pairling 0.2.5 → 0.2.7

package/payload/mac/connectd/internal/gateway/proxy.go

@@ -1,8 +1,11 @@
 package gateway
 
 import (
+	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httputil"
@@ -16,6 +19,12 @@ const defaultMaxBodyBytes int64 = 1_000_000
 const prePairMaxBodyBytes int64 = 16 * 1024
 const pairDropSmallFileMaxBodyBytes int64 = 10 * 1024 * 1024
 const pairDropUploadChunkMaxBodyBytes int64 = 1024 * 1024
+const peerNodeHeader = "X-Pairling-Peer-Node"
+
+// funnelOriginHeader marks a request that arrived over the public Funnel
+// listener. connectd sets it only on the funnel handler and deletes any inbound
+// copy first; every other handler deletes it, so a client can never forge it.
+const funnelOriginHeader = "X-Pairling-Funnel-Origin"
 
 // Chat attachment uploads (POST /upload) carry whole photos/short videos in
 // one shot — the 1MB default rejected most camera photos with 413.
@@ -27,6 +36,11 @@ const (
 	ExposureModePostPair        ExposureMode = "post_pair"
 	ExposureModePrePair         ExposureMode = "pre_pair"
 	ExposureModePairlingConnect ExposureMode = "pairling_connect"
+	// ExposureModeFunnelBootstrap is the public Funnel surface. It is the most
+	// restrictive mode: only the minimal bootstrap claim plus health probes, with
+	// no bearer post-pair fallthrough. Used only by the separate ListenFunnel
+	// handler, never by the tailnet listener.
+	ExposureModeFunnelBootstrap ExposureMode = "funnel_bootstrap"
 )
 
 // Logger receives metadata-only gateway events. Event intentionally excludes
@@ -35,6 +49,10 @@ type Logger interface {
 	Log(Event)
 }
 
+type PeerNodeResolver interface {
+	PeerNodeID(ctx context.Context, remoteAddr string) (string, bool)
+}
+
 type Event struct {
 	Method  string
 	Path    string
@@ -43,20 +61,31 @@ type Event struct {
 }
 
 type Options struct {
-	Upstream     *url.URL
-	MaxBodyBytes int64
-	Mode         ExposureMode
-	Logger       Logger
-	RateLimiter  RateLimiter
+	Upstream         *url.URL
+	MaxBodyBytes     int64
+	Mode             ExposureMode
+	Logger           Logger
+	RateLimiter      RateLimiter
+	PeerNodeResolver PeerNodeResolver
+	// FunnelMacIDHash, when set, is returned in the synthesized funnel-mode
+	// /health and /manifest responses so a phone can confirm it reached the Mac
+	// named in its QR, without the upstream's identity fields ever being exposed.
+	FunnelMacIDHash string
+	// FunnelLimiter, when set, owns identity-independent rate limiting on the
+	// funnel claim path. Used instead of RateLimiter for the funnel handler.
+	FunnelLimiter *FunnelLimiter
 }
 
 type Handler struct {
-	upstream     *url.URL
-	maxBodyBytes int64
-	mode         ExposureMode
-	logger       Logger
-	rateLimiter  RateLimiter
-	proxy        *httputil.ReverseProxy
+	upstream         *url.URL
+	maxBodyBytes     int64
+	mode             ExposureMode
+	logger           Logger
+	rateLimiter      RateLimiter
+	peerNodeResolver PeerNodeResolver
+	funnelMacIDHash  string
+	funnelLimiter    *FunnelLimiter
+	proxy            *httputil.ReverseProxy
 }
 
 type RateLimiter interface {
@@ -84,16 +113,19 @@ func NewHandler(opts Options) (*Handler, error) {
 	if mode == "" {
 		mode = ExposureModePostPair
 	}
-	if mode != ExposureModePostPair && mode != ExposureModePrePair && mode != ExposureModePairlingConnect {
+	if mode != ExposureModePostPair && mode != ExposureModePrePair && mode != ExposureModePairlingConnect && mode != ExposureModeFunnelBootstrap {
 		return nil, errors.New("unknown exposure mode")
 	}
 	upstream := *opts.Upstream
 	h := &Handler{
-		upstream:     &upstream,
-		maxBodyBytes: maxBody,
-		mode:         mode,
-		logger:       opts.Logger,
-		rateLimiter:  opts.RateLimiter,
+		upstream:         &upstream,
+		maxBodyBytes:     maxBody,
+		mode:             mode,
+		logger:           opts.Logger,
+		rateLimiter:      opts.RateLimiter,
+		peerNodeResolver: opts.PeerNodeResolver,
+		funnelMacIDHash:  opts.FunnelMacIDHash,
+		funnelLimiter:    opts.FunnelLimiter,
 	}
 	h.proxy = &httputil.ReverseProxy{
 		Rewrite:       h.rewrite,
@@ -103,6 +135,26 @@ func NewHandler(opts Options) (*Handler, error) {
 	return h, nil
 }
 
