chore: v0.4.1

This includes setting a custom redirect URI, handling errors, and using a better library.
As an API decision I've also disabled per session API keys as it clutters up too much.

.env.example

@@ -1,4 +1,4 @@
-API_KEY=abcdefghijklmnopqrstuvwxyz
+ROOT_API_KEY=abcdefghijklmnopqrstuvwxyz
 COOKIE_SECRET=abcdefghijklmnopqrstuvwxyz
 DISABLE_API_KEY_LOGIN=true
 HEADSCALE_CONTAINER=headscale

.eslintrc

@@ -1,3 +0,0 @@
-{
-	"extends": "tale"
-}

.github/workflows/nightly.yaml

@@ -0,0 +1,44 @@
+name: Publish Nightly Docker Image
+on:
+  schedule:
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Build and Publish Nightly
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker Metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=edge,branch=main
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64, linux/arm64

.github/workflows/push.yaml

@@ -0,0 +1,44 @@
+name: 'Build'
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Install node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+        with:
+          version: 9
+          run_install: false
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - uses: actions/cache@v4
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Build
+        run: pnpm build

.gitignore

@@ -1,5 +1,5 @@
 node_modules
-
+/.react-router
 /.cache
 /build
 .env

CHANGELOG.md

@@ -1,3 +1,143 @@
+### 0.4.1 (January 18, 2025)
+- Fixed an urgent issue where the OIDC redirect URI would mismatch.
+
+### 0.4.0 (January 18, 2025)
+- Switched from Remix.run to React-Router
+- Fixed an issue where some config fields were marked as required even if they weren't (fixes [#66](https://github.com/tale/headplane/issues/66))
+- Fixed an issue where the toasts would be obscured by the footer (fixes [#68](https://github.com/tale/headplane/issues/68))
+- The footer now blurs your Headscale URL as a privacy measure
+- Updated to the next stable beta of the React Compiler
+- Changed `/healthz` to use a well-known endpoint instead of trying an invalid API key
+- Support `OIDC_REDIRECT_URI` to force a specific redirect URI
+- Redo the OIDC integration for better error handling and configuration
+- Gracefully handle when Headscale is unreachable instead of crashing the dashboard
+- Reusable Pre-Auth Keys no longer show expired when used (PR [#88](https://github.com/tale/headplane/pull/88))
+- Tweaked some CSS issues in the UI
+
+### 0.3.9 (December 6, 2024)
+- Fixed a race condition bug in the OIDC validation code
+
+### 0.3.8 (December 6, 2024)
+- Added a little HTML footer to show the login page and link to a donation page.
+- Allow creating pre-auth keys that expire past 90 days (fixes [#58](https://github.com/tale/headplane/issues/58))
+- Validates OIDC config and ignores validation if specified via variables or Headscale config (fixes [#63](https://github.com/tale/headplane/issues/63))
+
+### 0.3.7 (November 30, 2024)
+- Allow customizing the OIDC token endpoint auth method via `OIDC_CLIENT_SECRET_METHOD` (fixes [#57](https://github.com/tale/headplane/issues/57))
+- Added a `/healthz` endpoint for Kubernetes and other health checks (fixes [#59](https://github.com/tale/headplane/issues/59))
+- Allow `HEADSCALE_PUBLIC_URL` to be set if `HEADSCALE_URL` points to a different internal address (fixes [#60](https://github.com/tale/headplane/issues/60))
+- Fixed an issue where the copy machine registration command had a typo.
+
+### 0.3.6 (November 20, 2024)
+- Fixed an issue where select dropdowns would not scroll (fixes [#53](https://github.com/tale/headplane/issues/53))
+- Added a button to copy the machine registration command to the clipboard (fixes [#52](https://github.com/tale/headplane/issues/52))
+
+### 0.3.5 (November 8, 2024)
+- Quickfix a bug where environment variables are ignored on the server.
+- Remove a nagging error about missing cookie since that happens when signed out.
+
+### 0.3.4 (November 7, 2024)
+- Clicking on the machine name in the users page now takes you to the machine overview page.
+- Completely rebuilt the production server to work better outside of Docker and be lighter. More specifically, we've switched from the `@remix-run/serve` package to our own custom built server.
+- Fixed a bunch of silly issues introduced by me not typechecking the codebase.
+- Improve documentation and support when running Headplane outside of Docker.
+- Removing Split DNS records will no longer result in an error (fixes [#40](https://github.com/tale/headplane/issues/40))
+- Removing the last ACL tag on a machine no longer results in an error (fixes [#41](https://github.com/tale/headplane/issues/41))
+- Added full support for Exit Nodes in the UI and redesigned the machines page (fixes [#36](https://github.com/tale/headplane/issues/36))
+- Added a basic check to see if the API keys passed via cookies are invalid.
+
+### 0.3.3 (October 28, 2024)
+- Added the ability to load a `.env` file from the PWD when `LOAD_ENV_FILE=true` is set as an environment variable.
+- Fixed an issue where non-English languages could not create Pre-auth keys due to a localization error
+- Improved ACL editor performance by switching back to CodeMirror 6
+- Fixed an issue where editing the ACL policy would cause it to revert on the UI (fixes [#34](https://github.com/tale/headplane/issues/34))
