fix: Fixed agent ci install

- single-use session tokens (atomic ConsumeSessionToken) + user-bound tunnel (actor must match session opener)
- wire VNC end-to-end (stash/consume password, connect+tunnel, frontend password field)
- passphrase-protected SSH keys: passphrase_enc on Key model, capture on upload, decrypt + pass to guacd

.gitea/workflows/agent-release.yml

@@ -36,10 +36,13 @@ jobs:
                   GOOS=linux GOARCH=arm64 go build \
                     -ldflags="-s -w -X main.Version=${VERSION}" \
                     -o dist/vantage-agent-linux-arm64 ./cmd
+                  GOOS=windows GOARCH=amd64 go build \
+                    -ldflags="-s -w -X main.Version=${VERSION}" \
+                    -o dist/vantage-agent-windows-amd64.exe ./cmd
 
             - name: Checksums
               working-directory: agent/dist
-              run: sha256sum vantage-agent-linux-amd64 vantage-agent-linux-arm64 > checksums.txt
+              run: sha256sum vantage-agent-linux-amd64 vantage-agent-linux-arm64 vantage-agent-windows-amd64.exe > checksums.txt
 
             - name: Create release
               uses: https://gitea.com/actions/gitea-release-action@v1
@@ -48,4 +51,54 @@ jobs:
                   files: |
                       agent/dist/vantage-agent-linux-amd64
                       agent/dist/vantage-agent-linux-arm64
+                      agent/dist/vantage-agent-windows-amd64.exe
                       agent/dist/checksums.txt
+
+    msi:
+        needs: build
+        runs-on: windows-2022
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Set up Go
+              uses: actions/setup-go@v5
+              with:
+                  go-version: "1.26"
+                  cache: true
+                  cache-dependency-path: agent/go.sum
+
+            - name: Build agent exe
+              working-directory: agent
+              shell: pwsh
+              run: |
+                  $env:GOOS = "windows"; $env:GOARCH = "amd64"
+                  go build -o ../installer/vantage-agent-windows-amd64.exe ./cmd
+
+            - name: Fetch nssm
+              working-directory: installer
+              shell: pwsh
+              run: |
+                  Invoke-WebRequest -Uri https://nssm.cc/release/nssm-2.24.zip -OutFile nssm.zip
+                  Expand-Archive -Path nssm.zip -DestinationPath nssm-extract -Force
+                  Copy-Item nssm-extract/nssm-2.24/win64/nssm.exe -Destination nssm.exe
+
+            - name: Install WiX
+              shell: pwsh
+              run: dotnet tool install --global wix --version 5.*
+
+            - name: Build MSI
+              working-directory: installer
+              shell: pwsh
+              run: |
+                  $env:PATH = "$env:PATH;$env:USERPROFILE\.dotnet\tools"
+                  wix build vantage-agent.wxs -o vantage-agent.msi
+                  (Get-FileHash vantage-agent.msi -Algorithm SHA256).Hash.ToLower() + "  vantage-agent.msi" | Out-File -Encoding ascii checksums-msi.txt
+
+            - name: Attach MSI to release
+              uses: https://gitea.com/actions/gitea-release-action@v1
+              with:
+                  token: ${{ secrets.RELEASE_TOKEN }}
+                  files: |
+                      installer/vantage-agent.msi
+                      installer/checksums-msi.txt

.gitignore

@@ -1,4 +1,11 @@
 node_modules
 dist
 build
-.env
+.env
+docs
+.superpowers
+installer/*.exe
+installer/*.msi
+installer/nssm.zip
+installer/checksums-msi.txt
+.next

agent/internal/config/config.go

@@ -2,12 +2,26 @@ package config
 
 import (
 	"os"
+	"path/filepath"
+	"runtime"
 	"time"
 
 	"gopkg.in/yaml.v3"
 )
 
-const ConfigPath = "/etc/vantage/config.yaml"
+// ConfigDir returns the platform-specific config directory.
+func ConfigDir() string {
+	if runtime.GOOS == "windows" {
+		base := os.Getenv("ProgramData")
+		if base == "" {
+			base = `C:\ProgramData`
+		}
+		return filepath.Join(base, "vantage")
+	}
+	return "/etc/vantage"
+}
+
+func configPath() string { return filepath.Join(ConfigDir(), "config.yaml") }
 
 type Config struct {
 	ServerURL    string        `yaml:"server_url"`
@@ -19,7 +33,7 @@ type Config struct {
 }
 
 func Load() (*Config, error) {
-	data, err := os.ReadFile(ConfigPath)
+	data, err := os.ReadFile(configPath())
 	if err != nil {
 		return nil, err
 	}
@@ -38,8 +52,8 @@ func Save(cfg *Config) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll("/etc/vantage", 0700); err != nil {
+	if err := os.MkdirAll(ConfigDir(), 0700); err != nil {
 		return err
 	}
-	return os.WriteFile(ConfigPath, data, 0600)
+	return os.WriteFile(configPath(), data, 0600)
 }

agent/internal/config/config_test.go

@@ -0,0 +1,20 @@
+package config
+
+import (
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestConfigDirByOS(t *testing.T) {
+	d := ConfigDir()
+	if runtime.GOOS == "windows" {
+		if !strings.Contains(strings.ToLower(d), "programdata") {
+			t.Fatalf("windows config dir = %q, want ProgramData path", d)
+		}
+	} else {
+		if d != "/etc/vantage" {
+			t.Fatalf("unix config dir = %q, want /etc/vantage", d)
+		}
+	}
+}

agent/internal/sync/sync.go

@@ -91,6 +91,11 @@ func poll(client *grpcclient.Client, cfg *config.Config, version string) error {
 		return fmt.Errorf("SyncKeys: %w", err)
 	}
 
+	// Windows agents register and heartbeat only — no authorized_keys management.
+	if runtime.GOOS != "linux" {
+		return nil
+	}
+
 	current, err := keys.ReadAuthorizedKeys()
 	if err != nil {
 		return fmt.Errorf("read authorized_keys: %w", err)

