fix: Fixed agent ci install

- single-use session tokens (atomic ConsumeSessionToken) + user-bound tunnel (actor must match session opener)
- wire VNC end-to-end (stash/consume password, connect+tunnel, frontend password field)
- passphrase-protected SSH keys: passphrase_enc on Key model, capture on upload, decrypt + pass to guacd

.gitea/workflows/agent-release.yml

@@ -32,20 +32,91 @@ jobs:
                   mkdir -p dist
                   GOOS=linux GOARCH=amd64 go build \
                     -ldflags="-s -w -X main.Version=${VERSION}" \
-                    -o dist/keymanager-agent-linux-amd64 ./cmd
+                    -o dist/vantage-agent-linux-amd64 ./cmd
                   GOOS=linux GOARCH=arm64 go build \
                     -ldflags="-s -w -X main.Version=${VERSION}" \
-                    -o dist/keymanager-agent-linux-arm64 ./cmd
+                    -o dist/vantage-agent-linux-arm64 ./cmd
+                  GOOS=windows GOARCH=amd64 go build \
+                    -ldflags="-s -w -X main.Version=${VERSION}" \
+                    -o dist/vantage-agent-windows-amd64.exe ./cmd
 
             - name: Checksums
               working-directory: agent/dist
-              run: sha256sum keymanager-agent-linux-amd64 keymanager-agent-linux-arm64 > checksums.txt
+              run: sha256sum vantage-agent-linux-amd64 vantage-agent-linux-arm64 vantage-agent-windows-amd64.exe > checksums.txt
 
             - name: Create release
               uses: https://gitea.com/actions/gitea-release-action@v1
               with:
                   token: ${{ secrets.RELEASE_TOKEN }}
                   files: |
-                      agent/dist/keymanager-agent-linux-amd64
-                      agent/dist/keymanager-agent-linux-arm64
+                      agent/dist/vantage-agent-linux-amd64
+                      agent/dist/vantage-agent-linux-arm64
+                      agent/dist/vantage-agent-windows-amd64.exe
                       agent/dist/checksums.txt
+
+    msi:
+        needs: build
+        runs-on: windows-2022
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Set up Go
+              uses: actions/setup-go@v5
+              with:
+                  go-version: "1.26"
+                  cache: true
+                  cache-dependency-path: agent/go.sum
+
+            - name: Build agent exe
+              working-directory: agent
+              shell: pwsh
+              run: |
+                  $env:GOOS = "windows"; $env:GOARCH = "amd64"
+                  go build -o ../installer/vantage-agent-windows-amd64.exe ./cmd
+
+            - name: Cache nssm
+              id: cache-nssm
+              uses: actions/cache@v4
+              with:
+                  path: installer/nssm.exe
+                  key: nssm-2.24-win64
+
+            - name: Fetch nssm
+              if: steps.cache-nssm.outputs.cache-hit != 'true'
+              working-directory: installer
+              shell: pwsh
+              run: |
+                  Invoke-WebRequest -Uri https://nssm.cc/release/nssm-2.24.zip -OutFile nssm.zip
+                  Expand-Archive -Path nssm.zip -DestinationPath nssm-extract -Force
+                  Copy-Item nssm-extract/nssm-2.24/win64/nssm.exe -Destination nssm.exe
+
+            - name: Install WiX
+              shell: pwsh
+              run: dotnet tool install --global wix --version 5.*
+
+            - name: Build MSI
+              working-directory: installer
+              shell: pwsh
+              run: |
+                  $env:PATH = "$env:PATH;$env:USERPROFILE\.dotnet\tools"
+                  wix build vantage-agent.wxs -o vantage-agent.msi
+                  (Get-FileHash vantage-agent.msi -Algorithm SHA256).Hash.ToLower() + "  vantage-agent.msi" | Out-File -Encoding ascii checksums-msi.txt
+
+            - name: Attach MSI to release
+              working-directory: installer
+              shell: pwsh
+              env:
+                  TOKEN: ${{ secrets.RELEASE_TOKEN }}
+              run: |
+                  $api = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+                  $tag = [uri]::EscapeDataString("${{ github.ref_name }}")
+                  $headers = @{ Authorization = "token $env:TOKEN" }
+                  # gitea-release-action can't find a slashed tag, so append via the API directly
+                  $rel = Invoke-RestMethod -Headers $headers -Uri "$api/releases/tags/$tag"
+                  foreach ($f in "vantage-agent.msi", "checksums-msi.txt") {
+                      $name = [uri]::EscapeDataString($f)
+                      Invoke-RestMethod -Headers $headers -Method Post -InFile $f `
+                        -ContentType "application/octet-stream" `
+                        -Uri "$api/releases/$($rel.id)/assets?name=$name"
+                  }

.gitea/workflows/server-deploy.yml

@@ -1,50 +1,37 @@
 name: Server Deploy
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - "server/**"
-      - "web/**"
-      - "proto/**"
+    push:
+        branches:
+            - main
 
 jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+    deploy:
+        runs-on: ubuntu-docker
+        container: docker:dind
+        steps:
+            - name: Setup Node
+              run: apk add --update nodejs npm
+            - name: Checkout
+              uses: actions/checkout@v4
 
-      - name: Log in to registry
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
-            docker login ${{ vars.GITEA_HOST }} \
-              -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+            - name: Log in to registry
+              run: |
+                  echo "${{ secrets.RELEASE_TOKEN }}" | \
+                    docker login ${{ vars.DOCKER_HOST }} \
+                      -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
-      - name: Build and push server image
-        run: |
-          IMAGE="${{ vars.GITEA_HOST }}/${{ github.repository_owner }}/keymanager/server:latest"
-          docker build -t "$IMAGE" -f server/Dockerfile server/
-          docker push "$IMAGE"
+            - name: Build and push server image
+              run: |
+                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/server:latest"
+                  docker build -t "$IMAGE" -f server/Dockerfile server/
+                  docker push "$IMAGE"
 
-      - name: Build and push web image
-        run: |
-          IMAGE="${{ vars.GITEA_HOST }}/${{ github.repository_owner }}/keymanager/web:latest"
-          docker build \
-            --build-arg NEXT_PUBLIC_API_URL="https://${{ vars.GITEA_HOST }}" \
-            -t "$IMAGE" \
-            -f web/Dockerfile web/
-          docker push "$IMAGE"
-
-      - name: Deploy via SSH
-        uses: https://github.com/appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.DEPLOY_HOST }}
-          username: ${{ secrets.DEPLOY_USER }}
-          key: ${{ secrets.DEPLOY_SSH_KEY }}
-          script: |
-            cd /opt/keymanager
-            docker compose pull
-            docker compose up -d --remove-orphans
-            docker image prune -f
+            - name: Build and push web image
+              run: |
+                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/web:latest"
+                  docker build \
+                    --build-arg NEXT_PUBLIC_API_URL="${{ vars.API_URL }}" \
+                    -t "$IMAGE" \
+                    -f web/Dockerfile web/
+                  docker push "$IMAGE"

.gitignore

@@ -1,4 +1,11 @@
 node_modules
 dist
 build
-.env
+.env
+docs
+.superpowers
+installer/*.exe
+installer/*.msi
+installer/nssm.zip
+installer/checksums-msi.txt
+.next

agent/cmd/main.go

@@ -1,11 +1,14 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"log"
+	"os/signal"
+	"syscall"
 
-	"github.com/mrhid6/keymanager/agent/internal/config"
-	agentsync "github.com/mrhid6/keymanager/agent/internal/sync"
+	"github.com/mrhid6/vantage/agent/internal/config"
+	agentsync "github.com/mrhid6/vantage/agent/internal/sync"
 )
 
 var Version = "dev"
@@ -26,8 +29,11 @@ func main() {
 		return
 	}
 
-	log.Printf("keymanager-agent %s starting (server=%s, poll=%s)", Version, cfg.ServerURL, cfg.PollInterval)
-	if err := agentsync.Run(cfg); err != nil {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	log.Printf("vantage-agent %s starting (server=%s, poll=%s)", Version, cfg.ServerURL, cfg.PollInterval)
+	if err := agentsync.Run(ctx, cfg, Version); err != nil {
 		log.Fatalf("agent error: %v", err)
 	}
 }

agent/go.mod

@@ -1,4 +1,4 @@
-module github.com/mrhid6/keymanager/agent
+module github.com/mrhid6/vantage/agent
 
 go 1.26
 

agent/internal/config/config.go

@@ -2,12 +2,26 @@ package config
 
 import (
 	"os"
+	"path/filepath"
+	"runtime"
 	"time"
 
 	"gopkg.in/yaml.v3"
 )
 
-const ConfigPath = "/etc/keymanager/config.yaml"
+// ConfigDir returns the platform-specific config directory.
+func ConfigDir() string {
+	if runtime.GOOS == "windows" {
+		base := os.Getenv("ProgramData")
+		if base == "" {
+			base = `C:\ProgramData`
+		}
+		return filepath.Join(base, "vantage")
+	}
+	return "/etc/vantage"
+}
+
+func configPath() string { return filepath.Join(ConfigDir(), "config.yaml") }
 
 type Config struct {
 	ServerURL    string        `yaml:"server_url"`
@@ -19,7 +33,7 @@ type Config struct {
 }
 
 func Load() (*Config, error) {
-	data, err := os.ReadFile(ConfigPath)
+	data, err := os.ReadFile(configPath())
 	if err != nil {
 		return nil, err
 	}
@@ -38,8 +52,8 @@ func Save(cfg *Config) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll("/etc/keymanager", 0700); err != nil {
+	if err := os.MkdirAll(ConfigDir(), 0700); err != nil {
 		return err
 	}
-	return os.WriteFile(ConfigPath, data, 0600)
+	return os.WriteFile(configPath(), data, 0600)
 }

agent/internal/config/config_test.go

@@ -0,0 +1,20 @@
+package config
+
+import (
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestConfigDirByOS(t *testing.T) {
+	d := ConfigDir()
+	if runtime.GOOS == "windows" {
+		if !strings.Contains(strings.ToLower(d), "programdata") {
+			t.Fatalf("windows config dir = %q, want ProgramData path", d)
+		}
+	} else {
+		if d != "/etc/vantage" {
+			t.Fatalf("unix config dir = %q, want /etc/vantage", d)
+		}
+	}
+}

agent/internal/grpc/client.go

@@ -3,13 +3,15 @@ package grpcclient
 import (
 	"context"
 	"crypto/tls"
+	"strings"
 	"time"
 
-	"github.com/mrhid6/keymanager/agent/internal/grpc/pb"
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/keepalive"
 )
 
 func init() {
@@ -18,11 +20,22 @@ func init() {
 
 type Client struct {
 	conn   *grpc.ClientConn
-	client pb.KeyManagerClient
+	client pb.VantageClient
 }
 
 func New(serverURL string, useTLS bool) (*Client, error) {
-	var dialOpts []grpc.DialOption
+	serverURL = strings.TrimPrefix(serverURL, "https://")
+	serverURL = strings.TrimPrefix(serverURL, "http://")
+
+	// Send a ping every 30s so proxies with a 60s idle timeout don't kill the
+	// long-lived CommandStream when no commands are flowing.
+	dialOpts := []grpc.DialOption{
+		grpc.WithKeepaliveParams(keepalive.ClientParameters{
+			Time:                30 * time.Second,
+			Timeout:             10 * time.Second,
+			PermitWithoutStream: false,
+		}),
+	}
 
 	if useTLS {
 		tlsCfg := &tls.Config{
@@ -44,7 +57,7 @@ func New(serverURL string, useTLS bool) (*Client, error) {
 
 	return &Client{
 		conn:   conn,
-		client: pb.NewKeyManagerClient(conn),
+		client: pb.NewVantageClient(conn),
 	}, nil
 }
 
@@ -69,13 +82,14 @@ func (c *Client) Register(serverID, preRegToken, hostname, ipAddress, osInfo str
 	return resp.AgentToken, nil
 }
 
-func (c *Client) SyncKeys(serverID, agentToken string) ([]string, error) {
+func (c *Client) SyncKeys(serverID, agentToken, version string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
 	resp, err := c.client.SyncKeys(ctx, &pb.SyncRequest{
-		ServerId:   serverID,
-		AgentToken: agentToken,
+		ServerId:     serverID,
+		AgentToken:   agentToken,
+		AgentVersion: version,
 	})
 	if err != nil {
 		return nil, err
@@ -83,7 +97,7 @@ func (c *Client) SyncKeys(serverID, agentToken string) ([]string, error) {
 	return resp.PublicKeys, nil
 }
 
-func (c *Client) UploadGeneratedKey(serverID, agentToken, publicKey, label string) (string, error) {
+func (c *Client) UploadGeneratedKey(serverID, agentToken, publicKey, privateKey, label string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
@@ -91,6 +105,7 @@ func (c *Client) UploadGeneratedKey(serverID, agentToken, publicKey, label strin
 		ServerId:   serverID,
 		AgentToken: agentToken,
 		PublicKey:  publicKey,
+		PrivateKey: privateKey,
 		Label:      label,
 	})
 	if err != nil {
@@ -98,3 +113,21 @@ func (c *Client) UploadGeneratedKey(serverID, agentToken, publicKey, label strin
 	}
 	return resp.KeyId, nil
 }
+
+func (c *Client) ReportUpdates(serverID, agentToken string, updates []pb.PackageUpdate) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	_, err := c.client.ReportUpdates(ctx, &pb.ReportUpdatesRequest{
+		ServerId:   serverID,
+		AgentToken: agentToken,
+		Updates:    updates,
+	})
+	return err
+}
+
+// CommandStream opens a long-lived bidirectional stream for server-pushed commands.
+// The caller controls the stream lifetime via ctx.
+func (c *Client) CommandStream(ctx context.Context) (pb.Vantage_CommandStreamClient, error) {
+	return c.client.CommandStream(ctx)
+}

agent/internal/grpc/pb/keymanager.pb.go

@@ -1,93 +0,0 @@
-// Hand-written gRPC bindings for keymanager.proto (agent side, JSON codec).
-
-package pb
-
-import (
-	"context"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-type RegisterRequest struct {
-	ServerId    string `json:"server_id"`
-	PreRegToken string `json:"pre_reg_token"`
-	Hostname    string `json:"hostname"`
-	IpAddress   string `json:"ip_address"`
-	OsInfo      string `json:"os_info"`
-}
-
-type RegisterResponse struct {
-	AgentToken string `json:"agent_token"`
-}
-
-type SyncRequest struct {
-	ServerId   string `json:"server_id"`
-	AgentToken string `json:"agent_token"`
-}
-
-type SyncResponse struct {
-	PublicKeys []string `json:"public_keys"`
-}
-
-type UploadKeyRequest struct {
-	ServerId   string `json:"server_id"`
-	AgentToken string `json:"agent_token"`
-	PublicKey  string `json:"public_key"`
-	Label      string `json:"label"`
-}
-
-type UploadKeyResponse struct {
-	KeyId string `json:"key_id"`
-}
-
-type KeyManagerClient interface {
-	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
-	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
-	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
-}
-
-type UnimplementedKeyManagerServer struct{}
-
-func (UnimplementedKeyManagerServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "not implemented")
-}
-func (UnimplementedKeyManagerServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "not implemented")
-}
-func (UnimplementedKeyManagerServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "not implemented")
-}
-
-type keyManagerClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewKeyManagerClient(cc grpc.ClientConnInterface) KeyManagerClient {
-	return &keyManagerClient{cc}
-}
-
-func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
-	out := new(RegisterResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/Register", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
-	out := new(SyncResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/SyncKeys", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
-	out := new(UploadKeyResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/UploadGeneratedKey", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}

agent/internal/grpc/pb/vantage.pb.go

@@ -0,0 +1,220 @@
+// Hand-written gRPC bindings for vantage.proto (agent side, JSON codec).
+
+package pb
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type RegisterRequest struct {
+	ServerId    string `json:"server_id"`
+	PreRegToken string `json:"pre_reg_token"`
+	Hostname    string `json:"hostname"`
+	IpAddress   string `json:"ip_address"`
+	OsInfo      string `json:"os_info"`
+}
+
+type RegisterResponse struct {
+	AgentToken string `json:"agent_token"`
+}
+
+type SyncRequest struct {
+	ServerId     string `json:"server_id"`
+	AgentToken   string `json:"agent_token"`
+	AgentVersion string `json:"agent_version,omitempty"`
+}
+
+type SyncResponse struct {
+	PublicKeys []string `json:"public_keys"`
+}
+
+type UploadKeyRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+	PublicKey  string `json:"public_key"`
+	Label      string `json:"label"`
+	PrivateKey string `json:"private_key,omitempty"`
+}
+
+type UploadKeyResponse struct {
+	KeyId string `json:"key_id"`
+}
+
+// CommandStream message types
+
+type PackageUpdate struct {
+	Name           string `json:"name"`
+	CurrentVersion string `json:"current_version,omitempty"`
+	NewVersion     string `json:"new_version"`
+}
+
+type ReportUpdatesRequest struct {
+	ServerId   string          `json:"server_id"`
+	AgentToken string          `json:"agent_token"`
+	Updates    []PackageUpdate `json:"updates"`
+}
+
+type ReportUpdatesResponse struct{}
+
+type ApplyUpdatesCmd struct{}
+
+type ServerCommand struct {
+	CommandId    string           `json:"command_id"`
+	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
+	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
+	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
+	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
+}
+
+type DeleteKeyCmd struct {
+	Label string `json:"label"`
+}
+
+type UpdateAgentCmd struct {
+	Version      string `json:"version"`
+	GiteaBaseURL string `json:"gitea_base_url"`
+}
+
+type GenerateKeyCmd struct {
+	Label      string `json:"label"`
+	KeyType    string `json:"key_type,omitempty"`
+	KeySize    int    `json:"key_size,omitempty"`
+	Passphrase string `json:"passphrase,omitempty"`
+	Comment    string `json:"comment,omitempty"`
+}
+
+type AgentMessage struct {
+	ServerId   string         `json:"server_id"`
+	AgentToken string         `json:"agent_token"`
+	Ready      *AgentReady    `json:"ready,omitempty"`
+	Result     *CommandResult `json:"result,omitempty"`
+}
+
+type AgentReady struct{}
+
+type CommandResult struct {
+	CommandId string `json:"command_id"`
+	Success   bool   `json:"success"`
+	Message   string `json:"message"`
+}
+
+// CommandStream client-side interface
+
+type Vantage_CommandStreamClient interface {
+	Send(*AgentMessage) error
+	Recv() (*ServerCommand, error)
+	grpc.ClientStream
+}
+
+type vantageCommandStreamClient struct {
+	grpc.ClientStream
+}
+
+func (c *vantageCommandStreamClient) Send(m *AgentMessage) error {
+	return c.ClientStream.SendMsg(m)
+}
+
+func (c *vantageCommandStreamClient) Recv() (*ServerCommand, error) {
+	m := new(ServerCommand)
+	if err := c.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// CommandStream server-side interface (included for completeness)
+
+type Vantage_CommandStreamServer interface {
+	Send(*ServerCommand) error
+	Recv() (*AgentMessage, error)
+	grpc.ServerStream
+}
+
+type keyManagerCommandStreamServer struct {
+	grpc.ServerStream
+}
+
+func (s *keyManagerCommandStreamServer) Send(m *ServerCommand) error {
+	return s.ServerStream.SendMsg(m)
+}
+
+func (s *keyManagerCommandStreamServer) Recv() (*AgentMessage, error) {
+	m := new(AgentMessage)
+	if err := s.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+type VantageClient interface {
+	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
+	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
+	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
+	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
+}
+
+type UnimplementedVantageServer struct{}
+
+func (UnimplementedVantageServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "not implemented")
+}
+func (UnimplementedVantageServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "not implemented")
+}
+func (UnimplementedVantageServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "not implemented")
+}
+
+type keyManagerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewVantageClient(cc grpc.ClientConnInterface) VantageClient {
+	return &keyManagerClient{cc}
+}
+
+func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
+	out := new(RegisterResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/Register", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
+	out := new(SyncResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncKeys", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
+	out := new(UploadKeyResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/UploadGeneratedKey", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error) {
+	out := new(ReportUpdatesResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportUpdates", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
+	desc := &grpc.StreamDesc{StreamName: "CommandStream", ServerStreams: true, ClientStreams: true}
+	stream, err := c.cc.NewStream(ctx, desc, "/vantage.v1.Vantage/CommandStream", opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &vantageCommandStreamClient{stream}, nil
+}

agent/internal/keys/keys.go

@@ -11,6 +11,9 @@ import (
 )
 
 const authorizedKeysPath = "/root/.ssh/authorized_keys"
+const sshConfigPath = "/root/.ssh/config"
+const managedConfigPath = "/root/.ssh/vantage.conf"
+const includeDirective = "Include /root/.ssh/vantage.conf"
 
 func ReadAuthorizedKeys() ([]string, error) {
 	data, err := os.ReadFile(authorizedKeysPath)
@@ -93,19 +96,36 @@ func fingerprint(pubKey string) string {
 	return "MD5:" + strings.Join(pairs, ":")
 }
 
-// GenerateKeyPair generates an ed25519 SSH keypair and returns the public key.
+// KeyGenOptions controls how ssh-keygen is invoked.
+type KeyGenOptions struct {
+	KeyType    string // ed25519 (default), rsa, ecdsa
+	KeySize    int    // bits; used for rsa and ecdsa
+	Passphrase string // empty = no passphrase
+	Comment    string // embedded in the public key
+}
+
+// GenerateKeyPair generates an SSH keypair and returns the public key.
 // The private key is written to keyPath; keyPath+".pub" holds the public key.
-func GenerateKeyPair(keyPath, comment string) (string, error) {
+func GenerateKeyPair(keyPath string, opts KeyGenOptions) (string, error) {
 	if err := os.MkdirAll(filepath.Dir(keyPath), 0700); err != nil {
 		return "", err
 	}
 
-	args := []string{
-		"-t", "ed25519",
-		"-f", keyPath,
-		"-N", "",
-		"-C", comment,
+	keyType := opts.KeyType
+	if keyType == "" {
+		keyType = "ed25519"
 	}
+
+	args := []string{
+		"-t", keyType,
+		"-f", keyPath,
+		"-N", opts.Passphrase,
+		"-C", opts.Comment,
+	}
+	if opts.KeySize > 0 && keyType != "ed25519" {
+		args = append(args, "-b", fmt.Sprintf("%d", opts.KeySize))
+	}
+
 	cmd := exec.Command("ssh-keygen", args...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -118,3 +138,91 @@ func GenerateKeyPair(keyPath, comment string) (string, error) {
 	}
 	return strings.TrimSpace(string(pubData)), nil
 }
+
+// AddSSHIdentity writes an IdentityFile entry for keyPath into the managed
+// vantage.conf include file, and ensures ~/.ssh/config includes it.
+func AddSSHIdentity(keyPath string) error {
+	if err := os.MkdirAll(filepath.Dir(sshConfigPath), 0700); err != nil {
+		return fmt.Errorf("mkdir .ssh: %w", err)
+	}
+
+	if err := ensureIncludeDirective(); err != nil {
+		return err
+	}
+
+	// Read existing managed config (it may not exist yet).
+	var existing string
+	data, err := os.ReadFile(managedConfigPath)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("read %s: %w", managedConfigPath, err)
+	}
+	existing = string(data)
+
+	line := "IdentityFile " + keyPath
+	for _, l := range strings.Split(existing, "\n") {
+		if strings.TrimSpace(l) == line {
+			return nil // already present
+		}
+	}
+
+	if existing != "" && !strings.HasSuffix(existing, "\n") {
+		existing += "\n"
+	}
+	updated := existing + line + "\n"
+
+	if err := os.WriteFile(managedConfigPath, []byte(updated), 0600); err != nil {
+		return fmt.Errorf("write %s: %w", managedConfigPath, err)
+	}
+	return nil
+}
+
+// RemoveSSHIdentity removes the IdentityFile entry for keyPath from the managed config.
+func RemoveSSHIdentity(keyPath string) error {
+	data, err := os.ReadFile(managedConfigPath)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("read %s: %w", managedConfigPath, err)
+	}
+
+	line := "IdentityFile " + keyPath
+	var kept []string
+	for _, l := range strings.Split(strings.TrimRight(string(data), "\n"), "\n") {
+		if strings.TrimSpace(l) != line {
+			kept = append(kept, l)
+		}
+	}
+
+	content := strings.Join(kept, "\n")
+	if len(kept) > 0 {
+		content += "\n"
+	}
+	if err := os.WriteFile(managedConfigPath, []byte(content), 0600); err != nil {
+		return fmt.Errorf("write %s: %w", managedConfigPath, err)
+	}
+	return nil
+}
+
+// ensureIncludeDirective adds "Include /root/.ssh/vantage.conf" to the top
+// of ~/.ssh/config if it is not already present. The Include must appear before
+// any Host stanzas to be effective for all connections.
+func ensureIncludeDirective() error {
+	data, err := os.ReadFile(sshConfigPath)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("read %s: %w", sshConfigPath, err)
+	}
+
+	for _, l := range strings.Split(string(data), "\n") {
+		if strings.TrimSpace(l) == includeDirective {
+			return nil // already present
+		}
+	}
+
+	// Prepend the Include directive so it takes effect before any Host blocks.
+	updated := includeDirective + "\n" + string(data)
+	if err := os.WriteFile(sshConfigPath, []byte(updated), 0600); err != nil {
+		return fmt.Errorf("write %s: %w", sshConfigPath, err)
+	}
+	return nil
+}

agent/internal/sync/sync.go

@@ -1,20 +1,28 @@
 package agentsync
 
 import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
+	"io"
 	"log"
 	"net"
+	"net/http"
 	"os"
+	"os/exec"
 	"runtime"
 	"strings"
 	"time"
 
-	"github.com/mrhid6/keymanager/agent/internal/config"
-	grpcclient "github.com/mrhid6/keymanager/agent/internal/grpc"
-	"github.com/mrhid6/keymanager/agent/internal/keys"
+	"github.com/mrhid6/vantage/agent/internal/config"
+	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+	"github.com/mrhid6/vantage/agent/internal/keys"
+	"github.com/mrhid6/vantage/agent/internal/updates"
 )
 
-func Run(cfg *config.Config) error {
+func Run(ctx context.Context, cfg *config.Config, version string) error {
 	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
 	if err != nil {
 		return fmt.Errorf("dial grpc: %w", err)
@@ -40,7 +48,6 @@ func Run(cfg *config.Config) error {
 		}
 		log.Println("registration successful")
 
-		// Reconnect with potentially updated state
 		client.Close()
 		client, err = grpcclient.New(cfg.ServerURL, cfg.TLS)
 		if err != nil {
@@ -52,28 +59,43 @@ func Run(cfg *config.Config) error {
 		return fmt.Errorf("no agent token available — registration required")
 	}
 
+	// Start the command stream alongside the poll loop.
+	go runCommandStream(ctx, cfg)
+
+	// Check for OS updates on startup and then hourly.
+	go runUpdateCheck(ctx, cfg)
+
 	ticker := time.NewTicker(cfg.PollInterval)
 	defer ticker.Stop()
 
 	// Run immediately on startup
-	if err := poll(client, cfg); err != nil {
+	if err := poll(client, cfg, version); err != nil {
 		log.Printf("poll error: %v", err)
 	}
 
-	for range ticker.C {
-		if err := poll(client, cfg); err != nil {
-			log.Printf("poll error: %v", err)
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+			if err := poll(client, cfg, version); err != nil {
+				log.Printf("poll error: %v", err)
+			}
 		}
 	}
-	return nil
 }
 
-func poll(client *grpcclient.Client, cfg *config.Config) error {
-	desired, err := client.SyncKeys(cfg.ServerID, cfg.AgentToken)
+func poll(client *grpcclient.Client, cfg *config.Config, version string) error {
+	desired, err := client.SyncKeys(cfg.ServerID, cfg.AgentToken, version)
 	if err != nil {
 		return fmt.Errorf("SyncKeys: %w", err)
 	}
 
+	// Windows agents register and heartbeat only — no authorized_keys management.
+	if runtime.GOOS != "linux" {
+		return nil
+	}
+
 	current, err := keys.ReadAuthorizedKeys()
 	if err != nil {
 		return fmt.Errorf("read authorized_keys: %w", err)
@@ -91,6 +113,294 @@ func poll(client *grpcclient.Client, cfg *config.Config) error {
 	return nil
 }
 
+// runCommandStream maintains a persistent bidirectional stream with the server
+// for instant command delivery. Reconnects with exponential backoff on failure.
+func runCommandStream(ctx context.Context, cfg *config.Config) {
+	backoff := time.Second
+	const maxBackoff = 2 * time.Minute
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+
+		if err := connectAndHandleStream(ctx, cfg); err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			log.Printf("command stream error: %v, reconnecting in %s", err, backoff)
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(backoff):
+			}
+			if backoff < maxBackoff {
+				backoff *= 2
+			}
+		} else {
+			backoff = time.Second
+		}
+	}
+}
+
+func connectAndHandleStream(ctx context.Context, cfg *config.Config) error {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return fmt.Errorf("dial: %w", err)
+	}
+	defer client.Close()
+
+	stream, err := client.CommandStream(ctx)
+	if err != nil {
+		return fmt.Errorf("open stream: %w", err)
+	}
+
+	if err := stream.Send(&pb.AgentMessage{
+		ServerId:   cfg.ServerID,
+		AgentToken: cfg.AgentToken,
+		Ready:      &pb.AgentReady{},
+	}); err != nil {
+		return fmt.Errorf("send auth: %w", err)
+	}
+
+	log.Println("command stream connected")
+
+	for {
+		cmd, err := stream.Recv()
+		if err != nil {
+			return fmt.Errorf("recv: %w", err)
+		}
+
+		if cmd.GenerateKey != nil {
+			go handleGenerateKey(cfg, cmd)
+		}
+		if cmd.DeleteKey != nil {
+			go handleDeleteKey(cmd)
+		}
+		if cmd.UpdateAgent != nil {
+			go handleUpdateAgent(cmd)
+		}
+		if cmd.ApplyUpdates != nil {
+			go handleApplyUpdates(cfg, cmd)
+		}
+	}
+}
+
+func runUpdateCheck(ctx context.Context, cfg *config.Config) {
+	const interval = time.Hour
+
+	doCheck := func() {
+		pkgs, err := updates.CheckAvailable()
+		if err != nil {
+			log.Printf("update check error: %v", err)
+			return
+		}
+		pbUpdates := make([]pb.PackageUpdate, len(pkgs))
+		for i, p := range pkgs {
+			pbUpdates[i] = pb.PackageUpdate{
+				Name:           p.Name,
+				CurrentVersion: p.CurrentVersion,
+				NewVersion:     p.NewVersion,
+			}
+		}
+		client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+		if err != nil {
+			log.Printf("update report dial error: %v", err)
+			return
+		}
+		defer client.Close()
+		if err := client.ReportUpdates(cfg.ServerID, cfg.AgentToken, pbUpdates); err != nil {
+			log.Printf("ReportUpdates error: %v", err)
+			return
+		}
+		log.Printf("reported %d available OS updates", len(pkgs))
+	}
+
+	doCheck()
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			doCheck()
+		}
+	}
+}
+
+func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
+	log.Printf("applying OS updates (cmd=%s)…", cmd.CommandId)
+	if err := updates.ApplyAll(); err != nil {
+		log.Printf("OS upgrade failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+	log.Printf("OS updates applied successfully (cmd=%s)", cmd.CommandId)
+
+	// Re-report the (now empty) update list so the server reflects the new state.
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return
+	}
+	defer client.Close()
+	_ = client.ReportUpdates(cfg.ServerID, cfg.AgentToken, nil)
+}
+
+func handleDeleteKey(cmd *pb.ServerCommand) {
+	label := cmd.DeleteKey.Label
+	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))
+
+	if err := keys.RemoveSSHIdentity(keyPath); err != nil {
+		log.Printf("remove ssh identity failed (cmd=%s): %v", cmd.CommandId, err)
+	}
+
+	for _, path := range []string{keyPath, keyPath + ".pub"} {
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			log.Printf("delete key file %s (cmd=%s): %v", path, cmd.CommandId, err)
+		}
+	}
+	log.Printf("deleted local key files for %q (cmd=%s)", label, cmd.CommandId)
+}
+
+func handleUpdateAgent(cmd *pb.ServerCommand) {
+	u := cmd.UpdateAgent
+	arch := runtime.GOARCH // "amd64" or "arm64"
+	tag := "agent%2Fv" + u.Version
+	binaryURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/vantage-agent-linux-%s", u.GiteaBaseURL, tag, arch)
+	checksumURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/checksums.txt", u.GiteaBaseURL, tag)
+
+	log.Printf("updating agent to v%s from %s (cmd=%s)", u.Version, u.GiteaBaseURL, cmd.CommandId)
+
+	// Download binary
+	tmpBin := "/tmp/vantage-agent-update"
+	if err := downloadFile(binaryURL, tmpBin); err != nil {
+		log.Printf("update download failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+
+	// Download and verify checksum
+	checksumData, err := httpGetBytes(checksumURL)
+	if err != nil {
+		log.Printf("update checksum fetch failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+	if err := verifyChecksum(tmpBin, fmt.Sprintf("vantage-agent-linux-%s", arch), checksumData); err != nil {
+		log.Printf("update checksum mismatch (cmd=%s): %v", cmd.CommandId, err)
+		os.Remove(tmpBin)
+		return
+	}
+
+	if err := os.Chmod(tmpBin, 0755); err != nil {
+		log.Printf("update chmod failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+	if err := os.Rename(tmpBin, "/usr/local/bin/vantage-agent"); err != nil {
+		log.Printf("update replace binary failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+
+	log.Printf("agent binary replaced, restarting service (cmd=%s)", cmd.CommandId)
+	exec.Command("systemctl", "restart", "vantage-agent").Run()
+}
+
+func downloadFile(url, dest string) error {
+	resp, err := http.Get(url) //nolint:gosec
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP %d from %s", resp.StatusCode, url)
+	}
+	f, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	_, err = io.Copy(f, resp.Body)
+	return err
+}
+
+func httpGetBytes(url string) ([]byte, error) {
+	resp, err := http.Get(url) //nolint:gosec
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d from %s", resp.StatusCode, url)
+	}
+	return io.ReadAll(resp.Body)
+}
+
+func verifyChecksum(filePath, filename string, checksumData []byte) error {
+	f, err := os.Open(filePath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return err
+	}
+	actual := hex.EncodeToString(h.Sum(nil))
+
+	for _, line := range strings.Split(string(checksumData), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 2 && fields[1] == filename {
+			if fields[0] != actual {
+				return fmt.Errorf("expected %s got %s", fields[0], actual)
+			}
+			return nil
+		}
+	}
+	return fmt.Errorf("no checksum entry found for %s", filename)
+}
+
+func handleGenerateKey(cfg *config.Config, cmd *pb.ServerCommand) {
+	g := cmd.GenerateKey
+	label := g.Label
+	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))
+
+	opts := keys.KeyGenOptions{
+		KeyType:    g.KeyType,
+		KeySize:    g.KeySize,
+		Passphrase: g.Passphrase,
+		Comment:    g.Comment,
+	}
+	pubKey, err := keys.GenerateKeyPair(keyPath, opts)
+	if err != nil {
+		log.Printf("key generation failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+
+	privKeyData, err := os.ReadFile(keyPath)
+	if err != nil {
+		log.Printf("read private key failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		log.Printf("dial for key upload failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+	defer client.Close()
+
+	keyID, err := client.UploadGeneratedKey(cfg.ServerID, cfg.AgentToken, pubKey, string(privKeyData), label)
+	if err != nil {
+		log.Printf("key upload failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+
+	if err := keys.AddSSHIdentity(keyPath); err != nil {
+		log.Printf("add ssh identity failed (cmd=%s): %v", cmd.CommandId, err)
+	}
+	log.Printf("generated and uploaded key %q (key_id=%s, cmd=%s)", label, keyID, cmd.CommandId)
+}
+
 func localIP() string {
 	addrs, err := net.InterfaceAddrs()
 	if err != nil {
@@ -114,16 +424,25 @@ func GenerateAndUpload(cfg *config.Config, label string) error {
 	}
 	defer client.Close()
 
