Cleanup

Refactor - now wireguard based. (#7 )
Bug fixes
2026-06-12 18:22:25 +02:00 · 2026-06-12 15:11:01 +00:00 · 2025-09-25 10:03:37 +02:00 · 2025-09-25 09:08:10 +02:00 · 2025-09-17 08:00:12 +00:00 · 2025-09-04 11:29:26 +02:00
132 changed files with 4454 additions and 5872 deletions
--- a/README.md
+++ b/README.md
@@ -9,7 +9,6 @@ adduser user
 # Enable ssh.
 cp -r ~/.ssh /home/user/
 chown -R user:user /home/user/.ssh
-
 ```

 Upload `hub` executable:
@@ -38,6 +37,7 @@ Add and start the hub server:

 ```
 systemctl daemon-reload
+systemctl enable hub
 systemctl start hub
 ```

@@ -53,19 +53,29 @@ Sign-in and configure.

 Install the binary somewhere, for example `~/bin/vppn`.

-Create systemd file in `/etc/systemd/system/vppn.service`.
+Add the API key for your network name in `~/.vppn/<netname>/apikey`.

+Create systemd file in `/etc/systemd/system/vppn.service`.

 ```
 [Service]
-AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
+AmbientCapabilities=AP_NET_ADMIN CAP_DAC_OVERRIDE CAP_CHOWN
 Type=simple
 User=user
 WorkingDirectory=/home/user/
-ExecStart=/home/user/vppn -name vppn -hub-address https://my.hub -api-key 1234567890
+ExecStart=/home/user/bin/vppn -name my_net_name -hub https://my.hub
 Restart=always
 RestartSec=8
+TimeoutStopSec=24

 [Install]
-WantedBy=default.target
+WantedBy=multi-user.target
+```
+
+Add and start the service:
+
+```
+systemctl daemon-reload
+systemctl enable vppn
+systemctl start vppn
 ```
--- a/cmd/vppn/main.go
+++ b/cmd/vppn/main.go
@@ -1,11 +1,72 @@
 package main

 import (
+	"flag"
 	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
 	"vppn/peer"
+
+	"git.crumpington.com/lib/go/flock"
 )

 func main() {
 	log.SetFlags(0)
-	peer.Main()
+
+	name := flag.String("name", "", "network name (required)")
+	hub := flag.String("hub", "", "hub base URL (required)")
+	flag.Parse()
+
+	if *name == "" || *hub == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	apiKey, err := loadAPIKey(*name)
+	if err != nil {
+		log.Fatalf("api key: %v", err)
+	}
+
+	// Directory existence is guaranteed by the apikey file read above.
+	lockFile, err := flock.TryLock(vppnPath(*name, "lock"))
+	if err != nil {
+		log.Fatalf("lock: %v", err)
+	}
+	if lockFile == nil {
+		log.Fatalf("already running for network %q", *name)
+	}
+	defer flock.Unlock(lockFile)
+
+	state, err := peer.LoadOrInit(vppnPath(*name, "state.json"), *hub, apiKey)
+	if err != nil {
+		log.Fatalf("init: %v", err)
+	}
+
+	ifaceName := strings.TrimSuffix(state.LocalDomain, ".local")
+	app, err := peer.New(state, *hub, apiKey, ifaceName, state.LocalDomain, vppnPath(*name, "network.json"))
+	if err != nil {
+		log.Fatalf("start: %v", err)
+	}
+
+	if err := app.Run(); err != nil {
+		log.Fatalf("run: %v", err)
+	}
+}
+
+func loadAPIKey(name string) (string, error) {
+	data, err := os.ReadFile(vppnPath(name, "apikey"))
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(data)), nil
+}
+
+func vppnPath(name, file string) string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return filepath.Join(".vppn", name, file)
+	}
+	return filepath.Join(home, ".vppn", name, file)
 }
--- a/go.mod
+++ b/go.mod
@@ -1,15 +1,23 @@
 module vppn

-go 1.24.1
+go 1.25.1

 require (
-	git.crumpington.com/lib/go v0.8.1
-	golang.org/x/crypto v0.29.0
-	golang.org/x/sys v0.27.0
+	git.crumpington.com/lib/go v0.9.1
+	golang.org/x/crypto v0.42.0
+	golang.org/x/sys v0.36.0
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 )

 require (
-	github.com/mattn/go-sqlite3 v1.14.24 // indirect
-	golang.org/x/net v0.31.0 // indirect
-	golang.org/x/text v0.20.0 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
+	github.com/mattn/go-sqlite3 v1.14.32 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
+	golang.org/x/net v0.44.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -1,12 +1,30 @@
-git.crumpington.com/lib/go v0.8.1 h1:rWjddllSxQ4yReraqDaGZAod4NpRD9LtGx1yV71ytcU=
-git.crumpington.com/lib/go v0.8.1/go.mod h1:XjQaf2NFlje9BJ1EevZL8NNioPrAe7WwHpKUhcDw2Lk=
-github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM=
-github.com/mattn/go-sqlite3 v1.14.24/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
-golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
-golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
-golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
-golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
-golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
-golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
+git.crumpington.com/lib/go v0.9.1 h1:xLBzcgiZRB6Ky3Ce9hKE+Ko0YbkA4USF4eJk5i5RJF4=
+git.crumpington.com/lib/go v0.9.1/go.mod h1:5nnfjdnUnj/FHhakaliKQKsKeSkUb0GEUKF3PqRgUXg=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
+github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
+github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
+github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
+golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
--- a/hub/api/api.go
+++ b/hub/api/api.go
@@ -19,8 +19,10 @@ import (
 var migrations embed.FS

 type API struct {
-	db   *sql.DB
-	lock sync.Mutex
+	db         *sql.DB
+	lock       sync.Mutex
+	sessionsMu sync.Mutex
+	sessions   map[string]*Session
 }

 func New(dbPath string) (*API, error) {
@@ -34,10 +36,17 @@ func New(dbPath string) (*API, error) {
 	}

 	a := &API{
-		db: sqlDB,
+		db:       sqlDB,
+		sessions: make(map[string]*Session),
 	}

-	return a, a.ensurePassword()
+	if err := a.ensurePassword(); err != nil {
+		return nil, err
+	}
+
+	go a.sweepSessions()
+
+	return a, nil
 }

 func (a *API) ensurePassword() error {
@@ -54,139 +63,153 @@ func (a *API) ensurePassword() error {
 	log.Printf("Setting password: %s", pwd)

 	hashed, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
-
 	if err != nil {
 		return err
 	}

-	conf := &Config{
-		ConfigID:   1,
-		VPNNetwork: []byte{10, 1, 1, 0},
-		Password:   hashed,
-	}
-
+	conf := &Config{ConfigID: 1, Password: hashed}
 	return db.Config_Insert(a.db, conf)
 }

-func (a *API) Config_Get() *Config {
-	conf, err := db.Config_Get(a.db, 1)
-	if err != nil {
-		panic(err)
-	}
-	return conf
+func (a *API) Config_Get() (*Config, error) {
+	return db.Config_Get(a.db, 1)
 }

 func (a *API) Config_Update(conf *Config) error {
 	return db.Config_Update(a.db, conf)
 }

-func (a *API) Config_UpdatePassword(pwdHash []byte) error {
-	return db.Config_UpdatePassword(a.db, pwdHash)
-}
-
 func (a *API) Session_Delete(sessionID string) error {
-	return db.Session_Delete(a.db, sessionID)
+	a.sessionsMu.Lock()
+	defer a.sessionsMu.Unlock()
+	delete(a.sessions, sessionID)
+	return nil
 }

-func (a *API) Session_Get(sessionID string) (*Session, error) {
-	if sessionID == "" {
-		return a.session_CreatePub()
+const (
+	sessionTTLSecs    = 86400 * 21 // sessions expire 21 days after last use
+	sessionSweepEvery = time.Hour  // cadence of expired-session eviction
+)
+
+// Session_Get returns a snapshot copy of the signed-in session for sessionID,
+// or the zero Session if the cookie is missing/unknown/expired. It never
+// creates a session, so anonymous requests cost no memory — a session is minted
+// only by Session_SignIn. Returning a value (not the stored pointer) keeps
+// callers from racing on the shared struct.
+func (a *API) Session_Get(sessionID string) (Session, error) {
+	a.sessionsMu.Lock()
+	defer a.sessionsMu.Unlock()
+
+	s, ok := a.sessions[sessionID]
+
+	if sessionID == "" || !ok {
+		return Session{}, nil
 	}

-	session, err := db.Session_Get(a.db, sessionID)
+	if timeSince(s.LastSeenAt) > sessionTTLSecs {
+		delete(a.sessions, sessionID)
+		return Session{}, nil
+	}
+
+	s.LastSeenAt = time.Now().Unix()
+	return *s, nil
+}
+
+// Session_SignIn verifies pwd and, on success, mints a fresh signed-in session,
+// returning it so the caller can set the cookie. A new ID per sign-in rotates
+// the session at the privilege boundary (session-fixation resistance).
+func (a *API) Session_SignIn(pwd string) (Session, error) {
+	conf, err := a.Config_Get()
 	if err != nil {
-		return a.session_CreatePub()
+		return Session{}, err
+	}
+	if err := bcrypt.CompareHashAndPassword(conf.Password, []byte(pwd)); err != nil {
+		return Session{}, ErrNotAuthorized
 	}

-	if timeSince(session.LastSeenAt) > 86400*21 {
-		return a.session_CreatePub()
-	}
-
-	if timeSince(session.LastSeenAt) > 86400*7 {
-		session.LastSeenAt = time.Now().Unix()
-		if err := db.Session_UpdateLastSeenAt(a.db, session.SessionID); err != nil {
-			log.Printf("Failed to update session: %v", err)
-		}
-	}
-
-	return session, nil
-}
-
-func (a *API) session_CreatePub() (*Session, error) {
+	a.sessionsMu.Lock()
+	defer a.sessionsMu.Unlock()
 	s := &Session{
 		SessionID:  idgen.NewToken(),
-		CSRF:       idgen.NewToken(),
-		SignedIn:   false,
+		SignedIn:   true,
 		CreatedAt:  time.Now().Unix(),
 		LastSeenAt: time.Now().Unix(),
 	}
-	err := db.Session_Insert(a.db, s)
-	return s, err
+	a.sessions[s.SessionID] = s
+	return *s, nil
 }

-func (a *API) Session_DeleteBefore(timestamp int64) error {
-	return db.Session_DeleteBefore(a.db, timestamp)
-}
-
-func (a *API) Session_SignIn(s *Session, pwd string) error {
-	conf := a.Config_Get()
-	if err := bcrypt.CompareHashAndPassword(conf.Password, []byte(pwd)); err != nil {
-		return ErrNotAuthorized
+// sweepSessions periodically evicts sessions past their TTL. Without it, a
+// signed-in session whose ID is never presented again would linger forever
+// (Session_Get only evicts on a lookup of that same ID).
+func (a *API) sweepSessions() {
+	for range time.Tick(sessionSweepEvery) {
+		a.sessionsMu.Lock()
+		for id, s := range a.sessions {
+			if timeSince(s.LastSeenAt) > sessionTTLSecs {
+				delete(a.sessions, id)
+			}
+		}
+		a.sessionsMu.Unlock()
 	}
+}

-	return db.Session_SetSignedIn(a.db, s.SessionID)
+func (a *API) Network_Create(n *Network) error {
+	n.NetworkID = idgen.NextID(0)
+	return db.Network_Insert(a.db, n)
+}
+
+func (a *API) Network_Delete(n *Network) error {
+	return db.Network_Delete(a.db, n.NetworkID)
+}
+
+func (a *API) Network_Get(id int64) (*Network, error) {
+	return db.Network_Get(a.db, id)
+}
+
+func (a *API) Network_List() ([]*Network, error) {
+	const query = db.Network_SelectQuery + ` ORDER BY LocalDomain ASC`
+	return db.Network_List(a.db, query)
 }

 func (a *API) Peer_CreateNew(p *Peer) error {
-	p.Version = idgen.NextID(0)
-	p.PubKey = []byte{}
-	p.PubSignKey = []byte{}
+	p.WGPubKey = []byte{}
+	p.SignPubKey = []byte{}
 	p.APIKey = idgen.NewToken()

 	return db.Peer_Insert(a.db, p)
 }

-func (a *API) Peer_Init(peer *Peer, args m.PeerInitArgs) (*m.PeerConfig, error) {
+func (a *API) Peer_Init(peer *Peer, args m.PeerInitArgs) error {
 	a.lock.Lock()
 	defer a.lock.Unlock()

-	peer.Version = idgen.NextID(0)
-	peer.PubKey = args.EncPubKey
-	peer.PubSignKey = args.PubSignKey
-
-	if err := db.Peer_UpdateFull(a.db, peer); err != nil {
-		return nil, err
+	// Re-read from DB inside the lock — the caller's copy was fetched before
+	// we held the lock, so it may be stale under concurrent requests.
+	current, err := db.Peer_Get(a.db, peer.NetworkID, peer.PeerIP)
+	if err != nil {
+		return err
+	}
+	if len(current.WGPubKey) != 0 {
+		return errors.New("peer already initialized")
 	}

-	conf := a.Config_Get()
+	peer.WGPubKey = args.WGPubKey
+	peer.SignPubKey = args.SignPubKey

-	return &m.PeerConfig{
-		PeerIP:   peer.PeerIP,
-		Network:  conf.VPNNetwork,
-		PublicIP: peer.PublicIP,
-		Port:     peer.Port,
-		Relay:    peer.Relay,
-	}, nil
+	return db.Peer_UpdateFull(a.db, peer)
 }

-func (a *API) Peer_Update(p *Peer) error {
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	p.Version = idgen.NextID(0)
-	return db.Peer_Update(a.db, p)
+func (a *API) Peer_Delete(networkID int64, peerIP byte) error {
+	return db.Peer_Delete(a.db, networkID, peerIP)
 }

-func (a *API) Peer_Delete(ip byte) error {
-	return db.Peer_Delete(a.db, ip)
+func (a *API) Peer_List(networkID int64) ([]*Peer, error) {
+	return db.Peer_ListAll(a.db, networkID)
 }

-func (a *API) Peer_List() ([]*Peer, error) {
-	return db.Peer_ListAll(a.db)
-}
-
-func (a *API) Peer_Get(ip byte) (*Peer, error) {
-	return db.Peer_Get(a.db, ip)
+func (a *API) Peer_Get(networkID int64, ip byte) (*Peer, error) {
+	return db.Peer_Get(a.db, networkID, ip)
 }

 func (a *API) Peer_GetByAPIKey(key string) (*Peer, error) {
--- a/hub/api/db/generated
+++ b/hub/api/db/generated
--- a/hub/api/db/generated.go
+++ b/hub/api/db/generated.go
@@ -16,13 +16,11 @@ type TX interface {
 // ----------------------------------------------------------------------------

 type Config struct {
-	ConfigID   int64
-	HubAddress string
-	VPNNetwork []byte
-	Password   []byte
+	ConfigID int64
+	Password []byte
 }

-const Config_SelectQuery = "SELECT ConfigID,HubAddress,VPNNetwork,Password FROM config"
+const Config_SelectQuery = "SELECT ConfigID,Password FROM config"

 func Config_Insert(
 	tx TX,
@@ -33,7 +31,7 @@ func Config_Insert(
 		return err
 	}

-	_, err = tx.Exec("INSERT INTO config(ConfigID,HubAddress,VPNNetwork,Password) VALUES(?,?,?,?)", row.ConfigID, row.HubAddress, row.VPNNetwork, row.Password)
+	_, err = tx.Exec("INSERT INTO config(ConfigID,Password) VALUES(?,?)", row.ConfigID, row.Password)
 	return err
 }

@@ -46,7 +44,7 @@ func Config_Update(
 		return err
 	}

-	result, err := tx.Exec("UPDATE config SET HubAddress=?,VPNNetwork=? WHERE ConfigID=?", row.HubAddress, row.VPNNetwork, row.ConfigID)
+	result, err := tx.Exec("UPDATE config SET Password=? WHERE ConfigID=?", row.Password, row.ConfigID)
 	if err != nil {
 		return err
 	}
@@ -74,7 +72,7 @@ func Config_UpdateFull(
 		return err
 	}

-	result, err := tx.Exec("UPDATE config SET HubAddress=?,VPNNetwork=?,Password=? WHERE ConfigID=?", row.HubAddress, row.VPNNetwork, row.Password, row.ConfigID)
+	result, err := tx.Exec("UPDATE config SET Password=? WHERE ConfigID=?", row.Password, row.ConfigID)
 	if err != nil {
 		return err
 	}
@@ -124,8 +122,10 @@ func Config_Get(
 	err error,
 ) {
 	row = &Config{}
-	r := tx.QueryRow("SELECT ConfigID,HubAddress,VPNNetwork,Password FROM config WHERE ConfigID=?", ConfigID)
-	err = r.Scan(&row.ConfigID, &row.HubAddress, &row.VPNNetwork, &row.Password)
+	r := tx.QueryRow("SELECT ConfigID,Password FROM config WHERE ConfigID=?", ConfigID)
+	if err = r.Scan(&row.ConfigID, &row.Password); err != nil {
+		row = nil
+	}
 	return
 }

@@ -139,7 +139,9 @@ func Config_GetWhere(
 ) {
 	row = &Config{}
 	r := tx.QueryRow(query, args...)
-	err = r.Scan(&row.ConfigID, &row.HubAddress, &row.VPNNetwork, &row.Password)
+	if err = r.Scan(&row.ConfigID, &row.Password); err != nil {
+		row = nil
+	}
 	return
 }

@@ -159,7 +161,7 @@ func Config_Iterate(
 		defer rows.Close()
 		for rows.Next() {
 			row := &Config{}
-			err := rows.Scan(&row.ConfigID, &row.HubAddress, &row.VPNNetwork, &row.Password)
+			err := rows.Scan(&row.ConfigID, &row.Password)
 			if !yield(row, err) {
 				return
 			}
@@ -185,164 +187,40 @@ func Config_List(
 }

 // ----------------------------------------------------------------------------
-// Table: sessions
+// Table: networks
 // ----------------------------------------------------------------------------

-type Session struct {
-	SessionID  string
-	CSRF       string
-	SignedIn   bool
-	CreatedAt  int64
-	LastSeenAt int64
+type Network struct {
+	NetworkID   int64
+	LocalDomain string
+	Network     []byte
 }

-const Session_SelectQuery = "SELECT SessionID,CSRF,SignedIn,CreatedAt,LastSeenAt FROM sessions"
+const Network_SelectQuery = "SELECT NetworkID,LocalDomain,Network FROM networks"

-func Session_Insert(
+func Network_Insert(
 	tx TX,
-	row *Session,
+	row *Network,
 ) (err error) {
-	Session_Sanitize(row)
-	if err = Session_Validate(row); err != nil {
+	Network_Sanitize(row)
+	if err = Network_Validate(row); err != nil {
 		return err
 	}

-	_, err = tx.Exec("INSERT INTO sessions(SessionID,CSRF,SignedIn,CreatedAt,LastSeenAt) VALUES(?,?,?,?,?)", row.SessionID, row.CSRF, row.SignedIn, row.CreatedAt, row.LastSeenAt)
+	_, err = tx.Exec("INSERT INTO networks(NetworkID,LocalDomain,Network) VALUES(?,?,?)", row.NetworkID, row.LocalDomain, row.Network)
 	return err
 }

-func Session_Delete(
+func Network_UpdateFull(
 	tx TX,
-	SessionID string,
+	row *Network,
 ) (err error) {
-	result, err := tx.Exec("DELETE FROM sessions WHERE SessionID=?", SessionID)
-	if err != nil {
+	Network_Sanitize(row)
+	if err = Network_Validate(row); err != nil {
 		return err
 	}

-	n, err := result.RowsAffected()
-	if err != nil {
-		panic(err)
-	}
-	switch n {
-	case 0:
-		return sql.ErrNoRows
-	case 1:
-		return nil
-	default:
-		panic("multiple rows deleted")
-	}
-}
-
-func Session_Get(
-	tx TX,
-	SessionID string,
-) (
-	row *Session,
-	err error,
-) {
-	row = &Session{}
-	r := tx.QueryRow("SELECT SessionID,CSRF,SignedIn,CreatedAt,LastSeenAt FROM sessions WHERE SessionID=?", SessionID)
-	err = r.Scan(&row.SessionID, &row.CSRF, &row.SignedIn, &row.CreatedAt, &row.LastSeenAt)
-	return
-}
-
-func Session_GetWhere(
-	tx TX,
-	query string,
-	args ...any,
-) (
-	row *Session,
-	err error,
-) {
-	row = &Session{}
-	r := tx.QueryRow(query, args...)
-	err = r.Scan(&row.SessionID, &row.CSRF, &row.SignedIn, &row.CreatedAt, &row.LastSeenAt)
-	return
-}
-
-func Session_Iterate(
-	tx TX,
-	query string,
-	args ...any,
-) iter.Seq2[*Session, error] {
-	rows, err := tx.Query(query, args...)
-	if err != nil {
-		return func(yield func(*Session, error) bool) {
-			yield(nil, err)
-		}
-	}
-
-	return func(yield func(*Session, error) bool) {
-		defer rows.Close()
-		for rows.Next() {
-			row := &Session{}
-			err := rows.Scan(&row.SessionID, &row.CSRF, &row.SignedIn, &row.CreatedAt, &row.LastSeenAt)
-			if !yield(row, err) {
-				return
-			}
-		}
-	}
-}
-
-func Session_List(
-	tx TX,
-	query string,
-	args ...any,
-) (
-	l []*Session,
-	err error,
-) {
-	for row, err := range Session_Iterate(tx, query, args...) {
-		if err != nil {
-			return nil, err
-		}
-		l = append(l, row)
-	}
-	return l, nil
-}
-
-// ----------------------------------------------------------------------------
-// Table: peers
-// ----------------------------------------------------------------------------
-
-type Peer struct {
-	PeerIP     byte
-	Version    int64
-	APIKey     string
-	Name       string
-	PublicIP   []byte
-	Port       uint16
-	Relay      bool
-	PubKey     []byte
-	PubSignKey []byte
-}
-
-const Peer_SelectQuery = "SELECT PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey,PubSignKey FROM peers"
-
-func Peer_Insert(
-	tx TX,
-	row *Peer,
-) (err error) {
-	Peer_Sanitize(row)
-	if err = Peer_Validate(row); err != nil {
-		return err
-	}
-
-	_, err = tx.Exec("INSERT INTO peers(PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey,PubSignKey) VALUES(?,?,?,?,?,?,?,?,?)", row.PeerIP, row.Version, row.APIKey, row.Name, row.PublicIP, row.Port, row.Relay, row.PubKey, row.PubSignKey)
-	return err
-}
-
-func Peer_Update(
-	tx TX,
-	row *Peer,
-) (err error) {
-	Peer_Sanitize(row)
-	if err = Peer_Validate(row); err != nil {
-		return err
-	}
-
-	result, err := tx.Exec("UPDATE peers SET Version=?,Name=?,PublicIP=?,Port=?,Relay=? WHERE PeerIP=?", row.Version, row.Name, row.PublicIP, row.Port, row.Relay, row.PeerIP)
+	result, err := tx.Exec("UPDATE networks SET LocalDomain=?,Network=? WHERE NetworkID=?", row.LocalDomain, row.Network, row.NetworkID)
 	if err != nil {
 		return err
 	}
@@ -361,6 +239,133 @@ func Peer_Update(
 	}
 }

+func Network_Delete(
+	tx TX,
+	NetworkID int64,
+) (err error) {
+	result, err := tx.Exec("DELETE FROM networks WHERE NetworkID=?", NetworkID)
+	if err != nil {
+		return err
+	}
+
+	n, err := result.RowsAffected()
+	if err != nil {
+		panic(err)
+	}
+	switch n {
+	case 0:
+		return sql.ErrNoRows
+	case 1:
+		return nil
+	default:
+		panic("multiple rows deleted")
+	}
+}
+
+func Network_Get(
+	tx TX,
+	NetworkID int64,
+) (
+	row *Network,
+	err error,
+) {
+	row = &Network{}
+	r := tx.QueryRow("SELECT NetworkID,LocalDomain,Network FROM networks WHERE NetworkID=?", NetworkID)
+	if err = r.Scan(&row.NetworkID, &row.LocalDomain, &row.Network); err != nil {
+		row = nil
+	}
+	return
+}
+
+func Network_GetWhere(
+	tx TX,
+	query string,
+	args ...any,
+) (
+	row *Network,
+	err error,
+) {
+	row = &Network{}
+	r := tx.QueryRow(query, args...)
+	if err = r.Scan(&row.NetworkID, &row.LocalDomain, &row.Network); err != nil {
+		row = nil
+	}
+	return
+}
+
+func Network_Iterate(
+	tx TX,
+	query string,
+	args ...any,
+) iter.Seq2[*Network, error] {
+	rows, err := tx.Query(query, args...)