custom-secrets-vault-gin-guide.md

@@ -1,707 +0,0 @@
-# Custom Secrets Vault + ESO Webhook Integration
-
-Self-hosted secrets API at `https://keymanager.hostxtra.co.uk/secrets`
-backed by MongoDB with Gin, exposed to K3s via ESO's Webhook provider.
-
----
-
-## Architecture
-
-```
-MongoDB (encrypted at rest)
-  └── secrets collection: { group, key, encryptedValue, updatedAt }
-        ↑ CRUD via Go API (Gin)
-Go API (keymanager secrets service)
-  └── GET    /secrets/:group        ← ESO webhook calls this
-  └── PUT    /secrets/:group        ← admin writes secrets to a group
-  └── DELETE /secrets/:group        ← admin deletes entire group
-  └── DELETE /secrets/:group/:key   ← admin deletes one key from a group
-        ↓ bearer token auth (read token for ESO, admin token for writes)
-ESO Webhook ClusterSecretStore
-  └── ExternalSecret (per namespace)
-        └── K8s Secret
-              └── Deployment env vars
-```
-
-**Data model:** A "group" is a logical namespace for a set of related secrets —
-e.g. `myapp-prod`, `postgres`, `infra`. Each group contains one or more
-key/value pairs stored individually as encrypted documents in MongoDB.
-
-**Encryption:** AES-256-GCM per value, random nonce per write, master key
-loaded from the `MASTER_KEY` environment variable (32-byte hex string).
-
----
-
-## Part 1 — The Go API
-
-### 1.1 — Project structure
-
-```
-keymanager/
-├── cmd/
-│   └── server/
-│       └── main.go
-├── internal/
-│   ├── crypto/
-│   │   └── crypto.go
-│   ├── store/
-│   │   └── store.go
-│   └── api/
-│       └── api.go
-├── go.mod
-└── Dockerfile
-```
-
-### 1.2 — `go.mod`
-
-```
-module github.com/yourusername/keymanager
-
-go 1.23
-
-require (
-    go.mongodb.org/mongo-driver v1.17.0
-    github.com/gin-gonic/gin v1.10.0
-)
-```
-
-### 1.3 — `internal/crypto/crypto.go`
-
-AES-256-GCM encryption. Each value gets a unique random nonce so identical
-plaintext values produce different ciphertext on every write.
-
-```go
-package crypto
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"encoding/base64"
-	"errors"
-	"io"
-)
-
-// Encrypt encrypts plaintext using AES-256-GCM.
-// Returns base64(nonce + ciphertext).
-func Encrypt(key []byte, plaintext string) (string, error) {
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return "", err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return "", err
-	}
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return "", err
-	}
-	ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
-	return base64.StdEncoding.EncodeToString(ciphertext), nil
-}
-
-// Decrypt decrypts a base64(nonce + ciphertext) produced by Encrypt.
-func Decrypt(key []byte, encoded string) (string, error) {
-	data, err := base64.StdEncoding.DecodeString(encoded)
-	if err != nil {
-		return "", err
-	}
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return "", err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return "", err
-	}
-	if len(data) < gcm.NonceSize() {
-		return "", errors.New("ciphertext too short")
-	}
-	nonce, ciphertext := data[:gcm.NonceSize()], data[gcm.NonceSize():]
-	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
-	if err != nil {
-		return "", err
-	}
-	return string(plaintext), nil
-}
-```
-
-### 1.4 — `internal/store/store.go`
-
-MongoDB storage. Each document represents one key within a group.
-
-```go
-package store
-
-import (
-	"context"
-	"time"
-
-	"go.mongodb.org/mongo-driver/bson"
-	"go.mongodb.org/mongo-driver/mongo"
-	"go.mongodb.org/mongo-driver/mongo/options"
-)
-
-type SecretDoc struct {
-	Group          string    `bson:"group"`
-	Key            string    `bson:"key"`
-	EncryptedValue string    `bson:"encryptedValue"`
-	UpdatedAt      time.Time `bson:"updatedAt"`
-}
-
-type Store struct {
-	col *mongo.Collection
-}
-
-func New(client *mongo.Client, dbName string) (*Store, error) {
-	col := client.Database(dbName).Collection("secrets")
-
-	// Unique compound index on (group, key)
-	_, err := col.Indexes().CreateOne(context.Background(), mongo.IndexModel{
-		Keys:    bson.D{{Key: "group", Value: 1}, {Key: "key", Value: 1}},
-		Options: options.Index().SetUnique(true),
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return &Store{col: col}, nil
-}
-
-// GetGroup returns all SecretDocs belonging to the given group.
-func (s *Store) GetGroup(ctx context.Context, group string) ([]SecretDoc, error) {
-	cursor, err := s.col.Find(ctx, bson.M{"group": group})
-	if err != nil {
-		return nil, err
-	}
-	var docs []SecretDoc
-	if err := cursor.All(ctx, &docs); err != nil {
-		return nil, err
-	}
-	return docs, nil
-}
-
-// Upsert writes or updates a single key within a group.
-func (s *Store) Upsert(ctx context.Context, group, key, encryptedValue string) error {
-	filter := bson.M{"group": group, "key": key}
-	update := bson.M{"$set": bson.M{
-		"encryptedValue": encryptedValue,
-		"updatedAt":      time.Now(),
-	}}
-	_, err := s.col.UpdateOne(ctx, filter, update, options.Update().SetUpsert(true))
-	return err
-}
-
-// DeleteGroup removes all keys belonging to a group.
-func (s *Store) DeleteGroup(ctx context.Context, group string) error {
-	_, err := s.col.DeleteMany(ctx, bson.M{"group": group})
-	return err
-}
-
-// DeleteKey removes a single key from a group.
-func (s *Store) DeleteKey(ctx context.Context, group, key string) error {
-	_, err := s.col.DeleteOne(ctx, bson.M{"group": group, "key": key})
-	return err
-}
-```
-
-### 1.5 — `internal/api/api.go`
-
-Gin handlers. Two token tiers: ESO gets a read-only token, admins get a write token.
-
-```go
-package api
-
-import (
-	"encoding/hex"
-	"net/http"
-	"os"
-
-	"github.com/gin-gonic/gin"
-	"github.com/yourusername/keymanager/internal/crypto"
-	"github.com/yourusername/keymanager/internal/store"
-)
-
-type API struct {
-	store      *store.Store
-	masterKey  []byte
-	esoToken   string
-	adminToken string
-}
-
-func New(s *store.Store) *API {
-	keyHex := os.Getenv("MASTER_KEY")
-	key, err := hex.DecodeString(keyHex)
-	if err != nil || len(key) != 32 {
-		panic("MASTER_KEY must be a 64-character hex string (32 bytes)")
-	}
-	return &API{
-		store:      s,
-		masterKey:  key,
-		esoToken:   os.Getenv("ESO_TOKEN"),
-		adminToken: os.Getenv("ADMIN_TOKEN"),
-	}
-}
-
-func (a *API) RegisterRoutes(r *gin.Engine) {
-	secrets := r.Group("/secrets")
-
-	// Read routes — ESO token
-	secrets.GET("/:group", a.bearerAuth(a.esoToken), a.getGroup)
-
-	// Write routes — admin token
-	secrets.PUT("/:group", a.bearerAuth(a.adminToken), a.putGroup)
-	secrets.DELETE("/:group", a.bearerAuth(a.adminToken), a.deleteGroup)
-	secrets.DELETE("/:group/:key", a.bearerAuth(a.adminToken), a.deleteKey)
-}
-
-// bearerAuth returns a Gin middleware that validates a Bearer token.
-func (a *API) bearerAuth(expected string) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		auth := c.GetHeader("Authorization")
-		const prefix = "Bearer "
-		if len(auth) <= len(prefix) || auth[:len(prefix)] != prefix {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing bearer token"})
-			return
-		}
-		token := auth[len(prefix):]
-		if token != expected {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-			return
-		}
-		c.Next()
-	}
-}
-
-// getGroup handles GET /secrets/:group
-// Returns a flat JSON object { "KEY": "value", ... } for ESO to consume.
-// Returns 404 if the group has no secrets — ESO treats 404 as "deleted".
-func (a *API) getGroup(c *gin.Context) {
-	group := c.Param("group")
-
-	docs, err := a.store.GetGroup(c.Request.Context(), group)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "store error"})
-		return
-	}
-	if len(docs) == 0 {
-		c.JSON(http.StatusNotFound, gin.H{"error": "group not found"})
-		return
-	}
-
-	result := make(map[string]string, len(docs))
-	for _, doc := range docs {
-		val, err := crypto.Decrypt(a.masterKey, doc.EncryptedValue)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "decrypt error"})
-			return
-		}
-		result[doc.Key] = val
-	}
-
-	c.JSON(http.StatusOK, result)
-}
-
-// putGroup handles PUT /secrets/:group
-// Body: { "KEY": "value", ... } — upserts each key in the group.
-func (a *API) putGroup(c *gin.Context) {
-	group := c.Param("group")
-
-	var payload map[string]string
-	if err := c.ShouldBindJSON(&payload); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid JSON body"})
-		return
-	}
-	if len(payload) == 0 {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "body must contain at least one key"})
-		return
-	}
-
-	for key, val := range payload {
-		encrypted, err := crypto.Encrypt(a.masterKey, val)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "encrypt error"})
-			return
-		}
-		if err := a.store.Upsert(c.Request.Context(), group, key, encrypted); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "store error"})
-			return
-		}
-	}
-
-	c.Status(http.StatusNoContent)
-}
-
-// deleteGroup handles DELETE /secrets/:group
-// Removes the entire group and all its keys.
-func (a *API) deleteGroup(c *gin.Context) {
-	group := c.Param("group")
-
-	if err := a.store.DeleteGroup(c.Request.Context(), group); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "store error"})
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-
-// deleteKey handles DELETE /secrets/:group/:key
-// Removes a single key from a group.
-func (a *API) deleteKey(c *gin.Context) {
-	group := c.Param("group")
-	key := c.Param("key")
-
-	if err := a.store.DeleteKey(c.Request.Context(), group, key); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "store error"})
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-```
-
-### 1.6 — `cmd/server/main.go`
-
-```go
-package main
-
-import (
-	"context"
-	"log"
-	"os"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"go.mongodb.org/mongo-driver/mongo"
-	"go.mongodb.org/mongo-driver/mongo/options"
-
-	"github.com/yourusername/keymanager/internal/api"
-	"github.com/yourusername/keymanager/internal/store"
-)
-
-func main() {
-	mongoURI := os.Getenv("MONGODB_URI")
-	if mongoURI == "" {
-		mongoURI = "mongodb://localhost:27017"
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	client, err := mongo.Connect(ctx, options.Client().ApplyURI(mongoURI))
-	if err != nil {
-		log.Fatalf("MongoDB connect: %v", err)
-	}
-	if err := client.Ping(ctx, nil); err != nil {
-		log.Fatalf("MongoDB ping: %v", err)
-	}
-	log.Println("Connected to MongoDB")
-
-	s, err := store.New(client, "keymanager")
-	if err != nil {
-		log.Fatalf("Store init: %v", err)
-	}
-
-	gin.SetMode(gin.ReleaseMode)
-	r := gin.New()
-	r.Use(gin.Logger(), gin.Recovery())
-
-	a := api.New(s)
-	a.RegisterRoutes(r)
-
-	log.Println("Secrets API listening on :8080")
-	if err := r.Run(":8080"); err != nil {
-		log.Fatalf("Server error: %v", err)
-	}
-}
-```
-
-### 1.7 — `Dockerfile`
-
-```dockerfile
-FROM golang:1.23-alpine AS builder
-WORKDIR /app
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN go build -o secrets-api ./cmd/server
-
-FROM alpine:3.20
-RUN apk add --no-cache ca-certificates
-WORKDIR /app
-COPY --from=builder /app/secrets-api .
-EXPOSE 8080
-CMD ["./secrets-api"]
-```
-
----
-
-## Part 2 — Deploying the API
-
-### 2.1 — Generate your secrets
-
-```bash
-# 32-byte master key — back this up in your password manager
-openssl rand -hex 32
-
-# ESO read token
-openssl rand -hex 32
-
-# Admin token
-openssl rand -hex 32
-```
-
-### 2.2 — Docker Compose
-
-```yaml
-services:
-  secrets-api:
-    image: ghcr.io/yourusername/keymanager-secrets:latest
-    restart: unless-stopped
-    environment:
-      MONGODB_URI: mongodb://mongo:27017
-      MASTER_KEY: "<your-32-byte-hex-key>"
-      ESO_TOKEN: "<your-eso-token>"
-      ADMIN_TOKEN: "<your-admin-token>"
-    ports:
-      - "127.0.0.1:8082:8080"
-```
-
-### 2.3 — Caddyfile
-
-```caddyfile
-keymanager.hostxtra.co.uk {
-    # ... existing KeyManager routes ...
-
-    handle /secrets* {
-        reverse_proxy localhost:8082
-    }
-}
-```
-
-```bash
-caddy reload --config /etc/caddy/Caddyfile
-```
-
-### 2.4 — Smoke test
-
-```bash
-export ADMIN="<your-admin-token>"
-export ESO="<your-eso-token>"
-export BASE="https://keymanager.hostxtra.co.uk/secrets"
-
-# Write a group
-curl -s -X PUT $BASE/myapp-prod \
-  -H "Authorization: Bearer $ADMIN" \
-  -H "Content-Type: application/json" \
-  -d '{"DB_PASSWORD": "supersecret123", "API_KEY": "myapikey456"}'
-# → 204 No Content
-
-# Read back (as ESO would)
-curl -s $BASE/myapp-prod \
-  -H "Authorization: Bearer $ESO"
-# → {"API_KEY":"myapikey456","DB_PASSWORD":"supersecret123"}
-
-# Delete a single key
-curl -s -X DELETE $BASE/myapp-prod/API_KEY \
-  -H "Authorization: Bearer $ADMIN"
-# → 204 No Content
-
-# Confirm it's gone
-curl -s $BASE/myapp-prod \
-  -H "Authorization: Bearer $ESO"
-# → {"DB_PASSWORD":"supersecret123"}
-
-# Delete the whole group
-curl -s -X DELETE $BASE/myapp-prod \
-  -H "Authorization: Bearer $ADMIN"
-# → 204 No Content
-
-# Confirm 404
-curl -s -o /dev/null -w "%{http_code}" $BASE/myapp-prod \
-  -H "Authorization: Bearer $ESO"
-# → 404
-```
-
----
-
-## Part 3 — ESO Webhook Integration
-
-### 3.1 — Install ESO
-
-```bash
-helm repo add external-secrets https://charts.external-secrets.io
-helm repo update
-helm upgrade --install external-secrets external-secrets/external-secrets \
-  --namespace external-secrets \
-  --create-namespace \
-  --set installCRDs=true \
-  --wait
-```
-
-### 3.2 — Store ESO token as a K8s Secret
-
-The `external-secrets.io/type=webhook` label is required — without it the
-webhook provider is not permitted to read the secret.
-
-```bash
-kubectl create secret generic keymanager-eso-token \
-  --namespace external-secrets \
-  --from-literal=token="<your-eso-token>"
-
-kubectl label secret keymanager-eso-token \
-  --namespace external-secrets \
-  external-secrets.io/type=webhook
-```
-
-### 3.3 — ClusterSecretStore
-
-```yaml
-# cluster-secret-store.yaml
-apiVersion: external-secrets.io/v1
-kind: ClusterSecretStore
-metadata:
-  name: keymanager-store
-spec:
-  provider:
-    webhook:
-      url: "https://keymanager.hostxtra.co.uk/secrets/{{ .remoteRef.key }}"
-      method: GET
-      result:
-        jsonPath: "$"
-      headers:
-        Content-Type: "application/json"
-        Authorization: "Bearer {{ .auth.token }}"
-      secrets:
-        - name: auth
-          secretRef:
-            name: keymanager-eso-token
-            namespace: external-secrets
-```
-
-```bash
-kubectl apply -f cluster-secret-store.yaml
-kubectl get clustersecretstore keymanager-store
-```
-
-### 3.4 — ExternalSecret
-
-The `remoteRef.key` value is the group name — ESO substitutes it into the
-URL template, calling `GET /secrets/myapp-prod`.
-
-```yaml
-# external-secret.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: myapp
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: myapp-secrets
-  namespace: myapp
-spec:
-  refreshInterval: 15m
-  secretStoreRef:
-    name: keymanager-store
-    kind: ClusterSecretStore
-  target:
-    name: myapp-secrets
-    creationPolicy: Owner
-  dataFrom:
-    - extract:
-        key: myapp-prod        # group name → GET /secrets/myapp-prod
-```
-
-Or to pull specific keys from a group:
-
-```yaml
-  data:
-    - secretKey: DB_PASSWORD
-      remoteRef:
-        key: myapp-prod        # group name
-        property: DB_PASSWORD  # key within the group's JSON response
-```
-
-```bash
-kubectl apply -f external-secret.yaml
-
-kubectl get externalsecret myapp-secrets -n myapp
-# STATUS: SecretSynced
-
-# Decode and verify values
-kubectl get secret myapp-secrets -n myapp -o json | \
-  jq '.data | map_values(@base64d)'
-```
-
-### 3.5 — Deployment
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myapp
-  namespace: myapp
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: myapp
-  template:
-    metadata:
-      labels:
-        app: myapp
-      annotations:
-        reloader.stakater.com/auto: "true"   # optional: auto-restart on secret change
-    spec:
-      containers:
-        - name: myapp
-          image: your-image:latest
-          envFrom:
-            - secretRef:
-                name: myapp-secrets
-```
-
----
-
-## Part 4 — Day-to-Day Secret Management
-
-```bash
-export ADMIN="<your-admin-token>"
-export BASE="https://keymanager.hostxtra.co.uk/secrets"
-
-# Create or update a group (upserts — safe to re-run)
-curl -s -X PUT $BASE/postgres \
-  -H "Authorization: Bearer $ADMIN" \
-  -H "Content-Type: application/json" \
-  -d '{"POSTGRES_PASSWORD": "dbpass", "POSTGRES_USER": "app"}'
-
-# Add a new key to an existing group (existing keys are untouched)
-curl -s -X PUT $BASE/postgres \
-  -H "Authorization: Bearer $ADMIN" \
-  -H "Content-Type: application/json" \
-  -d '{"POSTGRES_DB": "mydb"}'
-
-# Remove a single key from a group
-curl -s -X DELETE $BASE/postgres/POSTGRES_USER \
-  -H "Authorization: Bearer $ADMIN"
-
-# Remove an entire group
-curl -s -X DELETE $BASE/postgres \
-  -H "Authorization: Bearer $ADMIN"
-
-# Force ESO to re-sync immediately after a rotation
-kubectl annotate externalsecret myapp-secrets -n myapp \
-  force-sync=$(date +%s) --overwrite
-```
-
----
-
-## Quick Reference
-
-| Endpoint | Token | Description |
-|---|---|---|
-| `GET /secrets/:group` | ESO token | Returns all keys in group as JSON |
-| `PUT /secrets/:group` | Admin token | Upserts keys into group |
-| `DELETE /secrets/:group` | Admin token | Deletes entire group |
-| `DELETE /secrets/:group/:key` | Admin token | Deletes one key from group |