-	keyPath := fmt.Sprintf("/root/.ssh/keymanager_%s", strings.ReplaceAll(label, " ", "_"))
-	pubKey, err := keys.GenerateKeyPair(keyPath, label)
+	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))
+	pubKey, err := keys.GenerateKeyPair(keyPath, keys.KeyGenOptions{Comment: label})
 	if err != nil {
 		return err
 	}
 
-	keyID, err := client.UploadGeneratedKey(cfg.ServerID, cfg.AgentToken, pubKey, label)
+	privKeyData, err := os.ReadFile(keyPath)
+	if err != nil {
+		return fmt.Errorf("read private key: %w", err)
+	}
+
+	keyID, err := client.UploadGeneratedKey(cfg.ServerID, cfg.AgentToken, pubKey, string(privKeyData), label)
 	if err != nil {
 		return err
 	}
+
+	if err := keys.AddSSHIdentity(keyPath); err != nil {
+		log.Printf("add ssh identity: %v", err)
+	}
 	log.Printf("uploaded generated key %s (key_id=%s)", label, keyID)
 	return nil
 }

agent/internal/updates/updates.go

@@ -0,0 +1,239 @@
+package updates
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+type PackageUpdate struct {
+	Name           string
+	CurrentVersion string
+	NewVersion     string
+}
+
+func detectPM() string {
+	for _, pm := range []string{"apt-get", "dnf", "yum", "pacman", "zypper", "apk"} {
+		if _, err := exec.LookPath(pm); err == nil {
+			if pm == "apt-get" {
+				return "apt"
+			}
+			return pm
+		}
+	}
+	return ""
+}
+
+// CheckAvailable returns the list of packages with available upgrades.
+// Returns nil, nil when no supported package manager is found.
+func CheckAvailable() ([]PackageUpdate, error) {
+	switch detectPM() {
+	case "apt":
+		return checkApt()
+	case "dnf":
+		return checkDnfYum("dnf")
+	case "yum":
+		return checkDnfYum("yum")
+	case "pacman":
+		return checkPacman()
+	case "zypper":
+		return checkZypper()
+	case "apk":
+		return checkApk()
+	default:
+		return nil, nil
+	}
+}
+
+// ApplyAll runs a full non-interactive upgrade using the detected package manager.
+func ApplyAll() error {
+	switch detectPM() {
+	case "apt":
+		// Refresh lists first, then upgrade.
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		defer cancel()
+		if err := exec.CommandContext(ctx, "apt-get", "update", "-qq").Run(); err != nil {
+			return err
+		}
+		return exec.CommandContext(ctx, "apt-get", "upgrade", "-y").Run()
+	case "dnf":
+		return exec.Command("dnf", "upgrade", "-y").Run()
+	case "yum":
+		return exec.Command("yum", "upgrade", "-y").Run()
+	case "pacman":
+		return exec.Command("pacman", "-Syu", "--noconfirm").Run()
+	case "zypper":
+		return exec.Command("zypper", "update", "-y").Run()
+	case "apk":
+		return exec.Command("apk", "upgrade").Run()
+	default:
+		return nil
+	}
+}
+
+func checkApt() ([]PackageUpdate, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	// Best-effort refresh; ignore errors (cached data is fine).
+	exec.CommandContext(ctx, "apt-get", "update", "-qq").Run() //nolint:errcheck
+
+	out, err := exec.Command("apt", "list", "--upgradable").Output()
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		// Format: package/suite version arch [upgradable from: old-ver]
+		if !strings.Contains(line, "[upgradable from:") {
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 2 {
+			continue
+		}
+		name := strings.SplitN(parts[0], "/", 2)[0]
+		newVer := parts[1]
+		oldVer := ""
+		if idx := strings.Index(line, "upgradable from: "); idx != -1 {
+			rest := line[idx+len("upgradable from: "):]
+			oldVer = strings.TrimSuffix(strings.TrimSpace(rest), "]")
+		}
+		updates = append(updates, PackageUpdate{Name: name, CurrentVersion: oldVer, NewVersion: newVer})
+	}
+	return updates, nil
+}
+
+func checkDnfYum(pm string) ([]PackageUpdate, error) {
+	cmd := exec.Command(pm, "check-update")
+	out, err := cmd.Output()
+	// Exit code 100 means updates are available — not an error.
+	if exitErr, ok := err.(*exec.ExitError); ok && exitErr.ExitCode() == 100 {
+		err = nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	pastHeader := false
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		if !pastHeader {
+			if strings.TrimSpace(line) == "" {
+				pastHeader = true
+			}
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 2 {
+			continue
+		}
+		// name.arch  new-version  repo
+		name := strings.SplitN(parts[0], ".", 2)[0]
+		updates = append(updates, PackageUpdate{Name: name, NewVersion: parts[1]})
+	}
+	return updates, nil
+}
+
+func checkPacman() ([]PackageUpdate, error) {
+	out, _ := exec.Command("pacman", "-Qu").Output()
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		parts := strings.Fields(scanner.Text())
+		// Format: package old-version -> new-version
+		if len(parts) < 4 {
+			continue
+		}
+		updates = append(updates, PackageUpdate{Name: parts[0], CurrentVersion: parts[1], NewVersion: parts[3]})
+	}
+	return updates, nil
+}
+
+func checkZypper() ([]PackageUpdate, error) {
+	out, err := exec.Command("zypper", "list-updates").Output()
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		// Data rows start with "v |" (available) or "i |" (installed but updatable).
+		if !strings.HasPrefix(line, "v |") && !strings.HasPrefix(line, "i |") {
+			continue
+		}
+		parts := strings.Split(line, "|")
+		if len(parts) < 5 {
+			continue
+		}
+		updates = append(updates, PackageUpdate{
+			Name:           strings.TrimSpace(parts[2]),
+			CurrentVersion: strings.TrimSpace(parts[3]),
+			NewVersion:     strings.TrimSpace(parts[4]),
+		})
+	}
+	return updates, nil
+}
+
+func checkApk() ([]PackageUpdate, error) {
+	out, err := exec.Command("apk", "list", "--upgradable").Output()
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		if !strings.Contains(line, "[upgradable") {
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 1 {
+			continue
+		}
+		pkgVer := parts[0]
+		name := apkName(pkgVer)
+		newVer := apkVersion(pkgVer)
+		oldVer := ""
+		if idx := strings.Index(line, "upgradable from:"); idx != -1 {
+			rest := strings.TrimSpace(line[idx+len("upgradable from:"):])
+			rest = strings.TrimSuffix(rest, "]")
+			oldVer = apkVersion(strings.TrimSpace(rest))
+		}
+		updates = append(updates, PackageUpdate{Name: name, CurrentVersion: oldVer, NewVersion: newVer})
+	}
+	return updates, nil
+}
+
+func apkName(pkgVer string) string {
+	parts := strings.Split(pkgVer, "-")
+	var name []string
+	for _, p := range parts {
+		if len(p) > 0 && p[0] >= '0' && p[0] <= '9' {
+			break
+		}
+		name = append(name, p)
+	}
+	return strings.Join(name, "-")
+}
+
+func apkVersion(pkgVer string) string {
+	parts := strings.Split(pkgVer, "-")
+	var ver []string
+	inVer := false
+	for _, p := range parts {
+		if !inVer && len(p) > 0 && p[0] >= '0' && p[0] <= '9' {
+			inVer = true
+		}
+		if inVer {
+			ver = append(ver, p)
+		}
+	}
+	return strings.Join(ver, "-")
+}

claude.md

@@ -1,4 +1,4 @@
-# KeyManager
+# Vantage
 
 A self-hosted SSH key management system. A central server (Go + Next.js + MongoDB) manages public key assignments across servers. A lightweight Go agent runs on each managed server, polls the central server via gRPC, and atomically rewrites `/root/.ssh/authorized_keys` to match the desired state.
 
@@ -34,7 +34,7 @@ A self-hosted SSH key management system. A central server (Go + Next.js + MongoD
 ## Repository Structure
 
 ```
-keymanager/
+vantage/
 ├── agent/
 │   ├── cmd/main.go
 │   └── internal/
@@ -56,7 +56,7 @@ keymanager/
 │   ├── app/
 │   └── components/
 ├── proto/
-│   └── keymanager/v1/keymanager.proto
+│   └── vantage/v1/vantage.proto
 ├── deploy/
 │   ├── docker-compose.yml
 │   └── agent.service
@@ -72,9 +72,9 @@ keymanager/
 
 ```protobuf
 syntax = "proto3";
-package keymanager.v1;
+package vantage.v1;
 
-service KeyManager {
+service Vantage {
   rpc Register(RegisterRequest)           returns (RegisterResponse);
   rpc SyncKeys(SyncRequest)               returns (SyncResponse);
   rpc UploadGeneratedKey(UploadKeyRequest) returns (UploadKeyResponse);
@@ -172,10 +172,10 @@ No streaming — polling only. Poll interval: **30 seconds**.
 
 ## Agent Lifecycle
 
-### Config file — `/etc/keymanager/config.yaml`
+### Config file — `/etc/vantage/config.yaml`
 
 ```yaml
-server_url: "keymanager.yourdomain.com:9090"
+server_url: "vantage.yourdomain.com:9090"
 server_id: "<uuid>"
 pre_reg_token: "<token>" # removed after first successful Register()
 agent_token: "" # written by agent after Register()
@@ -216,15 +216,15 @@ Config file permissions: `0600`. Config directory: `0700`.
 - Uploads public key via `UploadGeneratedKey()`
 - Private key stays local on the machine
 
-### Systemd unit — `/etc/systemd/system/keymanager-agent.service`
+### Systemd unit — `/etc/systemd/system/vantage-agent.service`
 
 ```ini
 [Unit]
-Description=KeyManager Agent
+Description=Vantage Agent
 After=network.target
 
 [Service]
-ExecStart=/usr/local/bin/keymanager-agent
+ExecStart=/usr/local/bin/vantage-agent
 Restart=always
 RestartSec=10
 User=root
@@ -241,14 +241,14 @@ WantedBy=multi-user.target
 2. Backend generates a short-lived pre-registration token (TTL: 1 hour) and a `server_id`
 3. UI displays a one-liner install command with copy button:
     ```bash
-    curl -fsSL https://keymanager.yourdomain.com/install | \
+    curl -fsSL https://vantage.yourdomain.com/install | \
       bash -s -- --server-id=<id> --token=<token>
     ```
 4. Install script:
     - Detects arch (`amd64` / `arm64`)
     - Downloads agent binary from Gitea release
     - Verifies SHA-256 checksum
-    - Writes `/etc/keymanager/config.yaml`
+    - Writes `/etc/vantage/config.yaml`
     - Installs and starts systemd unit
 5. On first `SyncKeys` call, server marks status as `active`
 
@@ -259,7 +259,7 @@ The backend serves `/install` dynamically, injecting the latest agent version by
 ## Security
 
 - gRPC over TLS (Let's Encrypt or self-signed with cert pinning on the agent)
-- Agent authenticates with a per-server token stored at `/etc/keymanager/config.yaml` (`0600`)
+- Agent authenticates with a per-server token stored at `/etc/vantage/config.yaml` (`0600`)
 - Server stores `SHA-256(agent_token)` — never the plaintext token
 - Private keys generated by agents are encrypted at rest in MongoDB (AES-256)
 - `authorized_keys` written as `0600`, owned by root
@@ -298,13 +298,13 @@ Build command:
 ```bash
 GOOS=linux GOARCH=amd64 go build \
   -ldflags="-s -w -X main.Version=${VERSION}" \
-  -o dist/keymanager-agent-linux-amd64 ./cmd
+  -o dist/vantage-agent-linux-amd64 ./cmd
 ```
 
 Release assets:
 
-- `keymanager-agent-linux-amd64`
-- `keymanager-agent-linux-arm64`
+- `vantage-agent-linux-amd64`
+- `vantage-agent-linux-arm64`
 - `checksums.txt`
 
 ### Server deploy — `.gitea/workflows/server-deploy.yml`
@@ -312,7 +312,7 @@ Release assets:
 Triggered on pushes to `main` touching `server/**`, `web/**`, or `proto/**`. Builds and pushes Docker images to the Gitea container registry, then deploys via SSH:
 
 ```bash
-cd /opt/keymanager && docker compose pull && docker compose up -d --remove-orphans
+cd /opt/vantage && docker compose pull && docker compose up -d --remove-orphans
 ```
 
 ### Tagging convention

deploy/agent.service

@@ -1,18 +1,18 @@
 [Unit]
-Description=KeyManager Agent
-Documentation=https://github.com/your-org/keymanager
+Description=Vantage Agent
+Documentation=https://github.com/your-org/vantage
 After=network.target
 Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=/usr/local/bin/keymanager-agent
+ExecStart=/usr/local/bin/vantage-agent
 Restart=always
 RestartSec=10
 User=root
 StandardOutput=journal
 StandardError=journal
-SyslogIdentifier=keymanager-agent
+SyslogIdentifier=vantage-agent
 
 # Security hardening
 NoNewPrivileges=true

deploy/docker-compose.yml

@@ -1,45 +1,53 @@
 services:
-  mongo:
-    image: mongo:8
+  redis:
+    image: redis:8
     restart: unless-stopped
     volumes:
-      - mongo_data:/data/db
+      - redis_data:/data
     healthcheck:
-      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
+      test:
+        - CMD
+        - redis-cli
+        - ping
       interval: 10s
       timeout: 5s
       retries: 5
-      start_period: 20s
-
-  server:
-    build:
-      context: ../server
-      dockerfile: Dockerfile
+  guacd:
+    image: docker.io/guacamole/guacd:1.6.0
     restart: unless-stopped
     ports:
-      - "8080:8080"
-      - "9090:9090"
+      - 4822:4822
+  server:
+    image: gitea.hostxtra.co.uk/mrhid6/vantage/server:latest
+    restart: unless-stopped
+    ports:
+      - 8080:8080
+      - 9090:9090
     environment:
-      MONGO_URI: mongodb://mongo:27017/keymanager
+      MONGO_URI: ${MONGO_URI:-}
+      REDIS_ADDR: redis:6379
       GITEA_HOST: ${GITEA_HOST}
       PUBLIC_HOST: ${PUBLIC_HOST}
+      GRPC_HOST: ${GRPC_HOST}
       GRPC_PORT: "9090"
       HTTP_PORT: "8080"
+      OIDC_ISSUER: ${OIDC_ISSUER:-}
+      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
+      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
+      OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
+      KEY_ENCRYPTION_KEY: ${KEY_ENCRYPTION_KEY:-}
+      GUACD_ADDR: guacd:4822
     depends_on:
-      mongo:
+      redis:
         condition: service_healthy
-
   web:
-    build:
-      context: ../web
-      dockerfile: Dockerfile
-      args:
-        NEXT_PUBLIC_API_URL: http://server:8080
+    image: gitea.hostxtra.co.uk/mrhid6/vantage/web:latest
     restart: unless-stopped
     ports:
-      - "3000:3000"
+      - 3000:3000
     depends_on:
       - server
-
 volumes:
-  mongo_data:
+  mongo_data: null
+  redis_data: null
+networks: {}

docs/superpowers/specs/2026-07-17-web-console-design.md

@@ -0,0 +1,241 @@
+# Vantage Web Console (Guacamole Replacement) — Design
+
+**Date:** 2026-07-17
+**Status:** Approved design, pre-implementation
+
+## Goal
+
+Add a browser-based remote-access console to Vantage — SSH, RDP, and VNC into
+managed servers — as a self-hosted Guacamole replacement. Users select an SSH
+key to connect over SSH. RDP targets are reachable from a new Windows agent that
+registers the host and reports status. Windows agent ships as an MSI installer
+produced by CI.
+
+## Non-Goals (YAGNI)
+
+- Session recording / replay (may be added later).
+- Native Go RDP implementation (guacd handles protocol translation).
+- Per-user Linux/Windows account management from the agent.
+- Tunneling console traffic through the agent (direct network path assumed).
+
+---
+
+## Architecture
+
+```
+Browser (guacamole-common-js, vendored — no CDN)
+   │  Guacamole protocol over WebSocket
+   ▼
+Go server: /api/console/tunnel   (github.com/wwt/guac)
+   │  Guacamole protocol over TCP :4822
+   ▼
+guacd container (Apache Guacamole daemon)
+   │  SSH :22 / RDP :3389 / VNC :5900  — direct to target IP
+   ▼
+Target host (LAN / VPN line-of-sight from server)
+```
+
+- **Browser:** loads vendored `guacamole-common-js`, renders RDP/VNC display and
+  SSH terminal. No external CDN (matches existing infra rules).
+- **Go server:** exposes a WebSocket tunnel endpoint using `github.com/wwt/guac`
+  (Go Guacamole tunnel library). No Java `guacamole-client` required.
+- **guacd:** new container in `deploy/docker-compose.yml`, bound to the internal
+  docker network only, reachable by the server on `:4822`.
+- **Network path:** guacd connects **directly** to the target IP. Requires the
+  central server to have network line-of-sight to hosts (homelab LAN / VPN). The
+  agent's outbound-only guarantee is unchanged — the console path is
+  server→target, not agent-mediated.
+
+---
+
+## Data Model Changes
+
+### `keys` — extend to hold private material
+
+```json
+{
+  "key_id": "uuid",
+  "label": "dom-macbook",
+  "public_key": "ssh-ed25519 AAAA...",
+  "private_key_enc": "<AES-256-GCM ciphertext | null>",
+  "has_private": true,
+  "passphrase_enc": "<AES-256-GCM ciphertext | null>",
+  "fingerprint": "SHA256:...",
+  "source": "uploaded|generated",
+  "created_at": "ISODate"
+}
+```
+
+- A key may be created from an uploaded **private+public** pair, upload of a
+  public key only, or agent generation.
+- Agent key generation now also uploads `private_key_enc` (reuses the existing
+  AES-256 key used for at-rest encryption). Private key no longer stays local
+  only — it is stored encrypted so the console can reuse it.
+- Optional `passphrase_enc` for passphrase-protected private keys.
+- Console lists only keys where `has_private = true`.
+
+### `servers` — extend with console metadata
+
+```json
+{
+  "...": "...existing fields...",
+  "os_type": "linux|windows",
+  "console_protocols": ["ssh"],
+  "ssh_port": 22,
+  "rdp_port": 3389
+}
+```
+
+- `os_type` set at registration from the agent.
+- `console_protocols` lists enabled protocols per server (`ssh`, `rdp`, `vnc`).
+- Port fields default to standard ports, overridable in the UI.
+
+### `console_sessions` — new collection (audit)
+
+```json
+{
+  "session_id": "uuid",
+  "server_id": "uuid",
+  "protocol": "ssh|rdp|vnc",
+  "key_id": "uuid | null",
+  "user": "who opened it",
+  "started_at": "ISODate",
+  "ended_at": "ISODate | null",
+  "client_ip": "string"
+}
+```
+
+---
+
+## Session Broker + Connection Flow
+
+New service: `server/internal/services/console.go`.
+
+1. Browser `POST /api/console/connect`
+   `{ server_id, protocol, key_id?, rdp_username?, rdp_password? }`.
+2. Broker validates request, loads the server (host IP, port for protocol),
+   loads the key and **decrypts `private_key_enc` in memory only**.
+3. Builds the guacd connection parameter map:
+   - **SSH:** `hostname`, `port`, `username`, `private-key` (decrypted),
+     `passphrase` (if any).
+   - **RDP:** `hostname`, `port`, `username`, `password`, `security=any`,
+     `ignore-cert=true`.
+   - **VNC:** `hostname`, `port`, `password`.
+4. Creates a `console_sessions` document, returns a short-lived signed session
+   token.
+5. Browser opens WebSocket `/api/console/tunnel?token=…`. The `wwt/guac` handler
+   validates the token, dials guacd `:4822`, and pipes bytes in both directions.
+6. On socket close, the broker sets `ended_at` on the session doc.
+
+### Security
+
+- Decrypted private keys and RDP passwords are **never persisted, never logged,
+  never sent to the browser** — passed only to guacd.
+- Session token: short TTL (~60s to open the WebSocket), single-use,
+  HMAC-signed, bound to the authenticated user.
+- guacd is bound to the internal docker network only; not exposed publicly.
+- At-rest encryption (`private_key_enc`, `passphrase_enc`) reuses the existing
+  AES-256 key already used for agent-generated private keys.
+
+---
+
+## Windows Agent
+
+Same Go codebase as the Linux agent, with a reduced role: **register +
+heartbeat + status only**. No `authorized_keys` management (meaningless on
+Windows).
+
+- Build target: `GOOS=windows GOARCH=amd64` → `vantage-agent-windows-amd64.exe`.
+- Agent detects OS at registration and sends `os_type=windows`.
+- The key-sync loop is disabled on Windows via a runtime OS check (or build tag)
+  — no `authorized_keys` writes are ever attempted.
+- Config file: `C:\ProgramData\vantage\config.yaml`, locked down via ACL to the
+  equivalent of `0600`.
+- Runs as a Windows service via **nssm**.
+
+---
+
+## Windows Installer (MSI)
+
+Agent ships as a WiX v4 MSI produced in CI.
+
+- **WiX v4** chosen because it is a dotnet tool that builds MSIs
+  **cross-platform** — runs on the Linux Gitea act_runner. (Inno Setup is
+  Windows-only and does not fit the runner.)
+- MSI bundles `vantage-agent.exe`, installs it to `C:\Program Files\Vantage\`,
+  and registers the nssm service (ships nssm or uses a CustomAction).
+- Accepts install parameters as MSI properties for silent/headless install:
+  ```
+  msiexec /i vantage-agent.msi /qn SERVERID=<id> TOKEN=<token> SERVERURL=vantage..:9090
+  ```
+- GUI install (double-click) prompts for server-id / token / server-url via a
+  dialog.
+
+### Two install paths
+
+1. **Installer direct** — user downloads `vantage-agent.msi`, double-clicks,
+   fills the dialog. No script required.
+2. **PowerShell one-liner** — served dynamically (like the existing bash
+   `/install`). Script downloads the `.msi`, verifies SHA-256, then runs
+   `msiexec /qn` with injected `SERVERID` / `TOKEN` / `SERVERURL`. Used by the
+   copy-paste "Add Server" flow.
+
+The PowerShell script (`/install.ps1`) steps:
+1. Detect arch.
+2. Download `vantage-agent.msi` from the latest Gitea `agent/v*` release.
+3. Verify SHA-256 against `checksums.txt`.
+4. Run `msiexec /i vantage-agent.msi /qn SERVERID=.. TOKEN=.. SERVERURL=..`.
+
+---
+
+## Frontend Routes
+
+| Route                     | Change                                                        |
+| ------------------------- | ------------------------------------------------------------- |
+| `/servers`                | Show `os_type` badge, enabled console protocols               |
+| `/servers/[id]`           | Add **Connect** button(s) per enabled protocol                |
+| `/servers/[id]/console`   | New — full-screen console (guacamole-common-js), key picker   |
+| `/servers/new`            | Offer Windows (MSI) vs Linux (bash) install instructions      |
+
+Console page: select protocol + SSH key (SSH) or enter RDP credentials, call
+`/api/console/connect`, open the tunnel WebSocket, mount the Guacamole client.
+
+---
+
+## CI/CD Changes
+
+### `agent-release.yml`
+
+- Add `windows/amd64` build: `vantage-agent-windows-amd64.exe`.
+- Add WiX v4 MSI build job → `vantage-agent.msi`.
+- Add both to `checksums.txt` and release assets.
+
+Release assets become:
+- `vantage-agent-linux-amd64`
+- `vantage-agent-linux-arm64`
+- `vantage-agent-windows-amd64.exe`
+- `vantage-agent.msi`
+- `checksums.txt`
+
+### `server-deploy.yml`
+
+- Add guacd service to `deploy/docker-compose.yml` (deployed alongside server).
+
+---
+
+## New Dependencies
+
+- **Go:** `github.com/wwt/guac` (Guacamole tunnel/WebSocket in Go).
+- **Container:** `guacamole/guacd` official image.
+- **Frontend:** vendored `guacamole-common-js` (no CDN).
+- **CI:** WiX v4 dotnet tool; nssm binary bundled for the MSI.
+
+---
+
+## Open Implementation Notes
+
+- Confirm `wwt/guac` API surface for connection-parameter passing and token auth
+  binding during implementation.
+- nssm packaging inside MSI: bundle the nssm binary as a payload + CustomAction,
+  or run `sc.exe`-based service install if nssm proves awkward in WiX.
+- ACL hardening of `C:\ProgramData\vantage\config.yaml` in the MSI CustomAction.

installer/setup.ps1

@@ -0,0 +1,25 @@
+param(
+  [string]$ServerId,
+  [string]$Token,
+  [string]$ServerUrl,
+  [string]$InstallDir
+)
+$cfgDir = Join-Path $env:ProgramData "vantage"
+New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
+$cfg = @"
+server_url: "$ServerUrl"
+server_id: "$ServerId"
+pre_reg_token: "$Token"
+agent_token: ""
+poll_interval: 30s
+tls: true
+"@
+Set-Content -Path (Join-Path $cfgDir "config.yaml") -Value $cfg -Encoding utf8
+# Lock down ACL: SYSTEM + Administrators only
+icacls (Join-Path $cfgDir "config.yaml") /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" | Out-Null
+
+$nssm = Join-Path $InstallDir "nssm.exe"
+$exe  = Join-Path $InstallDir "vantage-agent.exe"
+& $nssm install VantageAgent $exe
+& $nssm set VantageAgent Start SERVICE_AUTO_START
+& $nssm start VantageAgent

installer/vantage-agent.wxs

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package Name="Vantage Agent" Manufacturer="Vantage"
+           Version="1.0.0.0" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
+           Scope="perMachine">
+    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <!-- Public properties settable via msiexec: SERVERID, TOKEN, SERVERURL -->
+    <Property Id="SERVERID" Secure="yes" />
+    <Property Id="TOKEN" Secure="yes" />
+    <Property Id="SERVERURL" Secure="yes" />
+
+    <StandardDirectory Id="ProgramFiles64Folder">
+      <Directory Id="INSTALLDIR" Name="Vantage">
+        <Component Id="AgentExe" Guid="*">
+          <File Id="AgentExe" Source="vantage-agent-windows-amd64.exe" Name="vantage-agent.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="NssmExe" Guid="*">
+          <File Id="NssmExe" Source="nssm.exe" Name="nssm.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="SetupScript" Guid="*">
+          <File Id="SetupScript" Source="setup.ps1" Name="setup.ps1" KeyPath="yes" />
+        </Component>
+      </Directory>
+    </StandardDirectory>
+
+    <Feature Id="Main">
+      <ComponentRef Id="AgentExe" />
+      <ComponentRef Id="NssmExe" />
+      <ComponentRef Id="SetupScript" />
+    </Feature>
+
+    <!-- Write config.yaml, then install + start the service via nssm.
+         Implemented as sequenced CustomActions running a helper script.
+
+         Deferred CustomActions run out-of-process (and with Impersonate="no",
+         as SYSTEM) with NO access to the installer property table, so
+         "[SERVERID]"/"[TOKEN]"/"[SERVERURL]"/"[INSTALLDIR]" would resolve to
+         empty strings if referenced directly on the deferred action. The fix
+         is the standard CustomActionData marshaling pattern: an immediate
+         SetProperty (type 51) with the SAME Id as the deferred CustomAction
+         runs first (while property values are still visible) and resolves
+         the formatted string; the deferred Directory/ExeCommand CustomAction
+         that shares that Id then receives the resolved string back as its
+         CustomActionData, referenced here as "[WriteConfig]". This avoids
+         pulling in the WixToolset.Util extension (WixQuietExec64) purely to
+         get CustomActionData plumbing.
+
+         NOTE: this only builds/validates the MSI's XML in CI - it has not
+         been verified with a real install on Windows. Needs a smoke test
+         (msiexec /i, confirm C:\ProgramData\Vantage\config.yaml or similar
+         is written with the correct values, and the service starts) on an
+         actual Windows machine before this is trusted in production. -->
+    <SetProperty Id="WriteConfig"
+      Before="WriteConfig" Sequence="execute" Condition="NOT Installed"
+      Value='cmd.exe /c powershell -ExecutionPolicy Bypass -File "[INSTALLDIR]setup.ps1" -ServerId "[SERVERID]" -Token "[TOKEN]" -ServerUrl "[SERVERURL]" -InstallDir "[INSTALLDIR]"' />
+
+    <CustomAction Id="WriteConfig" Directory="INSTALLDIR" ExeCommand="[WriteConfig]"
+      Execute="deferred" Impersonate="no" Return="check" />
+
+    <InstallExecuteSequence>
+      <Custom Action="WriteConfig" After="InstallFiles" Condition="NOT Installed" />
+    </InstallExecuteSequence>
+  </Package>
+</Wix>

proto/keymanager/v1/keymanager.proto

@@ -1,43 +0,0 @@
-syntax = "proto3";
-
-package keymanager.v1;
-
-option go_package = "github.com/mrhid6/keymanager/server/internal/grpc/pb";
-
-service KeyManager {
-  rpc Register(RegisterRequest) returns (RegisterResponse);
-  rpc SyncKeys(SyncRequest) returns (SyncResponse);
-  rpc UploadGeneratedKey(UploadKeyRequest) returns (UploadKeyResponse);
-}
-
-message RegisterRequest {
-  string server_id     = 1;
-  string pre_reg_token = 2;
-  string hostname      = 3;
-  string ip_address    = 4;
-  string os_info       = 5;
-}
-
-message RegisterResponse {
-  string agent_token = 1;
-}
-
-message SyncRequest {
-  string server_id   = 1;
-  string agent_token = 2;
-}
-
-message SyncResponse {
-  repeated string public_keys = 1;
-}
-
-message UploadKeyRequest {
-  string server_id   = 1;
-  string agent_token = 2;
-  string public_key  = 3;
-  string label       = 4;
-}
-
-message UploadKeyResponse {
-  string key_id = 1;
-}

proto/vantage/v1/vantage.proto

@@ -0,0 +1,110 @@
+syntax = "proto3";
+
+package vantage.v1;
+
+option go_package = "github.com/mrhid6/vantage/server/internal/grpc/pb";
+
+service Vantage {
+  rpc Register(RegisterRequest)                returns (RegisterResponse);
+  rpc SyncKeys(SyncRequest)                    returns (SyncResponse);
+  rpc UploadGeneratedKey(UploadKeyRequest)      returns (UploadKeyResponse);
+  rpc ReportUpdates(ReportUpdatesRequest)       returns (ReportUpdatesResponse);
+  // Bidirectional stream: agent sends auth once, server pushes commands.
+  rpc CommandStream(stream AgentMessage)        returns (stream ServerCommand);
+}
+
+message RegisterRequest {
+  string server_id     = 1;
+  string pre_reg_token = 2;
+  string hostname      = 3;
+  string ip_address    = 4;
+  string os_info       = 5;
+}
+
+message RegisterResponse {
+  string agent_token = 1;
+}
+
+message SyncRequest {
+  string server_id    = 1;
+  string agent_token  = 2;
+  string agent_version = 3;
+}
+
+message SyncResponse {
+  repeated string public_keys = 1;
+}
+
+message UploadKeyRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  string public_key  = 3;
+  string label       = 4;
+  string private_key = 5;
+}
+
+message UploadKeyResponse {
+  string key_id = 1;
+}
+
+// CommandStream messages
+
+message AgentMessage {
+  string server_id   = 1;
+  string agent_token = 2;
+  oneof payload {
+    AgentReady    ready  = 3;
+    CommandResult result = 4;
+  }
+}
+
+message AgentReady {}
+
+message CommandResult {
+  string command_id = 1;
+  bool   success    = 2;
+  string message    = 3;
+}
+
+message PackageUpdate {
+  string name            = 1;
+  string current_version = 2;
+  string new_version     = 3;
+}
+
+message ReportUpdatesRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  repeated PackageUpdate updates = 3;
+}
+
+message ReportUpdatesResponse {}
+
+message ApplyUpdatesCmd {}
+
+message ServerCommand {
+  string command_id = 1;
+  oneof command {
+    GenerateKeyCmd  generate_key  = 2;
+    DeleteKeyCmd    delete_key    = 3;
+    UpdateAgentCmd  update_agent  = 4;
+    ApplyUpdatesCmd apply_updates = 5;
+  }
+}
+
+message DeleteKeyCmd {
+  string label = 1;
+}
+
+message UpdateAgentCmd {
+  string version       = 1; // e.g. "1.2.3"
+  string gitea_base_url = 2; // e.g. "https://gitea.example.com"
+}
+
+message GenerateKeyCmd {
+  string label      = 1;
+  string key_type   = 2; // ed25519 | rsa | ecdsa (default: ed25519)
+  int32  key_size   = 3; // bits; used for rsa and ecdsa
+  string passphrase = 4; // empty = no passphrase
+  string comment    = 5; // embedded in public key
+}

server/Dockerfile

@@ -11,14 +11,14 @@ RUN go mod download
 COPY . .
 