+	if err != nil {
+		return func(yield func(*Network, error) bool) {
+			yield(nil, err)
+		}
+	}
+
+	return func(yield func(*Network, error) bool) {
+		defer rows.Close()
+		for rows.Next() {
+			row := &Network{}
+			err := rows.Scan(&row.NetworkID, &row.LocalDomain, &row.Network)
+			if !yield(row, err) {
+				return
+			}
+		}
+	}
+}
+
+func Network_List(
+	tx TX,
+	query string,
+	args ...any,
+) (
+	l []*Network,
+	err error,
+) {
+	for row, err := range Network_Iterate(tx, query, args...) {
+		if err != nil {
+			return nil, err
+		}
+		l = append(l, row)
+	}
+	return l, nil
+}
+
+// ----------------------------------------------------------------------------
+// Table: peers
+// ----------------------------------------------------------------------------
+
+type Peer struct {
+	NetworkID  int64
+	PeerIP     byte
+	APIKey     string
+	Name       string
+	Addr4      []byte
+	Addr6      []byte
+	Port       uint16
+	Relay      bool
+	WGPubKey   []byte
+	SignPubKey []byte
+}
+
+const Peer_SelectQuery = "SELECT NetworkID,PeerIP,APIKey,Name,Addr4,Addr6,Port,Relay,WGPubKey,SignPubKey FROM peers"
+
+func Peer_Insert(
+	tx TX,
+	row *Peer,
+) (err error) {
+	Peer_Sanitize(row)
+	if err = Peer_Validate(row); err != nil {
+		return err
+	}
+
+	_, err = tx.Exec("INSERT INTO peers(NetworkID,PeerIP,APIKey,Name,Addr4,Addr6,Port,Relay,WGPubKey,SignPubKey) VALUES(?,?,?,?,?,?,?,?,?,?)", row.NetworkID, row.PeerIP, row.APIKey, row.Name, row.Addr4, row.Addr6, row.Port, row.Relay, row.WGPubKey, row.SignPubKey)
+	return err
+}
+
 func Peer_UpdateFull(
 	tx TX,
 	row *Peer,
@@ -370,7 +375,7 @@ func Peer_UpdateFull(
 		return err
 	}

-	result, err := tx.Exec("UPDATE peers SET Version=?,APIKey=?,Name=?,PublicIP=?,Port=?,Relay=?,PubKey=?,PubSignKey=? WHERE PeerIP=?", row.Version, row.APIKey, row.Name, row.PublicIP, row.Port, row.Relay, row.PubKey, row.PubSignKey, row.PeerIP)
+	result, err := tx.Exec("UPDATE peers SET APIKey=?,Name=?,Addr4=?,Addr6=?,Port=?,Relay=?,WGPubKey=?,SignPubKey=? WHERE NetworkID=? AND PeerIP=?", row.APIKey, row.Name, row.Addr4, row.Addr6, row.Port, row.Relay, row.WGPubKey, row.SignPubKey, row.NetworkID, row.PeerIP)
 	if err != nil {
 		return err
 	}
@@ -391,9 +396,10 @@ func Peer_UpdateFull(

 func Peer_Delete(
 	tx TX,
+	NetworkID int64,
 	PeerIP byte,
 ) (err error) {
-	result, err := tx.Exec("DELETE FROM peers WHERE PeerIP=?", PeerIP)
+	result, err := tx.Exec("DELETE FROM peers WHERE NetworkID=? AND PeerIP=?", NetworkID, PeerIP)
 	if err != nil {
 		return err
 	}
@@ -414,14 +420,17 @@ func Peer_Delete(

 func Peer_Get(
 	tx TX,
+	NetworkID int64,
 	PeerIP byte,
 ) (
 	row *Peer,
 	err error,
 ) {
 	row = &Peer{}
-	r := tx.QueryRow("SELECT PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey,PubSignKey FROM peers WHERE PeerIP=?", PeerIP)
-	err = r.Scan(&row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey, &row.PubSignKey)
+	r := tx.QueryRow("SELECT NetworkID,PeerIP,APIKey,Name,Addr4,Addr6,Port,Relay,WGPubKey,SignPubKey FROM peers WHERE NetworkID=? AND PeerIP=?", NetworkID, PeerIP)
+	if err = r.Scan(&row.NetworkID, &row.PeerIP, &row.APIKey, &row.Name, &row.Addr4, &row.Addr6, &row.Port, &row.Relay, &row.WGPubKey, &row.SignPubKey); err != nil {
+		row = nil
+	}
 	return
 }

@@ -435,7 +444,9 @@ func Peer_GetWhere(
 ) {
 	row = &Peer{}
 	r := tx.QueryRow(query, args...)
-	err = r.Scan(&row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey, &row.PubSignKey)
+	if err = r.Scan(&row.NetworkID, &row.PeerIP, &row.APIKey, &row.Name, &row.Addr4, &row.Addr6, &row.Port, &row.Relay, &row.WGPubKey, &row.SignPubKey); err != nil {
+		row = nil
+	}
 	return
 }

@@ -455,7 +466,7 @@ func Peer_Iterate(
 		defer rows.Close()
 		for rows.Next() {
 			row := &Peer{}
-			err := rows.Scan(&row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey, &row.PubSignKey)
+			err := rows.Scan(&row.NetworkID, &row.PeerIP, &row.APIKey, &row.Name, &row.Addr4, &row.Addr6, &row.Port, &row.Relay, &row.WGPubKey, &row.SignPubKey)
 			if !yield(row, err) {
 				return
 			}
--- a/hub/api/db/sanitize-validate.go
+++ b/hub/api/db/sanitize-validate.go
@@ -3,67 +3,120 @@ package db
 import (
 	"errors"
 	"net/netip"
-	"net/url"
 	"strings"
 )

 var (
-	ErrInvalidIP   = errors.New("invalid IP")
-	ErrInvalidPort = errors.New("invalid port")
+	ErrInvalidIP       = errors.New("invalid IP")
+	ErrInvalidPeerIP   = errors.New("invalid peer IP")
+	ErrNonPrivateIP    = errors.New("non-private IP")
+	ErrInvalidPort     = errors.New("invalid port")
+	ErrInvalidNetName  = errors.New("invalid network name")
+	ErrNetNameNotLocal = errors.New("network name must end with .local")
+	ErrInvalidPeerName = errors.New("invalid peer name")
 )

 func Config_Sanitize(c *Config) {
-	if u, err := url.Parse(c.HubAddress); err == nil {
-		c.HubAddress = u.String()
-	}
-
-	if addr, ok := netip.AddrFromSlice(c.VPNNetwork); ok {
-		c.VPNNetwork = addr.AsSlice()
-	}
 }

 func Config_Validate(c *Config) error {
-	if _, err := url.Parse(c.HubAddress); err != nil {
-		return err
+	return nil
+}
+
+func Network_Sanitize(n *Network) {
+	n.LocalDomain = strings.TrimSpace(n.LocalDomain)
+
+	if addr, ok := netip.AddrFromSlice(n.Network); ok {
+		n.Network = addr.AsSlice()
+	}
+}
+
+func Network_Validate(c *Network) error {
+	// 15 bytes is linux limit for network interface names. With ending .local,
+	// max length is 21.
+	if len(c.LocalDomain) == 0 || len(c.LocalDomain) > 21 {
+		return ErrInvalidNetName
 	}

-	addr, ok := netip.AddrFromSlice(c.VPNNetwork)
+	if !strings.HasSuffix(c.LocalDomain, ".local") {
+		return ErrNetNameNotLocal
+	}
+
+	for _, c := range strings.TrimSuffix(c.LocalDomain, ".local") {
+		if c >= 'a' && c <= 'z' {
+			continue
+		}
+		if c >= '0' && c <= '9' {
+			continue
+		}
+		return ErrInvalidNetName
+	}
+
+	addr, ok := netip.AddrFromSlice(c.Network)
 	if !ok || !addr.Is4() || addr.As4()[3] != 0 || addr.As4()[0] == 0 {
 		return ErrInvalidIP
 	}

-	return nil
-}
+	if !addr.IsPrivate() {
+		return ErrNonPrivateIP
+	}

-func Session_Sanitize(s *Session) {
-}
-
-func Session_Validate(s *Session) error {
 	return nil
 }

 func Peer_Sanitize(p *Peer) {
 	p.Name = strings.TrimSpace(p.Name)
-	if len(p.PublicIP) != 0 {
-		addr, ok := netip.AddrFromSlice(p.PublicIP)
-		if ok && addr.Is4() {
-			p.PublicIP = addr.AsSlice()
+	if len(p.Addr4) != 0 {
+		if addr, ok := netip.AddrFromSlice(p.Addr4); ok {
+			// Unmap so an IPv4-mapped form is stored canonically as 4 bytes.
+			p.Addr4 = addr.Unmap().AsSlice()
+		}
+	}
+	if len(p.Addr6) != 0 {
+		if addr, ok := netip.AddrFromSlice(p.Addr6); ok {
+			p.Addr6 = addr.AsSlice()
 		}
 	}
 	if p.Port == 0 {
-		p.Port = 456
+		p.Port = 51820
 	}
 }

 func Peer_Validate(p *Peer) error {
-	if len(p.PublicIP) > 0 {
-		_, ok := netip.AddrFromSlice(p.PublicIP)
-		if !ok {
+	if p.PeerIP < 1 || p.PeerIP > 254 {
+		return ErrInvalidPeerIP
+	}
+	if len(p.Addr4) > 0 {
+		// Must be a genuine IPv4 address (reject an IPv6 in the v4 field).
+		if addr, ok := netip.AddrFromSlice(p.Addr4); !ok || !addr.Is4() {
+			return ErrInvalidIP
+		}
+	}
+	if len(p.Addr6) > 0 {
+		// Must be a genuine IPv6 address (reject IPv4 / IPv4-mapped in the v6 field).
+		if addr, ok := netip.AddrFromSlice(p.Addr6); !ok || !addr.Is6() || addr.Is4In6() {
 			return ErrInvalidIP
 		}
 	}
 	if p.Port == 0 {
 		return ErrInvalidPort
 	}
+
+	if len(p.Name) == 0 {
+		return ErrInvalidPeerName
+	}
+	for _, c := range p.Name {
+		if c >= 'a' && c <= 'z' {
+			continue
+		}
+		if c >= '0' && c <= '9' {
+			continue
+		}
+		if c == '-' {
+			continue
+		}
+		return ErrInvalidPeerName
+	}
+
 	return nil
 }
--- a/hub/api/db/tables.defs
+++ b/hub/api/db/tables.defs
@@ -1,26 +1,23 @@
 TABLE config OF Config (
  ConfigID    int64  PK,
-  HubAddress  string,
-  VPNNetwork  []byte,
-  Password    []byte NoUpdate
+  Password    []byte
 );

-TABLE sessions OF Session NoUpdate (
-  SessionID  string PK,
-  CSRF       string,
-  SignedIn   bool,
-  CreatedAt  int64,
-  LastSeenAt int64
+TABLE networks OF Network (
+  NetworkID   int64 PK,
+  LocalDomain string NoUpdate,
+  Network     []byte NoUpdate
 );

 TABLE peers OF Peer (
+  NetworkID  int64 PK,
  PeerIP     byte PK,
-  Version    int64,
  APIKey     string NoUpdate,
-  Name       string,
-  PublicIP   []byte,
-  Port       uint16,
-  Relay      bool,
-  PubKey     []byte NoUpdate,
-  PubSignKey []byte NoUpdate
+  Name       string NoUpdate,
+  Addr4      []byte NoUpdate,
+  Addr6      []byte NoUpdate,
+  Port       uint16 NoUpdate,
+  Relay      bool   NoUpdate,
+  WGPubKey   []byte NoUpdate,
+  SignPubKey []byte NoUpdate
 );
--- a/hub/api/db/written.go
+++ b/hub/api/db/written.go
@@ -1,41 +1,8 @@
 package db

-import "time"
-
-func Session_UpdateLastSeenAt(
-	tx TX,
-	id string,
-) (err error) {
-	_, err = tx.Exec("UPDATE sessions SET LastSeenAt=? WHERE SessionID=?", time.Now().Unix(), id)
-	return err
-}
-
-func Session_SetSignedIn(
-	tx TX,
-	id string,
-) (err error) {
-	_, err = tx.Exec("UPDATE sessions SET SignedIn=1 WHERE SessionID=?", id)
-	return err
-}
-
-func Session_DeleteBefore(
-	tx TX,
-	timestamp int64,
-) (err error) {
-	_, err = tx.Exec("DELETE FROM sessions WHERE LastSeenAt<?", timestamp)
-	return err
-}
-
-func Config_UpdatePassword(
-	tx TX,
-	pwdHash []byte,
-) (err error) {
-	_, err = tx.Exec("UPDATE config SET Password=? WHERE ConfigID=1", pwdHash)
-	return err
-}
-
-func Peer_ListAll(tx TX) ([]*Peer, error) {
-	return Peer_List(tx, Peer_SelectQuery)
+func Peer_ListAll(tx TX, networkID int64) ([]*Peer, error) {
+	const query = Peer_SelectQuery + ` WHERE NetworkID=? ORDER BY PeerIP ASC`
+	return Peer_List(tx, query, networkID)
 }

 func Peer_GetByAPIKey(tx TX, apiKey string) (*Peer, error) {
@@ -44,8 +11,3 @@ func Peer_GetByAPIKey(tx TX, apiKey string) (*Peer, error) {
 		Peer_SelectQuery+` WHERE APIKey=?`,
 		apiKey)
 }
-
-func Peer_Exists(tx TX, ip byte) (exists bool, err error) {
-	err = tx.QueryRow(`SELECT EXISTS(SELECT 1 FROM peers WHERE PeerIP=?)`, ip).Scan(&exists)
-	return
-}
--- a/hub/api/errors.go
+++ b/hub/api/errors.go
@@ -7,7 +7,6 @@ import (

 var (
 	ErrNotAuthorized = errors.New("not authorized")
-	ErrNoIPAvailable = errors.New("no IP address available")
 	ErrInvalidIP     = db.ErrInvalidIP
 	ErrInvalidPort   = db.ErrInvalidPort
 )
--- a/hub/api/migrations/2024-11-30-init.sql
+++ b/hub/api/migrations/2024-11-30-init.sql
@@ -1,27 +1,25 @@
 CREATE TABLE config (
  ConfigID    INTEGER NOT NULL PRIMARY KEY, -- Always 1.
-  HubAddress  TEXT    NOT NULL, -- https://for.example.com
-  VPNNetwork  BLOB    NOT NULL, -- Network (/24), example 10.51.50.0
  Password    BLOB    NOT NULL  -- bcrypt password for web interface
 ) WITHOUT ROWID;

-CREATE TABLE sessions (
-  SessionID  TEXT    NOT NULL PRIMARY KEY,
-  CSRF       TEXT    NOT NULL,
-  SignedIn   INTEGER NOT NULL,
-  CreatedAt  INTEGER NOT NULL,
-  LastSeenAt INTEGER NOT NULL
+CREATE TABLE networks (
+  NetworkID   INTEGER NOT NULL PRIMARY KEY,
+  LocalDomain TEXT    NOT NULL UNIQUE, -- Network/interface name.
+  Network     BLOB    NOT NULL UNIQUE  -- Network (/24), example 10.51.50.0
 ) WITHOUT ROWID;

-CREATE INDEX sessions_last_seen_index ON sessions(LastSeenAt);
-
 CREATE TABLE peers (
-  PeerIP     INTEGER NOT NULL PRIMARY KEY, -- Final byte.
-  Version    INTEGER NOT NULL,
-  APIKey     TEXT    NOT NULL UNIQUE,
-  Name       TEXT    NOT NULL UNIQUE,      -- For humans.
-  PublicIP   BLOB    NOT NULL,
+  NetworkID  INTEGER NOT NULL,
+  PeerIP     INTEGER NOT NULL,           -- Final byte of IP.
+  APIKey     TEXT    NOT NULL UNIQUE,    -- Peer's secret API key.
+  Name       TEXT    NOT NULL,           -- For humans.
+  Addr4      BLOB    NOT NULL,
+  Addr6      BLOB    NOT NULL,
  Port       INTEGER NOT NULL,
-  Relay      INTEGER NOT NULL DEFAULT 0,   -- Boolean if peer will forward packets. Must also have public address.
-  PubKey     BLOB    NOT NULL
+  Relay      INTEGER NOT NULL DEFAULT 0, -- Boolean if peer will forward packets.
+  WGPubKey   BLOB    NOT NULL,
+  SignPubKey BLOB    NOT NULL,
+  UNIQUE(NetworkID, Name),
+  PRIMARY KEY(NetworkID, PeerIP)
 ) WITHOUT ROWID;
--- a/hub/api/migrations/2024-12-27-signing-keys.sql
+++ b/hub/api/migrations/2024-12-27-signing-keys.sql
@@ -1 +0,0 @@
-ALTER TABLE peers ADD COLUMN PubSignKey BLOB NOT NULL DEFAULT '';
--- a/hub/api/types.go
+++ b/hub/api/types.go
@@ -3,5 +3,12 @@ package api
 import "vppn/hub/api/db"

 type Config = db.Config
-type Session = db.Session
+type Network = db.Network
 type Peer = db.Peer
+
+type Session struct {
+	SessionID  string
+	SignedIn   bool
+	CreatedAt  int64
+	LastSeenAt int64
+}
--- a/hub/app.go
+++ b/hub/app.go
@@ -2,6 +2,7 @@ package hub

 import (
 	"embed"
+	"encoding/base64"
 	"html/template"
 	"net/http"
 	"path/filepath"
@@ -47,6 +48,19 @@ func NewApp(conf Config) (*App, error) {
 	return app, nil
 }

-var templateFuncs = template.FuncMap{
-	"ipToString": ipBytesTostring,
+func (app *App) Handler() http.Handler {
+	cop := http.NewCrossOriginProtection()
+	return cop.Handler(app.mux)
+}
+
+var templateFuncs = template.FuncMap{
+	"ipToString":  ipBytesTostring,
+	"wgKeyString": wgKeyString,
+}
+
+func wgKeyString(key []byte) string {
+	if len(key) == 0 {
+		return "not set"
+	}
+	return base64.StdEncoding.EncodeToString(key)
 }
--- a/hub/cookie.go
+++ b/hub/cookie.go
@@ -2,7 +2,6 @@ package hub

 import (
 	"net/http"
-	"time"
 )

 func (a *App) getCookie(r *http.Request, name string) string {
@@ -26,9 +25,12 @@ func (a *App) setCookie(w http.ResponseWriter, name, value string) {

 func (a *App) deleteCookie(w http.ResponseWriter, name string) {
 	http.SetCookie(w, &http.Cookie{
-		Name:    name,
-		Value:   "",
-		Path:    "/",
-		Expires: time.Unix(0, 0),
+		Name:     name,
+		Value:    "",
+		Path:     "/",
+		Secure:   !a.insecure,
+		SameSite: http.SameSiteStrictMode,
+		HttpOnly: true,
+		MaxAge:   -1, // delete now
 	})
 }
--- a/hub/form.go
+++ b/hub/form.go
@@ -0,0 +1,42 @@
+package hub
+
+import (
+	"net/url"
+	"vppn/hub/api"
+
+	"git.crumpington.com/lib/go/webutil"
+)
+
+func (app *App) formGetNetwork(form url.Values) (*api.Network, error) {
+	var id int64
+	if err := webutil.NewFormScanner(form).Scan("NetworkID", &id).Error(); err != nil {
+		return nil, err
+	}
+
+	return app.api.Network_Get(id)
+}
+
+func (app *App) formGetNetworkPeers(form url.Values) (*api.Network, []*api.Peer, error) {
+	n, err := app.formGetNetwork(form)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	peers, err := app.api.Peer_List(n.NetworkID)
+	return n, peers, err
+}
+
+func (app *App) formGetPeer(form url.Values) (*api.Network, *api.Peer, error) {
+	net, err := app.formGetNetwork(form)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var ip byte
+	if err := webutil.NewFormScanner(form).Scan("PeerIP", &ip).Error(); err != nil {
+		return nil, nil, err
+	}
+
+	peer, err := app.api.Peer_Get(net.NetworkID, ip)
+	return net, peer, err
+}
--- a/hub/global.go
+++ b/hub/global.go
@@ -1,5 +1,5 @@
 package hub

 const (
-	SESSION_ID_COOKIE_NAME = "SessionID"
+	sessionIDCookieName = "SessionID"
 )
--- a/hub/handler.go
+++ b/hub/handler.go
@@ -12,7 +12,7 @@ type handlerFunc func(s *api.Session, w http.ResponseWriter, r *http.Request) er

 func (app *App) handlePub(pattern string, fn handlerFunc) {
 	wrapped := func(w http.ResponseWriter, r *http.Request) {
-		sessionID := app.getCookie(r, SESSION_ID_COOKIE_NAME)
+		sessionID := app.getCookie(r, sessionIDCookieName)
 		s, err := app.api.Session_Get(sessionID)
 		if err != nil {
 			log.Printf("Failed to get session: %v", err)
@@ -20,22 +20,13 @@ func (app *App) handlePub(pattern string, fn handlerFunc) {
 			return
 		}

-		if s.SessionID != sessionID {
-			app.setCookie(w, SESSION_ID_COOKIE_NAME, s.SessionID)
-		}
-
 		if r.Method == http.MethodPost {
 			r.ParseMultipartForm(64 * 1024)
-			if r.FormValue("CSRF") != s.CSRF {
-				log.Printf("%s != %s", r.FormValue("CSRF"), s.CSRF)
-				http.Error(w, "CSRF mismatch", http.StatusBadRequest)
-				return
-			}
 		} else {
 			r.ParseForm()
 		}

-		if err := fn(s, w, r); err != nil {
+		if err := fn(&s, w, r); err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 		}
 	}
--- a/hub/handlers.go
+++ b/hub/handlers.go
@@ -5,18 +5,17 @@ import (
 	"errors"
 	"log"
 	"net/http"
-	"net/netip"
-	"strings"
 	"vppn/hub/api"
 	"vppn/m"

 	"git.crumpington.com/lib/go/webutil"
 	"golang.org/x/crypto/bcrypt"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )

 func (a *App) _root(s *api.Session, w http.ResponseWriter, r *http.Request) error {
 	if s.SignedIn {
-		return a.redirect(w, r, "/admin/config/")
+		return a.redirect(w, r, "/admin/network/list/")
 	} else {
 		return a.redirect(w, r, "/sign-in/")
 	}
@@ -35,9 +34,11 @@ func (a *App) _signinSubmit(s *api.Session, w http.ResponseWriter, r *http.Reque
 		return err
 	}

-	if err := a.api.Session_SignIn(s, pwd); err != nil {
+	sess, err := a.api.Session_SignIn(pwd)
+	if err != nil {
 		return err
 	}
+	a.setCookie(w, sessionIDCookieName, sess.SessionID)

 	return a.redirect(w, r, "/")
 }
@@ -50,58 +51,164 @@ func (a *App) _adminSignOutSubmit(s *api.Session, w http.ResponseWriter, r *http
 	if err := a.api.Session_Delete(s.SessionID); err != nil {
 		log.Printf("Failed to delete session cookie %s: %v", s.SessionID, err)
 	}
-	a.deleteCookie(w, SESSION_ID_COOKIE_NAME)
+	a.deleteCookie(w, sessionIDCookieName)
 	return a.redirect(w, r, "/")
 }

-func (a *App) _adminConfig(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	peers, err := a.api.Peer_List()
+func (a *App) _adminNetworkList(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	l, err := a.api.Network_List()
 	if err != nil {
 		return err
 	}
-
-	return a.render("/admin-config.html", w, struct {
-		Session *api.Session
-		Peers   []*api.Peer
-		Config  *api.Config
-	}{
-		s,
-		peers,
-		a.api.Config_Get(),
-	})
+	return a.render("/admin-network-list.html", w, struct {
+		Session  *api.Session
+		Networks []*api.Network
+	}{s, l})
 }

-func (a *App) _adminConfigEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	return a.render("/admin-config-edit.html", w, struct {
-		Session *api.Session
-		Config  *api.Config
-	}{
-		s,
-		a.api.Config_Get(),
-	})
+func (a *App) _adminNetworkCreate(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	return a.render("/admin-network-create.html", w, struct{ Session *api.Session }{s})
 }

-func (a *App) _adminConfigEditSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var (
-		conf  = a.api.Config_Get()
-		ipStr string
-	)
+func (a *App) _adminNetworkCreateSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	n := &api.Network{}
+	var netStr string

 	err := webutil.NewFormScanner(r.Form).
-		Scan("HubAddress", &conf.HubAddress).
-		Scan("VPNNetwork", &ipStr).
+		Scan("LocalDomain", &n.LocalDomain).
+		Scan("Network", &netStr).
 		Error()
 	if err != nil {
 		return err
 	}

-	if conf.VPNNetwork, err = stringToIP(ipStr); err != nil {
+	n.Network, err = stringToIP(netStr)
+	if err != nil {
 		return err
 	}
-	if err := a.api.Config_Update(conf); err != nil {
+
+	if err := a.api.Network_Create(n); err != nil {
 		return err
 	}
-	return a.redirect(w, r, "/admin/config/")
+
+	return a.redirect(w, r, "/admin/network/view/?NetworkID=%d", n.NetworkID)
+}
+
+func (a *App) _adminNetworkView(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	n, peers, err := a.formGetNetworkPeers(r.Form)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/network/network-view.html", w, struct {
+		Session *api.Session
+		Network *api.Network
+		Peers   []*api.Peer
+	}{s, n, peers})
+}
+
+func (a *App) _adminNetworkDelete(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	n, peers, err := a.formGetNetworkPeers(r.Form)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/network/network-delete.html", w, struct {
+		Session *api.Session
+		Network *api.Network
+		Peers   []*api.Peer
+	}{s, n, peers})
+}
+
+func (a *App) _adminNetworkDeleteSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	n, err := a.formGetNetwork(r.Form)
+	if err != nil {
+		return err
+	}
+
+	if err = a.api.Network_Delete(n); err != nil {
+		return err
+	}
+	return a.redirect(w, r, "/admin/network/list/")
+}
+
+func (a *App) _adminPeerCreate(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	n, err := a.formGetNetwork(r.Form)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/network/peer-create.html", w, struct {
+		Session *api.Session
+		Network *api.Network
+	}{s, n})
+}
+
+func (a *App) _adminPeerCreateSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	var addr4Str, addr6Str string
+
+	p := &api.Peer{}
+	err := webutil.NewFormScanner(r.Form).
+		Scan("NetworkID", &p.NetworkID).
+		Scan("IP", &p.PeerIP).
+		Scan("Name", &p.Name).
+		Scan("Addr4", &addr4Str).
+		Scan("Addr6", &addr6Str).
+		Scan("Port", &p.Port).
+		Scan("Relay", &p.Relay).
+		Error()
+	if err != nil {
+		return err
+	}
+
+	if p.Addr4, err = stringToIP(addr4Str); err != nil {
+		return err
+	}
+	if p.Addr6, err = stringToIP(addr6Str); err != nil {
+		return err
+	}
+
+	if err := a.api.Peer_CreateNew(p); err != nil {
+		return err
+	}
+	return a.redirect(w, r, "/admin/peer/view/?NetworkID=%d&PeerIP=%d", p.NetworkID, p.PeerIP)
+}
+
+func (a *App) _adminPeerView(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	net, peer, err := a.formGetPeer(r.Form)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/network/peer-view.html", w, struct {
+		Session *api.Session
+		Network *api.Network
+		Peer    *api.Peer
+	}{s, net, peer})
+}
+
+func (a *App) _adminPeerDelete(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	n, peer, err := a.formGetPeer(r.Form)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/network/peer-delete.html", w, struct {
+		Session *api.Session
+		Network *api.Network
+		Peer    *api.Peer
+	}{s, n, peer})
+}
+
+func (a *App) _adminPeerDeleteSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	n, peer, err := a.formGetPeer(r.Form)
+	if err != nil {
+		return err
+	}
+	if err := a.api.Peer_Delete(n.NetworkID, peer.PeerIP); err != nil {
+		return err
+	}
+	return a.redirect(w, r, "/admin/network/view/?NetworkID=%d", n.NetworkID)
 }

 func (a *App) _adminPasswordEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
@@ -110,13 +217,17 @@ func (a *App) _adminPasswordEdit(s *api.Session, w http.ResponseWriter, r *http.