deploy/docker-compose.yml

@@ -1,37 +1,30 @@
 services:
-  mongo:
-    image: mongo:8
-    restart: unless-stopped
-    volumes:
-      - mongo_data:/data/db
-    healthcheck:
-      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 20s
-
   redis:
     image: redis:8
     restart: unless-stopped
     volumes:
       - redis_data:/data
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test:
+        - CMD
+        - redis-cli
+        - ping
       interval: 10s
       timeout: 5s
       retries: 5
-
-  server:
-    build:
-      context: ../server
-      dockerfile: Dockerfile
+  guacd:
+    image: docker.io/guacamole/guacd:1.6.0
     restart: unless-stopped
     ports:
-      - "8080:8080"
-      - "9090:9090"
+      - 4822:4822
+  server:
+    image: gitea.hostxtra.co.uk/mrhid6/vantage/server:latest
+    restart: unless-stopped
+    ports:
+      - 8080:8080
+      - 9090:9090
     environment:
-      MONGO_URI: mongodb://mongo:27017/vantage
+      MONGO_URI: ${MONGO_URI:-}
       REDIS_ADDR: redis:6379
       GITEA_HOST: ${GITEA_HOST}
       PUBLIC_HOST: ${PUBLIC_HOST}
@@ -42,24 +35,19 @@ services:
       OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
       OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
       OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
+      KEY_ENCRYPTION_KEY: ${KEY_ENCRYPTION_KEY:-}
+      GUACD_ADDR: guacd:4822
     depends_on:
-      mongo:
-        condition: service_healthy
       redis:
         condition: service_healthy
-
   web:
-    build:
-      context: ../web
-      dockerfile: Dockerfile
-      args:
-        NEXT_PUBLIC_API_URL: http://server:8080
+    image: gitea.hostxtra.co.uk/mrhid6/vantage/web:latest
     restart: unless-stopped
     ports:
-      - "3000:3000"
+      - 3000:3000
     depends_on:
       - server
-
 volumes:
-  mongo_data:
-  redis_data:
+  mongo_data: null
+  redis_data: null
+networks: {}