 ARG VERSION=dev
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.Version=${VERSION}" -o /keymanager-server ./cmd
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.Version=${VERSION}" -o /vantage-server ./cmd
 
 # Runtime stage
 FROM scratch
 
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-COPY --from=builder /keymanager-server /keymanager-server
+COPY --from=builder /vantage-server /vantage-server
 
 EXPOSE 8080 9090
 
-ENTRYPOINT ["/keymanager-server"]
+ENTRYPOINT ["/vantage-server"]

server/cmd/main.go

@@ -1,32 +1,48 @@
 package main
 
 import (
+	"context"
 	"log"
 	"os"
 	"time"
 
 	"github.com/gin-gonic/gin"
-	"github.com/mrhid6/keymanager/server/internal/api"
-	"github.com/mrhid6/keymanager/server/internal/db"
-	grpcserver "github.com/mrhid6/keymanager/server/internal/grpc"
-	"github.com/mrhid6/keymanager/server/internal/services"
+	"github.com/mrhid6/vantage/server/internal/api"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/db"
+	grpcserver "github.com/mrhid6/vantage/server/internal/grpc"
+	"github.com/mrhid6/vantage/server/internal/services"
 )
 
 func main() {
 	mongoURI := getEnv("MONGO_URI", "mongodb://localhost:27017")
-	dbName := getEnv("MONGO_DB", "keymanager")
+	dbName := getEnv("MONGO_DB", "vantage")
 
 	if err := db.Connect(mongoURI, dbName); err != nil {
 		log.Fatalf("failed to connect to MongoDB: %v", err)
 	}
 	log.Println("connected to MongoDB")
 
+	if err := services.EnsureSecretIndexes(); err != nil {
+		log.Printf("warning: failed to ensure secret indexes: %v", err)
+	}
+
+	redisAddr := getEnv("REDIS_ADDR", "localhost:6379")
+	if err := auth.InitRedis(redisAddr); err != nil {
+		log.Fatalf("failed to connect to Redis: %v", err)
+	}
+	log.Println("connected to Redis")
+
+	if err := auth.InitOIDC(context.Background()); err != nil {
+		log.Fatalf("failed to initialise OIDC: %v", err)
+	}
+
 	// Background goroutine to mark offline servers
 	go func() {
 		ticker := time.NewTicker(2 * time.Minute)
 		defer ticker.Stop()
 		for range ticker.C {
-			if err := services.MarkOfflineServers(5 * time.Minute); err != nil {
+			if err := services.MarkOfflineServers(); err != nil {
 				log.Printf("mark offline error: %v", err)
 			}
 		}
@@ -40,7 +56,9 @@ func main() {
 	}()
 
 	// Start REST server
-	r := gin.Default()
+	r := gin.New()
+	r.Use(gin.Recovery())
+	r.Use(gin.LoggerWithConfig(gin.LoggerConfig{SkipPaths: []string{"/api/console/tunnel"}}))
 	r.Use(corsMiddleware())
 	api.RegisterRoutes(r)
 

server/go.mod

@@ -1,40 +1,50 @@
-module github.com/mrhid6/keymanager/server
+module github.com/mrhid6/vantage/server
 
 go 1.26
 
 require (
+	github.com/coreos/go-oidc/v3 v3.18.0
 	github.com/gin-gonic/gin v1.10.0
 	github.com/google/uuid v1.6.0
+	github.com/redis/go-redis/v9 v9.20.1
+	github.com/wwt/guac v1.3.2
 	go.mongodb.org/mongo-driver/v2 v2.2.2
+	golang.org/x/oauth2 v0.36.0
 	google.golang.org/grpc v1.64.0
 )
 
 require (
 	github.com/bytedance/sonic v1.11.6 // indirect
 	github.com/bytedance/sonic/loader v0.1.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.4 // indirect
 	github.com/cloudwego/iasm v0.2.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.20.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
+	github.com/gorilla/websocket v1.4.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.16.7 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/konsorten/go-windows-terminal-sequences v1.0.1 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/sirupsen/logrus v1.4.2 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
 	github.com/xdg-go/scram v1.1.2 // indirect
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/arch v0.8.0 // indirect
 	golang.org/x/crypto v0.33.0 // indirect
 	golang.org/x/net v0.25.0 // indirect

server/go.sum

@@ -1,11 +1,19 @@
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0=
 github.com/bytedance/sonic v1.11.6/go.mod h1:LysEHSvpvDySVdC2f87zGWf6CIKJcAvqab1ZaiQtds4=
 github.com/bytedance/sonic/loader v0.1.1 h1:c+e5Pt1k/cy5wMveRDyk2X4B9hF4g7an8N3zCYjJFNM=
 github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y=
 github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
 github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
 github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
+github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -15,6 +23,8 @@ github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
 github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -30,16 +40,21 @@ github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEW
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.4.1 h1:q7AeDBpnBk8AogcD4DSag/Ukw/KV+YhzLj2bP5HvKCM=
+github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
 github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
-github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -53,10 +68,16 @@ github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6
 github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/redis/go-redis/v9 v9.20.1 h1:sfCU6A8P3dXbKyWes02uxA2baehGux9dZHfEKtsTB1w=
+github.com/redis/go-redis/v9 v9.20.1/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -69,6 +90,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
 github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/wwt/guac v1.3.2 h1:sH6OFGa/1tBs7ieWBVlZe7t6F5JAOWBry/tqQL/Vup4=
+github.com/wwt/guac v1.3.2/go.mod h1:eKm+NrnK7A88l4UBEcYNpZQGMpZRryYKoz4D/0/n1C0=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
@@ -78,8 +101,12 @@ github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gi
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 go.mongodb.org/mongo-driver/v2 v2.2.2 h1:9cYuS3fl1Xhqwpfazso10V7BHQD58kCgtzhfAmJYz9c=
 go.mongodb.org/mongo-driver/v2 v2.2.2/go.mod h1:qQkDMhCGWl3FN509DfdPd4GRBLU/41zqF/k8eTRceps=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
 golang.org/x/arch v0.8.0 h1:3wRIsP3pM4yUptoR96otTUOXI367OS0+c9eeRi9doIc=
 golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
@@ -93,16 +120,18 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
 golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

server/internal/api/console.go

@@ -0,0 +1,166 @@
+package api
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"github.com/wwt/guac"
+)
+
+// POST /api/console/connect
+// Body: { server_id, protocol, key_id?, rdp_username?, rdp_password? }
+// Returns: { session_id, token, ws_path }
+func consoleConnect(c *gin.Context) {
+	var body struct {
+		ServerID    string `json:"server_id" binding:"required"`
+		Protocol    string `json:"protocol" binding:"required"`
+		KeyID       string `json:"key_id"`
+		RDPUsername string `json:"rdp_username"`
+		RDPPassword string `json:"rdp_password"`
+		SSHUsername string `json:"ssh_username"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	srv, err := services.GetServer(body.ServerID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	sess, err := services.CreateConsoleSession(body.ServerID, body.Protocol, body.KeyID, actorFromCtx(c), c.ClientIP())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	token, err := services.SignSessionToken(sess.SessionID, time.Minute)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	if (body.Protocol == "rdp" || body.Protocol == "vnc") && (body.RDPUsername != "" || body.RDPPassword != "") {
+		if err := services.StashConsoleRDPCreds(sess.SessionID, body.RDPUsername, body.RDPPassword); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+	}
+
+	if body.Protocol == "ssh" {
+		if err := services.SetConsoleSSHUser(sess.SessionID, body.SSHUsername); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+	}
+
+	services.LogEvent("console.opened", actorFromCtx(c), srv.ServerID, "",
+		"console session opened ("+body.Protocol+")")
+
+	c.JSON(http.StatusOK, gin.H{
+		"session_id": sess.SessionID,
+		"token":      token,
+		"ws_path":    "/api/console/tunnel",
+	})
+}
+
+// GET /api/console/tunnel?token=... (WebSocket upgrade)
+func consoleTunnel(c *gin.Context) {
+	token := c.Query("token")
+	sessionID, err := services.VerifySessionToken(token)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+		return
+	}
+	sess, err := services.GetConsoleSession(sessionID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "session not found"})
+		return
+	}
+
+	// User-bound: the caller (authenticated via session cookie) must be the same
+	// user who opened the session. Blocks a leaked token being used by someone else.
+	if actor := actorFromCtx(c); actor != sess.User {
+		c.JSON(http.StatusForbidden, gin.H{"error": "session belongs to another user"})
+		return
+	}
+
+	// Single-use: atomically spend the token so a replay within its TTL is rejected.
+	if err := services.ConsumeSessionToken(sessionID); err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "token already used"})
+		return
+	}
+
+	srv, err := services.GetServer(sess.ServerID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	// Decrypt private key + passphrase in-memory only (ssh).
+	var privKey, passphrase string
+	if sess.Protocol == "ssh" && sess.KeyID != "" {
+		privKey, err = services.GetPrivateKey(sess.KeyID)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "selected key has no private material"})
+			return
+		}
+		passphrase, _ = services.GetPassphrase(sess.KeyID)
+	}
+
+	var rdpUser, rdpPass string
+	if sess.Protocol == "rdp" || sess.Protocol == "vnc" {
+		rdpUser, rdpPass, err = services.ConsumeConsoleRDPCreds(sessionID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "could not load credentials"})
+			return
+		}
+	}
+	gp, err := services.BuildGuacParams(srv, sess.Protocol, sess.SSHUsername, privKey, passphrase, rdpUser, rdpPass)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	guacdAddr := os.Getenv("GUACD_ADDR")
+	if guacdAddr == "" {
+		guacdAddr = "guacd:4822"
+	}
+
+	// Build a guac tunnel config from our params.
+	connect := func(r *http.Request) (guac.Tunnel, error) {
+		config := guac.NewGuacamoleConfiguration()
+		config.Protocol = gp.Protocol
+		for k, v := range gp.Params {
+			config.Parameters[k] = v
+		}
+		config.OptimalScreenWidth = 1024
+		config.OptimalScreenHeight = 768
+		config.OptimalResolution = 96
+
+		addr, err := net.ResolveTCPAddr("tcp", guacdAddr)
+		if err != nil {
+			return nil, err
+		}
+		conn, err := net.DialTCP("tcp", nil, addr)
+		if err != nil {
+			return nil, err
+		}
+		stream := guac.NewStream(conn, guac.SocketTimeout)
+		if err := stream.Handshake(config); err != nil {
+			return nil, err
+		}
+		return guac.NewSimpleTunnel(stream), nil
+	}
+
+	wsServer := guac.NewWebsocketServer(connect)
+	wsServer.OnDisconnect = func(id string, r *http.Request, t guac.Tunnel) {
+		_ = services.EndConsoleSession(sessionID)
+	}
+	wsServer.ServeHTTP(c.Writer, c.Request)
+}

server/internal/api/handlers.go

@@ -4,30 +4,79 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"strconv"
 
 	"github.com/gin-gonic/gin"
-	"github.com/mrhid6/keymanager/server/internal/models"
-	"github.com/mrhid6/keymanager/server/internal/services"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
 )
 
+func actorFromCtx(c *gin.Context) string {
+	if sess := auth.GetSessionFromContext(c); sess != nil && sess.Email != "" {
+		return sess.Email
+	}
+	return "admin"
+}
+
 func RegisterRoutes(r *gin.Engine) {
 	r.GET("/install", handleInstallScript)
+	r.GET("/install.ps1", handleInstallScriptWindows)
+	r.GET("/update", handleUpdateScript)
 
-	api := r.Group("/api")
+	// ESO read endpoint — bearer-token auth, not session auth, so Kubernetes
+	// External Secrets Operator can call it. Lives under /api (so the reverse
+	// proxy routes it to the backend) but on a distinct subpath to avoid
+	// colliding with the session-authed GET /api/secrets/:group. Returns a
+	// group as flat JSON.
+	r.GET("/api/secrets/:group/values", secretsReadAuth(), esoGetGroup)
+
+	// Auth endpoints (no session required)
+	r.GET("/auth/login", auth.HandleLogin)
+	r.GET("/auth/callback", auth.HandleCallback)
+	r.GET("/auth/logout", auth.HandleLogout)
+	r.GET("/auth/me", auth.HandleMe)
+
+	// API endpoints protected by session middleware
+	apiGroup := r.Group("/api")
+	apiGroup.Use(auth.Middleware())
 	{
-		api.GET("/servers", listServers)
-		api.POST("/servers", createServer)
-		api.GET("/servers/new", newServer)
-		api.POST("/servers/new", newServer)
-		api.GET("/servers/:id", getServer)
-		api.DELETE("/servers/:id", deleteServer)
-		api.POST("/servers/:id/generate-key", generateKey)
+		apiGroup.GET("/servers", listServers)
+		apiGroup.POST("/servers", createServer)
+		apiGroup.GET("/servers/new", newServer)
+		apiGroup.POST("/servers/new", newServer)
+		apiGroup.GET("/servers/:id", getServer)
+		apiGroup.DELETE("/servers/:id", deleteServer)
+		apiGroup.POST("/servers/:id/generate-key", generateKey)
+		apiGroup.POST("/servers/:id/update-agent", updateAgent)
+		apiGroup.POST("/servers/:id/apply-updates", applyUpdates)
 
-		api.GET("/keys", listKeys)
-		api.POST("/keys", createKey)
-		api.GET("/keys/:id", getKey)
-		api.POST("/keys/:id/assign", assignKey)
-		api.DELETE("/keys/:id/assign/:serverId", revokeAssignment)
+		apiGroup.GET("/agent/latest-version", getLatestAgentVersion)
+
+		apiGroup.GET("/audit", listAuditEvents)
+
+		apiGroup.GET("/settings", getSettings)
+		apiGroup.PUT("/settings", saveSettings)
+		apiGroup.POST("/settings/secrets-token", rotateSecretsToken)
+
+		apiGroup.GET("/secrets", listSecretGroups)
+		apiGroup.POST("/secrets", createSecretGroup)
+		apiGroup.GET("/secrets/:group", getSecretGroup)
+		apiGroup.PUT("/secrets/:group", putSecretGroup)
+		apiGroup.POST("/secrets/:group/reveal", revealSecret)
+		apiGroup.DELETE("/secrets/:group", deleteSecretGroup)
+		apiGroup.DELETE("/secrets/:group/:key", deleteSecretKey)
+
+		apiGroup.GET("/keys", listKeys)
+		apiGroup.POST("/keys", createKey)
+		apiGroup.GET("/keys/:id", getKey)
+		apiGroup.GET("/keys/:id/private-key", getPrivateKey)
+		apiGroup.DELETE("/keys/:id", deleteKey)
+		apiGroup.POST("/keys/:id/assign", assignKey)
+		apiGroup.DELETE("/keys/:id/assign/:serverId", revokeAssignment)
+
+		apiGroup.POST("/console/connect", consoleConnect)
+		apiGroup.GET("/console/tunnel", consoleTunnel)
 	}
 }
 
@@ -59,6 +108,7 @@ func newServer(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("server.created", actorFromCtx(c), s.ServerID, "", "pre-registration token issued")
 
 	giteaHost := os.Getenv("GITEA_HOST")
 	if giteaHost == "" {
@@ -66,11 +116,11 @@ func newServer(c *gin.Context) {
 	}
 	host := os.Getenv("PUBLIC_HOST")
 	if host == "" {
-		host = "keymanager.example.com"
+		host = "https://vantage.example.com"
 	}
 
 	installCmd := fmt.Sprintf(
-		`curl -fsSL "https://%s/install?server_id=%s&token=%s" | bash`,
+		`curl -fsSL "%s/install?server_id=%s&token=%s" | bash`,
 		host, s.ServerID, token,
 	)
 
@@ -104,26 +154,57 @@ func getServer(c *gin.Context) {
 
 func deleteServer(c *gin.Context) {
 	id := c.Param("id")
+	s, _ := services.GetServer(id)
 	if err := services.DeleteServer(id); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	hostname := id
+	if s != nil {
+		hostname = s.Hostname
+	}
+	services.LogEvent("server.deleted", actorFromCtx(c), id, "", fmt.Sprintf("server %s deleted", hostname))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
 func generateKey(c *gin.Context) {
-	// The agent triggers key generation itself; this endpoint signals
-	// the intent by returning the server so the caller knows to wait
-	// for the agent to upload via gRPC UploadGeneratedKey.
 	id := c.Param("id")
+
+	var body struct {
+		Label      string `json:"label"`
+		KeyType    string `json:"key_type"`
+		KeySize    int    `json:"key_size"`
+		Passphrase string `json:"passphrase"`
+		Comment    string `json:"comment"`
+	}
+	_ = c.ShouldBindJSON(&body)
+	if body.Label == "" {
+		body.Label = "generated"
+	}
+
 	s, err := services.GetServer(id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{
-		"message":   "agent will generate and upload key on next poll",
-		"server_id": s.ServerID,
+
+	cmdID, err := services.DispatchGenerateKey(s.ServerID, services.KeyGenParams{
+		Label:      body.Label,
+		KeyType:    body.KeyType,
+		KeySize:    body.KeySize,
+		Passphrase: body.Passphrase,
+		Comment:    body.Comment,
+	})
+	if err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+		return
+	}
+
+	services.LogEvent("key.generation_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("key generation dispatched (label=%s type=%s)", body.Label, body.KeyType))
+	c.JSON(http.StatusAccepted, gin.H{
+		"message":    "key generation command sent to agent",
+		"command_id": cmdID,
+		"server_id":  s.ServerID,
 	})
 }
 
@@ -138,22 +219,35 @@ func listKeys(c *gin.Context) {
 
 func createKey(c *gin.Context) {
 	var body struct {
-		Label     string `json:"label" binding:"required"`
-		PublicKey string `json:"public_key" binding:"required"`
+		Label      string `json:"label" binding:"required"`
+		PublicKey  string `json:"public_key" binding:"required"`
+		PrivateKey string `json:"private_key"`
+		Passphrase string `json:"passphrase"`
 	}
 	if err := c.ShouldBindJSON(&body); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	key, err := services.CreateKey(body.Label, body.PublicKey, "uploaded", "")
+	key, err := services.CreateKey(body.Label, body.PublicKey, "uploaded", "", body.PrivateKey, body.Passphrase)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("key.uploaded", actorFromCtx(c), "", key.KeyID, fmt.Sprintf("key '%s' uploaded", key.Label))
 	c.JSON(http.StatusCreated, key)
 }
 
+func getPrivateKey(c *gin.Context) {
+	id := c.Param("id")
+	plaintext, err := services.GetPrivateKey(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"private_key": plaintext})
+}
+
 func getKey(c *gin.Context) {
 	id := c.Param("id")
 	key, err := services.GetKey(id)
@@ -163,12 +257,32 @@ func getKey(c *gin.Context) {
 	}
 
 	assignments, _ := services.GetAssignmentsWithServers(id)
-	c.JSON(http.StatusOK, gin.H{
-		"key":         key,
-		"assignments": assignments,
+
+	type keyResponse struct {
+		*models.Key
+		Assignments any `json:"assignments"`
+	}
+	c.JSON(http.StatusOK, keyResponse{
+		Key:         key,
+		Assignments: assignments,
 	})
 }
 
+func deleteKey(c *gin.Context) {
+	id := c.Param("id")
+	k, _ := services.GetKey(id)
+	if err := services.DeleteKey(id); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	label := id
+	if k != nil {
+		label = k.Label
+	}
+	services.LogEvent("key.deleted", actorFromCtx(c), "", id, fmt.Sprintf("key '%s' deleted", label))
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
 func assignKey(c *gin.Context) {
 	keyID := c.Param("id")
 	var body struct {
@@ -184,6 +298,7 @@ func assignKey(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("key.assigned", actorFromCtx(c), body.ServerID, keyID, fmt.Sprintf("key %s assigned to server %s", keyID, body.ServerID))
 	c.JSON(http.StatusCreated, a)
 }
 
@@ -195,9 +310,152 @@ func revokeAssignment(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("key.revoked", actorFromCtx(c), serverID, keyID, fmt.Sprintf("key %s revoked from server %s", keyID, serverID))
 	c.JSON(http.StatusOK, gin.H{"revoked": true})
 }
 
+func getLatestAgentVersion(c *gin.Context) {
+	version, err := services.GetLatestAgentVersion()
+	if err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"version": version})
+}
+
+func updateAgent(c *gin.Context) {
+	id := c.Param("id")
+	s, err := services.GetServer(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	version, err := services.DispatchUpdateAgent(s.ServerID)
+	if err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("agent.update_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("agent update dispatched to %s (version %s)", s.Hostname, version))
+	c.JSON(http.StatusAccepted, gin.H{
+		"message": "update command sent to agent",
+		"version": version,
+	})
+}
+
+func applyUpdates(c *gin.Context) {
+	id := c.Param("id")
+	s, err := services.GetServer(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	if err := services.DispatchApplyUpdates(s.ServerID); err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("updates.applied", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("package update command dispatched to %s", s.Hostname))
+	c.JSON(http.StatusAccepted, gin.H{"message": "apply updates command sent to agent"})
+}
+
+func handleUpdateScript(c *gin.Context) {
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+
+	script := fmt.Sprintf(`#!/usr/bin/env bash
+set -euo pipefail
+
+GITEA_HOST="%s"
+
+ARCH=$(uname -m)
+case "$ARCH" in
+  x86_64)  ARCH="amd64" ;;
+  aarch64) ARCH="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+# Get latest agent release tag
+LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/vantage/releases?limit=10" \
+  | grep -o '"tag_name":"agent/v[^"]*"' | head -1 | sed 's/"tag_name":"//;s/"//')
+
+if [ -z "$LATEST" ]; then
+  echo "Could not determine latest agent version" >&2
+  exit 1
+fi
+
+VERSION="${LATEST#agent/}"
+LATEST_ENCODED="${LATEST/\//%%2F}"
+BINARY_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/vantage-agent-linux-${ARCH}"
+CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/checksums.txt"
+
+echo "Updating vantage-agent to ${VERSION} (${ARCH})..."
+
+curl -fsSL -o /tmp/vantage-agent "${BINARY_URL}"
+curl -fsSL -o /tmp/checksums.txt "${CHECKSUM_URL}"
+
+cd /tmp
+EXPECTED=$(grep "vantage-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
+ACTUAL=$(sha256sum vantage-agent | awk '{print $1}')
+if [ "$EXPECTED" != "$ACTUAL" ]; then
+  echo "Checksum mismatch!" >&2
+  exit 1
+fi
+
+systemctl stop vantage-agent || true
+install -m 0755 /tmp/vantage-agent /usr/local/bin/vantage-agent
+systemctl start vantage-agent
+
+echo "vantage-agent updated to ${VERSION} and restarted."
+`, giteaHost)
+
+	c.Header("Content-Type", "text/x-shellscript")
+	c.String(http.StatusOK, script)
+}
+
+func listAuditEvents(c *gin.Context) {
+	limit := int64(100)
+	if l := c.Query("limit"); l != "" {
+		if n, err := strconv.ParseInt(l, 10, 64); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	events, err := services.ListAuditEvents(limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, events)
+}
+
+func getSettings(c *gin.Context) {
+	s, err := services.GetSettings()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, s)
+}
+
+func saveSettings(c *gin.Context) {
+	var body struct {
+		Alerts models.AlertSettings `json:"alerts"`
+		Email  models.EmailSettings `json:"email"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.SaveSettings(body.Alerts, body.Email); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("settings.updated", actorFromCtx(c), "", "", "alert settings updated")
+	c.JSON(http.StatusOK, gin.H{"saved": true})
+}
+
 func handleInstallScript(c *gin.Context) {
 	serverID := c.Query("server_id")
 	token := c.Query("token")
@@ -208,7 +466,11 @@ func handleInstallScript(c *gin.Context) {
 	}
 	publicHost := os.Getenv("PUBLIC_HOST")
 	if publicHost == "" {
-		publicHost = "keymanager.example.com"
+		publicHost = "vantage.example.com"
+	}
+	grpcHost := os.Getenv("GRPC_HOST")
+	if grpcHost == "" {
+		grpcHost = publicHost
 	}
 
 	script := fmt.Sprintf(`#!/usr/bin/env bash
@@ -218,6 +480,11 @@ SERVER_ID="%s"
 TOKEN="%s"
 GITEA_HOST="%s"
 KM_HOST="%s"
+KM_HOST="${KM_HOST#https://}"
+KM_HOST="${KM_HOST#http://}"
+GRPC_HOST="%s"
+GRPC_HOST="${GRPC_HOST#https://}"
+GRPC_HOST="${GRPC_HOST#http://}"
 
 ARCH=$(uname -m)
 case "$ARCH" in
@@ -227,7 +494,7 @@ case "$ARCH" in
 esac
 
 # Get latest agent release tag
-LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/keymanager/releases?limit=10" \
+LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/vantage/releases?limit=10" \
   | grep -o '"tag_name":"agent/v[^"]*"' | head -1 | sed 's/"tag_name":"//;s/"//')
 
 if [ -z "$LATEST" ]; then
@@ -236,44 +503,45 @@ if [ -z "$LATEST" ]; then
 fi
 
 VERSION="${LATEST#agent/}"
-BINARY_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST}/keymanager-agent-linux-${ARCH}"
-CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST}/checksums.txt"
+LATEST_ENCODED="${LATEST/\//%%2F}"
+BINARY_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/vantage-agent-linux-${ARCH}"
+CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/checksums.txt"
 
-echo "Installing keymanager-agent ${VERSION} (${ARCH})..."
+echo "Installing vantage-agent ${VERSION} (${ARCH})..."
 
-curl -fsSL -o /tmp/keymanager-agent "${BINARY_URL}"
+curl -fsSL -o /tmp/vantage-agent "${BINARY_URL}"
 curl -fsSL -o /tmp/checksums.txt "${CHECKSUM_URL}"
 
 cd /tmp
-EXPECTED=$(grep "keymanager-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
-ACTUAL=$(sha256sum keymanager-agent | awk '{print $1}')
+EXPECTED=$(grep "vantage-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
+ACTUAL=$(sha256sum vantage-agent | awk '{print $1}')
 if [ "$EXPECTED" != "$ACTUAL" ]; then
   echo "Checksum mismatch!" >&2
   exit 1
 fi
 
-install -m 0755 /tmp/keymanager-agent /usr/local/bin/keymanager-agent
+install -m 0755 /tmp/vantage-agent /usr/local/bin/vantage-agent
 
-mkdir -p /etc/keymanager
-chmod 0700 /etc/keymanager
+mkdir -p /etc/vantage
+chmod 0700 /etc/vantage
 
-cat > /etc/keymanager/config.yaml <<EOF
-server_url: "${KM_HOST}:9090"
+cat > /etc/vantage/config.yaml <<EOF
+server_url: "${GRPC_HOST}"
 server_id: "${SERVER_ID}"
 pre_reg_token: "${TOKEN}"
 agent_token: ""
 poll_interval: 30s
 tls: true
 EOF
-chmod 0600 /etc/keymanager/config.yaml
+chmod 0600 /etc/vantage/config.yaml
 
-cat > /etc/systemd/system/keymanager-agent.service <<EOF
+cat > /etc/systemd/system/vantage-agent.service <<EOF
 [Unit]
-Description=KeyManager Agent
+Description=Vantage Agent
 After=network.target
 
 [Service]
-ExecStart=/usr/local/bin/keymanager-agent
+ExecStart=/usr/local/bin/vantage-agent
 Restart=always
 RestartSec=10
 User=root
@@ -283,10 +551,10 @@ WantedBy=multi-user.target
 EOF
 
 systemctl daemon-reload
-systemctl enable --now keymanager-agent
+systemctl enable --now vantage-agent
 