 func (a *App) _adminPasswordSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
 	var (
-		conf    = a.api.Config_Get()
 		curPwd  string
 		newPwd  string
 		newPwd2 string
 	)

-	err := webutil.NewFormScanner(r.Form).
+	conf, err := a.api.Config_Get()
+	if err != nil {
+		return err
+	}
+
+	err = webutil.NewFormScanner(r.Form).
 		Scan("CurrentPassword", &curPwd).
 		Scan("NewPassword", &newPwd).
 		Scan("NewPassword2", &newPwd2).
@@ -143,205 +254,95 @@ func (a *App) _adminPasswordSubmit(s *api.Session, w http.ResponseWriter, r *htt
 		return err
 	}

-	if err := a.api.Config_UpdatePassword(hash); err != nil {
+	conf.Password = hash
+
+	if err := a.api.Config_Update(conf); err != nil {
 		return err
 	}

 	return a.redirect(w, r, "/admin/config/")
 }

-func (a *App) _adminHosts(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	conf := a.api.Config_Get()
-
-	peers, err := a.api.Peer_List()
-	if err != nil {
-		return err
-	}
-
-	b := strings.Builder{}
-
-	for _, peer := range peers {
-		ip := conf.VPNNetwork
-		ip[3] = peer.PeerIP
-		b.WriteString(netip.AddrFrom4([4]byte(ip)).String())
-		b.WriteString(" ")
-		b.WriteString(peer.Name)
-		b.WriteString("\n")
-	}
-
-	w.Write([]byte(b.String()))
-	return nil
-}
-
-func (a *App) _adminPeerCreate(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	return a.render("/admin-peer-create.html", w, struct{ Session *api.Session }{s})
-}
-
-func (a *App) _adminPeerCreateSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var ipStr string
-
-	p := &api.Peer{}
-	err := webutil.NewFormScanner(r.Form).
-		Scan("IP", &p.PeerIP).
-		Scan("Name", &p.Name).
-		Scan("PublicIP", &ipStr).
-		Scan("Port", &p.Port).
-		Scan("Relay", &p.Relay).
-		Error()
-	if err != nil {
-		return err
-	}
-
-	if p.PublicIP, err = stringToIP(ipStr); err != nil {
-		return err
-	}
-
-	if err := a.api.Peer_CreateNew(p); err != nil {
-		return err
-	}
-	return a.redirect(w, r, "/admin/peer/view/?PeerIP=%d", p.PeerIP)
-}
-
-func (a *App) _adminPeerView(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var peerIP byte
-	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
-	if err != nil {
-		return err
-	}
-
-	peer, err := a.api.Peer_Get(peerIP)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/admin-peer-view.html", w, struct {
-		Session *api.Session
-		Peer    *api.Peer
-	}{s, peer})
-}
-
-func (a *App) _adminPeerEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var peerIP byte
-	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
-	if err != nil {
-		return err
-	}
-
-	peer, err := a.api.Peer_Get(peerIP)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/admin-peer-edit.html", w, struct {
-		Session *api.Session
-		Peer    *api.Peer
-	}{s, peer})
-}
-
-func (a *App) _adminPeerEditSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var (
-		peerIP byte
-		ipStr  string
-	)
-
-	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
-	if err != nil {
-		return err
-	}
-
-	peer, err := a.api.Peer_Get(peerIP)
-	if err != nil {
-		return err
-	}
-	err = webutil.NewFormScanner(r.Form).
-		Scan("Name", &peer.Name).
-		Scan("PublicIP", &ipStr).
-		Scan("Port", &peer.Port).
-		Scan("Relay", &peer.Relay).
-		Error()
-	if err != nil {
-		return err
-	}
-
-	if peer.PublicIP, err = stringToIP(ipStr); err != nil {
-		return err
-	}
-
-	if err = a.api.Peer_Update(peer); err != nil {
-		return err
-	}
-
-	return a.redirect(w, r, "/admin/peer/view/?PeerIP=%d", peer.PeerIP)
-}
-
-func (a *App) _adminPeerDelete(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var peerIP byte
-	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
-	if err != nil {
-		return err
-	}
-
-	peer, err := a.api.Peer_Get(peerIP)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/admin-peer-delete.html", w, struct {
-		Session *api.Session
-		Peer    *api.Peer
-	}{s, peer})
-}
-
-func (a *App) _adminPeerDeleteSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var peerIP byte
-	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
-	if err != nil {
-		return err
-	}
-
-	if err := a.api.Peer_Delete(peerIP); err != nil {
-		return err
-	}
-
-	return a.redirect(w, r, "/admin/peer/list/")
-}
-
 func (a *App) _peerInit(peer *api.Peer, w http.ResponseWriter, r *http.Request) error {
+	if len(peer.WGPubKey) != 0 {
+		http.Error(w, "Already initialized", http.StatusConflict)
+		return nil
+	}
+
 	args := m.PeerInitArgs{}
 	if err := json.NewDecoder(r.Body).Decode(&args); err != nil {
 		return err
 	}

-	conf, err := a.api.Peer_Init(peer, args)
+	if len(args.WGPubKey) != 32 {
+		http.Error(w, "invalid WGPubKey", http.StatusBadRequest)
+		return nil
+	}
+	if len(args.SignPubKey) != 32 {
+		http.Error(w, "invalid SignPubKey", http.StatusBadRequest)
+		return nil
+	}
+
+	net, err := a.api.Network_Get(peer.NetworkID)
 	if err != nil {
 		return err
 	}

-	return a.sendJSON(w, conf)
+	if err := a.api.Peer_Init(peer, args); err != nil {
+		return err
+	}
+
+	resp := m.PeerInitResp{
+		PeerIP:      peer.PeerIP,
+		Network:     net.Network,
+		LocalDomain: net.LocalDomain,
+	}
+
+	resp.NetworkState.Peers, err = a.peersList(net.NetworkID)
+	if err != nil {
+		return err
+	}
+
+	return a.sendJSON(w, resp)
 }

 func (a *App) _peerFetchState(peer *api.Peer, w http.ResponseWriter, r *http.Request) error {
-	peers, err := a.api.Peer_List()
+	peers, err := a.peersList(peer.NetworkID)
 	if err != nil {
 		return err
 	}
+	return a.sendJSON(w, m.NetworkState{Peers: peers})
+}

-	state := m.NetworkState{}
-
-	for _, p := range peers {
-		if len(p.PubKey) != 0 {
-			state.Peers[p.PeerIP] = &m.Peer{
-				PeerIP:     p.PeerIP,
-				Version:    p.Version,
-				Name:       p.Name,
-				PublicIP:   p.PublicIP,
-				Port:       p.Port,
-				Relay:      p.Relay,
-				PubKey:     p.PubKey,
-				PubSignKey: p.PubSignKey,
-			}
-		}
+func (a *App) peersList(networkID int64) (peers []m.Peer, err error) {
+	l, err := a.api.Peer_List(networkID)
+	if err != nil {
+		return nil, err
 	}

-	return a.sendJSON(w, state)
+	peers = make([]m.Peer, 0, len(l))
+
+	for _, p := range l {
+		if len(p.WGPubKey) == 0 {
+			continue
+		}
+		wgKey, err := wgtypes.NewKey(p.WGPubKey)
+		if err != nil {
+			continue // malformed key; skip rather than serve garbage
+		}
+		var signKey [32]byte
+		copy(signKey[:], p.SignPubKey)
+		peers = append(peers, m.Peer{
+			PeerIP:     p.PeerIP,
+			Name:       p.Name,
+			Addr4:      addrFromBytes(p.Addr4),
+			Addr6:      addrFromBytes(p.Addr6),
+			Port:       p.Port,
+			Relay:      p.Relay,
+			WGPubKey:   wgKey,
+			SignPubKey: signKey,
+		})
+	}
+
+	return peers, nil
 }
--- a/hub/main.go
+++ b/hub/main.go
@@ -31,7 +31,7 @@ func Main() {

 	srv := &http.Server{
 		Addr:    conf.ListenAddr,
-		Handler: app.mux,
+		Handler: app.Handler(),
 	}

 	log.Fatal(webutil.ListenAndServe(srv))
--- a/hub/routes.go
+++ b/hub/routes.go
@@ -9,22 +9,25 @@ func (a *App) registerRoutes() {
 	a.handleNotSignedIn("GET  /sign-in/", a._signin)
 	a.handleNotSignedIn("POST /sign-in/", a._signinSubmit)

-	a.handleSignedIn("GET  /admin/config/", a._adminConfig)
-	a.handleSignedIn("GET  /admin/config/edit/", a._adminConfigEdit)
-	a.handleSignedIn("POST /admin/config/edit/", a._adminConfigEditSubmit)
 	a.handleSignedIn("GET  /admin/sign-out/", a._adminSignOut)
 	a.handleSignedIn("POST /admin/sign-out/", a._adminSignOutSubmit)
-	a.handleSignedIn("GET  /admin/password/edit/", a._adminPasswordEdit)
-	a.handleSignedIn("POST /admin/password/edit/", a._adminPasswordSubmit)
-	a.handleSignedIn("GET  /admin/peer/hosts/", a._adminHosts)
+
+	a.handleSignedIn("GET  /admin/network/list/", a._adminNetworkList)
+	a.handleSignedIn("GET  /admin/network/create/", a._adminNetworkCreate)
+	a.handleSignedIn("POST /admin/network/create/", a._adminNetworkCreateSubmit)
+	a.handleSignedIn("GET  /admin/network/delete/", a._adminNetworkDelete)
+	a.handleSignedIn("POST /admin/network/delete/", a._adminNetworkDeleteSubmit)
+
+	a.handleSignedIn("GET  /admin/network/view/", a._adminNetworkView)
 	a.handleSignedIn("GET  /admin/peer/create/", a._adminPeerCreate)
 	a.handleSignedIn("POST /admin/peer/create/", a._adminPeerCreateSubmit)
 	a.handleSignedIn("GET  /admin/peer/view/", a._adminPeerView)
-	a.handleSignedIn("GET  /admin/peer/edit/", a._adminPeerEdit)
-	a.handleSignedIn("POST /admin/peer/edit/", a._adminPeerEditSubmit)
 	a.handleSignedIn("GET  /admin/peer/delete/", a._adminPeerDelete)
 	a.handleSignedIn("POST /admin/peer/delete/", a._adminPeerDeleteSubmit)

+	a.handleSignedIn("GET  /admin/password/edit/", a._adminPasswordEdit)
+	a.handleSignedIn("POST /admin/password/edit/", a._adminPasswordSubmit)
+
 	a.handlePeer("POST /peer/init/", a._peerInit)
 	a.handlePeer("GET /peer/fetch-state/", a._peerFetchState)
 }
--- a/hub/templates/admin-config-edit.html
+++ b/hub/templates/admin-config-edit.html
@@ -1,20 +0,0 @@
-{{define "body" -}}
-<h2>Config</h2>
-
-<form method="POST">
-  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <p>
-    <label>Hub Address</label><br>
-    <input type="url" name="HubAddress" value="{{.Config.HubAddress}}">
-  </p>
-  <p>
-    <label>VPN Network</label><br>
-    <input type="text" name="VPNNetwork" value="{{ipToString .Config.VPNNetwork}}">
-  </p>
-  <p>
-    <button type="submit">Save</button>
-    <a href="/admin/config/">Cancel</a>
-  </p>
-</form>
-
-{{- end}}
--- a/hub/templates/admin-network-create.html
+++ b/hub/templates/admin-network-create.html
@@ -0,0 +1,18 @@
+{{define "body" -}}
+<h2>Create Network</h2>
+
+<form method="POST">
+<p>
+    <label>Local Domain (ending with .local)</label><br>
+    <input type="text" name="LocalDomain">
+  </p>
+  <p>
+    <label>Network /24</label><br>
+    <input type="text" name="Network">
+  </p>
+  <p>
+    <button type="submit">Save</button>
+    <a href="/admin/network/list/">Cancel</a>
+  </p>
+</form>
+{{- end}}
--- a/hub/templates/admin-network-list.html
+++ b/hub/templates/admin-network-list.html
@@ -0,0 +1,38 @@
+{{define "body" -}}
+<h2>Networks</h2>
+
+<p>
+  <a href="/admin/network/create/">Create</a>
+</p>
+
+{{if .Networks -}}
+<table>
+  <thead>
+    <tr>
+      <th>Local Domain</th>
+      <th>Network</th>
+    </tr>
+  </thead>
+  <tbody>
+  {{range .Networks -}}
+  <tr>
+    <td>
+      <a href="/admin/network/view/?NetworkID={{.NetworkID}}">
+        {{.LocalDomain}}
+      </a>
+    </td>
+    <td>{{ipToString .Network}}</td>
+  </tr>
+  </tbody>
+  {{- end}}
+</table>
+{{- else}}
+<p>No networks.</p>
+{{- end}}
+
+<h3>Settings</h3>
+
+<ul>
+  <li><a href="/admin/password/edit/">Password</a></li>
+</ul>
+{{- end}}
--- a/hub/templates/admin-password-edit.html
+++ b/hub/templates/admin-password-edit.html
@@ -2,8 +2,7 @@
 <h2>Change Password</h2>

 <form method="POST">
-  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <p>
+<p>
    <label>Current Password</label><br>
    <input type="password" name="CurrentPassword">
  </p>
--- a/hub/templates/admin-peer-create.html
+++ b/hub/templates/admin-peer-create.html
@@ -1,34 +0,0 @@
-{{define "body" -}}
-<h2>New Peer</h2>
-
-<form method="POST">
-  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <p>
-    <label>IP</label><br>
-    <input type="number" name="IP" min="1" max="255" value="0">
-  </p>
-  <p>
-    <label>Name</label><br>
-    <input type="text" name="Name">
-  </p>
-  <p>
-    <label>Public IP</label><br>
-    <input type="text" name="PublicIP">
-  </p>
-  <p>
-    <label>Port</label><br>
-    <input type="number" name="Port" value="456">
-  </p>
-  <p>
-    <label>
-      <input type="checkbox" name="Relay">
-      Relay
-    </label>
-  </p>
-  <p>
-    <button type="submit">Save</button>
-    <a href="/admin/config/">Cancel</a>
-  </p>
-</form>
-
-{{- end}}
--- a/hub/templates/admin-peer-delete.html
+++ b/hub/templates/admin-peer-delete.html
@@ -1,36 +0,0 @@
-{{define "body" -}}
-<h2>Delete Peer</h2>
-
-{{with .Peer -}}
-<form method="POST">
-  <input type="hidden" name="CSRF" value="{{$.Session.CSRF}}">
-  <p>
-    <label>Peer IP</label><br>
-    <input type="number" name="PeerIP" value="{{.PeerIP}}" disabled>
-  </p>
-  <p>
-    <label>Name</label><br>
-    <input type="text" value="{{.Name}}" disabled>
-  </p>
-  <p>
-    <label>Public IP</label><br>
-    <input type="text" value="{{ipToString .PublicIP}}" disabled>
-  </p>
-  <p>
-    <label>Port</label><br>
-    <input type="number" value="{{.Port}}" disabled>
-  </p>
-  <p>
-    <label>
-      <input type="checkbox" {{if .Relay}}checked{{end}} disabled>
-      Relay
-    </label>
-  </p>
-  <p>
-    <button type="submit">Delete</button>
-    <a href="/admin/peer/view/?PeerIP={{.PeerIP}}">Cancel</a>
-  </p>
-</form>
-{{- end}}
-
-{{- end}}
--- a/hub/templates/admin-peer-edit.html
+++ b/hub/templates/admin-peer-edit.html
@@ -1,36 +0,0 @@
-{{define "body" -}}
-<h2>Edit Peer</h2>
-
-{{with .Peer -}}
-<form method="POST">
-  <input type="hidden" name="CSRF" value="{{$.Session.CSRF}}">
-  <p>
-    <label>Peer IP</label><br>
-    <input type="number" name="PeerIP" value="{{.PeerIP}}" disabled>
-  </p>
-  <p>
-    <label>Name</label><br>
-    <input type="text" name="Name" value="{{.Name}}">
-  </p>
-  <p>
-    <label>Public IP</label><br>
-    <input type="text" name="PublicIP" value="{{ipToString .PublicIP}}">
-  </p>
-  <p>
-    <label>Port</label><br>
-    <input type="number" name="Port" value="{{.Port}}">
-  </p>
-  <p>
-    <label>
-      <input type="checkbox" name="Relay" {{if .Relay}}checked{{end}}>
-      Relay
-    </label>
-  </p>
-  <p>
-    <button type="submit">Save</button>
-    <a href="/admin/peer/view/?PeerIP={{.PeerIP}}">Cancel</a>
-  </p>
-</form>
-{{- end}}
-
-{{- end}}
--- a/hub/templates/admin-peer-init.html
+++ b/hub/templates/admin-peer-init.html
@@ -1,13 +0,0 @@
-{{define "body" -}}
-<h2>Initialize Peer</h2>
-
-<p>
-  Configure the peer with the following URL:
-</p>
-<pre>
-  {{.HubAddress}}/peer/init/?Code={{.Code}}
-</pre>
-<p>
-  <a href="/admin/config/">Done</a>
-</p>
-{{- end}}
--- a/hub/templates/admin-peer-intent.html
+++ b/hub/templates/admin-peer-intent.html
@@ -1,13 +0,0 @@
-{{define "body" -}}
-<h2>Create Peer</h2>
-
-<p>
-  Configure the peer with the following URL:
-</p>
-<pre>
-  {{.HubAddress}}/peer/create/?Code={{.Code}}
-</pre>
-<p>
-  <a href="/admin/config/">Done</a>
-</p>
-{{- end}}
--- a/hub/templates/admin-peer-view.html
+++ b/hub/templates/admin-peer-view.html
@@ -1,20 +0,0 @@
-{{define "body" -}}
-<h2>Peer</h2>
-
-<p>
-  <a href="/admin/peer/edit/?PeerIP={{.Peer.PeerIP}}">Edit</a> /
-  <a href="/admin/peer/delete/?PeerIP={{.Peer.PeerIP}}">Delete</a>
-</p>
-
-{{with .Peer -}}
-<table class="def-list">
-  <tr><td>Peer IP</td><td>{{.PeerIP}}</td></tr>
-  <tr><td>Name</td><td>{{.Name}}</td></tr>
-  <tr><td>Public IP</td><td>{{ipToString .PublicIP}}</td></tr>
-  <tr><td>Port</td><td>{{.Port}}</td></tr>
-  <tr><td>Relay</td><td>{{if .Relay}}T{{else}}F{{end}}</td></tr>
-  <tr><td>API Key</td><td>{{.APIKey}}</td></tr>
-</table>
-{{- end}}
-
-{{- end}}
--- a/hub/templates/admin-sign-out.html
+++ b/hub/templates/admin-sign-out.html
@@ -2,10 +2,9 @@
 <h2>Sign Out</h2>

 <form method="POST">
-  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <p>
+<p>
    <button type="submit">Sign Out</button>
-    <a href="/admin/config/">Cancel</a>
+    <a href="/">Cancel</a>
  </p>
 </form>
 {{- end}}
--- a/hub/templates/base.html
+++ b/hub/templates/base.html
@@ -10,7 +10,7 @@
    <h1>VPPN</h1>
    <nav>
      {{if .Session.SignedIn -}}
-      <a href="/admin/config/">Home</a> /
+      <a href="/admin/networks/list/">Home</a> /
      <a href="/admin/sign-out/">Sign out</a>
      {{- end}}
    </nav>
--- a/hub/templates/network/base.html
+++ b/hub/templates/network/base.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <title>VPPN Hub</title>
+  <link rel="stylesheet" href="/static/new.min.css">
+    <link rel="stylesheet" href="/static/custom.css">
+</head>
+<body>
+  <header>
+    <h1>VPPN</h1>
+    <nav>
+      {{if .Session.SignedIn -}}
+      <a href="/admin/networks/list/">Home</a> /
+      <a href="/admin/sign-out/">Sign out</a>
+      {{- end}}
+    </nav>
+  </header>
+  <h2>
+    Network:
+    <a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">{{.Network.LocalDomain}}</a>
+  </h2>
+
+  {{block "body" .}}There's nothing here.{{end}}
+</body>
+</html>
--- a/hub/templates/network/network-delete.html
+++ b/hub/templates/network/network-delete.html
@@ -0,0 +1,15 @@
+{{define "body" -}}
+<h3>Delete</h3>
+
+{{if .Peers -}}
+<p>You must first delete all peers.</p>
+{{- else -}}
+<form method="POST">
+<input type="hidden" name="NetworkID" value="{{.Network.NetworkID}}">
+  <p>
+    <button type="submit">Delete</button>
+    <a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">Cancel</a>
+  </p>
+</form>
+{{- end}}
+{{- end}}
--- a/hub/templates/network/network-view.html
+++ b/hub/templates/network/network-view.html
@@ -1,27 +1,19 @@
 {{define "body" -}}
-<h2>Config</h2>
-
 <p>
-  <a href="/admin/config/edit/">Edit</a> /
-  <a href="/admin/password/edit/">Change Password</a>
+  <a href="/admin/network/delete/?NetworkID={{.Network.NetworkID}}">Delete</a>
 </p>

 <table class="def-list">
  <tr>
-    <td>Hub Address</td>
-    <td>{{.Config.HubAddress}}</td>
-  </tr>
-  <tr>
-    <td>VPN Network</td>
-    <td>{{ipToString .Config.VPNNetwork}}</td>
+    <td>Network</td>
+    <td>{{ipToString .Network.Network}}/24</td>
  </tr>
 </table>

-<h2>Peers</h2>
+<h3>Peers</h3>

 <p>
-  <a href="/admin/peer/create/">Add Peer</a> /
-  <a href="/admin/peer/hosts/">Hosts</a>
+  <a href="/admin/peer/create/?NetworkID={{.Network.NetworkID}}">Create</a>
 </p>

 {{if .Peers -}}
@@ -30,7 +22,8 @@
    <tr>
      <th>PeerIP</th>
      <th>Name</th>
-      <th>Public IP</th>
+      <th>IPv4</th>
+      <th>IPv6</th>
      <th>Port</th>
      <th>Relay</th>
    </tr>
@@ -39,12 +32,13 @@
  {{range .Peers -}}
  <tr>
    <td>
-      <a href="/admin/peer/view/?PeerIP={{.PeerIP}}">
+      <a href="/admin/peer/view/?NetworkID={{$.Network.NetworkID}}&PeerIP={{.PeerIP}}">
        {{.PeerIP}}
      </a>
    </td>
    <td>{{.Name}}</td>
-    <td>{{ipToString .PublicIP}}</td>
+    <td>{{ipToString .Addr4}}</td>
+    <td>{{ipToString .Addr6}}</td>
    <td>{{.Port}}</td>
    <td>{{if .Relay}}T{{else}}F{{end}}</td>
  </tr>
--- a/hub/templates/network/peer-create.html
+++ b/hub/templates/network/peer-create.html
@@ -0,0 +1,38 @@
+{{define "body" -}}
+<h3>New Peer</h3>
+
+<form method="POST">
+  <input type="hidden" name="NetworkID" value="{{.Network.NetworkID}}">
+  <p>
+    <label>IP</label><br>
+    <input type="number" name="IP" min="1" max="255" value="0">
+  </p>
+  <p>
+    <label>Name</label><br>
+    <input type="text" name="Name">
+  </p>
+  <p>
+    <label>IPv4 Address (optional)</label><br>
+    <input type="text" name="Addr4">
+  </p>
+  <p>
+    <label>IPv6 Address (optional)</label><br>
+    <input type="text" name="Addr6">
+  </p>
+  <p>
+    <label>WireGuard Port</label><br>
+    <input type="number" name="Port" value="51820">
+  </p>
+  <p>
+    <label>
+      <input type="checkbox" name="Relay">
+      Relay
+    </label>
+  </p>
+  <p>
+    <button type="submit">Save</button>
+    <a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">Cancel</a>
+  </p>
+</form>
+
+{{- end}}
--- a/hub/templates/network/peer-delete.html
+++ b/hub/templates/network/peer-delete.html
@@ -0,0 +1,14 @@
+{{define "body" -}}
+<h3>Delete {{.Peer.Name}}</h3>
+
+{{with .Peer -}}
+<form method="POST">
+<input type="hidden" name="NetworkID" value="{{.NetworkID}}">
+  <input type="hidden" name="PeerIP" value="{{.PeerIP}}">
+  <p>
+    <button type="submit">Delete</button>
+    <a href="/admin/peer/view/?PeerIP={{.PeerIP}}&NetworkID={{.NetworkID}}">Cancel</a>
+  </p>
+</form>
+{{- end}}
+{{- end}}
--- a/hub/templates/network/peer-view.html
+++ b/hub/templates/network/peer-view.html
@@ -0,0 +1,24 @@
+{{define "body" -}}
+<h3>{{.Peer.Name}}</h3>
+<p>
+  <a href="/admin/peer/delete/?NetworkID={{.Network.NetworkID}}&PeerIP={{.Peer.PeerIP}}">Delete</a>
+</p>
+
+{{with .Peer -}}
+<table class="def-list">
+  <tr><td>Peer IP</td><td>{{.PeerIP}}</td></tr>
+  <tr><td>IPv4 Address</td><td>{{ipToString .Addr4}}</td></tr>
+  <tr><td>IPv6 Address</td><td>{{ipToString .Addr6}}</td></tr>
+  <tr><td>WireGuard Port</td><td>{{.Port}}</td></tr>
+  <tr><td>Relay</td><td>{{if .Relay}}T{{else}}F{{end}}</td></tr>
+  <tr><td>WG Public Key</td><td>{{wgKeyString .WGPubKey}}</td></tr>
+</table>
+
+<details>
+  <summary>API Key</summary>
+  <p>{{.APIKey}}</p>
+</details>
+
+{{- end}}
+
+{{- end}}
--- a/hub/templates/share/common.html
+++ b/hub/templates/share/common.html
--- a/hub/templates/sign-in.html
+++ b/hub/templates/sign-in.html
@@ -2,8 +2,7 @@
 <h2>Sign In</h2>

 <form method="POST">
-  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <p>
+<p>
    <label>Password</label><br>
    <input type="password" name="Password">
  </p>
--- a/hub/util.go
+++ b/hub/util.go
@@ -38,6 +38,19 @@ func (app *App) sendJSON(w http.ResponseWriter, data any) error {
 	return nil
 }

+// addrFromBytes parses raw IP bytes (4 or 16) into a netip.Addr, unmapping
+// IPv4-in-IPv6, returning the zero Addr for empty/invalid input.
