first commit

2026-06-15 13:58:45 +01:00
commit c9868b2108
55 changed files with 11076 additions and 0 deletions
@@ -0,0 +1,50 @@
+name: Agent Release
+
+on:
+  push:
+    tags:
+      - "agent/v*"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+          cache: true
+          cache-dependency-path: agent/go.sum
+
+      - name: Extract version
+        id: version
+        run: echo "VERSION=${GITHUB_REF_NAME#agent/}" >> $GITHUB_OUTPUT
+
+      - name: Build
+        working-directory: agent
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
+        run: |
+          mkdir -p dist
+          GOOS=linux GOARCH=amd64 go build \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o dist/keymanager-agent-linux-amd64 ./cmd
+          GOOS=linux GOARCH=arm64 go build \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o dist/keymanager-agent-linux-arm64 ./cmd
+
+      - name: Checksums
+        working-directory: agent/dist
+        run: sha256sum keymanager-agent-linux-amd64 keymanager-agent-linux-arm64 > checksums.txt
+
+      - name: Create release
+        uses: https://gitea.com/actions/gitea-release-action@v1
+        with:
+          token: ${{ secrets.RELEASE_TOKEN }}
+          files: |
+            agent/dist/keymanager-agent-linux-amd64
+            agent/dist/keymanager-agent-linux-arm64
+            agent/dist/checksums.txt
@@ -0,0 +1,50 @@
+name: Server Deploy
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "server/**"
+      - "web/**"
+      - "proto/**"
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
+            docker login ${{ vars.GITEA_HOST }} \
+              -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Build and push server image
+        run: |
+          IMAGE="${{ vars.GITEA_HOST }}/${{ github.repository_owner }}/keymanager/server:latest"
+          docker build -t "$IMAGE" -f server/Dockerfile server/
+          docker push "$IMAGE"
+
+      - name: Build and push web image
+        run: |
+          IMAGE="${{ vars.GITEA_HOST }}/${{ github.repository_owner }}/keymanager/web:latest"
+          docker build \
+            --build-arg NEXT_PUBLIC_API_URL="https://${{ vars.GITEA_HOST }}" \
+            -t "$IMAGE" \
+            -f web/Dockerfile web/
+          docker push "$IMAGE"
+
+      - name: Deploy via SSH
+        uses: https://github.com/appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            cd /opt/keymanager
+            docker compose pull
+            docker compose up -d --remove-orphans
+            docker image prune -f
@@ -0,0 +1,4 @@
+node_modules
+dist
+build
+.env
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"flag"
+	"log"
+
+	"github.com/mrhid6/keymanager/agent/internal/config"
+	agentsync "github.com/mrhid6/keymanager/agent/internal/sync"
+)
+
+var Version = "dev"
+
+func main() {
+	genKey := flag.String("generate-key", "", "Generate SSH keypair and upload with this label")
+	flag.Parse()
+
+	cfg, err := config.Load()
+	if err != nil {
+		log.Fatalf("failed to load config: %v", err)
+	}
+
+	if *genKey != "" {
+		if err := agentsync.GenerateAndUpload(cfg, *genKey); err != nil {
+			log.Fatalf("key generation failed: %v", err)
+		}
+		return
+	}
+
+	log.Printf("keymanager-agent %s starting (server=%s, poll=%s)", Version, cfg.ServerURL, cfg.PollInterval)
+	if err := agentsync.Run(cfg); err != nil {
+		log.Fatalf("agent error: %v", err)
+	}
+}
@@ -0,0 +1,16 @@
+module github.com/mrhid6/keymanager/agent
+
+go 1.26
+
+require (
+	google.golang.org/grpc v1.64.0
+	gopkg.in/yaml.v3 v3.0.1
+)
+
+require (
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e // indirect
+	google.golang.org/protobuf v1.34.1 // indirect
+)
@@ -0,0 +1,18 @@
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e h1:Elxv5MwEkCI9f5SkoL6afed6NTdxaGoAo39eANBwHL8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
+google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=
+google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
+google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
+google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -0,0 +1,45 @@
+package config
+
+import (
+	"os"
+	"time"
+
+	"gopkg.in/yaml.v3"
+)
+
+const ConfigPath = "/etc/keymanager/config.yaml"
+
+type Config struct {
+	ServerURL    string        `yaml:"server_url"`
+	ServerID     string        `yaml:"server_id"`
+	PreRegToken  string        `yaml:"pre_reg_token"`
+	AgentToken   string        `yaml:"agent_token"`
+	PollInterval time.Duration `yaml:"poll_interval"`
+	TLS          bool          `yaml:"tls"`
+}
+
+func Load() (*Config, error) {
+	data, err := os.ReadFile(ConfigPath)
+	if err != nil {
+		return nil, err
+	}
+	var cfg Config
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
+		return nil, err
+	}
+	if cfg.PollInterval == 0 {
+		cfg.PollInterval = 30 * time.Second
+	}
+	return &cfg, nil
+}
+
+func Save(cfg *Config) error {
+	data, err := yaml.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll("/etc/keymanager", 0700); err != nil {
+		return err
+	}
+	return os.WriteFile(ConfigPath, data, 0600)
+}
@@ -0,0 +1,100 @@
+package grpcclient
+
+import (
+	"context"
+	"crypto/tls"
+	"time"
+
+	"github.com/mrhid6/keymanager/agent/internal/grpc/pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/encoding"
+)
+
+func init() {
+	encoding.RegisterCodec(JSONCodec{})
+}
+
+type Client struct {
+	conn   *grpc.ClientConn
+	client pb.KeyManagerClient
+}
+
+func New(serverURL string, useTLS bool) (*Client, error) {
+	var dialOpts []grpc.DialOption
+
+	if useTLS {
+		tlsCfg := &tls.Config{
+			InsecureSkipVerify: false,
+		}
+		creds := credentials.NewTLS(tlsCfg)
+		dialOpts = append(dialOpts, grpc.WithTransportCredentials(creds))
+	} else {
+		dialOpts = append(dialOpts, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	conn, err := grpc.DialContext(ctx, serverURL, dialOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Client{
+		conn:   conn,
+		client: pb.NewKeyManagerClient(conn),
+	}, nil
+}
+
+func (c *Client) Close() error {
+	return c.conn.Close()
+}
+
+func (c *Client) Register(serverID, preRegToken, hostname, ipAddress, osInfo string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	resp, err := c.client.Register(ctx, &pb.RegisterRequest{
+		ServerId:    serverID,
+		PreRegToken: preRegToken,
+		Hostname:    hostname,
+		IpAddress:   ipAddress,
+		OsInfo:      osInfo,
+	})
+	if err != nil {
+		return "", err
+	}
+	return resp.AgentToken, nil
+}
+
+func (c *Client) SyncKeys(serverID, agentToken string) ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	resp, err := c.client.SyncKeys(ctx, &pb.SyncRequest{
+		ServerId:   serverID,
+		AgentToken: agentToken,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return resp.PublicKeys, nil
+}
+
+func (c *Client) UploadGeneratedKey(serverID, agentToken, publicKey, label string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	resp, err := c.client.UploadGeneratedKey(ctx, &pb.UploadKeyRequest{
+		ServerId:   serverID,
+		AgentToken: agentToken,
+		PublicKey:  publicKey,
+		Label:      label,
+	})
+	if err != nil {
+		return "", err
+	}
+	return resp.KeyId, nil
+}
@@ -0,0 +1,17 @@
+package grpcclient
+
+import "encoding/json"
+
+type JSONCodec struct{}
+
+func (JSONCodec) Marshal(v interface{}) ([]byte, error) {
+	return json.Marshal(v)
+}
+
+func (JSONCodec) Unmarshal(data []byte, v interface{}) error {
+	return json.Unmarshal(data, v)
+}
+
+func (JSONCodec) Name() string {
+	return "proto"
+}
@@ -0,0 +1,93 @@
+// Hand-written gRPC bindings for keymanager.proto (agent side, JSON codec).
+
+package pb
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type RegisterRequest struct {
+	ServerId    string `json:"server_id"`
+	PreRegToken string `json:"pre_reg_token"`
+	Hostname    string `json:"hostname"`
+	IpAddress   string `json:"ip_address"`
+	OsInfo      string `json:"os_info"`
+}
+
+type RegisterResponse struct {
+	AgentToken string `json:"agent_token"`
+}
+
+type SyncRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+
+type SyncResponse struct {
+	PublicKeys []string `json:"public_keys"`
+}
+
+type UploadKeyRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+	PublicKey  string `json:"public_key"`
+	Label      string `json:"label"`
+}
+
+type UploadKeyResponse struct {
+	KeyId string `json:"key_id"`
+}
+
+type KeyManagerClient interface {
+	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
+	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
+	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
+}
+
+type UnimplementedKeyManagerServer struct{}
+
+func (UnimplementedKeyManagerServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "not implemented")
+}
+func (UnimplementedKeyManagerServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "not implemented")
+}
+func (UnimplementedKeyManagerServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "not implemented")
+}
+
+type keyManagerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewKeyManagerClient(cc grpc.ClientConnInterface) KeyManagerClient {
+	return &keyManagerClient{cc}
+}
+
+func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
+	out := new(RegisterResponse)
+	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/Register", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
+	out := new(SyncResponse)
+	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/SyncKeys", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
+	out := new(UploadKeyResponse)
+	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/UploadGeneratedKey", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
@@ -0,0 +1,120 @@
+package keys
+
+import (
+	"crypto/md5"
+	"encoding/base64"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+const authorizedKeysPath = "/root/.ssh/authorized_keys"
+
+func ReadAuthorizedKeys() ([]string, error) {
+	data, err := os.ReadFile(authorizedKeysPath)
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	var lines []string
+	for _, line := range strings.Split(string(data), "\n") {
+		line = strings.TrimSpace(line)
+		if line != "" && !strings.HasPrefix(line, "#") {
+			lines = append(lines, line)
+		}
+	}
+	return lines, nil
+}
+
+func WriteAuthorizedKeys(keys []string) error {
+	dir := filepath.Dir(authorizedKeysPath)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		return fmt.Errorf("mkdir %s: %w", dir, err)
+	}
+
+	content := strings.Join(keys, "\n")
+	if len(keys) > 0 {
+		content += "\n"
+	}
+
+	tmpPath := authorizedKeysPath + ".tmp"
+	if err := os.WriteFile(tmpPath, []byte(content), 0600); err != nil {
+		return fmt.Errorf("write tmp: %w", err)
+	}
+
+	if err := os.Rename(tmpPath, authorizedKeysPath); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("rename: %w", err)
+	}
+
+	return os.Chmod(authorizedKeysPath, 0600)
+}
+
+func FingerprintLines(lines []string) map[string]bool {
+	fp := make(map[string]bool, len(lines))
+	for _, line := range lines {
+		fp[fingerprint(line)] = true
+	}
+	return fp
+}
+
+func StateChanged(current, desired []string) bool {
+	if len(current) != len(desired) {
+		return true
+	}
+	cur := FingerprintLines(current)
+	for _, line := range desired {
+		if !cur[fingerprint(line)] {
+			return true
+		}
+	}
+	return false
+}
+
+func fingerprint(pubKey string) string {
+	parts := strings.Fields(pubKey)
+	if len(parts) < 2 {
+		return pubKey
+	}
+	raw, err := base64.StdEncoding.DecodeString(parts[1])
+	if err != nil {
+		return pubKey
+	}
+	sum := md5.Sum(raw)
+	var pairs []string
+	for _, b := range sum {
+		pairs = append(pairs, fmt.Sprintf("%02x", b))
+	}
+	return "MD5:" + strings.Join(pairs, ":")
+}
+
+// GenerateKeyPair generates an ed25519 SSH keypair and returns the public key.
+// The private key is written to keyPath; keyPath+".pub" holds the public key.
+func GenerateKeyPair(keyPath, comment string) (string, error) {
+	if err := os.MkdirAll(filepath.Dir(keyPath), 0700); err != nil {
+		return "", err
+	}
+
+	args := []string{
+		"-t", "ed25519",
+		"-f", keyPath,
+		"-N", "",
+		"-C", comment,
+	}
+	cmd := exec.Command("ssh-keygen", args...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return "", fmt.Errorf("ssh-keygen: %w: %s", err, out)
+	}
+
+	pubData, err := os.ReadFile(keyPath + ".pub")
+	if err != nil {
+		return "", fmt.Errorf("read pubkey: %w", err)
+	}
+	return strings.TrimSpace(string(pubData)), nil
+}
@@ -0,0 +1,129 @@
+package agentsync
+
+import (
+	"fmt"
+	"log"
+	"net"
+	"os"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/mrhid6/keymanager/agent/internal/config"
+	grpcclient "github.com/mrhid6/keymanager/agent/internal/grpc"
+	"github.com/mrhid6/keymanager/agent/internal/keys"
+)
+
+func Run(cfg *config.Config) error {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return fmt.Errorf("dial grpc: %w", err)
+	}
+	defer client.Close()
+
+	// Register if we have a pre-reg token
+	if cfg.PreRegToken != "" {
+		log.Println("registering with server...")
