_WG_PORT);
-    const SERVICE_DNS = (process.env.TUG_SERVICE_NAMES ?? String(MESH)) === 'true';
+    const SERVICE_DNS = process.env.TUG_SERVICE_NAMES !== 'false';
     const ACME_EMAIL = process.env.TUG_ACME_EMAIL || undefined;
-    if (MESH)
-        parseCidr(MESH_CIDR);
     const db = await (options.openDatabase || openDb)(dbFile);
     const wakeHub = new WakeHub();
     // Events are an operator-facing log, not a record of truth, so keep them bounded. `0` turns a limit off; anything that is
@@ -479,14 +473,16 @@ export async function createApp(options = {}) {
     const masterKey = await loadOrCreateMasterKey(masterKeyFile);
     // A CA is created only for a fresh installation; existing state with missing or mismatched CA material is a startup error.
     const pki = await Pki.load(path.join(DATA_DIR, 'pki'), !db.get('SELECT 1 FROM operator_credentials') && !db.get('SELECT 1 FROM nodes'));
-    const advertiseUrl = () => {
-        const url = options.advertiseUrl ?? process.env.TUG_ADVERTISE_URL;
+    const configuredControlUrl = options.controlUrl ?? process.env.TUG_CONTROL_URL;
+    const controlUrl = () => {
+        const url = configuredControlUrl;
         if (!url)
-            throw httpError(500, 'TUG_ADVERTISE_URL is not set');
+            throw httpError(500, 'TUG_CONTROL_URL is not set');
         return new URL(url).origin;
     };
     const app = express();
     app.locals.pki = pki;
+    app.locals.controlUrl = configuredControlUrl;
     app.locals.dataDir = DATA_DIR;
     /** Resolves a presented certificate (principal URI and key hash) to a principal from current database state. */
     function resolvePrincipal(uri, keyHash) {
@@ -685,7 +681,40 @@ export async function createApp(options = {}) {
             ? JSON.parse(byNode.get(node)?.status_json || '{}').observedRevision === state.revision
             : byNode.get(node)?.observed_version === state.version) &&
             ['serving', 'skipped'].includes(byNode.get(node)?.health ?? ''));
-        if (ok)
+        // For projects using managed ingress, wait until each enabled ingress node has applied
+        // the current routing configuration. Container health alone does not prove a switch.
+        const ingressServices = Object.entries(state.compose.services || {})
+            .filter(([, service]) => service['x-tug']?.ingress)
+            .map(([name]) => name);
+        // A revision that removes its last route must wait for that removal too.
+        const previous = db.get(`SELECT ds.state_json FROM desired_states ds JOIN deployments d ON d.id=ds.deployment_id
+       WHERE d.project_id=? AND d.id<>? AND d.state='succeeded' ORDER BY d.created_at DESC LIMIT 1`, projectId, project.current_deployment_id);
+        const previouslyRouted = previous
+            ? Object.values(JSON.parse(previous.state_json).compose.services || {}).some((service) => service['x-tug']?.ingress)
+            : false;
+        const ingressNodes = ingressServices.length || previouslyRouted
+            ? db.all('SELECT * FROM nodes WHERE ingress=1 AND disabled_at IS NULL')
+            : [];
+        const staleBefore = new Date(Date.now() - Number(process.env.TUG_STALE_SECONDS || 60) * 1000).toISOString();
+        const ingressReady = !ingressNodes.length ||
+            ingressNodes.every((node) => {
+                const work = ingressFor(node, currentDesiredStates());
+                if (!ingressServices.every((service) => work.routes.some((route) => route.project === projectId && route.service === service && route.upstreams.length)))
+                    return false;
+                if (!node.ingress_status_json)
+                    return false;
+                try {
+                    const status = JSON.parse(node.ingress_status_json);
+                    return (status.state === 'serving' &&
+                        status.configHash === ingressConfigHash(work) &&
+                        typeof status.reportedAt === 'string' &&
+                        status.reportedAt >= staleBefore);
+                }
+                catch {
+                    return false;
+                }
+            });
+        if (ok && ingressReady)
             db.run('UPDATE deployments SET state=?,updated_at=? WHERE id=? AND state=?', 'succeeded', now(), project.current_deployment_id, 'rolling_out');
     }
     /** Events control writes when it rolls back on its own; they are attributed to a reserved system actor. */
@@ -937,41 +966,7 @@ export async function createApp(options = {}) {
     /** A node whose agent has been seen before but not within TUG_STALE_SECONDS; never-seen (just registered) nodes stay schedulable. */
     const isStale = (row) => !!row.last_seen_at &&
         Date.parse(row.last_seen_at) < Date.now() - Number(process.env.TUG_STALE_SECONDS || 60) * 1000;
-    const NODE_INFO_SQL = 'SELECT id,name,address,public_address,overlay_ip,labels_json,status,created_at,updated_at FROM nodes WHERE id=?';
-    /** Allocates the node's stable overlay IP on first registration (retrying if a concurrent register took it). */
-    function ensureOverlayIp(nodeId) {
-        if (!MESH)
-            return;
-        for (let attempt = 0; attempt < 5; attempt++) {