+func addrFromBytes(b []byte) netip.Addr {
+	if len(b) == 0 {
+		return netip.Addr{}
+	}
+	addr, ok := netip.AddrFromSlice(b)
+	if !ok {
+		return netip.Addr{}
+	}
+	return addr.Unmap()
+}
+
 func stringToIP(in string) ([]byte, error) {
 	in = strings.TrimSpace(in)
 	if len(in) == 0 {
--- a/m/models.go
+++ b/m/models.go
@@ -1,30 +1,133 @@
 // The package `m` contains models shared between the hub and peer programs.
 package m

+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/netip"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
 type PeerInitArgs struct {
-	EncPubKey  []byte
-	PubSignKey []byte
+	WGPubKey   []byte
+	SignPubKey []byte
 }

-type PeerConfig struct {
-	PeerIP   byte
-	Network  []byte
-	PublicIP []byte
-	Port     uint16
-	Relay    bool
+type PeerInitResp struct {
+	PeerIP       byte
+	Network      []byte
+	LocalDomain  string
+	NetworkState NetworkState
 }

+// Peer is the network membership record for a single peer, exchanged between
+// the hub and peers. Addr4/Addr6 are the peer's public endpoint addresses (zero
+// if it has none); Port is its WireGuard listen port, meaningful even for a
+// non-public peer (it is the peer's own bind/beacon port).
 type Peer struct {
 	PeerIP     byte
-	Version    int64
 	Name       string
-	PublicIP   []byte
+	Addr4      netip.Addr // zero if none
+	Addr6      netip.Addr // zero if none
 	Port       uint16
 	Relay      bool
-	PubKey     []byte
-	PubSignKey []byte
+	WGPubKey   wgtypes.Key
+	SignPubKey [32]byte
+}
+
+// IsPublic reports whether the peer advertises at least one reachable endpoint.
+func (p Peer) IsPublic() bool {
+	return p.Addr4.IsValid() || p.Addr6.IsValid()
+}
+
+// Endpoint4 returns the IPv4 endpoint (addr+port), or the zero AddrPort if the
+// peer has no IPv4 address.
+func (p Peer) Endpoint4() netip.AddrPort {
+	if !p.Addr4.IsValid() {
+		return netip.AddrPort{}
+	}
+	return netip.AddrPortFrom(p.Addr4, p.Port)
+}
+
+// Endpoint6 returns the IPv6 endpoint (addr+port), or the zero AddrPort if the
+// peer has no IPv6 address.
+func (p Peer) Endpoint6() netip.AddrPort {
+	if !p.Addr6.IsValid() {
+		return netip.AddrPort{}
+	}
+	return netip.AddrPortFrom(p.Addr6, p.Port)
+}
+
+// PreferredEndpoint returns the IPv4 endpoint if present, else IPv6.
+func (p Peer) PreferredEndpoint() netip.AddrPort {
+	if ep := p.Endpoint4(); ep.IsValid() {
+		return ep
+	}
+	return p.Endpoint6()
+}
+
+// peerJSON is the wire representation. netip.Addr fields round-trip as text
+// strings automatically; only the fixed-size key arrays need base64 (otherwise
+// encoding/json would emit them as arrays of numbers).
+type peerJSON struct {
+	PeerIP     byte
+	Name       string
+	Addr4      netip.Addr
+	Addr6      netip.Addr
+	Port       uint16
+	Relay      bool
+	WGPubKey   string
+	SignPubKey string
+}
+
+func (p Peer) MarshalJSON() ([]byte, error) {
+	return json.Marshal(peerJSON{
+		PeerIP:     p.PeerIP,
+		Name:       p.Name,
+		Addr4:      p.Addr4,
+		Addr6:      p.Addr6,
+		Port:       p.Port,
+		Relay:      p.Relay,
+		WGPubKey:   base64.StdEncoding.EncodeToString(p.WGPubKey[:]),
+		SignPubKey: base64.StdEncoding.EncodeToString(p.SignPubKey[:]),
+	})
+}
+
+func (p *Peer) UnmarshalJSON(data []byte) error {
+	var j peerJSON
+	if err := json.Unmarshal(data, &j); err != nil {
+		return err
+	}
+	wg, err := base64.StdEncoding.DecodeString(j.WGPubKey)
+	if err != nil {
+		return fmt.Errorf("decode WGPubKey: %w", err)
+	}
+	key, err := wgtypes.NewKey(wg)
+	if err != nil {
+		return fmt.Errorf("invalid WGPubKey: %w", err)
+	}
+	sign, err := base64.StdEncoding.DecodeString(j.SignPubKey)
+	if err != nil {
+		return fmt.Errorf("decode SignPubKey: %w", err)
+	}
+	if len(sign) != 32 {
+		return fmt.Errorf("invalid SignPubKey length: %d", len(sign))
+	}
+	*p = Peer{
+		PeerIP:     j.PeerIP,
+		Name:       j.Name,
+		Addr4:      j.Addr4,
+		Addr6:      j.Addr6,
+		Port:       j.Port,
+		Relay:      j.Relay,
+		WGPubKey:   key,
+		SignPubKey: [32]byte(sign),
+	}
+	return nil
 }

 type NetworkState struct {
-	Peers [256]*Peer
+	Peers []Peer
 }
--- a/peer/app.go
+++ b/peer/app.go
@@ -0,0 +1,105 @@
+package peer
+
+import (
+	"net/netip"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"vppn/m"
+	"vppn/peer/control"
+	"vppn/peer/multicast"
+	"vppn/peer/wginterface"
+)
+
+var _ WGDevice = (*wginterface.Device)(nil) // compile-time check: Device satisfies WGDevice
+
+const (
+	ControlPort     = 4561
+	PingInterval    = 8 * time.Second
+	TimeoutInterval = 30 * time.Second
+)
+
+// scratchSize is large enough for the biggest buffer either the ping or the
+// multicast path serializes through the shared App scratch.
+const scratchSize = max(control.Size, multicast.SignedPacketSize)
+
+type PingEvent struct {
+	srcVPNIP netip.Addr
+	ping     control.Ping
+}
+
+// App is the peer application. All mutable state lives here and is
+// accessed only from the Run goroutine.
+type App struct {
+	// Identity
+	vpnIP       netip.Addr
+	vpnNet      netip.Prefix
+	privKey     wgtypes.Key
+	pubKey      wgtypes.Key
+	isRelay     bool
+	isPublic    bool
+	localDomain string
+
+	// Infrastructure
+	dev         WGDevice
+	controlConn ControlConn
+
+	// Peer state
+	relay      *Peer
+	peersByKey map[wgtypes.Key]*Peer
+	peersByIP  map[netip.Addr]*Peer
+
+	// Our own external endpoints, learned from Dst fields in incoming pings
+	selfV4 netip.AddrPort
+	selfV6 netip.AddrPort
+
+	// Reusable serialization scratch for outgoing pings and multicast signature
+	// verification. Only touched from the Run goroutine.
+	scratch []byte
+
+	// Event channels fed by background goroutines
+	hubAddCh    <-chan m.Peer
+	hubRemoveCh <-chan wgtypes.Key
+	pingCh      <-chan PingEvent
+	multicastCh <-chan multicast.Packet
+}
+
+// Run is the main event loop. It runs until SIGTERM/SIGINT.
+func (a *App) Run() error {
+	// Establish a clean hosts section before the first poll lands, clearing
+	// any stale entries left by a prior run (e.g. crash, or peers removed
+	// while we were down).
+	a.updateHosts()
+
+	ticker := time.NewTicker(PingInterval)
+	defer ticker.Stop()
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGTERM, syscall.SIGINT)
+	defer signal.Stop(sig)
+
+	for {
+		select {
+		case p := <-a.hubAddCh:
+			a.onAddPeer(p)
+		case key := <-a.hubRemoveCh:
+			a.onRemovePeer(key)
+		case e := <-a.pingCh:
+			a.onPing(e)
+		case e := <-a.multicastCh:
+			a.onMulticastDiscovery(e)
+		case <-ticker.C:
+			a.onTick()
+		case <-sig:
+			return a.onShutdown()
+		}
+	}
+}
+
+func (a *App) onShutdown() error {
+	return wginterface.Delete(a.dev.Name())
+}
--- a/peer/app_test.go
+++ b/peer/app_test.go
@@ -0,0 +1,62 @@
+package peer
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"vppn/m"
+	"vppn/peer/multicast"
+)
+
+// addRelayPeer adds a public relay peer and marks it Up so it satisfies
+// CanRelay. It does not set a.relay — callers do that explicitly.
+func addRelayPeer(t *testing.T, a *App, vpnIP string, ep netip.AddrPort) *Peer {
+	t.Helper()
+	key := mustKey(t)
+	ip := netip.MustParseAddr(vpnIP)
+	a.onAddPeer(m.Peer{
+		WGPubKey: key,
+		PeerIP:   ip.As4()[3],
+		Addr4:    ep.Addr(),
+		Port:     ep.Port(),
+		Relay:    true,
+	})
+	p := a.peersByKey[key]
+	p.wgPeer.LastHandshakeTime = time.Now()
+	return p
+}
+
+// newTestApp returns a minimal App wired to a fakeWGDevice and fakeControlConn.
+// vpnIP is the local VPN address (e.g. "10.0.0.1").
+// isPublic / isRelay describe the local node's role.
+func newTestApp(t *testing.T, vpnIP string, isPublic, isRelay bool) (*App, *fakeWGDevice, *fakeControlConn) {
+	t.Helper()
+	privKey, err := wgtypes.GeneratePrivateKey()
+	if err != nil {
+		t.Fatalf("generate key: %v", err)
+	}
+	ip := netip.MustParseAddr(vpnIP)
+	dev := &fakeWGDevice{}
+	cc := &fakeControlConn{}
+	a := &App{
+		vpnIP:       ip,
+		vpnNet:      netip.MustParsePrefix("10.0.0.0/24"),
+		privKey:     privKey,
+		pubKey:      privKey.PublicKey(),
+		isPublic:    isPublic,
+		isRelay:     isRelay,
+		dev:         dev,
+		controlConn: cc,
+		peersByKey:  make(map[wgtypes.Key]*Peer),
+		peersByIP:   make(map[netip.Addr]*Peer),
+		scratch:     make([]byte, scratchSize),
+		hubAddCh:    make(chan m.Peer),
+		hubRemoveCh: make(chan wgtypes.Key),
+		pingCh:      make(chan PingEvent),
+		multicastCh: make(chan multicast.Packet),
+	}
+	return a, dev, cc
+}
--- a/peer/bitset.go
+++ b/peer/bitset.go
@@ -1,21 +0,0 @@
-package peer
-
-const bitSetSize = 512 // Multiple of 64.
-
-type bitSet [bitSetSize / 64]uint64
-
-func (bs *bitSet) Set(i int) {
-	bs[i/64] |= 1 << (i % 64)
-}
-
-func (bs *bitSet) Clear(i int) {
-	bs[i/64] &= ^(1 << (i % 64))
-}
-
-func (bs *bitSet) ClearAll() {
-	clear(bs[:])
-}
-
-func (bs *bitSet) Get(i int) bool {
-	return bs[i/64]&(1<<(i%64)) != 0
-}
--- a/peer/bitset_test.go
+++ b/peer/bitset_test.go
@@ -1,48 +0,0 @@
-package peer
-
-import (
-	"math/rand"
-	"testing"
-)
-
-func TestBitSet(t *testing.T) {
-	state := make([]bool, bitSetSize)
-	for i := range state {
-		state[i] = rand.Float32() > 0.5
-	}
-
-	bs := bitSet{}
-
-	for i := range state {
-		if state[i] {
-			bs.Set(i)
-		}
-	}
-
-	for i := range state {
-		if bs.Get(i) != state[i] {
-			t.Fatal(i, state[i], bs.Get(i))
-		}
-	}
-
-	for i := range state {
-		if rand.Float32() > 0.5 {
-			state[i] = false
-			bs.Clear(i)
-		}
-	}
-
-	for i := range state {
-		if bs.Get(i) != state[i] {
-			t.Fatal(i, state[i], bs.Get(i))
-		}
-	}
-
-	bs.ClearAll()
-
-	for i := range state {
-		if bs.Get(i) {
-			t.Fatal(i, bs.Get(i))
-		}
-	}
-}
--- a/peer/cipher-control.go
+++ b/peer/cipher-control.go
@@ -1,26 +0,0 @@
-package peer
-
-import "golang.org/x/crypto/nacl/box"
-
-type controlCipher struct {
-	sharedKey [32]byte
-}
-
-func newControlCipher(privKey, pubKey []byte) *controlCipher {
-	shared := [32]byte{}
-	box.Precompute(&shared, (*[32]byte)(pubKey), (*[32]byte)(privKey))
-	return &controlCipher{shared}
-}
-
-func (cc *controlCipher) Encrypt(h header, data, out []byte) []byte {
-	const s = controlHeaderSize
-	out = out[:s+controlCipherOverhead+len(data)]
-	h.Marshal(out[:s])
-	box.SealAfterPrecomputation(out[s:s], data, (*[24]byte)(out[:s]), &cc.sharedKey)
-	return out
-}
-
-func (cc *controlCipher) Decrypt(encrypted, out []byte) (data []byte, ok bool) {
-	const s = controlHeaderSize
-	return box.OpenAfterPrecomputation(out[:0], encrypted[s:], (*[24]byte)(encrypted[:s]), &cc.sharedKey)
-}
--- a/peer/cipher-control_test.go
+++ b/peer/cipher-control_test.go
@@ -1,122 +0,0 @@
-package peer
-
-import (
-	"bytes"
-	"crypto/rand"
-	"reflect"
-	"testing"
-
-	"golang.org/x/crypto/nacl/box"
-)
-
-func newControlCipherForTesting() (c1, c2 *controlCipher) {
-	pubKey1, privKey1, err := box.GenerateKey(rand.Reader)
-	if err != nil {
-		panic(err)
-	}
-
-	pubKey2, privKey2, err := box.GenerateKey(rand.Reader)
-	if err != nil {
-		panic(err)
-	}
-
-	return newControlCipher(privKey1[:], pubKey2[:]),
-		newControlCipher(privKey2[:], pubKey1[:])
-}
-
-func TestControlCipher(t *testing.T) {
-	c1, c2 := newControlCipherForTesting()
-
-	maxSizePlaintext := make([]byte, bufferSize-controlHeaderSize-controlCipherOverhead)
-	rand.Read(maxSizePlaintext)
-
-	testCases := [][]byte{
-		make([]byte, 0),
-		{1},
-		{255},
-		{1, 2, 3, 4, 5},
-		[]byte("Hello world"),
-		maxSizePlaintext,
-	}
-
-	for _, plaintext := range testCases {
-		h1 := header{
-			StreamID: controlStreamID,
-			Counter:  235153,
-			SourceIP: 4,
-			DestIP:   88,
-		}
-
-		encrypted := make([]byte, bufferSize)
-
-		encrypted = c1.Encrypt(h1, plaintext, encrypted)
-
-		h2 := header{}
-		h2.Parse(encrypted)
-		if !reflect.DeepEqual(h1, h2) {
-			t.Fatal(h1, h2)
-		}
-
-		decrypted, ok := c2.Decrypt(encrypted, make([]byte, bufferSize))
-		if !ok {
-			t.Fatal(ok)
-		}
-
-		if !bytes.Equal(decrypted, plaintext) {
-			t.Fatal("not equal")
-		}
-	}
-}
-
-func TestControlCipher_ShortCiphertext(t *testing.T) {
-	c1, _ := newControlCipherForTesting()
-	shortText := make([]byte, controlHeaderSize+controlCipherOverhead-1)
-	rand.Read(shortText)
-	_, ok := c1.Decrypt(shortText, make([]byte, bufferSize))
-	if ok {
-		t.Fatal(ok)
-	}
-}
-
-func BenchmarkControlCipher_Encrypt(b *testing.B) {
-	c1, _ := newControlCipherForTesting()
-	h1 := header{
-		Counter:  235153,
-		SourceIP: 4,
-		DestIP:   88,
-	}
-
-	plaintext := make([]byte, bufferSize-controlHeaderSize-controlCipherOverhead)
-	rand.Read(plaintext)
-
-	encrypted := make([]byte, bufferSize)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		encrypted = c1.Encrypt(h1, plaintext, encrypted)
-	}
-}
-
-func BenchmarkControlCipher_Decrypt(b *testing.B) {
-	c1, c2 := newControlCipherForTesting()
-
-	h1 := header{
-		Counter:  235153,
-		SourceIP: 4,
-		DestIP:   88,
-	}
-
-	plaintext := make([]byte, bufferSize-controlHeaderSize-controlCipherOverhead)
-	rand.Read(plaintext)
-
-	encrypted := make([]byte, bufferSize)
-
-	encrypted = c1.Encrypt(h1, plaintext, encrypted)
-
-	decrypted := make([]byte, bufferSize)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		decrypted, _ = c2.Decrypt(encrypted, decrypted)
-	}
-}
--- a/peer/cipher-data.go
+++ b/peer/cipher-data.go
@@ -1,61 +0,0 @@
-package peer
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"log"
-)
-
-type dataCipher struct {
-	key  [32]byte
-	aead cipher.AEAD
-}
-
-func newDataCipher() *dataCipher {
-	key := [32]byte{}
-	if _, err := rand.Read(key[:]); err != nil {
-		log.Fatalf("Failed to read random data: %v", err)
-	}
-	return newDataCipherFromKey(key)
-}
-
-func newDataCipherFromKey(key [32]byte) *dataCipher {
-	block, err := aes.NewCipher(key[:])
-	if err != nil {
-		log.Fatalf("Failed to create new cipher: %v", err)
-	}
-
-	aead, err := cipher.NewGCM(block)
-	if err != nil {
-		log.Fatalf("Failed to create new GCM: %v", err)
-	}
-
-	return &dataCipher{key: key, aead: aead}
-}
-
-func (sc *dataCipher) Key() [32]byte {
-	return sc.key
-}
-
-func (sc *dataCipher) Encrypt(h header, data, out []byte) []byte {
-	const s = dataHeaderSize
-	out = out[:s+dataCipherOverhead+len(data)]
-	h.Marshal(out[:s])
-	sc.aead.Seal(out[s:s], out[:s], data, nil)
-	return out
-}
-
-func (sc *dataCipher) Decrypt(encrypted, out []byte) (data []byte, ok bool) {
-	const s = dataHeaderSize
-	if len(encrypted) < s+dataCipherOverhead {
-		ok = false
-		return
-	}
-
-	var err error
-
-	data, err = sc.aead.Open(out[:0], encrypted[:s], encrypted[s:], nil)
-	ok = err == nil
-	return
-}
--- a/peer/cipher-data_test.go
+++ b/peer/cipher-data_test.go
@@ -1,141 +0,0 @@
-package peer
-
-import (
-	"bytes"
-	"crypto/rand"
-	mrand "math/rand/v2"
-	"reflect"
-	"testing"
-)
-
-func TestDataCipher(t *testing.T) {
-	maxSizePlaintext := make([]byte, bufferSize-dataHeaderSize-dataCipherOverhead)
-	rand.Read(maxSizePlaintext)
-
-	testCases := [][]byte{
-		make([]byte, 0),
-		{1},
-		{255},
-		{1, 2, 3, 4, 5},
-		[]byte("Hello world"),
-		maxSizePlaintext,
-	}
-
-	for _, plaintext := range testCases {
-		h1 := header{
-			StreamID: dataStreamID,
-			Counter:  235153,
-			SourceIP: 4,
-			DestIP:   88,
-		}
-
-		encrypted := make([]byte, bufferSize)
-
-		dc1 := newDataCipher()
-		encrypted = dc1.Encrypt(h1, plaintext, encrypted)
-		h2 := header{}
-		h2.Parse(encrypted)
-
-		dc2 := newDataCipherFromKey(dc1.Key())
-
-		decrypted, ok := dc2.Decrypt(encrypted, make([]byte, bufferSize-dataHeaderSize))
-		if !ok {
-			t.Fatal(ok)
-		}
-
-		if !bytes.Equal(plaintext, decrypted) {
-			t.Fatal("not equal")
-		}
-
-		if !reflect.DeepEqual(h1, h2) {
-			t.Fatalf("%v != %v", h1, h2)
-		}
-	}
-}
-
-func TestDataCipher_ModifyCiphertext(t *testing.T) {
-	maxSizePlaintext := make([]byte, bufferSize-dataHeaderSize-dataCipherOverhead)
-	rand.Read(maxSizePlaintext)
-
-	testCases := [][]byte{
-		make([]byte, 0),
-		{1},
-		{255},
-		{1, 2, 3, 4, 5},
-		[]byte("Hello world"),
-		maxSizePlaintext,
-	}
-
-	for _, plaintext := range testCases {
-		h1 := header{
-			Counter:  235153,
-			SourceIP: 4,
-			DestIP:   88,
-		}
-
-		encrypted := make([]byte, bufferSize)
-
-		dc1 := newDataCipher()
-		encrypted = dc1.Encrypt(h1, plaintext, encrypted)
-		encrypted[mrand.IntN(len(encrypted))]++
-
-		dc2 := newDataCipherFromKey(dc1.Key())
-
-		_, ok := dc2.Decrypt(encrypted, make([]byte, bufferSize-dataHeaderSize))
-		if ok {
-			t.Fatal(ok)
-		}
-	}
-}
-
-func TestDataCipher_ShortCiphertext(t *testing.T) {
-	dc1 := newDataCipher()
-	shortText := make([]byte, dataHeaderSize+dataCipherOverhead-1)
-	rand.Read(shortText)
-	_, ok := dc1.Decrypt(shortText, make([]byte, bufferSize))
-	if ok {
-		t.Fatal(ok)
-	}
-}
-
-func BenchmarkDataCipher_Encrypt(b *testing.B) {
-	h1 := header{
-		Counter:  235153,
-		SourceIP: 4,
-		DestIP:   88,
-	}
-
-	plaintext := make([]byte, bufferSize-dataHeaderSize-dataCipherOverhead)
-	rand.Read(plaintext)
-
-	encrypted := make([]byte, bufferSize)
-
-	dc1 := newDataCipher()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		encrypted = dc1.Encrypt(h1, plaintext, encrypted)
-	}
-}
-
-func BenchmarkDataCipher_Decrypt(b *testing.B) {
-	h1 := header{
-		Counter:  235153,
-		SourceIP: 4,
-		DestIP:   88,
-	}
-
-	plaintext := make([]byte, bufferSize-dataHeaderSize-dataCipherOverhead)
-	rand.Read(plaintext)
-
-	encrypted := make([]byte, bufferSize)
-
-	dc1 := newDataCipher()
-	encrypted = dc1.Encrypt(h1, plaintext, encrypted)
-
-	decrypted := make([]byte, bufferSize)
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		decrypted, _ = dc1.Decrypt(encrypted, decrypted)
-	}
-}
--- a/peer/cipher-discovery.go
+++ b/peer/cipher-discovery.go
@@ -1,13 +0,0 @@
-package peer
-
-/*
-func signData(privKey *[64]byte, h header, data, out []byte) []byte {
-	out = out[:headerSize]
-	h.Marshal(out)
-	return sign.Sign(out, data, privKey)
-}
-
-func openData(pubKey *[32]byte, signed, out []byte) (data []byte, ok bool) {
-	return sign.Open(out[:0], signed[headerSize:], pubKey)
-}
-*/
--- a/peer/connreader.go
+++ b/peer/connreader.go
@@ -1,140 +0,0 @@
-package peer
-
-import (
-	"io"
-	"log"
-	"net/netip"
-	"sync/atomic"
-)
-
-type connReader struct {
-	// Input
-	readFromUDPAddrPort func([]byte) (int, netip.AddrPort, error)
-
-	// Output
-	writeToUDPAddrPort func([]byte, netip.AddrPort) (int, error)
-	iface              io.Writer
-	handleControlMsg   func(fromIP byte, pkt any)
-
-	localIP byte
-	rt      *atomic.Pointer[routingTable]
-
-	buf    []byte
-	decBuf []byte
-}
-
-func newConnReader(
-	readFromUDPAddrPort func([]byte) (int, netip.AddrPort, error),
-	writeToUDPAddrPort func([]byte, netip.AddrPort) (int, error),
-	iface io.Writer,
-	handleControlMsg func(fromIP byte, pkt any),
-	rt *atomic.Pointer[routingTable],
-) *connReader {
-	return &connReader{
-		readFromUDPAddrPort: readFromUDPAddrPort,
-		writeToUDPAddrPort:  writeToUDPAddrPort,
-		iface:               iface,
-		handleControlMsg:    handleControlMsg,
-		localIP:             rt.Load().LocalIP,
-		rt:                  rt,
-		buf:                 newBuf(),
-		decBuf:              newBuf(),
-	}
-}
-
-func (r *connReader) Run() {
-	for {
-		r.handleNextPacket()
-	}
-}
-
-func (r *connReader) handleNextPacket() {
-	buf := r.buf[:bufferSize]
-	n, remoteAddr, err := r.readFromUDPAddrPort(buf)
-	if err != nil {
-		log.Fatalf("Failed to read from UDP port: %v", err)
-	}
-
-	if n < headerSize {
-		return
-	}
-
-	remoteAddr = netip.AddrPortFrom(remoteAddr.Addr().Unmap(), remoteAddr.Port())
-
-	buf = buf[:n]
-	h := parseHeader(buf)
-
-	rt := r.rt.Load()
-	peer := rt.Peers[h.SourceIP]
-
-	switch h.StreamID {
-	case controlStreamID:
-		r.handleControlPacket(remoteAddr, peer, h, buf)
-	case dataStreamID:
-		r.handleDataPacket(rt, peer, h, buf)
-	default:
-		r.logf("Unknown stream ID: %d", h.StreamID)
-	}
-}
-
-func (r *connReader) handleControlPacket(
-	remoteAddr netip.AddrPort,
-	peer remotePeer,
-	h header,
-	enc []byte,
-) {
-	if peer.ControlCipher == nil {
-		r.logf("No control cipher for peer: %d", h.SourceIP)
-		return
-	}
-
-	if h.DestIP != r.localIP {
-		r.logf("Incorrect destination IP on control packet: %d", h.DestIP)
-		return
-	}
-
-	msg, err := peer.DecryptControlPacket(remoteAddr, h, enc, r.decBuf)
-	if err != nil {
-		r.logf("Failed to decrypt control packet: %v", err)
-		return
-	}
-
-	r.handleControlMsg(h.SourceIP, msg)
-}
-
-func (r *connReader) handleDataPacket(
-	rt *routingTable,
-	peer remotePeer,
-	h header,
-	enc []byte,
-) {
-	if !peer.Up {
-		r.logf("Not connected (recv).")
-		return
-	}
-
-	data, err := peer.DecryptDataPacket(h, enc, r.decBuf)
-	if err != nil {
-		r.logf("Failed to decrypt data packet: %v", err)
-		return
-	}
-
-	if h.DestIP == r.localIP {
-		if _, err := r.iface.Write(data); err != nil {
-			log.Fatalf("Failed to write to interface: %v", err)
-		}
-		return
-	}
-
-	remote := rt.Peers[h.DestIP]
-	if !remote.Direct {
-		r.logf("Unable to relay data to %d.", h.DestIP)
-		return
-	}
-
-	r.writeToUDPAddrPort(data, remote.DirectAddr)
-}
-
-func (r *connReader) logf(format string, args ...any) {
-	log.Printf("[ConnReader] "+format, args...)