+		hostname, _ := os.Hostname()
+		ipAddress := localIP()
+		osInfo := fmt.Sprintf("%s %s", runtime.GOOS, runtime.GOARCH)
+
+		agentToken, err := client.Register(cfg.ServerID, cfg.PreRegToken, hostname, ipAddress, osInfo)
+		if err != nil {
+			return fmt.Errorf("registration failed: %w", err)
+		}
+
+		cfg.AgentToken = agentToken
+		cfg.PreRegToken = ""
+		if err := config.Save(cfg); err != nil {
+			return fmt.Errorf("save config: %w", err)
+		}
+		log.Println("registration successful")
+
+		// Reconnect with potentially updated state
+		client.Close()
+		client, err = grpcclient.New(cfg.ServerURL, cfg.TLS)
+		if err != nil {
+			return fmt.Errorf("reconnect: %w", err)
+		}
+	}
+
+	if cfg.AgentToken == "" {
+		return fmt.Errorf("no agent token available — registration required")
+	}
+
+	ticker := time.NewTicker(cfg.PollInterval)
+	defer ticker.Stop()
+
+	// Run immediately on startup
+	if err := poll(client, cfg); err != nil {
+		log.Printf("poll error: %v", err)
+	}
+
+	for range ticker.C {
+		if err := poll(client, cfg); err != nil {
+			log.Printf("poll error: %v", err)
+		}
+	}
+	return nil
+}
+
+func poll(client *grpcclient.Client, cfg *config.Config) error {
+	desired, err := client.SyncKeys(cfg.ServerID, cfg.AgentToken)
+	if err != nil {
+		return fmt.Errorf("SyncKeys: %w", err)
+	}
+
+	current, err := keys.ReadAuthorizedKeys()
+	if err != nil {
+		return fmt.Errorf("read authorized_keys: %w", err)
+	}
+
+	if !keys.StateChanged(current, desired) {
+		log.Println("authorized_keys unchanged, skipping write")
+		return nil
+	}
+
+	if err := keys.WriteAuthorizedKeys(desired); err != nil {
+		return fmt.Errorf("write authorized_keys: %w", err)
+	}
+	log.Printf("authorized_keys updated (%d keys)", len(desired))
+	return nil
+}
+
+func localIP() string {
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return ""
+	}
+	for _, addr := range addrs {
+		if ipNet, ok := addr.(*net.IPNet); ok && !ipNet.IP.IsLoopback() {
+			if ipNet.IP.To4() != nil {
+				return ipNet.IP.String()
+			}
+		}
+	}
+	return ""
+}
+
+// GenerateAndUpload generates an SSH keypair and uploads the public key to the server.
+func GenerateAndUpload(cfg *config.Config, label string) error {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	keyPath := fmt.Sprintf("/root/.ssh/keymanager_%s", strings.ReplaceAll(label, " ", "_"))
+	pubKey, err := keys.GenerateKeyPair(keyPath, label)
+	if err != nil {
+		return err
+	}
+
+	keyID, err := client.UploadGeneratedKey(cfg.ServerID, cfg.AgentToken, pubKey, label)
+	if err != nil {
+		return err
+	}
+	log.Printf("uploaded generated key %s (key_id=%s)", label, keyID)
+	return nil
+}
@@ -0,0 +1,351 @@
+# KeyManager
+
+A self-hosted SSH key management system. A central server (Go + Next.js + MongoDB) manages public key assignments across servers. A lightweight Go agent runs on each managed server, polls the central server via gRPC, and atomically rewrites `/root/.ssh/authorized_keys` to match the desired state.
+
+---
+
+## Architecture Overview
+
+```
+┌─────────────────────────────────┐
+│  Next.js Frontend               │
+│  - Upload/manage keys           │
+│  - Add servers (install script) │
+│  - Assign/revoke per server     │
+└────────────┬────────────────────┘
+             │ REST
+┌────────────▼────────────────────┐
+│  Go Backend                     │
+│  - REST API for frontend        │
+│  - gRPC server for agents       │
+│  - MongoDB                      │
+└────────────┬────────────────────┘
+             │ gRPC (TLS)
+┌────────────▼────────────────────┐
+│  Go Agent (per server)          │
+│  - Polls every 30s              │
+│  - Rewrites authorized_keys     │
+│  - Can generate SSH keypairs    │
+└─────────────────────────────────┘
+```
+
+---
+
+## Repository Structure
+
+```
+keymanager/
+├── agent/
+│   ├── cmd/main.go
+│   └── internal/
+│       ├── config/
+│       ├── grpc/
+│       ├── keys/
+│       └── sync/
+├── server/
+│   ├── cmd/main.go
+│   └── internal/
+│       ├── api/          # REST handlers for Next.js
+│       ├── grpc/         # gRPC server implementation
+│       ├── models/       # MongoDB models
+│       └── services/
+│           ├── keys.go
+│           ├── servers.go
+│           └── sync.go   # builds desired state per server
+├── web/
+│   ├── app/
+│   └── components/
+├── proto/
+│   └── keymanager/v1/keymanager.proto
+├── deploy/
+│   ├── docker-compose.yml
+│   └── agent.service
+└── .gitea/
+    └── workflows/
+        ├── agent-release.yml
+        └── server-deploy.yml
+```
+
+---
+
+## gRPC API
+
+```protobuf
+syntax = "proto3";
+package keymanager.v1;
+
+service KeyManager {
+  rpc Register(RegisterRequest)           returns (RegisterResponse);
+  rpc SyncKeys(SyncRequest)               returns (SyncResponse);
+  rpc UploadGeneratedKey(UploadKeyRequest) returns (UploadKeyResponse);
+}
+
+message RegisterRequest {
+  string server_id      = 1;
+  string pre_reg_token  = 2;
+  string hostname       = 3;
+  string ip_address     = 4;
+  string os_info        = 5;
+}
+message RegisterResponse {
+  string agent_token = 1;
+}
+
+message SyncRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+}
+message SyncResponse {
+  repeated string public_keys = 1; // full authorized_keys lines
+}
+
+message UploadKeyRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  string public_key  = 3;
+  string label       = 4;
+}
+message UploadKeyResponse {
+  string key_id = 1;
+}
+```
+
+No streaming — polling only. Poll interval: **30 seconds**.
+
+---
+
+## MongoDB Collections
+
+### `servers`
+
+```json
+{
+    "_id": "ObjectId",
+    "server_id": "uuid",
+    "hostname": "proxmox-node-1",
+    "ip_address": "10.10.10.5",
+    "os_info": "Ubuntu 24.04",
+    "pre_reg_token": "abc123",
+    "pre_reg_expires": "ISODate",
+    "agent_token_hash": "sha256...",
+    "status": "pending|active|offline",
+    "last_seen": "ISODate",
+    "created_at": "ISODate"
+}
+```
+
+- `pre_reg_token` is cleared after the agent successfully calls `Register()`
+- `agent_token_hash` stores SHA-256 of the token — never plaintext
+- `status` transitions: `pending` → `active` on first `Register()`, `offline` if last_seen exceeds threshold
+
+### `keys`
+
+```json
+{
+    "_id": "ObjectId",
+    "key_id": "uuid",
+    "label": "dom-macbook",
+    "public_key": "ssh-ed25519 AAAA...",
+    "fingerprint": "SHA256:...",
+    "source": "uploaded|generated",
+    "generated_by_server_id": "uuid",
+    "created_at": "ISODate"
+}
+```
+
+### `assignments`
+
+```json
+{
+    "_id": "ObjectId",
+    "key_id": "uuid",
+    "server_id": "uuid",
+    "assigned_at": "ISODate",
+    "revoked_at": "ISODate | null"
+}
+```
+
+- `revoked_at: null` = key is active on that server
+- Revocation is soft — set `revoked_at`, agent picks it up on next poll
+
+---
+
+## Agent Lifecycle
+
+### Config file — `/etc/keymanager/config.yaml`
+
+```yaml
+server_url: "keymanager.yourdomain.com:9090"
+server_id: "<uuid>"
+pre_reg_token: "<token>" # removed after first successful Register()
+agent_token: "" # written by agent after Register()
+poll_interval: 30s
+tls: true
+```
+
+Config file permissions: `0600`. Config directory: `0700`.
+
+### Startup flow
+
+```
+1. Load config
+2. If pre_reg_token present:
+     → call Register(server_id, pre_reg_token, hostname, ip, os_info)
+     → save returned agent_token to config
+     → delete pre_reg_token from config
+3. Enter poll loop
+```
+
+### Poll loop (every 30s)
+
+```
+1. Call SyncKeys(server_id, agent_token)
+2. Receive []public_keys
+3. Compute fingerprints of current /root/.ssh/authorized_keys
+4. If state unchanged → skip write
+5. If changed:
+     → write to /root/.ssh/authorized_keys.tmp
+     → os.Rename() to /root/.ssh/authorized_keys  (atomic)
+     → chmod 0600
+```
+
+### Key generation (on demand)
+
+- Triggered by a flag or API call from the server
+- Runs `ssh-keygen` via `exec.Command`
+- Uploads public key via `UploadGeneratedKey()`
+- Private key stays local on the machine
+
+### Systemd unit — `/etc/systemd/system/keymanager-agent.service`
+
+```ini
+[Unit]
+Description=KeyManager Agent
+After=network.target
+
+[Service]
+ExecStart=/usr/local/bin/keymanager-agent
+Restart=always
+RestartSec=10
+User=root
+
+[Install]
+WantedBy=multi-user.target
+```
+
+---
+
+## Server Registration Flow
+
+1. Click **Add Server** in the UI
+2. Backend generates a short-lived pre-registration token (TTL: 1 hour) and a `server_id`
+3. UI displays a one-liner install command with copy button:
+    ```bash
+    curl -fsSL https://keymanager.yourdomain.com/install | \
+      bash -s -- --server-id=<id> --token=<token>
+    ```
+4. Install script:
+    - Detects arch (`amd64` / `arm64`)
+    - Downloads agent binary from Gitea release
+    - Verifies SHA-256 checksum
+    - Writes `/etc/keymanager/config.yaml`
+    - Installs and starts systemd unit
+5. On first `SyncKeys` call, server marks status as `active`
+
+The backend serves `/install` dynamically, injecting the latest agent version by querying the Gitea API for the most recent `agent/v*` release tag.
+
+---
+
+## Security
+
+- gRPC over TLS (Let's Encrypt or self-signed with cert pinning on the agent)
+- Agent authenticates with a per-server token stored at `/etc/keymanager/config.yaml` (`0600`)
+- Server stores `SHA-256(agent_token)` — never the plaintext token
+- Private keys generated by agents are encrypted at rest in MongoDB (AES-256)
+- `authorized_keys` written as `0600`, owned by root
+- Pre-registration tokens are short-lived (1 hour) and single-use
+- Agent runs as `root` (required for `/root/.ssh/authorized_keys` writes)
+
+---
+
+## Frontend Routes
+
+| Route           | Purpose                                                              |
+| --------------- | -------------------------------------------------------------------- |
+| `/servers`      | List all servers, online/offline status badge, last seen timestamp   |
+| `/servers/new`  | Displays the one-liner install script with copy button               |
+| `/servers/[id]` | Keys installed on this server, trigger key generation, remove server |
+| `/keys`         | All keys — label, fingerprint, source, assigned count                |
+| `/keys/[id]`    | Assign key to servers, revoke per server                             |
+
+---
+
+## CI/CD — Gitea Actions
+
+### Agent release — `.gitea/workflows/agent-release.yml`
+
+Triggered by a `agent/v*` tag. Cross-compiles for `linux/amd64` and `linux/arm64`, creates a Gitea release with binaries and checksums.