+// isFunnelSynthesizedPath reports the funnel-mode GET paths connectd answers
+// itself with a minimal body, so the upstream's identity, version, install
+// path, and route topology never reach the public surface. /healthz shares the
+// sensitive /health payload upstream, so it is synthesized too. /readyz is left
+// to proxy because it is the warmup readiness probe and carries no identity.
+func isFunnelSynthesizedPath(path string) bool {
+	return path == "/health" || path == "/healthz" || path == "/manifest"
+}
+
+func (h *Handler) writeFunnelHealth(w http.ResponseWriter, r *http.Request, path string) {
+	body := map[string]any{"ok": true}
+	if (path == "/health" || path == "/manifest") && h.funnelMacIDHash != "" {
+		body["mac_id_hash"] = h.funnelMacIDHash
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(body)
+	h.log(r, http.StatusOK, "funnel_synthesized")
+}
+
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	path := r.URL.EscapedPath()
 	if path == "" {
@@ -120,6 +172,25 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		h.reject(w, r, http.StatusNotFound, "path_not_allowed")
 		return
 	}
+	if h.mode == ExposureModeFunnelBootstrap && r.Method == http.MethodGet && isFunnelSynthesizedPath(path) {
+		h.writeFunnelHealth(w, r, path)
+		return
+	}
+	if h.funnelLimiter != nil && h.mode == ExposureModeFunnelBootstrap && r.Method == http.MethodPost && isPrePairClaimPath(path) {
+		body, err := io.ReadAll(io.LimitReader(r.Body, prePairMaxBodyBytes+1))
+		if err != nil || int64(len(body)) > prePairMaxBodyBytes {
+			h.reject(w, r, http.StatusRequestEntityTooLarge, "request_too_large")
+			return
+		}
+		release, ok := h.funnelLimiter.Acquire(extractPairID(body))
+		if !ok {
+			h.reject(w, r, http.StatusTooManyRequests, "rate_limited")
+			return
+		}
+		defer release()
+		r.Body = io.NopCloser(bytes.NewReader(body))
+		r.ContentLength = int64(len(body))
+	}
 	if h.rateLimiter != nil && h.rateLimitPath(r.Method, path) && !h.rateLimiter.Allow(r.RemoteAddr, r.Method, path) {
 		h.reject(w, r, http.StatusTooManyRequests, "rate_limited")
 		return
@@ -150,10 +221,122 @@ func (h *Handler) rewrite(r *httputil.ProxyRequest) {
 	}
 	r.Out.Host = h.upstream.Host
 	r.Out.Header.Del("X-Forwarded-For")
+	r.Out.Header.Del(peerNodeHeader)
+	r.Out.Header.Del(funnelOriginHeader)
+	if h.mode == ExposureModeFunnelBootstrap {
+		r.Out.Header.Set(funnelOriginHeader, "1")
+	}
+	if h.peerNodeResolver != nil {
+		if nodeID, ok := h.peerNodeResolver.PeerNodeID(in.Context(), in.RemoteAddr); ok {
+			if nodeID = strings.TrimSpace(nodeID); nodeID != "" {
+				r.Out.Header.Set(peerNodeHeader, nodeID)
+			}
+		}
+	}
 	r.Out.Header.Set("X-Pairling-Connect-Gateway", "pairling-connectd")
 	r.SetXForwarded()
 }
 