-}
--- a/peer/control/ping.go
+++ b/peer/control/ping.go
@@ -0,0 +1,76 @@
+// Package control implements the VPN-internal peer control protocol.
+// Peers exchange Ping packets over UDP on the VPN control port to maintain
+// liveness and discover external endpoints for direct connection attempts.
+package control
+
+import (
+	"encoding/binary"
+	"fmt"
+	"net/netip"
+)
+
+const (
+	version = 1
+	Size    = 51 // 1 version + 8 PingTS + 6 SrcV4 + 18 SrcV6 + 18 Dst
+)
+
+// Ping is the single control packet type exchanged between VPN peers.
+//
+// In each peer pair, the peer with the lower VPN IP is the client: it sets
+// PingTS and sends pings on a timer. The server echoes PingTS back in its
+// response, allowing the client to compute RTT = now - PingTS.
+//
+// Both client and server populate SrcV4, SrcV6, and Dst on every packet so
+// endpoint information flows in both directions.
+//
+// Dst is the recipient's external endpoint as observed by the sender from the
+// WireGuard handshake source. Zero if the sender has not observed a handshake
+// from the recipient.
+type Ping struct {
+	PingTS int64          // Client ping send time in nanoseconds.
+	SrcV4  netip.AddrPort // Sender's discovered IPv4 address and port.
+	SrcV6  netip.AddrPort // Sender's discovered IPv6 address and port.
+	Dst    netip.AddrPort
+}
+
+// Marshal encodes p into buf (which must be at least Size bytes) and returns
+// buf[:Size]. Taking the buffer lets callers reuse one across sends; every
+// field is written unconditionally so a reused buffer needs no pre-zeroing.
+func (p Ping) Marshal(buf []byte) []byte {
+	buf[0] = version
+	binary.BigEndian.PutUint64(buf[1:9], uint64(p.PingTS))
+	if p.SrcV4.IsValid() {
+		a4 := p.SrcV4.Addr().As4()
+		copy(buf[9:13], a4[:])
+		binary.BigEndian.PutUint16(buf[13:15], p.SrcV4.Port())
+	} else {
+		clear(buf[9:15])
+	}
+	a16 := p.SrcV6.Addr().As16()
+	copy(buf[15:31], a16[:])
+	binary.BigEndian.PutUint16(buf[31:33], p.SrcV6.Port())
+	a16 = p.Dst.Addr().As16()
+	copy(buf[33:49], a16[:])
+	binary.BigEndian.PutUint16(buf[49:51], p.Dst.Port())
+	return buf[:Size]
+}
+
+// Unmarshal decodes a Ping from a fixed-size 51-byte array.
+func Unmarshal(buf [Size]byte) (Ping, error) {
+	if buf[0] != version {
+		return Ping{}, fmt.Errorf("unknown ping version %d", buf[0])
+	}
+	p := Ping{
+		PingTS: int64(binary.BigEndian.Uint64(buf[1:9])),
+	}
+	if addr := netip.AddrFrom4([4]byte(buf[9:13])); !addr.IsUnspecified() {
+		p.SrcV4 = netip.AddrPortFrom(addr, binary.BigEndian.Uint16(buf[13:15]))
+	}
+	if addr := netip.AddrFrom16([16]byte(buf[15:31])); !addr.IsUnspecified() {
+		p.SrcV6 = netip.AddrPortFrom(addr, binary.BigEndian.Uint16(buf[31:33]))
+	}
+	if addr := netip.AddrFrom16([16]byte(buf[33:49])).Unmap(); !addr.IsUnspecified() {
+		p.Dst = netip.AddrPortFrom(addr, binary.BigEndian.Uint16(buf[49:51]))
+	}
+	return p, nil
+}
--- a/peer/control/ping_test.go
+++ b/peer/control/ping_test.go
@@ -0,0 +1,106 @@
+package control_test
+
+import (
+	"net/netip"
+	"testing"
+
+	"vppn/peer/control"
+)
+
+func TestRoundTrip(t *testing.T) {
+	cases := []struct {
+		name string
+		ping control.Ping
+	}{
+		{
+			name: "zero",
+			ping: control.Ping{},
+		},
+		{
+			name: "client ping",
+			ping: control.Ping{
+				PingTS: 1234567890,
+				SrcV4:  netip.MustParseAddrPort("1.2.3.4:51820"),
+				Dst:    netip.MustParseAddrPort("5.6.7.8:51820"),
+			},
+		},
+		{
+			name: "server response",
+			ping: control.Ping{
+				PingTS: 1234567890,
+				SrcV4:  netip.MustParseAddrPort("5.6.7.8:51820"),
+				Dst:    netip.MustParseAddrPort("1.2.3.4:9999"),
+			},
+		},
+		{
+			name: "IPv6 only",
+			ping: control.Ping{
+				PingTS: 999,
+				SrcV6:  netip.MustParseAddrPort("[2001:db8::1]:51820"),
+				Dst:    netip.MustParseAddrPort("[2001:db8::2]:51820"),
+			},
+		},
+		{
+			name: "dual stack",
+			ping: control.Ping{
+				PingTS: 555,
+				SrcV4:  netip.MustParseAddrPort("1.2.3.4:51820"),
+				SrcV6:  netip.MustParseAddrPort("[2001:db8::1]:51820"),
+				Dst:    netip.MustParseAddrPort("5.6.7.8:9999"),
+			},
+		},
+		{
+			name: "no src known",
+			ping: control.Ping{
+				Dst: netip.MustParseAddrPort("5.6.7.8:51820"),
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf [control.Size]byte
+			tc.ping.Marshal(buf[:])
+			got, err := control.Unmarshal(buf)
+			if err != nil {
+				t.Fatalf("Unmarshal: %v", err)
+			}
+			if got != tc.ping {
+				t.Fatalf("round-trip mismatch:\n  got  %+v\n  want %+v", got, tc.ping)
+			}
+		})
+	}
+}
+
+func TestUnmarshalBadVersion(t *testing.T) {
+	var buf [control.Size]byte
+	buf[0] = 99
+	if _, err := control.Unmarshal(buf); err == nil {
+		t.Fatal("expected error for unknown version, got nil")
+	}
+}
+
+func TestZeroEncoding(t *testing.T) {
+	var buf [control.Size]byte
+	(control.Ping{}).Marshal(buf[:])
+	for i, b := range buf {
+		if i == 0 {
+			continue // version byte
+		}
+		if b != 0 {
+			t.Fatalf("expected zero encoding at byte %d, got %d", i, b)
+		}
+	}
+}
+
+func TestRoleFor(t *testing.T) {
+	lo := netip.MustParseAddr("10.0.0.1")
+	hi := netip.MustParseAddr("10.0.0.2")
+
+	if control.RoleFor(lo, hi) != control.Client {
+		t.Error("lower IP should be client")
+	}
+	if control.RoleFor(hi, lo) != control.Server {
+		t.Error("higher IP should be server")
+	}
+}
--- a/peer/control/role.go
+++ b/peer/control/role.go
@@ -0,0 +1,22 @@
+package control
+
+import "net/netip"
+
+// Role identifies a peer's role in a ping exchange with a specific remote peer.
+type Role string
+
+const (
+	// Client initiates pings and measures RTT.
+	Client Role = "CLIENT"
+	// Server responds to pings.
+	Server Role = "SERVER"
+)
+
+// RoleFor returns the Role of local relative to remote.
+// The peer with the lower VPN IP is the client.
+func RoleFor(local, remote netip.Addr) Role {
+	if local.Compare(remote) < 0 {
+		return Client
+	}
+	return Server
+}
--- a/peer/control_conn.go
+++ b/peer/control_conn.go
@@ -0,0 +1,64 @@
+package peer
+
+import (
+	"log"
+	"net"
+	"net/netip"
+
+	"vppn/peer/control"
+)
+
+var _ ControlConn = (*udpControlConn)(nil)
+
+type udpControlConn struct {
+	conn *net.UDPConn
+}
+
+// newUDPControlConn opens a UDP socket bound to localIP:port.
+func newUDPControlConn(localIP netip.Addr, port uint16) (*udpControlConn, error) {
+	addr := net.UDPAddrFromAddrPort(netip.AddrPortFrom(localIP, port))
+	conn, err := net.ListenUDP("udp4", addr)
+	if err != nil {
+		return nil, err
+	}
+	return &udpControlConn{conn: conn}, nil
+}
+
+func (c *udpControlConn) SendPing(dst netip.AddrPort, ping control.Ping, buf []byte) error {
+	_, err := c.conn.WriteToUDP(ping.Marshal(buf), net.UDPAddrFromAddrPort(dst))
+	return err
+}
+
+// run reads incoming ping packets and forwards them to ch until ctx is done.
+// Call this in a goroutine before starting the App event loop.
+func (c *udpControlConn) run(ch chan<- PingEvent) {
+	var buf [control.Size]byte
+	for {
+		n, src, err := c.conn.ReadFromUDP(buf[:])
+		if err != nil {
+			log.Printf("control read: %v", err)
+			continue
+		}
+
+		if n != control.Size {
+			continue
+		}
+
+		ping, err := control.Unmarshal(buf)
+		if err != nil {
+			log.Printf("control unmarshal: %v", err)
+			continue
+		}
+
+		srcIP, ok := netip.AddrFromSlice(src.IP)
+		if !ok {
+			continue
+		}
+
+		ch <- PingEvent{srcVPNIP: srcIP.Unmap(), ping: ping}
+	}
+}
+
+func (c *udpControlConn) Close() error {
+	return c.conn.Close()
+}
--- a/peer/controlmessage.go
+++ b/peer/controlmessage.go
@@ -1,64 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"vppn/m"
-)
-
-// ----------------------------------------------------------------------------
-
-type controlMsg[T any] struct {
-	SrcIP   byte
-	SrcAddr netip.AddrPort
-	Packet  T
-}
-
-func parseControlMsg(srcIP byte, srcAddr netip.AddrPort, buf []byte) (any, error) {
-	switch buf[0] {
-
-	case packetTypeInit:
-		packet, err := parsePacketInit(buf)
-		return controlMsg[packetInit]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	case packetTypeSyn:
-		packet, err := parsePacketSyn(buf)
-		return controlMsg[packetSyn]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	case packetTypeAck:
-		packet, err := parsePacketAck(buf)
-		return controlMsg[packetAck]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	case packetTypeProbe:
-		packet, err := parsePacketProbe(buf)
-		return controlMsg[packetProbe]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	default:
-		return nil, errUnknownPacketType
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-type peerUpdateMsg struct {
-	Peer *m.Peer
-}
-
-// ----------------------------------------------------------------------------
-
-type pingTimerMsg struct{}
--- a/peer/crypto.go
+++ b/peer/crypto.go
@@ -1,30 +0,0 @@
-package peer
-
-import (
-	"crypto/rand"
-	"log"
-
-	"golang.org/x/crypto/nacl/box"
-	"golang.org/x/crypto/nacl/sign"
-)
-
-type cryptoKeys struct {
-	PubKey      []byte
-	PrivKey     []byte
-	PubSignKey  []byte
-	PrivSignKey []byte
-}
-
-func generateKeys() cryptoKeys {
-	pubKey, privKey, err := box.GenerateKey(rand.Reader)
-	if err != nil {
-		log.Fatalf("Failed to generate encryption keys: %v", err)
-	}
-
-	pubSignKey, privSignKey, err := sign.GenerateKey(rand.Reader)
-	if err != nil {
-		log.Fatalf("Failed to generate signing keys: %v", err)
-	}
-
-	return cryptoKeys{pubKey[:], privKey[:], pubSignKey[:], privSignKey[:]}
-}
--- a/peer/crypto_test.go
+++ b/peer/crypto_test.go
@@ -1,191 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"reflect"
-	"testing"
-)
-
-func newRoutePairForTesting() (*remotePeer, *remotePeer) {
-	keys1 := generateKeys()
-	keys2 := generateKeys()
-
-	r1 := newRemotePeer(1)
-	r1.PubSignKey = keys1.PubSignKey
-	r1.ControlCipher = newControlCipher(keys1.PrivKey, keys2.PubKey)
-	r1.DataCipher = newDataCipher()
-
-	r2 := newRemotePeer(2)
-	r2.PubSignKey = keys2.PubSignKey
-	r2.ControlCipher = newControlCipher(keys2.PrivKey, keys1.PubKey)
-	r2.DataCipher = r1.DataCipher
-
-	return r1, r2
-}
-
-func TestDecryptControlPacket(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		tmp    = make([]byte, bufferSize)
-		out    = make([]byte, bufferSize)
-	)
-
-	in := packetSyn{
-		TraceID:   newTraceID(),
-		SharedKey: r1.DataCipher.Key(),
-		Direct:    true,
-	}
-
-	enc := r1.EncryptControlPacket(in, tmp, out)
-	h := parseHeader(enc)
-
-	iMsg, err := r2.DecryptControlPacket(netip.AddrPort{}, h, enc, tmp)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	msg, ok := iMsg.(controlMsg[packetSyn])
-	if !ok {
-		t.Fatal(ok)
-	}
-
-	if !reflect.DeepEqual(msg.Packet, in) {
-		t.Fatal(msg)
-	}
-}
-
-/*
-	func TestDecryptControlPacket_decryptionFailed(t *testing.T) {
-		var (
-			r1, r2 = newRoutePairForTesting()
-			tmp    = make([]byte, bufferSize)
-			out    = make([]byte, bufferSize)
-		)
-
-		in := packetSyn{
-			TraceID:   newTraceID(),
-			SharedKey: r1.DataCipher.Key(),
-			Direct:    true,
-		}
-
-		enc := encryptControlPacket(r1.IP, r2, in, tmp, out)
-		h := parseHeader(enc)
-
-		for i := range enc {
-			x := bytes.Clone(enc)
-			x[i]++
-			_, err := decryptControlPacket(r2, netip.AddrPort{}, h, x, tmp)
-			if !errors.Is(err, errDecryptionFailed) {
-				t.Fatal(i, err)
-			}
-		}
-	}
-
-	func TestDecryptControlPacket_duplicate(t *testing.T) {
-		var (
-			r1, r2 = newRoutePairForTesting()
-			tmp    = make([]byte, bufferSize)
-			out    = make([]byte, bufferSize)
-		)
-
-		in := packetSyn{
-			TraceID:   newTraceID(),
-			SharedKey: r1.DataCipher.Key(),
-			Direct:    true,
-		}
-
-		enc := encryptControlPacket(r1.IP, r2, in, tmp, out)
-		h := parseHeader(enc)
-
-		if _, err := decryptControlPacket(r2, netip.AddrPort{}, h, enc, tmp); err != nil {
-			t.Fatal(err)
-		}
-
-		_, err := decryptControlPacket(r2, netip.AddrPort{}, h, enc, tmp)
-		if !errors.Is(err, errDuplicateSeqNum) {
-			t.Fatal(err)
-		}
-	}
-
-	func TestDecryptControlPacket_invalidPacket(t *testing.T) {
-		var (
-			r1, r2 = newRoutePairForTesting()
-			tmp    = make([]byte, bufferSize)
-			out    = make([]byte, bufferSize)
-		)
-
-		in := testPacket("hello!")
-
-		enc := encryptControlPacket(r1.IP, r2, in, tmp, out)
-		h := parseHeader(enc)
-
-		_, err := decryptControlPacket(r2, netip.AddrPort{}, h, enc, tmp)
-		if !errors.Is(err, errUnknownPacketType) {
-			t.Fatal(err)
-		}
-	}
-
-func TestDecryptDataPacket(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		out    = make([]byte, bufferSize)
-		data   = make([]byte, 1024)
-	)
-
-	rand.Read(data)
-
-	enc := encryptDataPacket(r1.IP, r2.IP, r2, data, out)
-	h := parseHeader(enc)
-
-	out, err := decryptDataPacket(r1, h, bytes.Clone(enc), out)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !bytes.Equal(data, out) {
-		t.Fatal(data, out)
-	}
-}
-
-func TestDecryptDataPacket_incorrectCipher(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		out    = make([]byte, bufferSize)
-		data   = make([]byte, 1024)
-	)
-
-	rand.Read(data)
-
-	enc := encryptDataPacket(r1.IP, r2.IP, r2, data, bytes.Clone(out))
-	h := parseHeader(enc)
-
-	r1.DataCipher = newDataCipher()
-	_, err := decryptDataPacket(r1, h, enc, bytes.Clone(out))
-	if !errors.Is(err, errDecryptionFailed) {
-		t.Fatal(err)
-	}
-}
-
-func TestDecryptDataPacket_duplicate(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		out    = make([]byte, bufferSize)
-		data   = make([]byte, 1024)
-	)
-
-	rand.Read(data)
-
-	enc := encryptDataPacket(r1.IP, r2.IP, r2, data, bytes.Clone(out))
-	h := parseHeader(enc)
-
-	_, err := decryptDataPacket(r1, h, enc, bytes.Clone(out))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = decryptDataPacket(r1, h, enc, bytes.Clone(out))
-	if !errors.Is(err, errDuplicateSeqNum) {
-		t.Fatal(err)
-	}
-}
-*/
--- a/peer/data-flow.dot
+++ b/peer/data-flow.dot
@@ -1,12 +1,11 @@
 digraph d {
-    ifReader   -> connWriter;
-    connReader -> ifWriter;
-    connReader -> connWriter;
-    connReader -> supervisor;
-    mcReader   -> supervisor;
-    supervisor -> connWriter;
-    supervisor -> mcWriter;
-    hubPoller  -> supervisor;
+    ifReader   -> remote;
+
+    connReader -> remote;
+    mcReader   -> remote;
+    remote -> connWriter;
+    remote -> ifWriter;
+    hubPoller  -> remote;

    connWriter [shape="box"];
    mcWriter [shape="box"];
--- a/peer/device.go
+++ b/peer/device.go
@@ -0,0 +1,79 @@
+package peer
+
+import (
+	"errors"
+	"log"
+	"net/netip"
+	"syscall"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// devRetry calls fn up to 6 times with exponential backoff, retrying on EBUSY
+// (transient netlink contention during WireGuard handshake/rekey). Fatal on
+// any other error.
+func devRetry(vpnIP netip.Addr, op string, fn func() error) {
+	const attempts = 6
+	timeout := 10 * time.Millisecond
+	for i := range attempts {
+		err := fn()
+		if err == nil {
+			return
+		}
+		if errors.Is(err, syscall.EBUSY) && i < attempts-1 {
+			time.Sleep(timeout)
+			timeout *= 2
+			continue
+		}
+		log.Fatalf("%s %v: %v", op, vpnIP, err)
+	}
+}
+
+func (a *App) devPeers() []wgtypes.Peer {
+	peers, err := a.dev.Peers()
+	if err != nil {
+		log.Fatalf("Failed to get peers %v: %v", a.vpnIP, err)
+	}
+	return peers
+}
+
+func (a *App) devAddPeer(p *Peer) {
+	log.Printf("RELAYED: %s - %s ", p.Name, p.VPNIP.String())
+	devRetry(p.VPNIP, "AddPeer", func() error { return a.dev.AddPeer(p.PubKey()) })
+	p.State = StateRelayed
+}
+
+func (a *App) devAddDirect(p *Peer, endpoint netip.AddrPort) {
+	log.Printf("DIRECT: %s - %s @ %s", p.Name, p.VPNIP.String(), endpoint.String())
+	devRetry(p.VPNIP, "AddDirect", func() error { return a.dev.AddDirect(p.PubKey(), endpoint, p.VPNIP) })
+	p.State = StateDirect
+}
+
+func (a *App) devSetRelay(p *Peer, endpoint netip.AddrPort) {
+	log.Printf("RELAY: %s - %s @ %s", p.Name, p.VPNIP.String(), endpoint.String())
+	devRetry(p.VPNIP, "SetRelay", func() error { return a.dev.SetRelay(p.PubKey(), endpoint, a.vpnNet) })
+	p.State = StateDirect // Dirrect connection. The app marks peer as relay.
+}
+
+func (a *App) devPromote(p *Peer) {
+	ep := p.WGEndpoint()
+	if ep.IsValid() {
+		log.Printf("PROMOTED: %s - %s @ %s", p.Name, p.VPNIP.String(), p.WGEndpoint().String())
+	} else {
+		log.Printf("PROMOTED: %s - %s (no IP)", p.Name, p.VPNIP.String())
+	}
+	devRetry(p.VPNIP, "Promote", func() error { return a.dev.Promote(p.PubKey(), p.VPNIP) })
+	p.State = StateDirect
+}
+
+func (a *App) devAddProbe(p *Peer, endpoint netip.AddrPort) {
+	log.Printf("PROBE: %s - %s @ %s", p.Name, p.VPNIP.String(), endpoint.String())
+	devRetry(p.VPNIP, "AddProbe", func() error { return a.dev.AddProbe(p.PubKey(), endpoint) })
+	p.State = StateProbing
+}
+
+func (a *App) devRemove(p *Peer) {
+	log.Printf("REMOVED: %s - %s", p.Name, p.VPNIP.String())
+	devRetry(p.VPNIP, "RemovePeer", func() error { return a.dev.RemovePeer(p.PubKey()) })
+}
--- a/peer/dupcheck.go
+++ b/peer/dupcheck.go
@@ -1,76 +0,0 @@
-package peer
-
-type dupCheck struct {
-	bitSet
-	head        int
-	tail        int
-	headCounter uint64
-	tailCounter uint64 // Also next expected counter value.
-}
-
-func newDupCheck(headCounter uint64) *dupCheck {
-	return &dupCheck{
-		headCounter: headCounter,
-		tailCounter: headCounter + 1,
-		tail:        1,
-	}
-}
-
-func (dc *dupCheck) IsDup(counter uint64) bool {
-
-	// Before head => it's late, say it's a dup.
-	if counter < dc.headCounter {
-		return true
-	}
-
-	// It's within the counter bounds.
-	if counter < dc.tailCounter {
-		index := (int(counter-dc.headCounter) + dc.head) % bitSetSize
-		if dc.Get(index) {
-			return true
-		}
-
-		dc.Set(index)
-		return false
-	}
-
-	// It's more than 1 beyond the tail.
-	delta := counter - dc.tailCounter
-
-	// Full clear.
-	if delta >= bitSetSize-1 {
-		dc.ClearAll()
-		dc.Set(0)
-
-		dc.tail = 1
-		dc.head = 2
-		dc.tailCounter = counter + 1
-		dc.headCounter = dc.tailCounter - bitSetSize + 1
-
-		return false
-	}
-
-	// Clear if necessary.
-	for i := 0; i < int(delta); i++ {
-		dc.put(false)
-	}
-
-	dc.put(true)
-	return false
-}
-
-func (dc *dupCheck) put(set bool) {
-	if set {
-		dc.Set(dc.tail)
-	} else {
-		dc.Clear(dc.tail)
-	}
-
-	dc.tail = (dc.tail + 1) % bitSetSize
-	dc.tailCounter++
-
-	if dc.head == dc.tail {
-		dc.head = (dc.head + 1) % bitSetSize
-		dc.headCounter++
-	}
-}
--- a/peer/dupcheck_test.go
+++ b/peer/dupcheck_test.go
@@ -1,57 +0,0 @@
-package peer
-
-import (
-	"testing"
-)
-
-func TestDupCheck(t *testing.T) {
-	dc := newDupCheck(0)
-
-	for i := range bitSetSize {
-		if dc.IsDup(uint64(i)) {
-			t.Fatal("!")
-		}
-	}
-
-	type TestCase struct {
-		Counter uint64
-		Dup     bool
-	}
-
-	testCases := []TestCase{
-		{511, true},
-		{0, true},
-		{1, true},
-		{2, true},
-		{3, true},
-		{63, true},
-		{256, true},
-		{510, true},
-		{511, true},
-		{512, false},
-		{0, true},
-		{512, true},
-		{513, false},
-		{517, false},
-		{512, true},
-		{513, true},
-		{514, false},
-		{515, false},
-		{516, false},
-		{517, true},
-		{2512, false},
-		{2512, true},
-		{2001, true},
-		{2002, false},
-		{2002, true},
-		{4000, false},
-		{4000 - 511, true},  // Too old.
-		{4000 - 510, false}, // Just in the window.
-	}
-
-	for i, tc := range testCases {
-		if ok := dc.IsDup(tc.Counter); ok != tc.Dup {
-			t.Fatal(i, ok, tc)
-		}
-	}
-}
--- a/peer/errors.go
+++ b/peer/errors.go
@@ -1,10 +0,0 @@
-package peer
-
-import "errors"
-
-var (
-	errDecryptionFailed  = errors.New("decryption failed")
-	errDuplicateSeqNum   = errors.New("duplicate sequence number")
-	errMalformedPacket   = errors.New("malformed packet")
-	errUnknownPacketType = errors.New("unknown packet type")
-)
--- a/peer/fake_control_conn_test.go
+++ b/peer/fake_control_conn_test.go
@@ -0,0 +1,43 @@
+package peer
+
+import (
+	"net/netip"
+	"testing"
+
+	"vppn/peer/control"
+)
+
+type sentPing struct {
+	Dst  netip.AddrPort
+	Ping control.Ping
+}
+
+type fakeControlConn struct {
+	Sent []sentPing
+}
+
+func (f *fakeControlConn) SendPing(dst netip.AddrPort, ping control.Ping, _ []byte) error {
+	f.Sent = append(f.Sent, sentPing{Dst: dst, Ping: ping})
+	return nil
+}
+
+func (f *fakeControlConn) AssertNone(t *testing.T) {
+	t.Helper()
+	if len(f.Sent) != 0 {
+		t.Fatalf("expected no pings sent, got %d: %v", len(f.Sent), f.Sent)
+	}
+}
+
+func (f *fakeControlConn) AssertSent(t *testing.T, i int, dst netip.AddrPort, ping control.Ping) {
+	t.Helper()
+	if i >= len(f.Sent) {
+		t.Fatalf("no ping at index %d (have %d)", i, len(f.Sent))
+	}
+	got := f.Sent[i]
+	if got.Dst != dst {
+		t.Errorf("ping[%d].Dst = %v, want %v", i, got.Dst, dst)
+	}
+	if got.Ping != ping {
+		t.Errorf("ping[%d].Ping = %+v, want %+v", i, got.Ping, ping)
+	}
+}
--- a/peer/fake_wgdevice_test.go
+++ b/peer/fake_wgdevice_test.go
@@ -0,0 +1,123 @@
+package peer
+
+import (
+	"net/netip"
+	"sync"
+	"testing"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// fakeWGDevice records every call made to it. It is safe to read Calls after
+// the event loop has processed the event under test (single-threaded loop
+// means no extra synchronisation needed, but the mutex guards concurrent test
+// helpers if needed).