docs/superpowers/specs/2026-07-17-web-console-design.md

@@ -0,0 +1,241 @@
+# Vantage Web Console (Guacamole Replacement) — Design
+
+**Date:** 2026-07-17
+**Status:** Approved design, pre-implementation
+
+## Goal
+
+Add a browser-based remote-access console to Vantage — SSH, RDP, and VNC into
+managed servers — as a self-hosted Guacamole replacement. Users select an SSH
+key to connect over SSH. RDP targets are reachable from a new Windows agent that
+registers the host and reports status. Windows agent ships as an MSI installer
+produced by CI.
+
+## Non-Goals (YAGNI)
+
+- Session recording / replay (may be added later).
+- Native Go RDP implementation (guacd handles protocol translation).
+- Per-user Linux/Windows account management from the agent.
+- Tunneling console traffic through the agent (direct network path assumed).
+
+---
+
+## Architecture
+
+```
+Browser (guacamole-common-js, vendored — no CDN)
+   │  Guacamole protocol over WebSocket
+   ▼
+Go server: /api/console/tunnel   (github.com/wwt/guac)
+   │  Guacamole protocol over TCP :4822
+   ▼
+guacd container (Apache Guacamole daemon)
+   │  SSH :22 / RDP :3389 / VNC :5900  — direct to target IP
+   ▼
+Target host (LAN / VPN line-of-sight from server)
+```
+
+- **Browser:** loads vendored `guacamole-common-js`, renders RDP/VNC display and
+  SSH terminal. No external CDN (matches existing infra rules).
+- **Go server:** exposes a WebSocket tunnel endpoint using `github.com/wwt/guac`
+  (Go Guacamole tunnel library). No Java `guacamole-client` required.
+- **guacd:** new container in `deploy/docker-compose.yml`, bound to the internal
+  docker network only, reachable by the server on `:4822`.
+- **Network path:** guacd connects **directly** to the target IP. Requires the
+  central server to have network line-of-sight to hosts (homelab LAN / VPN). The
+  agent's outbound-only guarantee is unchanged — the console path is
+  server→target, not agent-mediated.
+
+---
+
+## Data Model Changes
+
+### `keys` — extend to hold private material
+
+```json
+{
+  "key_id": "uuid",
+  "label": "dom-macbook",
+  "public_key": "ssh-ed25519 AAAA...",
+  "private_key_enc": "<AES-256-GCM ciphertext | null>",
+  "has_private": true,
+  "passphrase_enc": "<AES-256-GCM ciphertext | null>",
+  "fingerprint": "SHA256:...",
+  "source": "uploaded|generated",
+  "created_at": "ISODate"
+}
+```
+
+- A key may be created from an uploaded **private+public** pair, upload of a
+  public key only, or agent generation.
+- Agent key generation now also uploads `private_key_enc` (reuses the existing
+  AES-256 key used for at-rest encryption). Private key no longer stays local
+  only — it is stored encrypted so the console can reuse it.
+- Optional `passphrase_enc` for passphrase-protected private keys.
+- Console lists only keys where `has_private = true`.
+
+### `servers` — extend with console metadata
+
+```json
+{
+  "...": "...existing fields...",
+  "os_type": "linux|windows",
+  "console_protocols": ["ssh"],
+  "ssh_port": 22,
+  "rdp_port": 3389
+}
+```
+
+- `os_type` set at registration from the agent.
+- `console_protocols` lists enabled protocols per server (`ssh`, `rdp`, `vnc`).
+- Port fields default to standard ports, overridable in the UI.
+
+### `console_sessions` — new collection (audit)
+
+```json
+{
+  "session_id": "uuid",
+  "server_id": "uuid",
+  "protocol": "ssh|rdp|vnc",
+  "key_id": "uuid | null",
+  "user": "who opened it",
+  "started_at": "ISODate",
+  "ended_at": "ISODate | null",
+  "client_ip": "string"
+}
+```
+
+---
+
+## Session Broker + Connection Flow
+
+New service: `server/internal/services/console.go`.
+
+1. Browser `POST /api/console/connect`
+   `{ server_id, protocol, key_id?, rdp_username?, rdp_password? }`.
+2. Broker validates request, loads the server (host IP, port for protocol),
+   loads the key and **decrypts `private_key_enc` in memory only**.
+3. Builds the guacd connection parameter map:
+   - **SSH:** `hostname`, `port`, `username`, `private-key` (decrypted),
+     `passphrase` (if any).
+   - **RDP:** `hostname`, `port`, `username`, `password`, `security=any`,
+     `ignore-cert=true`.
+   - **VNC:** `hostname`, `port`, `password`.
+4. Creates a `console_sessions` document, returns a short-lived signed session
+   token.
+5. Browser opens WebSocket `/api/console/tunnel?token=…`. The `wwt/guac` handler
+   validates the token, dials guacd `:4822`, and pipes bytes in both directions.
+6. On socket close, the broker sets `ended_at` on the session doc.
+
+### Security
+
+- Decrypted private keys and RDP passwords are **never persisted, never logged,
+  never sent to the browser** — passed only to guacd.
+- Session token: short TTL (~60s to open the WebSocket), single-use,
+  HMAC-signed, bound to the authenticated user.
+- guacd is bound to the internal docker network only; not exposed publicly.
+- At-rest encryption (`private_key_enc`, `passphrase_enc`) reuses the existing
+  AES-256 key already used for agent-generated private keys.
+
+---
+
+## Windows Agent
+
+Same Go codebase as the Linux agent, with a reduced role: **register +
+heartbeat + status only**. No `authorized_keys` management (meaningless on
+Windows).
+
+- Build target: `GOOS=windows GOARCH=amd64` → `vantage-agent-windows-amd64.exe`.
+- Agent detects OS at registration and sends `os_type=windows`.
+- The key-sync loop is disabled on Windows via a runtime OS check (or build tag)
+  — no `authorized_keys` writes are ever attempted.
+- Config file: `C:\ProgramData\vantage\config.yaml`, locked down via ACL to the
+  equivalent of `0600`.
+- Runs as a Windows service via **nssm**.
+
+---
+
+## Windows Installer (MSI)
+
+Agent ships as a WiX v4 MSI produced in CI.
+
+- **WiX v4** chosen because it is a dotnet tool that builds MSIs
+  **cross-platform** — runs on the Linux Gitea act_runner. (Inno Setup is
+  Windows-only and does not fit the runner.)
+- MSI bundles `vantage-agent.exe`, installs it to `C:\Program Files\Vantage\`,
+  and registers the nssm service (ships nssm or uses a CustomAction).
+- Accepts install parameters as MSI properties for silent/headless install:
+  ```
+  msiexec /i vantage-agent.msi /qn SERVERID=<id> TOKEN=<token> SERVERURL=vantage..:9090
+  ```
+- GUI install (double-click) prompts for server-id / token / server-url via a
+  dialog.
+
+### Two install paths
+
+1. **Installer direct** — user downloads `vantage-agent.msi`, double-clicks,
+   fills the dialog. No script required.
+2. **PowerShell one-liner** — served dynamically (like the existing bash
+   `/install`). Script downloads the `.msi`, verifies SHA-256, then runs
+   `msiexec /qn` with injected `SERVERID` / `TOKEN` / `SERVERURL`. Used by the
+   copy-paste "Add Server" flow.
+
+The PowerShell script (`/install.ps1`) steps:
+1. Detect arch.
+2. Download `vantage-agent.msi` from the latest Gitea `agent/v*` release.
+3. Verify SHA-256 against `checksums.txt`.
+4. Run `msiexec /i vantage-agent.msi /qn SERVERID=.. TOKEN=.. SERVERURL=..`.
+
+---
+
+## Frontend Routes
+
+| Route                     | Change                                                        |
+| ------------------------- | ------------------------------------------------------------- |
+| `/servers`                | Show `os_type` badge, enabled console protocols               |
+| `/servers/[id]`           | Add **Connect** button(s) per enabled protocol                |
+| `/servers/[id]/console`   | New — full-screen console (guacamole-common-js), key picker   |
+| `/servers/new`            | Offer Windows (MSI) vs Linux (bash) install instructions      |
+
+Console page: select protocol + SSH key (SSH) or enter RDP credentials, call
+`/api/console/connect`, open the tunnel WebSocket, mount the Guacamole client.
+
+---
+
+## CI/CD Changes
+
+### `agent-release.yml`
+
+- Add `windows/amd64` build: `vantage-agent-windows-amd64.exe`.
+- Add WiX v4 MSI build job → `vantage-agent.msi`.
+- Add both to `checksums.txt` and release assets.
+
+Release assets become:
+- `vantage-agent-linux-amd64`
+- `vantage-agent-linux-arm64`
+- `vantage-agent-windows-amd64.exe`
+- `vantage-agent.msi`
+- `checksums.txt`
+
+### `server-deploy.yml`
+
+- Add guacd service to `deploy/docker-compose.yml` (deployed alongside server).
+
+---
+
+## New Dependencies
+
+- **Go:** `github.com/wwt/guac` (Guacamole tunnel/WebSocket in Go).
+- **Container:** `guacamole/guacd` official image.
+- **Frontend:** vendored `guacamole-common-js` (no CDN).
+- **CI:** WiX v4 dotnet tool; nssm binary bundled for the MSI.
+
+---
+
+## Open Implementation Notes
+
+- Confirm `wwt/guac` API surface for connection-parameter passing and token auth
+  binding during implementation.
+- nssm packaging inside MSI: bundle the nssm binary as a payload + CustomAction,
+  or run `sc.exe`-based service install if nssm proves awkward in WiX.
+- ACL hardening of `C:\ProgramData\vantage\config.yaml` in the MSI CustomAction.

installer/setup.ps1

@@ -0,0 +1,25 @@
+param(
+  [string]$ServerId,
+  [string]$Token,
+  [string]$ServerUrl,
+  [string]$InstallDir
+)
+$cfgDir = Join-Path $env:ProgramData "vantage"
+New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
+$cfg = @"
+server_url: "$ServerUrl"
+server_id: "$ServerId"
+pre_reg_token: "$Token"
+agent_token: ""
+poll_interval: 30s
+tls: true
+"@
+Set-Content -Path (Join-Path $cfgDir "config.yaml") -Value $cfg -Encoding utf8
+# Lock down ACL: SYSTEM + Administrators only
+icacls (Join-Path $cfgDir "config.yaml") /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" | Out-Null
+
+$nssm = Join-Path $InstallDir "nssm.exe"
+$exe  = Join-Path $InstallDir "vantage-agent.exe"
+& $nssm install VantageAgent $exe
+& $nssm set VantageAgent Start SERVICE_AUTO_START
+& $nssm start VantageAgent

installer/vantage-agent.wxs

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package Name="Vantage Agent" Manufacturer="Vantage"
+           Version="1.0.0.0" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
+           Scope="perMachine">
+    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <!-- Public properties settable via msiexec: SERVERID, TOKEN, SERVERURL -->
+    <Property Id="SERVERID" Secure="yes" />
+    <Property Id="TOKEN" Secure="yes" />
+    <Property Id="SERVERURL" Secure="yes" />
+
+    <StandardDirectory Id="ProgramFiles64Folder">
+      <Directory Id="INSTALLDIR" Name="Vantage">
+        <Component Id="AgentExe" Guid="*">
+          <File Id="AgentExe" Source="vantage-agent-windows-amd64.exe" Name="vantage-agent.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="NssmExe" Guid="*">
+          <File Id="NssmExe" Source="nssm.exe" Name="nssm.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="SetupScript" Guid="*">
+          <File Id="SetupScript" Source="setup.ps1" Name="setup.ps1" KeyPath="yes" />
+        </Component>
+      </Directory>
+    </StandardDirectory>
+
+    <Feature Id="Main">
+      <ComponentRef Id="AgentExe" />
+      <ComponentRef Id="NssmExe" />
+      <ComponentRef Id="SetupScript" />
+    </Feature>
+
+    <!-- Write config.yaml, then install + start the service via nssm.
+         Implemented as sequenced CustomActions running a helper script.
+
+         Deferred CustomActions run out-of-process (and with Impersonate="no",
+         as SYSTEM) with NO access to the installer property table, so
+         "[SERVERID]"/"[TOKEN]"/"[SERVERURL]"/"[INSTALLDIR]" would resolve to
+         empty strings if referenced directly on the deferred action. The fix
+         is the standard CustomActionData marshaling pattern: an immediate
+         SetProperty (type 51) with the SAME Id as the deferred CustomAction
+         runs first (while property values are still visible) and resolves
+         the formatted string; the deferred Directory/ExeCommand CustomAction
+         that shares that Id then receives the resolved string back as its
+         CustomActionData, referenced here as "[WriteConfig]". This avoids
+         pulling in the WixToolset.Util extension (WixQuietExec64) purely to
+         get CustomActionData plumbing.
+
+         NOTE: this only builds/validates the MSI's XML in CI - it has not
+         been verified with a real install on Windows. Needs a smoke test
+         (msiexec /i, confirm C:\ProgramData\Vantage\config.yaml or similar
+         is written with the correct values, and the service starts) on an
+         actual Windows machine before this is trusted in production. -->
+    <SetProperty Id="WriteConfig"
+      Before="WriteConfig" Sequence="execute" Condition="NOT Installed"
+      Value='cmd.exe /c powershell -ExecutionPolicy Bypass -File "[INSTALLDIR]setup.ps1" -ServerId "[SERVERID]" -Token "[TOKEN]" -ServerUrl "[SERVERURL]" -InstallDir "[INSTALLDIR]"' />
+
+    <CustomAction Id="WriteConfig" Directory="INSTALLDIR" ExeCommand="[WriteConfig]"
+      Execute="deferred" Impersonate="no" Return="check" />
+
+    <InstallExecuteSequence>
+      <Custom Action="WriteConfig" After="InstallFiles" Condition="NOT Installed" />
+    </InstallExecuteSequence>
+  </Package>
+</Wix>

server/cmd/main.go

@@ -56,7 +56,9 @@ func main() {
 	}()
 