-            const row = db.get('SELECT overlay_ip FROM nodes WHERE id=?', nodeId);
-            if (row?.overlay_ip)
-                return;
-            const used = db
-                .all('SELECT overlay_ip FROM nodes WHERE overlay_ip IS NOT NULL')
-                .map((r) => r.overlay_ip);
-            try {
-                db.run('UPDATE nodes SET overlay_ip=? WHERE id=? AND overlay_ip IS NULL', allocateOverlayIp(MESH_CIDR, used), nodeId);
-                return;
-            }
-            catch (e) {
-                if (!isUniqueViolation(e))
-                    throw e;
-            }
-        }
-        throw new Error('could not allocate an overlay address');
-    }
-    /** Stores (or refreshes) the node's WireGuard peer entry; the private key never reaches control. */
-    function syncWgPeer(nodeId, publicKey) {
-        if (!MESH)
-            return;
-        const node = db.get('SELECT * FROM nodes WHERE id=?', nodeId);
-        const existing = db.get('SELECT * FROM wg_peers WHERE node_id=?', nodeId);
-        const key = publicKey ?? existing?.public_key;
-        if (!node?.overlay_ip || !key)
-            return;
-        db.run(`INSERT INTO wg_peers(node_id,public_key,overlay_ip,endpoint,allowed_ips,updated_at) VALUES(?,?,?,?,?,?)
-      ON CONFLICT(node_id) DO UPDATE SET public_key=excluded.public_key,overlay_ip=excluded.overlay_ip,endpoint=excluded.endpoint,allowed_ips=excluded.allowed_ips,updated_at=excluded.updated_at`, nodeId, key, node.overlay_ip, wgEndpoint(node.public_address, WG_PORT) ?? null, `${node.overlay_ip}/32`, now());
-    }
+    const NODE_INFO_SQL = 'SELECT id,name,address,labels_json,status,created_at,updated_at FROM nodes WHERE id=?';
     const NODE_RENEW_MIN_INTERVAL_MS = () => Number(process.env.TUG_RENEW_MIN_INTERVAL_MS ?? 60 * 60 * 1000);
     const nodeInfo = (nodeId) => {
         const row = db.get(NODE_INFO_SQL, nodeId);
@@ -981,8 +976,6 @@ export async function createApp(options = {}) {
             id: row.id,
             name: row.name,
             address: row.address,
-            public_address: row.public_address,
-            overlay_ip: row.overlay_ip,
             labels: row.labels_json ? JSON.parse(row.labels_json) : [],
             status: row.status,
             created_at: row.created_at,
@@ -996,22 +989,16 @@ export async function createApp(options = {}) {
             throw httpError(400, 'node name must be 1-63 letters, numbers, dots, underscores or hyphens');
         if (input.address && !isNodeHost(input.address))
             throw httpError(400, 'address must be an IP address or hostname without a port');
-        if (input.publicAddress && !isNodeEndpoint(input.publicAddress))
-            throw httpError(400, 'publicAddress must be an IP address or hostname with an optional port');
-        if (input.wgPublicKey !== undefined && !isWgKey(input.wgPublicKey))
-            throw httpError(400, 'wgPublicKey must be a base64 WireGuard public key');
         const ts = now();
-        db.run(`INSERT INTO nodes(id,name,address,public_address,status,labels_json,key_hash,cert_not_after,created_at,updated_at)
-      VALUES(?,?,?,?,?,?,?,?,?,?)`, input.id, input.name, input.address || null, input.publicAddress || null, 'registered', JSON.stringify(Array.isArray(input.labels) ? input.labels : []), input.keyHash, input.notAfter.toISOString(), ts, ts);
-        ensureOverlayIp(input.id);
-        syncWgPeer(input.id, input.wgPublicKey);
+        db.run(`INSERT INTO nodes(id,name,address,status,labels_json,key_hash,cert_not_after,created_at,updated_at)
+      VALUES(?,?,?,?,?,?,?,?,?)`, input.id, input.name, input.address || null, 'registered', JSON.stringify(Array.isArray(input.labels) ? input.labels : []), input.keyHash, input.notAfter.toISOString(), ts, ts);
         wakeAll();
     }
     const identityResponse = (nodeId, cert) => ({
         node: nodeInfo(nodeId),
         certificate: cert,
         ca: pki.caPem,
-        url: advertiseUrl(),
+        url: controlUrl(),
     });
     // The node generates its key and CSR; an admin posts the CSR here. The private key is never transmitted.
     api('post', '/api/v1/nodes/:name/identity', null, async (req, res) => {
@@ -1047,7 +1034,6 @@ export async function createApp(options = {}) {
                         keyHash: signed.keyHash,
                         notAfter: signed.notAfter,
                         address: body.address,
-                        publicAddress: body.publicAddress,
                         labels: body.labels,
                     });
                 }
@@ -1055,13 +1041,18 @@ export async function createApp(options = {}) {
             else {
                 if (!existing)
                     return res.status(404).json({ error: 'node not found' });
-                db.run("UPDATE nodes SET key_hash=?,disabled_at=NULL,status='registered',cert_not_after=?,updated_at=? WHERE id=?", signed.keyHash, signed.notAfter.toISOString(), now(), existing.id);
+                if (body.address !== undefined && !isNodeHost(body.address))
+                    throw httpError(400, 'address must be an IP address or hostname without a port');
+                const address = body.address === undefined ? existing.address : body.address;