+type fakeWGDevice struct {
+	mu    sync.Mutex
+	Calls []fakeCall
+	peers []wgtypes.Peer
+}
+
+type fakeCall struct {
+	Method   string
+	PubKey   wgtypes.Key
+	Endpoint netip.AddrPort
+	VPNiP    netip.Addr
+	Network  netip.Prefix
+}
+
+func (f *fakeWGDevice) record(c fakeCall) {
+	f.mu.Lock()
+	f.Calls = append(f.Calls, c)
+	f.mu.Unlock()
+}
+
+func (f *fakeWGDevice) Name() string { return "wg-test" }
+
+func (f *fakeWGDevice) Peers() ([]wgtypes.Peer, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]wgtypes.Peer, len(f.peers))
+	copy(out, f.peers)
+	return out, nil
+}
+
+func (f *fakeWGDevice) AddPeer(pubKey wgtypes.Key) error {
+	f.record(fakeCall{Method: "AddPeer", PubKey: pubKey})
+	return nil
+}
+
+func (f *fakeWGDevice) AddDirect(pubKey wgtypes.Key, endpoint netip.AddrPort, vpnIP netip.Addr) error {
+	f.record(fakeCall{Method: "AddDirect", PubKey: pubKey, Endpoint: endpoint, VPNiP: vpnIP})
+	return nil
+}
+
+func (f *fakeWGDevice) SetRelay(pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) error {
+	f.record(fakeCall{Method: "SetRelay", PubKey: pubKey, Endpoint: endpoint, Network: network})
+	return nil
+}
+
+func (f *fakeWGDevice) AddProbe(pubKey wgtypes.Key, endpoint netip.AddrPort) error {
+	f.record(fakeCall{Method: "AddProbe", PubKey: pubKey, Endpoint: endpoint})
+	return nil
+}
+
+func (f *fakeWGDevice) Promote(pubKey wgtypes.Key, vpnIP netip.Addr) error {
+	f.record(fakeCall{Method: "Promote", PubKey: pubKey, VPNiP: vpnIP})
+	return nil
+}
+
+func (f *fakeWGDevice) RemovePeer(pubKey wgtypes.Key) error {
+	f.record(fakeCall{Method: "RemovePeer", PubKey: pubKey})
+	return nil
+}
+
+// AssertNoCalls fails the test if any dev calls were recorded.
+func (f *fakeWGDevice) AssertNoCalls(t *testing.T) {
+	t.Helper()
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.Calls) != 0 {
+		t.Fatalf("unexpected dev calls: %v", f.Calls)
+	}
+}
+
+func (f *fakeWGDevice) AssertAddPeer(t *testing.T, i int, pubKey wgtypes.Key) {
+	t.Helper()
+	f.assertCall(t, i, fakeCall{Method: "AddPeer", PubKey: pubKey})
+}
+
+func (f *fakeWGDevice) AssertAddDirect(t *testing.T, i int, pubKey wgtypes.Key, endpoint netip.AddrPort, vpnIP netip.Addr) {
+	t.Helper()
+	f.assertCall(t, i, fakeCall{Method: "AddDirect", PubKey: pubKey, Endpoint: endpoint, VPNiP: vpnIP})
+}
+
+func (f *fakeWGDevice) AssertSetRelay(t *testing.T, i int, pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) {
+	t.Helper()
+	f.assertCall(t, i, fakeCall{Method: "SetRelay", PubKey: pubKey, Endpoint: endpoint, Network: network})
+}
+
+func (f *fakeWGDevice) AssertAddProbe(t *testing.T, i int, pubKey wgtypes.Key, endpoint netip.AddrPort) {
+	t.Helper()
+	f.assertCall(t, i, fakeCall{Method: "AddProbe", PubKey: pubKey, Endpoint: endpoint})
+}
+
+func (f *fakeWGDevice) AssertPromote(t *testing.T, i int, pubKey wgtypes.Key, vpnIP netip.Addr) {
+	t.Helper()
+	f.assertCall(t, i, fakeCall{Method: "Promote", PubKey: pubKey, VPNiP: vpnIP})
+}
+
+func (f *fakeWGDevice) AssertRemovePeer(t *testing.T, i int, pubKey wgtypes.Key) {
+	t.Helper()
+	f.assertCall(t, i, fakeCall{Method: "RemovePeer", PubKey: pubKey})
+}
+
+func (f *fakeWGDevice) assertCall(t *testing.T, i int, c fakeCall) {
+	t.Helper()
+	if len(f.Calls) <= i {
+		t.Fatalf("no call at index %d: %v", i, c)
+	}
+	if c != f.Calls[i] {
+		t.Fatalf("call[%d]: got %v, want %v", i, f.Calls[i], c)
+	}
+}
--- a/peer/files.go
+++ b/peer/files.go
@@ -1,90 +0,0 @@
-package peer
-
-import (
-	"encoding/json"
-	"log"
-	"os"
-	"path/filepath"
-	"vppn/m"
-)
-
-type localConfig struct {
-	m.PeerConfig
-	PubKey      []byte
-	PrivKey     []byte
-	PubSignKey  []byte
-	PrivSignKey []byte
-}
-
-func configDir(netName string) string {
-	d, err := os.UserHomeDir()
-	if err != nil {
-		log.Fatalf("Failed to get user home directory: %v", err)
-	}
-	return filepath.Join(d, ".vppn", netName)
-}
-
-func peerConfigPath(netName string) string {
-	return filepath.Join(configDir(netName), "peer-config.json")
-}
-
-func peerStatePath(netName string) string {
-	return filepath.Join(configDir(netName), "peer-state.json")
-}
-
-func storeJson(x any, outPath string) error {
-	outDir := filepath.Dir(outPath)
-	_ = os.MkdirAll(outDir, 0700)
-
-	tmpPath := outPath + ".tmp"
-	buf, err := json.Marshal(x)
-	if err != nil {
-		return err
-	}
-
-	f, err := os.Create(tmpPath)
-	if err != nil {
-		return err
-	}
-
-	if _, err := f.Write(buf); err != nil {
-		f.Close()
-		return err
-	}
-
-	if err := f.Sync(); err != nil {
-		f.Close()
-		return err
-	}
-
-	if err := f.Close(); err != nil {
-		return err
-	}
-
-	return os.Rename(tmpPath, outPath)
-}
-
-func storePeerConfig(netName string, pc localConfig) error {
-	return storeJson(pc, peerConfigPath(netName))
-}
-
-func storeNetworkState(netName string, ps m.NetworkState) error {
-	return storeJson(ps, peerStatePath(netName))
-}
-
-func loadJson(dataPath string, ptr any) error {
-	data, err := os.ReadFile(dataPath)
-	if err != nil {
-		return err
-	}
-
-	return json.Unmarshal(data, ptr)
-}
-
-func loadPeerConfig(netName string) (pc localConfig, err error) {
-	return pc, loadJson(peerConfigPath(netName), &pc)
-}
-
-func loadNetworkState(netName string) (ps m.NetworkState, err error) {
-	return ps, loadJson(peerStatePath(netName), &ps)
-}
--- a/peer/files_test.go
+++ b/peer/files_test.go
@@ -1,57 +0,0 @@
-package peer
-
-import (
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-func TestFilePaths(t *testing.T) {
-	confDir := configDir("netName")
-	if filepath.Base(confDir) != "netName" {
-		t.Fatal(confDir)
-	}
-	if filepath.Base(filepath.Dir(confDir)) != ".vppn" {
-		t.Fatal(confDir)
-	}
-
-	path := peerConfigPath("netName")
-	if path != filepath.Join(confDir, "peer-config.json") {
-		t.Fatal(path)
-	}
-
-	path = peerStatePath("netName")
-	if path != filepath.Join(confDir, "peer-state.json") {
-		t.Fatal(path)
-	}
-}
-
-func TestStoreLoadJson(t *testing.T) {
-	type Object struct {
-		Name  string
-		Age   int
-		Price float64
-	}
-
-	tmpDir := t.TempDir()
-	outPath := filepath.Join(tmpDir, "object.json")
-
-	obj := Object{
-		Name:  "Jason",
-		Age:   22,
-		Price: 123.534,
-	}
-
-	if err := storeJson(obj, outPath); err != nil {
-		t.Fatal(err)
-	}
-
-	obj2 := Object{}
-	if err := loadJson(outPath, &obj2); err != nil {
-		t.Fatal(err)
-	}
-
-	if !reflect.DeepEqual(obj, obj2) {
-		t.Fatal(obj, obj2)
-	}
-}
--- a/peer/globals.go
+++ b/peer/globals.go
@@ -1,37 +0,0 @@
-package peer
-
-import (
-	"net"
-	"net/netip"
-	"time"
-)
-
-const (
-	version = 1
-
-	bufferSize = 1536
-
-	if_mtu       = 1200
-	if_queue_len = 2048
-
-	controlCipherOverhead = 16
-	dataCipherOverhead    = 16
-	signOverhead          = 64
-
-	pingInterval                  = 8 * time.Second
-	timeoutInterval               = 30 * time.Second
-	broadcastInterval             = 16 * time.Second
-	broadcastErrorTimeoutInterval = 8 * time.Second
-)
-
-var multicastAddr = net.UDPAddrFromAddrPort(netip.AddrPortFrom(
-	netip.AddrFrom4([4]byte{224, 0, 0, 157}),
-	4560))
-
-func newBuf() []byte {
-	return make([]byte, bufferSize)
-}
-
-type marshaller interface {
-	Marshal([]byte) []byte
-}
--- a/peer/header.go
+++ b/peer/header.go
@@ -1,46 +0,0 @@
-package peer
-
-import "unsafe"
-
-// ----------------------------------------------------------------------------
-
-const (
-	headerSize        = 12
-	controlStreamID   = 2
-	controlHeaderSize = 24
-	dataStreamID      = 1
-	dataHeaderSize    = 12
-)
-
-type header struct {
-	Version  byte
-	StreamID byte
-	SourceIP byte
-	DestIP   byte
-	Counter  uint64 // Init with time.Now().Unix << 30 to ensure monotonic.
-}
-
-func parseHeader(b []byte) (h header) {
-	h.Version = b[0]
-	h.StreamID = b[1]
-	h.SourceIP = b[2]
-	h.DestIP = b[3]
-	h.Counter = *(*uint64)(unsafe.Pointer(&b[4]))
-	return h
-}
-
-func (h *header) Parse(b []byte) {
-	h.Version = b[0]
-	h.StreamID = b[1]
-	h.SourceIP = b[2]
-	h.DestIP = b[3]
-	h.Counter = *(*uint64)(unsafe.Pointer(&b[4]))
-}
-
-func (h *header) Marshal(buf []byte) {
-	buf[0] = h.Version
-	buf[1] = h.StreamID
-	buf[2] = h.SourceIP
-	buf[3] = h.DestIP
-	*(*uint64)(unsafe.Pointer(&buf[4])) = h.Counter
-}
--- a/peer/header_test.go
+++ b/peer/header_test.go
@@ -1,21 +0,0 @@
-package peer
-
-import "testing"
-
-func TestHeaderMarshalParse(t *testing.T) {
-	nIn := header{
-		StreamID: 23,
-		Counter:  3212,
-		SourceIP: 34,
-		DestIP:   200,
-	}
-
-	buf := make([]byte, headerSize)
-	nIn.Marshal(buf)
-
-	nOut := header{}
-	nOut.Parse(buf)
-	if nIn != nOut {
-		t.Fatal(nIn, nOut)
-	}
-}
--- a/peer/hosts.go
+++ b/peer/hosts.go
@@ -0,0 +1,128 @@
+package peer
+
+import (
+	"fmt"
+	"log"
+	"net/netip"
+	"os"
+	"sort"
+	"strings"
+	"syscall"
+
+	"git.crumpington.com/lib/go/flock"
+)
+
+const (
+	hostsFile  = "/etc/hosts"
+	hostsBegin = "# BEGIN vppn"
+	hostsEnd   = "# END vppn"
+)
+
+// hostMarkers returns the begin/end marker lines that delimit the managed
+// section for localDomain. The domain is wrapped in parentheses so one domain's
+// marker can never be a prefix of another's (e.g. "net" vs "net2") when
+// multiple vppn instances share /etc/hosts.
+func hostMarkers(localDomain string) (begin, end string) {
+	return hostsBegin + "(" + localDomain + ")", hostsEnd + "(" + localDomain + ")"
+}
+
+// updateHosts rewrites the managed vppn section in /etc/hosts using the
+// current peersByIP map. Peers without a Name are skipped.
+func (a *App) updateHosts() {
+	if a.localDomain == "" {
+		return
+	}
+	if err := updateHosts(hostsFile, a.localDomain, a.peersByIP); err != nil {
+		log.Printf("Failed to update hosts file: %v", err)
+	}
+}
+
+func updateHosts(hostsPath, localDomain string, peers map[netip.Addr]*Peer) error {
+	lockFile, err := flock.Lock(hostsPath + ".vppn.lock")
+	if err != nil {
+		return err
+	}
+	defer lockFile.Close()
+
+	begin, end := hostMarkers(localDomain)
+
+	info, err := os.Stat(hostsPath)
+	if err != nil {
+		return err
+	}
+
+	raw, err := os.ReadFile(hostsPath)
+	if err != nil {
+		return err
+	}
+
+	data := string(raw)
+
+	before := strings.TrimSpace(data)
+	after := ""
+
+	if idxBegin := strings.Index(data, begin); idxBegin != -1 {
+		idxEnd := strings.Index(data[idxBegin:], end)
+		if idxEnd != -1 {
+			after = strings.TrimSpace(data[idxBegin+idxEnd+len(end):])
+		}
+		before = strings.TrimSpace(data[:idxBegin])
+	}
+
+	b := strings.Builder{}
+	b.WriteString(before)
+	b.WriteRune('\n')
+	b.WriteString(after)
+	b.WriteRune('\n')
+	b.WriteRune('\n')
+
+	b.WriteString(begin)
+	b.WriteRune('\n')
+
+	// Collect entries so we can sort by IP for stable output. Pad the IP
+	// column to the width of the widest possible address ("255.255.255.255")
+	// for readability.
+	type entry struct {
+		ip   netip.Addr
+		host string
+	}
+	var entries []entry
+	for ip, p := range peers {
+		if p.Name == "" {
+			continue
+		}
+		entries = append(entries, entry{ip: ip, host: p.Name + "." + localDomain})
+	}
+	sort.Slice(entries, func(i, j int) bool {
+		return entries[i].ip.Less(entries[j].ip)
+	})
+
+	for _, e := range entries {
+		b.WriteString(fmt.Sprintf("%-15s %s\n", e.ip.String(), e.host))
+	}
+
+	b.WriteString(end)
+	b.WriteRune('\n')
+
+	// Write to a temp file in the same directory, then rename over the
+	// original so readers never observe a partial file. Preserve the
+	// original's mode and ownership, since rename replaces the inode.
+	tmpPath := hostsPath + ".vppn.tmp"
+	if err := os.WriteFile(tmpPath, []byte(b.String()), info.Mode().Perm()); err != nil {
+		return err
+	}
+
+	if st, ok := info.Sys().(*syscall.Stat_t); ok {
+		if err := os.Chown(tmpPath, int(st.Uid), int(st.Gid)); err != nil {
+			os.Remove(tmpPath)
+			return err
+		}
+	}
+
+	if err := os.Rename(tmpPath, hostsPath); err != nil {
+		os.Remove(tmpPath)
+		return err
+	}
+
+	return nil
+}
--- a/peer/hosts_test.go
+++ b/peer/hosts_test.go
@@ -0,0 +1,205 @@
+package peer
+
+import (
+	"net/netip"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// writeTempHosts creates a temp hosts file with the given content and returns
+// its path.
+func writeTempHosts(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "hosts")
+	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+// readManagedSection returns the lines between the begin/end markers for the
+// given localDomain, plus everything outside the section ("outside").
+func readManagedSection(t *testing.T, path, localDomain string) (inside, outside []string) {
+	t.Helper()
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	begin, end := hostMarkers(localDomain)
+
+	inSection := false
+	for _, line := range strings.Split(string(raw), "\n") {
+		switch {
+		case strings.HasPrefix(line, begin):
+			inSection = true
+		case strings.HasPrefix(line, end):
+			inSection = false
+		case inSection:
+			if f := strings.Join(strings.Fields(line), " "); f != "" {
+				inside = append(inside, f)
+			}
+		default:
+			if f := strings.Join(strings.Fields(line), " "); f != "" {
+				outside = append(outside, f)
+			}
+		}
+	}
+	return inside, outside
+}
+
+func peer(name string) *Peer {
+	return &Peer{Name: name}
+}
+
+func TestUpdateHosts_AddsSection(t *testing.T) {
+	path := writeTempHosts(t, "127.0.0.1 localhost\n")
+
+	peers := map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.11.12.1"):  peer("hub"),
+		netip.MustParseAddr("10.11.12.10"): peer("laptop"),
+	}
+
+	if err := updateHosts(path, "mynet.local", peers); err != nil {
+		t.Fatal(err)
+	}
+
+	inside, outside := readManagedSection(t, path, "mynet.local")
+
+	sort.Strings(inside)
+	want := []string{
+		"10.11.12.1 hub.mynet.local",
+		"10.11.12.10 laptop.mynet.local",
+	}
+	if strings.Join(inside, "\n") != strings.Join(want, "\n") {
+		t.Errorf("managed section = %v, want %v", inside, want)
+	}
+
+	if !contains(outside, "127.0.0.1 localhost") {
+		t.Errorf("original content lost; outside = %v", outside)
+	}
+}
+
+func TestUpdateHosts_ReplacesExistingSection(t *testing.T) {
+	path := writeTempHosts(t, "127.0.0.1 localhost\n")
+
+	// First write.
+	first := map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.11.12.1"): peer("hub"),
+	}
+	if err := updateHosts(path, "mynet.local", first); err != nil {
+		t.Fatal(err)
+	}
+
+	// Second write with a different set of peers.
+	second := map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.11.12.20"): peer("phone"),
+	}
+	if err := updateHosts(path, "mynet.local", second); err != nil {
+		t.Fatal(err)
+	}
+
+	inside, outside := readManagedSection(t, path, "mynet.local")
+
+	if len(inside) != 1 || inside[0] != "10.11.12.20 phone.mynet.local" {
+		t.Errorf("section not replaced; inside = %v", inside)
+	}
+	if contains(inside, "10.11.12.1 hub.mynet.local") {
+		t.Errorf("stale entry remained; inside = %v", inside)
+	}
+	if !contains(outside, "127.0.0.1 localhost") {
+		t.Errorf("original content lost; outside = %v", outside)
+	}
+}
+
+func TestUpdateHosts_SkipsEmptyNames(t *testing.T) {
+	path := writeTempHosts(t, "127.0.0.1 localhost\n")
+
+	peers := map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.11.12.1"):  peer("hub"),
+		netip.MustParseAddr("10.11.12.99"): peer(""), // no name
+	}
+	if err := updateHosts(path, "mynet.local", peers); err != nil {
+		t.Fatal(err)
+	}
+
+	inside, _ := readManagedSection(t, path, "mynet.local")
+	if len(inside) != 1 || inside[0] != "10.11.12.1 hub.mynet.local" {
+		t.Errorf("expected only named peer; inside = %v", inside)
+	}
+}
+
+func TestUpdateHosts_Idempotent(t *testing.T) {
+	path := writeTempHosts(t, "127.0.0.1 localhost\n")
+
+	peers := map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.11.12.1"): peer("hub"),
+	}
+	if err := updateHosts(path, "mynet.local", peers); err != nil {
+		t.Fatal(err)
+	}
+	first, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := updateHosts(path, "mynet.local", peers); err != nil {
+		t.Fatal(err)
+	}
+	second, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(first) != string(second) {
+		t.Errorf("repeated update changed file:\nfirst:\n%s\nsecond:\n%s", first, second)
+	}
+}
+
+// TestUpdateHosts_PrefixDomainsCoexist guards finding 4.4: two domains where
+// one label is a prefix of the other ("net" vs "net2") must each manage their
+// own section without clobbering the other's, even sharing one hosts file.
+func TestUpdateHosts_PrefixDomainsCoexist(t *testing.T) {
+	path := writeTempHosts(t, "127.0.0.1 localhost\n")
+
+	if err := updateHosts(path, "net2.local", map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.0.2.1"): peer("a"),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := updateHosts(path, "net.local", map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.0.1.1"): peer("b"),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Both sections coexist after writing the prefix domain.
+	if in, _ := readManagedSection(t, path, "net2.local"); len(in) != 1 || in[0] != "10.0.2.1 a.net2.local" {
+		t.Errorf("net2 section clobbered: %v", in)
+	}
+	if in, _ := readManagedSection(t, path, "net.local"); len(in) != 1 || in[0] != "10.0.1.1 b.net.local" {
+		t.Errorf("net section wrong: %v", in)
+	}
+
+	// Re-updating net2 must not disturb the net section.
+	if err := updateHosts(path, "net2.local", map[netip.Addr]*Peer{
+		netip.MustParseAddr("10.0.2.2"): peer("c"),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if in, _ := readManagedSection(t, path, "net.local"); len(in) != 1 || in[0] != "10.0.1.1 b.net.local" {
+		t.Errorf("net section disturbed by net2 update: %v", in)
+	}
+	if in, _ := readManagedSection(t, path, "net2.local"); len(in) != 1 || in[0] != "10.0.2.2 c.net2.local" {
+		t.Errorf("net2 section not updated: %v", in)
+	}
+}
+
+func contains(ss []string, s string) bool {
+	for _, x := range ss {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}
--- a/peer/hub_poller.go
+++ b/peer/hub_poller.go
@@ -0,0 +1,153 @@
+package peer
+
+import (
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"vppn/m"
+)
+
+const hubPollInterval = 64 * time.Second
+
+type HubPoller struct {
+	selfVPNIP netip.Addr
+	vpnNet    netip.Prefix
+	hubURL    string
+	apiKey    string
+	statePath string // where the network state cache is persisted
+	addCh     chan<- m.Peer
+	removeCh  chan<- wgtypes.Key
+	known     map[wgtypes.Key]struct{} // pubKeys currently configured
+}
+
+func NewHubPoller(
+	selfVPNIP netip.Addr,
+	vpnNet netip.Prefix,
+	hubURL, apiKey string,
+	statePath string,
+	addCh chan<- m.Peer,
+	removeCh chan<- wgtypes.Key,
+) (*HubPoller, error) {
+	u, err := url.Parse(hubURL)
+	if err != nil {
+		return nil, err
+	}
+	u.Path = "/peer/fetch-state/"
+
+	return &HubPoller{
+		selfVPNIP: selfVPNIP,
+		vpnNet:    vpnNet,
+		hubURL:    u.String(),
+		apiKey:    apiKey,
+		statePath: statePath,
+		addCh:     addCh,
+		removeCh:  removeCh,
+		known:     make(map[wgtypes.Key]struct{}),
+	}, nil
+}
+
+func (hp *HubPoller) Run() {
+	// Prime from the on-disk cache before reaching the hub, so the peer
+	// configures WireGuard from its last known state even if the hub is down.
+	// known starts empty, so this emits every cached peer as an add; the first
+	// real poll then emits only deltas (adds for new peers, removes for gone).
+	if state, err := loadNetworkState(hp.statePath); err == nil {
+		hp.apply(state)
+	}
+
+	hp.poll()
+	for range time.Tick(hubPollInterval) {
+		hp.poll()
+	}
+}
+
+func (hp *HubPoller) poll() {
+	req, err := http.NewRequest(http.MethodGet, hp.hubURL, nil)
+	if err != nil {
+		log.Printf("[HubPoller] build request: %v", err)
+		return
+	}
+	req.SetBasicAuth("", hp.apiKey)
+
+	client := &http.Client{Timeout: 32 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Printf("[HubPoller] fetch: %v", err)
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		log.Printf("[HubPoller] unexpected status %d", resp.StatusCode)
+		return
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		log.Printf("[HubPoller] read body: %v", err)
+		return
+	}
+
+	var state m.NetworkState
+	if err := json.Unmarshal(body, &state); err != nil {
+		log.Printf("[HubPoller] unmarshal: %v", err)
+		return
+	}
+
+	// Persist only when the state actually changed, to avoid needless writes
+	// on every poll.
+	if hp.apply(state) {
+		if err := saveNetworkState(hp.statePath, state); err != nil {
+			log.Printf("[HubPoller] save state: %v", err)
+		}
+	}
+}
+
+// apply diffs state against the set of known peers, emitting an add for each
+// newly-seen peer and a remove for each that disappeared. It returns true if
+// anything changed. A peer's config is immutable under a stable WG key (the hub
+// has no peer-edit path), so a key already in known needs no re-emit.
+func (hp *HubPoller) apply(state m.NetworkState) (changed bool) {
+	seen := make(map[wgtypes.Key]struct{}, len(hp.known))
+
+	netAddr := hp.vpnNet.Addr().As4()
+
+	for _, p := range state.Peers {
+		if p.WGPubKey == (wgtypes.Key{}) {
+			continue
+		}
+
+		octets := netAddr
+		octets[3] = p.PeerIP
+		vpnIP := netip.AddrFrom4(octets)
+		if vpnIP == hp.selfVPNIP {
+			continue
+		}
+
+		seen[p.WGPubKey] = struct{}{}
+
+		if _, ok := hp.known[p.WGPubKey]; ok {
+			continue
+		}
+		hp.known[p.WGPubKey] = struct{}{}
+		hp.addCh <- p
+		changed = true
+	}
+
+	for key := range hp.known {
+		if _, ok := seen[key]; !ok {
+			delete(hp.known, key)
+			hp.removeCh <- key
+			changed = true
+		}
+	}
+
+	return changed
+}
--- a/peer/hub_poller_test.go
+++ b/peer/hub_poller_test.go
@@ -0,0 +1,80 @@
+package peer
+
+import (
+	"net/netip"
+	"testing"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"vppn/m"
+)
+
+func testPoller(t *testing.T) (*HubPoller, chan m.Peer, chan wgtypes.Key) {
+	t.Helper()
+	addCh := make(chan m.Peer, 8)
+	removeCh := make(chan wgtypes.Key, 8)
+	hp := &HubPoller{
+		selfVPNIP: netip.MustParseAddr("10.0.0.1"),
+		vpnNet:    netip.MustParsePrefix("10.0.0.0/24"),
+		addCh:     addCh,
+		removeCh:  removeCh,
+		known:     make(map[wgtypes.Key]struct{}),
+	}
+	return hp, addCh, removeCh
+}
+
+func stateWith(key wgtypes.Key, peerIP byte) m.NetworkState {
+	return m.NetworkState{Peers: []m.Peer{{
+		PeerIP:   peerIP,
+		WGPubKey: key,
+	}}}
+}
+
+func TestApply_EmitsAddsAndReportsChange(t *testing.T) {
+	hp, addCh, _ := testPoller(t)
+	key := mustKey(t)
+
+	if changed := hp.apply(stateWith(key, 2)); !changed {
+		t.Fatal("expected changed=true on first apply")
+	}
+	if len(addCh) != 1 {
+		t.Fatalf("expected 1 add, got %d", len(addCh))
+	}
+	if got := <-addCh; got.WGPubKey != key {
+		t.Errorf("add pubkey mismatch")
+	}
+}
+
+func TestApply_NoChangeWhenKnown(t *testing.T) {
+	hp, addCh, _ := testPoller(t)
+	key := mustKey(t)
+
+	hp.apply(stateWith(key, 2))
+	<-addCh // drain initial add
+
+	if changed := hp.apply(stateWith(key, 2)); changed {
+		t.Fatal("expected changed=false when peer already known")
+	}
+	if len(addCh) != 0 {
+		t.Fatalf("expected no re-emit, got %d adds", len(addCh))
+	}
+}
+
+func TestApply_RemovesVanishedPeer(t *testing.T) {
+	hp, addCh, removeCh := testPoller(t)
+	key := mustKey(t)
+
+	hp.apply(stateWith(key, 2))
+	<-addCh
+
+	// Empty state: the peer is gone.