 	// Start REST server
-	r := gin.Default()
+	r := gin.New()
+	r.Use(gin.Recovery())
+	r.Use(gin.LoggerWithConfig(gin.LoggerConfig{SkipPaths: []string{"/api/console/tunnel"}}))
 	r.Use(corsMiddleware())
 	api.RegisterRoutes(r)
 

server/go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/gin-gonic/gin v1.10.0
 	github.com/google/uuid v1.6.0
 	github.com/redis/go-redis/v9 v9.20.1
+	github.com/wwt/guac v1.3.2
 	go.mongodb.org/mongo-driver/v2 v2.2.2
 	golang.org/x/oauth2 v0.36.0
 	google.golang.org/grpc v1.64.0
@@ -26,14 +27,17 @@ require (
 	github.com/go-playground/validator/v10 v10.20.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
+	github.com/gorilla/websocket v1.4.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.16.7 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/konsorten/go-windows-terminal-sequences v1.0.1 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/sirupsen/logrus v1.4.2 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect

server/go.sum

@@ -40,8 +40,11 @@ github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEW
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.4.1 h1:q7AeDBpnBk8AogcD4DSag/Ukw/KV+YhzLj2bP5HvKCM=
+github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
@@ -50,6 +53,8 @@ github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa02
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -65,10 +70,14 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/redis/go-redis/v9 v9.20.1 h1:sfCU6A8P3dXbKyWes02uxA2baehGux9dZHfEKtsTB1w=
 github.com/redis/go-redis/v9 v9.20.1/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -81,6 +90,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
 github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/wwt/guac v1.3.2 h1:sH6OFGa/1tBs7ieWBVlZe7t6F5JAOWBry/tqQL/Vup4=
+github.com/wwt/guac v1.3.2/go.mod h1:eKm+NrnK7A88l4UBEcYNpZQGMpZRryYKoz4D/0/n1C0=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
@@ -116,6 +127,7 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
 golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

server/internal/api/console.go

@@ -0,0 +1,166 @@
+package api
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"github.com/wwt/guac"
+)
+
+// POST /api/console/connect
+// Body: { server_id, protocol, key_id?, rdp_username?, rdp_password? }
+// Returns: { session_id, token, ws_path }
+func consoleConnect(c *gin.Context) {
+	var body struct {
+		ServerID    string `json:"server_id" binding:"required"`
+		Protocol    string `json:"protocol" binding:"required"`
+		KeyID       string `json:"key_id"`
+		RDPUsername string `json:"rdp_username"`
+		RDPPassword string `json:"rdp_password"`
+		SSHUsername string `json:"ssh_username"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	srv, err := services.GetServer(body.ServerID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	sess, err := services.CreateConsoleSession(body.ServerID, body.Protocol, body.KeyID, actorFromCtx(c), c.ClientIP())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	token, err := services.SignSessionToken(sess.SessionID, time.Minute)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	if (body.Protocol == "rdp" || body.Protocol == "vnc") && (body.RDPUsername != "" || body.RDPPassword != "") {
+		if err := services.StashConsoleRDPCreds(sess.SessionID, body.RDPUsername, body.RDPPassword); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+	}
+
+	if body.Protocol == "ssh" {
+		if err := services.SetConsoleSSHUser(sess.SessionID, body.SSHUsername); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+	}
+
+	services.LogEvent("console.opened", actorFromCtx(c), srv.ServerID, "",
+		"console session opened ("+body.Protocol+")")
+
+	c.JSON(http.StatusOK, gin.H{
+		"session_id": sess.SessionID,
+		"token":      token,
+		"ws_path":    "/api/console/tunnel",
+	})
+}
+
+// GET /api/console/tunnel?token=... (WebSocket upgrade)
+func consoleTunnel(c *gin.Context) {
+	token := c.Query("token")
+	sessionID, err := services.VerifySessionToken(token)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+		return
+	}
+	sess, err := services.GetConsoleSession(sessionID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "session not found"})
+		return
+	}
+
+	// User-bound: the caller (authenticated via session cookie) must be the same
+	// user who opened the session. Blocks a leaked token being used by someone else.
+	if actor := actorFromCtx(c); actor != sess.User {
+		c.JSON(http.StatusForbidden, gin.H{"error": "session belongs to another user"})
+		return
+	}
+
+	// Single-use: atomically spend the token so a replay within its TTL is rejected.
+	if err := services.ConsumeSessionToken(sessionID); err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "token already used"})
+		return
+	}
+
+	srv, err := services.GetServer(sess.ServerID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	// Decrypt private key + passphrase in-memory only (ssh).
+	var privKey, passphrase string
+	if sess.Protocol == "ssh" && sess.KeyID != "" {
+		privKey, err = services.GetPrivateKey(sess.KeyID)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "selected key has no private material"})
+			return
+		}
+		passphrase, _ = services.GetPassphrase(sess.KeyID)
+	}
+
+	var rdpUser, rdpPass string
+	if sess.Protocol == "rdp" || sess.Protocol == "vnc" {
+		rdpUser, rdpPass, err = services.ConsumeConsoleRDPCreds(sessionID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "could not load credentials"})
+			return
+		}
+	}
+	gp, err := services.BuildGuacParams(srv, sess.Protocol, sess.SSHUsername, privKey, passphrase, rdpUser, rdpPass)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	guacdAddr := os.Getenv("GUACD_ADDR")
+	if guacdAddr == "" {
+		guacdAddr = "guacd:4822"
+	}
+
+	// Build a guac tunnel config from our params.
+	connect := func(r *http.Request) (guac.Tunnel, error) {
+		config := guac.NewGuacamoleConfiguration()
+		config.Protocol = gp.Protocol
+		for k, v := range gp.Params {
+			config.Parameters[k] = v
+		}
+		config.OptimalScreenWidth = 1024
+		config.OptimalScreenHeight = 768
+		config.OptimalResolution = 96
+
+		addr, err := net.ResolveTCPAddr("tcp", guacdAddr)
+		if err != nil {
+			return nil, err
+		}
+		conn, err := net.DialTCP("tcp", nil, addr)
+		if err != nil {
+			return nil, err
+		}
+		stream := guac.NewStream(conn, guac.SocketTimeout)
+		if err := stream.Handshake(config); err != nil {
+			return nil, err
+		}
+		return guac.NewSimpleTunnel(stream), nil
+	}
+
+	wsServer := guac.NewWebsocketServer(connect)
+	wsServer.OnDisconnect = func(id string, r *http.Request, t guac.Tunnel) {
+		_ = services.EndConsoleSession(sessionID)
+	}
+	wsServer.ServeHTTP(c.Writer, c.Request)
+}

server/internal/api/handlers.go

@@ -21,6 +21,7 @@ func actorFromCtx(c *gin.Context) string {
 
 func RegisterRoutes(r *gin.Engine) {
 	r.GET("/install", handleInstallScript)
+	r.GET("/install.ps1", handleInstallScriptWindows)
 	r.GET("/update", handleUpdateScript)
 
 	// ESO read endpoint — bearer-token auth, not session auth, so Kubernetes
@@ -73,6 +74,9 @@ func RegisterRoutes(r *gin.Engine) {
 		apiGroup.DELETE("/keys/:id", deleteKey)
 		apiGroup.POST("/keys/:id/assign", assignKey)
 		apiGroup.DELETE("/keys/:id/assign/:serverId", revokeAssignment)
+
+		apiGroup.POST("/console/connect", consoleConnect)
+		apiGroup.GET("/console/tunnel", consoleTunnel)
 	}
 }
 
@@ -218,13 +222,14 @@ func createKey(c *gin.Context) {
 		Label      string `json:"label" binding:"required"`
 		PublicKey  string `json:"public_key" binding:"required"`
 		PrivateKey string `json:"private_key"`
+		Passphrase string `json:"passphrase"`
 	}
 	if err := c.ShouldBindJSON(&body); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	key, err := services.CreateKey(body.Label, body.PublicKey, "uploaded", "", body.PrivateKey)
+	key, err := services.CreateKey(body.Label, body.PublicKey, "uploaded", "", body.PrivateKey, body.Passphrase)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return

server/internal/api/install_ps1.go

@@ -0,0 +1,56 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+
+	"github.com/gin-gonic/gin"
+)
+
+func handleInstallScriptWindows(c *gin.Context) {
+	serverID := c.Query("server_id")
+	token := c.Query("token")
+
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+	grpcHost := os.Getenv("GRPC_HOST")
+	if grpcHost == "" {
+		grpcHost = os.Getenv("PUBLIC_HOST")
+	}
+	if grpcHost == "" {
+		grpcHost = "vantage.example.com"
+	}
+
+	script := fmt.Sprintf(
+		"#Requires -RunAsAdministrator\n"+
+			"$ErrorActionPreference = \"Stop\"\n"+
+			"\n"+
+			"$ServerId = \"%s\"\n"+
+			"$Token = \"%s\"\n"+
+			"$GiteaHost = \"%s\"\n"+
+			"$ServerUrl = \"%s\" -replace '^https?://',''\n"+
+			"\n"+
+			"$rel = Invoke-RestMethod -Uri \"https://$GiteaHost/api/v1/repos/mrhid6/vantage/releases?limit=10\"\n"+
+			"$tag = ($rel | Where-Object { $_.tag_name -like 'agent/v*' } | Select-Object -First 1).tag_name\n"+
+			"if (-not $tag) { throw \"Could not determine latest agent version\" }\n"+
+			"$enc = $tag -replace '/','%%2F'\n"+
+			"$base = \"https://$GiteaHost/mrhid6/vantage/releases/download/$enc\"\n"+
+			"\n"+
+			"$tmp = Join-Path $env:TEMP \"vantage-agent.msi\"\n"+
+			"Invoke-WebRequest -Uri \"$base/vantage-agent.msi\" -OutFile $tmp\n"+
+			"Invoke-WebRequest -Uri \"$base/checksums-msi.txt\" -OutFile \"$env:TEMP\\checksums-msi.txt\"\n"+
+			"\n"+
+			"$expected = (Get-Content \"$env:TEMP\\checksums-msi.txt\" | Select-String 'vantage-agent.msi').ToString().Split()[0]\n"+
+			"$actual = (Get-FileHash $tmp -Algorithm SHA256).Hash.ToLower()\n"+
+			"if ($expected -ne $actual) { throw \"Checksum mismatch\" }\n"+
+			"\n"+
+			"Start-Process msiexec.exe -Wait -ArgumentList \"/i `\"$tmp`\" /qn SERVERID=$ServerId TOKEN=$Token SERVERURL=$ServerUrl\"\n"+
+			"Write-Host \"Vantage agent installed.\"\n",
+		serverID, token, giteaHost, grpcHost)
+
+	c.Header("Content-Type", "text/plain; charset=utf-8")
+	c.String(http.StatusOK, script)
+}

server/internal/grpc/server.go

@@ -57,7 +57,8 @@ func (s *vantageServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKe
 		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
 	}
 