+- Updated to the next stable beta of the React 19 Compiler ([See More](https://react.dev/learn/react-compiler))
+
+### 0.3.2 (October 11, 2024)
+- Implement the ability to create and expire pre-auth keys (fixes [#22](https://github.com/tale/headplane/issues/22))
+- Fix machine registration not working as expected (fixes [#27](https://github.com/tale/headplane/issues/27))
+- Removed more references to usernames in MagicDNS hostnames (fixes [#35](https://github.com/tale/headplane/issues/35))
+- Handle `null` values on machine expiry when using a database like PostgreSQL.
+- Use `X-Forwarded-Proto` and `Host` headers for building the OIDC callback URL.
+
+### 0.3.1 (October 3, 2024)
+- Fixed the Docker integration to properly support custom socket paths. This regressed at some point previously.
+- Allow you to register a machine using machine keys (`nodekey:...`) on the machines page.
+- Added the option for debug logs with the `DEBUG=true` environment variable.
+
+### 0.3.0 (September 25, 2024)
+- Bumped the minimum supported version of Headscale to 0.23.
+- Updated the UI to respect `dns.use_username_in_magic_dns`.
+
+### 0.2.4 (August 24, 2024)
+- Removed ACL management from the integration since Headscale 0.23-beta2 now supports it natively.
+- Removed the `ACL_FILE` environment variable since it's no longer needed.
+- Introduce a `COOKIE_SECURE=false` environment variable to disable HTTPS requirements for cookies.
+- Fixed a bug where removing Split DNS configurations would crash the UI.
+
+### 0.2.3 (August 23, 2024)
+- Change the minimum required version of Headscale to 0.23-beta2
+- Support the new API policy mode for Headscale 0.23-beta1
+- Switch to the new DNS configuration in Headscale 0.23-beta2 (fixes [#29](https://github.com/tale/headplane/issues/29))
+- If OIDC environment variables are defined, don't use configuration file values (fixes [#24](https://github.com/tale/headplane/issues/24))
+
+### 0.2.2 (August 2, 2024)
+- Added a proper Kubernetes integration which utilizes `shareProcessNamespace` for PIDs.
+- Added a new logger utility that shows categories, levels, and timestamps.
+- Reimplemented the integration system to be more resilient and log more information.
+- Fixed an issue where the /proc integration found `undefined` PIDs.
+
+### 0.2.1 (July 7, 2024)
+- Added the ability to manage custom DNS records on your Tailnet.
+- ACL tags for machines are now able to be changed via the machine menu.
+- Fixed a bug where the ACL editor did not show the diffs correctly.
+- Fixed an issue that stopped the "Discard changes" button in the ACL editor from working.
+
+### 0.2.0 (June 23, 2024)
+- Fix the dropdown options for machines not working on the machines page.
+- Add an option to change the machine owner in the dropdown (aside from the users page).
+
+### 0.1.9 (June 2, 2024)
+- Switch to Monaco editor with proper HuJSON and YAML syntax highlighting.
+- Utilize magic DNS hostnames for the machine overview page.
+- Fixed the expiry issue once and for all.
+- Add a nightly build with the `ghcr.io/tale/headplane:edge` tag
+
+### 0.1.8 (June 2, 2024)
+- Built basic functionality for the machine overview page (by machine ID).
+- Possibly fixed an issue where expiry disabled machines' timestamps weren't handled correctly.
+- Prevent users from being deleted if they still have ownership of machines.
+- Fixed some type issues where `Date` was being used instead of `string` for timestamps.
+
+### 0.1.7 (May 30, 2024)
+- Added support for the `HEADSCALE_INTEGRATION` variable to allow for advanced integration without Docker.
+- Fixed a bug where the `expiry` field on the Headscale configuration could cause crashes.
+- Made the strict configuration loader more lenient to allow for more flexibility.
+- Added `HEADSCALE_CONFIG_UNSTRICT`=true to revert back to a weaker configuration loader.
+- Headplane's context now only loads once at start instead of being lazy-loaded.
+- Improved logging and error propagation so that it's easier to debug issues.
+
+### 0.1.6 (May 22, 2024)
+- Added experimental support for advanced integration without Docker.
+- Fixed a crash where the Docker integration tried to use `process.env.API_KEY` instead of context.
+- Fixed a crash where `ROOT_API_KEY` was not respected in the OIDC flow.
+
+### 0.1.5 (May 20, 2024)
+- Robust configuration handling with fallbacks based on the headscale source.
+- Support for `client_secret_path` on configuration file based OIDC.
+- `DISABLE_API_KEY_LOGIN` now works as expected (non 'true' values work).
+- `API_KEY` is renamed to `ROOT_API_KEY` for better clarity (old variable still works).
+- Fixed button responders not actually being invoked (should fix the ACL page).
+
+### 0.1.4 (May 15, 2024)
+
+- Users can now be created, renamed, and deleted on the users page.
+- Machines can be dragged between users to change their ownership.
+- The login page actually respects the `DISABLE_API_KEY_LOGIN` variable.
+- Implemented some fixes that should stop dialogs from hanging a webpage.
+- Upgrade to React 19 beta to take advantage of the compiler (may revert if it causes issues).
+- Upgrade other dependencies
+
 ### 0.1.3 (May 4, 2024)
 