+	if changed := hp.apply(m.NetworkState{}); !changed {
+		t.Fatal("expected changed=true when peer vanishes")
+	}
+	if len(removeCh) != 1 {
+		t.Fatalf("expected 1 remove, got %d", len(removeCh))
+	}
+	if got := <-removeCh; got != key {
+		t.Errorf("remove key mismatch")
+	}
+}
--- a/peer/hubpoller.go
+++ b/peer/hubpoller.go
@@ -1,110 +0,0 @@
-package peer
-
-import (
-	"encoding/json"
-	"io"
-	"log"
-	"net/http"
-	"net/url"
-	"time"
-	"vppn/m"
-)
-
-type hubPoller struct {
-	client           *http.Client
-	req              *http.Request
-	versions         [256]int64
-	localIP          byte
-	netName          string
-	handleControlMsg func(fromIP byte, msg any)
-}
-
-func newHubPoller(
-	localIP byte,
-	netName,
-	hubURL,
-	apiKey string,
-	handleControlMsg func(byte, any),
-) (*hubPoller, error) {
-	u, err := url.Parse(hubURL)
-	if err != nil {
-		return nil, err
-	}
-	u.Path = "/peer/fetch-state/"
-
-	client := &http.Client{Timeout: 8 * time.Second}
-
-	req := &http.Request{
-		Method: http.MethodGet,
-		URL:    u,
-		Header: http.Header{},
-	}
-	req.SetBasicAuth("", apiKey)
-
-	return &hubPoller{
-		client:           client,
-		req:              req,
-		localIP:          localIP,
-		netName:          netName,
-		handleControlMsg: handleControlMsg,
-	}, nil
-}
-
-func (hp *hubPoller) logf(s string, args ...any) {
-	log.Printf("[HubPoller] "+s, args...)
-}
-
-func (hp *hubPoller) Run() {
-	state, err := loadNetworkState(hp.netName)
-	if err != nil {
-		hp.logf("Failed to load network state: %v", err)
-		hp.logf("Polling hub...")
-		hp.pollHub()
-	} else {
-		hp.applyNetworkState(state)
-	}
-
-	for range time.Tick(64 * time.Second) {
-		hp.pollHub()
-	}
-}
-
-func (hp *hubPoller) pollHub() {
-	var state m.NetworkState
-
-	resp, err := hp.client.Do(hp.req)
-	if err != nil {
-		hp.logf("Failed to fetch peer state: %v", err)
-		return
-	}
-	body, err := io.ReadAll(resp.Body)
-	_ = resp.Body.Close()
-	if err != nil {
-		hp.logf("Failed to read body from hub: %v", err)
-		return
-	}
-
-	if err := json.Unmarshal(body, &state); err != nil {
-		hp.logf("Failed to unmarshal response from hub: %v\n%s", err, body)
-		return
-	}
-
-	hp.applyNetworkState(state)
-
-	if err := storeNetworkState(hp.netName, state); err != nil {
-		hp.logf("Failed to store network state: %v", err)
-	}
-}
-
-func (hp *hubPoller) applyNetworkState(state m.NetworkState) {
-	for i, peer := range state.Peers {
-		if i != int(hp.localIP) {
-			if peer == nil || peer.Version != hp.versions[i] {
-				hp.handleControlMsg(byte(i), peerUpdateMsg{Peer: state.Peers[i]})
-				if peer != nil {
-					hp.versions[i] = peer.Version
-				}
-			}
-		}
-	}
-}
--- a/peer/ifreader.go
+++ b/peer/ifreader.go
@@ -1,103 +0,0 @@
-package peer
-
-import (
-	"io"
-	"log"
-	"net/netip"
-	"sync/atomic"
-)
-
-type ifReader struct {
-	iface              io.Reader
-	writeToUDPAddrPort func([]byte, netip.AddrPort) (int, error)
-	rt                 *atomic.Pointer[routingTable]
-	buf1               []byte
-	buf2               []byte
-}
-
-func newIFReader(
-	iface io.Reader,
-	writeToUDPAddrPort func([]byte, netip.AddrPort) (int, error),
-	rt *atomic.Pointer[routingTable],
-) *ifReader {
-	return &ifReader{iface, writeToUDPAddrPort, rt, newBuf(), newBuf()}
-}
-
-func (r *ifReader) Run() {
-	packet := newBuf()
-	for {
-		r.handleNextPacket(packet)
-	}
-}
-
-func (r *ifReader) handleNextPacket(packet []byte) {
-	packet = r.readNextPacket(packet)
-	remoteIP, ok := r.parsePacket(packet)
-	if !ok {
-		return
-	}
-
-	rt := r.rt.Load()
-	peer := rt.Peers[remoteIP]
-	if !peer.Up {
-		r.logf("Peer %d not up.", peer.IP)
-		return
-	}
-
-	enc := peer.EncryptDataPacket(peer.IP, packet, r.buf1)
-	if peer.Direct {
-		r.writeToUDPAddrPort(enc, peer.DirectAddr)
-		return
-	}
-
-	relay, ok := rt.GetRelay()
-	if !ok {
-		r.logf("Relay not available for peer %d.", peer.IP)
-		return
-	}
-
-	enc = relay.EncryptDataPacket(peer.IP, enc, r.buf2)
-	r.writeToUDPAddrPort(enc, relay.DirectAddr)
-}
-
-func (r *ifReader) readNextPacket(buf []byte) []byte {
-	n, err := r.iface.Read(buf[:cap(buf)])
-	if err != nil {
-		log.Fatalf("Failed to read from interface: %v", err)
-	}
-
-	return buf[:n]
-}
-
-func (r *ifReader) parsePacket(buf []byte) (byte, bool) {
-	n := len(buf)
-	if n == 0 {
-		return 0, false
-	}
-
-	version := buf[0] >> 4
-
-	switch version {
-	case 4:
-		if n < 20 {
-			r.logf("Short IPv4 packet: %d", len(buf))
-			return 0, false
-		}
-		return buf[19], true
-
-	case 6:
-		if len(buf) < 40 {
-			r.logf("Short IPv6 packet: %d", len(buf))
-			return 0, false
-		}
-		return buf[39], true
-
-	default:
-		r.logf("Invalid IP packet version: %v", version)
-		return 0, false
-	}
-}
-
-func (*ifReader) logf(s string, args ...any) {
-	log.Printf("[IFReader] "+s, args...)
-}
--- a/peer/ifreader_test.go
+++ b/peer/ifreader_test.go
@@ -1,81 +0,0 @@
-package peer
-
-/*
-func TestIFReader_IPv4(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	pkt := make([]byte, 1234)
-	pkt[0] = 4 << 4
-	pkt[19] = 2 // IP.
-
-	p1.IFace.UserWrite(pkt)
-	p1.IFReader.handleNextPacket(newBuf())
-
-	packets := p2.Conn.Packets()
-	if len(packets) != 1 {
-		t.Fatal(packets)
-	}
-}
-
-func TestIFReader_IPv6(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	pkt := make([]byte, 1234)
-	pkt[0] = 6 << 4
-	pkt[39] = 2 // IP.
-
-	p1.IFace.UserWrite(pkt)
-	p1.IFReader.handleNextPacket(newBuf())
-
-	packets := p2.Conn.Packets()
-	if len(packets) != 1 {
-		t.Fatal(packets)
-	}
-}
-
-func TestIFReader_parsePacket_emptyPacket(t *testing.T) {
-	r := NewIFReader(nil, nil)
-	pkt := make([]byte, 0)
-	if ip, ok := r.parsePacket(pkt); ok {
-		t.Fatal(ip, ok)
-	}
-}
-
-func TestIFReader_parsePacket_invalidIPVersion(t *testing.T) {
-	r := NewIFReader(nil, nil)
-
-	for i := byte(1); i < 16; i++ {
-		if i == 4 || i == 6 {
-			continue
-		}
-		pkt := make([]byte, 1234)
-		pkt[0] = i << 4
-
-		if ip, ok := r.parsePacket(pkt); ok {
-			t.Fatal(i, ip, ok)
-		}
-	}
-}
-
-func TestIFReader_parsePacket_shortIPv4(t *testing.T) {
-	r := NewIFReader(nil, nil)
-
-	pkt := make([]byte, 19)
-	pkt[0] = 4 << 4
-
-	if ip, ok := r.parsePacket(pkt); ok {
-		t.Fatal(ip, ok)
-	}
-}
-
-func TestIFReader_parsePacket_shortIPv6(t *testing.T) {
-	r := NewIFReader(nil, nil)
-
-	pkt := make([]byte, 39)
-	pkt[0] = 6 << 4
-
-	if ip, ok := r.parsePacket(pkt); ok {
-		t.Fatal(ip, ok)
-	}
-}
-*/
--- a/peer/init.go
+++ b/peer/init.go
@@ -0,0 +1,190 @@
+package peer
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/netip"
+	"os"
+
+	"golang.org/x/crypto/nacl/sign"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"vppn/m"
+)
+
+// LocalState is the persisted identity for this peer, written on first run and
+// loaded on every subsequent run.
+type LocalState struct {
+	PrivKey     wgtypes.Key
+	SignKey     [64]byte // nacl/sign Ed25519 private key
+	VPNIP       netip.Addr
+	VPNNet      netip.Prefix
+	WGPort      uint16
+	IsRelay     bool
+	IsPublic    bool
+	LocalDomain string
+}
+
+// localStateJSON is the on-disk representation.
+type localStateJSON struct {
+	PrivKey     string
+	SignKey     string
+	VPNIP       netip.Addr
+	VPNNet      netip.Prefix
+	WGPort      uint16
+	IsRelay     bool
+	IsPublic    bool
+	LocalDomain string
+}
+
+// LoadOrInit loads LocalState from path, or registers with the hub and creates
+// the file if it doesn't exist.
+func LoadOrInit(statePath, hubURL, apiKey string) (LocalState, error) {
+	var state LocalState
+	switch err := loadJSON(statePath, &state); {
+	case err == nil:
+		return state, nil
+	case !os.IsNotExist(err):
+		// File exists but is unreadable/corrupt: surface it rather than
+		// silently regenerating a new identity and re-registering.
+		return LocalState{}, fmt.Errorf("load state: %w", err)
+	}
+
+	privKey, err := wgtypes.GeneratePrivateKey()
+	if err != nil {
+		return LocalState{}, fmt.Errorf("generate key: %w", err)
+	}
+
+	state, err = initFromHub(hubURL, apiKey, privKey)
+	if err != nil {
+		return LocalState{}, err
+	}
+
+	if err := storeJSON(statePath, state); err != nil {
+		return LocalState{}, fmt.Errorf("save state: %w", err)
+	}
+	return state, nil
+}
+
+func initFromHub(hubURL, apiKey string, privKey wgtypes.Key) (LocalState, error) {
+	wgPubKey := privKey.PublicKey()
+
+	signPubKey, signPrivKey, err := sign.GenerateKey(rand.Reader)
+	if err != nil {
+		return LocalState{}, fmt.Errorf("generate sign key: %w", err)
+	}
+
+	body, err := json.Marshal(m.PeerInitArgs{
+		WGPubKey:   wgPubKey[:],
+		SignPubKey: signPubKey[:],
+	})
+	if err != nil {
+		return LocalState{}, fmt.Errorf("json error: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, hubURL+"/peer/init/", bytes.NewReader(body))
+	if err != nil {
+		return LocalState{}, err
+	}
+	req.SetBasicAuth("", apiKey)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return LocalState{}, fmt.Errorf("hub init: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return LocalState{}, fmt.Errorf("hub init: HTTP %d", resp.StatusCode)
+	}
+
+	var r m.PeerInitResp
+	if err := json.NewDecoder(resp.Body).Decode(&r); err != nil {
+		return LocalState{}, fmt.Errorf("hub init decode: %w", err)
+	}
+
+	if len(r.Network) != 4 {
+		return LocalState{}, fmt.Errorf("hub init: invalid network %v", r.Network)
+	}
+
+	netAddr := netip.AddrFrom4([4]byte(r.Network))
+	octets := netAddr.As4()
+	octets[3] = r.PeerIP
+	vpnIP := netip.AddrFrom4(octets)
+	vpnNet := netip.PrefixFrom(netAddr, 24)
+
+	var self *m.Peer
+	for i := range r.NetworkState.Peers {
+		if r.NetworkState.Peers[i].PeerIP == r.PeerIP {
+			self = &r.NetworkState.Peers[i]
+			break
+		}
+	}
+	if self == nil {
+		return LocalState{}, fmt.Errorf("hub init: no peer for own IP: %d", r.PeerIP)
+	}
+
+	public := self.IsPublic()
+
+	return LocalState{
+		PrivKey:     privKey,
+		SignKey:     *signPrivKey,
+		VPNIP:       vpnIP,
+		VPNNet:      vpnNet,
+		WGPort:      self.Port,
+		IsRelay:     self.Relay && public,
+		IsPublic:    public,
+		LocalDomain: r.LocalDomain,
+	}, nil
+}
+
+func (s LocalState) MarshalJSON() ([]byte, error) {
+	return json.Marshal(localStateJSON{
+		PrivKey:     base64.StdEncoding.EncodeToString(s.PrivKey[:]),
+		SignKey:     base64.StdEncoding.EncodeToString(s.SignKey[:]),
+		VPNIP:       s.VPNIP,
+		VPNNet:      s.VPNNet,
+		WGPort:      s.WGPort,
+		IsRelay:     s.IsRelay,
+		IsPublic:    s.IsPublic,
+		LocalDomain: s.LocalDomain,
+	})
+}
+
+func (s *LocalState) UnmarshalJSON(data []byte) error {
+	var j localStateJSON
+	if err := json.Unmarshal(data, &j); err != nil {
+		return err
+	}
+	keyBytes, err := base64.StdEncoding.DecodeString(j.PrivKey)
+	if err != nil {
+		return fmt.Errorf("decode key: %w", err)
+	}
+	key, err := wgtypes.NewKey(keyBytes)
+	if err != nil {
+		return fmt.Errorf("invalid key: %w", err)
+	}
+	signKeyBytes, err := base64.StdEncoding.DecodeString(j.SignKey)
+	if err != nil {
+		return fmt.Errorf("decode sign key: %w", err)
+	}
+	if len(signKeyBytes) != 64 {
+		return fmt.Errorf("invalid sign key length: %d", len(signKeyBytes))
+	}
+	*s = LocalState{
+		PrivKey:     key,
+		SignKey:     [64]byte(signKeyBytes),
+		VPNIP:       j.VPNIP,
+		VPNNet:      j.VPNNet,
+		WGPort:      j.WGPort,
+		IsRelay:     j.IsRelay,
+		IsPublic:    j.IsPublic,
+		LocalDomain: j.LocalDomain,
+	}
+	return nil
+}
--- a/peer/interface.go
+++ b/peer/interface.go
@@ -1,137 +0,0 @@
-package peer
-
-import (
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func openInterface(network []byte, localIP byte, name string) (io.ReadWriteCloser, error) {
-	if len(network) != 4 {
-		return nil, fmt.Errorf("expected network to be 4 bytes, got %d", len(network))
-	}
-	ip := net.IPv4(network[0], network[1], network[2], localIP)
-
-	//////////////////////////
-	// Create TUN Interface //
-	//////////////////////////
-
-	tunFD, err := syscall.Open("/dev/net/tun", syscall.O_RDWR|unix.O_CLOEXEC, 0600)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open TUN device: %w", err)
-	}
-
-	// New interface request.
-	req, err := unix.NewIfreq(name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create new TUN interface request: %w", err)
-	}
-
-	// Flags:
-	//
-	// IFF_NO_PI => don't add packet info data to packets sent to the interface.
-	// IFF_TUN   => create a TUN device handling IP packets.
-	req.SetUint16(unix.IFF_NO_PI | unix.IFF_TUN)
-
-	err = unix.IoctlIfreq(tunFD, unix.TUNSETIFF, req)
-	if err != nil {
-		return nil, fmt.Errorf("failed to set TUN device settings: %w", err)
-	}
-
-	// Name may not be exactly the same?
-	name = req.Name()
-
-	/////////////
-	// Set MTU //
-	/////////////
-
-	// We need a socket file descriptor to set other options for some reason.
-	sockFD, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open socket: %w", err)
-	}
-	defer unix.Close(sockFD)
-
-	req, err = unix.NewIfreq(name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create MTU interface request: %w", err)
-	}
-
-	req.SetUint32(if_mtu)
-	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFMTU, req); err != nil {
-		return nil, fmt.Errorf("failed to set interface MTU: %w", err)
-	}
-
-	//////////////////////
-	// Set Queue Length //
-	//////////////////////
-
-	req, err = unix.NewIfreq(name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create IP interface request: %w", err)
-	}
-
-	req.SetUint16(if_queue_len)
-	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFTXQLEN, req); err != nil {
-		return nil, fmt.Errorf("failed to set interface queue length: %w", err)
-	}
-
-	/////////////////////
-	// Set IP and Mask //
-	/////////////////////
-
-	req, err = unix.NewIfreq(name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create IP interface request: %w", err)
-	}
-
-	if err := req.SetInet4Addr(ip.To4()); err != nil {
-		return nil, fmt.Errorf("failed to set interface request IP: %w", err)
-	}
-
-	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFADDR, req); err != nil {
-		return nil, fmt.Errorf("failed to set interface IP: %w", err)
-	}
-
-	// SET MASK - must happen after setting address.
-	req, err = unix.NewIfreq(name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create mask interface request: %w", err)
-	}
-
-	if err := req.SetInet4Addr(net.IPv4(255, 255, 255, 0).To4()); err != nil {
-		return nil, fmt.Errorf("failed to set interface request mask: %w", err)
-	}
-
-	if err := unix.IoctlIfreq(sockFD, unix.SIOCSIFNETMASK, req); err != nil {
-		return nil, fmt.Errorf("failed to set interface mask: %w", err)
-	}
-
-	////////////////////////
-	// Bring Interface Up //
-	////////////////////////
-
-	req, err = unix.NewIfreq(name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create up interface request: %w", err)
-	}
-
-	// Get current flags.
-	if err = unix.IoctlIfreq(sockFD, unix.SIOCGIFFLAGS, req); err != nil {
-		return nil, fmt.Errorf("failed to get interface flags: %w", err)
-	}
-
-	flags := req.Uint16() | unix.IFF_UP | unix.IFF_RUNNING
-
-	// Set UP flag / broadcast flags.
-	req.SetUint16(flags)
-	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFFLAGS, req); err != nil {
-		return nil, fmt.Errorf("failed to set interface up: %w", err)
-	}
-
-	return os.NewFile(uintptr(tunFD), "tun"), nil
-}
--- a/peer/interfaces.go
+++ b/peer/interfaces.go
@@ -0,0 +1,28 @@
+package peer
+
+import (
+	"net/netip"
+	"vppn/peer/control"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// WGDevice is the subset of wginterface.Device used by App.
+type WGDevice interface {
+	Name() string
+	Peers() ([]wgtypes.Peer, error)
+	AddPeer(pubKey wgtypes.Key) error
+	AddDirect(pubKey wgtypes.Key, endpoint netip.AddrPort, vpnIP netip.Addr) error
+	SetRelay(pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) error
+	AddProbe(pubKey wgtypes.Key, endpoint netip.AddrPort) error
+	Promote(pubKey wgtypes.Key, vpnIP netip.Addr) error
+	RemovePeer(pubKey wgtypes.Key) error
+}
+
+// ControlConn sends pings to peers over the VPN control port.
+// Reading is handled separately via run, which feeds the App's pingCh.
+// buf is a caller-provided scratch buffer (at least control.Size bytes) used to
+// marshal the ping; the caller reuses one across sends.
+type ControlConn interface {
+	SendPing(dst netip.AddrPort, ping control.Ping, buf []byte) error
+}
--- a/peer/json.go
+++ b/peer/json.go
@@ -0,0 +1,36 @@
+package peer
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+)
+
+func loadJSON(path string, target any) error {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(data, target)
+}
+
+func storeJSON(path string, obj any) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return err
+	}
+	data, err := json.MarshalIndent(obj, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	tmpPath := path + ".tmp"
+	if err := os.WriteFile(tmpPath, data, 0600); err != nil {
+		return err
+	}
+
+	if err := os.Rename(tmpPath, path); err != nil {
+		os.Remove(tmpPath)
+		return err
+	}
+	return nil
+}
--- a/peer/main.go
+++ b/peer/main.go
@@ -1,23 +0,0 @@
-package peer
-
-import (
-	"flag"
-	"os"
-)
-
-func Main() {
-	conf := peerConfig{}
-
-	flag.StringVar(&conf.NetName, "name", "", "[REQUIRED] The network name.")
-	flag.StringVar(&conf.HubAddress, "hub-address", "", "[REQUIRED] The hub address.")
-	flag.StringVar(&conf.APIKey, "api-key", "", "[REQUIRED] The node's API key.")
-	flag.Parse()
-
-	if conf.NetName == "" || conf.HubAddress == "" || conf.APIKey == "" {
-		flag.Usage()
-		os.Exit(1)
-	}
-
-	peer := newPeerMain(conf)
-	peer.Run()
-}
--- a/peer/mcreader.go
+++ b/peer/mcreader.go
@@ -1,70 +0,0 @@
-package peer
-
-import (
-	"log"
-	"net"
-	"sync/atomic"
-	"time"
-)
-
-func runMCReader(
-	rt *atomic.Pointer[routingTable],
-	handleControlMsg func(destIP byte, msg any),
-) {
-	for {
-		runMCReaderInner(rt, handleControlMsg)
-		time.Sleep(broadcastErrorTimeoutInterval)
-	}
-}
-
-func runMCReaderInner(
-	rt *atomic.Pointer[routingTable],
-	handleControlMsg func(destIP byte, msg any),
-) {
-	var (
-		raw  = newBuf()
-		buf  = newBuf()
-		logf = func(s string, args ...any) {
-			log.Printf("[MCReader] "+s, args...)
-		}
-	)
-
-	conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
-	if err != nil {
-		logf("Failed to bind to multicast address: %v", err)
-		return
-	}
-
-	for {
-		conn.SetReadDeadline(time.Now().Add(32 * time.Second))
-		n, remoteAddr, err := conn.ReadFromUDPAddrPort(raw[:bufferSize])
-		if err != nil {
-			logf("Failed to read from UDP port): %v", err)
-			return
-		}
-
-		raw = raw[:n]
-		h, ok := headerFromLocalDiscoveryPacket(raw)
-		if !ok {
-			logf("Failed to open discovery packet?")
-			continue
-		}
-
-		peer := rt.Load().Peers[h.SourceIP]
-		if peer.PubSignKey == nil {
-			logf("No signing key for peer %d.", h.SourceIP)
-			continue
-		}
-
-		if !verifyLocalDiscoveryPacket(raw, buf, peer.PubSignKey) {
-			logf("Invalid signature from peer: %d", h.SourceIP)
-			continue
-		}
-
-		msg := controlMsg[packetLocalDiscovery]{
-			SrcIP:   h.SourceIP,
-			SrcAddr: remoteAddr,
-		}
-		handleControlMsg(h.SourceIP, msg)
-	}
-}
--- a/peer/mcreader_test.go
+++ b/peer/mcreader_test.go
@@ -1,132 +0,0 @@
-package peer
-
-/*
-type mcMockConn struct {
-	packets chan []byte
-}
-
-func newMCMockConn() *mcMockConn {
-	return &mcMockConn{make(chan []byte, 32)}
-}
-
-func (c *mcMockConn) WriteToUDP(in []byte, addr *net.UDPAddr) (int, error) {
-	c.packets <- bytes.Clone(in)
-	return len(in), nil
-}
-
-func (c *mcMockConn) ReadFromUDPAddrPort(b []byte) (n int, addr netip.AddrPort, err error) {
-	buf := <-c.packets
-	b = b[:len(buf)]
-	copy(b, buf)
-	return len(b), netip.AddrPort{}, nil
-}
-
-func TestMCReader(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	w := newMCWriter(conn, 1, keys.PrivSignKey)
-	r := newMCReader(conn, super, peers)
-
-	w.SendLocalDiscovery()
-	r.handleNextPacket()
-
-	if len(super.Messages) != 1 {
-		t.Fatal(super.Messages)
-	}
-	msg, ok := super.Messages[0].(controlMsg[PacketLocalDiscovery])
-	if !ok || msg.SrcIP != 1 {
-		t.Fatal(ok, msg)
-	}
-}
-
-func TestMCReader_noHeader(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	r := newMCReader(conn, super, peers)
-	conn.WriteToUDP([]byte("0123546789"), nil)
-	r.handleNextPacket()
-
-	if len(super.Messages) != 0 {
-		t.Fatal(super.Messages)
-	}
-}
-
-func TestMCReader_noPeer(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[2] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	w := newMCWriter(conn, 2, keys.PrivSignKey)
-	r := newMCReader(conn, super, peers)
-
-	w.SendLocalDiscovery()
-	r.handleNextPacket()
-
-	if len(super.Messages) != 0 {
-		t.Fatal(super.Messages)
-	}
-}
-
-func TestMCReader_badSignature(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	w := newMCWriter(conn, 1, keys.PrivSignKey)
-	w.SendLocalDiscovery()
-
-	// Break signing.