+
+```yaml
+on:
+    push:
+        tags:
+            - "agent/v*"
+```
+
+Build command:
+
+```bash
+GOOS=linux GOARCH=amd64 go build \
+  -ldflags="-s -w -X main.Version=${VERSION}" \
+  -o dist/keymanager-agent-linux-amd64 ./cmd
+```
+
+Release assets:
+
+- `keymanager-agent-linux-amd64`
+- `keymanager-agent-linux-arm64`
+- `checksums.txt`
+
+### Server deploy — `.gitea/workflows/server-deploy.yml`
+
+Triggered on pushes to `main` touching `server/**`, `web/**`, or `proto/**`. Builds and pushes Docker images to the Gitea container registry, then deploys via SSH:
+
+```bash
+cd /opt/keymanager && docker compose pull && docker compose up -d --remove-orphans
+```
+
+### Tagging convention
+
+```bash
+# Release a new agent version
+git tag agent/v1.0.0 && git push origin agent/v1.0.0
+
+# Server + web deploy automatically on push to main
+git push origin main
+```
+
+### Required Gitea secrets / variables
+
+| Name                | Type     | Value                                      |
+| ------------------- | -------- | ------------------------------------------ |
+| `RELEASE_TOKEN`     | Secret   | Gitea API token with `write:release` scope |
+| `REGISTRY_USER`     | Secret   | Gitea username                             |
+| `REGISTRY_PASSWORD` | Secret   | Gitea token with `write:packages` scope    |
+| `DEPLOY_HOST`       | Secret   | IP/hostname of the server VM               |
+| `DEPLOY_USER`       | Secret   | SSH user for deploy                        |
+| `DEPLOY_SSH_KEY`    | Secret   | Private key for deploy SSH                 |
+| `GITEA_HOST`        | Variable | `gitea.hostxtra.co.uk`                     |
+
+---
+
+## Design Decisions
+
+- **gRPC over REST for agent communication** — strong typing, easy versioning, bi-directional streaming available later if push-based updates are needed
+- **Poll-only, no streaming** — 30s interval is sufficient for a homelab; simplifies agent implementation
+- **Outbound-only agent connections** — no inbound firewall holes required on managed servers
+- **Atomic `authorized_keys` rewrite** — write to `.tmp` then `os.Rename()` prevents partial writes
+- **Fingerprint diffing before write** — avoids unnecessary disk writes on unchanged state
+- **Soft revocation** — `revoked_at` timestamp rather than hard deletes; preserves audit history
+- **root only** — manages `/root/.ssh/authorized_keys` only; no per-user key management
+- **Gitea releases for agent binaries** — slots into existing act_runner CI pipeline; install script queries Gitea API for latest version at serve time
@@ -0,0 +1,23 @@
+[Unit]
+Description=KeyManager Agent
+Documentation=https://github.com/your-org/keymanager
+After=network.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/keymanager-agent
+Restart=always
+RestartSec=10
+User=root
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=keymanager-agent
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=false
+ProtectHome=false
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,45 @@
+services:
+  mongo:
+    image: mongo:8
+    restart: unless-stopped
+    volumes:
+      - mongo_data:/data/db
+    healthcheck:
+      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+  server:
+    build:
+      context: ../server
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+      - "9090:9090"
+    environment:
+      MONGO_URI: mongodb://mongo:27017/keymanager
+      GITEA_HOST: ${GITEA_HOST}
+      PUBLIC_HOST: ${PUBLIC_HOST}
+      GRPC_PORT: "9090"
+      HTTP_PORT: "8080"
+    depends_on:
+      mongo:
+        condition: service_healthy
+
+  web:
+    build:
+      context: ../web
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_API_URL: http://server:8080
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    depends_on:
+      - server
+
+volumes:
+  mongo_data:
@@ -0,0 +1,43 @@
+syntax = "proto3";
+
+package keymanager.v1;
+
+option go_package = "github.com/mrhid6/keymanager/server/internal/grpc/pb";
+
+service KeyManager {
+  rpc Register(RegisterRequest) returns (RegisterResponse);
+  rpc SyncKeys(SyncRequest) returns (SyncResponse);
+  rpc UploadGeneratedKey(UploadKeyRequest) returns (UploadKeyResponse);
+}
+
+message RegisterRequest {
+  string server_id     = 1;
+  string pre_reg_token = 2;
+  string hostname      = 3;
+  string ip_address    = 4;
+  string os_info       = 5;
+}
+
+message RegisterResponse {
+  string agent_token = 1;
+}
+
+message SyncRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+}
+
+message SyncResponse {
+  repeated string public_keys = 1;
+}
+
+message UploadKeyRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  string public_key  = 3;
+  string label       = 4;
+}
+
+message UploadKeyResponse {
+  string key_id = 1;
+}
@@ -0,0 +1,24 @@
+# Build stage
+FROM golang:1.26 AS builder
+
+WORKDIR /app
+
+# Download dependencies first (layer cache)
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy source and build
+COPY . .
+
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.Version=${VERSION}" -o /keymanager-server ./cmd
+
+# Runtime stage
+FROM scratch
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /keymanager-server /keymanager-server
+
+EXPOSE 8080 9090
+
+ENTRYPOINT ["/keymanager-server"]
@@ -0,0 +1,71 @@
+package main
+
+import (
+	"log"
+	"os"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/keymanager/server/internal/api"
+	"github.com/mrhid6/keymanager/server/internal/db"
+	grpcserver "github.com/mrhid6/keymanager/server/internal/grpc"
+	"github.com/mrhid6/keymanager/server/internal/services"
+)
+
+func main() {
+	mongoURI := getEnv("MONGO_URI", "mongodb://localhost:27017")
+	dbName := getEnv("MONGO_DB", "keymanager")
+
+	if err := db.Connect(mongoURI, dbName); err != nil {
+		log.Fatalf("failed to connect to MongoDB: %v", err)
+	}
+	log.Println("connected to MongoDB")
+
+	// Background goroutine to mark offline servers
+	go func() {
+		ticker := time.NewTicker(2 * time.Minute)
+		defer ticker.Stop()
+		for range ticker.C {
+			if err := services.MarkOfflineServers(5 * time.Minute); err != nil {
+				log.Printf("mark offline error: %v", err)
+			}
+		}
+	}()
+
+	// Start gRPC server
+	go func() {
+		if err := grpcserver.StartGRPC(9090); err != nil {
+			log.Fatalf("gRPC server error: %v", err)
+		}
+	}()
+
+	// Start REST server
+	r := gin.Default()
+	r.Use(corsMiddleware())
+	api.RegisterRoutes(r)
+
+	log.Println("REST server listening on :8080")
+	if err := r.Run(":8080"); err != nil {
+		log.Fatalf("REST server error: %v", err)
+	}
+}
+
+func corsMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Access-Control-Allow-Origin", "*")
+		c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+		c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization")
+		if c.Request.Method == "OPTIONS" {
+			c.AbortWithStatus(204)
+			return
+		}
+		c.Next()
+	}
+}
+
+func getEnv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}
@@ -0,0 +1,47 @@
+module github.com/mrhid6/keymanager/server
+
+go 1.26
+
+require (
+	github.com/gin-gonic/gin v1.10.0
+	github.com/google/uuid v1.6.0
+	go.mongodb.org/mongo-driver/v2 v2.2.2
+	google.golang.org/grpc v1.64.0
+)
+
+require (
+	github.com/bytedance/sonic v1.11.6 // indirect
+	github.com/bytedance/sonic/loader v0.1.1 // indirect
+	github.com/cloudwego/base64x v0.1.4 // indirect
+	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
+	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.20.0 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.16.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.2.12 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/scram v1.1.2 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
+	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
+	golang.org/x/arch v0.8.0 // indirect
+	golang.org/x/crypto v0.33.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
@@ -0,0 +1,133 @@
+github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0=
+github.com/bytedance/sonic v1.11.6/go.mod h1:LysEHSvpvDySVdC2f87zGWf6CIKJcAvqab1ZaiQtds4=
+github.com/bytedance/sonic/loader v0.1.1 h1:c+e5Pt1k/cy5wMveRDyk2X4B9hF4g7an8N3zCYjJFNM=
+github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y=
+github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
+github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
+github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
+github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
+github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.20.0 h1:K9ISHbSaI0lyB2eWMPJo+kOS/FBExVwjEviJTixqxL8=
+github.com/go-playground/validator/v10 v10.20.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
+github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
+github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
+github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
+github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.mongodb.org/mongo-driver/v2 v2.2.2 h1:9cYuS3fl1Xhqwpfazso10V7BHQD58kCgtzhfAmJYz9c=
+go.mongodb.org/mongo-driver/v2 v2.2.2/go.mod h1:qQkDMhCGWl3FN509DfdPd4GRBLU/41zqF/k8eTRceps=
+golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
+golang.org/x/arch v0.8.0 h1:3wRIsP3pM4yUptoR96otTUOXI367OS0+c9eeRi9doIc=
+golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
+golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e h1:Elxv5MwEkCI9f5SkoL6afed6NTdxaGoAo39eANBwHL8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
+google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=
+google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
+rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
@@ -0,0 +1,293 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/keymanager/server/internal/models"
+	"github.com/mrhid6/keymanager/server/internal/services"
+)
+
+func RegisterRoutes(r *gin.Engine) {
+	r.GET("/install", handleInstallScript)
+
+	api := r.Group("/api")
+	{
+		api.GET("/servers", listServers)
+		api.POST("/servers", createServer)
+		api.GET("/servers/new", newServer)
+		api.POST("/servers/new", newServer)
+		api.GET("/servers/:id", getServer)
+		api.DELETE("/servers/:id", deleteServer)
+		api.POST("/servers/:id/generate-key", generateKey)
+
+		api.GET("/keys", listKeys)
+		api.POST("/keys", createKey)
+		api.GET("/keys/:id", getKey)
+		api.POST("/keys/:id/assign", assignKey)
+		api.DELETE("/keys/:id/assign/:serverId", revokeAssignment)
+	}
+}
+
+func listServers(c *gin.Context) {
+	servers, err := services.ListServers()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, servers)
+}
+
+func createServer(c *gin.Context) {
+	s, token, err := services.CreateServer()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, gin.H{
+		"server":    s,
+		"token":     token,
+		"server_id": s.ServerID,
+	})
+}
+
+func newServer(c *gin.Context) {
+	s, token, err := services.CreateServer()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+	host := os.Getenv("PUBLIC_HOST")
+	if host == "" {
+		host = "keymanager.example.com"
+	}
+
+	installCmd := fmt.Sprintf(
+		`curl -fsSL "https://%s/install?server_id=%s&token=%s" | bash`,
+		host, s.ServerID, token,
+	)
+
+	c.JSON(http.StatusOK, gin.H{
+		"server_id":       s.ServerID,
+		"pre_reg_token":   token,
+		"install_command": installCmd,
+	})
+}
+
+func getServer(c *gin.Context) {
+	id := c.Param("id")
+	s, err := services.GetServer(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	assignments, _ := services.GetAssignmentsWithKeysForServer(id)
+
+	// Build response matching ServerWithKeys shape expected by frontend
+	type serverResponse struct {
+		*models.Server
+		Keys interface{} `json:"keys"`
+	}
+	c.JSON(http.StatusOK, serverResponse{
+		Server: s,
+		Keys:   assignments,
+	})
+}
+
+func deleteServer(c *gin.Context) {
+	id := c.Param("id")
+	if err := services.DeleteServer(id); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func generateKey(c *gin.Context) {
+	// The agent triggers key generation itself; this endpoint signals
+	// the intent by returning the server so the caller knows to wait
+	// for the agent to upload via gRPC UploadGeneratedKey.
+	id := c.Param("id")
+	s, err := services.GetServer(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"message":   "agent will generate and upload key on next poll",
+		"server_id": s.ServerID,
+	})
+}
+
+func listKeys(c *gin.Context) {
+	keys, err := services.ListKeys()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, keys)
+}
+
+func createKey(c *gin.Context) {
+	var body struct {
+		Label     string `json:"label" binding:"required"`
+		PublicKey string `json:"public_key" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	key, err := services.CreateKey(body.Label, body.PublicKey, "uploaded", "")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, key)
+}
+
+func getKey(c *gin.Context) {
+	id := c.Param("id")
+	key, err := services.GetKey(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "key not found"})
+		return
+	}
+
+	assignments, _ := services.GetAssignmentsWithServers(id)
+	c.JSON(http.StatusOK, gin.H{
+		"key":         key,
+		"assignments": assignments,
+	})
+}
+
+func assignKey(c *gin.Context) {
+	keyID := c.Param("id")
+	var body struct {
+		ServerID string `json:"server_id" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	a, err := services.AssignKey(keyID, body.ServerID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, a)
+}
+
+func revokeAssignment(c *gin.Context) {
+	keyID := c.Param("id")
+	serverID := c.Param("serverId")
+
+	if err := services.RevokeAssignment(keyID, serverID); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"revoked": true})
+}
+
+func handleInstallScript(c *gin.Context) {
+	serverID := c.Query("server_id")
+	token := c.Query("token")
+
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+	publicHost := os.Getenv("PUBLIC_HOST")
+	if publicHost == "" {
+		publicHost = "keymanager.example.com"
+	}
+
+	script := fmt.Sprintf(`#!/usr/bin/env bash
+set -euo pipefail
+
+SERVER_ID="%s"
+TOKEN="%s"
+GITEA_HOST="%s"
+KM_HOST="%s"
+
+ARCH=$(uname -m)
+case "$ARCH" in
+  x86_64)  ARCH="amd64" ;;
+  aarch64) ARCH="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+# Get latest agent release tag
+LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/keymanager/releases?limit=10" \
+  | grep -o '"tag_name":"agent/v[^"]*"' | head -1 | sed 's/"tag_name":"//;s/"//')
+
+if [ -z "$LATEST" ]; then
+  echo "Could not determine latest agent version" >&2
+  exit 1
+fi
+
+VERSION="${LATEST#agent/}"
+BINARY_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST}/keymanager-agent-linux-${ARCH}"
+CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST}/checksums.txt"
+
+echo "Installing keymanager-agent ${VERSION} (${ARCH})..."