+                db.run("UPDATE nodes SET key_hash=?,disabled_at=NULL,status='registered',cert_not_after=?,address=?,updated_at=? WHERE id=?", signed.keyHash, signed.notAfter.toISOString(), address || null, now(), existing.id);
                 audit(req.actor, {
                     type: 'node.replaced',
                     message: `node ${name} key replaced by ${req.actor.name}`,
                     metadata: { node: name },
                 });
                 reconcileSockets();
+                endpointSnapshot = JSON.stringify(endpointsFor(currentDesiredStates()));
+                wakeAll();
             }
             res.json(identityResponse(nodeId, signed.cert));
         }
@@ -1082,7 +1073,7 @@ export async function createApp(options = {}) {
             return res.status(400).json({ error: 'labels must be a list of strings' });
         const ttlSeconds = Math.max(1, Number(req.body.ttlSeconds ?? ENROLL_DEFAULT_TTL_MS / 1000));
         const rowId = id('enr');
-        const issued = await pki.issueClient(identityUri('enroll', rowId), ttlSeconds * 1000, advertiseUrl());
+        const issued = await pki.issueClient(identityUri('enroll', rowId), ttlSeconds * 1000, controlUrl());
         const expiresAt = issued.notAfter.toISOString();
         db.run('DELETE FROM enrollment_credentials WHERE expires_at < ?', new Date(Date.now() - 86_400_000).toISOString());
         // Minting again for a name revokes its previous unconsumed key.
@@ -1123,8 +1114,6 @@ export async function createApp(options = {}) {
                     keyHash: signed.keyHash,
                     notAfter: signed.notAfter,
                     address: body.address,
-                    publicAddress: body.publicAddress,
-                    wgPublicKey: body.wgPublicKey,
                     labels: fresh.labels_json ? JSON.parse(fresh.labels_json) : [],
                 });
                 db.run('UPDATE enrollment_credentials SET node_id=?,node_key_hash=? WHERE id=?', fresh.reserved_node_id, signed.keyHash, fresh.id);
@@ -1173,13 +1162,13 @@ export async function createApp(options = {}) {
             metadata: { node: node.name },
         });
         reconcileSockets();
-        // Healthy peers drop the node from their mesh and ingress configuration on their next work fetch.
+        // Other nodes drop the node from service endpoints and ingress configuration on their next work fetch.
         endpointSnapshot = JSON.stringify(endpointsFor(currentDesiredStates()));
         wakeAll();
         res.json({ ok: true, node: node.name });
     });
     api('get', '/api/v1/nodes', null, async (req, res) => {
-        const rows = db.all('SELECT id,name,address,public_address,overlay_ip,ingress,ingress_status_json,status,labels_json,last_seen_at,disabled_at,cert_not_after,created_at,updated_at FROM nodes ORDER BY name');
+        const rows = db.all('SELECT id,name,address,ingress,ingress_status_json,status,labels_json,last_seen_at,disabled_at,cert_not_after,created_at,updated_at FROM nodes ORDER BY name');
         res.json({
             nodes: rows.map((row) => {
                 const { labels_json, ...rest } = row;
@@ -1197,17 +1186,7 @@ export async function createApp(options = {}) {
         wakeHub.wake(nodeId, projectId ?? undefined);
         return commandId;
     }
-    // The private key lives only on the node, so rotation is a command the agent executes: it
-    // generates a new keypair, reports the public key and peers pick it up from their next work response.
-    api('post', '/api/v1/nodes/:name/rotate-wg-key', null, async (req, res) => {
-        if (!MESH)
-            return res.status(409).json({ error: 'the WireGuard mesh is not enabled (TUG_MESH=true)' });
-        const node = findNode(String(req.params.name));
-        if (!node)
-            return res.status(404).json({ error: 'node not found' });
-        res.json({ commandId: queueCommand(node.id, null, 'wg.rotate-key'), nodeId: node.id });
-    });
-    // Removes a retired node: its identity, WireGuard peer, statuses and queued commands. Refused while a current deployment still places
+    // Removes a retired node: its identity, statuses and queued commands. Refused while a current deployment still places
     // something on it (redeploy without it first) or while its agent is still reporting, unless force=true.
     api('delete', '/api/v1/nodes/:name', null, async (req, res) => {
         const node = db.get('SELECT id,name,last_seen_at FROM nodes WHERE name=? OR id=?', String(req.params.name), String(req.params.name));
@@ -1232,7 +1211,6 @@ export async function createApp(options = {}) {
             });
         db.run('DELETE FROM commands WHERE node_id=?', node.id);
         db.run('DELETE FROM node_statuses WHERE node_id=?', node.id);
-        db.run('DELETE FROM wg_peers WHERE node_id=?', node.id);
         db.run('DELETE FROM nodes WHERE id=?', node.id);
         db.run('UPDATE enrollment_credentials SET revoked_at=COALESCE(revoked_at,?) WHERE name=? AND node_id IS NULL', now(), node.name);
         reconcileSockets();
@@ -1244,33 +1222,37 @@ export async function createApp(options = {}) {
         wakeAll();
         res.json({ ok: true, node: node.name });
     });