+// FunnelLimiter owns identity-independent rate limiting for the public Funnel
+// claim path. The real client IP is unrecoverable over tsnet.ListenFunnel, so
+// none of these limits depend on it: a global per-minute ceiling (a circuit
+// breaker), a per-pair_id cap (matching the 5-attempt lockout, so a victim whose
+// pair_id is unknown to an attacker is unaffected), and an in-flight ECDH
+// concurrency cap (so a pair_id spray cannot force unbounded P-256/HKDF work).
+type FunnelLimiter struct {
+	mu           sync.Mutex
+	now          func() time.Time
+	window       time.Duration
+	globalLimit  int
+	perPairLimit int
+	globalHits   []time.Time
+	perPair      map[string][]time.Time
+	ecdhSem      chan struct{}
+}
+
+func NewFunnelLimiter(globalPerMinute, perPairMax, ecdhConcurrency int) *FunnelLimiter {
+	if globalPerMinute <= 0 {
+		globalPerMinute = 120
+	}
+	if perPairMax <= 0 {
+		perPairMax = 5
+	}
+	if ecdhConcurrency <= 0 {
+		ecdhConcurrency = 6
+	}
+	return &FunnelLimiter{
+		now:          time.Now,
+		window:       time.Minute,
+		globalLimit:  globalPerMinute,
+		perPairLimit: perPairMax,
+		perPair:      map[string][]time.Time{},
+		ecdhSem:      make(chan struct{}, ecdhConcurrency),
+	}
+}
+
+// Acquire enforces the three caps and acquires an ECDH slot. It returns a
+// release func that frees the slot when the claim finishes. ok is false when any
+// budget is exhausted, in which case nothing is held.
+func (l *FunnelLimiter) Acquire(pairID string) (release func(), ok bool) {
+	if l == nil {
+		return func() {}, true
+	}
+	select {
+	case l.ecdhSem <- struct{}{}:
+	default:
+		return nil, false
+	}
+	l.mu.Lock()
+	now := l.now()
+	cutoff := now.Add(-l.window)
+	l.globalHits = pruneTimes(l.globalHits, cutoff)
+	ph := pruneTimes(l.perPair[pairID], cutoff)
+	if len(l.globalHits) >= l.globalLimit || len(ph) >= l.perPairLimit {
+		l.perPair[pairID] = ph
+		l.mu.Unlock()
+		<-l.ecdhSem
+		return nil, false
+	}
+	l.globalHits = append(l.globalHits, now)
+	l.perPair[pairID] = append(ph, now)
+	if len(l.perPair) > 4096 {
+		for k, v := range l.perPair {
+			stale := true
+			for _, t := range v {
+				if t.After(cutoff) {
+					stale = false
+					break
+				}
+			}
+			if stale {
+				delete(l.perPair, k)
+			}
+		}
+	}
+	l.mu.Unlock()
+	return func() { <-l.ecdhSem }, true
+}
+
+func pruneTimes(times []time.Time, cutoff time.Time) []time.Time {
+	kept := times[:0]
+	for _, t := range times {
+		if t.After(cutoff) {
+			kept = append(kept, t)
+		}
+	}
+	return kept
+}
+
+func extractPairID(body []byte) string {
+	var obj struct {
+		PairID string `json:"pair_id"`
+	}
+	if json.Unmarshal(body, &obj) != nil {
+		return ""
+	}
+	return obj.PairID
+}
+
 func (h *Handler) proxyError(w http.ResponseWriter, r *http.Request, err error) {
 	h.reject(w, r, http.StatusBadGateway, "upstream_error")
 }
@@ -204,6 +387,8 @@ func (h *Handler) allowed(method, path string, header http.Header) bool {
 	switch h.mode {
 	case ExposureModePrePair:
 		return prePairAllowed(method, path)
+	case ExposureModeFunnelBootstrap:
+		return funnelBootstrapAllowed(method, path)
 	case ExposureModePairlingConnect:
 		if path == "/pair/start" {
 			return false
@@ -221,6 +406,8 @@ func (h *Handler) allowedForAnyMethod(path string, header http.Header) bool {
 	switch h.mode {
 	case ExposureModePrePair:
 		return prePairAllowed(http.MethodGet, path) || prePairAllowed(http.MethodPost, path)
+	case ExposureModeFunnelBootstrap:
+		return funnelBootstrapAllowed(http.MethodGet, path) || funnelBootstrapAllowed(http.MethodPost, path)
 	case ExposureModePairlingConnect:
 		if path == "/pair/start" {
 			return true
@@ -235,7 +422,7 @@ func (h *Handler) allowedForAnyMethod(path string, header http.Header) bool {
 }
 