-	packet := <-conn.packets
-	packet[0]++
-	conn.packets <- packet
-
-	r := newMCReader(conn, super, peers)
-
-	r.handleNextPacket()
-
-	if len(super.Messages) != 0 {
-		t.Fatal(super.Messages)
-	}
-}
-*/
--- a/peer/mcwriter.go
+++ b/peer/mcwriter.go
@@ -1,53 +0,0 @@
-package peer
-
-import (
-	"log"
-	"net"
-	"time"
-
-	"golang.org/x/crypto/nacl/sign"
-)
-
-func createLocalDiscoveryPacket(localIP byte, signingKey []byte) []byte {
-	h := header{
-		SourceIP: localIP,
-		DestIP:   255,
-	}
-	buf := make([]byte, headerSize)
-	h.Marshal(buf)
-	out := make([]byte, headerSize+signOverhead)
-	return sign.Sign(out[:0], buf, (*[64]byte)(signingKey))
-}
-
-func headerFromLocalDiscoveryPacket(pkt []byte) (h header, ok bool) {
-	if len(pkt) != headerSize+signOverhead {
-		return
-	}
-
-	h.Parse(pkt[signOverhead:])
-	ok = true
-	return
-}
-
-func verifyLocalDiscoveryPacket(pkt, buf []byte, pubSignKey []byte) bool {
-	_, ok := sign.Open(buf[:0], pkt, (*[32]byte)(pubSignKey))
-	return ok
-}
-
-// ----------------------------------------------------------------------------
-
-func runMCWriter(localIP byte, signingKey []byte) {
-	discoveryPacket := createLocalDiscoveryPacket(localIP, signingKey)
-
-	conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
-	if err != nil {
-		log.Fatalf("[MCWriter] Failed to bind to multicast address: %v", err)
-	}
-
-	for range time.Tick(broadcastInterval) {
-		_, err := conn.WriteToUDP(discoveryPacket, multicastAddr)
-		if err != nil {
-			log.Printf("[MCWriter] Failed to write multicast: %v", err)
-		}
-	}
-}
--- a/peer/mcwriter_test.go
+++ b/peer/mcwriter_test.go
@@ -1,98 +0,0 @@
-package peer
-
-/*
-// ----------------------------------------------------------------------------
-
-// Testing that we can create and verify a local discovery packet.
-func TestVerifyLocalDiscoveryPacket_valid(t *testing.T) {
-	keys := generateKeys()
-
-	created := createLocalDiscoveryPacket(55, keys.PrivSignKey)
-
-	header, ok := headerFromLocalDiscoveryPacket(created)
-	if !ok {
-		t.Fatal(ok)
-	}
-	if header.SourceIP != 55 || header.DestIP != 255 {
-		t.Fatal(header)
-	}
-
-	if !verifyLocalDiscoveryPacket(created, make([]byte, 1024), keys.PubSignKey) {
-		t.Fatal("Not valid")
-	}
-}
-
-// Testing that we don't try to parse short packets.
-func TestVerifyLocalDiscoveryPacket_tooShort(t *testing.T) {
-	keys := generateKeys()
-
-	created := createLocalDiscoveryPacket(55, keys.PrivSignKey)
-
-	_, ok := headerFromLocalDiscoveryPacket(created[:len(created)-1])
-	if ok {
-		t.Fatal(ok)
-	}
-}
-
-// Testing that modifying a packet makes it invalid.
-func TestVerifyLocalDiscoveryPacket_invalid(t *testing.T) {
-	keys := generateKeys()
-
-	created := createLocalDiscoveryPacket(55, keys.PrivSignKey)
-	buf := make([]byte, 1024)
-	for i := range created {
-		modified := bytes.Clone(created)
-		modified[i]++
-		if verifyLocalDiscoveryPacket(modified, buf, keys.PubSignKey) {
-			t.Fatal("Verification should have failed.")
-		}
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-type testUDPWriter struct {
-	written [][]byte
-}
-
-func (w *testUDPWriter) WriteToUDP(b []byte, addr *net.UDPAddr) (int, error) {
-	w.written = append(w.written, bytes.Clone(b))
-	return len(b), nil
-}
-
-func (w *testUDPWriter) Written() [][]byte {
-	out := w.written
-	w.written = [][]byte{}
-	return out
-}
-
-// ----------------------------------------------------------------------------
-
-// Testing that the mcWriter sends local discovery packets as expected.
-func TestMCWriter_SendLocalDiscovery(t *testing.T) {
-	keys := generateKeys()
-	writer := &testUDPWriter{}
-
-	mcw := newMCWriter(writer, 42, keys.PrivSignKey)
-	mcw.SendLocalDiscovery()
-
-	out := writer.Written()
-	if len(out) != 1 {
-		t.Fatal(out)
-	}
-
-	pkt := out[0]
-
-	header, ok := headerFromLocalDiscoveryPacket(pkt)
-	if !ok {
-		t.Fatal(ok)
-	}
-	if header.SourceIP != 42 || header.DestIP != 255 {
-		t.Fatal(header)
-	}
-
-	if !verifyLocalDiscoveryPacket(pkt, make([]byte, 1024), keys.PubSignKey) {
-		t.Fatal("Verification should succeed.")
-	}
-}
-*/
--- a/peer/mock-iface_test.go
+++ b/peer/mock-iface_test.go
@@ -1,31 +0,0 @@
-package peer
-
-import "bytes"
-
-type TestIFace struct {
-	out *bytes.Buffer // Toward the network.
-	in  *bytes.Buffer // From the network
-}
-
-func NewTestIFace() *TestIFace {
-	return &TestIFace{
-		out: &bytes.Buffer{},
-		in:  &bytes.Buffer{},
-	}
-}
-
-func (iface *TestIFace) Write(b []byte) (int, error) {
-	return iface.in.Write(b)
-}
-
-func (iface *TestIFace) Read(b []byte) (int, error) {
-	return iface.out.Read(b)
-}
-
-func (iface *TestIFace) UserWrite(b []byte) (int, error) {
-	return iface.out.Write(b)
-}
-
-func (iface *TestIFace) UserRead(b []byte) (int, error) {
-	return iface.in.Read(b)
-}
--- a/peer/mock-network_test.go
+++ b/peer/mock-network_test.go
@@ -1,80 +0,0 @@
-package peer
-
-import (
-	"bytes"
-	"net"
-	"net/netip"
-	"sync"
-)
-
-type TestPacket struct {
-	Addr netip.AddrPort
-	Data []byte
-}
-
-type TestNetwork struct {
-	lock    sync.Mutex
-	packets map[netip.AddrPort]chan TestPacket
-}
-
-func NewTestNetwork() *TestNetwork {
-	return &TestNetwork{packets: map[netip.AddrPort]chan TestPacket{}}
-}
-
-func (n *TestNetwork) NewUDPConn(localAddr netip.AddrPort) *TestUDPConn {
-	n.lock.Lock()
-	defer n.lock.Unlock()
-	if _, ok := n.packets[localAddr]; !ok {
-		n.packets[localAddr] = make(chan TestPacket, 1024)
-	}
-	return &TestUDPConn{
-		addr:    localAddr,
-		n:       n,
-		packets: n.packets[localAddr],
-	}
-}
-
-func (n *TestNetwork) write(b []byte, from, to netip.AddrPort) {
-	n.lock.Lock()
-	defer n.lock.Unlock()
-	if _, ok := n.packets[to]; !ok {
-		n.packets[to] = make(chan TestPacket, 1024)
-	}
-	n.packets[to] <- TestPacket{
-		Addr: from,
-		Data: bytes.Clone(b),
-	}
-}
-
-type TestUDPConn struct {
-	addr    netip.AddrPort
-	n       *TestNetwork
-	packets chan TestPacket
-}
-
-func (c *TestUDPConn) WriteToUDPAddrPort(b []byte, addr netip.AddrPort) (int, error) {
-	c.n.write(b, c.addr, addr)
-	return len(b), nil
-}
-
-func (c *TestUDPConn) WriteToUDP(b []byte, addr *net.UDPAddr) (int, error) {
-	return c.WriteToUDPAddrPort(b, addr.AddrPort())
-}
-
-func (c *TestUDPConn) ReadFromUDPAddrPort(b []byte) (n int, addr netip.AddrPort, err error) {
-	pkt := <-c.packets
-	b = b[:len(pkt.Data)]
-	copy(b, pkt.Data)
-	return len(b), pkt.Addr, nil
-}
-
-func (c *TestUDPConn) Packets() (out []TestPacket) {
-	for {
-		select {
-		case pkt := <-c.packets:
-			out = append(out, pkt)
-		default:
-			return
-		}
-	}
-}
--- a/peer/multicast/broadcaster.go
+++ b/peer/multicast/broadcaster.go
@@ -0,0 +1,62 @@
+package multicast
+
+import (
+	"log"
+	"net"
+	"net/netip"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+var addr = net.UDPAddrFromAddrPort(netip.AddrPortFrom(
+	netip.AddrFrom4([4]byte{224, 0, 0, 157}),
+	4560))
+
+func Broadcast(
+	selfVPNIP netip.Addr,
+	pubKey wgtypes.Key,
+	wgPort uint16,
+	signKey *[64]byte,
+) {
+	for {
+		broadcastInner(selfVPNIP, pubKey, wgPort, signKey)
+		time.Sleep(errorTimeout)
+	}
+}
+
+func broadcastInner(selfVPNIP netip.Addr, pubKey wgtypes.Key, wgPort uint16, signKey *[64]byte) {
+	conn, err := net.ListenMulticastUDP("udp", nil, addr)
+	if err != nil {
+		log.Printf("[MCBroadcast] bind: %v", err)
+		return
+	}
+	defer conn.Close()
+
+	buf := make([]byte, BufferSize)
+	packet := Packet{
+		PeerIP:   selfVPNIP.As4()[3],
+		WGPubKey: pubKey,
+		WGPort:   wgPort,
+	}
+
+	// Re-sign on each send so the timestamp is fresh; a stale timestamp would be
+	// dropped by receivers' freshness gate.
+	send := func() error {
+		packet.Timestamp = time.Now().Unix()
+		payload := packet.Marshal(buf, signKey)
+		_, err := conn.WriteToUDP(payload, addr)
+		return err
+	}
+
+	if err := send(); err != nil {
+		log.Printf("[MCBroadcast] write: %v", err)
+	}
+
+	for range time.Tick(broadcastInterval) {
+		if err := send(); err != nil {
+			log.Printf("[MCBroadcast] write: %v", err)
+			return
+		}
+	}
+}
--- a/peer/multicast/global.go
+++ b/peer/multicast/global.go
@@ -0,0 +1,9 @@
+package multicast
+
+import "time"
+
+const (
+	errorTimeout      = 16 * time.Second
+	broadcastInterval = 16 * time.Second
+	maxPacketAge      = time.Minute
+)
--- a/peer/multicast/packet.go
+++ b/peer/multicast/packet.go
@@ -0,0 +1,54 @@
+package multicast
+
+import (
+	"encoding/binary"
+	"net/netip"
+
+	"golang.org/x/crypto/nacl/sign"
+)
+
+const (
+	BufferSize       = packetSize + SignedPacketSize
+	SignedPacketSize = packetSize + signSize
+	packetSize       = 43
+	signSize         = 64
+)
+
+// Layout:
+//
+// [0]      final octet of the sender's VPN IP
+// [1:33]   WG public key
+// [33:35]  WG listen port (big-endian uint16)
+// [35:43]  send time, Unix seconds (big-endian int64) — freshness/replay gate
+type Packet struct {
+	PeerIP    byte       // Final octet of the sender's VPN IP.
+	WGPubKey  [32]byte   // WG public key.
+	WGPort    uint16     // WG listen port.
+	Timestamp int64      // Unix timestamp.
+	Src       netip.Addr // Source of packet.
+	Signed    []byte     // Raw signed message for verification (incoming packet).
+}
+
+// Marshal the packet into a buffer with prefixed signature.
+func (p Packet) Marshal(buf []byte, signKey *[64]byte) []byte {
+	buf[0] = p.PeerIP
+	copy(buf[1:33], p.WGPubKey[:])
+	binary.BigEndian.PutUint16(buf[33:35], p.WGPort)
+	binary.BigEndian.PutUint64(buf[35:43], uint64(p.Timestamp))
+	return sign.Sign(buf[packetSize:packetSize], buf[:packetSize], signKey)
+}
+
+func (p Packet) Verify(buf []byte, pubKey *[32]byte) bool {
+	_, ok := sign.Open(buf, p.Signed, pubKey)
+	return ok
+}
+
+func Unmarshal(signed []byte) (p Packet) {
+	buf := signed[signSize:]
+	p.PeerIP = buf[0]
+	copy(p.WGPubKey[:], buf[1:33])
+	p.WGPort = binary.BigEndian.Uint16(buf[33:35])
+	p.Timestamp = int64(binary.BigEndian.Uint64(buf[35:43]))
+	p.Signed = signed
+	return
+}
--- a/peer/multicast/packet_test.go
+++ b/peer/multicast/packet_test.go
@@ -0,0 +1,38 @@
+package multicast
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"golang.org/x/crypto/nacl/sign"
+)
+
+func TestPacket(t *testing.T) {
+	pub, priv, err := sign.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	p := Packet{
+		PeerIP:    10,
+		WGPubKey:  [32]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2},
+		WGPort:    44,
+		Timestamp: 12948893,
+	}
+
+	buf := make([]byte, BufferSize)
+	signed := p.Marshal(buf, priv)
+	if len(signed) != SignedPacketSize {
+		t.Fatalf("signed length = %d, want %d", len(signed), SignedPacketSize)
+	}
+
+	got := Unmarshal(signed)
+	if got.PeerIP != p.PeerIP || got.WGPubKey != p.WGPubKey ||
+		got.WGPort != p.WGPort || got.Timestamp != p.Timestamp {
+		t.Fatalf("round-trip mismatch:\n got %+v\nwant %+v", got, p)
+	}
+
+	if !got.Verify(nil, pub) {
+		t.Error("signature did not verify")
+	}
+}
--- a/peer/multicast/receiver.go
+++ b/peer/multicast/receiver.go
@@ -0,0 +1,61 @@
+package multicast
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"net"
+	"net/netip"
+	"time"
+)
+
+func Receiver(vpnNet netip.Prefix, selfVPNIP netip.Addr, ch chan<- Packet) {
+	for {
+		if err := receiver(vpnNet, selfVPNIP, ch); err != nil {
+			log.Printf("[MCReader] %v", err)
+		}
+		time.Sleep(errorTimeout)
+	}
+}
+
+func receiver(vpnNet netip.Prefix, selfVPNIP netip.Addr, ch chan<- Packet) error {
+	selfIP := selfVPNIP.As4()[3]
+
+	conn, err := net.ListenMulticastUDP("udp", nil, addr)
+	if err != nil {
+		return fmt.Errorf("bind: %w", err)
+	}
+	defer conn.Close()
+
+	buf := make([]byte, BufferSize+1) // +1 to detect oversized packets
+
+	for {
+		conn.SetReadDeadline(time.Now().Add(32 * time.Second))
+		n, src, err := conn.ReadFromUDPAddrPort(buf)
+		if err != nil {
+			if ne, ok := err.(net.Error); ok && ne.Timeout() {
+				continue
+			}
+			return fmt.Errorf("read: %w", err)
+		}
+
+		if n != SignedPacketSize {
+			continue
+		}
+
+		packet := Unmarshal(buf[:n])
+
+		if packet.PeerIP == selfIP {
+			continue
+		}
+
+		age := time.Since(time.Unix(packet.Timestamp, 0))
+		if age > maxPacketAge || age < -maxPacketAge {
+			continue
+		}
+
+		packet.Signed = bytes.Clone(packet.Signed)
+		packet.Src = src.Addr().Unmap()
+		ch <- packet
+	}
+}
--- a/peer/network_state.go
+++ b/peer/network_state.go
@@ -0,0 +1,18 @@
+package peer
+
+import "vppn/m"
+
+// loadNetworkState reads a cached network state from disk. Any error (most
+// commonly a missing file on first run) is returned to the caller, which
+// treats it as "no cache available".
+func loadNetworkState(path string) (m.NetworkState, error) {
+	var state m.NetworkState
+	err := loadJSON(path, &state)
+	return state, err
+}
+
+// saveNetworkState writes state to path atomically (see storeJSON), so a crash
+// mid-write cannot leave a corrupt cache.
+func saveNetworkState(path string, state m.NetworkState) error {
+	return storeJSON(path, state)
+}
--- a/peer/network_state_test.go
+++ b/peer/network_state_test.go
@@ -0,0 +1,56 @@
+package peer
+
+import (
+	"net/netip"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"vppn/m"
+)
+
+func TestNetworkState_RoundTrip(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "network.json")
+
+	var sign1 [32]byte
+	copy(sign1[:], []byte("0123456789abcdef0123456789abcdef"))
+
+	state := m.NetworkState{Peers: []m.Peer{
+		{
+			PeerIP:     1,
+			Name:       "hub",
+			Addr4:      netip.MustParseAddr("10.11.12.1"),
+			Port:       51820,
+			Relay:      true,
+			WGPubKey:   mustKey(t),
+			SignPubKey: sign1,
+		},
+		{
+			PeerIP:   10,
+			Name:     "laptop",
+			Addr4:    netip.MustParseAddr("10.11.12.10"),
+			Port:     51820,
+			WGPubKey: mustKey(t),
+		},
+	}}
+
+	if err := saveNetworkState(path, state); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := loadNetworkState(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(got, state) {
+		t.Errorf("round-trip mismatch:\n got: %+v\nwant: %+v", got.Peers[1], state.Peers[1])
+	}
+}
+
+func TestNetworkState_LoadMissing(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "does-not-exist.json")
+	if _, err := loadNetworkState(path); err == nil {
+		t.Fatal("expected error loading missing cache, got nil")
+	}
+}
--- a/peer/new.go
+++ b/peer/new.go
@@ -0,0 +1,109 @@
+package peer
+
+import (
+	"fmt"
+	"net/netip"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"vppn/m"
+	"vppn/peer/multicast"
+	"vppn/peer/wginterface"
+)
+
+// New constructs an App, creates the WireGuard interface, and starts the
+// background goroutines (hub poller, multicast, control conn reader).
+// The caller should invoke Run() to start the event loop.
+func New(
+	state LocalState,
+	hubURL, apiKey string,
+	ifaceName string,
+	localDomain string,
+	networkStatePath string,
+) (*App, error) {
+
+	a4 := state.VPNIP.As4()
+	if err := wginterface.Create(ifaceName, a4[:], 24); err != nil {
+		return nil, fmt.Errorf("create WG interface: %w", err)
+	}
+
+	dev, err := wginterface.Open(ifaceName)
+	if err != nil {
+		_ = wginterface.Delete(ifaceName)
+		return nil, fmt.Errorf("open WG device: %w", err)
+	}
+
+	cc, err := newUDPControlConn(state.VPNIP, ControlPort)
+	if err != nil {
+		_ = dev.Close()
+		_ = wginterface.Delete(ifaceName)
+		return nil, fmt.Errorf("control conn: %w", err)
+	}
+
+	cleanup := func() {
+		_ = cc.Close()
+		_ = dev.Close()
+		_ = wginterface.Delete(ifaceName)
+	}
+
+	if err := dev.Configure(state.PrivKey, int(state.WGPort)); err != nil {
+		cleanup()
+		return nil, fmt.Errorf("configure WG device: %w", err)
+	}
+
+	if state.IsRelay {
+		if err := dev.EnableForwarding(); err != nil {
+			cleanup()
+			return nil, fmt.Errorf("enable forwarding: %w", err)
+		}
+	}
+
+	pingCh := make(chan PingEvent)
+	hubAddCh := make(chan m.Peer)
+	hubRemoveCh := make(chan wgtypes.Key)
+	multicastCh := make(chan multicast.Packet)
+
+	poller, err := NewHubPoller(
+		state.VPNIP,
+		state.VPNNet,
+		hubURL,
+		apiKey,
+		networkStatePath,
+		hubAddCh,
+		hubRemoveCh)
+	if err != nil {
+		cleanup()
+		return nil, fmt.Errorf("hub poller: %w", err)
+	}
+
+	go cc.run(pingCh)
+	go poller.Run()
+
+	if !state.IsPublic {
+		go multicast.Broadcast(state.VPNIP, state.PrivKey.PublicKey(), state.WGPort, &state.SignKey)
+		go multicast.Receiver(state.VPNNet, state.VPNIP, multicastCh)
+	}
+
+	return &App{
+		vpnIP:       state.VPNIP,
+		vpnNet:      state.VPNNet,
+		privKey:     state.PrivKey,
+		pubKey:      state.PrivKey.PublicKey(),
+		isRelay:     state.IsRelay,
+		isPublic:    state.IsPublic,
+		localDomain: localDomain,
+
+		dev:         dev,
+		controlConn: cc,
+
+		peersByKey: make(map[wgtypes.Key]*Peer),
+		peersByIP:  make(map[netip.Addr]*Peer),
+
+		scratch: make([]byte, scratchSize),
+
+		hubAddCh:    hubAddCh,
+		hubRemoveCh: hubRemoveCh,
+		pingCh:      pingCh,
+		multicastCh: multicastCh,
+	}, nil
+}
--- a/peer/on_hub.go
+++ b/peer/on_hub.go
@@ -0,0 +1,114 @@
+package peer
+
+import (
+	"log"
+	"math"
+	"net/netip"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"vppn/m"
+	"vppn/peer/control"
+)
+
+func (a *App) onAddPeer(p m.Peer) {
+	a.onRemovePeer(p.WGPubKey)
+
+	octets := a.vpnNet.Addr().As4()
+	octets[3] = p.PeerIP
+	vpnIP := netip.AddrFrom4(octets)
+
+	peer := &Peer{
+		wgPeer:     wgtypes.Peer{PublicKey: p.WGPubKey},
+		VPNIP:      vpnIP,
+		Name:       p.Name,
+		IsRelay:    p.Relay,
+		IsPublic:   p.IsPublic(),
+		EndpointV4: p.Endpoint4(),
+		EndpointV6: p.Endpoint6(),
+		RTT:        time.Duration(math.MaxInt64) * time.Nanosecond,
+		Role:       roleFor(a.isPublic, a.vpnIP, p.IsPublic(), vpnIP),
+		SignPubKey: p.SignPubKey,
+	}
+
+	a.peersByKey[p.WGPubKey] = peer
+	a.peersByIP[peer.VPNIP] = peer
+	defer a.updateHosts()
+
+	if !peer.IsPublic {
+		if a.isPublic {
+			// Public nodes accept traffic from non-public peers as soon as they
+			// initiate a handshake. Set /32 AllowedIPs now; WireGuard learns the
+			// endpoint from the incoming handshake automatically.
+			a.devPromote(peer)
+		} else {
+			a.devAddPeer(peer)
+		}
+		return
+	}
+
+	a.devAddDirect(peer, peer.PreferredEndpoint())
+}
+
+func (a *App) onRemovePeer(key wgtypes.Key) {
+	peer, exists := a.peersByKey[key]
+	if !exists {
+		return
+	}
+	a.devRemove(peer)
+	delete(a.peersByKey, key)
+	delete(a.peersByIP, peer.VPNIP)
+	a.updateHosts()
+
+	if peer == a.relay {
+		a.relay = nil
+		a.switchActiveRelay()
+	}
+}
+
+// switchActiveRelay promotes the lowest-latency relay peer to active.
+func (a *App) switchActiveRelay() {
+	if a.relay != nil {
+		// If we have a relay, it's public, so should go back to being a direct
+		// peer - this will convert it's /24 to a /32.
+		a.devAddDirect(a.relay, a.relay.PreferredEndpoint())
+		a.relay = nil
+	}
+
+	var best *Peer
+	for _, p := range a.peersByKey {
+		if !p.CanRelay() {
+			continue
+		}
+
+		if best == nil || p.RTT < best.RTT {
+			best = p
+		}
+	}
+	if best == nil {
+		log.Printf("no relay available")
+		return
+	}
+
+	a.devSetRelay(best, best.PreferredEndpoint())
+	a.relay = best
+}
+
+func preferredEndpoint(v4, v6 netip.AddrPort) netip.AddrPort {
+	// We always prefer v4 since all peers can connect to IPv4 addresses.
+	if v4.IsValid() {
+		return v4
+	}
+	return v6
+}
+
+func roleFor(selfIsPublic bool, selfIP netip.Addr, peerIsPublic bool, peerVPNIP netip.Addr) control.Role {
+	if !selfIsPublic && peerIsPublic {
+		return control.Client
+	}
+	if selfIsPublic && !peerIsPublic {
+		return control.Server
+	}
+	return control.RoleFor(selfIP, peerVPNIP)
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
jdl	926e111c3f	Cleanup	2026-06-12 18:22:25 +02:00
J. David Lee	9a3cb2d1c2	Refactor - now wireguard based. (#7 )	2026-06-12 15:11:01 +00:00
jdl	5ae075647d	Bug fixes	2025-09-25 10:03:37 +02:00
jdl	29bbb442c8	Cleanup	2025-09-25 09:08:10 +02:00
J. David Lee	3d93c0206c	client-interface-cleanup (#6 ) Refactoring and code cleanup. Improved client command interface.	2025-09-17 08:00:12 +00:00
jdl	75c7c2d3d9	README cleanup.	2025-09-04 11:29:26 +02:00
jdl	c61319ed16	Cleanup	2025-09-03 20:41:35 +02:00
jdl	0a7328ed5f	Refactor	2025-09-01 18:15:42 +02:00
jdl	5f0b00ff46	Refactor	2025-09-01 18:09:24 +02:00
jdl	e91cbfe957	Merge branch 'refactor-2025'	2025-09-01 18:05:42 +02:00
jdl	7c476fc332	WIP: Cleanup	2025-09-01 18:03:09 +02:00
jdl	69823d1d19	WIP	2025-09-01 18:00:41 +02:00
jdl	b7cb4e20f0	WIP	2025-08-26 19:50:59 +02:00
jdl	6382c13d1a	WIP	2025-08-26 19:12:07 +02:00
jdl	1ca55158c2	wip	2025-08-26 17:01:38 +02:00
jdl	302d27692b	WIP: Cleanup	2025-08-26 16:57:46 +02:00
jdl	31c48fbafd	Cleanup	2025-08-26 16:20:47 +02:00
jdl	3c4534f620	WIP: Fixed rate limiting	2025-08-26 16:17:46 +02:00
jdl	169231d848	WIP: Apparently working?	2025-08-26 16:11:21 +02:00
jdl	f4589a1031	Don't crash	2025-08-26 15:45:06 +02:00
jdl	ab246b2a90	WIP	2025-08-26 15:33:27 +02:00
J. David Lee	b9e773ec83	Update - modify hub to support multiple networks. (#4 ) Co-authored-by: jdl <jdl@desktop> Reviewed-on: #4	2025-04-12 11:43:18 +00:00
jdl	d558ebbd14	WIP	2025-04-06 07:51:47 +02:00
				`@@ -1 +0,0 @@`
				`ALTER TABLE peers ADD COLUMN PubSignKey BLOB NOT NULL DEFAULT '';`