+    api('post', '/api/v1/nodes/:name/address', null, async (req, res) => {
+        const node = findNode(String(req.params.name));
+        if (!node)
+            return res.status(404).json({ error: 'node not found' });
+        const { address } = req.body;
+        if (!isNodeHost(address))
+            return res
+                .status(400)
+                .json({ error: 'address must be an IP address or hostname without a port' });
+        db.run('UPDATE nodes SET address=?,updated_at=? WHERE id=?', address, now(), node.id);
+        audit(req.actor, {
+            type: 'node.address',
+            message: `node ${node.name} address changed`,
+            metadata: { node: node.name, address },
+        });
+        endpointSnapshot = JSON.stringify(endpointsFor(currentDesiredStates()));
+        wakeAll();
+        res.json({ ok: true, node: node.name, address });
+    });
     api('post', '/api/v1/nodes/:name/ingress', null, async (req, res) => {
         const node = findNode(String(req.params.name));
         if (!node)
             return res.status(404).json({ error: 'node not found' });
         const enabled = req.body.enabled !== false;
-        db.run('UPDATE nodes SET ingress=?,updated_at=? WHERE id=?', enabled ? 1 : 0, now(), node.id);
+        db.run('UPDATE nodes SET ingress_status_json=CASE WHEN ingress<>? THEN NULL ELSE ingress_status_json END,ingress=?,updated_at=? WHERE id=?', enabled ? 1 : 0, enabled ? 1 : 0, now(), node.id);
         wakeHub.wake(node.id);
         res.json({ ok: true, node: node.name, ingress: enabled });
     });
-    post('/agent/v1/wireguard/key', authAgent, async (req, res) => {
-        if (!MESH)
-            return res.status(409).json({ error: 'the WireGuard mesh is not enabled' });
-        const { publicKey } = req.body;
-        if (!isWgKey(publicKey))
-            return res.status(400).json({ error: 'publicKey must be a base64 WireGuard public key' });
-        try {
-            syncWgPeer(req.node.id, publicKey);
-            wakeAll();
-            res.json({ ok: true });
-        }
-        catch (e) {
-            sendError(res, isUniqueViolation(e) ? httpError(409, 'public key already registered to another node') : e);
-        }
-    });
     api('post', '/api/v1/credentials', null, async (req, res) => {
         const request = parseCredentialRequest(req.body);
-        const created = await createCredential(db, pki, advertiseUrl(), request, req.actor.name);
+        const created = await createCredential(db, pki, controlUrl(), request, req.actor.name);
         audit(req.actor, {
             type: 'credential.create',
             message: `credential ${created.name} (${created.role}${created.projects ? `, projects: ${created.projects.join(', ')}` : ''}) created by ${req.actor.name}`,
@@ -2219,15 +2201,6 @@ export async function createApp(options = {}) {
         await check('docker', async () => ({
             output: (await runCommand('docker', ['version', '--format', '{{.Server.Version}}'])).out.trim(),
         }));
-        if (MESH) {
-            await check('mesh', async () => {
-                const nodes = db.all('SELECT n.name, n.overlay_ip, EXISTS(SELECT 1 FROM wg_peers w WHERE w.node_id=n.id) AS has_key FROM nodes n');
-                const missing = nodes.filter((n) => !n.has_key).map((n) => n.name);
-                if (missing.length)
-                    throw new Error(`nodes without a reported WireGuard key (is TUG_MESH=true on their agents?): ${missing.join(', ')}`);
-                return { cidr: MESH_CIDR, port: WG_PORT, nodes: nodes.length };
-            });
-        }
         const ingressNodes = db.all('SELECT name,ingress_status_json FROM nodes WHERE ingress=1');
         if (ingressNodes.length) {
             await check('ingress', async () => {
@@ -2261,10 +2234,9 @@ export async function createApp(options = {}) {
     }
     function endpointsFor(states) {
         const staleBefore = new Date(Date.now() - Number(process.env.TUG_STALE_SECONDS || 60) * 1000).toISOString();
-        const nodes = db.all('SELECT n.*, EXISTS(SELECT 1 FROM wg_peers w WHERE w.node_id=n.id) AS has_key FROM nodes n WHERE n.disabled_at IS NULL');
+        const nodes = db.all('SELECT * FROM nodes WHERE disabled_at IS NULL');
         const views = nodes.map((n) => ({
             name: n.name,
-            overlayIp: MESH && n.has_key ? n.overlay_ip : null,
             address: n.address,
             lastSeenAt: n.last_seen_at,
         }));
@@ -2277,24 +2249,6 @@ export async function createApp(options = {}) {
         }));
         return resolveServiceEndpoints(states, views, statuses, staleBefore);
     }
-    function networkFor(node) {
-        if (!MESH || !node.overlay_ip)
-            return undefined;
-        const peers = db.all('SELECT w.*, n.name FROM wg_peers w JOIN nodes n ON n.id=w.node_id WHERE w.node_id != ? AND n.disabled_at IS NULL ORDER BY n.name', node.id);
-        return {
-            interface: WG_INTERFACE,
-            overlayIp: node.overlay_ip,
-            cidr: MESH_CIDR,
-            listenPort: WG_PORT,
-            peers: peers.map((p) => ({
-                node: p.name,
-                publicKey: p.public_key,
-                endpoint: p.endpoint ?? undefined,