 - Switched to a better icon set for the UI.

Dockerfile

@@ -2,7 +2,9 @@ FROM node:20-alpine AS build
 WORKDIR /app
 
 RUN npm install -g pnpm
+RUN apk add --no-cache git
 COPY package.json pnpm-lock.yaml ./
+COPY patches ./patches
 RUN pnpm install --frozen-lockfile
 
 COPY . .
@@ -18,4 +20,4 @@ RUN echo '{"type":"module"}' > /app/package.json
 EXPOSE 3000
 ENV NODE_ENV=production
 ENV HOST=0.0.0.0
-CMD [ "node_modules/.bin/remix-serve", "./build/server/index.js" ]
+CMD [ "node", "./build/headplane/server.js" ]

README.md

@@ -1,7 +1,20 @@
 # Headplane
 > An advanced UI for [juanfont/headscale](https://github.com/juanfont/headscale)
 
-![Preview](/assets/main-preview.png)
+<picture>
+    <source
+        media="(prefers-color-scheme: dark)"
+        srcset="./assets/preview-dark.png"
+    >
+    <source
+        media="(prefers-color-scheme: light)"
+        srcset="./assets/preview-light.png"
+    >
+    <img
+        alt="Preview"
+        src="./assets/preview-dark.png"
+    >
+</picture>
 
 Headscale is a self-hosted version of the Tailscale control server, however, it currently lacks a first-party web UI.
 Headplane aims to solve this issue by providing a GUI that can deeply integrate with the Headscale server.
@@ -13,9 +26,17 @@ It's able to replicate nearly all of the functions of the official Tailscale Saa
 - DNS and *safe* Headscale configuration management
 
 ## Deployment
-- If you run Headscale in a Docker container, see the [Advanced Deployment](/docs/Advanced-Integration.md) guide.
-- If you run Headscale natively, see the [Basic Deployment](/docs/Basic-Integration.md) guide.
-- For more configuration options, refer to the [Configuration](/docs/Configuration.md) guide.
+> For more configuration options, refer to the [Configuration](/docs/Configuration.md) guide.
+
+For fully-featured deployments, see the [Advanced Deployment](/docs/Advanced-Integration.md) guide.
+This includes automatic management of ACLs, DNS settings, and Headscale configuration.
+*This is the closest experience to the Tailscale UI that can be achieved with Headscale and Headplane.*
+*If you aren't sure which one to pick, we recommend this.*
+
+If your environment is not able to support the advanced deployment, you can still use the basic deployment.
+For basic deployments, see the [Basic Deployment](/docs/Basic-Integration.md) guide.
+It does not include automatic management of ACLs, DNS settings, or the Headscale configuration,
+instead requiring manual editing and reloading when making changes.
 