+
+curl -fsSL -o /tmp/keymanager-agent "${BINARY_URL}"
+curl -fsSL -o /tmp/checksums.txt "${CHECKSUM_URL}"
+
+cd /tmp
+EXPECTED=$(grep "keymanager-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
+ACTUAL=$(sha256sum keymanager-agent | awk '{print $1}')
+if [ "$EXPECTED" != "$ACTUAL" ]; then
+  echo "Checksum mismatch!" >&2
+  exit 1
+fi
+
+install -m 0755 /tmp/keymanager-agent /usr/local/bin/keymanager-agent
+
+mkdir -p /etc/keymanager
+chmod 0700 /etc/keymanager
+
+cat > /etc/keymanager/config.yaml <<EOF
+server_url: "${KM_HOST}:9090"
+server_id: "${SERVER_ID}"
+pre_reg_token: "${TOKEN}"
+agent_token: ""
+poll_interval: 30s
+tls: true
+EOF
+chmod 0600 /etc/keymanager/config.yaml
+
+cat > /etc/systemd/system/keymanager-agent.service <<EOF
+[Unit]
+Description=KeyManager Agent
+After=network.target
+
+[Service]
+ExecStart=/usr/local/bin/keymanager-agent
+Restart=always
+RestartSec=10
+User=root
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now keymanager-agent
+
+echo "keymanager-agent installed and started."
+`, serverID, token, giteaHost, publicHost)
+
+	c.Header("Content-Type", "text/x-shellscript")
+	c.String(http.StatusOK, script)
+}
@@ -0,0 +1,34 @@
+package db
+
+import (
+	"context"
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+var Client *mongo.Client
+var Database *mongo.Database
+
+func Connect(uri, dbName string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	client, err := mongo.Connect(options.Client().ApplyURI(uri))
+	if err != nil {
+		return err
+	}
+
+	if err := client.Ping(ctx, nil); err != nil {
+		return err
+	}
+
+	Client = client
+	Database = client.Database(dbName)
+	return nil
+}
+
+func Col(name string) *mongo.Collection {
+	return Database.Collection(name)
+}
@@ -0,0 +1,20 @@
+package grpcserver
+
+import (
+	"encoding/json"
+)
+
+// JSONCodec is a gRPC codec that uses JSON encoding.
+type JSONCodec struct{}
+
+func (JSONCodec) Marshal(v interface{}) ([]byte, error) {
+	return json.Marshal(v)
+}
+
+func (JSONCodec) Unmarshal(data []byte, v interface{}) error {
+	return json.Unmarshal(data, v)
+}
+
+func (JSONCodec) Name() string {
+	return "proto" // override default proto codec name so gRPC uses it
+}
@@ -0,0 +1,171 @@
+// Hand-written gRPC bindings for keymanager.proto using JSON codec.
+// To use: register the JSON codec before creating gRPC servers/clients.
+
+package pb
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// Message types
+
+type RegisterRequest struct {
+	ServerId    string `json:"server_id"`
+	PreRegToken string `json:"pre_reg_token"`
+	Hostname    string `json:"hostname"`
+	IpAddress   string `json:"ip_address"`
+	OsInfo      string `json:"os_info"`
+}
+
+type RegisterResponse struct {
+	AgentToken string `json:"agent_token"`
+}
+
+type SyncRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+
+type SyncResponse struct {
+	PublicKeys []string `json:"public_keys"`
+}
+
+type UploadKeyRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+	PublicKey  string `json:"public_key"`
+	Label      string `json:"label"`
+}
+
+type UploadKeyResponse struct {
+	KeyId string `json:"key_id"`
+}
+
+// Server interface
+
+type KeyManagerServer interface {
+	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
+	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
+	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
+}
+
+type UnimplementedKeyManagerServer struct{}
+
+func (UnimplementedKeyManagerServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Register not implemented")
+}
+
+func (UnimplementedKeyManagerServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SyncKeys not implemented")
+}
+
+func (UnimplementedKeyManagerServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UploadGeneratedKey not implemented")
+}
+
+// Client interface
+
+type KeyManagerClient interface {
+	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
+	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
+	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
+}
+
+type keyManagerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewKeyManagerClient(cc grpc.ClientConnInterface) KeyManagerClient {
+	return &keyManagerClient{cc}
+}
+
+func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
+	out := new(RegisterResponse)
+	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/Register", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
+	out := new(SyncResponse)
+	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/SyncKeys", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
+	out := new(UploadKeyResponse)
+	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/UploadGeneratedKey", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// Server registration
+
+func RegisterKeyManagerServer(s grpc.ServiceRegistrar, srv KeyManagerServer) {
+	s.RegisterService(&KeyManager_ServiceDesc, srv)
+}
+
+var KeyManager_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "keymanager.v1.KeyManager",
+	HandlerType: (*KeyManagerServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{MethodName: "Register", Handler: _KeyManager_Register_Handler},
+		{MethodName: "SyncKeys", Handler: _KeyManager_SyncKeys_Handler},
+		{MethodName: "UploadGeneratedKey", Handler: _KeyManager_UploadGeneratedKey_Handler},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "keymanager/v1/keymanager.proto",
+}
+
+func _KeyManager_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(KeyManagerServer).Register(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/Register"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(KeyManagerServer).Register(ctx, req.(*RegisterRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _KeyManager_SyncKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SyncRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(KeyManagerServer).SyncKeys(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/SyncKeys"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(KeyManagerServer).SyncKeys(ctx, req.(*SyncRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _KeyManager_UploadGeneratedKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UploadKeyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(KeyManagerServer).UploadGeneratedKey(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/UploadGeneratedKey"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(KeyManagerServer).UploadGeneratedKey(ctx, req.(*UploadKeyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
@@ -0,0 +1,81 @@
+package grpcserver
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net"
+
+	"github.com/mrhid6/keymanager/server/internal/grpc/pb"
+	"github.com/mrhid6/keymanager/server/internal/services"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/status"
+)
+
+func init() {
+	encoding.RegisterCodec(JSONCodec{})
+}
+
+type keyManagerServer struct {
+	pb.UnimplementedKeyManagerServer
+}
+
+func (s *keyManagerServer) Register(ctx context.Context, req *pb.RegisterRequest) (*pb.RegisterResponse, error) {
+	agentToken, err := services.RegisterServer(req.ServerId, req.PreRegToken, req.Hostname, req.IpAddress, req.OsInfo)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "registration failed: %v", err)
+	}
+	return &pb.RegisterResponse{AgentToken: agentToken}, nil
+}
+
+func (s *keyManagerServer) SyncKeys(ctx context.Context, req *pb.SyncRequest) (*pb.SyncResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+
+	if err := services.UpdateServerLastSeen(srv.ServerID); err != nil {
+		log.Printf("failed to update last seen for %s: %v", srv.ServerID, err)
+	}
+
+	keys, err := services.BuildAuthorizedKeys(req.ServerId)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to build authorized keys: %v", err)
+	}
+
+	return &pb.SyncResponse{PublicKeys: keys}, nil
+}
+
+func (s *keyManagerServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKeyRequest) (*pb.UploadKeyResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+
+	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to store key: %v", err)
+	}
+
+	// Auto-assign to the generating server
+	if _, err := services.AssignKey(key.KeyID, srv.ServerID); err != nil {
+		log.Printf("failed to auto-assign generated key: %v", err)
+	}
+
+	return &pb.UploadKeyResponse{KeyId: key.KeyID}, nil
+}
+
+func StartGRPC(port int) error {
+	lis, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
+	if err != nil {
+		return fmt.Errorf("failed to listen: %w", err)
+	}
+
+	s := grpc.NewServer()
+	pb.RegisterKeyManagerServer(s, &keyManagerServer{})
+
+	log.Printf("gRPC server listening on :%d", port)
+	return s.Serve(lis)
+}
@@ -0,0 +1,15 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type Assignment struct {
+	ID         bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	KeyID      string             `bson:"key_id" json:"key_id"`
+	ServerID   string             `bson:"server_id" json:"server_id"`
+	AssignedAt time.Time          `bson:"assigned_at" json:"assigned_at"`
+	RevokedAt  *time.Time         `bson:"revoked_at,omitempty" json:"revoked_at,omitempty"`
+}
@@ -0,0 +1,18 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type Key struct {
+	ID                  bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	KeyID               string             `bson:"key_id" json:"key_id"`
+	Label               string             `bson:"label" json:"label"`
+	PublicKey           string             `bson:"public_key" json:"public_key"`
+	Fingerprint         string             `bson:"fingerprint" json:"fingerprint"`
+	Source              string             `bson:"source" json:"source"` // uploaded | generated
+	GeneratedByServerID string             `bson:"generated_by_server_id,omitempty" json:"generated_by_server_id,omitempty"`
+	CreatedAt           time.Time          `bson:"created_at" json:"created_at"`
+}
@@ -0,0 +1,21 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type Server struct {
+	ID             bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	ServerID       string             `bson:"server_id" json:"server_id"`
+	Hostname       string             `bson:"hostname" json:"hostname"`
+	IPAddress      string             `bson:"ip_address" json:"ip_address"`
+	OSInfo         string             `bson:"os_info" json:"os_info"`
+	PreRegToken    string             `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
+	PreRegExpires  *time.Time         `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
+	AgentTokenHash string             `bson:"agent_token_hash,omitempty" json:"-"`
+	Status         string             `bson:"status" json:"status"`
+	LastSeen       *time.Time         `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
+	CreatedAt      time.Time          `bson:"created_at" json:"created_at"`
+}
@@ -0,0 +1,209 @@
+package services
+
+import (
+	"context"
+	"crypto/md5"
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/keymanager/server/internal/db"
+	"github.com/mrhid6/keymanager/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func computeFingerprint(pubKey string) string {
+	parts := strings.Fields(pubKey)
+	if len(parts) < 2 {
+		return ""
+	}
+	raw, err := base64.StdEncoding.DecodeString(parts[1])
+	if err != nil {
+		return ""
+	}
+	sum := md5.Sum(raw)
+	var pairs []string
+	for _, b := range sum {
+		pairs = append(pairs, fmt.Sprintf("%02x", b))
+	}
+	return "MD5:" + strings.Join(pairs, ":")
+}
+
+func CreateKey(label, publicKey, source, generatedByServerID string) (*models.Key, error) {
+	key := &models.Key{
+		KeyID:               uuid.NewString(),
+		Label:               label,
+		PublicKey:           publicKey,
+		Fingerprint:         computeFingerprint(publicKey),
+		Source:              source,
+		GeneratedByServerID: generatedByServerID,
+		CreatedAt:           time.Now(),
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err := db.Col("keys").InsertOne(ctx, key)
+	if err != nil {
+		return nil, err
+	}
+	return key, nil
+}
+
+func GetKey(keyID string) (*models.Key, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var key models.Key
+	err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key)
+	if err != nil {
+		return nil, err
+	}
+	return &key, nil
+}
+
+func ListKeys() ([]models.Key, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cursor, err := db.Col("keys").Find(ctx, bson.M{})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var keys []models.Key
+	if err := cursor.All(ctx, &keys); err != nil {
+		return nil, err
+	}
+	return keys, nil
+}
+
+func DeleteKey(keyID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID})
+	return err
+}
+
+func AssignKey(keyID, serverID string) (*models.Assignment, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	// Check if already assigned and active
+	var existing models.Assignment