-                allowedIps: p.allowed_ips.split(','),
-                persistentKeepalive: WG_KEEPALIVE,
-            })),
-        };
-    }
     /** Names of all nodes and of the ingress nodes, for port binding and upstream decisions. */
     function nodeTopology() {
         const rows = db.all('SELECT name,ingress FROM nodes WHERE disabled_at IS NULL ORDER BY name');
@@ -2305,7 +2259,6 @@ export async function createApp(options = {}) {
     }
     /** Where this node's published ports listen: the address other nodes and the ingress reach it on, or loopback. */
     function portBindingFor(node, states) {
-        const hasKey = MESH && node.overlay_ip && db.get('SELECT 1 FROM wg_peers WHERE node_id=?', node.id);
         const { nodes, ingressNodes } = nodeTopology();
         const loopback = {};
         for (const state of states) {
@@ -2313,7 +2266,7 @@ export async function createApp(options = {}) {
             if (services.length)
                 loopback[state.project] = services;
         }
-        return { address: (hasKey ? node.overlay_ip : node.address) || null, loopback };
+        return { address: node.address || null, loopback };
     }
     function ingressFor(node, states) {
         const secrets = new Map();
@@ -2367,9 +2320,6 @@ export async function createApp(options = {}) {
             commands,
             retainedImages,
         };
-        const network = networkFor(node);
-        if (network)
-            work.network = network;
         work.ports = portBindingFor(node, desiredStates);
         const holds = restores.holds();
         if (Object.keys(holds).length)
@@ -2408,7 +2358,6 @@ export async function createApp(options = {}) {
                 }),
             };
             db.run(`INSERT INTO node_statuses(id,node_id,project_id,observed_version,status_json,health,updated_at) VALUES(?,?,?,?,?,?,?) ON CONFLICT(node_id,project_id) DO UPDATE SET observed_version=excluded.observed_version,status_json=excluded.status_json,health=excluded.health,updated_at=excluded.updated_at`, id('ns'), req.node.id, st.project, st.observedVersion, JSON.stringify(sanitized), st.health, ts);
-            updateDeploymentConvergence(st.project);
         }
         // Commands are resolved under the calling node first: only a running command of this node can be
         // heartbeated or completed, so foreign and already-finished command ids change nothing.
@@ -2423,10 +2372,14 @@ export async function createApp(options = {}) {
             db.run("UPDATE commands SET state=?,result_json=?,updated_at=? WHERE id=? AND node_id=? AND state='running'", cr.state, JSON.stringify(cr.result), ts, cr.commandId, req.node.id);
         }
         if (report.ingress)
-            db.run('UPDATE nodes SET ingress_status_json=? WHERE id=?', JSON.stringify({ ...report.ingress, reportedAt: ts }), req.node.id);
+            db.run('UPDATE nodes SET ingress_status_json=? WHERE id=? AND ingress=1 AND disabled_at IS NULL', JSON.stringify({ ...report.ingress, reportedAt: ts }), req.node.id);
         db.run('UPDATE nodes SET last_seen_at=?,status=? WHERE id=?', ts, 'online', req.node.id);
         if (report.sentAt)
             db.run('UPDATE nodes SET clock_skew_ms=?,clock_observed_at=? WHERE id=?', Date.parse(report.sentAt) - Date.parse(ts), ts, req.node.id);
+        // Ingress-only nodes can acknowledge routing without reporting any project; recheck
+        // every active rollout after all project and ingress observations have been stored.
+        for (const deployment of db.all("SELECT DISTINCT project_id FROM deployments WHERE state='rolling_out'"))
+            updateDeploymentConvergence(deployment.project_id);
         try {
             restores.advance();
         }
@@ -2598,18 +2551,18 @@ async function ensureServerCredential(pki, dir, names, force = false) {
 export async function listen(app, port = PORT) {
     const pki = app.locals.pki;
     const dataDir = app.locals.dataDir;
-    const advertiseUrl = process.env.TUG_ADVERTISE_URL;
-    if (!advertiseUrl)
-        throw new Error('TUG_ADVERTISE_URL is required: the credential-free https origin clients connect to');
-    const url = new URL(advertiseUrl);
+    const advertised = app.locals.controlUrl;
+    if (!advertised)
+        throw new Error('TUG_CONTROL_URL is required: the credential-free https origin clients connect to');
+    const url = new URL(advertised);
     if (url.protocol !== 'https:' ||
         url.username ||
         url.password ||
         url.search ||
         url.hash ||
         url.pathname !== '/')
-        throw new Error('TUG_ADVERTISE_URL must be a credential-free https origin such as https://control.example.com:8443');
-    const names = serverNames(advertiseUrl, (process.env.TUG_EXTRA_SANS || '').split(','));
+        throw new Error('TUG_CONTROL_URL must be a credential-free https origin such as https://control.example.com:8443');
+    const names = serverNames(advertised, (process.env.TUG_EXTRA_SANS || '').split(','));
     const credential = await ensureServerCredential(pki, dataDir, names);
     const server = https.createServer(serverTlsOptions({ cert: credential.cert, key: credential.key, ca: pki.caPem }), app);
     server.requestTimeout = 5 * 60_000;