 func (h *Handler) requestBodyLimit(method, path string) int64 {
-	if method == http.MethodPost && isPrePairClaimPath(path) && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect) {
+	if method == http.MethodPost && isPrePairClaimPath(path) && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect || h.mode == ExposureModeFunnelBootstrap) {
 		if h.maxBodyBytes <= 0 || prePairMaxBodyBytes < h.maxBodyBytes {
 			return prePairMaxBodyBytes
 		}
@@ -259,7 +446,7 @@ func (h *Handler) requestBodyLimit(method, path string) int64 {
 }
 
 func (h *Handler) rateLimitPath(method, path string) bool {
-	return method == http.MethodPost && isPrePairClaimPath(path) && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect)
+	return method == http.MethodPost && isPrePairClaimPath(path) && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect || h.mode == ExposureModeFunnelBootstrap)
 }
 
 func prePairAllowed(method, path string) bool {
@@ -273,6 +460,33 @@ func prePairAllowed(method, path string) bool {
 	}
 }
 
+// funnelBootstrapAllowed is the public Funnel surface: the most restrictive mode.
+// It is a strict subset of the pre-pair set, declared explicitly so it can never
+// inherit a widening of prePairGetPaths/prePairPostPaths. It excludes /routez
+// (route-topology leak), /pair/claim (legacy plaintext), /pair/start, and the
+// reauth paths. There is no bearer post-pair fallthrough.
+func funnelBootstrapAllowed(method, path string) bool {
+	switch method {
+	case http.MethodGet:
+		return funnelBootstrapGetPaths[path]
+	case http.MethodPost:
+		return funnelBootstrapPostPaths[path]
+	default:
+		return false
+	}
+}
+
+var funnelBootstrapGetPaths = map[string]bool{
+	"/health":   true,
+	"/healthz":  true,
+	"/readyz":   true,
+	"/manifest": true,
+}
+
+var funnelBootstrapPostPaths = map[string]bool{
+	"/pair/psk-claim": true,
+}
+
 func isPrePairClaimPath(path string) bool {
 	return path == "/pair/claim" || path == "/pair/psk-claim"
 }

package/payload/mac/connectd/internal/gateway/proxy_test.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -20,6 +21,12 @@ type recordingLogger struct {
 	events []Event
 }
 
+type peerNodeResolverFunc func(context.Context, string) (string, bool)
+
+func (f peerNodeResolverFunc) PeerNodeID(ctx context.Context, remoteAddr string) (string, bool) {
+	return f(ctx, remoteAddr)
+}
+
 func (l *recordingLogger) Log(event Event) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -420,6 +427,70 @@ func TestPairlingConnectModeRequiresBearerForPostPairEndpointsAndRejectsRemotePa
 	}
 }
 
+func TestPairlingConnectStripsForgedPeerNodeHeader(t *testing.T) {
+	var forwardedHeader string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		forwardedHeader = r.Header.Get("X-Pairling-Peer-Node")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+	handler := newTestHandlerWithMode(t, upstream.URL, 1024, nil, ExposureModePairlingConnect, nil)
+
+	req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/send-text", strings.NewReader(`{"tailnet_node_id":"forged-body"}`))
+	req.Header.Set("Authorization", "Bearer device-token")
+	req.Header.Set("X-Pairling-Peer-Node", "forged-header")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if forwardedHeader != "" {
+		t.Fatalf("forged peer-node header forwarded to upstream: %q", forwardedHeader)
+	}
+}
+
+func TestPairlingConnectSetsPeerNodeHeaderFromResolver(t *testing.T) {
+	var forwardedHeader string
+	var resolvedRemote string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		forwardedHeader = r.Header.Get("X-Pairling-Peer-Node")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+	upstreamURL, err := url.Parse(upstream.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler, err := NewHandler(Options{
+		Upstream:     upstreamURL,
+		MaxBodyBytes: 1024,
+		Mode:         ExposureModePairlingConnect,
+		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, remoteAddr string) (string, bool) {
+			resolvedRemote = remoteAddr
+			return "nPeerCNTRL", true
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/send-text", strings.NewReader(`{}`))
+	req.RemoteAddr = "100.64.0.50:12345"
+	req.Header.Set("Authorization", "Bearer device-token")
+	req.Header.Set("X-Pairling-Peer-Node", "forged-header")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if resolvedRemote != "100.64.0.50:12345" {
+		t.Fatalf("resolver remote addr = %q", resolvedRemote)
+	}
+	if forwardedHeader != "nPeerCNTRL" {
+		t.Fatalf("peer-node header = %q, want trusted resolver value", forwardedHeader)
+	}
+}
+
 func TestPairlingConnectModeMatchesEndpointContract(t *testing.T) {
 	contract := loadEndpointContractForTesting(t)
 	var forwarded []string