-echo "keymanager-agent installed and started."
-`, serverID, token, giteaHost, publicHost)
+echo "vantage-agent installed and started."
+`, serverID, token, giteaHost, publicHost, grpcHost)
 
 	c.Header("Content-Type", "text/x-shellscript")
 	c.String(http.StatusOK, script)

server/internal/api/install_ps1.go

@@ -0,0 +1,56 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+
+	"github.com/gin-gonic/gin"
+)
+
+func handleInstallScriptWindows(c *gin.Context) {
+	serverID := c.Query("server_id")
+	token := c.Query("token")
+
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+	grpcHost := os.Getenv("GRPC_HOST")
+	if grpcHost == "" {
+		grpcHost = os.Getenv("PUBLIC_HOST")
+	}
+	if grpcHost == "" {
+		grpcHost = "vantage.example.com"
+	}
+
+	script := fmt.Sprintf(
+		"#Requires -RunAsAdministrator\n"+
+			"$ErrorActionPreference = \"Stop\"\n"+
+			"\n"+
+			"$ServerId = \"%s\"\n"+
+			"$Token = \"%s\"\n"+
+			"$GiteaHost = \"%s\"\n"+
+			"$ServerUrl = \"%s\" -replace '^https?://',''\n"+
+			"\n"+
+			"$rel = Invoke-RestMethod -Uri \"https://$GiteaHost/api/v1/repos/mrhid6/vantage/releases?limit=10\"\n"+
+			"$tag = ($rel | Where-Object { $_.tag_name -like 'agent/v*' } | Select-Object -First 1).tag_name\n"+
+			"if (-not $tag) { throw \"Could not determine latest agent version\" }\n"+
+			"$enc = $tag -replace '/','%%2F'\n"+
+			"$base = \"https://$GiteaHost/mrhid6/vantage/releases/download/$enc\"\n"+
+			"\n"+
+			"$tmp = Join-Path $env:TEMP \"vantage-agent.msi\"\n"+
+			"Invoke-WebRequest -Uri \"$base/vantage-agent.msi\" -OutFile $tmp\n"+
+			"Invoke-WebRequest -Uri \"$base/checksums-msi.txt\" -OutFile \"$env:TEMP\\checksums-msi.txt\"\n"+
+			"\n"+
+			"$expected = (Get-Content \"$env:TEMP\\checksums-msi.txt\" | Select-String 'vantage-agent.msi').ToString().Split()[0]\n"+
+			"$actual = (Get-FileHash $tmp -Algorithm SHA256).Hash.ToLower()\n"+
+			"if ($expected -ne $actual) { throw \"Checksum mismatch\" }\n"+
+			"\n"+
+			"Start-Process msiexec.exe -Wait -ArgumentList \"/i `\"$tmp`\" /qn SERVERID=$ServerId TOKEN=$Token SERVERURL=$ServerUrl\"\n"+
+			"Write-Host \"Vantage agent installed.\"\n",
+		serverID, token, giteaHost, grpcHost)
+
+	c.Header("Content-Type", "text/plain; charset=utf-8")
+	c.String(http.StatusOK, script)
+}

server/internal/api/secrets.go

@@ -0,0 +1,188 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+// groupNamePattern restricts group and key names to characters that are safe
+// in URLs and Kubernetes/env contexts.
+var groupNamePattern = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
+
+func validName(s string) bool {
+	return s != "" && len(s) <= 128 && groupNamePattern.MatchString(s)
+}
+
+// secretsReadAuth validates the ESO bearer token on the public read endpoint.
+func secretsReadAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		const prefix = "Bearer "
+		auth := c.GetHeader("Authorization")
+		if len(auth) <= len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing bearer token"})
+			return
+		}
+		if !services.VerifySecretsReadToken(auth[len(prefix):]) {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+			return
+		}
+		c.Next()
+	}
+}
+
+// esoGetGroup handles GET /secrets/:group for the External Secrets Operator.
+// Returns a flat JSON object { "KEY": "value", ... }; 404 if the group is empty
+// (ESO treats 404 as "deleted").
+func esoGetGroup(c *gin.Context) {
+	group := c.Param("group")
+	values, err := services.GetSecretGroupDecrypted(group)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "store error"})
+		return
+	}
+	if len(values) == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "group not found"})
+		return
+	}
+	c.JSON(http.StatusOK, values)
+}
+
+func listSecretGroups(c *gin.Context) {
+	groups, err := services.ListSecretGroups()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, groups)
+}
+
+// createSecretGroup handles POST /api/secrets. A group is implicit, so it must
+// be created with at least one key/value pair.
+func createSecretGroup(c *gin.Context) {
+	var body struct {
+		Group  string            `json:"group" binding:"required"`
+		Values map[string]string `json:"values"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if !validName(body.Group) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid group name"})
+		return
+	}
+	if len(body.Values) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "a group must be created with at least one key"})
+		return
+	}
+	for k := range body.Values {
+		if !validName(k) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("invalid key name: %s", k)})
+			return
+		}
+	}
+	if err := services.UpsertSecrets(body.Group, body.Values); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' created with keys: %s", body.Group, strings.Join(services.SortedKeys(body.Values), ", ")))
+	c.JSON(http.StatusCreated, gin.H{"group": body.Group})
+}
+
+func getSecretGroup(c *gin.Context) {
+	group := c.Param("group")
+	secrets, err := services.GetSecretGroup(group)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if len(secrets) == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "group not found"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"group": group, "secrets": secrets})
+}
+
+// putSecretGroup upserts one or more keys into an existing (or new) group.
+func putSecretGroup(c *gin.Context) {
+	group := c.Param("group")
+	if !validName(group) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid group name"})
+		return
+	}
+	var values map[string]string
+	if err := c.ShouldBindJSON(&values); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid JSON body"})
+		return
+	}
+	if len(values) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "body must contain at least one key"})
+		return
+	}
+	for k := range values {
+		if !validName(k) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("invalid key name: %s", k)})
+			return
+		}
+	}
+	if err := services.UpsertSecrets(group, values); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' keys updated: %s", group, strings.Join(services.SortedKeys(values), ", ")))
+	c.JSON(http.StatusOK, gin.H{"saved": true})
+}
+
+func revealSecret(c *gin.Context) {
+	group := c.Param("group")
+	var body struct {
+		Key string `json:"key" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	value, err := services.RevealSecret(group, body.Key)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("secret.revealed", actorFromCtx(c), "", "", fmt.Sprintf("value of '%s/%s' revealed", group, body.Key))
+	c.JSON(http.StatusOK, gin.H{"value": value})
+}
+
+func deleteSecretKey(c *gin.Context) {
+	group := c.Param("group")
+	key := c.Param("key")
+	if err := services.DeleteSecret(group, key); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("secret.deleted", actorFromCtx(c), "", "", fmt.Sprintf("key '%s' deleted from group '%s'", key, group))
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func deleteSecretGroup(c *gin.Context) {
+	group := c.Param("group")
+	if err := services.DeleteSecretGroup(group); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("secretgroup.deleted", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' deleted", group))
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func rotateSecretsToken(c *gin.Context) {
+	token, err := services.RotateSecretsReadToken()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("secrets.token_rotated", actorFromCtx(c), "", "", "ESO read token rotated")
+	c.JSON(http.StatusOK, gin.H{"token": token})
+}

server/internal/auth/middleware.go

@@ -0,0 +1,39 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+const ctxSessionKey = "km_session"
+
+func GetSessionFromContext(c *gin.Context) *Session {
+	v, _ := c.Get(ctxSessionKey)
+	sess, _ := v.(*Session)
+	return sess
+}
+
+func Middleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !authEnabled {
+			c.Next()
+			return
+		}
+
+		cookie, err := c.Request.Cookie(sessionCookieName)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
+			return
+		}
+
+		sess, err := GetSession(c.Request.Context(), cookie.Value)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "session expired"})
+			return
+		}
+
+		c.Set(ctxSessionKey, sess)
+		c.Next()
+	}
+}

server/internal/auth/oidc.go

@@ -0,0 +1,154 @@
+package auth
+
+import (
+	"context"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/gin-gonic/gin"
+	"golang.org/x/oauth2"
+)
+
+var (
+	oidcProvider *oidc.Provider
+	oauth2Cfg    *oauth2.Config
+	authEnabled  bool
+)
+
+func InitOIDC(ctx context.Context) error {
+	issuer := os.Getenv("OIDC_ISSUER")
+	if issuer == "" {
+		log.Println("OIDC_ISSUER not set; authentication disabled")
+		return nil
+	}
+
+	p, err := oidc.NewProvider(ctx, issuer)
+	if err != nil {
+		return err
+	}
+	oidcProvider = p
+	oauth2Cfg = &oauth2.Config{
+		ClientID:     os.Getenv("OIDC_CLIENT_ID"),
+		ClientSecret: os.Getenv("OIDC_CLIENT_SECRET"),
+		RedirectURL:  os.Getenv("OIDC_REDIRECT_URL"),
+		Endpoint:     p.Endpoint(),
+		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+	authEnabled = true
+	log.Println("OIDC authentication enabled")
+	return nil
+}
+
+func Enabled() bool { return authEnabled }
+
+func HandleLogin(c *gin.Context) {
+	state, err := randomHex(16)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "state generation failed"})
+		return
+	}
+	if err := SaveState(c.Request.Context(), state); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "state save failed"})
+		return
+	}
+	c.Redirect(http.StatusFound, oauth2Cfg.AuthCodeURL(state))
+}
+
+func HandleCallback(c *gin.Context) {
+	ctx := c.Request.Context()
+
+	if !ConsumeState(ctx, c.Query("state")) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid state"})
+		return
+	}
+
+	token, err := oauth2Cfg.Exchange(ctx, c.Query("code"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "token exchange failed"})
+		return
+	}
+
+	rawIDToken, ok := token.Extra("id_token").(string)
+	if !ok {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "missing id_token"})
+		return
+	}
+
+	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: oauth2Cfg.ClientID})
+	idToken, err := verifier.Verify(ctx, rawIDToken)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "token verification failed"})
+		return
+	}
+
+	var claims struct {
+		Sub   string `json:"sub"`
+		Email string `json:"email"`
+		Name  string `json:"name"`
+	}
+	if err := idToken.Claims(&claims); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "claims extraction failed"})
+		return
+	}
+
+	sessionID, err := SaveSession(ctx, &Session{
+		UserID: claims.Sub,
+		Email:  claims.Email,
+		Name:   claims.Name,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
+		return
+	}
+
+	secure := c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https"
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    sessionID,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   int(sessionTTL.Seconds()),
+	})
+
+	frontendURL := os.Getenv("PUBLIC_HOST")
+	if frontendURL == "" {
+		frontendURL = "/"
+	}
+	c.Redirect(http.StatusFound, frontendURL)
+}
+
+func HandleLogout(c *gin.Context) {
+	if cookie, err := c.Request.Cookie(sessionCookieName); err == nil {
+		_ = DeleteSession(c.Request.Context(), cookie.Value)
+	}
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		MaxAge:   -1,
+	})
+	c.Redirect(http.StatusFound, "/")
+}
+
+func HandleMe(c *gin.Context) {
+	if !authEnabled {
+		c.JSON(http.StatusOK, gin.H{"auth_enabled": false})
+		return
+	}
+	cookie, err := c.Request.Cookie(sessionCookieName)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
+		return
+	}
+	sess, err := GetSession(c.Request.Context(), cookie.Value)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "session expired"})
+		return
+	}
+	c.JSON(http.StatusOK, sess)
+}

server/internal/auth/session.go

@@ -0,0 +1,79 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+const sessionTTL = 24 * time.Hour
+const sessionCookieName = "km_session"
+const sessionPrefix = "km:session:"
+const statePrefix = "km:state:"
+
+type Session struct {
+	UserID string `json:"user_id"`
+	Email  string `json:"email"`
+	Name   string `json:"name"`
+}
+
+var rdb *redis.Client
+
+func InitRedis(addr string) error {
+	rdb = redis.NewClient(&redis.Options{Addr: addr})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return rdb.Ping(ctx).Err()
+}
+
+func randomHex(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func SaveSession(ctx context.Context, sess *Session) (string, error) {
+	id, err := randomHex(32)
+	if err != nil {
+		return "", err
+	}
+	data, err := json.Marshal(sess)
+	if err != nil {
+		return "", err
+	}
+	if err := rdb.Set(ctx, sessionPrefix+id, data, sessionTTL).Err(); err != nil {
+		return "", err
+	}
+	return id, nil
+}
+
+func GetSession(ctx context.Context, id string) (*Session, error) {
+	data, err := rdb.Get(ctx, sessionPrefix+id).Bytes()
+	if err != nil {
+		return nil, err
+	}
+	var sess Session
+	if err := json.Unmarshal(data, &sess); err != nil {
+		return nil, err
+	}
+	return &sess, nil
+}
+
+func DeleteSession(ctx context.Context, id string) error {
+	return rdb.Del(ctx, sessionPrefix+id).Err()
+}
+
+func SaveState(ctx context.Context, state string) error {
+	return rdb.Set(ctx, statePrefix+state, "1", 10*time.Minute).Err()
+}
+
+func ConsumeState(ctx context.Context, state string) bool {
+	n, err := rdb.Del(ctx, statePrefix+state).Result()
+	return err == nil && n > 0
+}

server/internal/grpc/pb/keymanager.pb.go

@@ -1,171 +0,0 @@
-// Hand-written gRPC bindings for keymanager.proto using JSON codec.
-// To use: register the JSON codec before creating gRPC servers/clients.
-
-package pb
-
-import (
-	"context"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-// Message types
-
-type RegisterRequest struct {
-	ServerId    string `json:"server_id"`
-	PreRegToken string `json:"pre_reg_token"`
-	Hostname    string `json:"hostname"`
-	IpAddress   string `json:"ip_address"`
-	OsInfo      string `json:"os_info"`
-}
-
-type RegisterResponse struct {
-	AgentToken string `json:"agent_token"`
-}
-
-type SyncRequest struct {
-	ServerId   string `json:"server_id"`
-	AgentToken string `json:"agent_token"`
-}
-
-type SyncResponse struct {
-	PublicKeys []string `json:"public_keys"`
-}
-
-type UploadKeyRequest struct {
-	ServerId   string `json:"server_id"`
-	AgentToken string `json:"agent_token"`
-	PublicKey  string `json:"public_key"`
-	Label      string `json:"label"`
-}
-
-type UploadKeyResponse struct {
-	KeyId string `json:"key_id"`
-}
-
-// Server interface
-
-type KeyManagerServer interface {
-	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
-	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
-	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
-}
-
-type UnimplementedKeyManagerServer struct{}
-
-func (UnimplementedKeyManagerServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Register not implemented")
-}
-
-func (UnimplementedKeyManagerServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SyncKeys not implemented")
-}
-
-func (UnimplementedKeyManagerServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UploadGeneratedKey not implemented")
-}
-
-// Client interface
-
-type KeyManagerClient interface {
-	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
-	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
-	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
-}
-
-type keyManagerClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewKeyManagerClient(cc grpc.ClientConnInterface) KeyManagerClient {
-	return &keyManagerClient{cc}
-}
-
-func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
-	out := new(RegisterResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/Register", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
-	out := new(SyncResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/SyncKeys", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
-	out := new(UploadKeyResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/UploadGeneratedKey", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// Server registration
-
-func RegisterKeyManagerServer(s grpc.ServiceRegistrar, srv KeyManagerServer) {
-	s.RegisterService(&KeyManager_ServiceDesc, srv)
-}
-
-var KeyManager_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "keymanager.v1.KeyManager",
-	HandlerType: (*KeyManagerServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{MethodName: "Register", Handler: _KeyManager_Register_Handler},
-		{MethodName: "SyncKeys", Handler: _KeyManager_SyncKeys_Handler},
-		{MethodName: "UploadGeneratedKey", Handler: _KeyManager_UploadGeneratedKey_Handler},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "keymanager/v1/keymanager.proto",
-}
-
-func _KeyManager_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RegisterRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyManagerServer).Register(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/Register"}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyManagerServer).Register(ctx, req.(*RegisterRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _KeyManager_SyncKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(SyncRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyManagerServer).SyncKeys(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/SyncKeys"}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyManagerServer).SyncKeys(ctx, req.(*SyncRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _KeyManager_UploadGeneratedKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(UploadKeyRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyManagerServer).UploadGeneratedKey(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/UploadGeneratedKey"}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyManagerServer).UploadGeneratedKey(ctx, req.(*UploadKeyRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}

server/internal/grpc/pb/vantage.pb.go

@@ -0,0 +1,334 @@
+// Hand-written gRPC bindings for vantage.proto using JSON codec.
+// To use: register the JSON codec before creating gRPC servers/clients.
+
+package pb
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// Message types
+
+type RegisterRequest struct {
+	ServerId    string `json:"server_id"`
+	PreRegToken string `json:"pre_reg_token"`
+	Hostname    string `json:"hostname"`
+	IpAddress   string `json:"ip_address"`
+	OsInfo      string `json:"os_info"`
+}
+
+type RegisterResponse struct {
+	AgentToken string `json:"agent_token"`
+}
+
+type SyncRequest struct {
+	ServerId     string `json:"server_id"`
+	AgentToken   string `json:"agent_token"`
+	AgentVersion string `json:"agent_version,omitempty"`
+}
+
+type SyncResponse struct {
+	PublicKeys []string `json:"public_keys"`
+}
+
+type UploadKeyRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+	PublicKey  string `json:"public_key"`
+	Label      string `json:"label"`
+	PrivateKey string `json:"private_key,omitempty"`
+}
+
+type UploadKeyResponse struct {
+	KeyId string `json:"key_id"`
+}
+
+// CommandStream message types
+
+type PackageUpdate struct {
+	Name           string `json:"name"`
+	CurrentVersion string `json:"current_version,omitempty"`
+	NewVersion     string `json:"new_version"`
+}
+
+type ReportUpdatesRequest struct {
+	ServerId   string          `json:"server_id"`
+	AgentToken string          `json:"agent_token"`
+	Updates    []PackageUpdate `json:"updates"`
+}
+
+type ReportUpdatesResponse struct{}
+
+type ApplyUpdatesCmd struct{}
+
+type ServerCommand struct {
+	CommandId    string           `json:"command_id"`
+	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
+	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
+	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
+	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
+}
+
+type DeleteKeyCmd struct {
+	Label string `json:"label"`
+}
+
+type UpdateAgentCmd struct {
+	Version      string `json:"version"`
+	GiteaBaseURL string `json:"gitea_base_url"`
+}
+
+type GenerateKeyCmd struct {
+	Label      string `json:"label"`
+	KeyType    string `json:"key_type,omitempty"`
+	KeySize    int    `json:"key_size,omitempty"`
+	Passphrase string `json:"passphrase,omitempty"`
+	Comment    string `json:"comment,omitempty"`
+}
+
+type AgentMessage struct {
+	ServerId   string         `json:"server_id"`
+	AgentToken string         `json:"agent_token"`
+	Ready      *AgentReady    `json:"ready,omitempty"`
+	Result     *CommandResult `json:"result,omitempty"`
+}
+
+type AgentReady struct{}
+
+type CommandResult struct {
+	CommandId string `json:"command_id"`
+	Success   bool   `json:"success"`
+	Message   string `json:"message"`
+}
+
+// CommandStream server-side interface
+
+type Vantage_CommandStreamServer interface {
+	Send(*ServerCommand) error
+	Recv() (*AgentMessage, error)
+	grpc.ServerStream
+}
+
+type keyManagerCommandStreamServer struct {
+	grpc.ServerStream
+}
+
+func (s *keyManagerCommandStreamServer) Send(m *ServerCommand) error {
+	return s.ServerStream.SendMsg(m)
+}
+
+func (s *keyManagerCommandStreamServer) Recv() (*AgentMessage, error) {
+	m := new(AgentMessage)
+	if err := s.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// CommandStream client-side interface
+
+type Vantage_CommandStreamClient interface {
+	Send(*AgentMessage) error
+	Recv() (*ServerCommand, error)
+	grpc.ClientStream
+}
+
+type vantageCommandStreamClient struct {
+	grpc.ClientStream
+}
+
+func (c *vantageCommandStreamClient) Send(m *AgentMessage) error {
+	return c.ClientStream.SendMsg(m)
+}
+
+func (c *vantageCommandStreamClient) Recv() (*ServerCommand, error) {
+	m := new(ServerCommand)
+	if err := c.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Server interface
+
+type VantageServer interface {
+	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
+	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
+	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
+	ReportUpdates(context.Context, *ReportUpdatesRequest) (*ReportUpdatesResponse, error)
+	CommandStream(Vantage_CommandStreamServer) error
+}
+
+type UnimplementedVantageServer struct{}
+
+func (UnimplementedVantageServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Register not implemented")
+}
+
+func (UnimplementedVantageServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SyncKeys not implemented")
+}
+
+func (UnimplementedVantageServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UploadGeneratedKey not implemented")
+}
+
+func (UnimplementedVantageServer) ReportUpdates(context.Context, *ReportUpdatesRequest) (*ReportUpdatesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportUpdates not implemented")
+}
+
+func (UnimplementedVantageServer) CommandStream(Vantage_CommandStreamServer) error {
+	return status.Errorf(codes.Unimplemented, "method CommandStream not implemented")
+}
+
+// Client interface
+
+type VantageClient interface {
+	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
+	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
+	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
+	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
+}
+
+type keyManagerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewVantageClient(cc grpc.ClientConnInterface) VantageClient {
+	return &keyManagerClient{cc}
+}
+
+func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
+	out := new(RegisterResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/Register", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
+	out := new(SyncResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncKeys", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
+	out := new(UploadKeyResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/UploadGeneratedKey", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error) {
+	out := new(ReportUpdatesResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportUpdates", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
+	stream, err := c.cc.NewStream(ctx, &Vantage_ServiceDesc.Streams[0], "/vantage.v1.Vantage/CommandStream", opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &vantageCommandStreamClient{stream}, nil
+}
+
+// Server registration
+
+func RegisterVantageServer(s grpc.ServiceRegistrar, srv VantageServer) {
+	s.RegisterService(&Vantage_ServiceDesc, srv)
+}
+
+var Vantage_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "vantage.v1.Vantage",
+	HandlerType: (*VantageServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{MethodName: "Register", Handler: _Vantage_Register_Handler},
+		{MethodName: "SyncKeys", Handler: _Vantage_SyncKeys_Handler},
+		{MethodName: "UploadGeneratedKey", Handler: _Vantage_UploadGeneratedKey_Handler},
+		{MethodName: "ReportUpdates", Handler: _Vantage_ReportUpdates_Handler},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "CommandStream",
+			Handler:       _Vantage_CommandStream_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "vantage/v1/vantage.proto",
+}
+
+func _Vantage_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).Register(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/Register"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).Register(ctx, req.(*RegisterRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_SyncKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SyncRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).SyncKeys(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/SyncKeys"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).SyncKeys(ctx, req.(*SyncRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_UploadGeneratedKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UploadKeyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).UploadGeneratedKey(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/UploadGeneratedKey"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).UploadGeneratedKey(ctx, req.(*UploadKeyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_ReportUpdates_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportUpdatesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportUpdates(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportUpdates"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportUpdates(ctx, req.(*ReportUpdatesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_CommandStream_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(VantageServer).CommandStream(&keyManagerCommandStreamServer{stream})
+}

server/internal/grpc/server.go

@@ -5,12 +5,15 @@ import (
 	"fmt"
 	"log"
 	"net"
+	"time"
 
-	"github.com/mrhid6/keymanager/server/internal/grpc/pb"
-	"github.com/mrhid6/keymanager/server/internal/services"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/status"
 )
 
@@ -18,11 +21,11 @@ func init() {
 	encoding.RegisterCodec(JSONCodec{})
 }
 
-type keyManagerServer struct {
-	pb.UnimplementedKeyManagerServer
+type vantageServer struct {
+	pb.UnimplementedVantageServer
 }
 
-func (s *keyManagerServer) Register(ctx context.Context, req *pb.RegisterRequest) (*pb.RegisterResponse, error) {
+func (s *vantageServer) Register(ctx context.Context, req *pb.RegisterRequest) (*pb.RegisterResponse, error) {
 	agentToken, err := services.RegisterServer(req.ServerId, req.PreRegToken, req.Hostname, req.IpAddress, req.OsInfo)
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "registration failed: %v", err)
@@ -30,13 +33,13 @@ func (s *keyManagerServer) Register(ctx context.Context, req *pb.RegisterRequest
 	return &pb.RegisterResponse{AgentToken: agentToken}, nil
 }
 
-func (s *keyManagerServer) SyncKeys(ctx context.Context, req *pb.SyncRequest) (*pb.SyncResponse, error) {
+func (s *vantageServer) SyncKeys(ctx context.Context, req *pb.SyncRequest) (*pb.SyncResponse, error) {
 	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
 	if err != nil {
 		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
 	}
 
-	if err := services.UpdateServerLastSeen(srv.ServerID); err != nil {
+	if err := services.UpdateServerLastSeen(srv.ServerID, req.AgentVersion); err != nil {
 		log.Printf("failed to update last seen for %s: %v", srv.ServerID, err)
 	}
 
@@ -48,13 +51,14 @@ func (s *keyManagerServer) SyncKeys(ctx context.Context, req *pb.SyncRequest) (*
 	return &pb.SyncResponse{PublicKeys: keys}, nil
 }
 
-func (s *keyManagerServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKeyRequest) (*pb.UploadKeyResponse, error) {
+func (s *vantageServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKeyRequest) (*pb.UploadKeyResponse, error) {
 	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
 	if err != nil {
 		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
 	}
 
-	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID)
+	// Agent-generated keys carry no passphrase over the wire (proto has no field).
+	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey, "")
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to store key: %v", err)
 	}
@@ -67,14 +71,100 @@ func (s *keyManagerServer) UploadGeneratedKey(ctx context.Context, req *pb.Uploa
 	return &pb.UploadKeyResponse{KeyId: key.KeyID}, nil
 }
 
+func (s *vantageServer) ReportUpdates(ctx context.Context, req *pb.ReportUpdatesRequest) (*pb.ReportUpdatesResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+
+	pkgs := make([]models.PackageUpdate, len(req.Updates))
+	for i, u := range req.Updates {
+		pkgs[i] = models.PackageUpdate{
+			Name:           u.Name,
+			CurrentVersion: u.CurrentVersion,
+			NewVersion:     u.NewVersion,
+		}
+	}
+	if err := services.StoreAvailableUpdates(srv.ServerID, pkgs); err != nil {
+		log.Printf("failed to store updates for %s: %v", srv.ServerID, err)
+	}
+	return &pb.ReportUpdatesResponse{}, nil
+}
+
+func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) error {
+	// First message authenticates the agent and signals readiness.
+	msg, err := stream.Recv()
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "expected initial auth message: %v", err)
+	}
+
+	srv, err := services.ValidateAgentToken(msg.ServerId, msg.AgentToken)
+	if err != nil {
+		return status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+
+	if err := services.UpdateServerLastSeen(srv.ServerID, ""); err != nil {
+		log.Printf("update last seen %s: %v", srv.ServerID, err)
+	}
+
+	ch := services.Dispatcher.Connect(srv.ServerID)
+	defer services.Dispatcher.Disconnect(srv.ServerID)
+
+	log.Printf("agent %s connected command stream", srv.ServerID)
+	defer log.Printf("agent %s disconnected command stream", srv.ServerID)
+
+	// Drain inbound results in the background so client Send calls never block.
+	// UploadGeneratedKey handles the real storage; these are just confirmation logs.
+	go func() {
+		for {
+			m, err := stream.Recv()
+			if err != nil {
+				return
+			}
+			if m.Result != nil {
+				r := m.Result
+				log.Printf("agent %s cmd %s: success=%v %s", srv.ServerID, r.CommandId, r.Success, r.Message)
+			}
+		}
+	}()
+
+	ctx := stream.Context()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case cmd, ok := <-ch:
+			if !ok {
+				return nil
+			}
+			if err := stream.Send(cmd); err != nil {
+				return err
+			}
+		}
+	}
+}
+
 func StartGRPC(port int) error {
 	lis, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
 	if err != nil {
 		return fmt.Errorf("failed to listen: %w", err)
 	}
 
-	s := grpc.NewServer()
-	pb.RegisterKeyManagerServer(s, &keyManagerServer{})
+	s := grpc.NewServer(
+		// Accept client keepalive pings as fast as every 20s so the 30s agent
+		// ping interval is always within the allowed window.
+		grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
+			MinTime:             20 * time.Second,
+			PermitWithoutStream: false,
+		}),
+		grpc.KeepaliveParams(keepalive.ServerParameters{
+			// Server also pings the client after 45s of inactivity so both
+			// sides can detect a dead connection without waiting for a timeout.
+			Time:    45 * time.Second,
+			Timeout: 10 * time.Second,
+		}),
+	)
+	pb.RegisterVantageServer(s, &vantageServer{})
 
 	log.Printf("gRPC server listening on :%d", port)
 	return s.Serve(lis)

server/internal/models/audit.go

@@ -0,0 +1,17 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type AuditEvent struct {
+	ID        bson.ObjectID `bson:"_id,omitempty" json:"id"`
+	EventType string        `bson:"event_type" json:"event_type"`
+	Actor     string        `bson:"actor" json:"actor"`
+	ServerID  string        `bson:"server_id,omitempty" json:"server_id,omitempty"`
+	KeyID     string        `bson:"key_id,omitempty" json:"key_id,omitempty"`
+	Details   string        `bson:"details" json:"details"`
+	CreatedAt time.Time     `bson:"created_at" json:"created_at"`
+}

server/internal/models/console_session.go

@@ -0,0 +1,28 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type ConsoleSession struct {
+	ID        bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	SessionID string        `bson:"session_id" json:"session_id"`
+	ServerID  string        `bson:"server_id" json:"server_id"`
+	Protocol  string        `bson:"protocol" json:"protocol"` // ssh | rdp | vnc
+	KeyID     string        `bson:"key_id,omitempty" json:"key_id,omitempty"`
+	User      string        `bson:"user" json:"user"`
+	StartedAt time.Time     `bson:"started_at" json:"started_at"`
+	EndedAt   *time.Time    `bson:"ended_at,omitempty" json:"ended_at,omitempty"`
+	ClientIP  string        `bson:"client_ip,omitempty" json:"client_ip,omitempty"`
+
+	// TokenConsumedAt marks the one-time session token as spent. Set atomically
+	// when the tunnel opens; a second open with the same token is rejected.
+	TokenConsumedAt *time.Time `bson:"token_consumed_at,omitempty" json:"-"`
+
+	SSHUsername string `bson:"ssh_username,omitempty" json:"ssh_username,omitempty"`
+
+	RDPUserEnc string `bson:"rdp_user_enc,omitempty" json:"-"`
+	RDPPassEnc string `bson:"rdp_pass_enc,omitempty" json:"-"`
+}

server/internal/models/key.go

@@ -8,11 +8,15 @@ import (
 
 type Key struct {
 	ID                  bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
-	KeyID               string             `bson:"key_id" json:"key_id"`
-	Label               string             `bson:"label" json:"label"`
-	PublicKey           string             `bson:"public_key" json:"public_key"`
-	Fingerprint         string             `bson:"fingerprint" json:"fingerprint"`
-	Source              string             `bson:"source" json:"source"` // uploaded | generated
-	GeneratedByServerID string             `bson:"generated_by_server_id,omitempty" json:"generated_by_server_id,omitempty"`
-	CreatedAt           time.Time          `bson:"created_at" json:"created_at"`
+	KeyID               string        `bson:"key_id" json:"key_id"`
+	Label               string        `bson:"label" json:"label"`
+	PublicKey           string        `bson:"public_key" json:"public_key"`
+	Fingerprint         string        `bson:"fingerprint" json:"fingerprint"`
+	Source              string        `bson:"source" json:"source"` // uploaded | generated
+	GeneratedByServerID string        `bson:"generated_by_server_id,omitempty" json:"generated_by_server_id,omitempty"`
+	PrivateKeyEncrypted string        `bson:"private_key_enc,omitempty" json:"-"`
+	HasPrivateKey       bool          `bson:"-" json:"has_private_key"`
+	PassphraseEncrypted string        `bson:"passphrase_enc,omitempty" json:"-"`
+	HasPassphrase       bool          `bson:"-" json:"has_passphrase"`
+	CreatedAt           time.Time     `bson:"created_at" json:"created_at"`
 }

server/internal/models/secret.go

@@ -0,0 +1,24 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Secret is a single key/value pair within a group. The value is stored
+// encrypted (AES-256-GCM) and is never serialized to JSON.
+type Secret struct {
+	ID             bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	Group          string        `bson:"group" json:"group"`
+	Key            string        `bson:"key" json:"key"`
+	EncryptedValue string        `bson:"encrypted_value" json:"-"`
+	UpdatedAt      time.Time     `bson:"updated_at" json:"updated_at"`
+}
+
+// GroupSummary describes a group in the list view.
+type GroupSummary struct {
+	Group     string    `json:"group"`
+	KeyCount  int       `json:"key_count"`
+	UpdatedAt time.Time `json:"updated_at"`
+}

server/internal/models/server.go

@@ -6,16 +6,29 @@ import (
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
-type Server struct {
-	ID             bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
-	ServerID       string             `bson:"server_id" json:"server_id"`
-	Hostname       string             `bson:"hostname" json:"hostname"`
-	IPAddress      string             `bson:"ip_address" json:"ip_address"`
-	OSInfo         string             `bson:"os_info" json:"os_info"`
-	PreRegToken    string             `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
-	PreRegExpires  *time.Time         `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
-	AgentTokenHash string             `bson:"agent_token_hash,omitempty" json:"-"`
-	Status         string             `bson:"status" json:"status"`
-	LastSeen       *time.Time         `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
-	CreatedAt      time.Time          `bson:"created_at" json:"created_at"`
+type PackageUpdate struct {
+	Name           string `bson:"name" json:"name"`
+	CurrentVersion string `bson:"current_version,omitempty" json:"current_version,omitempty"`
+	NewVersion     string `bson:"new_version" json:"new_version"`
+}
+
+type Server struct {
+	ID               bson.ObjectID  `bson:"_id,omitempty" json:"_id,omitempty"`
+	ServerID         string         `bson:"server_id" json:"server_id"`
+	Hostname         string         `bson:"hostname" json:"hostname"`
+	IPAddress        string         `bson:"ip_address" json:"ip_address"`
+	OSInfo           string         `bson:"os_info" json:"os_info"`
+	OSType           string         `bson:"os_type,omitempty" json:"os_type,omitempty"`
+	ConsoleProtocols []string       `bson:"console_protocols,omitempty" json:"console_protocols,omitempty"`
+	SSHPort          int            `bson:"ssh_port,omitempty" json:"ssh_port,omitempty"`
+	RDPPort          int            `bson:"rdp_port,omitempty" json:"rdp_port,omitempty"`
+	PreRegToken      string         `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
+	PreRegExpires    *time.Time     `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
+	AgentTokenHash   string         `bson:"agent_token_hash,omitempty" json:"-"`
+	Status           string         `bson:"status" json:"status"`
+	AgentVersion     string         `bson:"agent_version,omitempty" json:"agent_version,omitempty"`
+	LastSeen         *time.Time     `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
+	AvailableUpdates []PackageUpdate `bson:"available_updates,omitempty" json:"available_updates,omitempty"`
+	UpdatesCheckedAt *time.Time     `bson:"updates_checked_at,omitempty" json:"updates_checked_at,omitempty"`
+	CreatedAt        time.Time      `bson:"created_at" json:"created_at"`
 }