+	err := db.Col("assignments").FindOne(ctx, bson.M{
+		"key_id":     keyID,
+		"server_id":  serverID,
+		"revoked_at": nil,
+	}).Decode(&existing)
+	if err == nil {
+		return &existing, nil
+	}
+
+	a := &models.Assignment{
+		KeyID:      keyID,
+		ServerID:   serverID,
+		AssignedAt: time.Now(),
+	}
+	_, err = db.Col("assignments").InsertOne(ctx, a)
+	if err != nil {
+		return nil, err
+	}
+	return a, nil
+}
+
+func RevokeAssignment(keyID, serverID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	now := time.Now()
+	_, err := db.Col("assignments").UpdateOne(ctx,
+		bson.M{"key_id": keyID, "server_id": serverID, "revoked_at": nil},
+		bson.M{"$set": bson.M{"revoked_at": now}},
+	)
+	return err
+}
+
+func GetAssignmentsForKey(keyID string) ([]models.Assignment, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"key_id": keyID, "revoked_at": nil})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var assignments []models.Assignment
+	if err := cursor.All(ctx, &assignments); err != nil {
+		return nil, err
+	}
+	return assignments, nil
+}
+
+type AssignmentWithServer struct {
+	models.Assignment `bson:",inline"`
+	Server            *models.Server `json:"server,omitempty"`
+}
+
+func GetAssignmentsWithServers(keyID string) ([]AssignmentWithServer, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"key_id": keyID})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var assignments []models.Assignment
+	if err := cursor.All(ctx, &assignments); err != nil {
+		return nil, err
+	}
+
+	result := make([]AssignmentWithServer, 0, len(assignments))
+	for _, a := range assignments {
+		item := AssignmentWithServer{Assignment: a}
+		var srv models.Server
+		if err := db.Col("servers").FindOne(ctx, bson.M{"server_id": a.ServerID}).Decode(&srv); err == nil {
+			item.Server = &srv
+		}
+		result = append(result, item)
+	}
+	return result, nil
+}
+
+type AssignmentWithKey struct {
+	models.Assignment `bson:",inline"`
+	Key               *models.Key `json:"key,omitempty"`
+}
+
+func GetAssignmentsWithKeysForServer(serverID string) ([]AssignmentWithKey, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"server_id": serverID})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var assignments []models.Assignment
+	if err := cursor.All(ctx, &assignments); err != nil {
+		return nil, err
+	}
+
+	result := make([]AssignmentWithKey, 0, len(assignments))
+	for _, a := range assignments {
+		item := AssignmentWithKey{Assignment: a}
+		var key models.Key
+		if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key); err == nil {
+			item.Key = &key
+		}
+		result = append(result, item)
+	}
+	return result, nil
+}
@@ -0,0 +1,193 @@
+package services
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/keymanager/server/internal/db"
+	"github.com/mrhid6/keymanager/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func generateToken(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func HashToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
+}
+
+func CreateServer() (*models.Server, string, error) {
+	token, err := generateToken(32)
+	if err != nil {
+		return nil, "", err
+	}
+	expires := time.Now().Add(time.Hour)
+	s := &models.Server{
+		ServerID:      uuid.NewString(),
+		PreRegToken:   token,
+		PreRegExpires: &expires,
+		Status:        "pending",
+		CreatedAt:     time.Now(),
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err = db.Col("servers").InsertOne(ctx, s)
+	if err != nil {
+		return nil, "", err
+	}
+	return s, token, nil
+}
+
+func GetServer(serverID string) (*models.Server, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Server
+	err := db.Col("servers").FindOne(ctx, bson.M{"server_id": serverID}).Decode(&s)
+	if err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+func GetServerByPreRegToken(token string) (*models.Server, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Server
+	err := db.Col("servers").FindOne(ctx, bson.M{
+		"pre_reg_token":   token,
+		"pre_reg_expires": bson.M{"$gt": time.Now()},
+	}).Decode(&s)
+	if err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+func RegisterServer(serverID, preRegToken, hostname, ipAddress, osInfo string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Server
+	err := db.Col("servers").FindOne(ctx, bson.M{
+		"server_id":       serverID,
+		"pre_reg_token":   preRegToken,
+		"pre_reg_expires": bson.M{"$gt": time.Now()},
+	}).Decode(&s)
+	if err != nil {
+		return "", fmt.Errorf("invalid or expired pre-registration token")
+	}
+
+	agentToken, err := generateToken(32)
+	if err != nil {
+		return "", err
+	}
+	tokenHash := HashToken(agentToken)
+	now := time.Now()
+
+	_, err = db.Col("servers").UpdateOne(ctx,
+		bson.M{"server_id": serverID},
+		bson.M{"$set": bson.M{
+			"hostname":         hostname,
+			"ip_address":       ipAddress,
+			"os_info":          osInfo,
+			"agent_token_hash": tokenHash,
+			"status":           "active",
+			"last_seen":        now,
+			"pre_reg_token":    "",
+			"pre_reg_expires":  nil,
+		}},
+	)
+	if err != nil {
+		return "", err
+	}
+	return agentToken, nil
+}
+
+func ValidateAgentToken(serverID, agentToken string) (*models.Server, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	tokenHash := HashToken(agentToken)
+	var s models.Server
+	err := db.Col("servers").FindOne(ctx, bson.M{
+		"server_id":        serverID,
+		"agent_token_hash": tokenHash,
+	}).Decode(&s)
+	if err != nil {
+		return nil, fmt.Errorf("invalid agent token")
+	}
+	return &s, nil
+}
+
+func UpdateServerLastSeen(serverID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	now := time.Now()
+	_, err := db.Col("servers").UpdateOne(ctx,
+		bson.M{"server_id": serverID},
+		bson.M{"$set": bson.M{"last_seen": now, "status": "active"}},
+	)
+	return err
+}
+
+func ListServers() ([]models.Server, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	opts := options.Find().SetSort(bson.D{{Key: "created_at", Value: -1}})
+	cursor, err := db.Col("servers").Find(ctx, bson.M{}, opts)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var servers []models.Server
+	if err := cursor.All(ctx, &servers); err != nil {
+		return nil, err
+	}
+	return servers, nil
+}
+
+func DeleteServer(serverID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err := db.Col("servers").DeleteOne(ctx, bson.M{"server_id": serverID})
+	if err != nil {
+		return err
+	}
+	// Also remove assignments
+	_, err = db.Col("assignments").DeleteMany(ctx, bson.M{"server_id": serverID})
+	return err
+}
+
+func MarkOfflineServers(threshold time.Duration) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cutoff := time.Now().Add(-threshold)
+	_, err := db.Col("servers").UpdateMany(ctx,
+		bson.M{
+			"status":    "active",
+			"last_seen": bson.M{"$lt": cutoff},
+		},
+		bson.M{"$set": bson.M{"status": "offline"}},
+	)
+	return err
+}
@@ -0,0 +1,40 @@
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/mrhid6/keymanager/server/internal/db"
+	"github.com/mrhid6/keymanager/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func BuildAuthorizedKeys(serverID string) ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{
+		"server_id":  serverID,
+		"revoked_at": nil,
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var assignments []models.Assignment
+	if err := cursor.All(ctx, &assignments); err != nil {
+		return nil, err
+	}
+
+	var lines []string
+	for _, a := range assignments {
+		var key models.Key
+		err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key)
+		if err != nil {
+			continue
+		}
+		lines = append(lines, key.PublicKey)
+	}
+	return lines, nil
+}
@@ -0,0 +1,43 @@
+# Dependencies stage
+FROM node:20-alpine AS deps
+
+WORKDIR /app
+
+COPY package.json package-lock.json* ./
+RUN npm install
+
+# Build stage
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+ARG NEXT_PUBLIC_API_URL=http://localhost:8080
+ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
+
+RUN npm run build
+
+# Runtime stage
+FROM node:20-alpine AS runner
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+
+EXPOSE 3000
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+CMD ["node", "server.js"]
@@ -0,0 +1,38 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+:root {
+  color-scheme: dark;
+}
+
+* {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+}
+
+body {
+  background-color: #0f1117;
+  color: #e8eaf0;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  -webkit-font-smoothing: antialiased;
+}
+
+::-webkit-scrollbar {
+  width: 6px;
+  height: 6px;
+}
+
+::-webkit-scrollbar-track {
+  background: #1a1d27;
+}
+
+::-webkit-scrollbar-thumb {
+  background: #2e3147;
+  border-radius: 3px;
+}
+
+::-webkit-scrollbar-thumb:hover {
+  background: #3e4160;
+}
@@ -0,0 +1,346 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, Server } from "@/lib/api";
+import { Badge, Button, Card, CardHeader, CardTitle } from "@/components/ui";
+import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function AssignModal({
+  keyId,
+  assignedServerIds,
+  onClose,
+}: {
+  keyId: string;
+  assignedServerIds: string[];
+  onClose: () => void;
+}) {
+  const queryClient = useQueryClient();
+  const [selectedServer, setSelectedServer] = useState("");
+
+  const { data: servers } = useQuery({
+    queryKey: ["servers"],
+    queryFn: api.listServers,
+  });
+
+  const { mutate: assign, isPending, error } = useMutation({
+    mutationFn: () => api.assignKey(keyId, selectedServer),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["keys", keyId] });
+      queryClient.invalidateQueries({ queryKey: ["servers"] });
+      onClose();
+    },
+  });
+
+  const availableServers = servers?.filter(
+    (s: Server) => !assignedServerIds.includes(s.server_id)
+  );
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+      <div className="w-full max-w-md rounded-xl border border-border bg-surface p-6">
+        <h2 className="mb-4 text-lg font-semibold text-text-primary">Assign Key to Server</h2>
+
+        {error && (
+          <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">
+            {(error as Error).message}
+          </div>
+        )}
+
+        <div className="mb-4">
+          <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+            Select Server
+          </label>
+          {!availableServers || availableServers.length === 0 ? (
+            <p className="text-sm text-text-secondary">
+              All servers already have this key assigned.
+            </p>
+          ) : (
+            <select
+              value={selectedServer}
+              onChange={(e) => setSelectedServer(e.target.value)}
+              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent"
+            >
+              <option value="">Choose a server...</option>
+              {availableServers.map((s: Server) => (
+                <option key={s.server_id} value={s.server_id}>
+                  {s.hostname} ({s.ip_address})
+                </option>
+              ))}
+            </select>
+          )}
+        </div>
+
+        <div className="flex justify-end gap-3">
+          <Button variant="ghost" onClick={onClose}>Cancel</Button>
+          <Button
+            variant="primary"
+            loading={isPending}
+            disabled={!selectedServer}
+            onClick={() => assign()}
+          >
+            Assign Key
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default function KeyDetailPage() {
+  const params = useParams();
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  const keyId = params.id as string;
+  const [showAssign, setShowAssign] = useState(false);
+  const [confirmDelete, setConfirmDelete] = useState(false);
+  const [copiedKey, setCopiedKey] = useState(false);
+
+  const { data: key, isLoading, error } = useQuery({
+    queryKey: ["keys", keyId],
+    queryFn: () => api.getKey(keyId),
+  });
+
+  const { mutate: revokeKey } = useMutation({
+    mutationFn: (serverId: string) => api.revokeKey(keyId, serverId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["keys", keyId] });
+      queryClient.invalidateQueries({ queryKey: ["servers"] });
+    },
+  });
+
+  const { mutate: deleteKey, isPending: isDeleting } = useMutation({
+    mutationFn: () => api.deleteKey(keyId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["keys"] });
+      router.push("/keys");
+    },
+  });
+
+  const handleCopyKey = async () => {
+    if (!key?.public_key) return;
+    await navigator.clipboard.writeText(key.public_key);
+    setCopiedKey(true);
+    setTimeout(() => setCopiedKey(false), 2000);
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  if (error || !key) {
+    return (
+      <div className="p-8">
+        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">
+          Key not found or failed to load.