package/dist/credentials.js

@@ -39,7 +39,7 @@ export const ROUTE_ROLES = {
     'POST /api/v1/nodes/enrollment-credential': 'admin',
     'POST /api/v1/nodes/:name/identity': 'admin',
     'POST /api/v1/nodes/:name/disable': 'admin',
-    'POST /api/v1/nodes/:name/rotate-wg-key': 'admin',
+    'POST /api/v1/nodes/:name/address': 'admin',
     'POST /api/v1/nodes/:name/ingress': 'admin',
     'DELETE /api/v1/nodes/:name': 'admin',
     'POST /api/v1/backups/run': 'deploy',

package/dist/db.d.ts

@@ -13,8 +13,6 @@ export interface NodeRow {
     id: string;
     name: string;
     address: string | null;
-    public_address: string | null;
-    overlay_ip: string | null;
     ingress: number;
     ingress_status_json: string | null;
     status: string;
@@ -31,14 +29,6 @@ export interface NodeRow {
     created_at: string;
     updated_at: string;
 }
-export interface WgPeerRow {
-    node_id: string;
-    public_key: string;
-    overlay_ip: string;
-    endpoint: string | null;
-    allowed_ips: string;
-    updated_at: string;
-}
 export interface EnrollmentCredentialRow {
     id: string;
     key_hash: string;