package/payload/mac/connectd/internal/runtime/config.go

@@ -56,6 +56,25 @@ func HostnameFromInstallID(installID string) string {
 	return "pairling-" + slug
 }
 
+// StableHostname returns a tailnet hostname that survives a regenerated
+// install_id. It persists the first computed hostname under the state directory
+// and reuses it thereafter, so a reinstall that only changes install_id does not
+// change the *.ts.net name, which would otherwise reset the Funnel certificate.
+// If the state directory is wiped, a fresh node and name are created regardless.
+func StableHostname(appSupportRoot, stateDir string) string {
+	path := filepath.Join(stateDir, "hostname")
+	if data, err := os.ReadFile(path); err == nil {
+		if name := strings.TrimSpace(string(data)); name != "" {
+			return name
+		}
+	}
+	name := HostnameFromInstallID(LoadInstallID(appSupportRoot))
+	if err := os.MkdirAll(stateDir, 0o700); err == nil {
+		_ = os.WriteFile(path, []byte(name+"\n"), 0o600)
+	}
+	return name
+}
+
 func loadInstallIDCandidate(path string) string {
 	data, err := os.ReadFile(path)
 	if err != nil {

package/payload/mac/connectd/internal/runtime/config_test.go

@@ -1,6 +1,7 @@
 package runtime
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 )
@@ -27,3 +28,27 @@ func TestHostnameFromInstallIDFallsBackWhenInstallIDMissing(t *testing.T) {
 		t.Fatalf("hostname fallback is empty: %q", got)
 	}
 }
+
+func TestStableHostnamePersistsAcrossInstallIDChange(t *testing.T) {
+	dir := t.TempDir()
+	appSupport := filepath.Join(dir, "appsupport")
+	stateDir := filepath.Join(dir, "state")
+	if err := os.MkdirAll(appSupport, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(appSupport, "config.json"), []byte(`{"install_id":"inst_first123"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	first := StableHostname(appSupport, stateDir)
+	if first == "" || first == "pairling-" {
+		t.Fatalf("first hostname empty: %q", first)
+	}
+	// Simulated reinstall: install_id changes, but the persisted hostname must win.
+	if err := os.WriteFile(filepath.Join(appSupport, "config.json"), []byte(`{"install_id":"inst_second999"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	second := StableHostname(appSupport, stateDir)
+	if second != first {
+		t.Fatalf("hostname changed after install_id change: %q -> %q", first, second)
+	}
+}

package/payload/mac/connectd/internal/status/status.go

@@ -20,7 +20,9 @@ const (
 	RouteIDPairlingConnect = "pairling-connect-tailnet"
 	RouteSourceConnectd    = "pairling_connectd"
 	RouteKindTailnet       = "tailnet"
+	RouteKindFunnel        = "funnel"
 	RouteStatusReady       = "ready"
+	RouteIDFunnel          = "pairling-connect-funnel"
 )
 
 type AdvertisedRoute struct {
@@ -39,7 +41,12 @@ type Snapshot struct {
 	SchemaVersion        int               `json:"schema_version"`
 	AuthState            string            `json:"auth_state"`
 	Hostname             string            `json:"hostname"`
+	FunnelHostname       string            `json:"funnel_hostname,omitempty"`
 	TailnetIP            string            `json:"tailnet_ip,omitempty"`
+	TailnetNodeID        string            `json:"tailnet_node_id,omitempty"`
+	Tags                 []string          `json:"tags,omitempty"`
+	TailnetIPs           []string          `json:"tailnet_ips,omitempty"`
+	TailnetLockEnabled   *bool             `json:"tailnet_lock_enabled,omitempty"`
 	TailnetIPCount       int               `json:"tailnet_ip_count"`
 	AuthURLPresent       bool              `json:"auth_url_present"`
 	ControlURLMode       string            `json:"control_url_mode"`
@@ -115,6 +122,15 @@ func (s *Store) SetConnectdVersion(version string) {
 	})
 }
 