+        </div>
+      </div>
+    );
+  }
+
+  const activeAssignments = key.assignments?.filter((a) => !a.revoked_at) ?? [];
+  const assignedServerIds = activeAssignments.map((a) => a.server_id);
+
+  return (
+    <div className="p-8">
+      {showAssign && (
+        <AssignModal
+          keyId={keyId}
+          assignedServerIds={assignedServerIds}
+          onClose={() => setShowAssign(false)}
+        />
+      )}
+
+      <div className="mb-6 flex items-start justify-between">
+        <div>
+          <Link href="/keys" className="text-text-secondary hover:text-text-primary text-sm">
+            ← SSH Keys
+          </Link>
+          <div className="mt-2 flex items-center gap-3">
+            <h1 className="text-2xl font-bold text-text-primary">{key.label}</h1>
+            <Badge variant={key.source === "generated" ? "accent" : "neutral"}>
+              {key.source}
+            </Badge>
+          </div>
+          <p className="mt-1 font-mono text-xs text-text-secondary">{key.fingerprint}</p>
+        </div>
+        <div className="flex gap-2">
+          <Button variant="secondary" onClick={() => setShowAssign(true)}>
+            <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+              <path strokeLinecap="round" strokeLinejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
+            </svg>
+            Assign to Server
+          </Button>
+          {!confirmDelete ? (
+            <Button variant="danger" onClick={() => setConfirmDelete(true)}>
+              Delete Key
+            </Button>
+          ) : (
+            <div className="flex items-center gap-2">
+              <span className="text-sm text-danger">Delete permanently?</span>
+              <Button variant="danger" loading={isDeleting} onClick={() => deleteKey()}>
+                Confirm
+              </Button>
+              <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
+                Cancel
+              </Button>
+            </div>
+          )}
+        </div>
+      </div>
+
+      <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
+        <div className="space-y-6 lg:col-span-1">
+          <Card>
+            <CardHeader>
+              <CardTitle>Details</CardTitle>
+            </CardHeader>
+            <dl className="space-y-3 text-sm">
+              <div>
+                <dt className="text-text-secondary">Key ID</dt>
+                <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">{key.key_id}</dd>
+              </div>
+              <div className="border-t border-border pt-3">
+                <dt className="text-text-secondary">Source</dt>
+                <dd className="mt-0.5 text-text-primary capitalize">{key.source}</dd>
+              </div>
+              {key.generated_by_server_id && (
+                <div className="border-t border-border pt-3">
+                  <dt className="text-text-secondary">Generated By</dt>
+                  <dd className="mt-0.5">
+                    <Link
+                      href={`/servers/${key.generated_by_server_id}`}
+                      className="font-mono text-xs text-accent hover:underline"
+                    >
+                      {key.generated_by_server_id}
+                    </Link>
+                  </dd>
+                </div>
+              )}
+              <div className="border-t border-border pt-3">
+                <dt className="text-text-secondary">Active Assignments</dt>
+                <dd className="mt-0.5 text-text-primary">{activeAssignments.length}</dd>
+              </div>
+              <div className="border-t border-border pt-3">
+                <dt className="text-text-secondary">Created</dt>
+                <dd className="mt-0.5 text-text-primary">
+                  {new Date(key.created_at).toLocaleString()}
+                </dd>
+              </div>
+            </dl>
+          </Card>
+
+          <Card>
+            <CardHeader>
+              <CardTitle>Public Key</CardTitle>
+              <button
+                onClick={handleCopyKey}
+                className="rounded-md border border-border bg-surface-2 px-2.5 py-1 text-xs font-medium text-text-secondary transition-colors hover:border-accent/50 hover:text-text-primary"
+              >
+                {copiedKey ? <span className="text-success">Copied!</span> : "Copy"}
+              </button>
+            </CardHeader>
+            <div className="rounded-lg border border-border bg-[#0a0c14] p-3">
+              <pre className="overflow-x-auto whitespace-pre-wrap break-all font-mono text-xs text-text-secondary leading-relaxed">
+                {key.public_key}
+              </pre>
+            </div>
+          </Card>
+        </div>
+
+        <div className="lg:col-span-2">
+          <Card padding={false}>
+            <div className="flex items-center justify-between border-b border-border px-6 py-4">
+              <h2 className="text-lg font-semibold text-text-primary">
+                Server Assignments
+                <span className="ml-2 rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-secondary">
+                  {activeAssignments.length} active
+                </span>
+              </h2>
+            </div>
+
+            {!key.assignments || key.assignments.length === 0 ? (
+              <div className="py-16 text-center">
+                <p className="text-text-secondary text-sm">Not assigned to any servers.</p>
+                <Button
+                  variant="secondary"
+                  size="sm"
+                  className="mt-3"
+                  onClick={() => setShowAssign(true)}
+                >
+                  Assign to a server
+                </Button>
+              </div>
+            ) : (
+              <Table>
+                <Thead>
+                  <Tr>
+                    <Th>Server</Th>
+                    <Th>IP Address</Th>
+                    <Th>Status</Th>
+                    <Th>Assigned</Th>
+                    <Th>Revoked</Th>
+                    <Th />
+                  </Tr>
+                </Thead>
+                <Tbody>
+                  {key.assignments.map((assignment) => (
+                    <Tr key={`${assignment.key_id}-${assignment.server_id}`}>
+                      <Td>
+                        <Link
+                          href={`/servers/${assignment.server_id}`}
+                          className="font-medium text-text-primary hover:text-accent"
+                        >
+                          {assignment.server?.hostname ?? assignment.server_id}
+                        </Link>
+                      </Td>
+                      <Td>
+                        <span className="font-mono text-xs text-text-secondary">
+                          {assignment.server?.ip_address ?? "—"}
+                        </span>
+                      </Td>
+                      <Td>
+                        <Badge variant={assignment.revoked_at ? "danger" : "success"}>
+                          {assignment.revoked_at ? "revoked" : "active"}
+                        </Badge>
+                      </Td>
+                      <Td>
+                        <span className="text-text-secondary text-xs">
+                          {new Date(assignment.assigned_at).toLocaleDateString()}
+                        </span>
+                      </Td>
+                      <Td>
+                        <span className="text-text-secondary text-xs">
+                          {assignment.revoked_at
+                            ? new Date(assignment.revoked_at).toLocaleDateString()
+                            : "—"}
+                        </span>
+                      </Td>
+                      <Td>
+                        {!assignment.revoked_at && (
+                          <Button
+                            variant="danger"
+                            size="sm"
+                            onClick={() => revokeKey(assignment.server_id)}
+                          >
+                            Revoke
+                          </Button>
+                        )}
+                      </Td>
+                    </Tr>
+                  ))}
+                </Tbody>
+              </Table>
+            )}
+          </Card>
+        </div>
+      </div>
+    </div>
+  );
+}
@@ -0,0 +1,181 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, Key } from "@/lib/api";
+import { Badge, Button, Card, CardHeader, CardTitle } from "@/components/ui";
+import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function UploadKeyModal({ onClose }: { onClose: () => void }) {
+  const queryClient = useQueryClient();
+  const [label, setLabel] = useState("");
+  const [publicKey, setPublicKey] = useState("");
+
+  const { mutate: upload, isPending, error } = useMutation({
+    mutationFn: () => api.uploadKey(label.trim(), publicKey.trim()),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["keys"] });
+      onClose();
+    },
+  });
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+      <div className="w-full max-w-lg rounded-xl border border-border bg-surface p-6">
+        <h2 className="mb-4 text-lg font-semibold text-text-primary">Upload SSH Key</h2>
+
+        {error && (
+          <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">
+            {(error as Error).message}
+          </div>
+        )}
+
+        <div className="space-y-4">
+          <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+              Label
+            </label>
+            <input
+              type="text"
+              value={label}
+              onChange={(e) => setLabel(e.target.value)}
+              placeholder="e.g. dom-macbook"
+              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent"
+            />
+          </div>
+          <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+              Public Key
+            </label>
+            <textarea
+              value={publicKey}
+              onChange={(e) => setPublicKey(e.target.value)}
+              placeholder="ssh-ed25519 AAAA..."
+              rows={4}
+              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 font-mono text-xs text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent resize-none"
+            />
+          </div>
+        </div>
+
+        <div className="mt-6 flex justify-end gap-3">
+          <Button variant="ghost" onClick={onClose}>Cancel</Button>
+          <Button
+            variant="primary"
+            loading={isPending}
+            disabled={!label.trim() || !publicKey.trim()}
+            onClick={() => upload()}
+          >
+            Upload Key
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default function KeysPage() {
+  const [showUpload, setShowUpload] = useState(false);
+
+  const { data: keys, isLoading, error } = useQuery({
+    queryKey: ["keys"],
+    queryFn: api.listKeys,
+  });
+
+  return (
+    <div className="p-8">
+      {showUpload && <UploadKeyModal onClose={() => setShowUpload(false)} />}
+
+      <div className="mb-6 flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold text-text-primary">SSH Keys</h1>
+          <p className="mt-1 text-sm text-text-secondary">
+            {keys?.length ?? 0} key{keys?.length !== 1 ? "s" : ""} managed
+          </p>
+        </div>
+        <Button variant="primary" onClick={() => setShowUpload(true)}>
+          <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+            <path strokeLinecap="round" strokeLinejoin="round" d="M3 16.5v2.25A2.25 2.25 0 005.25 21h13.5A2.25 2.25 0 0021 18.75V16.5m-13.5-9L12 3m0 0l4.5 4.5M12 3v13.5" />
+          </svg>
+          Upload Key
+        </Button>
+      </div>
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex items-center justify-center py-20">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : error ? (
+          <div className="py-20 text-center text-danger">
+            Failed to load keys. Is the backend running?
+          </div>
+        ) : keys && keys.length > 0 ? (
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Label</Th>
+                <Th>Fingerprint</Th>
+                <Th>Source</Th>
+                <Th>Assignments</Th>
+                <Th>Created</Th>
+                <Th />
+              </Tr>
+            </Thead>
+            <Tbody>
+              {keys.map((key: Key) => (
+                <Tr key={key.key_id}>
+                  <Td>
+                    <span className="font-medium text-text-primary">{key.label}</span>
+                  </Td>
+                  <Td>
+                    <span className="font-mono text-xs text-text-secondary">
+                      {key.fingerprint}
+                    </span>
+                  </Td>
+                  <Td>
+                    <Badge variant={key.source === "generated" ? "accent" : "neutral"}>
+                      {key.source}
+                    </Badge>
+                  </Td>
+                  <Td>
+                    <span className="text-text-secondary">
+                      {key.assigned_count ?? 0} server{(key.assigned_count ?? 0) !== 1 ? "s" : ""}
+                    </span>
+                  </Td>
+                  <Td>
+                    <span className="text-text-secondary text-xs">
+                      {new Date(key.created_at).toLocaleDateString()}
+                    </span>
+                  </Td>
+                  <Td>
+                    <Link href={`/keys/${key.key_id}`}>
+                      <Button variant="ghost" size="sm">View →</Button>
+                    </Link>
+                  </Td>
+                </Tr>
+              ))}
+            </Tbody>
+          </Table>
+        ) : (
+          <div className="py-20 text-center">
+            <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-surface-2">
+              <svg className="h-6 w-6 text-text-secondary" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
+              </svg>
+            </div>
+            <p className="text-text-secondary">No SSH keys yet.</p>
+            <Button
+              variant="primary"
+              size="sm"
+              className="mt-4"
+              onClick={() => setShowUpload(true)}
+            >
+              Upload your first key
+            </Button>
+          </div>
+        )}
+      </Card>
+    </div>
+  );
+}
@@ -0,0 +1,30 @@
+import type { Metadata } from "next";
+import "./globals.css";
+import { Providers } from "@/components/Providers";
+import { Sidebar } from "@/components/Sidebar";
+
+export const metadata: Metadata = {
+  title: "KeyManager",
+  description: "Self-hosted SSH key management",
+};
+
+export default function RootLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <html lang="en" className="dark">
+      <body className="bg-background text-text-primary">
+        <Providers>
+          <div className="flex h-screen overflow-hidden">
+            <Sidebar />
+            <main className="flex-1 overflow-y-auto">
+              {children}
+            </main>
+          </div>
+        </Providers>
+      </body>
+    </html>
+  );
+}
@@ -0,0 +1,5 @@
+import { redirect } from "next/navigation";
+
+export default function Home() {
+  redirect("/servers");
+}
@@ -0,0 +1,219 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, ServerStatus } from "@/lib/api";
+import { Badge, Button, Card, CardHeader, CardTitle } from "@/components/ui";
+import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function statusVariant(status: ServerStatus) {
+  switch (status) {
+    case "active": return "success";
+    case "pending": return "warning";
+    case "offline": return "danger";
+  }
+}
+
+function formatDate(dateStr: string) {
+  return new Date(dateStr).toLocaleString();
+}
+
+export default function ServerDetailPage() {
+  const params = useParams();
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  const serverId = params.id as string;
+  const [confirmDelete, setConfirmDelete] = useState(false);
+
+  const { data: server, isLoading, error } = useQuery({
+    queryKey: ["servers", serverId],
+    queryFn: () => api.getServer(serverId),
+    refetchInterval: 30_000,
+  });
+
+  const { mutate: generateKey, isPending: isGenerating } = useMutation({
+    mutationFn: () => api.generateKeyForServer(serverId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["servers", serverId] });
+      queryClient.invalidateQueries({ queryKey: ["keys"] });
+    },
+  });
+
+  const { mutate: deleteServer, isPending: isDeleting } = useMutation({
+    mutationFn: () => api.deleteServer(serverId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["servers"] });
+      router.push("/servers");
+    },
+  });
+
+  if (isLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  if (error || !server) {
+    return (
+      <div className="p-8">
+        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">
+          Server not found or failed to load.
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-start justify-between">
+        <div>
+          <div className="flex items-center gap-3">
+            <Link href="/servers" className="text-text-secondary hover:text-text-primary text-sm">
+              ← Servers
+            </Link>
+          </div>
+          <div className="mt-2 flex items-center gap-3">
+            <h1 className="text-2xl font-bold text-text-primary">{server.hostname}</h1>
+            <Badge variant={statusVariant(server.status)}>{server.status}</Badge>
+          </div>
+          <p className="mt-1 font-mono text-sm text-text-secondary">{server.ip_address}</p>
+        </div>
+        <div className="flex gap-2">
+          <Button
+            variant="secondary"
+            loading={isGenerating}
+            onClick={() => generateKey()}
+          >
+            <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+              <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
+            </svg>
+            Generate SSH Key
+          </Button>
+          {!confirmDelete ? (
+            <Button variant="danger" onClick={() => setConfirmDelete(true)}>
+              Remove Server
+            </Button>
+          ) : (
+            <div className="flex items-center gap-2">
+              <span className="text-sm text-danger">Are you sure?</span>
+              <Button
+                variant="danger"
+                loading={isDeleting}
+                onClick={() => deleteServer()}
+              >
+                Confirm
+              </Button>
+              <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
+                Cancel
+              </Button>
+            </div>
+          )}
+        </div>
+      </div>
+
+      <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
+        <Card className="lg:col-span-1">
+          <CardHeader>
+            <CardTitle>Details</CardTitle>
+          </CardHeader>
+          <dl className="space-y-3 text-sm">
+            <div>
+              <dt className="text-text-secondary">Server ID</dt>
+              <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">{server.server_id}</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">OS</dt>
+              <dd className="mt-0.5 text-text-primary">{server.os_info}</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Last Seen</dt>
+              <dd className="mt-0.5 text-text-primary">{server.last_seen ? formatDate(server.last_seen) : "Never"}</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Registered</dt>
+              <dd className="mt-0.5 text-text-primary">{formatDate(server.created_at)}</dd>
+            </div>
+          </dl>
+        </Card>
+
+        <div className="lg:col-span-2">
+          <Card padding={false}>
+            <div className="flex items-center justify-between border-b border-border px-6 py-4">
+              <h2 className="text-lg font-semibold text-text-primary">
+                Installed Keys
+                <span className="ml-2 rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-secondary">
+                  {server.keys?.filter(k => !k.revoked_at).length ?? 0} active
+                </span>
+              </h2>
+              <Link href="/keys">
+                <Button variant="ghost" size="sm">Manage Keys →</Button>
+              </Link>
+            </div>
+
+            {!server.keys || server.keys.length === 0 ? (
+              <div className="py-16 text-center">
+                <p className="text-text-secondary text-sm">No keys assigned to this server.</p>
+                <Link href="/keys">
+                  <Button variant="secondary" size="sm" className="mt-3">
+                    Assign a key
+                  </Button>
+                </Link>
+              </div>
+            ) : (
+              <Table>
+                <Thead>
+                  <Tr>
+                    <Th>Label</Th>
+                    <Th>Fingerprint</Th>
+                    <Th>Source</Th>
+                    <Th>Status</Th>
+                    <Th>Assigned</Th>
+                    <Th />
+                  </Tr>
+                </Thead>
+                <Tbody>
+                  {server.keys.map((assignment) => (
+                    <Tr key={assignment.key_id}>
+                      <Td>
+                        <span className="font-medium">{assignment.key.label}</span>
+                      </Td>
+                      <Td>
+                        <span className="font-mono text-xs text-text-secondary">
+                          {assignment.key.fingerprint}
+                        </span>
+                      </Td>
+                      <Td>
+                        <Badge variant={assignment.key.source === "generated" ? "accent" : "neutral"}>
+                          {assignment.key.source}
+                        </Badge>
+                      </Td>
+                      <Td>
+                        <Badge variant={assignment.revoked_at ? "danger" : "success"}>
+                          {assignment.revoked_at ? "revoked" : "active"}
+                        </Badge>
+                      </Td>
+                      <Td>
+                        <span className="text-text-secondary text-xs">
+                          {formatDate(assignment.assigned_at)}
+                        </span>
+                      </Td>
+                      <Td>
+                        <Link href={`/keys/${assignment.key_id}`}>
+                          <Button variant="ghost" size="sm">View</Button>
+                        </Link>
+                      </Td>
+                    </Tr>
+                  ))}
+                </Tbody>
+              </Table>
+            )}
+          </Card>
+        </div>
+      </div>
+    </div>
+  );
+}
@@ -0,0 +1,139 @@
+"use client";
+
+import { useState } from "react";
+import { useMutation } from "@tanstack/react-query";
+import { api, NewServerResponse } from "@/lib/api";
+import { Button, Card, CardHeader, CardTitle } from "@/components/ui";
+
+export default function NewServerPage() {
+  const [result, setResult] = useState<NewServerResponse | null>(null);
+  const [copied, setCopied] = useState(false);
+
+  const { mutate: createServer, isPending, error } = useMutation({
+    mutationFn: api.createServer,
+    onSuccess: (data) => setResult(data),
+  });
+
+  const handleCopy = async () => {
+    if (!result?.install_command) return;
+    await navigator.clipboard.writeText(result.install_command);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 2000);
+  };
+
+  return (
+    <div className="p-8">
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold text-text-primary">Add Server</h1>
+        <p className="mt-1 text-sm text-text-secondary">
+          Generate an install command to register a new server with the KeyManager agent.