-	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey)
+	// Agent-generated keys carry no passphrase over the wire (proto has no field).
+	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey, "")
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to store key: %v", err)
 	}

server/internal/models/console_session.go

@@ -0,0 +1,28 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type ConsoleSession struct {
+	ID        bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	SessionID string        `bson:"session_id" json:"session_id"`
+	ServerID  string        `bson:"server_id" json:"server_id"`
+	Protocol  string        `bson:"protocol" json:"protocol"` // ssh | rdp | vnc
+	KeyID     string        `bson:"key_id,omitempty" json:"key_id,omitempty"`
+	User      string        `bson:"user" json:"user"`
+	StartedAt time.Time     `bson:"started_at" json:"started_at"`
+	EndedAt   *time.Time    `bson:"ended_at,omitempty" json:"ended_at,omitempty"`
+	ClientIP  string        `bson:"client_ip,omitempty" json:"client_ip,omitempty"`
+
+	// TokenConsumedAt marks the one-time session token as spent. Set atomically
+	// when the tunnel opens; a second open with the same token is rejected.
+	TokenConsumedAt *time.Time `bson:"token_consumed_at,omitempty" json:"-"`
+
+	SSHUsername string `bson:"ssh_username,omitempty" json:"ssh_username,omitempty"`
+
+	RDPUserEnc string `bson:"rdp_user_enc,omitempty" json:"-"`
+	RDPPassEnc string `bson:"rdp_pass_enc,omitempty" json:"-"`
+}

server/internal/models/key.go

@@ -16,5 +16,7 @@ type Key struct {
 	GeneratedByServerID string        `bson:"generated_by_server_id,omitempty" json:"generated_by_server_id,omitempty"`
 	PrivateKeyEncrypted string        `bson:"private_key_enc,omitempty" json:"-"`
 	HasPrivateKey       bool          `bson:"-" json:"has_private_key"`
+	PassphraseEncrypted string        `bson:"passphrase_enc,omitempty" json:"-"`
+	HasPassphrase       bool          `bson:"-" json:"has_passphrase"`
 	CreatedAt           time.Time     `bson:"created_at" json:"created_at"`
 }

server/internal/models/server.go

@@ -18,6 +18,10 @@ type Server struct {
 	Hostname         string         `bson:"hostname" json:"hostname"`
 	IPAddress        string         `bson:"ip_address" json:"ip_address"`
 	OSInfo           string         `bson:"os_info" json:"os_info"`
+	OSType           string         `bson:"os_type,omitempty" json:"os_type,omitempty"`
+	ConsoleProtocols []string       `bson:"console_protocols,omitempty" json:"console_protocols,omitempty"`
+	SSHPort          int            `bson:"ssh_port,omitempty" json:"ssh_port,omitempty"`
+	RDPPort          int            `bson:"rdp_port,omitempty" json:"rdp_port,omitempty"`
 	PreRegToken      string         `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
 	PreRegExpires    *time.Time     `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
 	AgentTokenHash   string         `bson:"agent_token_hash,omitempty" json:"-"`

server/internal/services/console.go

@@ -0,0 +1,250 @@
+package services
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func sessionHMACKey() ([]byte, error) {
+	// Reuse the AES key material as the HMAC secret. Distinct domain via prefix.
+	k, err := encryptionKey()
+	if err != nil {
+		return nil, err
+	}
+	mac := hmac.New(sha256.New, k)
+	mac.Write([]byte("vantage-console-session-v1"))
+	return mac.Sum(nil), nil
+}
+
+func b64(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
+
+// SignSessionToken returns a signed, expiring token binding a session id.
+func SignSessionToken(sessionID string, ttl time.Duration) (string, error) {
+	key, err := sessionHMACKey()
+	if err != nil {
+		return "", err
+	}
+	exp := time.Now().Add(ttl).Unix()
+	payload := fmt.Sprintf("%s.%d", b64([]byte(sessionID)), exp)
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(payload))
+	return payload + "." + b64(mac.Sum(nil)), nil
+}
+
+// VerifySessionToken checks signature + expiry and returns the session id.
+func VerifySessionToken(token string) (string, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return "", fmt.Errorf("malformed token")
+	}
+	payload := parts[0] + "." + parts[1]
+	key, err := sessionHMACKey()
+	if err != nil {
+		return "", err
+	}
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(payload))
+	want := mac.Sum(nil)
+	got, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil || !hmac.Equal(want, got) {
+		return "", fmt.Errorf("invalid signature")
+	}
+	exp, err := strconv.ParseInt(parts[1], 10, 64)
+	if err != nil {
+		return "", fmt.Errorf("invalid expiry")
+	}
+	if time.Now().Unix() > exp {
+		return "", fmt.Errorf("token expired")
+	}
+	sid, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return "", fmt.Errorf("invalid session id")
+	}
+	return string(sid), nil
+}
+
+type GuacParams struct {
+	Protocol string
+	Params   map[string]string
+}
+
+func portOr(v, def int) string {
+	if v == 0 {
+		v = def
+	}
+	return strconv.Itoa(v)
+}
+
+// BuildGuacParams assembles the guacd connection parameter map for a protocol.
+// privateKey/passphrase are the decrypted SSH private key and its optional
+// passphrase (ssh only); rdpUser/rdpPass are used for rdp, and rdpPass carries
+// the password for vnc. None of these values are persisted or logged by the caller.
+func BuildGuacParams(srv *models.Server, protocol, sshUser, privateKey, passphrase, rdpUser, rdpPass string) (*GuacParams, error) {
+	host := srv.IPAddress
+	switch protocol {
+	case "ssh":
+		p := map[string]string{
+			"hostname": host,
+			"port":     portOr(srv.SSHPort, 22),
+		}
+		if sshUser == "" {
+			sshUser = "root"
+		}
+		p["username"] = sshUser
+		if privateKey != "" {
+			p["private-key"] = privateKey
+		}
+		if passphrase != "" {
+			p["passphrase"] = passphrase
+		}
+		return &GuacParams{Protocol: "ssh", Params: p}, nil
+	case "rdp":
+		return &GuacParams{Protocol: "rdp", Params: map[string]string{
+			"hostname":    host,
+			"port":        portOr(srv.RDPPort, 3389),
+			"username":    rdpUser,
+			"password":    rdpPass,
+			"security":    "any",
+			"ignore-cert": "true",
+		}}, nil
+	case "vnc":
+		return &GuacParams{Protocol: "vnc", Params: map[string]string{
+			"hostname": host,
+			"port":     "5900",
+			"password": rdpPass,
+		}}, nil
+	default:
+		return nil, fmt.Errorf("unsupported protocol %q", protocol)
+	}
+}
+
+func CreateConsoleSession(serverID, protocol, keyID, user, clientIP string) (*models.ConsoleSession, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	s := &models.ConsoleSession{
+		SessionID: uuid.NewString(),
+		ServerID:  serverID,
+		Protocol:  protocol,
+		KeyID:     keyID,
+		User:      user,
+		ClientIP:  clientIP,
+		StartedAt: time.Now(),
+	}
+	if _, err := db.Col("console_sessions").InsertOne(ctx, s); err != nil {
+		return nil, err
+	}
+	return s, nil
+}
+
+func GetConsoleSession(sessionID string) (*models.ConsoleSession, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var s models.ConsoleSession
+	if err := db.Col("console_sessions").FindOne(ctx, bson.M{"session_id": sessionID}).Decode(&s); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+// StashConsoleRDPCreds encrypts and stores single-use RDP credentials on the
+// session document. They are consumed (and cleared) when the tunnel opens.
+func StashConsoleRDPCreds(sessionID, username, password string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	u, err := encryptString(username)
+	if err != nil {
+		return err
+	}
+	p, err := encryptString(password)
+	if err != nil {
+		return err
+	}
+	_, err = db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID},
+		bson.M{"$set": bson.M{"rdp_user_enc": u, "rdp_pass_enc": p}},
+	)
+	return err
+}
+
+// ConsumeConsoleRDPCreds decrypts and returns the stored RDP credentials, then
+// clears them from the session document (single-use). Returns empty strings if
+// none were stored.
+func ConsumeConsoleRDPCreds(sessionID string) (username, password string, err error) {
+	s, err := GetConsoleSession(sessionID)
+	if err != nil {
+		return "", "", err
+	}
+	if s.RDPUserEnc == "" && s.RDPPassEnc == "" {
+		return "", "", nil
+	}
+	if s.RDPUserEnc != "" {
+		if username, err = decryptString(s.RDPUserEnc); err != nil {
+			return "", "", err
+		}
+	}
+	if s.RDPPassEnc != "" {
+		if password, err = decryptString(s.RDPPassEnc); err != nil {
+			return "", "", err
+		}
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, _ = db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID},
+		bson.M{"$unset": bson.M{"rdp_user_enc": "", "rdp_pass_enc": ""}},
+	)
+	return username, password, nil
+}
+
+// SetConsoleSSHUser persists the SSH username to use on the session doc.
+func SetConsoleSSHUser(sessionID, username string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err := db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID},
+		bson.M{"$set": bson.M{"ssh_username": username}})
+	return err
+}
+
+// ConsumeSessionToken atomically marks a session's one-time token as spent.
+// It returns an error if the token was already consumed (replay) or the session
+// does not exist, so the tunnel can be opened at most once per issued token.
+func ConsumeSessionToken(sessionID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	now := time.Now()
+	res, err := db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID, "token_consumed_at": nil},
+		bson.M{"$set": bson.M{"token_consumed_at": now}},
+	)
+	if err != nil {
+		return err
+	}
+	if res.MatchedCount == 0 {
+		return fmt.Errorf("session token already used")
+	}
+	return nil
+}
+
+func EndConsoleSession(sessionID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	now := time.Now()
+	_, err := db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID, "ended_at": nil},
+		bson.M{"$set": bson.M{"ended_at": now}},
+	)
+	return err
+}