package/dist/db.js

@@ -54,8 +54,7 @@ function initializeControl(db) {
     db.exec(`
 CREATE TABLE IF NOT EXISTS meta(key TEXT PRIMARY KEY, value TEXT NOT NULL);
 CREATE TABLE IF NOT EXISTS projects(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, current_deployment_id TEXT, created_at TEXT, updated_at TEXT);
-CREATE TABLE IF NOT EXISTS nodes(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, address TEXT, public_address TEXT, overlay_ip TEXT UNIQUE, ingress INTEGER NOT NULL DEFAULT 0, ingress_status_json TEXT, status TEXT, labels_json TEXT, key_hash TEXT, disabled_at TEXT, cert_not_after TEXT, last_renewed_at TEXT, last_seen_at TEXT, clock_skew_ms INTEGER, clock_observed_at TEXT, created_at TEXT, updated_at TEXT);
-CREATE TABLE IF NOT EXISTS wg_peers(node_id TEXT PRIMARY KEY, public_key TEXT NOT NULL UNIQUE, overlay_ip TEXT NOT NULL, endpoint TEXT, allowed_ips TEXT NOT NULL, updated_at TEXT);
+CREATE TABLE IF NOT EXISTS nodes(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, address TEXT, ingress INTEGER NOT NULL DEFAULT 0, ingress_status_json TEXT, status TEXT, labels_json TEXT, key_hash TEXT, disabled_at TEXT, cert_not_after TEXT, last_renewed_at TEXT, last_seen_at TEXT, clock_skew_ms INTEGER, clock_observed_at TEXT, created_at TEXT, updated_at TEXT);
 CREATE TABLE IF NOT EXISTS enrollment_credentials(id TEXT PRIMARY KEY, key_hash TEXT UNIQUE NOT NULL, name TEXT NOT NULL, labels_json TEXT, expires_at TEXT NOT NULL, revoked_at TEXT, node_id TEXT, reserved_node_id TEXT NOT NULL, node_key_hash TEXT, created_at TEXT);
 CREATE TABLE IF NOT EXISTS deployments(id TEXT PRIMARY KEY, project_id TEXT, version TEXT, state TEXT, created_at TEXT, updated_at TEXT, error_message TEXT, actor TEXT);
 CREATE TABLE IF NOT EXISTS desired_states(id TEXT PRIMARY KEY, project_id TEXT, deployment_id TEXT, version TEXT, state_json TEXT, created_at TEXT);

package/dist/ingress.d.ts

@@ -4,8 +4,7 @@ export declare const CADDY_CONTAINER = "tug-caddy";
 export declare const DEFAULT_CADDY_IMAGE = "caddy:2-alpine";
 export interface NodeView {
     name: string;
-    /** Reachable mesh address; null when the mesh is off or the node has not reported a key yet. */
-    overlayIp: string | null;
+    /** Operator-provided address other nodes use to reach this node's published ports. */
     address: string | null;
     lastSeenAt: string | null;
 }

package/dist/ingress.js

@@ -26,7 +26,7 @@ export function resolveServiceEndpoints(states, nodes, statuses, staleBefore) {
             const endpoints = [];
             for (const nodeName of spec.placement?.nodes || []) {
                 const node = byName.get(nodeName);
-                const address = node && (node.overlayIp || node.address);
+                const address = node?.address;
                 if (!node || !address || !node.lastSeenAt || node.lastSeenAt < staleBefore)
                     continue;
                 const serviceState = reported.get(`${nodeName}\0${state.project}`)?.serviceStates?.[service];

package/dist/main.js

@@ -9,7 +9,7 @@ async function readStdin() {
     return Buffer.concat(chunks).toString('utf8');
 }
 const usage = `Usage: tug-runtime <control|agent> [command]
-  control                          run the control plane (needs TUG_ADVERTISE_URL)
+  control                          run the control plane (needs TUG_CONTROL_URL)
   control issue-credential         issue an operator credential on the control-plane host (--name, --role, --replace)
   agent                            run the node agent
   agent identity                   print the CSR for this node's pending key

package/dist/node-address.d.ts

@@ -0,0 +1,2 @@
+/** An IP literal or DNS hostname with no port, brackets, whitespace or other syntax that could reach generated configuration. */
+export declare const isNodeHost: (value: unknown) => value is string;

package/dist/node-address.js

@@ -0,0 +1,6 @@
+import { isIP } from 'node:net';
+const HOST_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/i;
+/** An IP literal or DNS hostname with no port, brackets, whitespace or other syntax that could reach generated configuration. */
+export const isNodeHost = (value) => typeof value === 'string' &&
+    value.length <= 253 &&
+    (isIP(value) !== 0 || value.split('.').every((label) => HOST_LABEL.test(label)));

package/dist/pki.d.ts

@@ -59,7 +59,7 @@ export interface SubjectNames {
     ip: string[];
 }
 /** The DNS names and IP addresses a server certificate covers, from the public URL plus optional extras. */
-export declare function serverNames(advertiseUrl: string, extras?: string[]): SubjectNames;
+export declare function serverNames(controlUrl: string, extras?: string[]): SubjectNames;
 export declare const namesKey: (names: SubjectNames) => string;
 export declare class Pki {
     readonly caPem: string;

package/dist/pki.js

@@ -149,9 +149,9 @@ export async function verifyCsr(csrPem) {
 }
 const serial = () => `0${crypto.randomBytes(15).toString('hex')}`;
 /** The DNS names and IP addresses a server certificate covers, from the public URL plus optional extras. */
-export function serverNames(advertiseUrl, extras = []) {
+export function serverNames(controlUrl, extras = []) {
     const names = { dns: [], ip: [] };
-    const host = new URL(advertiseUrl).hostname.replace(/^\[|\]$/g, '');
+    const host = new URL(controlUrl).hostname.replace(/^\[|\]$/g, '');
     for (const entry of [host, ...extras.map((e) => e.trim()).filter(Boolean)]) {
         const bucket = net.isIP(entry) ? names.ip : names.dns;
         if (!bucket.includes(entry))