+        </p>
+      </div>
+
+      <div className="max-w-2xl space-y-6">
+        {!result ? (
+          <Card>
+            <CardHeader>
+              <CardTitle>Generate Install Command</CardTitle>
+            </CardHeader>
+            <p className="mb-6 text-sm text-text-secondary leading-relaxed">
+              Click the button below to generate a one-time install command. The command
+              contains a short-lived token (valid for 1 hour) that registers your server
+              and installs the KeyManager agent automatically.
+            </p>
+
+            {error && (
+              <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-4 py-3 text-sm text-danger">
+                Failed to generate install command. Make sure the backend is running.
+              </div>
+            )}
+
+            <Button
+              variant="primary"
+              loading={isPending}
+              onClick={() => createServer()}
+            >
+              Generate Install Command
+            </Button>
+          </Card>
+        ) : (
+          <>
+            <Card>
+              <CardHeader>
+                <CardTitle>Install Command</CardTitle>
+                <span className="rounded-full bg-success/15 px-2.5 py-0.5 text-xs font-medium text-success border border-success/30">
+                  Valid for 1 hour
+                </span>
+              </CardHeader>
+              <p className="mb-4 text-sm text-text-secondary">
+                Run this command on the target server as <code className="rounded bg-surface-2 px-1 py-0.5 text-xs font-mono text-text-primary">root</code>:
+              </p>
+
+              <div className="relative rounded-lg border border-border bg-[#0a0c14] p-4 font-mono text-sm">
+                <pre className="overflow-x-auto whitespace-pre-wrap break-all text-text-secondary leading-relaxed">
+                  <span className="text-accent">$</span>{" "}
+                  <span className="text-text-primary">{result.install_command}</span>
+                </pre>
+                <button
+                  onClick={handleCopy}
+                  className="absolute right-3 top-3 rounded-md border border-border bg-surface-2 px-2.5 py-1 text-xs font-medium text-text-secondary transition-colors hover:border-accent/50 hover:text-text-primary"
+                >
+                  {copied ? (
+                    <span className="text-success">Copied!</span>
+                  ) : (
+                    "Copy"
+                  )}
+                </button>
+              </div>
+            </Card>
+
+            <Card>
+              <CardHeader>
+                <CardTitle>Server Details</CardTitle>
+              </CardHeader>
+              <dl className="space-y-3 text-sm">
+                <div className="flex items-center justify-between">
+                  <dt className="text-text-secondary">Server ID</dt>
+                  <dd className="font-mono text-text-primary">{result.server_id}</dd>
+                </div>
+                <div className="flex items-center justify-between border-t border-border pt-3">
+                  <dt className="text-text-secondary">Status</dt>
+                  <dd className="text-warning">Pending registration</dd>
+                </div>
+              </dl>
+            </Card>
+
+            <Card>
+              <CardHeader>
+                <CardTitle>What happens next?</CardTitle>
+              </CardHeader>
+              <ol className="space-y-3 text-sm text-text-secondary">
+                {[
+                  "The install script detects your CPU architecture (amd64 / arm64)",
+                  "Downloads and verifies the latest agent binary from the Gitea release",
+                  "Writes /etc/keymanager/config.yaml with the server ID and token",
+                  "Installs and starts the keymanager-agent systemd service",
+                  "The agent calls Register() to obtain a persistent auth token",
+                  "The server status changes to active on the first successful sync",
+                ].map((step, i) => (
+                  <li key={i} className="flex gap-3">
+                    <span className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full bg-accent/20 text-xs font-semibold text-accent">
+                      {i + 1}
+                    </span>
+                    {step}
+                  </li>
+                ))}
+              </ol>
+            </Card>
+
+            <div className="flex gap-3">
+              <Button variant="secondary" onClick={() => { setResult(null); setCopied(false); }}>
+                Generate Another
+              </Button>
+            </div>
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
@@ -0,0 +1,139 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, Server, ServerStatus } from "@/lib/api";
+import { Badge, Button, Card } from "@/components/ui";
+import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function statusVariant(status: ServerStatus) {
+  switch (status) {
+    case "active":
+      return "success";
+    case "pending":
+      return "warning";
+    case "offline":
+      return "danger";
+  }
+}
+
+function formatLastSeen(dateStr: string): string {
+  const date = new Date(dateStr);
+  const now = new Date();
+  const diffMs = now.getTime() - date.getTime();
+  const diffSec = Math.floor(diffMs / 1000);
+  const diffMin = Math.floor(diffSec / 60);
+  const diffHour = Math.floor(diffMin / 60);
+  const diffDay = Math.floor(diffHour / 24);
+
+  if (diffSec < 60) return `${diffSec}s ago`;
+  if (diffMin < 60) return `${diffMin}m ago`;
+  if (diffHour < 24) return `${diffHour}h ago`;
+  return `${diffDay}d ago`;
+}
+
+export default function ServersPage() {
+  const { data: servers, isLoading, error } = useQuery({
+    queryKey: ["servers"],
+    queryFn: api.listServers,
+    refetchInterval: 30_000,
+  });
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold text-text-primary">Servers</h1>
+          <p className="mt-1 text-sm text-text-secondary">
+            {servers?.length ?? 0} registered server{servers?.length !== 1 ? "s" : ""}
+          </p>
+        </div>
+        <Link href="/servers/new">
+          <Button variant="primary">
+            <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+              <path strokeLinecap="round" strokeLinejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
+            </svg>
+            Add Server
+          </Button>
+        </Link>
+      </div>
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex items-center justify-center py-20">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : error ? (
+          <div className="py-20 text-center text-danger">
+            Failed to load servers. Is the backend running?
+          </div>
+        ) : servers && servers.length > 0 ? (
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Hostname</Th>
+                <Th>IP Address</Th>
+                <Th>OS</Th>
+                <Th>Status</Th>
+                <Th>Last Seen</Th>
+                <Th />
+              </Tr>
+            </Thead>
+            <Tbody>
+              {servers.map((server: Server) => (
+                <Tr key={server.server_id}>
+                  <Td>
+                    <span className="font-medium text-text-primary">
+                      {server.hostname}
+                    </span>
+                  </Td>
+                  <Td>
+                    <span className="font-mono text-text-secondary">
+                      {server.ip_address}
+                    </span>
+                  </Td>
+                  <Td>
+                    <span className="text-text-secondary">{server.os_info}</span>
+                  </Td>
+                  <Td>
+                    <Badge variant={statusVariant(server.status)}>
+                      {server.status}
+                    </Badge>
+                  </Td>
+                  <Td>
+                    <span className="text-text-secondary">
+                      {server.last_seen
+                        ? formatLastSeen(server.last_seen)
+                        : "Never"}
+                    </span>
+                  </Td>
+                  <Td>
+                    <Link href={`/servers/${server.server_id}`}>
+                      <Button variant="ghost" size="sm">
+                        View →
+                      </Button>
+                    </Link>
+                  </Td>
+                </Tr>
+              ))}
+            </Tbody>
+          </Table>
+        ) : (
+          <div className="py-20 text-center">
+            <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-surface-2">
+              <svg className="h-6 w-6 text-text-secondary" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                <path strokeLinecap="round" strokeLinejoin="round" d="M5.25 14.25h13.5m-13.5 0a3 3 0 01-3-3m3 3a3 3 0 100 6h13.5a3 3 0 100-6m-16.5-3a3 3 0 013-3h13.5a3 3 0 013 3m-19.5 0a4.5 4.5 0 01.9-2.7L5.737 5.1a3.375 3.375 0 012.7-1.35h7.126c1.062 0 2.062.5 2.7 1.35l2.587 3.45a4.5 4.5 0 01.9 2.7m0 0a3 3 0 01-3 3m0 3h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008zm-3 6h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008z" />
+              </svg>
+            </div>
+            <p className="text-text-secondary">No servers registered yet.</p>
+            <Link href="/servers/new">
+              <Button variant="primary" size="sm" className="mt-4">
+                Add your first server
+              </Button>
+            </Link>
+          </div>
+        )}
+      </Card>
+    </div>
+  );
+}
@@ -0,0 +1,10 @@
+"use client";
+
+import { QueryClientProvider } from "@tanstack/react-query";
+import { queryClient } from "@/lib/query-client";
+
+export function Providers({ children }: { children: React.ReactNode }) {
+  return (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  );
+}
@@ -0,0 +1,78 @@
+"use client";
+
+import Link from "next/link";
+import { usePathname } from "next/navigation";
+import { clsx } from "clsx";
+
+interface NavItem {
+  href: string;
+  label: string;
+  icon: React.ReactNode;
+}
+
+function ServerIcon() {
+  return (
+    <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+      <path strokeLinecap="round" strokeLinejoin="round" d="M5.25 14.25h13.5m-13.5 0a3 3 0 01-3-3m3 3a3 3 0 100 6h13.5a3 3 0 100-6m-16.5-3a3 3 0 013-3h13.5a3 3 0 013 3m-19.5 0a4.5 4.5 0 01.9-2.7L5.737 5.1a3.375 3.375 0 012.7-1.35h7.126c1.062 0 2.062.5 2.7 1.35l2.587 3.45a4.5 4.5 0 01.9 2.7m0 0a3 3 0 01-3 3m0 3h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008zm-3 6h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008z" />
+    </svg>
+  );
+}
+
+function KeyIcon() {
+  return (
+    <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+      <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
+    </svg>
+  );
+}
+
+const navItems: NavItem[] = [
+  { href: "/servers", label: "Servers", icon: <ServerIcon /> },
+  { href: "/keys", label: "SSH Keys", icon: <KeyIcon /> },
+];
+
+export function Sidebar() {
+  const pathname = usePathname();
+
+  return (
+    <aside className="flex h-screen w-60 flex-col border-r border-border bg-surface">
+      <div className="flex h-16 items-center gap-3 border-b border-border px-5">
+        <div className="flex h-8 w-8 items-center justify-center rounded-lg bg-accent">
+          <svg className="h-4 w-4 text-white" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+            <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
+          </svg>
+        </div>
+        <span className="text-base font-semibold text-text-primary">KeyManager</span>
+      </div>
+
+      <nav className="flex-1 overflow-y-auto px-3 py-4">
+        <ul className="space-y-1">
+          {navItems.map((item) => {
+            const isActive =
+              pathname === item.href || pathname.startsWith(item.href + "/");
+            return (
+              <li key={item.href}>
+                <Link
+                  href={item.href}
+                  className={clsx(
+                    "flex items-center gap-3 rounded-lg px-3 py-2.5 text-sm font-medium transition-colors",
+                    isActive
+                      ? "bg-accent/15 text-accent"
+                      : "text-text-secondary hover:bg-surface-2 hover:text-text-primary"
+                  )}
+                >
+                  {item.icon}