server/internal/services/console_test.go

@@ -0,0 +1,111 @@
+package services
+
+import (
+	"testing"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+func TestSessionTokenRoundTrip(t *testing.T) {
+	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	tok, err := SignSessionToken("sess-123", time.Minute)
+	if err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+	got, err := VerifySessionToken(tok)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if got != "sess-123" {
+		t.Fatalf("got %q want sess-123", got)
+	}
+}
+
+func TestSessionTokenExpired(t *testing.T) {
+	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	tok, err := SignSessionToken("sess-123", -time.Second)
+	if err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+	if _, err := VerifySessionToken(tok); err == nil {
+		t.Fatalf("expected expiry error, got nil")
+	}
+}
+
+func TestSessionTokenTampered(t *testing.T) {
+	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	tok, _ := SignSessionToken("sess-123", time.Minute)
+	if _, err := VerifySessionToken(tok + "x"); err == nil {
+		t.Fatalf("expected signature error, got nil")
+	}
+}
+
+func TestBuildGuacParamsSSH(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
+	p, err := BuildGuacParams(srv, "ssh", "", "PRIVATE-KEY-DATA", "", "", "")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Protocol != "ssh" {
+		t.Fatalf("protocol %q", p.Protocol)
+	}
+	if p.Params["hostname"] != "10.0.0.5" || p.Params["port"] != "22" {
+		t.Fatalf("bad host/port: %+v", p.Params)
+	}
+	if p.Params["private-key"] != "PRIVATE-KEY-DATA" {
+		t.Fatalf("missing private-key")
+	}
+	if p.Params["username"] != "root" {
+		t.Fatalf("expected default username root, got %q", p.Params["username"])
+	}
+}
+
+func TestBuildGuacParamsRDP(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.9", RDPPort: 3389}
+	p, err := BuildGuacParams(srv, "rdp", "", "", "", "administrator", "s3cret")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Params["port"] != "3389" || p.Params["username"] != "administrator" || p.Params["password"] != "s3cret" {
+		t.Fatalf("bad rdp params: %+v", p.Params)
+	}
+	if p.Params["ignore-cert"] != "true" {
+		t.Fatalf("expected ignore-cert=true")
+	}
+}
+
+func TestBuildGuacParamsUnknownProtocol(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.9"}
+	if _, err := BuildGuacParams(srv, "telnet", "", "", "", "", ""); err == nil {
+		t.Fatalf("expected error for unknown protocol")
+	}
+}
+
+func TestBuildGuacParamsSSHPassphrase(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
+	p, err := BuildGuacParams(srv, "ssh", "deploy", "PK", "s3cret-phrase", "", "")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Params["username"] != "deploy" {
+		t.Fatalf("username %q", p.Params["username"])
+	}
+	if p.Params["passphrase"] != "s3cret-phrase" {
+		t.Fatalf("missing passphrase: %+v", p.Params)
+	}
+}
+
+func TestBuildGuacParamsVNC(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.7"}
+	p, err := BuildGuacParams(srv, "vnc", "", "", "", "", "vncpass")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Protocol != "vnc" || p.Params["hostname"] != "10.0.0.7" || p.Params["port"] != "5900" || p.Params["password"] != "vncpass" {
+		t.Fatalf("bad vnc params: %+v", p.Params)
+	}
+}

server/internal/services/keys.go

@@ -33,9 +33,10 @@ func computeFingerprint(pubKey string) string {
 
 func setKeyMeta(k *models.Key) {
 	k.HasPrivateKey = k.PrivateKeyEncrypted != ""
+	k.HasPassphrase = k.PassphraseEncrypted != ""
 }
 
-func CreateKey(label, publicKey, source, generatedByServerID, privateKey string) (*models.Key, error) {
+func CreateKey(label, publicKey, source, generatedByServerID, privateKey, passphrase string) (*models.Key, error) {
 	key := &models.Key{
 		KeyID:               uuid.NewString(),
 		Label:               label,
@@ -52,6 +53,13 @@ func CreateKey(label, publicKey, source, generatedByServerID, privateKey string)
 		}
 		key.PrivateKeyEncrypted = enc
 	}
+	if passphrase != "" {
+		enc, err := encryptString(passphrase)
+		if err != nil {
+			return nil, fmt.Errorf("encrypt passphrase: %w", err)
+		}
+		key.PassphraseEncrypted = enc
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -90,6 +98,22 @@ func GetPrivateKey(keyID string) (string, error) {
 	return decryptPrivateKey(key.PrivateKeyEncrypted)
 }
 
+// GetPassphrase returns the decrypted passphrase for a key, or an empty string
+// if the key has none stored.
+func GetPassphrase(keyID string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var key models.Key
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+		return "", err
+	}
+	if key.PassphraseEncrypted == "" {
+		return "", nil
+	}
+	return decryptString(key.PassphraseEncrypted)
+}
+
 type KeyWithCount struct {
 	models.Key    `bson:",inline"`
 	AssignedCount int `bson:"-" json:"assigned_count"`

server/internal/services/servers.go

@@ -79,6 +79,25 @@ func GetServerByPreRegToken(token string) (*models.Server, error) {
 	return &s, nil
 }
 
+// OSTypeFromInfo derives a coarse os_type ("windows" or "linux") from the
+// agent-reported os_info string, which is formatted "<GOOS> <GOARCH>".
+// Anything that is not explicitly windows defaults to linux.
+func OSTypeFromInfo(osInfo string) string {
+	if strings.HasPrefix(strings.ToLower(osInfo), "windows") {
+		return "windows"
+	}
+	return "linux"
+}
+
+// defaultConsoleFields returns the initial console configuration for a newly
+// registered server based on its os_type.
+func defaultConsoleFields(osType string) (protocols []string, sshPort, rdpPort int) {
+	if osType == "windows" {
+		return []string{"rdp"}, 22, 3389
+	}
+	return []string{"ssh"}, 22, 3389
+}
+
 func RegisterServer(serverID, preRegToken, hostname, ipAddress, osInfo string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
@@ -100,18 +119,31 @@ func RegisterServer(serverID, preRegToken, hostname, ipAddress, osInfo string) (
 	tokenHash := HashToken(agentToken)
 	now := time.Now()
 
+	osType := OSTypeFromInfo(osInfo)
+	protocols, sshPort, rdpPort := defaultConsoleFields(osType)
+
+	setFields := bson.M{
+		"hostname":         hostname,
+		"ip_address":       ipAddress,
+		"os_info":          osInfo,
+		"os_type":          osType,
+		"agent_token_hash": tokenHash,
+		"status":           "active",
+		"last_seen":        now,
+		"pre_reg_token":    "",
+		"pre_reg_expires":  nil,
+	}
+	if len(s.ConsoleProtocols) == 0 {
+		setFields["console_protocols"] = protocols
+		setFields["ssh_port"] = sshPort
+		setFields["rdp_port"] = rdpPort
+	}
+
 	_, err = db.Col("servers").UpdateOne(ctx,
 		bson.M{"server_id": serverID},
-		bson.M{"$set": bson.M{
-			"hostname":         hostname,
-			"ip_address":       ipAddress,
-			"os_info":          osInfo,
-			"agent_token_hash": tokenHash,
-			"status":           "active",
-			"last_seen":        now,
-			"pre_reg_token":    "",
-			"pre_reg_expires":  nil,
-		}},
+		bson.M{
+			"$set": setFields,
+		},
 	)
 	if err != nil {
 		return "", err

server/internal/services/servers_console_test.go

@@ -0,0 +1,18 @@
+package services
+
+import "testing"
+
+func TestOSTypeFromInfo(t *testing.T) {
+	cases := map[string]string{
+		"windows amd64": "windows",
+		"linux amd64":   "linux",
+		"linux arm64":   "linux",
+		"":              "linux",
+		"darwin arm64":  "linux",
+	}
+	for in, want := range cases {
+		if got := OSTypeFromInfo(in); got != want {
+			t.Errorf("OSTypeFromInfo(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

web/app/keys/page.tsx

@@ -12,9 +12,10 @@ function UploadKeyModal({ onClose }: { onClose: () => void }) {
   const [label, setLabel] = useState("");
   const [publicKey, setPublicKey] = useState("");
   const [privateKey, setPrivateKey] = useState("");
+  const [passphrase, setPassphrase] = useState("");
 
   const { mutate: upload, isPending, error } = useMutation({
-    mutationFn: () => api.uploadKey(label.trim(), publicKey.trim(), privateKey.trim() || undefined),
+    mutationFn: () => api.uploadKey(label.trim(), publicKey.trim(), privateKey.trim() || undefined, passphrase || undefined),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["keys"] });
       onClose();
@@ -70,6 +71,19 @@ function UploadKeyModal({ onClose }: { onClose: () => void }) {
               className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 font-mono text-xs text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent resize-none"
             />
           </div>
+          <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+              Passphrase{" "}
+              <span className="text-text-tertiary font-normal">(optional — for an encrypted private key)</span>
+            </label>
+            <input
+              type="password"
+              value={passphrase}
+              onChange={(e) => setPassphrase(e.target.value)}
+              autoComplete="new-password"
+              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent"
+            />
+          </div>
         </div>
 