+// SetFunnelHostname records the public *.ts.net hostname of the Funnel listener.
+// Empty when Funnel is disabled, which keeps the snapshot and advertised routes
+// byte-identical to the no-funnel build.
+func (s *Store) SetFunnelHostname(host string) {
+	s.update(func(snapshot *Snapshot) {
+		snapshot.FunnelHostname = strings.TrimSpace(host)
+	})
+}
+
 func (s *Store) SetAuthPending(message string) {
 	s.update(func(snapshot *Snapshot) {
 		snapshot.AuthState = "pending"
@@ -144,6 +160,20 @@ func (s *Store) SetTailnetIP(ip string) {
 	})
 }
 
+func (s *Store) SetTailnetIdentity(nodeID string, tags, ips []string) {
+	s.update(func(snapshot *Snapshot) {
+		snapshot.TailnetNodeID = sanitizeIdentityValue(nodeID)
+		snapshot.Tags = sanitizeIdentityValues(tags)
+		snapshot.TailnetIPs = sanitizeIdentityValues(ips)
+	})
+}
+
+func (s *Store) SetTailnetLockEnabled(enabled bool) {
+	s.update(func(snapshot *Snapshot) {
+		snapshot.TailnetLockEnabled = &enabled
+	})
+}
+
 func (s *Store) SetUpstreamReachable(reachable bool) {
 	s.update(func(snapshot *Snapshot) {
 		snapshot.UpstreamReachable = reachable
@@ -229,7 +259,7 @@ func advertisedRoutes(snapshot Snapshot) []AdvertisedRoute {
 	if port <= 0 {
 		port = DefaultListenPort
 	}
-	return []AdvertisedRoute{{
+	routes := []AdvertisedRoute{{
 		ID:       RouteIDPairlingConnect,
 		Kind:     RouteKindTailnet,
 		Source:   RouteSourceConnectd,
@@ -239,6 +269,22 @@ func advertisedRoutes(snapshot Snapshot) []AdvertisedRoute {
 		Port:     port,
 		Status:   RouteStatusReady,
 	}}
+	// Additive funnel route, lowest priority so it is used only for the off-LAN
+	// bootstrap and dropped once the tailnet route is reachable. Present only when
+	// Funnel is enabled (a hostname is set); the health gate above already holds.
+	if host := strings.TrimSpace(snapshot.FunnelHostname); host != "" {
+		routes = append(routes, AdvertisedRoute{
+			ID:       RouteIDFunnel,
+			Kind:     RouteKindFunnel,
+			Source:   RouteSourceConnectd,
+			Priority: 10,
+			BaseURL:  "https://" + host,
+			Host:     host,
+			Port:     443,
+			Status:   RouteStatusReady,
+		})
+	}
+	return routes
 }
 
 func gatewayEventIsFailure(path string, status int, outcome string) bool {
@@ -269,6 +315,26 @@ var secretPattern = regexp.MustCompile(`(?i)(sk-[A-Za-z0-9._-]+|[A-Za-z0-9._-]*s
 var authURLPattern = regexp.MustCompile(`https://login\.tailscale\.com/a/[A-Za-z0-9._~!$&'()*+,;=:@%/?-]+`)
 var bearerPattern = regexp.MustCompile(`(?i)Bearer\s+[A-Za-z0-9._~+/=-]+`)
 var tailscaleAuthKeyPattern = regexp.MustCompile(`(?i)tskey-[A-Za-z0-9._-]+`)
+var identitySecretPattern = regexp.MustCompile(`(?i)(authkey|nlprivate)`)
+
+func sanitizeIdentityValues(values []string) []string {
+	if len(values) == 0 {
+		return nil
+	}
+	cleaned := make([]string, 0, len(values))
+	for _, value := range values {
+		cleaned = append(cleaned, sanitizeIdentityValue(value))
+	}
+	return cleaned
+}
+
+func sanitizeIdentityValue(value string) string {
+	value = strings.TrimSpace(value)
+	if identitySecretPattern.MatchString(value) {
+		return "[redacted]"
+	}
+	return redact(value)
+}
 
 func extractAuthURL(value string) (string, bool) {
 	raw := authURLPattern.FindString(value)