server/internal/models/settings.go

@@ -0,0 +1,39 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type AlertSettings struct {
+	Enabled                 bool   `bson:"enabled" json:"enabled"`
+	WebhookURL              string `bson:"webhook_url" json:"webhook_url"`
+	OfflineThresholdMinutes int    `bson:"offline_threshold_minutes" json:"offline_threshold_minutes"`
+}
+
+type EmailSettings struct {
+	Enabled  bool     `bson:"enabled" json:"enabled"`
+	SMTPHost string   `bson:"smtp_host" json:"smtp_host"`
+	SMTPPort int      `bson:"smtp_port" json:"smtp_port"`
+	Username string   `bson:"username" json:"username"`
+	Password string   `bson:"password" json:"password"`
+	FromAddr string   `bson:"from_addr" json:"from_addr"`
+	ToAddrs  []string `bson:"to_addrs" json:"to_addrs"`
+	UseTLS   bool     `bson:"use_tls" json:"use_tls"`
+}
+
+// SecretsSettings holds configuration for the secrets vault / ESO integration.
+// The read token is stored as a SHA-256 hash and never returned to clients.
+type SecretsSettings struct {
+	ReadTokenHash string    `bson:"read_token_hash,omitempty" json:"-"`
+	ReadTokenSet  bool      `bson:"-" json:"read_token_set"`
+	RotatedAt     time.Time `bson:"rotated_at,omitempty" json:"rotated_at,omitempty"`
+}
+
+type Settings struct {
+	ID      bson.ObjectID   `bson:"_id,omitempty" json:"-"`
+	Alerts  AlertSettings   `bson:"alerts" json:"alerts"`
+	Email   EmailSettings   `bson:"email" json:"email"`
+	Secrets SecretsSettings `bson:"secrets" json:"secrets"`
+}

server/internal/services/audit.go

@@ -0,0 +1,50 @@
+package services
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func LogEvent(eventType, actor, serverID, keyID, details string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	event := models.AuditEvent{
+		EventType: eventType,
+		Actor:     actor,
+		ServerID:  serverID,
+		KeyID:     keyID,
+		Details:   details,
+		CreatedAt: time.Now(),
+	}
+	if _, err := db.Col("audit_logs").InsertOne(ctx, event); err != nil {
+		log.Printf("audit log error: %v", err)
+	}
+}
+
+func ListAuditEvents(limit int64) ([]models.AuditEvent, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	opts := options.Find().
+		SetSort(bson.D{{Key: "created_at", Value: -1}}).
+		SetLimit(limit)
+
+	cursor, err := db.Col("audit_logs").Find(ctx, bson.M{}, opts)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var events []models.AuditEvent
+	if err := cursor.All(ctx, &events); err != nil {
+		return nil, err
+	}
+	return events, nil
+}

server/internal/services/console.go

@@ -0,0 +1,250 @@
+package services
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func sessionHMACKey() ([]byte, error) {
+	// Reuse the AES key material as the HMAC secret. Distinct domain via prefix.
+	k, err := encryptionKey()
+	if err != nil {
+		return nil, err
+	}
+	mac := hmac.New(sha256.New, k)
+	mac.Write([]byte("vantage-console-session-v1"))
+	return mac.Sum(nil), nil
+}
+
+func b64(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
+
+// SignSessionToken returns a signed, expiring token binding a session id.
+func SignSessionToken(sessionID string, ttl time.Duration) (string, error) {
+	key, err := sessionHMACKey()
+	if err != nil {
+		return "", err
+	}
+	exp := time.Now().Add(ttl).Unix()
+	payload := fmt.Sprintf("%s.%d", b64([]byte(sessionID)), exp)
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(payload))
+	return payload + "." + b64(mac.Sum(nil)), nil
+}
+
+// VerifySessionToken checks signature + expiry and returns the session id.
+func VerifySessionToken(token string) (string, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return "", fmt.Errorf("malformed token")
+	}
+	payload := parts[0] + "." + parts[1]
+	key, err := sessionHMACKey()
+	if err != nil {
+		return "", err
+	}
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(payload))
+	want := mac.Sum(nil)
+	got, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil || !hmac.Equal(want, got) {
+		return "", fmt.Errorf("invalid signature")
+	}
+	exp, err := strconv.ParseInt(parts[1], 10, 64)
+	if err != nil {
+		return "", fmt.Errorf("invalid expiry")
+	}
+	if time.Now().Unix() > exp {
+		return "", fmt.Errorf("token expired")
+	}
+	sid, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return "", fmt.Errorf("invalid session id")
+	}
+	return string(sid), nil
+}
+
+type GuacParams struct {
+	Protocol string
+	Params   map[string]string
+}
+
+func portOr(v, def int) string {
+	if v == 0 {
+		v = def
+	}
+	return strconv.Itoa(v)
+}
+
+// BuildGuacParams assembles the guacd connection parameter map for a protocol.
+// privateKey/passphrase are the decrypted SSH private key and its optional
+// passphrase (ssh only); rdpUser/rdpPass are used for rdp, and rdpPass carries
+// the password for vnc. None of these values are persisted or logged by the caller.
+func BuildGuacParams(srv *models.Server, protocol, sshUser, privateKey, passphrase, rdpUser, rdpPass string) (*GuacParams, error) {
+	host := srv.IPAddress
+	switch protocol {
+	case "ssh":
+		p := map[string]string{
+			"hostname": host,
+			"port":     portOr(srv.SSHPort, 22),
+		}
+		if sshUser == "" {
+			sshUser = "root"
+		}
+		p["username"] = sshUser
+		if privateKey != "" {
+			p["private-key"] = privateKey
+		}
+		if passphrase != "" {
+			p["passphrase"] = passphrase
+		}
+		return &GuacParams{Protocol: "ssh", Params: p}, nil
+	case "rdp":
+		return &GuacParams{Protocol: "rdp", Params: map[string]string{
+			"hostname":    host,
+			"port":        portOr(srv.RDPPort, 3389),
+			"username":    rdpUser,
+			"password":    rdpPass,
+			"security":    "any",
+			"ignore-cert": "true",
+		}}, nil
+	case "vnc":
+		return &GuacParams{Protocol: "vnc", Params: map[string]string{
+			"hostname": host,
+			"port":     "5900",
+			"password": rdpPass,
+		}}, nil
+	default:
+		return nil, fmt.Errorf("unsupported protocol %q", protocol)
+	}
+}
+
+func CreateConsoleSession(serverID, protocol, keyID, user, clientIP string) (*models.ConsoleSession, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	s := &models.ConsoleSession{
+		SessionID: uuid.NewString(),
+		ServerID:  serverID,
+		Protocol:  protocol,
+		KeyID:     keyID,
+		User:      user,
+		ClientIP:  clientIP,
+		StartedAt: time.Now(),
+	}
+	if _, err := db.Col("console_sessions").InsertOne(ctx, s); err != nil {
+		return nil, err
+	}
+	return s, nil
+}
+
+func GetConsoleSession(sessionID string) (*models.ConsoleSession, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var s models.ConsoleSession
+	if err := db.Col("console_sessions").FindOne(ctx, bson.M{"session_id": sessionID}).Decode(&s); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+// StashConsoleRDPCreds encrypts and stores single-use RDP credentials on the
+// session document. They are consumed (and cleared) when the tunnel opens.
+func StashConsoleRDPCreds(sessionID, username, password string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	u, err := encryptString(username)
+	if err != nil {
+		return err
+	}
+	p, err := encryptString(password)
+	if err != nil {
+		return err
+	}
+	_, err = db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID},
+		bson.M{"$set": bson.M{"rdp_user_enc": u, "rdp_pass_enc": p}},
+	)
+	return err
+}
+
+// ConsumeConsoleRDPCreds decrypts and returns the stored RDP credentials, then
+// clears them from the session document (single-use). Returns empty strings if
+// none were stored.
+func ConsumeConsoleRDPCreds(sessionID string) (username, password string, err error) {
+	s, err := GetConsoleSession(sessionID)
+	if err != nil {
+		return "", "", err
+	}
+	if s.RDPUserEnc == "" && s.RDPPassEnc == "" {
+		return "", "", nil
+	}
+	if s.RDPUserEnc != "" {
+		if username, err = decryptString(s.RDPUserEnc); err != nil {
+			return "", "", err
+		}
+	}
+	if s.RDPPassEnc != "" {
+		if password, err = decryptString(s.RDPPassEnc); err != nil {
+			return "", "", err
+		}
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, _ = db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID},
+		bson.M{"$unset": bson.M{"rdp_user_enc": "", "rdp_pass_enc": ""}},
+	)
+	return username, password, nil
+}
+
+// SetConsoleSSHUser persists the SSH username to use on the session doc.
+func SetConsoleSSHUser(sessionID, username string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err := db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID},
+		bson.M{"$set": bson.M{"ssh_username": username}})
+	return err
+}
+
+// ConsumeSessionToken atomically marks a session's one-time token as spent.
+// It returns an error if the token was already consumed (replay) or the session
+// does not exist, so the tunnel can be opened at most once per issued token.
+func ConsumeSessionToken(sessionID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	now := time.Now()
+	res, err := db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID, "token_consumed_at": nil},
+		bson.M{"$set": bson.M{"token_consumed_at": now}},
+	)
+	if err != nil {
+		return err
+	}
+	if res.MatchedCount == 0 {
+		return fmt.Errorf("session token already used")
+	}
+	return nil
+}
+
+func EndConsoleSession(sessionID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	now := time.Now()
+	_, err := db.Col("console_sessions").UpdateOne(ctx,
+		bson.M{"session_id": sessionID, "ended_at": nil},
+		bson.M{"$set": bson.M{"ended_at": now}},
+	)
+	return err
+}

server/internal/services/console_test.go

@@ -0,0 +1,111 @@
+package services
+
+import (
+	"testing"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+func TestSessionTokenRoundTrip(t *testing.T) {
+	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	tok, err := SignSessionToken("sess-123", time.Minute)
+	if err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+	got, err := VerifySessionToken(tok)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if got != "sess-123" {
+		t.Fatalf("got %q want sess-123", got)
+	}
+}
+
+func TestSessionTokenExpired(t *testing.T) {
+	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	tok, err := SignSessionToken("sess-123", -time.Second)
+	if err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+	if _, err := VerifySessionToken(tok); err == nil {
+		t.Fatalf("expected expiry error, got nil")
+	}
+}
+
+func TestSessionTokenTampered(t *testing.T) {
+	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
+
+	tok, _ := SignSessionToken("sess-123", time.Minute)
+	if _, err := VerifySessionToken(tok + "x"); err == nil {
+		t.Fatalf("expected signature error, got nil")
+	}
+}
+
+func TestBuildGuacParamsSSH(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
+	p, err := BuildGuacParams(srv, "ssh", "", "PRIVATE-KEY-DATA", "", "", "")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Protocol != "ssh" {
+		t.Fatalf("protocol %q", p.Protocol)
+	}
+	if p.Params["hostname"] != "10.0.0.5" || p.Params["port"] != "22" {
+		t.Fatalf("bad host/port: %+v", p.Params)
+	}
+	if p.Params["private-key"] != "PRIVATE-KEY-DATA" {
+		t.Fatalf("missing private-key")
+	}
+	if p.Params["username"] != "root" {
+		t.Fatalf("expected default username root, got %q", p.Params["username"])
+	}
+}
+
+func TestBuildGuacParamsRDP(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.9", RDPPort: 3389}
+	p, err := BuildGuacParams(srv, "rdp", "", "", "", "administrator", "s3cret")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Params["port"] != "3389" || p.Params["username"] != "administrator" || p.Params["password"] != "s3cret" {
+		t.Fatalf("bad rdp params: %+v", p.Params)
+	}
+	if p.Params["ignore-cert"] != "true" {
+		t.Fatalf("expected ignore-cert=true")
+	}
+}
+
+func TestBuildGuacParamsUnknownProtocol(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.9"}
+	if _, err := BuildGuacParams(srv, "telnet", "", "", "", "", ""); err == nil {
+		t.Fatalf("expected error for unknown protocol")
+	}
+}
+
+func TestBuildGuacParamsSSHPassphrase(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
+	p, err := BuildGuacParams(srv, "ssh", "deploy", "PK", "s3cret-phrase", "", "")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Params["username"] != "deploy" {
+		t.Fatalf("username %q", p.Params["username"])
+	}
+	if p.Params["passphrase"] != "s3cret-phrase" {
+		t.Fatalf("missing passphrase: %+v", p.Params)
+	}
+}
+
+func TestBuildGuacParamsVNC(t *testing.T) {
+	srv := &models.Server{IPAddress: "10.0.0.7"}
+	p, err := BuildGuacParams(srv, "vnc", "", "", "", "", "vncpass")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if p.Protocol != "vnc" || p.Params["hostname"] != "10.0.0.7" || p.Params["port"] != "5900" || p.Params["password"] != "vncpass" {
+		t.Fatalf("bad vnc params: %+v", p.Params)
+	}
+}

server/internal/services/crypto.go

@@ -0,0 +1,79 @@
+package services
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+)
+
+func encryptionKey() ([]byte, error) {
+	raw := os.Getenv("KEY_ENCRYPTION_KEY")
+	if raw == "" {
+		return nil, fmt.Errorf("KEY_ENCRYPTION_KEY is not set")
+	}
+	key, err := hex.DecodeString(raw)
+	if err != nil || len(key) != 32 {
+		return nil, fmt.Errorf("KEY_ENCRYPTION_KEY must be a 64-character hex string (32 bytes)")
+	}
+	return key, nil
+}
+
+// encryptString encrypts a plaintext value with AES-256-GCM using the
+// shared KEY_ENCRYPTION_KEY, returning hex(nonce + ciphertext).
+func encryptString(plaintext string) (string, error) {
+	key, err := encryptionKey()
+	if err != nil {
+		return "", err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return "", err
+	}
+	sealed := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
+	return hex.EncodeToString(sealed), nil
+}
+
+// decryptString reverses encryptString.
+func decryptString(ciphertextHex string) (string, error) {
+	key, err := encryptionKey()
+	if err != nil {
+		return "", err
+	}
+	data, err := hex.DecodeString(ciphertextHex)
+	if err != nil {
+		return "", fmt.Errorf("invalid ciphertext encoding")
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonceSize := gcm.NonceSize()
+	if len(data) < nonceSize {
+		return "", fmt.Errorf("ciphertext too short")
+	}
+	plaintext, err := gcm.Open(nil, data[:nonceSize], data[nonceSize:], nil)
+	if err != nil {
+		return "", fmt.Errorf("decryption failed")
+	}
+	return string(plaintext), nil
+}
+
+func encryptPrivateKey(plaintext string) (string, error) { return encryptString(plaintext) }
+
+func decryptPrivateKey(ciphertextHex string) (string, error) { return decryptString(ciphertextHex) }

server/internal/services/dispatch.go

@@ -0,0 +1,186 @@
+package services
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+)
+
+type commandDispatcher struct {
+	mu       sync.RWMutex
+	channels map[string]chan *pb.ServerCommand
+}
+
+// Dispatcher is the singleton command dispatcher used by both the gRPC server
+// and the REST API to push commands to connected agents.
+var Dispatcher = &commandDispatcher{
+	channels: make(map[string]chan *pb.ServerCommand),
+}
+
+// Connect registers an agent's command channel. Returns the channel to drain.
+func (d *commandDispatcher) Connect(serverID string) chan *pb.ServerCommand {
+	ch := make(chan *pb.ServerCommand, 16)
+	d.mu.Lock()
+	d.channels[serverID] = ch
+	d.mu.Unlock()
+	return ch
+}
+
+// Disconnect removes the agent's channel on stream close.
+func (d *commandDispatcher) Disconnect(serverID string) {
+	d.mu.Lock()
+	delete(d.channels, serverID)
+	d.mu.Unlock()
+}
+
+// IsConnected reports whether an agent is currently holding a CommandStream.
+func (d *commandDispatcher) IsConnected(serverID string) bool {
+	d.mu.RLock()
+	_, ok := d.channels[serverID]
+	d.mu.RUnlock()
+	return ok
+}
+
+func (d *commandDispatcher) dispatch(serverID string, cmd *pb.ServerCommand) error {
+	d.mu.RLock()
+	ch, ok := d.channels[serverID]
+	d.mu.RUnlock()
+	if !ok {
+		return fmt.Errorf("agent for server %s is not connected", serverID)
+	}
+	select {
+	case ch <- cmd:
+		return nil
+	default:
+		return fmt.Errorf("command queue full for server %s", serverID)
+	}
+}
+
+// KeyGenParams carries all options for a generate-key command.
+type KeyGenParams struct {
+	Label      string
+	KeyType    string
+	KeySize    int
+	Passphrase string
+	Comment    string
+}
+
+// GetLatestAgentVersion queries the Gitea API for the latest agent/v* release tag
+// and returns just the version number (e.g. "1.2.3").
+func GetLatestAgentVersion() (string, error) {
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+	url := fmt.Sprintf("https://%s/api/v1/repos/mrhid6/vantage/releases?limit=20", giteaHost)
+	resp, err := http.Get(url) //nolint:gosec
+	if err != nil {
+		return "", fmt.Errorf("fetch releases: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("Gitea API returned HTTP %d", resp.StatusCode)
+	}
+
+	var releases []struct {
+		TagName string `json:"tag_name"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
+		return "", fmt.Errorf("decode releases: %w", err)
+	}
+
+	for _, r := range releases {
+		if strings.HasPrefix(r.TagName, "agent/v") {
+			return strings.TrimPrefix(r.TagName, "agent/v"), nil
+		}
+	}
+	return "", fmt.Errorf("no agent release found")
+}
+
+// DispatchUpdateAgent sends an update command to the named server's agent.
+// It fetches the latest version from Gitea and includes the download base URL.
+func DispatchUpdateAgent(serverID string) (string, error) {
+	if !Dispatcher.IsConnected(serverID) {
+		return "", fmt.Errorf("agent is not connected to the command stream")
+	}
+
+	version, err := GetLatestAgentVersion()
+	if err != nil {
+		return "", fmt.Errorf("get latest version: %w", err)
+	}
+
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+
+	cmdID := uuid.New().String()
+	cmd := &pb.ServerCommand{
+		CommandId: cmdID,
+		UpdateAgent: &pb.UpdateAgentCmd{
+			Version:      version,
+			GiteaBaseURL: "https://" + giteaHost,
+		},
+	}
+	if err := Dispatcher.dispatch(serverID, cmd); err != nil {
+		return "", err
+	}
+	return version, nil
+}
+
+// DispatchApplyUpdates sends an apply-updates command to the named server's agent.
+func DispatchApplyUpdates(serverID string) error {
+	if !Dispatcher.IsConnected(serverID) {
+		return fmt.Errorf("agent is not connected to the command stream")
+	}
+	cmd := &pb.ServerCommand{
+		CommandId:    uuid.New().String(),
+		ApplyUpdates: &pb.ApplyUpdatesCmd{},
+	}
+	return Dispatcher.dispatch(serverID, cmd)
+}
+
+// DispatchDeleteKey sends a delete-key command to the named server's agent.
+// It is best-effort: if the agent is offline the local files will remain until next connection.
+func DispatchDeleteKey(serverID, label string) {
+	if !Dispatcher.IsConnected(serverID) {
+		return
+	}
+	cmd := &pb.ServerCommand{
+		CommandId: uuid.New().String(),
+		DeleteKey: &pb.DeleteKeyCmd{Label: label},
+	}
+	if err := Dispatcher.dispatch(serverID, cmd); err != nil {
+		// Non-fatal: agent will clean up files on next manual intervention or reinstall.
+		_ = err
+	}
+}
+
+// DispatchGenerateKey sends a generate-key command to the named server's agent.
+// Returns the command ID that can be used to correlate the agent's result.
+func DispatchGenerateKey(serverID string, p KeyGenParams) (string, error) {
+	if !Dispatcher.IsConnected(serverID) {
+		return "", fmt.Errorf("agent is not connected to the command stream")
+	}
+	cmdID := uuid.New().String()
+	cmd := &pb.ServerCommand{
+		CommandId: cmdID,
+		GenerateKey: &pb.GenerateKeyCmd{
+			Label:      p.Label,
+			KeyType:    p.KeyType,
+			KeySize:    p.KeySize,
+			Passphrase: p.Passphrase,
+			Comment:    p.Comment,
+		},
+	}
+	if err := Dispatcher.dispatch(serverID, cmd); err != nil {
+		return "", err
+	}
+	return cmdID, nil
+}

server/internal/services/keys.go

@@ -9,8 +9,8 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/mrhid6/keymanager/server/internal/db"
-	"github.com/mrhid6/keymanager/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
@@ -31,7 +31,12 @@ func computeFingerprint(pubKey string) string {
 	return "MD5:" + strings.Join(pairs, ":")
 }
 
-func CreateKey(label, publicKey, source, generatedByServerID string) (*models.Key, error) {
+func setKeyMeta(k *models.Key) {
+	k.HasPrivateKey = k.PrivateKeyEncrypted != ""
+	k.HasPassphrase = k.PassphraseEncrypted != ""
+}
+
+func CreateKey(label, publicKey, source, generatedByServerID, privateKey, passphrase string) (*models.Key, error) {
 	key := &models.Key{
 		KeyID:               uuid.NewString(),
 		Label:               label,
@@ -41,6 +46,20 @@ func CreateKey(label, publicKey, source, generatedByServerID string) (*models.Ke
 		GeneratedByServerID: generatedByServerID,
 		CreatedAt:           time.Now(),
 	}
+	if privateKey != "" {
+		enc, err := encryptPrivateKey(privateKey)
+		if err != nil {
+			return nil, fmt.Errorf("encrypt private key: %w", err)
+		}
+		key.PrivateKeyEncrypted = enc
+	}
+	if passphrase != "" {
+		enc, err := encryptString(passphrase)
+		if err != nil {
+			return nil, fmt.Errorf("encrypt passphrase: %w", err)
+		}
+		key.PassphraseEncrypted = enc
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -48,6 +67,7 @@ func CreateKey(label, publicKey, source, generatedByServerID string) (*models.Ke
 	if err != nil {
 		return nil, err
 	}
+	setKeyMeta(key)
 	return key, nil
 }
 
@@ -60,10 +80,46 @@ func GetKey(keyID string) (*models.Key, error) {
 	if err != nil {
 		return nil, err
 	}
+	setKeyMeta(&key)
 	return &key, nil
 }
 
-func ListKeys() ([]models.Key, error) {
+func GetPrivateKey(keyID string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var key models.Key
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+		return "", err
+	}
+	if key.PrivateKeyEncrypted == "" {
+		return "", fmt.Errorf("no private key stored for this key")
+	}
+	return decryptPrivateKey(key.PrivateKeyEncrypted)
+}
+
+// GetPassphrase returns the decrypted passphrase for a key, or an empty string
+// if the key has none stored.
+func GetPassphrase(keyID string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var key models.Key
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+		return "", err
+	}
+	if key.PassphraseEncrypted == "" {
+		return "", nil
+	}
+	return decryptString(key.PassphraseEncrypted)
+}
+
+type KeyWithCount struct {
+	models.Key    `bson:",inline"`
+	AssignedCount int `bson:"-" json:"assigned_count"`
+}
+
+func ListKeys() ([]KeyWithCount, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -77,15 +133,39 @@ func ListKeys() ([]models.Key, error) {
 	if err := cursor.All(ctx, &keys); err != nil {
 		return nil, err
 	}
-	return keys, nil
+
+	result := make([]KeyWithCount, 0, len(keys))
+	for _, k := range keys {
+		setKeyMeta(&k)
+		count, _ := db.Col("assignments").CountDocuments(ctx, bson.M{
+			"key_id":     k.KeyID,
+			"revoked_at": nil,
+		})
+		result = append(result, KeyWithCount{Key: k, AssignedCount: int(count)})
+	}
+	return result, nil
 }
 
 func DeleteKey(keyID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	_, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID})
-	return err
+	var key models.Key
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+		return err
+	}
+
+	if _, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID}); err != nil {
+		return err
+	}
+	if _, err := db.Col("assignments").DeleteMany(ctx, bson.M{"key_id": keyID}); err != nil {
+		return err
+	}
+
+	if key.Source == "generated" && key.GeneratedByServerID != "" {
+		DispatchDeleteKey(key.GeneratedByServerID, key.Label)
+	}
+	return nil
 }
 
 func AssignKey(keyID, serverID string) (*models.Assignment, error) {
@@ -198,12 +278,12 @@ func GetAssignmentsWithKeysForServer(serverID string) ([]AssignmentWithKey, erro
 
 	result := make([]AssignmentWithKey, 0, len(assignments))
 	for _, a := range assignments {
-		item := AssignmentWithKey{Assignment: a}
 		var key models.Key
-		if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key); err == nil {
-			item.Key = &key
+		if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key); err != nil {
+			continue
 		}
-		result = append(result, item)
+		setKeyMeta(&key)
+		result = append(result, AssignmentWithKey{Assignment: a, Key: &key})
 	}
 	return result, nil
 }

server/internal/services/secrets.go

@@ -0,0 +1,174 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+// EnsureSecretIndexes creates the unique compound index on (group, key).
+func EnsureSecretIndexes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	_, err := db.Col("secrets").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "group", Value: 1}, {Key: "key", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	})
+	return err
+}
+
+// ListSecretGroups returns a summary of every group with its key count and
+// most recent update time.
+func ListSecretGroups() ([]models.GroupSummary, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	pipeline := mongo.Pipeline{
+		{{Key: "$group", Value: bson.D{
+			{Key: "_id", Value: "$group"},
+			{Key: "key_count", Value: bson.D{{Key: "$sum", Value: 1}}},
+			{Key: "updated_at", Value: bson.D{{Key: "$max", Value: "$updated_at"}}},
+		}}},
+		{{Key: "$sort", Value: bson.D{{Key: "_id", Value: 1}}}},
+	}
+
+	cursor, err := db.Col("secrets").Aggregate(ctx, pipeline)
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var rows []struct {
+		Group     string    `bson:"_id"`
+		KeyCount  int       `bson:"key_count"`
+		UpdatedAt time.Time `bson:"updated_at"`
+	}
+	if err := cursor.All(ctx, &rows); err != nil {
+		return nil, err
+	}
+
+	groups := make([]models.GroupSummary, 0, len(rows))
+	for _, r := range rows {
+		groups = append(groups, models.GroupSummary{
+			Group:     r.Group,
+			KeyCount:  r.KeyCount,
+			UpdatedAt: r.UpdatedAt,
+		})
+	}
+	return groups, nil
+}
+
+// GetSecretGroup returns the keys within a group, sorted by key name, without
+// decrypted values.
+func GetSecretGroup(group string) ([]models.Secret, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cursor, err := db.Col("secrets").Find(ctx, bson.M{"group": group},
+		options.Find().SetSort(bson.D{{Key: "key", Value: 1}}))
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+
+	var docs []models.Secret
+	if err := cursor.All(ctx, &docs); err != nil {
+		return nil, err
+	}
+	return docs, nil
+}
+
+// GetSecretGroupDecrypted returns a flat map of key → plaintext value for a
+// group. Used by the ESO read endpoint.
+func GetSecretGroupDecrypted(group string) (map[string]string, error) {
+	docs, err := GetSecretGroup(group)
+	if err != nil {
+		return nil, err
+	}
+	result := make(map[string]string, len(docs))
+	for _, doc := range docs {
+		val, err := decryptString(doc.EncryptedValue)
+		if err != nil {
+			return nil, fmt.Errorf("decrypt %s/%s: %w", group, doc.Key, err)
+		}
+		result[doc.Key] = val
+	}
+	return result, nil
+}
+
+// RevealSecret returns the decrypted value of a single key.
+func RevealSecret(group, key string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var doc models.Secret
+	err := db.Col("secrets").FindOne(ctx, bson.M{"group": group, "key": key}).Decode(&doc)
+	if err == mongo.ErrNoDocuments {
+		return "", fmt.Errorf("secret not found")
+	}
+	if err != nil {
+		return "", err
+	}
+	return decryptString(doc.EncryptedValue)
+}
+
+// UpsertSecrets encrypts and writes each key/value pair into the group.
+func UpsertSecrets(group string, values map[string]string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	for key, val := range values {
+		encrypted, err := encryptString(val)
+		if err != nil {
+			return fmt.Errorf("encrypt %s: %w", key, err)
+		}
+		_, err = db.Col("secrets").UpdateOne(ctx,
+			bson.M{"group": group, "key": key},
+			bson.M{"$set": bson.M{
+				"encrypted_value": encrypted,
+				"updated_at":      time.Now(),
+			}},
+			options.UpdateOne().SetUpsert(true),
+		)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SortedKeys returns the map keys sorted — handy for stable audit messages.
+func SortedKeys(m map[string]string) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// DeleteSecret removes a single key from a group.
+func DeleteSecret(group, key string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err := db.Col("secrets").DeleteOne(ctx, bson.M{"group": group, "key": key})
+	return err
+}
+
+// DeleteSecretGroup removes an entire group and all its keys.
+func DeleteSecretGroup(group string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_, err := db.Col("secrets").DeleteMany(ctx, bson.M{"group": group})
+	return err
+}

server/internal/services/servers.go

@@ -6,11 +6,12 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/mrhid6/keymanager/server/internal/db"
-	"github.com/mrhid6/keymanager/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
 	"go.mongodb.org/mongo-driver/v2/bson"
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
@@ -78,6 +79,25 @@ func GetServerByPreRegToken(token string) (*models.Server, error) {
 	return &s, nil
 }
 
+// OSTypeFromInfo derives a coarse os_type ("windows" or "linux") from the
+// agent-reported os_info string, which is formatted "<GOOS> <GOARCH>".
+// Anything that is not explicitly windows defaults to linux.
+func OSTypeFromInfo(osInfo string) string {
+	if strings.HasPrefix(strings.ToLower(osInfo), "windows") {
+		return "windows"
+	}
+	return "linux"
+}
+
+// defaultConsoleFields returns the initial console configuration for a newly
+// registered server based on its os_type.
+func defaultConsoleFields(osType string) (protocols []string, sshPort, rdpPort int) {
+	if osType == "windows" {
+		return []string{"rdp"}, 22, 3389
+	}
+	return []string{"ssh"}, 22, 3389
+}
+
 func RegisterServer(serverID, preRegToken, hostname, ipAddress, osInfo string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
@@ -99,18 +119,31 @@ func RegisterServer(serverID, preRegToken, hostname, ipAddress, osInfo string) (
 	tokenHash := HashToken(agentToken)
 	now := time.Now()
 
+	osType := OSTypeFromInfo(osInfo)
+	protocols, sshPort, rdpPort := defaultConsoleFields(osType)
+
+	setFields := bson.M{
+		"hostname":         hostname,
+		"ip_address":       ipAddress,
+		"os_info":          osInfo,
+		"os_type":          osType,
+		"agent_token_hash": tokenHash,
+		"status":           "active",
+		"last_seen":        now,
+		"pre_reg_token":    "",
+		"pre_reg_expires":  nil,
+	}
+	if len(s.ConsoleProtocols) == 0 {
+		setFields["console_protocols"] = protocols
+		setFields["ssh_port"] = sshPort
+		setFields["rdp_port"] = rdpPort
+	}
+
 	_, err = db.Col("servers").UpdateOne(ctx,
 		bson.M{"server_id": serverID},
-		bson.M{"$set": bson.M{
-			"hostname":         hostname,
-			"ip_address":       ipAddress,
-			"os_info":          osInfo,
-			"agent_token_hash": tokenHash,
-			"status":           "active",
-			"last_seen":        now,
-			"pre_reg_token":    "",
-			"pre_reg_expires":  nil,
-		}},
+		bson.M{
+			"$set": setFields,
+		},
 	)
 	if err != nil {
 		return "", err
@@ -134,14 +167,18 @@ func ValidateAgentToken(serverID, agentToken string) (*models.Server, error) {
 	return &s, nil
 }
 
-func UpdateServerLastSeen(serverID string) error {
+func UpdateServerLastSeen(serverID, agentVersion string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	now := time.Now()
+	fields := bson.M{"last_seen": now, "status": "active"}
+	if agentVersion != "" {
+		fields["agent_version"] = strings.TrimPrefix(agentVersion, "v")
+	}
 	_, err := db.Col("servers").UpdateOne(ctx,
 		bson.M{"server_id": serverID},
-		bson.M{"$set": bson.M{"last_seen": now, "status": "active"}},
+		bson.M{"$set": fields},
 	)
 	return err
 }
@@ -177,12 +214,64 @@ func DeleteServer(serverID string) error {
 	return err
 }
 