         <div className="mt-6 flex justify-end gap-3">

web/app/servers/[id]/console/page.tsx

@@ -0,0 +1,243 @@
+"use client";
+
+import { useEffect, useMemo, useRef, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { useParams, useRouter, useSearchParams } from "next/navigation";
+import Link from "next/link";
+import { api } from "@/lib/api";
+import { Button, Card } from "@/components/ui";
+import { openConsole } from "@/lib/guacConsole";
+
+export default function ServerConsolePage() {
+    const params = useParams();
+    const router = useRouter();
+    const searchParams = useSearchParams();
+    const serverId = params.id as string;
+
+    const containerRef = useRef<HTMLDivElement>(null);
+    const connectionRef = useRef<{ disconnect: () => void } | null>(null);
+
+    const [protocol, setProtocol] = useState<string>(searchParams.get("protocol") || "");
+    const [keyId, setKeyId] = useState<string>("");
+    const [sshUsername, setSshUsername] = useState<string>("root");
+    const [rdpUsername, setRdpUsername] = useState("");
+    const [rdpPassword, setRdpPassword] = useState("");
+    const [vncPassword, setVncPassword] = useState("");
+    const [connecting, setConnecting] = useState(false);
+    const [connected, setConnected] = useState(false);
+    const [error, setError] = useState<string | null>(null);
+
+    // Inject the vendored Guacamole client script once.
+    useEffect(() => {
+        const s = document.createElement("script");
+        s.src = "/lib/guacamole-common.js";
+        s.async = true;
+        document.body.appendChild(s);
+        return () => {
+            document.body.removeChild(s);
+        };
+    }, []);
+
+    // Disconnect on unmount.
+    useEffect(() => {
+        return () => {
+            connectionRef.current?.disconnect();
+        };
+    }, []);
+
+    const { data: server, isLoading: serverLoading } = useQuery({
+        queryKey: ["servers", serverId],
+        queryFn: () => api.getServer(serverId),
+    });
+
+    const { data: keys, isLoading: keysLoading } = useQuery({
+        queryKey: ["keys"],
+        queryFn: () => api.listKeys(),
+    });
+
+    const usableKeys = useMemo(() => (keys ?? []).filter((k) => k.has_private_key === true), [keys]);
+    const protocols = server?.console_protocols ?? [];
+
+    useEffect(() => {
+        if (!protocol && protocols.length > 0) {
+            setProtocol(protocols[0]);
+        }
+    }, [protocols, protocol]);
+
+    async function handleConnect() {
+        setError(null);
+        setConnecting(true);
+        try {
+            const body: Parameters<typeof api.connectConsole>[0] = {
+                server_id: serverId,
+                protocol,
+            };
+            if (protocol === "ssh") {
+                body.key_id = keyId || undefined;
+                body.ssh_username = sshUsername || undefined;
+            } else if (protocol === "rdp") {
+                body.rdp_username = rdpUsername || undefined;
+                body.rdp_password = rdpPassword || undefined;
+            } else if (protocol === "vnc") {
+                body.rdp_password = vncPassword || undefined;
+            }
+
+            const { token, ws_path } = await api.connectConsole(body);
+
+            const wsProto = location.protocol === "https:" ? "wss" : "ws";
+            const wsUrl = `${wsProto}://${location.host}${ws_path}?token=${encodeURIComponent(token)}`;
+
+            if (containerRef.current) {
+                const conn = openConsole(containerRef.current, wsUrl);
+                connectionRef.current = conn;
+                setConnected(true);
+            }
+        } catch (e) {
+            setError(e instanceof Error ? e.message : "Failed to connect");
+        } finally {
+            setConnecting(false);
+        }
+    }
+
+    function handleDisconnect() {
+        connectionRef.current?.disconnect();
+        connectionRef.current = null;
+        setConnected(false);
+        if (containerRef.current) {
+            containerRef.current.innerHTML = "";
+        }
+    }
+
+    if (serverLoading || keysLoading) {
+        return (
+            <div className="flex h-full items-center justify-center">
+                <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+            </div>
+        );
+    }
+
+    if (!server) {
+        return (
+            <div className="p-8">
+                <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Server not found or failed to load.</div>
+            </div>
+        );
+    }
+
+    return (
+        <div className="flex h-full flex-col p-8">
+            <div className="mb-4 flex items-center gap-3">
+                <Link href={`/servers/${serverId}`} className="text-text-secondary hover:text-text-primary text-sm">
+                    ← {server.hostname}
+                </Link>
+            </div>
+
+            <h1 className="mb-4 text-2xl font-bold text-text-primary">Console</h1>
+
+            {error && <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">{error}</div>}
+
+            {!connected ? (
+                <Card className="mb-4 max-w-xl">
+                    <div className="space-y-4">
+                        <div>
+                            <label className="mb-1.5 block text-sm font-medium text-text-secondary">Protocol</label>
+                            <select
+                                value={protocol}
+                                onChange={(e) => setProtocol(e.target.value)}
+                                className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                            >
+                                {protocols.length === 0 && <option value="">No protocols available</option>}
+                                {protocols.map((p) => (
+                                    <option key={p} value={p}>
+                                        {p.toUpperCase()}
+                                    </option>
+                                ))}
+                            </select>
+                        </div>
+
+                        {protocol === "ssh" && (
+                            <div>
+                                <label className="mb-1.5 block text-sm font-medium text-text-secondary">SSH Username</label>
+                                <input
+                                    type="text"
+                                    value={sshUsername}
+                                    onChange={(e) => setSshUsername(e.target.value)}
+                                    placeholder="root"
+                                    className="mb-3 w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                                <label className="mb-1.5 block text-sm font-medium text-text-secondary">SSH Key</label>
+                                <select
+                                    value={keyId}
+                                    onChange={(e) => setKeyId(e.target.value)}
+                                    className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                >
+                                    <option value="">Select a key…</option>
+                                    {usableKeys.map((k) => (
+                                        <option key={k.key_id} value={k.key_id}>
+                                            {k.label}
+                                        </option>
+                                    ))}
+                                </select>
+                                {usableKeys.length === 0 && (
+                                    <p className="mt-1.5 text-xs text-text-tertiary">No keys with stored private material are available.</p>
+                                )}
+                            </div>
+                        )}
+
+                        {protocol === "rdp" && (
+                            <>
+                                <div>
+                                    <label className="mb-1.5 block text-sm font-medium text-text-secondary">Username</label>
+                                    <input
+                                        type="text"
+                                        value={rdpUsername}
+                                        onChange={(e) => setRdpUsername(e.target.value)}
+                                        className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                    />
+                                </div>
+                                <div>
+                                    <label className="mb-1.5 block text-sm font-medium text-text-secondary">Password</label>
+                                    <input
+                                        type="password"
+                                        value={rdpPassword}
+                                        onChange={(e) => setRdpPassword(e.target.value)}
+                                        autoComplete="new-password"
+                                        className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                    />
+                                </div>
+                            </>
+                        )}
+
+                        {protocol === "vnc" && (
+                            <div>
+                                <label className="mb-1.5 block text-sm font-medium text-text-secondary">Password</label>
+                                <input
+                                    type="password"
+                                    value={vncPassword}
+                                    onChange={(e) => setVncPassword(e.target.value)}
+                                    autoComplete="new-password"
+                                    className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                            </div>
+                        )}
+
+                        <Button variant="primary" loading={connecting} disabled={!protocol} onClick={handleConnect}>
+                            Connect
+                        </Button>
+                    </div>
+                </Card>
+            ) : (
+                <div className="mb-4 flex items-center gap-3">
+                    <Button variant="danger" onClick={handleDisconnect}>
+                        Disconnect
+                    </Button>
+                </div>
+            )}
+
+            <div
+                ref={containerRef}
+                className="min-h-[500px] flex-1 rounded-lg border border-border bg-black"
+            />
+        </div>
+    );
+}

web/app/servers/[id]/page.tsx

@@ -338,6 +338,16 @@ export default function ServerDetailPage() {
                     <p className="mt-1 font-mono text-sm text-text-secondary">{server.ip_address}</p>
                 </div>
                 <div className="flex gap-2">
+                    {server.console_protocols?.map((p) => (
+                        <Link key={p} href={`/servers/${serverId}/console?protocol=${p}`}>
+                            <Button variant="secondary">
+                                <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                                    <path strokeLinecap="round" strokeLinejoin="round" d="M9 17.25v1.007a3 3 0 01-.879 2.122L7.5 21h9l-.621-.621A3 3 0 0115 18.257V17.25m6-12V15a2.25 2.25 0 01-2.25 2.25H5.25A2.25 2.25 0 013 15V5.25m18 0A2.25 2.25 0 0018.75 3H5.25A2.25 2.25 0 003 5.25m18 0V12a2.25 2.25 0 01-2.25 2.25H5.25A2.25 2.25 0 013 12V5.25" />
+                                </svg>
+                                Connect {p.toUpperCase()}
+                            </Button>
+                        </Link>
+                    ))}
                     {server.available_updates && server.available_updates.length > 0 && (
                         <Button
                             variant="secondary"

web/lib/api.ts

@@ -19,6 +19,22 @@ export interface Server {
   created_at: string;
   available_updates?: PackageUpdate[];
   updates_checked_at?: string;
+  console_protocols?: string[];
+}
+
+export interface ConsoleConnectRequest {
+  server_id: string;
+  protocol: string;
+  key_id?: string;
+  rdp_username?: string;
+  rdp_password?: string;
+  ssh_username?: string;
+}
+
+export interface ConsoleConnectResponse {
+  session_id: string;
+  token: string;
+  ws_path: string;
 }
 
 export interface Key {
@@ -30,6 +46,7 @@ export interface Key {
   source: KeySource;
   generated_by_server_id?: string;
   has_private_key: boolean;
+  has_passphrase?: boolean;
   created_at: string;
   assigned_count?: number;
 }
@@ -262,10 +279,15 @@ export const api = {
     return request<KeyWithAssignments>(`/keys/${keyId}`);
   },
 
-  uploadKey(label: string, public_key: string, private_key?: string): Promise<Key> {
+  uploadKey(label: string, public_key: string, private_key?: string, passphrase?: string): Promise<Key> {
     return request<Key>("/keys", {
       method: "POST",
-      body: JSON.stringify({ label, public_key, private_key: private_key || undefined }),
+      body: JSON.stringify({
+        label,
+        public_key,
+        private_key: private_key || undefined,
+        passphrase: passphrase || undefined,
+      }),
     });
   },
 
@@ -290,4 +312,12 @@ export const api = {
       method: "DELETE",
     });
   },
+
+  // Console
+  connectConsole(body: ConsoleConnectRequest): Promise<ConsoleConnectResponse> {
+    return request<ConsoleConnectResponse>("/console/connect", {
+      method: "POST",
+      body: JSON.stringify(body),
+    });
+  },
 };

web/lib/guacConsole.ts

@@ -0,0 +1,27 @@
+// Thin wrapper over the vendored guacamole-common-js client.
+// The library attaches a global `Guacamole` object when loaded.
+declare const Guacamole: any;
+
+export function openConsole(container: HTMLElement, wsUrl: string): { disconnect: () => void } {
+  const tunnel = new Guacamole.WebSocketTunnel(wsUrl);
+  const client = new Guacamole.Client(tunnel);
+
+  container.innerHTML = "";
+  container.appendChild(client.getDisplay().getElement());
+
+  client.connect("");
+
+  // Wire keyboard + mouse.
+  const mouse = new Guacamole.Mouse(client.getDisplay().getElement());
+  mouse.onmousedown = mouse.onmouseup = mouse.onmousemove = (state: any) =>
+    client.sendMouseState(state);
+  const keyboard = new Guacamole.Keyboard(document);
+  keyboard.onkeydown = (k: number) => client.sendKeyEvent(1, k);
+  keyboard.onkeyup = (k: number) => client.sendKeyEvent(0, k);
+
+  return {
+    disconnect() {
+      client.disconnect();
+    },
+  };
+}

web/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

web/tsconfig.json

@@ -1,6 +1,10 @@
 {
   "compilerOptions": {
-    "lib": ["dom", "dom.iterable", "esnext"],
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
@@ -10,7 +14,7 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "incremental": true,
     "plugins": [
       {
@@ -18,9 +22,20 @@
       }
     ],
     "paths": {
-      "@/*": ["./*"]
-    }
+      "@/*": [
+        "./*"
+      ]
+    },
+    "target": "ES2017"
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
 }