package/dist/protocol.d.ts

@@ -165,7 +165,7 @@ export declare const ACTIVE_DEPLOYMENT_STATES: readonly ["uploading", "building"
 /** Deployment states a CLI wait loop stops on. */
 export declare const TERMINAL_DEPLOYMENT_STATES: readonly ["succeeded", "failed", "build_failed", "cancelled"];
 export type DeploymentState = (typeof ACTIVE_DEPLOYMENT_STATES)[number] | (typeof TERMINAL_DEPLOYMENT_STATES)[number];
-export type CommandType = 'diagnostics.run' | 'service.restart' | 'logs.fetch' | 'volume.delete' | 'wg.rotate-key' | 'backup.check' | 'backup.run' | 'backup.restore' | 'backup.list';
+export type CommandType = 'diagnostics.run' | 'service.restart' | 'logs.fetch' | 'volume.delete' | 'backup.check' | 'backup.run' | 'backup.restore' | 'backup.list';
 /** Commands whose helper containers need the backup destination's credentials. */
 export declare const BACKUP_COMMAND_TYPES: readonly CommandType[];
 /** `GET /agent/v1/backup/credentials`: environment for the restic helper of one running backup command. */
@@ -273,8 +273,6 @@ export type CommandResultPayload = {
     project: string;
     volume: string;
     deleted: true;
-} | {
-    publicKey: string;
 } | BackupJobResult | {
     error: string;
 };
@@ -423,8 +421,6 @@ export interface WorkResponse {
     desiredStates: DesiredState[];
     commands: Command[];
     retainedImages?: string[];
-    /** WireGuard mesh config for this node; present only when the mesh is enabled on control. */
-    network?: NetworkConfig;
     /** Healthy cross-node endpoints per project and service; present only when service DNS is enabled. */
     serviceEndpoints?: ServiceEndpoints;
     /** Edge proxy config; present only for nodes marked as ingress nodes. */
@@ -439,33 +435,11 @@ export interface WorkResponse {
  * explicit host IP (including `0.0.0.0`) are never changed.
  */
 export interface PortBinding {
-    /** The node's overlay IP with the mesh, otherwise its `address` (an IP or a hostname the agent resolves); null binds to `127.0.0.1`. */
+    /** The node's `address` (an IP or a hostname the agent resolves); null binds to `127.0.0.1`. */
     address: string | null;
     /** Per project, services whose ingress port only the managed Caddy on this node dials; that port binds to `127.0.0.1`. */
     loopback: Record<string, string[]>;
 }
-export interface WgPeer {
-    node: string;
-    publicKey: string;
-    /** `host:port` the peer can be dialed on; absent for nodes behind NAT (they dial out instead). */
-    endpoint?: string;
-    allowedIps: string[];
-    persistentKeepalive: number;
-}
-/** The `network` block of `GET /agent/v1/work`: everything an agent needs to reconcile `wg0`. */
-export interface NetworkConfig {
-    interface: string;
-    /** This node's overlay address, e.g. `10.210.0.2`. */
-    overlayIp: string;
-    /** Mesh CIDR, e.g. `10.210.0.0/16`; `overlayIp` is assigned to `wg0` with this prefix length. */
-    cidr: string;
-    listenPort: number;
-    peers: WgPeer[];
-}
-/** Body of `POST /agent/v1/wireguard/key` (also accepted as `wgPublicKey` on register and enroll). */
-export interface WgKeyRequest {
-    publicKey: string;
-}
 export interface ServiceEndpoint {
     node: string;
     address: string;
@@ -552,8 +526,6 @@ export interface NodeInfo {
     id: string;
     name: string;
     address: string | null;
-    public_address: string | null;
-    overlay_ip?: string | null;
     labels?: string[];
     status: string;
     created_at: string;
@@ -565,7 +537,6 @@ export interface IdentityRequest {
     /** `create` makes a new node (idempotent for the identical key); `replace` installs a new key on an existing node. */
     mode: 'create' | 'replace';
     address?: string;
-    publicAddress?: string;
     labels?: string[];
 }
 /** Response of `POST /api/v1/nodes/:name/identity` and `POST /agent/v1/enroll`. */
@@ -581,9 +552,6 @@ export interface IdentityResponse {
 export interface EnrollRequest {
     csr: string;
     address?: string;
-    publicAddress?: string;
-    /** Base64 WireGuard public key; the private key never leaves the node. */
-    wgPublicKey?: string;
 }
 /** Response of `POST /agent/v1/enroll`. */
 export type EnrollResponse = IdentityResponse;