-func MarkOfflineServers(threshold time.Duration) error {
+func StoreAvailableUpdates(serverID string, pkgs []models.PackageUpdate) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
+	now := time.Now()
+	_, err := db.Col("servers").UpdateOne(ctx,
+		bson.M{"server_id": serverID},
+		bson.M{"$set": bson.M{
+			"available_updates":  pkgs,
+			"updates_checked_at": now,
+		}},
+	)
+	return err
+}
+
+func MarkOfflineServers() error {
+	settings, _ := GetSettings()
+	thresholdMinutes := 5
+	if settings != nil && settings.Alerts.OfflineThresholdMinutes > 0 {
+		thresholdMinutes = settings.Alerts.OfflineThresholdMinutes
+	}
+	threshold := time.Duration(thresholdMinutes) * time.Minute
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
 	cutoff := time.Now().Add(-threshold)
-	_, err := db.Col("servers").UpdateMany(ctx,
+
+	// Find servers about to transition to offline so we can alert on them.
+	cursor, err := db.Col("servers").Find(ctx, bson.M{
+		"status":    "active",
+		"last_seen": bson.M{"$lt": cutoff},
+	})
+	if err != nil {
+		return err
+	}
+	defer cursor.Close(ctx)
+
+	var goingOffline []models.Server
+	if err := cursor.All(ctx, &goingOffline); err != nil {
+		return err
+	}
+
+	if len(goingOffline) == 0 {
+		return nil
+	}
+
+	for _, s := range goingOffline {
+		LogEvent("server.offline", "system", s.ServerID, "", fmt.Sprintf("%s (%s) went offline", s.Hostname, s.IPAddress))
+		if settings != nil && settings.Alerts.Enabled && settings.Alerts.WebhookURL != "" {
+			go SendOfflineWebhook(settings.Alerts.WebhookURL, s.Hostname, s.ServerID, s.IPAddress)
+		}
+		if settings != nil && settings.Email.Enabled {
+			go SendOfflineEmail(settings.Email, s.Hostname, s.ServerID, s.IPAddress)
+		}
+	}
+
+	_, err = db.Col("servers").UpdateMany(ctx,
 		bson.M{
 			"status":    "active",
 			"last_seen": bson.M{"$lt": cutoff},

server/internal/services/servers_console_test.go

@@ -0,0 +1,18 @@
+package services
+
+import "testing"
+
+func TestOSTypeFromInfo(t *testing.T) {
+	cases := map[string]string{
+		"windows amd64": "windows",
+		"linux amd64":   "linux",
+		"linux arm64":   "linux",
+		"":              "linux",
+		"darwin arm64":  "linux",
+	}
+	for in, want := range cases {
+		if got := OSTypeFromInfo(in); got != want {
+			t.Errorf("OSTypeFromInfo(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

server/internal/services/settings.go

@@ -0,0 +1,220 @@
+package services
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"crypto/tls"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"net/smtp"
+	"strings"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+var defaultSettings = models.Settings{
+	Alerts: models.AlertSettings{
+		Enabled:                 false,
+		WebhookURL:              "",
+		OfflineThresholdMinutes: 5,
+	},
+	Email: models.EmailSettings{
+		SMTPPort: 587,
+	},
+}
+
+func GetSettings() (*models.Settings, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Settings
+	err := db.Col("settings").FindOne(ctx, bson.M{}).Decode(&s)
+	if err == mongo.ErrNoDocuments {
+		cp := defaultSettings
+		return &cp, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	s.Secrets.ReadTokenSet = s.Secrets.ReadTokenHash != ""
+	return &s, nil
+}
+
+func hashToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
+}
+
+// RotateSecretsReadToken generates a new ESO read token, stores its SHA-256
+// hash, and returns the plaintext token exactly once.
+func RotateSecretsReadToken() (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	raw := make([]byte, 32)
+	if _, err := rand.Read(raw); err != nil {
+		return "", err
+	}
+	token := hex.EncodeToString(raw)
+
+	_, err := db.Col("settings").UpdateOne(ctx,
+		bson.M{},
+		bson.M{"$set": bson.M{
+			"secrets.read_token_hash": hashToken(token),
+			"secrets.rotated_at":      time.Now(),
+		}},
+		options.UpdateOne().SetUpsert(true),
+	)
+	if err != nil {
+		return "", err
+	}
+	return token, nil
+}
+
+// VerifySecretsReadToken reports whether the supplied token matches the stored
+// hash, using a constant-time comparison.
+func VerifySecretsReadToken(token string) bool {
+	if token == "" {
+		return false
+	}
+	s, err := GetSettings()
+	if err != nil || s.Secrets.ReadTokenHash == "" {
+		return false
+	}
+	expected, err := hex.DecodeString(s.Secrets.ReadTokenHash)
+	if err != nil {
+		return false
+	}
+	got := sha256.Sum256([]byte(token))
+	return subtle.ConstantTimeCompare(expected, got[:]) == 1
+}
+
+func SaveSettings(alerts models.AlertSettings, email models.EmailSettings) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	if alerts.OfflineThresholdMinutes <= 0 {
+		alerts.OfflineThresholdMinutes = 5
+	}
+	if email.SMTPPort <= 0 {
+		email.SMTPPort = 587
+	}
+
+	_, err := db.Col("settings").UpdateOne(ctx,
+		bson.M{},
+		bson.M{"$set": bson.M{"alerts": alerts, "email": email}},
+		options.UpdateOne().SetUpsert(true),
+	)
+	return err
+}
+
+func SendOfflineWebhook(webhookURL, hostname, serverID, ipAddress string) {
+	payload := map[string]any{
+		"event":      "server.offline",
+		"hostname":   hostname,
+		"server_id":  serverID,
+		"ip_address": ipAddress,
+		"timestamp":  time.Now().UTC().Format(time.RFC3339),
+		"message":    fmt.Sprintf("Server %s (%s) has gone offline", hostname, ipAddress),
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		log.Printf("webhook marshal error: %v", err)
+		return
+	}
+	resp, err := http.Post(webhookURL, "application/json", bytes.NewReader(body))
+	if err != nil {
+		log.Printf("webhook delivery error for %s: %v", hostname, err)
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		log.Printf("webhook returned %d for %s", resp.StatusCode, hostname)
+	}
+}
+
+func SendOfflineEmail(cfg models.EmailSettings, hostname, serverID, ipAddress string) {
+	if !cfg.Enabled || cfg.SMTPHost == "" || len(cfg.ToAddrs) == 0 {
+		return
+	}
+
+	subject := fmt.Sprintf("Vantage Alert: %s is offline", hostname)
+	bodyText := fmt.Sprintf(
+		"Server %s (%s) has gone offline.\r\n\r\nServer ID: %s\r\nTimestamp: %s\r\n",
+		hostname, ipAddress, serverID, time.Now().UTC().Format(time.RFC3339),
+	)
+
+	msg := []byte(fmt.Sprintf(
+		"From: %s\r\nTo: %s\r\nSubject: %s\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n%s",
+		cfg.FromAddr,
+		strings.Join(cfg.ToAddrs, ", "),
+		subject,
+		bodyText,
+	))
+
+	addr := fmt.Sprintf("%s:%d", cfg.SMTPHost, cfg.SMTPPort)
+	var auth smtp.Auth
+	if cfg.Username != "" {
+		auth = smtp.PlainAuth("", cfg.Username, cfg.Password, cfg.SMTPHost)
+	}
+
+	var sendErr error
+	if cfg.UseTLS {
+		sendErr = sendMailTLS(addr, cfg.SMTPHost, auth, cfg.FromAddr, cfg.ToAddrs, msg)
+	} else {
+		sendErr = smtp.SendMail(addr, auth, cfg.FromAddr, cfg.ToAddrs, msg)
+	}
+	if sendErr != nil {
+		log.Printf("email alert error for %s: %v", hostname, sendErr)
+	}
+}
+
+// sendMailTLS dials with implicit TLS (port 465) instead of STARTTLS.
+func sendMailTLS(addr, host string, auth smtp.Auth, from string, to []string, msg []byte) error {
+	conn, err := tls.Dial("tcp", addr, &tls.Config{ServerName: host})
+	if err != nil {
+		return fmt.Errorf("tls dial: %w", err)
+	}
+	c, err := smtp.NewClient(conn, host)
+	if err != nil {
+		return fmt.Errorf("smtp client: %w", err)
+	}
+	defer c.Close()
+
+	if auth != nil {
+		if err := c.Auth(auth); err != nil {
+			return fmt.Errorf("smtp auth: %w", err)
+		}
+	}
+	if err := c.Mail(from); err != nil {
+		return err
+	}
+	for _, rcpt := range to {
+		if err := c.Rcpt(strings.TrimSpace(rcpt)); err != nil {
+			return err
+		}
+	}
+	w, err := c.Data()
+	if err != nil {
+		return err
+	}
+	if _, err := w.Write(msg); err != nil {
+		return err
+	}
+	if err := w.Close(); err != nil {
+		return err
+	}
+	return c.Quit()
+}
+

server/internal/services/sync.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"time"
 
-	"github.com/mrhid6/keymanager/server/internal/db"
-	"github.com/mrhid6/keymanager/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 

web/app/audit/page.tsx

@@ -0,0 +1,106 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { api, AuditEvent } from "@/lib/api";
+import { Card } from "@/components/ui";
+import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+const EVENT_LABELS: Record<string, string> = {
+  "server.created":             "Server Created",
+  "server.deleted":             "Server Deleted",
+  "server.offline":             "Server Offline",
+  "key.uploaded":               "Key Uploaded",
+  "key.deleted":                "Key Deleted",
+  "key.assigned":               "Key Assigned",
+  "key.revoked":                "Key Revoked",
+  "key.generation_dispatched":  "Key Generation",
+  "agent.update_dispatched":    "Agent Updated",
+  "updates.applied":            "Updates Applied",
+  "settings.updated":           "Settings Updated",
+};
+
+const EVENT_COLOURS: Record<string, string> = {
+  "server.offline":  "text-danger",
+  "server.deleted":  "text-danger",
+  "key.deleted":     "text-danger",
+  "key.revoked":     "text-warning",
+  "server.created":  "text-success",
+  "key.uploaded":    "text-success",
+  "key.assigned":    "text-success",
+};
+
+function formatDate(dateStr: string) {
+  return new Date(dateStr).toLocaleString();
+}
+
+function EventTypeBadge({ type }: { type: string }) {
+  const label = EVENT_LABELS[type] ?? type;
+  const colour = EVENT_COLOURS[type] ?? "text-text-secondary";
+  return (
+    <span className={`font-mono text-xs font-medium ${colour}`}>{label}</span>
+  );
+}
+
+export default function AuditPage() {
+  const { data: events, isLoading, error } = useQuery({
+    queryKey: ["audit"],
+    queryFn: () => api.listAuditEvents(200),
+    refetchInterval: 30_000,
+  });
+
+  return (
+    <div className="p-8">
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold text-text-primary">Audit Log</h1>
+        <p className="mt-1 text-sm text-text-secondary">
+          All administrative actions and server status changes
+        </p>
+      </div>
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex items-center justify-center py-20">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : error ? (
+          <div className="py-20 text-center text-danger">Failed to load audit log.</div>
+        ) : events && events.length > 0 ? (
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Time</Th>
+                <Th>Event</Th>
+                <Th>Actor</Th>
+                <Th>Details</Th>
+              </Tr>
+            </Thead>
+            <Tbody>
+              {events.map((e: AuditEvent) => (
+                <Tr key={e.id}>
+                  <Td>
+                    <span className="whitespace-nowrap font-mono text-xs text-text-secondary">
+                      {formatDate(e.created_at)}
+                    </span>
+                  </Td>
+                  <Td>
+                    <EventTypeBadge type={e.event_type} />
+                  </Td>
+                  <Td>
+                    <span className="text-sm text-text-primary">{e.actor}</span>
+                  </Td>
+                  <Td>
+                    <span className="text-sm text-text-secondary">{e.details}</span>
+                  </Td>
+                </Tr>
+              ))}
+            </Tbody>
+          </Table>
+        ) : (
+          <div className="py-20 text-center">
+            <p className="text-text-secondary text-sm">No audit events recorded yet.</p>
+          </div>
+        )}
+      </Card>
+    </div>
+  );
+}

web/app/keys/[id]/page.tsx

@@ -89,6 +89,97 @@ function AssignModal({
   );
 }
 
+function PrivateKeyCard({ keyId }: { keyId: string }) {
+  const [revealed, setRevealed] = useState(false);
+  const [privateKey, setPrivateKey] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [copied, setCopied] = useState(false);
+
+  async function reveal() {
+    setLoading(true);
+    setError(null);
+    try {
+      const res = await api.getPrivateKey(keyId);
+      setPrivateKey(res.private_key);
+      setRevealed(true);
+    } catch (e) {
+      setError((e as Error).message);
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  function download() {
+    if (!privateKey) return;
+    const blob = new Blob([privateKey], { type: "text/plain" });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = `${keyId}.pem`;
+    a.click();
+    URL.revokeObjectURL(url);
+  }
+
+  async function copy() {
+    if (!privateKey) return;
+    await navigator.clipboard.writeText(privateKey);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 2000);
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Private Key</CardTitle>
+        {revealed && (
+          <div className="flex gap-2">
+            <button
+              onClick={copy}
+              className="rounded-md border border-border bg-surface-2 px-2.5 py-1 text-xs font-medium text-text-secondary transition-colors hover:border-accent/50 hover:text-text-primary"
+            >
+              {copied ? <span className="text-success">Copied!</span> : "Copy"}
+            </button>
+            <button
+              onClick={download}
+              className="rounded-md border border-border bg-surface-2 px-2.5 py-1 text-xs font-medium text-text-secondary transition-colors hover:border-accent/50 hover:text-text-primary"
+            >
+              Download .pem
+            </button>
+          </div>
+        )}
+      </CardHeader>
+
+      {error && (
+        <div className="mb-3 rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-xs text-danger">
+          {error}
+        </div>
+      )}
+
+      {!revealed ? (
+        <div className="flex flex-col items-center gap-3 py-4">
+          <p className="text-center text-xs text-text-tertiary">
+            Stored encrypted (AES-256-GCM). Click to decrypt and display.
+          </p>
+          <Button variant="secondary" size="sm" loading={loading} onClick={reveal}>
+            <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+              <path strokeLinecap="round" strokeLinejoin="round" d="M2.036 12.322a1.012 1.012 0 010-.639C3.423 7.51 7.36 4.5 12 4.5c4.638 0 8.573 3.007 9.963 7.178.07.207.07.431 0 .639C20.577 16.49 16.64 19.5 12 19.5c-4.638 0-8.573-3.007-9.964-7.178z" />
+              <path strokeLinecap="round" strokeLinejoin="round" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+            </svg>
+            Reveal Private Key
+          </Button>
+        </div>
+      ) : (
+        <div className="rounded-lg border border-border bg-[#0a0c14] p-3">
+          <pre className="overflow-x-auto whitespace-pre-wrap break-all font-mono text-xs text-text-secondary leading-relaxed">
+            {privateKey}
+          </pre>
+        </div>
+      )}
+    </Card>
+  );
+}
+
 export default function KeyDetailPage() {
   const params = useParams();
   const router = useRouter();
@@ -252,6 +343,8 @@ export default function KeyDetailPage() {
               </pre>
             </div>
           </Card>
+
+          {key.has_private_key && <PrivateKeyCard keyId={keyId} />}
         </div>
 
         <div className="lg:col-span-2">

web/app/keys/page.tsx

@@ -11,9 +11,11 @@ function UploadKeyModal({ onClose }: { onClose: () => void }) {
   const queryClient = useQueryClient();
   const [label, setLabel] = useState("");
   const [publicKey, setPublicKey] = useState("");
+  const [privateKey, setPrivateKey] = useState("");
+  const [passphrase, setPassphrase] = useState("");
 
   const { mutate: upload, isPending, error } = useMutation({
-    mutationFn: () => api.uploadKey(label.trim(), publicKey.trim()),
+    mutationFn: () => api.uploadKey(label.trim(), publicKey.trim(), privateKey.trim() || undefined, passphrase || undefined),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["keys"] });
       onClose();
@@ -52,10 +54,36 @@ function UploadKeyModal({ onClose }: { onClose: () => void }) {
               value={publicKey}
               onChange={(e) => setPublicKey(e.target.value)}
               placeholder="ssh-ed25519 AAAA..."
-              rows={4}
+              rows={3}
               className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 font-mono text-xs text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent resize-none"
             />
           </div>
+          <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+              Private Key{" "}
+              <span className="text-text-tertiary font-normal">(optional — stored AES-256-GCM encrypted)</span>
+            </label>
+            <textarea
+              value={privateKey}
+              onChange={(e) => setPrivateKey(e.target.value)}
+              placeholder="-----BEGIN OPENSSH PRIVATE KEY-----"
+              rows={3}
+              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 font-mono text-xs text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent resize-none"
+            />
+          </div>
+          <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+              Passphrase{" "}
+              <span className="text-text-tertiary font-normal">(optional — for an encrypted private key)</span>
+            </label>
+            <input
+              type="password"
+              value={passphrase}
+              onChange={(e) => setPassphrase(e.target.value)}
+              autoComplete="new-password"
+              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent"
+            />
+          </div>
         </div>
 
         <div className="mt-6 flex justify-end gap-3">

web/app/layout.tsx

@@ -1,10 +1,11 @@
 import type { Metadata } from "next";
 import "./globals.css";
 import { Providers } from "@/components/Providers";
+import { AuthProvider } from "@/components/AuthProvider";
 import { Sidebar } from "@/components/Sidebar";
 
 export const metadata: Metadata = {
-  title: "KeyManager",
+  title: "Vantage",
   description: "Self-hosted SSH key management",
 };
 
@@ -17,12 +18,14 @@ export default function RootLayout({
     <html lang="en" className="dark">
       <body className="bg-background text-text-primary">
         <Providers>
-          <div className="flex h-screen overflow-hidden">
-            <Sidebar />
-            <main className="flex-1 overflow-y-auto">
-              {children}
-            </main>
-          </div>
+          <AuthProvider>
+            <div className="flex h-screen overflow-hidden">
+              <Sidebar />
+              <main className="flex-1 overflow-y-auto">
+                {children}
+              </main>
+            </div>
+          </AuthProvider>
         </Providers>
       </body>
     </html>

web/app/secrets/[group]/page.tsx

@@ -0,0 +1,311 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, Secret } from "@/lib/api";
+import { Button, Card, CardHeader, CardTitle } from "@/components/ui";
+import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+const inputClass =
+    "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent";
+
+// Name of the ClusterSecretStore the generated manifests reference.
+const STORE_NAME = "vantage-store";
+
+function CopyBlock({ label, yaml }: { label: string; yaml: string }) {
+    const [copied, setCopied] = useState(false);
+
+    async function copy() {
+        await navigator.clipboard.writeText(yaml);
+        setCopied(true);
+        setTimeout(() => setCopied(false), 2000);
+    }
+
+    return (
+        <div>
+            <div className="mb-1.5 flex items-center justify-between">
+                <span className="text-sm font-medium text-text-secondary">{label}</span>
+                <Button type="button" variant="ghost" size="sm" onClick={copy}>
+                    {copied ? "Copied!" : "Copy"}
+                </Button>
+            </div>
+            <pre className="overflow-x-auto rounded-lg border border-border bg-surface-2 p-3 font-mono text-xs leading-relaxed text-text-primary">{yaml}</pre>
+        </div>
+    );
+}
+
+function YamlModal({ group, onClose }: { group: string; onClose: () => void }) {
+    const [namespace, setNamespace] = useState(group);
+    const readUrl = typeof window !== "undefined" ? window.location.origin : "https://vantage.example.com";
+    const ns = namespace.trim() || group;
+
+    const externalSecret = `apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ${group}
+  namespace: ${ns}
+spec:
+  refreshInterval: 15m
+  secretStoreRef:
+    name: ${STORE_NAME}
+    kind: ClusterSecretStore
+  target:
+    name: ${group}
+    creationPolicy: Owner
+  dataFrom:
+    - extract:
+        key: ${group}`;
+
+    const clusterStore = `apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: ${STORE_NAME}
+spec:
+  provider:
+    webhook:
+      url: "${readUrl}/api/secrets/{{ .remoteRef.key }}/values"
+      method: GET
+      result:
+        jsonPath: "$"
+      headers:
+        Content-Type: "application/json"
+        Authorization: "Bearer {{ .auth.token }}"
+      secrets:
+        - name: auth
+          secretRef:
+            name: vantage-eso-token
+            namespace: external-secrets`;
+
+    return (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+            <div className="max-h-[90vh] w-full max-w-2xl overflow-y-auto rounded-xl border border-border bg-surface p-6">
+                <h2 className="mb-1 text-lg font-semibold text-text-primary">
+                    Kubernetes manifests for <span className="font-mono">{group}</span>
+                </h2>
+                <p className="mb-5 text-sm text-text-secondary">Apply the ExternalSecret in your app&apos;s namespace to sync this group into a Kubernetes Secret via ESO.</p>
+
+                <div className="mb-5">
+                    <label className="mb-1.5 block text-sm font-medium text-text-secondary">Namespace</label>
+                    <input type="text" value={namespace} onChange={(e) => setNamespace(e.target.value)} placeholder={group} className={`${inputClass} font-mono`} />
+                </div>
+
+                <div className="space-y-5">
+                    <CopyBlock label="ExternalSecret (apply per namespace)" yaml={externalSecret} />
+
+                    <details className="group">
+                        <summary className="cursor-pointer text-sm font-medium text-text-secondary hover:text-text-primary">One-time cluster setup: ClusterSecretStore</summary>
+                        <p className="mb-3 mt-2 text-xs text-text-tertiary">
+                            Apply this once per cluster. It requires a Secret named <span className="font-mono">vantage-eso-token</span> in the <span className="font-mono">external-secrets</span>{" "}
+                            namespace holding the read token from Settings, labelled <span className="font-mono">external-secrets.io/type=webhook</span>.
+                        </p>
+                        <CopyBlock label="ClusterSecretStore" yaml={clusterStore} />
+                    </details>
+                </div>
+
+                <div className="mt-6 flex justify-end">
+                    <Button variant="ghost" onClick={onClose}>
+                        Close
+                    </Button>
+                </div>
+            </div>
+        </div>
+    );
+}
+
+function SecretRow({ group, secret }: { group: string; secret: Secret }) {
+    const queryClient = useQueryClient();
+    const [revealed, setRevealed] = useState<string | null>(null);
+    const [copied, setCopied] = useState(false);
+
+    const { mutate: reveal, isPending: revealing } = useMutation({
+        mutationFn: () => api.revealSecret(group, secret.key),
+        onSuccess: (res) => setRevealed(res.value),
+    });
+
+    const { mutate: remove, isPending: removing } = useMutation({
+        mutationFn: () => api.deleteSecret(group, secret.key),
+        onSuccess: () => queryClient.invalidateQueries({ queryKey: ["secret-group", group] }),
+    });
+
+    async function copy() {
+        if (revealed == null) return;
+        await navigator.clipboard.writeText(revealed);
+        setCopied(true);
+        setTimeout(() => setCopied(false), 2000);
+    }
+
+    return (
+        <Tr>
+            <Td>
+                <span className="font-mono font-medium text-text-primary">{secret.key}</span>
+            </Td>
+            <Td>{revealed == null ? <span className="font-mono text-text-tertiary">••••••••••••</span> : <span className="font-mono text-xs break-all text-text-primary">{revealed}</span>}</Td>
+            <Td>
+                <span className="text-text-secondary text-xs">{new Date(secret.updated_at).toLocaleString()}</span>
+            </Td>
+            <Td>
+                <div className="flex justify-end gap-2">
+                    {revealed == null ? (
+                        <Button variant="ghost" size="sm" loading={revealing} onClick={() => reveal()}>
+                            Reveal
+                        </Button>
+                    ) : (
+                        <>
+                            <Button variant="ghost" size="sm" onClick={copy}>
+                                {copied ? "Copied!" : "Copy"}
+                            </Button>
+                            <Button variant="ghost" size="sm" onClick={() => setRevealed(null)}>
+                                Hide
+                            </Button>
+                        </>
+                    )}
+                    <Button
+                        variant="ghost"
+                        size="sm"
+                        loading={removing}
+                        className="text-danger hover:text-danger"
+                        onClick={() => {
+                            if (confirm(`Delete key "${secret.key}"?`)) remove();
+                        }}
+                    >
+                        Delete
+                    </Button>
+                </div>
+            </Td>
+        </Tr>
+    );
+}
+
+function AddKeyCard({ group }: { group: string }) {
+    const queryClient = useQueryClient();
+    const [key, setKey] = useState("");
+    const [value, setValue] = useState("");
+
+    const {
+        mutate: add,
+        isPending,
+        error,
+    } = useMutation({
+        mutationFn: () => api.putSecrets(group, { [key.trim()]: value }),
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ["secret-group", group] });
+            setKey("");
+            setValue("");
+        },
+    });
+
+    return (
+        <Card>
+            <CardHeader>
+                <CardTitle>Add / Update Key</CardTitle>
+            </CardHeader>
+            <p className="mb-4 text-sm text-text-secondary">Adding a key that already exists overwrites its value. Others are left untouched.</p>
+            {error && <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">{(error as Error).message}</div>}
+            <div className="flex items-end gap-3">
+                <div className="flex-1">
+                    <label className="mb-1.5 block text-sm font-medium text-text-secondary">Key</label>
+                    <input type="text" value={key} onChange={(e) => setKey(e.target.value)} placeholder="API_KEY" className={`${inputClass} font-mono`} />
+                </div>
+                <div className="flex-1">
+                    <label className="mb-1.5 block text-sm font-medium text-text-secondary">Value</label>
+                    <input type="text" value={value} onChange={(e) => setValue(e.target.value)} placeholder="myapikey456" className={`${inputClass} font-mono`} />
+                </div>
+                <Button variant="primary" loading={isPending} disabled={!key.trim() || !value} onClick={() => add()}>
+                    Save
+                </Button>
+            </div>
+        </Card>
+    );
+}
+
+export default function SecretGroupPage() {
+    const params = useParams();
+    const router = useRouter();
+    const queryClient = useQueryClient();
+    const group = decodeURIComponent(String(params.group));
+    const [showYaml, setShowYaml] = useState(false);
+
+    const { data, isLoading, error } = useQuery({
+        queryKey: ["secret-group", group],
+        queryFn: () => api.getSecretGroup(group),
+    });
+
+    const { mutate: deleteGroup, isPending: deleting } = useMutation({
+        mutationFn: () => api.deleteSecretGroup(group),
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ["secret-groups"] });
+            router.push("/secrets");
+        },
+    });
+
+    return (
+        <div className="p-8">
+            {showYaml && <YamlModal group={group} onClose={() => setShowYaml(false)} />}
+
+            <Link href="/secrets" className="mb-4 inline-flex items-center gap-1 text-sm text-text-secondary hover:text-text-primary">
+                ← Back to secrets
+            </Link>
+
+            <div className="mb-6 flex items-center justify-between">
+                <div>
+                    <h1 className="font-mono text-2xl font-bold text-text-primary">{group}</h1>
+                    <p className="mt-1 text-sm text-text-secondary">
+                        ESO reads this group at <span className="font-mono">GET /api/secrets/{group}/values</span>
+                    </p>
+                </div>
+                <div className="flex items-center gap-3">
+                    <Button variant="ghost" onClick={() => setShowYaml(true)}>
+                        <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                            <path strokeLinecap="round" strokeLinejoin="round" d="M17.25 6.75L22.5 12l-5.25 5.25m-10.5 0L1.5 12l5.25-5.25m7.5-3l-4.5 16.5" />
+                        </svg>
+                        ExternalSecret YAML
+                    </Button>
+                    <Button
+                        variant="ghost"
+                        className="text-danger hover:text-danger"
+                        loading={deleting}
+                        onClick={() => {
+                            if (confirm(`Delete the entire "${group}" group and all its keys?`)) deleteGroup();
+                        }}
+                    >
+                        Delete Group
+                    </Button>
+                </div>
+            </div>
+
+            <div className="space-y-6">
+                <AddKeyCard group={group} />
+
+                <Card padding={false}>
+                    {isLoading ? (
+                        <div className="flex items-center justify-center py-20">
+                            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+                        </div>
+                    ) : error ? (
+                        <div className="py-20 text-center text-danger">Failed to load group. It may have been deleted.</div>
+                    ) : data && data.secrets.length > 0 ? (
+                        <Table>
+                            <Thead>
+                                <Tr>
+                                    <Th>Key</Th>
+                                    <Th>Value</Th>
+                                    <Th>Updated</Th>
+                                    <Th />
+                                </Tr>
+                            </Thead>
+                            <Tbody>
+                                {data.secrets.map((s: Secret) => (
+                                    <SecretRow key={s.key} group={group} secret={s} />
+                                ))}
+                            </Tbody>
+                        </Table>
+                    ) : (
+                        <div className="py-16 text-center text-text-secondary">This group has no keys. Add one above.</div>
+                    )}
+                </Card>
+            </div>
+        </div>
+    );
+}

web/app/secrets/page.tsx

@@ -0,0 +1,180 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, SecretGroupSummary } from "@/lib/api";
+import { Button, Card } from "@/components/ui";
+import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent";
+
+function NewGroupModal({ onClose }: { onClose: () => void }) {
+  const queryClient = useQueryClient();
+  const [group, setGroup] = useState("");
+  const [key, setKey] = useState("");
+  const [value, setValue] = useState("");
+
+  const { mutate: create, isPending, error } = useMutation({
+    mutationFn: () =>
+      api.createSecretGroup(group.trim(), { [key.trim()]: value }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["secret-groups"] });
+      onClose();
+    },
+  });
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
+      <div className="w-full max-w-lg rounded-xl border border-border bg-surface p-6">
+        <h2 className="mb-1 text-lg font-semibold text-text-primary">New Secret Group</h2>
+        <p className="mb-4 text-sm text-text-secondary">
+          A group must be created with at least one key. You can add more keys afterwards.
+        </p>
+
+        {error && (
+          <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">
+            {(error as Error).message}
+          </div>
+        )}
+
+        <div className="space-y-4">
+          <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">Group name</label>
+            <input
+              type="text"
+              value={group}
+              onChange={(e) => setGroup(e.target.value)}
+              placeholder="e.g. myapp-prod"
+              className={`${inputClass} font-mono`}
+            />
+          </div>
+          <div className="grid grid-cols-2 gap-3">
+            <div>
+              <label className="mb-1.5 block text-sm font-medium text-text-secondary">First key</label>
+              <input
+                type="text"
+                value={key}
+                onChange={(e) => setKey(e.target.value)}
+                placeholder="DB_PASSWORD"
+                className={`${inputClass} font-mono`}
+              />
+            </div>
+            <div>
+              <label className="mb-1.5 block text-sm font-medium text-text-secondary">Value</label>
+              <input
+                type="text"
+                value={value}
+                onChange={(e) => setValue(e.target.value)}
+                placeholder="supersecret123"
+                className={`${inputClass} font-mono`}
+              />
+            </div>
+          </div>
+        </div>
+
+        <div className="mt-6 flex justify-end gap-3">
+          <Button variant="ghost" onClick={onClose}>Cancel</Button>
+          <Button
+            variant="primary"
+            loading={isPending}
+            disabled={!group.trim() || !key.trim() || !value}
+            onClick={() => create()}
+          >
+            Create Group
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default function SecretsPage() {
+  const [showNew, setShowNew] = useState(false);
+
+  const { data: groups, isLoading, error } = useQuery({
+    queryKey: ["secret-groups"],
+    queryFn: api.listSecretGroups,
+  });
+
+  return (
+    <div className="p-8">
+      {showNew && <NewGroupModal onClose={() => setShowNew(false)} />}
+
+      <div className="mb-6 flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold text-text-primary">Secrets</h1>
+          <p className="mt-1 text-sm text-text-secondary">
+            {groups?.length ?? 0} group{groups?.length !== 1 ? "s" : ""} · encrypted at rest, exposed to Kubernetes via ESO
+          </p>
+        </div>
+        <Button variant="primary" onClick={() => setShowNew(true)}>
+          <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+            <path strokeLinecap="round" strokeLinejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
+          </svg>
+          New Group
+        </Button>
+      </div>
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex items-center justify-center py-20">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : error ? (
+          <div className="py-20 text-center text-danger">
+            Failed to load secrets. Is the backend running?
+          </div>
+        ) : groups && groups.length > 0 ? (
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Group</Th>
+                <Th>Keys</Th>
+                <Th>Last Updated</Th>
+                <Th />
+              </Tr>
+            </Thead>
+            <Tbody>
+              {groups.map((g: SecretGroupSummary) => (
+                <Tr key={g.group}>
+                  <Td>
+                    <span className="font-mono font-medium text-text-primary">{g.group}</span>
+                  </Td>
+                  <Td>
+                    <span className="text-text-secondary">
+                      {g.key_count} key{g.key_count !== 1 ? "s" : ""}
+                    </span>
+                  </Td>
+                  <Td>
+                    <span className="text-text-secondary text-xs">
+                      {new Date(g.updated_at).toLocaleString()}
+                    </span>
+                  </Td>
+                  <Td>
+                    <Link href={`/secrets/${encodeURIComponent(g.group)}`}>
+                      <Button variant="ghost" size="sm">View →</Button>
+                    </Link>
+                  </Td>
+                </Tr>
+              ))}
+            </Tbody>
+          </Table>
+        ) : (
+          <div className="py-20 text-center">
+            <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-surface-2">
+              <svg className="h-6 w-6 text-text-secondary" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                <path strokeLinecap="round" strokeLinejoin="round" d="M16.5 10.5V6.75a4.5 4.5 0 10-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 002.25-2.25v-6.75a2.25 2.25 0 00-2.25-2.25H6.75a2.25 2.25 0 00-2.25 2.25v6.75a2.25 2.25 0 002.25 2.25z" />
+              </svg>
+            </div>
+            <p className="text-text-secondary">No secret groups yet.</p>
+            <Button variant="primary" size="sm" className="mt-4" onClick={() => setShowNew(true)}>
+              Create your first group
+            </Button>
+          </div>
+        )}
+      </Card>
+    </div>
+  );
+}