+                  {item.label}
+                </Link>
+              </li>
+            );
+          })}
+        </ul>
+      </nav>
+
+      <div className="border-t border-border px-4 py-3">
+        <p className="text-xs text-text-secondary">KeyManager v1.0</p>
+      </div>
+    </aside>
+  );
+}
@@ -0,0 +1,40 @@
+import { clsx } from "clsx";
+
+type Variant = "success" | "warning" | "danger" | "neutral" | "accent";
+
+interface BadgeProps {
+  variant?: Variant;
+  children: React.ReactNode;
+  className?: string;
+}
+
+const variantClasses: Record<Variant, string> = {
+  success: "bg-success/15 text-success border-success/30",
+  warning: "bg-warning/15 text-warning border-warning/30",
+  danger: "bg-danger/15 text-danger border-danger/30",
+  neutral: "bg-surface-2 text-text-secondary border-border",
+  accent: "bg-accent/15 text-accent border-accent/30",
+};
+
+export function Badge({ variant = "neutral", children, className }: BadgeProps) {
+  return (
+    <span
+      className={clsx(
+        "inline-flex items-center gap-1 rounded-full border px-2.5 py-0.5 text-xs font-medium",
+        variantClasses[variant],
+        className
+      )}
+    >
+      {(variant === "success" || variant === "warning" || variant === "danger") && (
+        <span
+          className={clsx("h-1.5 w-1.5 rounded-full", {
+            "bg-success": variant === "success",
+            "bg-warning": variant === "warning",
+            "bg-danger": variant === "danger",
+          })}
+        />
+      )}
+      {children}
+    </span>
+  );
+}
@@ -0,0 +1,75 @@
+import { ButtonHTMLAttributes, forwardRef } from "react";
+import { clsx } from "clsx";
+
+type Variant = "primary" | "secondary" | "danger" | "ghost";
+type Size = "sm" | "md" | "lg";
+
+interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
+  variant?: Variant;
+  size?: Size;
+  loading?: boolean;
+}
+
+const variantClasses: Record<Variant, string> = {
+  primary:
+    "bg-accent hover:bg-accent-hover text-white border-transparent",
+  secondary:
+    "bg-surface-2 hover:bg-[#2d3048] text-text-primary border-border",
+  danger:
+    "bg-danger hover:bg-danger-hover text-white border-transparent",
+  ghost:
+    "bg-transparent hover:bg-surface-2 text-text-secondary hover:text-text-primary border-transparent",
+};
+
+const sizeClasses: Record<Size, string> = {
+  sm: "px-3 py-1.5 text-sm",
+  md: "px-4 py-2 text-sm",
+  lg: "px-5 py-2.5 text-base",
+};
+
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(
+  (
+    { variant = "primary", size = "md", loading, className, children, disabled, ...props },
+    ref
+  ) => {
+    return (
+      <button
+        ref={ref}
+        disabled={disabled || loading}
+        className={clsx(
+          "inline-flex items-center gap-2 rounded-lg border font-medium transition-colors duration-150 focus:outline-none focus:ring-2 focus:ring-accent focus:ring-offset-2 focus:ring-offset-background disabled:opacity-50 disabled:cursor-not-allowed",
+          variantClasses[variant],
+          sizeClasses[size],
+          className
+        )}
+        {...props}
+      >
+        {loading && (
+          <svg
+            className="animate-spin h-4 w-4"
+            xmlns="http://www.w3.org/2000/svg"
+            fill="none"
+            viewBox="0 0 24 24"
+          >
+            <circle
+              className="opacity-25"
+              cx="12"
+              cy="12"
+              r="10"
+              stroke="currentColor"
+              strokeWidth="4"
+            />
+            <path
+              className="opacity-75"
+              fill="currentColor"
+              d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"
+            />
+          </svg>
+        )}
+        {children}
+      </button>
+    );
+  }
+);
+
+Button.displayName = "Button";
@@ -0,0 +1,37 @@
+import { clsx } from "clsx";
+import { HTMLAttributes } from "react";
+
+interface CardProps extends HTMLAttributes<HTMLDivElement> {
+  padding?: boolean;
+}
+
+export function Card({ className, padding = true, children, ...props }: CardProps) {
+  return (
+    <div
+      className={clsx(
+        "rounded-xl border border-border bg-surface",
+        padding && "p-6",
+        className
+      )}
+      {...props}
+    >
+      {children}
+    </div>
+  );
+}
+
+export function CardHeader({ className, children, ...props }: HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div className={clsx("mb-4 flex items-center justify-between", className)} {...props}>
+      {children}
+    </div>
+  );
+}
+
+export function CardTitle({ className, children, ...props }: HTMLAttributes<HTMLHeadingElement>) {
+  return (
+    <h2 className={clsx("text-lg font-semibold text-text-primary", className)} {...props}>
+      {children}
+    </h2>
+  );
+}
@@ -0,0 +1,67 @@
+import { clsx } from "clsx";
+import { HTMLAttributes, TdHTMLAttributes, ThHTMLAttributes } from "react";
+
+export function Table({ className, children, ...props }: HTMLAttributes<HTMLTableElement>) {
+  return (
+    <div className="overflow-x-auto">
+      <table
+        className={clsx("w-full border-collapse text-sm", className)}
+        {...props}
+      >
+        {children}
+      </table>
+    </div>
+  );
+}
+
+export function Thead({ className, children, ...props }: HTMLAttributes<HTMLTableSectionElement>) {
+  return (
+    <thead className={clsx("border-b border-border", className)} {...props}>
+      {children}
+    </thead>
+  );
+}
+
+export function Tbody({ className, children, ...props }: HTMLAttributes<HTMLTableSectionElement>) {
+  return (
+    <tbody className={clsx("divide-y divide-border", className)} {...props}>
+      {children}
+    </tbody>
+  );
+}
+
+export function Tr({ className, children, ...props }: HTMLAttributes<HTMLTableRowElement>) {
+  return (
+    <tr
+      className={clsx("transition-colors hover:bg-surface-2/50", className)}
+      {...props}
+    >
+      {children}
+    </tr>
+  );
+}
+
+export function Th({ className, children, ...props }: ThHTMLAttributes<HTMLTableCellElement>) {
+  return (
+    <th
+      className={clsx(
+        "px-4 py-3 text-left text-xs font-semibold uppercase tracking-wider text-text-secondary",
+        className
+      )}
+      {...props}
+    >
+      {children}
+    </th>
+  );
+}
+
+export function Td({ className, children, ...props }: TdHTMLAttributes<HTMLTableCellElement>) {
+  return (
+    <td
+      className={clsx("px-4 py-3 text-text-primary", className)}
+      {...props}
+    >
+      {children}
+    </td>
+  );
+}
@@ -0,0 +1,4 @@
+export { Button } from "./Button";
+export { Badge } from "./Badge";
+export { Card, CardHeader, CardTitle } from "./Card";
+export { Table, Thead, Tbody, Tr, Th, Td } from "./Table";
@@ -0,0 +1,137 @@
+export type ServerStatus = "pending" | "active" | "offline";
+export type KeySource = "uploaded" | "generated";
+
+export interface Server {
+  id: string;
+  server_id: string;
+  hostname: string;
+  ip_address: string;
+  os_info: string;
+  status: ServerStatus;
+  last_seen: string;
+  created_at: string;
+}
+
+export interface Key {
+  id: string;
+  key_id: string;
+  label: string;
+  public_key: string;
+  fingerprint: string;
+  source: KeySource;
+  generated_by_server_id?: string;
+  created_at: string;
+  assigned_count?: number;
+}
+
+export interface Assignment {
+  id: string;
+  key_id: string;
+  server_id: string;
+  assigned_at: string;
+  revoked_at: string | null;
+}
+
+export interface NewServerResponse {
+  server_id: string;
+  pre_reg_token: string;
+  install_command: string;
+}
+
+export interface KeyWithAssignments extends Key {
+  assignments: (Assignment & { server: Server })[];
+}
+
+export interface ServerWithKeys extends Server {
+  keys: (Assignment & { key: Key })[];
+}
+
+class ApiError extends Error {
+  constructor(
+    public status: number,
+    message: string
+  ) {
+    super(message);
+    this.name = "ApiError";
+  }
+}
+
+async function request<T>(path: string, options?: RequestInit): Promise<T> {
+  const res = await fetch(`/api${path}`, {
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+    },
+    ...options,
+  });
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => res.statusText);
+    throw new ApiError(res.status, text || `HTTP ${res.status}`);
+  }
+
+  if (res.status === 204) {
+    return undefined as T;
+  }
+
+  return res.json();
+}
+
+export const api = {
+  // Servers
+  listServers(): Promise<Server[]> {
+    return request<Server[]>("/servers");
+  },
+
+  getServer(serverId: string): Promise<ServerWithKeys> {
+    return request<ServerWithKeys>(`/servers/${serverId}`);
+  },
+
+  createServer(): Promise<NewServerResponse> {
+    return request<NewServerResponse>("/servers/new", { method: "POST" });
+  },
+
+  deleteServer(serverId: string): Promise<void> {
+    return request<void>(`/servers/${serverId}`, { method: "DELETE" });
+  },
+
+  generateKeyForServer(serverId: string): Promise<{ key_id: string }> {
+    return request<{ key_id: string }>(`/servers/${serverId}/generate-key`, {
+      method: "POST",
+    });
+  },
+
+  // Keys
+  listKeys(): Promise<Key[]> {
+    return request<Key[]>("/keys");
+  },
+
+  getKey(keyId: string): Promise<KeyWithAssignments> {
+    return request<KeyWithAssignments>(`/keys/${keyId}`);
+  },
+
+  uploadKey(label: string, public_key: string): Promise<Key> {
+    return request<Key>("/keys", {
+      method: "POST",
+      body: JSON.stringify({ label, public_key }),
+    });
+  },
+
+  deleteKey(keyId: string): Promise<void> {
+    return request<void>(`/keys/${keyId}`, { method: "DELETE" });
+  },
+
+  // Assignments
+  assignKey(keyId: string, serverId: string): Promise<Assignment> {
+    return request<Assignment>(`/keys/${keyId}/assign`, {
+      method: "POST",
+      body: JSON.stringify({ server_id: serverId }),
+    });
+  },
+
+  revokeKey(keyId: string, serverId: string): Promise<void> {
+    return request<void>(`/keys/${keyId}/assign/${serverId}`, {
+      method: "DELETE",
+    });
+  },
+};
@@ -0,0 +1,12 @@
+"use client";
+
+import { QueryClient } from "@tanstack/react-query";
+
+export const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      staleTime: 30_000,
+      retry: 1,
+    },
+  },
+});
@@ -0,0 +1,21 @@
+import type { NextConfig } from "next";
+
+const apiUrl = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:8080";
+
+const nextConfig: NextConfig = {
+  output: "standalone",
+  async rewrites() {
+    return [
+      {
+        source: "/api/:path*",
+        destination: `${apiUrl}/api/:path*`,
+      },
+      {
+        source: "/install",
+        destination: `${apiUrl}/install`,
+      },
+    ];
+  },
+};
+
+export default nextConfig;
@@ -0,0 +1,30 @@
+{
+    "name": "keymanager-web",
+    "version": "0.1.0",
+    "private": true,
+    "scripts": {
+        "dev": "next dev",
+        "build": "next build",
+        "start": "next start",
+        "lint": "next lint"
+    },
+    "dependencies": {
+        "next": "16.2.9",
+        "react": "^18.3.1",
+        "react-dom": "^18.3.1",
+        "@tanstack/react-query": "^5.51.1",
+        "clsx": "^2.1.1",
+        "tailwind-merge": "^2.4.0"
+    },
+    "devDependencies": {
+        "@types/node": "^20.14.11",
+        "@types/react": "^18.3.3",
+        "@types/react-dom": "^18.3.0",
+        "autoprefixer": "^10.4.19",
+        "postcss": "^8.4.39",
+        "tailwindcss": "^3.4.6",
+        "typescript": "^5.5.3",
+        "eslint": "^9.0.0",
+        "eslint-config-next": "16.2.9"
+    }
+}
@@ -0,0 +1,6 @@
+module.exports = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
@@ -0,0 +1,30 @@
+import type { Config } from "tailwindcss";
+
+const config: Config = {
+  content: [
+    "./pages/**/*.{js,ts,jsx,tsx,mdx}",
+    "./components/**/*.{js,ts,jsx,tsx,mdx}",
+    "./app/**/*.{js,ts,jsx,tsx,mdx}",
+  ],
+  theme: {
+    extend: {
+      colors: {
+        background: "#0f1117",
+        surface: "#1a1d27",
+        "surface-2": "#232635",
+        border: "#2e3147",
+        "text-primary": "#e8eaf0",
+        "text-secondary": "#9095a8",
+        accent: "#6366f1",
+        "accent-hover": "#4f52d4",
+        success: "#22c55e",
+        warning: "#f59e0b",
+        danger: "#ef4444",
+        "danger-hover": "#dc2626",
+      },
+    },
+  },
+  plugins: [],
+};
+
+export default config;
@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": ["./*"]
+    }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}