web/app/servers/[id]/console/page.tsx

@@ -0,0 +1,243 @@
+"use client";
+
+import { useEffect, useMemo, useRef, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { useParams, useRouter, useSearchParams } from "next/navigation";
+import Link from "next/link";
+import { api } from "@/lib/api";
+import { Button, Card } from "@/components/ui";
+import { openConsole } from "@/lib/guacConsole";
+
+export default function ServerConsolePage() {
+    const params = useParams();
+    const router = useRouter();
+    const searchParams = useSearchParams();
+    const serverId = params.id as string;
+
+    const containerRef = useRef<HTMLDivElement>(null);
+    const connectionRef = useRef<{ disconnect: () => void } | null>(null);
+
+    const [protocol, setProtocol] = useState<string>(searchParams.get("protocol") || "");
+    const [keyId, setKeyId] = useState<string>("");
+    const [sshUsername, setSshUsername] = useState<string>("root");
+    const [rdpUsername, setRdpUsername] = useState("");
+    const [rdpPassword, setRdpPassword] = useState("");
+    const [vncPassword, setVncPassword] = useState("");
+    const [connecting, setConnecting] = useState(false);
+    const [connected, setConnected] = useState(false);
+    const [error, setError] = useState<string | null>(null);
+
+    // Inject the vendored Guacamole client script once.
+    useEffect(() => {
+        const s = document.createElement("script");
+        s.src = "/lib/guacamole-common.js";
+        s.async = true;
+        document.body.appendChild(s);
+        return () => {
+            document.body.removeChild(s);
+        };
+    }, []);
+
+    // Disconnect on unmount.
+    useEffect(() => {
+        return () => {
+            connectionRef.current?.disconnect();
+        };
+    }, []);
+
+    const { data: server, isLoading: serverLoading } = useQuery({
+        queryKey: ["servers", serverId],
+        queryFn: () => api.getServer(serverId),
+    });
+
+    const { data: keys, isLoading: keysLoading } = useQuery({
+        queryKey: ["keys"],
+        queryFn: () => api.listKeys(),
+    });
+
+    const usableKeys = useMemo(() => (keys ?? []).filter((k) => k.has_private_key === true), [keys]);
+    const protocols = server?.console_protocols ?? [];
+
+    useEffect(() => {
+        if (!protocol && protocols.length > 0) {
+            setProtocol(protocols[0]);
+        }
+    }, [protocols, protocol]);
+
+    async function handleConnect() {
+        setError(null);
+        setConnecting(true);
+        try {
+            const body: Parameters<typeof api.connectConsole>[0] = {
+                server_id: serverId,
+                protocol,
+            };
+            if (protocol === "ssh") {
+                body.key_id = keyId || undefined;
+                body.ssh_username = sshUsername || undefined;
+            } else if (protocol === "rdp") {
+                body.rdp_username = rdpUsername || undefined;
+                body.rdp_password = rdpPassword || undefined;
+            } else if (protocol === "vnc") {
+                body.rdp_password = vncPassword || undefined;
+            }
+
+            const { token, ws_path } = await api.connectConsole(body);
+
+            const wsProto = location.protocol === "https:" ? "wss" : "ws";
+            const wsUrl = `${wsProto}://${location.host}${ws_path}?token=${encodeURIComponent(token)}`;
+
+            if (containerRef.current) {
+                const conn = openConsole(containerRef.current, wsUrl);
+                connectionRef.current = conn;
+                setConnected(true);
+            }
+        } catch (e) {
+            setError(e instanceof Error ? e.message : "Failed to connect");
+        } finally {
+            setConnecting(false);
+        }
+    }
+
+    function handleDisconnect() {
+        connectionRef.current?.disconnect();
+        connectionRef.current = null;
+        setConnected(false);
+        if (containerRef.current) {
+            containerRef.current.innerHTML = "";
+        }
+    }
+
+    if (serverLoading || keysLoading) {
+        return (
+            <div className="flex h-full items-center justify-center">
+                <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+            </div>
+        );
+    }
+
+    if (!server) {
+        return (
+            <div className="p-8">
+                <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Server not found or failed to load.</div>
+            </div>
+        );
+    }
+
+    return (
+        <div className="flex h-full flex-col p-8">
+            <div className="mb-4 flex items-center gap-3">
+                <Link href={`/servers/${serverId}`} className="text-text-secondary hover:text-text-primary text-sm">
+                    ← {server.hostname}
+                </Link>
+            </div>
+
+            <h1 className="mb-4 text-2xl font-bold text-text-primary">Console</h1>
+
+            {error && <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">{error}</div>}
+
+            {!connected ? (
+                <Card className="mb-4 max-w-xl">
+                    <div className="space-y-4">
+                        <div>
+                            <label className="mb-1.5 block text-sm font-medium text-text-secondary">Protocol</label>
+                            <select
+                                value={protocol}
+                                onChange={(e) => setProtocol(e.target.value)}
+                                className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                            >
+                                {protocols.length === 0 && <option value="">No protocols available</option>}
+                                {protocols.map((p) => (
+                                    <option key={p} value={p}>
+                                        {p.toUpperCase()}
+                                    </option>
+                                ))}
+                            </select>
+                        </div>
+
+                        {protocol === "ssh" && (
+                            <div>
+                                <label className="mb-1.5 block text-sm font-medium text-text-secondary">SSH Username</label>
+                                <input
+                                    type="text"
+                                    value={sshUsername}
+                                    onChange={(e) => setSshUsername(e.target.value)}
+                                    placeholder="root"
+                                    className="mb-3 w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                                <label className="mb-1.5 block text-sm font-medium text-text-secondary">SSH Key</label>
+                                <select
+                                    value={keyId}
+                                    onChange={(e) => setKeyId(e.target.value)}
+                                    className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                >
+                                    <option value="">Select a key…</option>
+                                    {usableKeys.map((k) => (
+                                        <option key={k.key_id} value={k.key_id}>
+                                            {k.label}
+                                        </option>
+                                    ))}
+                                </select>
+                                {usableKeys.length === 0 && (
+                                    <p className="mt-1.5 text-xs text-text-tertiary">No keys with stored private material are available.</p>
+                                )}
+                            </div>
+                        )}
+
+                        {protocol === "rdp" && (
+                            <>
+                                <div>
+                                    <label className="mb-1.5 block text-sm font-medium text-text-secondary">Username</label>
+                                    <input
+                                        type="text"
+                                        value={rdpUsername}
+                                        onChange={(e) => setRdpUsername(e.target.value)}
+                                        className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                    />
+                                </div>
+                                <div>
+                                    <label className="mb-1.5 block text-sm font-medium text-text-secondary">Password</label>
+                                    <input
+                                        type="password"
+                                        value={rdpPassword}
+                                        onChange={(e) => setRdpPassword(e.target.value)}
+                                        autoComplete="new-password"
+                                        className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                    />
+                                </div>
+                            </>
+                        )}
+
+                        {protocol === "vnc" && (
+                            <div>
+                                <label className="mb-1.5 block text-sm font-medium text-text-secondary">Password</label>
+                                <input
+                                    type="password"
+                                    value={vncPassword}
+                                    onChange={(e) => setVncPassword(e.target.value)}
+                                    autoComplete="new-password"
+                                    className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                            </div>
+                        )}
+
+                        <Button variant="primary" loading={connecting} disabled={!protocol} onClick={handleConnect}>
+                            Connect
+                        </Button>
+                    </div>
+                </Card>
+            ) : (
+                <div className="mb-4 flex items-center gap-3">
+                    <Button variant="danger" onClick={handleDisconnect}>
+                        Disconnect
+                    </Button>
+                </div>
+            )}
+
+            <div
+                ref={containerRef}
+                className="min-h-[500px] flex-1 rounded-lg border border-border bg-black"
+            />
+        </div>
+    );
+}

web/app/servers/[id]/page.tsx

@@ -4,216 +4,533 @@ import { useState } from "react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { useParams, useRouter } from "next/navigation";
 import Link from "next/link";
-import { api, ServerStatus } from "@/lib/api";
+import { api, ServerStatus, GenerateKeyOptions, PackageUpdate } from "@/lib/api";
 import { Badge, Button, Card, CardHeader, CardTitle } from "@/components/ui";
 import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
 
 function statusVariant(status: ServerStatus) {
-  switch (status) {
-    case "active": return "success";
-    case "pending": return "warning";
-    case "offline": return "danger";
-  }
+    switch (status) {
+        case "active":
+            return "success";
+        case "pending":
+            return "warning";
+        case "offline":
+            return "danger";
+    }
 }
 
 function formatDate(dateStr: string) {
-  return new Date(dateStr).toLocaleString();
+    return new Date(dateStr).toLocaleString();
 }
 
-export default function ServerDetailPage() {
-  const params = useParams();
-  const router = useRouter();
-  const queryClient = useQueryClient();
-  const serverId = params.id as string;
-  const [confirmDelete, setConfirmDelete] = useState(false);
+const KEY_SIZES: Record<string, number[]> = {
+    rsa: [2048, 3072, 4096],
+    ecdsa: [256, 384, 521],
+};
 
-  const { data: server, isLoading, error } = useQuery({
-    queryKey: ["servers", serverId],
-    queryFn: () => api.getServer(serverId),
-    refetchInterval: 30_000,
-  });
+const DEFAULT_SIZE: Record<string, number> = {
+    rsa: 4096,
+    ecdsa: 256,
+};
 
-  const { mutate: generateKey, isPending: isGenerating } = useMutation({
-    mutationFn: () => api.generateKeyForServer(serverId),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["servers", serverId] });
-      queryClient.invalidateQueries({ queryKey: ["keys"] });
-    },
-  });
+function GenerateKeyModal({ onClose, onSubmit, isPending }: { onClose: () => void; onSubmit: (opts: GenerateKeyOptions) => void; isPending: boolean }) {
+    const [label, setLabel] = useState("");
+    const [keyType, setKeyType] = useState<"ed25519" | "rsa" | "ecdsa">("ed25519");
+    const [keySize, setKeySize] = useState<number>(4096);
+    const [passphrase, setPassphrase] = useState("");
+    const [comment, setComment] = useState("");
 
-  const { mutate: deleteServer, isPending: isDeleting } = useMutation({
-    mutationFn: () => api.deleteServer(serverId),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["servers"] });
-      router.push("/servers");
-    },
-  });
+    function handleKeyTypeChange(t: "ed25519" | "rsa" | "ecdsa") {
+        setKeyType(t);
+        if (t !== "ed25519") {
+            setKeySize(DEFAULT_SIZE[t]);
+        }
+    }
+
+    function handleSubmit(e: React.FormEvent) {
+        e.preventDefault();
+        onSubmit({
+            label: label || "generated",
+            key_type: keyType,
+            key_size: keyType !== "ed25519" ? keySize : undefined,
+            passphrase: passphrase || undefined,
+            comment: comment || undefined,
+        });
+    }
+
+    const sizes = KEY_SIZES[keyType];
 
-  if (isLoading) {
     return (
-      <div className="flex h-full items-center justify-center">
-        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
-      </div>
-    );
-  }
+        <div className="fixed inset-0 z-50 flex items-center justify-center">
+            <div className="absolute inset-0 bg-black/60 backdrop-blur-sm" onClick={onClose} />
+            <div className="relative z-10 w-full max-w-md rounded-xl border border-border bg-surface-1 p-6 shadow-2xl">
+                <div className="mb-5 flex items-center justify-between">
+                    <h2 className="text-lg font-semibold text-text-primary">Generate SSH Key</h2>
+                    <button onClick={onClose} className="rounded-md p-1 text-text-secondary hover:text-text-primary transition-colors">
+                        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                            <path strokeLinecap="round" strokeLinejoin="round" d="M6 18L18 6M6 6l12 12" />
+                        </svg>
+                    </button>
+                </div>
 
-  if (error || !server) {
-    return (
-      <div className="p-8">
-        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">
-          Server not found or failed to load.
+                <form onSubmit={handleSubmit} className="space-y-4">
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+                            Label <span className="text-text-tertiary">(used as the key name in Vantage)</span>
+                        </label>
+                        <input
+                            type="text"
+                            value={label}
+                            onChange={(e) => setLabel(e.target.value)}
+                            placeholder="e.g. server-deploy-key"
+                            className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                        />
+                    </div>
+
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">Key Type</label>
+                        <div className="grid grid-cols-3 gap-2">
+                            {(["ed25519", "rsa", "ecdsa"] as const).map((t) => (
+                                <button
+                                    key={t}
+                                    type="button"
+                                    onClick={() => handleKeyTypeChange(t)}
+                                    className={`rounded-lg border px-3 py-2 text-sm font-medium transition-colors ${
+                                        keyType === t ? "border-accent bg-accent/10 text-accent" : "border-border bg-surface-2 text-text-secondary hover:border-accent/40 hover:text-text-primary"
+                                    }`}
+                                >
+                                    {t}
+                                </button>
+                            ))}
+                        </div>
+                        {keyType === "ed25519" && <p className="mt-1.5 text-xs text-text-tertiary">Modern, fast, and secure. Recommended for new keys.</p>}
+                        {keyType === "rsa" && <p className="mt-1.5 text-xs text-text-tertiary">Widely compatible with older systems.</p>}
+                        {keyType === "ecdsa" && <p className="mt-1.5 text-xs text-text-tertiary">Elliptic curve — shorter keys, good compatibility.</p>}
+                    </div>
+
+                    {sizes && (
+                        <div>
+                            <label className="mb-1.5 block text-sm font-medium text-text-secondary">Key Size (bits)</label>
+                            <select
+                                value={keySize}
+                                onChange={(e) => setKeySize(Number(e.target.value))}
+                                className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                            >
+                                {sizes.map((s) => (
+                                    <option key={s} value={s}>
+                                        {s}
+                                    </option>
+                                ))}
+                            </select>
+                        </div>
+                    )}
+
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+                            Comment <span className="text-text-tertiary">(embedded in the public key)</span>
+                        </label>
+                        <input
+                            type="text"
+                            value={comment}
+                            onChange={(e) => setComment(e.target.value)}
+                            placeholder="e.g. user@hostname"
+                            className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                        />
+                    </div>
+
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+                            Passphrase <span className="text-text-tertiary">(leave blank for no passphrase)</span>
+                        </label>
+                        <input
+                            type="password"
+                            value={passphrase}
+                            onChange={(e) => setPassphrase(e.target.value)}
+                            placeholder="Optional passphrase"
+                            autoComplete="new-password"
+                            className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                        />
+                    </div>
+
+                    <div className="flex gap-3 pt-1">
+                        <Button type="submit" variant="primary" loading={isPending} className="flex-1">
+                            Generate Key
+                        </Button>
+                        <Button type="button" variant="ghost" onClick={onClose}>
+                            Cancel
+                        </Button>
+                    </div>
+                </form>
+            </div>
         </div>
-      </div>
     );
-  }
+}
 
+
+function UpdatesModal({
+  updates,
+  onClose,
+  onApply,
+  isApplying,
+  applySuccess,
+}: {
+  updates: PackageUpdate[];
+  onClose: () => void;
+  onApply: () => void;
+  isApplying: boolean;
+  applySuccess: boolean;
+}) {
   return (
-    <div className="p-8">
-      <div className="mb-6 flex items-start justify-between">
-        <div>
-          <div className="flex items-center gap-3">
-            <Link href="/servers" className="text-text-secondary hover:text-text-primary text-sm">
-              ← Servers
-            </Link>
+    <div className="fixed inset-0 z-50 flex items-center justify-center">
+      <div className="absolute inset-0 bg-black/60 backdrop-blur-sm" onClick={onClose} />
+      <div className="relative z-10 w-full max-w-2xl rounded-xl border border-border bg-surface-1 p-6 shadow-2xl">
+        <div className="mb-5 flex items-center justify-between">
+          <div>
+            <h2 className="text-lg font-semibold text-text-primary">Available OS Updates</h2>
+            <p className="mt-0.5 text-sm text-text-secondary">{updates.length} package{updates.length !== 1 ? "s" : ""} available</p>
           </div>
-          <div className="mt-2 flex items-center gap-3">
-            <h1 className="text-2xl font-bold text-text-primary">{server.hostname}</h1>
-            <Badge variant={statusVariant(server.status)}>{server.status}</Badge>
-          </div>
-          <p className="mt-1 font-mono text-sm text-text-secondary">{server.ip_address}</p>
-        </div>
-        <div className="flex gap-2">
-          <Button
-            variant="secondary"
-            loading={isGenerating}
-            onClick={() => generateKey()}
+          <button
+            onClick={onClose}
+            className="rounded-md p-1 text-text-secondary hover:text-text-primary transition-colors"
           >
-            <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
-              <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
+            <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+              <path strokeLinecap="round" strokeLinejoin="round" d="M6 18L18 6M6 6l12 12" />
             </svg>
-            Generate SSH Key
-          </Button>
-          {!confirmDelete ? (
-            <Button variant="danger" onClick={() => setConfirmDelete(true)}>
-              Remove Server
-            </Button>
-          ) : (
-            <div className="flex items-center gap-2">
-              <span className="text-sm text-danger">Are you sure?</span>
-              <Button
-                variant="danger"
-                loading={isDeleting}
-                onClick={() => deleteServer()}
-              >
-                Confirm
-              </Button>
-              <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
-                Cancel
-              </Button>
-            </div>
-          )}
+          </button>
         </div>
-      </div>
 
-      <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
-        <Card className="lg:col-span-1">
-          <CardHeader>
-            <CardTitle>Details</CardTitle>
-          </CardHeader>
-          <dl className="space-y-3 text-sm">
-            <div>
-              <dt className="text-text-secondary">Server ID</dt>
-              <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">{server.server_id}</dd>
-            </div>
-            <div className="border-t border-border pt-3">
-              <dt className="text-text-secondary">OS</dt>
-              <dd className="mt-0.5 text-text-primary">{server.os_info}</dd>
-            </div>
-            <div className="border-t border-border pt-3">
-              <dt className="text-text-secondary">Last Seen</dt>
-              <dd className="mt-0.5 text-text-primary">{server.last_seen ? formatDate(server.last_seen) : "Never"}</dd>
-            </div>
-            <div className="border-t border-border pt-3">
-              <dt className="text-text-secondary">Registered</dt>
-              <dd className="mt-0.5 text-text-primary">{formatDate(server.created_at)}</dd>
-            </div>
-          </dl>
-        </Card>
+        <div className="max-h-80 overflow-y-auto rounded-lg border border-border">
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Package</Th>
+                <Th>Current</Th>
+                <Th>Available</Th>
+              </Tr>
+            </Thead>
+            <Tbody>
+              {updates.map((u) => (
+                <Tr key={u.name}>
+                  <Td><span className="font-medium font-mono text-sm">{u.name}</span></Td>
+                  <Td><span className="font-mono text-xs text-text-secondary">{u.current_version || "—"}</span></Td>
+                  <Td><span className="font-mono text-xs text-success">{u.new_version}</span></Td>
+                </Tr>
+              ))}
+            </Tbody>
+          </Table>
+        </div>
 
-        <div className="lg:col-span-2">
-          <Card padding={false}>
-            <div className="flex items-center justify-between border-b border-border px-6 py-4">
-              <h2 className="text-lg font-semibold text-text-primary">
-                Installed Keys
-                <span className="ml-2 rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-secondary">
-                  {server.keys?.filter(k => !k.revoked_at).length ?? 0} active
-                </span>
-              </h2>
-              <Link href="/keys">
-                <Button variant="ghost" size="sm">Manage Keys →</Button>
-              </Link>
-            </div>
-
-            {!server.keys || server.keys.length === 0 ? (
-              <div className="py-16 text-center">
-                <p className="text-text-secondary text-sm">No keys assigned to this server.</p>
-                <Link href="/keys">
-                  <Button variant="secondary" size="sm" className="mt-3">
-                    Assign a key
-                  </Button>
-                </Link>
-              </div>
-            ) : (
-              <Table>
-                <Thead>
-                  <Tr>
-                    <Th>Label</Th>
-                    <Th>Fingerprint</Th>
-                    <Th>Source</Th>
-                    <Th>Status</Th>
-                    <Th>Assigned</Th>
-                    <Th />
-                  </Tr>
-                </Thead>
-                <Tbody>
-                  {server.keys.map((assignment) => (
-                    <Tr key={assignment.key_id}>
-                      <Td>
-                        <span className="font-medium">{assignment.key.label}</span>
-                      </Td>
-                      <Td>
-                        <span className="font-mono text-xs text-text-secondary">
-                          {assignment.key.fingerprint}
-                        </span>
-                      </Td>
-                      <Td>
-                        <Badge variant={assignment.key.source === "generated" ? "accent" : "neutral"}>
-                          {assignment.key.source}
-                        </Badge>
-                      </Td>
-                      <Td>
-                        <Badge variant={assignment.revoked_at ? "danger" : "success"}>
-                          {assignment.revoked_at ? "revoked" : "active"}
-                        </Badge>
-                      </Td>
-                      <Td>
-                        <span className="text-text-secondary text-xs">
-                          {formatDate(assignment.assigned_at)}
-                        </span>
-                      </Td>
-                      <Td>
-                        <Link href={`/keys/${assignment.key_id}`}>
-                          <Button variant="ghost" size="sm">View</Button>
-                        </Link>
-                      </Td>
-                    </Tr>
-                  ))}
-                </Tbody>
-              </Table>
-            )}
-          </Card>
+        <div className="mt-5 flex items-center gap-3">
+          <Button variant="primary" loading={isApplying} onClick={onApply}>
+            {applySuccess ? "Sent!" : "Apply Updates"}
+          </Button>
+          <Button variant="ghost" onClick={onClose}>Close</Button>
+          <p className="ml-auto text-xs text-text-tertiary">Upgrade runs in the background. This may take several minutes.</p>
         </div>
       </div>
     </div>
   );
 }
+export default function ServerDetailPage() {
+    const params = useParams();
+    const router = useRouter();
+    const queryClient = useQueryClient();
+    const serverId = params.id as string;
+    const [confirmDelete, setConfirmDelete] = useState(false);
+    const [showGenerateModal, setShowGenerateModal] = useState(false);
+    const [copiedUpdate, setCopiedUpdate] = useState(false);
+    const [updateSuccess, setUpdateSuccess] = useState(false);
+  const [showUpdatesModal, setShowUpdatesModal] = useState(false);
+  const [applySuccess, setApplySuccess] = useState(false);
+
+    const {
+        data: server,
+        isLoading,
+        error,
+    } = useQuery({
+        queryKey: ["servers", serverId],
+        queryFn: () => api.getServer(serverId),
+        refetchInterval: 30_000,
+    });
+
+    const { mutate: generateKey, isPending: isGenerating } = useMutation({
+        mutationFn: (opts: GenerateKeyOptions) => api.generateKeyForServer(serverId, opts),
+        onSuccess: () => {
+            setShowGenerateModal(false);
+            queryClient.invalidateQueries({ queryKey: ["servers", serverId] });
+            queryClient.invalidateQueries({ queryKey: ["keys"] });
+        },
+    });
+
+    const { data: latestVersion } = useQuery({
+        queryKey: ["agent-latest-version"],
+        queryFn: () => api.getLatestAgentVersion(),
+        staleTime: 5 * 60_000,
+    });
+
+    const { mutate: triggerUpdate, isPending: isUpdating } = useMutation({
+        mutationFn: () => api.updateAgent(serverId),
+        onSuccess: () => {
+            setUpdateSuccess(true);
+            setTimeout(() => setUpdateSuccess(false), 4000);
+        },
+    });
+
+  
+  const { mutate: applyUpdates, isPending: isApplying } = useMutation({
+    mutationFn: () => api.applyUpdates(serverId),
+    onSuccess: () => {
+      setApplySuccess(true);
+      setTimeout(() => {
+        setApplySuccess(false);
+        setShowUpdatesModal(false);
+      }, 2000);
+    },
+  });
+  const { mutate: deleteServer, isPending: isDeleting } = useMutation({
+        mutationFn: () => api.deleteServer(serverId),
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ["servers"] });
+            router.push("/servers");
+        },
+    });
+
+    if (isLoading) {
+        return (
+            <div className="flex h-full items-center justify-center">
+                <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+            </div>
+        );
+    }
+
+    if (error || !server) {
+        return (
+            <div className="p-8">
+                <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Server not found or failed to load.</div>
+            </div>
+        );
+    }
+
+    return (
+        <div className="p-8">
+            {showGenerateModal && <GenerateKeyModal onClose={() => setShowGenerateModal(false)} onSubmit={(opts) => generateKey(opts)} isPending={isGenerating} />}
+            {showUpdatesModal && server.available_updates && (
+                <UpdatesModal
+                    updates={server.available_updates}
+                    onClose={() => setShowUpdatesModal(false)}
+                    onApply={() => applyUpdates()}
+                    isApplying={isApplying}
+                    applySuccess={applySuccess}
+                />
+            )}
+
+            <div className="mb-6 flex items-start justify-between">
+                <div>
+                    <div className="flex items-center gap-3">
+                        <Link href="/servers" className="text-text-secondary hover:text-text-primary text-sm">
+                            ← Servers
+                        </Link>
+                    </div>
+                    <div className="mt-2 flex items-center gap-3">
+                        <h1 className="text-2xl font-bold text-text-primary">{server.hostname}</h1>
+                        <Badge variant={statusVariant(server.status)}>{server.status}</Badge>
+                    </div>
+                    <p className="mt-1 font-mono text-sm text-text-secondary">{server.ip_address}</p>
+                </div>
+                <div className="flex gap-2">
+                    {server.console_protocols?.map((p) => (
+                        <Link key={p} href={`/servers/${serverId}/console?protocol=${p}`}>
+                            <Button variant="secondary">
+                                <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                                    <path strokeLinecap="round" strokeLinejoin="round" d="M9 17.25v1.007a3 3 0 01-.879 2.122L7.5 21h9l-.621-.621A3 3 0 0115 18.257V17.25m6-12V15a2.25 2.25 0 01-2.25 2.25H5.25A2.25 2.25 0 013 15V5.25m18 0A2.25 2.25 0 0018.75 3H5.25A2.25 2.25 0 003 5.25m18 0V12a2.25 2.25 0 01-2.25 2.25H5.25A2.25 2.25 0 013 12V5.25" />
+                                </svg>
+                                Connect {p.toUpperCase()}
+                            </Button>
+                        </Link>
+                    ))}
+                    {server.available_updates && server.available_updates.length > 0 && (
+                        <Button
+                            variant="secondary"
+                            onClick={() => setShowUpdatesModal(true)}
+                            className="border-warning/50 text-warning hover:border-warning hover:bg-warning/10"
+                        >
+                            <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                                <path strokeLinecap="round" strokeLinejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z" />
+                            </svg>
+                            {server.available_updates.length} OS Update{server.available_updates.length !== 1 ? "s" : ""}
+                        </Button>
+                    )}
+                    <Button variant="secondary" onClick={() => setShowGenerateModal(true)}>
+                        <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                            <path
+                                strokeLinecap="round"
+                                strokeLinejoin="round"
+                                d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z"
+                            />
+                        </svg>
+                        Generate SSH Key
+                    </Button>
+                    {!confirmDelete ? (
+                        <Button variant="danger" onClick={() => setConfirmDelete(true)}>
+                            Remove Server
+                        </Button>
+                    ) : (
+                        <div className="flex items-center gap-2">
+                            <span className="text-sm text-danger">Are you sure?</span>
+                            <Button variant="danger" loading={isDeleting} onClick={() => deleteServer()}>
+                                Confirm
+                            </Button>
+                            <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
+                                Cancel
+                            </Button>
+                        </div>
+                    )}
+                </div>
+            </div>
+
+            <div className="mb-6">
+                <Card>
+                    <CardHeader>
+                        <CardTitle>Update Agent</CardTitle>
+                    </CardHeader>
+                    <div className="mb-4 flex flex-wrap items-center gap-4 text-sm">
+                        <div>
+                            <span className="text-text-secondary">Installed: </span>
+                            <span className="font-mono font-medium text-text-primary">{server.agent_version ? `v${server.agent_version}` : "unknown"}</span>
+                        </div>
+                        <div>
+                            <span className="text-text-secondary">Latest: </span>
+                            <span className="font-mono font-medium text-text-primary">{latestVersion ? `v${latestVersion.version}` : "—"}</span>
+                        </div>
+                        {latestVersion && server.agent_version && server.agent_version !== latestVersion.version && <Badge variant="warning">update available</Badge>}
+                        {latestVersion && server.agent_version && server.agent_version === latestVersion.version && <Badge variant="success">up to date</Badge>}
+                    </div>
+                    <div className="flex flex-wrap gap-3">
+                        <Button
+                            variant="primary"
+                            loading={isUpdating}
+                            onClick={() => triggerUpdate()}
+                            disabled={server.status !== "active"}
+                            title={server.status !== "active" ? "Agent must be online to update" : undefined}
+                        >
+                            {updateSuccess ? "Update Sent!" : "Update Agent"}
+                        </Button>
+                        <div className="relative flex-1 min-w-64 rounded-lg border border-border bg-[#0a0c14] px-4 py-2.5 font-mono text-sm">
+                            <span className="text-accent">$</span> <span className="text-text-primary">{api.getUpdateCommand()}</span>
+                            <button
+                                onClick={async () => {
+                                    await navigator.clipboard.writeText(api.getUpdateCommand());
+                                    setCopiedUpdate(true);
+                                    setTimeout(() => setCopiedUpdate(false), 2000);
+                                }}
+                                className="absolute right-2 top-1.5 rounded-md border border-border bg-surface-2 px-2 py-0.5 text-xs font-medium text-text-secondary transition-colors hover:border-accent/50 hover:text-text-primary"
+                            >
+                                {copiedUpdate ? <span className="text-success">Copied!</span> : "Copy"}
+                            </button>
+                        </div>
+                    </div>
+                </Card>
+            </div>
+
+            <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
+                <Card className="lg:col-span-1">
+                    <CardHeader>
+                        <CardTitle>Details</CardTitle>
+                    </CardHeader>
+                    <dl className="space-y-3 text-sm">
+                        <div>
+                            <dt className="text-text-secondary">Server ID</dt>
+                            <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">{server.server_id}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">OS</dt>
+                            <dd className="mt-0.5 text-text-primary">{server.os_info}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">Agent Version</dt>
+                            <dd className="mt-0.5 font-mono text-text-primary">{server.agent_version ? `v${server.agent_version}` : "unknown"}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">Last Seen</dt>
+                            <dd className="mt-0.5 text-text-primary">{server.last_seen ? formatDate(server.last_seen) : "Never"}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">Registered</dt>
+                            <dd className="mt-0.5 text-text-primary">{formatDate(server.created_at)}</dd>
+                        </div>
+                    </dl>
+                </Card>
+
+                <div className="lg:col-span-2">
+                    <Card padding={false}>
+                        <div className="flex items-center justify-between border-b border-border px-6 py-4">
+                            <h2 className="text-lg font-semibold text-text-primary">
+                                Installed SSH Keys
+                                <span className="ml-2 rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-secondary">{server.keys?.filter((k) => !k.revoked_at).length ?? 0} active</span>
+                            </h2>
+                            <Link href="/keys">
+                                <Button variant="ghost" size="sm">
+                                    Manage Keys →
+                                </Button>
+                            </Link>
+                        </div>
+
+                        {!server.keys || server.keys.length === 0 ? (
+                            <div className="py-16 text-center">
+                                <p className="text-text-secondary text-sm">No keys assigned to this server.</p>
+                                <Link href="/keys">
+                                    <Button variant="secondary" size="sm" className="mt-3">
+                                        Assign a key
+                                    </Button>
+                                </Link>
+                            </div>
+                        ) : (
+                            <Table>
+                                <Thead>
+                                    <Tr>
+                                        <Th>Label</Th>
+                                        <Th>Fingerprint</Th>
+                                        <Th>Source</Th>
+                                        <Th>Status</Th>
+                                        <Th>Assigned</Th>
+                                        <Th />
+                                    </Tr>
+                                </Thead>
+                                <Tbody>
+                                    {server.keys
+                                        .filter((a) => a.key)
+                                        .map((assignment) => (
+                                            <Tr key={assignment.key_id}>
+                                                <Td>
+                                                    <span className="font-medium">{assignment.key.label}</span>
+                                                </Td>
+                                                <Td>
+                                                    <span className="font-mono text-xs text-text-secondary">{assignment.key.fingerprint}</span>
+                                                </Td>
+                                                <Td>
+                                                    <Badge variant={assignment.key.source === "generated" ? "accent" : "neutral"}>{assignment.key.source}</Badge>
+                                                </Td>
+                                                <Td>
+                                                    <Badge variant={assignment.revoked_at ? "danger" : "success"}>{assignment.revoked_at ? "revoked" : "active"}</Badge>
+                                                </Td>
+                                                <Td>
+                                                    <span className="text-text-secondary text-xs">{formatDate(assignment.assigned_at)}</span>
+                                                </Td>
+                                                <Td>
+                                                    <Link href={`/keys/${assignment.key_id}`}>
+                                                        <Button variant="ghost" size="sm">
+                                                            View
+                                                        </Button>
+                                                    </Link>
+                                                </Td>
+                                            </Tr>
+                                        ))}
+                                </Tbody>
+                            </Table>
+                        )}
+                    </Card>
+                </div>
+            </div>
+        </div>
+    );
+}

web/app/servers/new/page.tsx

@@ -26,7 +26,7 @@ export default function NewServerPage() {
       <div className="mb-6">
         <h1 className="text-2xl font-bold text-text-primary">Add Server</h1>
         <p className="mt-1 text-sm text-text-secondary">
-          Generate an install command to register a new server with the KeyManager agent.
+          Generate an install command to register a new server with the Vantage agent.
         </p>
       </div>
 
@@ -39,7 +39,7 @@ export default function NewServerPage() {
             <p className="mb-6 text-sm text-text-secondary leading-relaxed">
               Click the button below to generate a one-time install command. The command
               contains a short-lived token (valid for 1 hour) that registers your server
-              and installs the KeyManager agent automatically.
+              and installs the Vantage agent automatically.
             </p>
 
             {error && (
@@ -111,8 +111,8 @@ export default function NewServerPage() {
                 {[
                   "The install script detects your CPU architecture (amd64 / arm64)",
                   "Downloads and verifies the latest agent binary from the Gitea release",
-                  "Writes /etc/keymanager/config.yaml with the server ID and token",
-                  "Installs and starts the keymanager-agent systemd service",
+                  "Writes /etc/vantage/config.yaml with the server ID and token",
+                  "Installs and starts the vantage-agent systemd service",
                   "The agent calls Register() to obtain a persistent auth token",
                   "The server status changes to active on the first successful sync",
                 ].map((step, i) => (

web/app/servers/page.tsx

@@ -2,19 +2,40 @@
 
 import { useQuery } from "@tanstack/react-query";
 import Link from "next/link";
-import { api, Server, ServerStatus } from "@/lib/api";
-import { Badge, Button, Card } from "@/components/ui";
+import { api, Server } from "@/lib/api";
+import { Button, Card } from "@/components/ui";
 import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
 
-function statusVariant(status: ServerStatus) {
-  switch (status) {
-    case "active":
-      return "success";
-    case "pending":
-      return "warning";
-    case "offline":
-      return "danger";
-  }
+
+type DotStatus = "offline" | "needs-update" | "has-package-updates" | "ok";
+
+function resolveStatus(server: Server, latestVersion: string | undefined): DotStatus {
+  if (server.status === "offline" || server.status === "pending") return "offline";
+  if (latestVersion && server.agent_version && server.agent_version !== latestVersion) return "needs-update";
+  if (server.available_updates && server.available_updates.length > 0) return "has-package-updates";
+  return "ok";
+}
+
+const DOT_CLASSES: Record<DotStatus, string> = {
+  offline:             "bg-danger",
+  "needs-update":      "bg-orange-500",
+  "has-package-updates": "bg-yellow-400",
+  ok:                  "bg-success",
+};
+
+const DOT_LABELS: Record<DotStatus, string> = {
+  offline:             "Offline",
+  "needs-update":      "Agent needs updating",
+  "has-package-updates": "Package updates available",
+  ok:                  "OK",
+};
+
+function StatusDot({ status }: { status: DotStatus }) {
+  return (
+    <span title={DOT_LABELS[status]} className="flex items-center">
+      <span className={`inline-block h-2.5 w-2.5 rounded-full ${DOT_CLASSES[status]}`} />
+    </span>
+  );
 }
 
 function formatLastSeen(dateStr: string): string {
@@ -39,6 +60,13 @@ export default function ServersPage() {
     refetchInterval: 30_000,
   });
 
+  const { data: latestVersionData } = useQuery({
+    queryKey: ["agent-latest-version"],
+    queryFn: api.getLatestAgentVersion,
+    staleTime: 5 * 60_000,
+  });
+  const latestVersion = latestVersionData?.version;
+
   return (
     <div className="p-8">
       <div className="mb-6 flex items-center justify-between">
@@ -96,9 +124,7 @@ export default function ServersPage() {
                     <span className="text-text-secondary">{server.os_info}</span>
                   </Td>
                   <Td>
-                    <Badge variant={statusVariant(server.status)}>
-                      {server.status}
-                    </Badge>
+                    <StatusDot status={resolveStatus(server, latestVersion)} />
                   </Td>
                   <Td>
                     <span className="text-text-secondary">

web/app/settings/page.tsx

@@ -0,0 +1,393 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { api, AlertSettings, EmailSettings } from "@/lib/api";
+import { Button, Card, CardHeader, CardTitle } from "@/components/ui";
+
+function Toggle({ enabled, onChange }: { enabled: boolean; onChange: (v: boolean) => void }) {
+  return (
+    <button
+      type="button"
+      onClick={() => onChange(!enabled)}
+      className={`relative inline-flex h-6 w-11 flex-shrink-0 items-center rounded-full transition-colors focus:outline-none ${
+        enabled ? "bg-accent" : "bg-surface-2 border border-border"
+      }`}
+    >
+      <span
+        className={`inline-block h-4 w-4 transform rounded-full bg-white shadow transition-transform ${
+          enabled ? "translate-x-6" : "translate-x-1"
+        }`}
+      />
+    </button>
+  );
+}
+
+function ToggleRow({
+  label,
+  description,
+  enabled,
+  onChange,
+}: {
+  label: string;
+  description: string;
+  enabled: boolean;
+  onChange: (v: boolean) => void;
+}) {
+  return (
+    <div className="flex items-center justify-between rounded-lg border border-border bg-surface-2 px-4 py-3">
+      <div>
+        <p className="text-sm font-medium text-text-primary">{label}</p>
+        <p className="text-xs text-text-secondary">{description}</p>
+      </div>
+      <Toggle enabled={enabled} onChange={onChange} />
+    </div>
+  );
+}
+
+function Field({
+  label,
+  hint,
+  children,
+}: {
+  label: string;
+  hint?: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <div>
+      <label className="mb-1.5 block text-sm font-medium text-text-secondary">{label}</label>
+      {children}
+      {hint && <p className="mt-1 text-xs text-text-tertiary">{hint}</p>}
+    </div>
+  );
+}
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30";
+
+function SecretsTokenCard({
+  tokenSet,
+  rotatedAt,
+}: {
+  tokenSet: boolean;
+  rotatedAt?: string;
+}) {
+  const queryClient = useQueryClient();
+  const [token, setToken] = useState<string | null>(null);
+  const [copied, setCopied] = useState(false);
+  const readUrl =
+    typeof window !== "undefined"
+      ? `${window.location.origin}/api/secrets/<group>/values`
+      : "/api/secrets/<group>/values";
+
+  const { mutate: rotate, isPending } = useMutation({
+    mutationFn: api.rotateSecretsToken,
+    onSuccess: (res) => {
+      setToken(res.token);
+      queryClient.invalidateQueries({ queryKey: ["settings"] });
+    },
+  });
+
+  async function copy() {
+    if (!token) return;
+    await navigator.clipboard.writeText(token);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 2000);
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Secrets Read Token (ESO)</CardTitle>
+      </CardHeader>
+      <p className="mb-5 text-sm text-text-secondary">
+        Kubernetes External Secrets Operator authenticates to the read endpoint with this bearer
+        token. Point your <span className="font-mono">ClusterSecretStore</span> at{" "}
+        <span className="font-mono text-text-primary">{readUrl}</span>.
+      </p>
+
+      <div className="mb-4 flex items-center gap-2 text-sm">
+        <span
+          className={`inline-block h-2 w-2 rounded-full ${tokenSet ? "bg-success" : "bg-text-tertiary"}`}
+        />
+        <span className="text-text-secondary">
+          {tokenSet ? "A read token is configured" : "No read token configured yet"}
+          {tokenSet && rotatedAt && ` · rotated ${new Date(rotatedAt).toLocaleString()}`}
+        </span>
+      </div>
+
+      {token && (
+        <div className="mb-4 rounded-lg border border-warning/30 bg-warning/10 p-3">
+          <p className="mb-2 text-xs font-medium text-warning">
+            Copy this token now — it will not be shown again.
+          </p>
+          <div className="flex items-center gap-2">
+            <code className="flex-1 overflow-x-auto rounded bg-surface-2 px-2 py-1.5 font-mono text-xs text-text-primary">
+              {token}
+            </code>
+            <Button type="button" variant="ghost" size="sm" onClick={copy}>
+              {copied ? "Copied!" : "Copy"}
+            </Button>
+          </div>
+        </div>
+      )}
+
+      <Button type="button" variant="primary" loading={isPending} onClick={() => rotate()}>
+        {tokenSet ? "Rotate Token" : "Generate Token"}
+      </Button>
+      {tokenSet && (
+        <p className="mt-2 text-xs text-text-tertiary">
+          Rotating invalidates the previous token. Update the Kubernetes secret afterwards.
+        </p>
+      )}
+    </Card>
+  );
+}
+
+export default function SettingsPage() {
+  const queryClient = useQueryClient();
+
+  const { data: settings, isLoading } = useQuery({
+    queryKey: ["settings"],
+    queryFn: api.getSettings,
+  });
+
+  // Webhook / offline alerting state
+  const [alertsEnabled, setAlertsEnabled] = useState(false);
+  const [webhookURL, setWebhookURL] = useState("");
+  const [thresholdMinutes, setThresholdMinutes] = useState(5);
+
+  // Email state
+  const [emailEnabled, setEmailEnabled] = useState(false);
+  const [smtpHost, setSmtpHost] = useState("");
+  const [smtpPort, setSmtpPort] = useState(587);
+  const [smtpUser, setSmtpUser] = useState("");
+  const [smtpPass, setSmtpPass] = useState("");
+  const [fromAddr, setFromAddr] = useState("");
+  const [toAddrs, setToAddrs] = useState(""); // comma-separated in UI
+  const [useTLS, setUseTLS] = useState(false);
+
+  const [saved, setSaved] = useState(false);
+
+  useEffect(() => {
+    if (!settings) return;
+    setAlertsEnabled(settings.alerts.enabled);
+    setWebhookURL(settings.alerts.webhook_url ?? "");
+    setThresholdMinutes(settings.alerts.offline_threshold_minutes || 5);
+    setEmailEnabled(settings.email?.enabled ?? false);
+    setSmtpHost(settings.email?.smtp_host ?? "");
+    setSmtpPort(settings.email?.smtp_port || 587);
+    setSmtpUser(settings.email?.username ?? "");
+    setSmtpPass(settings.email?.password ?? "");
+    setFromAddr(settings.email?.from_addr ?? "");
+    setToAddrs((settings.email?.to_addrs ?? []).join(", "));
+    setUseTLS(settings.email?.use_tls ?? false);
+  }, [settings]);
+
+  const { mutate: save, isPending } = useMutation({
+    mutationFn: (payload: { alerts: AlertSettings; email: EmailSettings }) =>
+      api.saveSettings(payload),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["settings"] });
+      setSaved(true);
+      setTimeout(() => setSaved(false), 3000);
+    },
+  });
+
+  function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    const toList = toAddrs
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean);
+
+    save({
+      alerts: {
+        enabled: alertsEnabled,
+        webhook_url: webhookURL,
+        offline_threshold_minutes: thresholdMinutes,
+      },
+      email: {
+        enabled: emailEnabled,
+        smtp_host: smtpHost,
+        smtp_port: smtpPort,
+        username: smtpUser,
+        password: smtpPass,
+        from_addr: fromAddr,
+        to_addrs: toList,
+        use_tls: useTLS,
+      },
+    });
+  }
+
+  if (isLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-8">
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold text-text-primary">Settings</h1>
+        <p className="mt-1 text-sm text-text-secondary">Configure alerting and monitoring behaviour</p>
+      </div>
+
+      <form onSubmit={handleSubmit} className="max-w-xl space-y-6">
+        {/* Webhook alerting */}
+        <Card>
+          <CardHeader>
+            <CardTitle>Webhook Alerting</CardTitle>
+          </CardHeader>
+          <p className="mb-5 text-sm text-text-secondary">
+            POST a JSON payload to a URL when a server goes offline. Compatible with Slack,
+            Discord, n8n, and any service that accepts JSON.
+          </p>
+          <div className="space-y-4">
+            <ToggleRow
+              label="Enable webhook alerts"
+              description="Webhook fires only when this is on"
+              enabled={alertsEnabled}
+              onChange={setAlertsEnabled}
+            />
+            <Field
+              label="Webhook URL"
+              hint={`POST body: { event, hostname, server_id, ip_address, timestamp, message }`}
+            >
+              <input
+                type="url"
+                value={webhookURL}
+                onChange={(e) => setWebhookURL(e.target.value)}
+                placeholder="https://hooks.slack.com/... or https://discord.com/api/webhooks/..."
+                className={inputClass}
+              />
+            </Field>
+            <Field
+              label="Offline threshold (minutes)"
+              hint="How long a server must be silent before being marked offline. Agents poll every 30s, so 5 minutes is a safe minimum."
+            >
+              <input
+                type="number"
+                min={1}
+                max={60}
+                value={thresholdMinutes}
+                onChange={(e) => setThresholdMinutes(Number(e.target.value))}
+                className="w-32 rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+              />
+            </Field>
+          </div>
+        </Card>
+
+        {/* Email alerting */}
+        <Card>
+          <CardHeader>
+            <CardTitle>Email Notifications</CardTitle>
+          </CardHeader>
+          <p className="mb-5 text-sm text-text-secondary">
+            Send an email when a server goes offline. Uses the same offline threshold as the
+            webhook setting above.
+          </p>
+          <div className="space-y-4">
+            <ToggleRow
+              label="Enable email alerts"
+              description="Emails are only sent when this is on"
+              enabled={emailEnabled}
+              onChange={setEmailEnabled}
+            />
+            <div className="grid grid-cols-3 gap-3">
+              <Field label="SMTP Host" hint="">
+                <input
+                  type="text"
+                  value={smtpHost}
+                  onChange={(e) => setSmtpHost(e.target.value)}
+                  placeholder="smtp.gmail.com"
+                  className={inputClass}
+                />
+              </Field>
+              <Field label="Port" hint="">
+                <input
+                  type="number"
+                  value={smtpPort}
+                  onChange={(e) => setSmtpPort(Number(e.target.value))}
+                  placeholder="587"
+                  className={inputClass}
+                />
+              </Field>
+              <div className="flex flex-col justify-center pt-5">
+                <ToggleRow
+                  label="TLS (port 465)"
+                  description="Use implicit TLS instead of STARTTLS"
+                  enabled={useTLS}
+                  onChange={(v) => {
+                    setUseTLS(v);
+                    setSmtpPort(v ? 465 : 587);
+                  }}
+                />
+              </div>
+            </div>
+            <div className="grid grid-cols-2 gap-3">
+              <Field label="Username">
+                <input
+                  type="text"
+                  value={smtpUser}
+                  onChange={(e) => setSmtpUser(e.target.value)}
+                  placeholder="user@example.com"
+                  className={inputClass}
+                  autoComplete="username"
+                />
+              </Field>
+              <Field label="Password">
+                <input
+                  type="password"
+                  value={smtpPass}
+                  onChange={(e) => setSmtpPass(e.target.value)}
+                  placeholder="App password or SMTP password"
+                  className={inputClass}
+                  autoComplete="new-password"
+                />
+              </Field>
+            </div>
+            <Field label="From address">
+              <input
+                type="email"
+                value={fromAddr}
+                onChange={(e) => setFromAddr(e.target.value)}
+                placeholder="vantage@example.com"
+                className={inputClass}
+              />
+            </Field>
+            <Field
+              label="To addresses"
+              hint="Separate multiple addresses with commas"
+            >
+              <input
+                type="text"
+                value={toAddrs}
+                onChange={(e) => setToAddrs(e.target.value)}
+                placeholder="admin@example.com, ops@example.com"
+                className={inputClass}
+              />
+            </Field>
+          </div>
+        </Card>
+
+        <div className="flex items-center gap-3">
+          <Button type="submit" variant="primary" loading={isPending}>
+            {saved ? "Saved!" : "Save Settings"}
+          </Button>
+          {saved && <span className="text-sm text-success">Settings saved successfully.</span>}
+        </div>
+      </form>
+
+      <div className="mt-6 max-w-xl">
+        <SecretsTokenCard
+          tokenSet={settings?.secrets?.read_token_set ?? false}
+          rotatedAt={settings?.secrets?.rotated_at}
+        />
+      </div>
+    </div>
+  );
+}

web/components/AuthProvider.tsx

@@ -0,0 +1,62 @@
+"use client";
+
+import { createContext, useContext, useEffect, useState, ReactNode } from "react";
+
+export interface User {
+  user_id: string;
+  email: string;
+  name: string;
+}
+
+interface AuthContextType {
+  user: User | null;
+  authEnabled: boolean;
+}
+
+const AuthContext = createContext<AuthContextType>({ user: null, authEnabled: false });
+
+export function useAuth() {
+  return useContext(AuthContext);
+}
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [user, setUser] = useState<User | null>(null);
+  const [authEnabled, setAuthEnabled] = useState(false);
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => {
+    fetch("/auth/me", { credentials: "include" })
+      .then(async (res) => {
+        if (res.status === 401) {
+          window.location.href = "/auth/login";
+          return;
+        }
+        const data = await res.json();
+        if (data.auth_enabled === false) {
+          setAuthEnabled(false);
+        } else {
+          setAuthEnabled(true);
+          setUser(data as User);
+        }
+        setLoading(false);
+      })
+      .catch(() => {
+        // Backend unreachable — don't block the UI
+        setLoading(false);
+      });
+  }, []);
+
+  if (loading) {
+    return (
+      <div className="flex h-screen items-center justify-center bg-background">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  return (
+    <AuthContext.Provider value={{ user, authEnabled }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}

web/components/Sidebar.tsx

@@ -3,6 +3,7 @@
 import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { clsx } from "clsx";
+import { useAuth } from "@/components/AuthProvider";
 
 interface NavItem {
   href: string;
@@ -26,13 +27,42 @@ function KeyIcon() {
   );
 }
 
+function SecretIcon() {
+  return (
+    <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+      <path strokeLinecap="round" strokeLinejoin="round" d="M16.5 10.5V6.75a4.5 4.5 0 10-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 002.25-2.25v-6.75a2.25 2.25 0 00-2.25-2.25H6.75a2.25 2.25 0 00-2.25 2.25v6.75a2.25 2.25 0 002.25 2.25z" />
+    </svg>
+  );
+}
+
+function AuditIcon() {
+  return (
+    <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+      <path strokeLinecap="round" strokeLinejoin="round" d="M9 12h3.75M9 15h3.75M9 18h3.75m3 .75H18a2.25 2.25 0 002.25-2.25V6.108c0-1.135-.845-2.098-1.976-2.192a48.424 48.424 0 00-1.123-.08m-5.801 0c-.065.21-.1.433-.1.664 0 .414.336.75.75.75h4.5a.75.75 0 00.75-.75 2.25 2.25 0 00-.1-.664m-5.8 0A2.251 2.251 0 0113.5 2.25H15c1.012 0 1.867.668 2.15 1.586m-5.8 0c-.376.023-.75.05-1.124.08C9.095 4.01 8.25 4.973 8.25 6.108V8.25m0 0H4.875c-.621 0-1.125.504-1.125 1.125v11.25c0 .621.504 1.125 1.125 1.125h9.75c.621 0 1.125-.504 1.125-1.125V9.375c0-.621-.504-1.125-1.125-1.125H8.25zM6.75 12h.008v.008H6.75V12zm0 3h.008v.008H6.75V15zm0 3h.008v.008H6.75V18z" />
+    </svg>
+  );
+}
+
+function SettingsIcon() {
+  return (
+    <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+      <path strokeLinecap="round" strokeLinejoin="round" d="M9.594 3.94c.09-.542.56-.94 1.11-.94h2.593c.55 0 1.02.398 1.11.94l.213 1.281c.063.374.313.686.645.87.074.04.147.083.22.127.324.196.72.257 1.075.124l1.217-.456a1.125 1.125 0 011.37.49l1.296 2.247a1.125 1.125 0 01-.26 1.431l-1.003.827c-.293.24-.438.613-.431.992a6.759 6.759 0 010 .255c-.007.378.138.75.43.99l1.005.828c.424.35.534.954.26 1.43l-1.298 2.247a1.125 1.125 0 01-1.369.491l-1.217-.456c-.355-.133-.75-.072-1.076.124a6.57 6.57 0 01-.22.128c-.331.183-.581.495-.644.869l-.213 1.28c-.09.543-.56.941-1.11.941h-2.594c-.55 0-1.02-.398-1.11-.94l-.213-1.281c-.062-.374-.312-.686-.644-.87a6.52 6.52 0 01-.22-.127c-.325-.196-.72-.257-1.076-.124l-1.217.456a1.125 1.125 0 01-1.369-.49l-1.297-2.247a1.125 1.125 0 01.26-1.431l1.004-.827c.292-.24.437-.613.43-.992a6.932 6.932 0 010-.255c.007-.378-.138-.75-.43-.99l-1.004-.828a1.125 1.125 0 01-.26-1.43l1.297-2.247a1.125 1.125 0 011.37-.491l1.216.456c.356.133.751.072 1.076-.124.072-.044.146-.087.22-.128.332-.183.582-.495.644-.869l.214-1.281z" />
+      <path strokeLinecap="round" strokeLinejoin="round" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+    </svg>
+  );
+}
+
 const navItems: NavItem[] = [
   { href: "/servers", label: "Servers", icon: <ServerIcon /> },
   { href: "/keys", label: "SSH Keys", icon: <KeyIcon /> },
+  { href: "/secrets", label: "Secrets", icon: <SecretIcon /> },
+  { href: "/audit", label: "Audit Log", icon: <AuditIcon /> },
+  { href: "/settings", label: "Settings", icon: <SettingsIcon /> },
 ];
 
 export function Sidebar() {
   const pathname = usePathname();
+  const { user, authEnabled } = useAuth();
 
   return (
     <aside className="flex h-screen w-60 flex-col border-r border-border bg-surface">
@@ -42,7 +72,7 @@ export function Sidebar() {
             <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
           </svg>
         </div>
-        <span className="text-base font-semibold text-text-primary">KeyManager</span>
+        <span className="text-base font-semibold text-text-primary">Vantage</span>
       </div>
 
       <nav className="flex-1 overflow-y-auto px-3 py-4">
@@ -71,7 +101,23 @@ export function Sidebar() {
       </nav>
 
       <div className="border-t border-border px-4 py-3">
-        <p className="text-xs text-text-secondary">KeyManager v1.0</p>
+        {authEnabled && user && (
+          <div className="mb-3">
+            <p className="truncate text-sm font-medium text-text-primary">{user.name || user.email}</p>
+            <p className="truncate text-xs text-text-secondary">{user.email}</p>
+          </div>
+        )}
+        <div className="flex items-center justify-between">
+          <p className="text-xs text-text-secondary">Vantage v1.0</p>
+          {authEnabled && user && (
+            <a
+              href="/auth/logout"
+              className="text-xs text-text-secondary transition-colors hover:text-danger"
+            >
+              Logout
+            </a>
+          )}
+        </div>
       </div>
     </aside>
   );

web/lib/api.ts

@@ -1,6 +1,12 @@
 export type ServerStatus = "pending" | "active" | "offline";
 export type KeySource = "uploaded" | "generated";
 
+export interface PackageUpdate {
+  name: string;
+  current_version?: string;
+  new_version: string;
+}
+
 export interface Server {
   id: string;
   server_id: string;
@@ -8,8 +14,27 @@ export interface Server {
   ip_address: string;
   os_info: string;
   status: ServerStatus;
+  agent_version?: string;
   last_seen: string;
   created_at: string;
+  available_updates?: PackageUpdate[];
+  updates_checked_at?: string;
+  console_protocols?: string[];
+}
+
+export interface ConsoleConnectRequest {
+  server_id: string;
+  protocol: string;
+  key_id?: string;
+  rdp_username?: string;
+  rdp_password?: string;
+  ssh_username?: string;
+}
+
+export interface ConsoleConnectResponse {
+  session_id: string;
+  token: string;
+  ws_path: string;
 }
 
 export interface Key {
@@ -20,6 +45,8 @@ export interface Key {
   fingerprint: string;
   source: KeySource;
   generated_by_server_id?: string;
+  has_private_key: boolean;
+  has_passphrase?: boolean;
   created_at: string;
   assigned_count?: number;
 }
@@ -32,12 +59,70 @@ export interface Assignment {
   revoked_at: string | null;
 }
 
+export interface AuditEvent {
+  id: string;
+  event_type: string;
+  actor: string;
+  server_id?: string;
+  key_id?: string;
+  details: string;
+  created_at: string;
+}
+
+export interface AlertSettings {
+  enabled: boolean;
+  webhook_url: string;
+  offline_threshold_minutes: number;
+}
+
+export interface EmailSettings {
+  enabled: boolean;
+  smtp_host: string;
+  smtp_port: number;
+  username: string;
+  password: string;
+  from_addr: string;
+  to_addrs: string[];
+  use_tls: boolean;
+}
+
+export interface SecretsSettings {
+  read_token_set: boolean;
+  rotated_at?: string;
+}
+
+export interface Settings {
+  alerts: AlertSettings;
+  email: EmailSettings;
+  secrets: SecretsSettings;
+}
+
+export interface SecretGroupSummary {
+  group: string;
+  key_count: number;
+  updated_at: string;
+}
+
+export interface Secret {
+  group: string;
+  key: string;
+  updated_at: string;
+}
+
 export interface NewServerResponse {
   server_id: string;
   pre_reg_token: string;
   install_command: string;
 }
 
+export interface GenerateKeyOptions {
+  label: string;
+  key_type: "ed25519" | "rsa" | "ecdsa";
+  key_size?: number;
+  passphrase?: string;
+  comment?: string;
+}
+
 export interface KeyWithAssignments extends Key {
   assignments: (Assignment & { server: Server })[];
 }
@@ -58,6 +143,7 @@ class ApiError extends Error {
 
 async function request<T>(path: string, options?: RequestInit): Promise<T> {
   const res = await fetch(`/api${path}`, {
+    credentials: "include",
     headers: {
       "Content-Type": "application/json",
       ...options?.headers,
@@ -95,12 +181,95 @@ export const api = {
     return request<void>(`/servers/${serverId}`, { method: "DELETE" });
   },
 
-  generateKeyForServer(serverId: string): Promise<{ key_id: string }> {
-    return request<{ key_id: string }>(`/servers/${serverId}/generate-key`, {
+  generateKeyForServer(serverId: string, opts: GenerateKeyOptions): Promise<{ command_id: string }> {
+    return request<{ command_id: string }>(`/servers/${serverId}/generate-key`, {
+      method: "POST",
+      body: JSON.stringify(opts),
+    });
+  },
+
+  getUpdateCommand(): string {
+    return `curl -fsSL "${window.location.origin}/update" | bash`;
+  },
+
+  getLatestAgentVersion(): Promise<{ version: string }> {
+    return request<{ version: string }>("/agent/latest-version");
+  },
+
+  updateAgent(serverId: string): Promise<{ message: string; version: string }> {
+    return request<{ message: string; version: string }>(`/servers/${serverId}/update-agent`, {
       method: "POST",
     });
   },
 
+  applyUpdates(serverId: string): Promise<{ message: string }> {
+    return request<{ message: string }>(`/servers/${serverId}/apply-updates`, {
+      method: "POST",
+    });
+  },
+
+  // Audit
+  listAuditEvents(limit?: number): Promise<AuditEvent[]> {
+    const qs = limit ? `?limit=${limit}` : "";
+    return request<AuditEvent[]>(`/audit${qs}`);
+  },
+
+  // Settings
+  getSettings(): Promise<Settings> {
+    return request<Settings>("/settings");
+  },
+
+  saveSettings(settings: { alerts: AlertSettings; email: EmailSettings }): Promise<{ saved: boolean }> {
+    return request<{ saved: boolean }>("/settings", {
+      method: "PUT",
+      body: JSON.stringify(settings),
+    });
+  },
+
+  rotateSecretsToken(): Promise<{ token: string }> {
+    return request<{ token: string }>("/settings/secrets-token", { method: "POST" });
+  },
+
+  // Secrets
+  listSecretGroups(): Promise<SecretGroupSummary[]> {
+    return request<SecretGroupSummary[]>("/secrets");
+  },
+
+  createSecretGroup(group: string, values: Record<string, string>): Promise<{ group: string }> {
+    return request<{ group: string }>("/secrets", {
+      method: "POST",
+      body: JSON.stringify({ group, values }),
+    });
+  },
+
+  getSecretGroup(group: string): Promise<{ group: string; secrets: Secret[] }> {
+    return request<{ group: string; secrets: Secret[] }>(`/secrets/${encodeURIComponent(group)}`);
+  },
+
+  putSecrets(group: string, values: Record<string, string>): Promise<{ saved: boolean }> {
+    return request<{ saved: boolean }>(`/secrets/${encodeURIComponent(group)}`, {
+      method: "PUT",
+      body: JSON.stringify(values),
+    });
+  },
+
+  revealSecret(group: string, key: string): Promise<{ value: string }> {
+    return request<{ value: string }>(`/secrets/${encodeURIComponent(group)}/reveal`, {
+      method: "POST",
+      body: JSON.stringify({ key }),
+    });
+  },
+
+  deleteSecret(group: string, key: string): Promise<void> {
+    return request<void>(`/secrets/${encodeURIComponent(group)}/${encodeURIComponent(key)}`, {
+      method: "DELETE",
+    });
+  },
+
+  deleteSecretGroup(group: string): Promise<void> {
+    return request<void>(`/secrets/${encodeURIComponent(group)}`, { method: "DELETE" });
+  },
+
   // Keys
   listKeys(): Promise<Key[]> {
     return request<Key[]>("/keys");
@@ -110,13 +279,22 @@ export const api = {
     return request<KeyWithAssignments>(`/keys/${keyId}`);
   },
 
-  uploadKey(label: string, public_key: string): Promise<Key> {
+  uploadKey(label: string, public_key: string, private_key?: string, passphrase?: string): Promise<Key> {
     return request<Key>("/keys", {
       method: "POST",
-      body: JSON.stringify({ label, public_key }),
+      body: JSON.stringify({
+        label,
+        public_key,
+        private_key: private_key || undefined,
+        passphrase: passphrase || undefined,
+      }),
     });
   },
 
+  getPrivateKey(keyId: string): Promise<{ private_key: string }> {
+    return request<{ private_key: string }>(`/keys/${keyId}/private-key`);
+  },
+
   deleteKey(keyId: string): Promise<void> {
     return request<void>(`/keys/${keyId}`, { method: "DELETE" });
   },
@@ -134,4 +312,12 @@ export const api = {
       method: "DELETE",
     });
   },
+
+  // Console
+  connectConsole(body: ConsoleConnectRequest): Promise<ConsoleConnectResponse> {
+    return request<ConsoleConnectResponse>("/console/connect", {
+      method: "POST",
+      body: JSON.stringify(body),
+    });
+  },
 };

web/lib/guacConsole.ts

@@ -0,0 +1,27 @@
+// Thin wrapper over the vendored guacamole-common-js client.
+// The library attaches a global `Guacamole` object when loaded.
+declare const Guacamole: any;
+
+export function openConsole(container: HTMLElement, wsUrl: string): { disconnect: () => void } {
+  const tunnel = new Guacamole.WebSocketTunnel(wsUrl);
+  const client = new Guacamole.Client(tunnel);
+
+  container.innerHTML = "";
+  container.appendChild(client.getDisplay().getElement());
+
+  client.connect("");
+
+  // Wire keyboard + mouse.
+  const mouse = new Guacamole.Mouse(client.getDisplay().getElement());
+  mouse.onmousedown = mouse.onmouseup = mouse.onmousemove = (state: any) =>
+    client.sendMouseState(state);
+  const keyboard = new Guacamole.Keyboard(document);
+  keyboard.onkeydown = (k: number) => client.sendKeyEvent(1, k);
+  keyboard.onkeyup = (k: number) => client.sendKeyEvent(0, k);
+
+  return {
+    disconnect() {
+      client.disconnect();
+    },
+  };
+}

web/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

web/next.config.ts

@@ -3,19 +3,27 @@ import type { NextConfig } from "next";
 const apiUrl = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:8080";
 
 const nextConfig: NextConfig = {
-  output: "standalone",
-  async rewrites() {
-    return [
-      {
-        source: "/api/:path*",
-        destination: `${apiUrl}/api/:path*`,
-      },
-      {
-        source: "/install",
-        destination: `${apiUrl}/install`,
-      },
-    ];
-  },
+    output: "standalone",
+    async rewrites() {
+        return [
+            {
+                source: "/api/:path*",
+                destination: `${apiUrl}/api/:path*`,
+            },
+            {
+                source: "/auth/:path*",
+                destination: `${apiUrl}/auth/:path*`,
+            },
+            {
+                source: "/install",
+                destination: `${apiUrl}/install`,
+            },
+            {
+                source: "/update",
+                destination: `${apiUrl}/update`,
+            },
+        ];
+    },
 };
 
 export default nextConfig;

web/package-lock.json

@@ -1,11 +1,11 @@
 {
-    "name": "keymanager-web",
+    "name": "vantage-web",
     "version": "0.1.0",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
-            "name": "keymanager-web",
+            "name": "vantage-web",
             "version": "0.1.0",
             "dependencies": {
                 "@tanstack/react-query": "^5.51.1",

web/package.json

@@ -1,5 +1,5 @@
 {
-    "name": "keymanager-web",
+    "name": "vantage-web",
     "version": "0.1.0",
     "private": true,
     "scripts": {

web/tsconfig.json

@@ -1,6 +1,10 @@
 {
   "compilerOptions": {
-    "lib": ["dom", "dom.iterable", "esnext"],
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
@@ -10,7 +14,7 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "incremental": true,
     "plugins": [
       {
@@ -18,9 +22,20 @@
       }
     ],
     "paths": {
-      "@/*": ["./*"]
-    }
+      "@/*": [
+        "./*"
+      ]
+    },
+    "target": "ES2017"
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules"]
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
 }