 ## Contributing
 If you would like to contribute, please install a relatively modern version of Node.js and PNPM.

agent.Dockerfile

@@ -0,0 +1,15 @@
+FROM golang:1.23 AS builder
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY agent/ ./agent
+RUN CGO_ENABLED=0 GOOS=linux go build \
+	-trimpath \
+	-ldflags "-s -w" \
+	-o /app/hp_agent ./agent/cmd/hp_agent
+
+FROM scratch
+COPY --from=builder /app/hp_agent /hp_agent
+ENTRYPOINT ["/hp_agent"]

agent/cmd/hp_agent/hp_agent.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	_ "github.com/joho/godotenv/autoload"
+	"github.com/tale/headplane/agent/config"
+	"github.com/tale/headplane/agent/tsnet"
+	"github.com/tale/headplane/agent/hpagent"
+	"log"
+)
+
+func main() {
+	cfg, err := config.Load()
+	if err != nil {
+		log.Fatalf("Failed to load configuration: %s", err)
+	}
+
+	agent := tsnet.NewAgent(
+		cfg.Hostname,
+		cfg.TSControlURL,
+		cfg.TSAuthKey,
+		cfg.Debug,
+	)
+
+	agent.StartAndFetchID()
+	defer agent.Shutdown()
+
+	ws, err := hpagent.NewSocket(
+		agent,
+		cfg.HPControlURL,
+		cfg.HPAuthKey,
+		cfg.Debug,
+	)
+
+	if err != nil {
+		log.Fatalf("Failed to create websocket: %s", err)
+	}
+
+	defer ws.StopListening()
+	ws.StartListening()
+}

agent/config/config.go

@@ -0,0 +1,55 @@
+package config
+
+import (
+	_ "github.com/joho/godotenv/autoload"
+	"os"
+)
+
+// Config represents the configuration for the agent.
+type Config struct {
+	Debug        bool
+	Hostname     string
+	TSControlURL string
+	TSAuthKey    string
+	HPControlURL string
+	HPAuthKey    string
+}
+
+const (
+	DebugEnv        = "HP_AGENT_DEBUG"
+	HostnameEnv     = "HP_AGENT_HOSTNAME"
+	TSControlURLEnv = "HP_AGENT_TS_SERVER"
+	TSAuthKeyEnv    = "HP_AGENT_TS_AUTHKEY"
+	HPControlURLEnv = "HP_AGENT_HP_SERVER"
+	HPAuthKeyEnv	= "HP_AGENT_HP_AUTHKEY"
+)
+
+// Load reads the agent configuration from environment variables.
+func Load() (*Config, error) {
+	c := &Config{
+		Debug:        false,
+		Hostname:     os.Getenv(HostnameEnv),
+		TSControlURL: os.Getenv(TSControlURLEnv),
+		TSAuthKey:    os.Getenv(TSAuthKeyEnv),
+		HPControlURL: os.Getenv(HPControlURLEnv),
+		HPAuthKey:    os.Getenv(HPAuthKeyEnv),
+	}
+
+	if os.Getenv(DebugEnv) == "true" {
+		c.Debug = true
+	}
+
+	if err := validateRequired(c); err != nil {
+		return nil, err
+	}
+
+	if err := validateTSReady(c); err != nil {
+		return nil, err
+	}
+
+	if err := validateHPReady(c); err != nil {
+		return nil, err
+	}
+
+	return c, nil
+}

agent/config/preflight.go

@@ -0,0 +1,73 @@
+package config
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// Checks to make sure all required environment variables are set
+func validateRequired(config *Config) error {
+	if config.Hostname == "" {
+		return fmt.Errorf("%s is required", HostnameEnv)
+	}
+
+	if config.TSControlURL == "" {
+		return fmt.Errorf("%s is required", TSControlURLEnv)
+	}
+
+	if config.HPControlURL == "" {
+		return fmt.Errorf("%s is required", HPControlURLEnv)
+	}
+
+	if config.TSAuthKey == "" {
+		return fmt.Errorf("%s is required", TSAuthKeyEnv)
+	}
+
+	if config.HPAuthKey == "" {
+		return fmt.Errorf("%s is required", HPAuthKeyEnv)
+	}
+
+	return nil
+}
+
+// Pings the Tailscale control server to make sure it's up and running
+func validateTSReady(config *Config) error {
+	testURL := config.TSControlURL
+	if strings.HasSuffix(testURL, "/") {
+		testURL = testURL[:len(testURL)-1]
+	}
+
+	// TODO: Consequences of switching to /health (headscale only)
+	testURL = fmt.Sprintf("%s/key?v=109", testURL)
+	resp, err := http.Get(testURL)
+	if err != nil {
+		return fmt.Errorf("Failed to connect to TS control server: %s", err)
+	}
+
+	if resp.StatusCode != 200 {
+		return fmt.Errorf("Failed to connect to TS control server: %s", resp.Status)
+	}
+
+	return nil
+}
+
+// Pings the Headplane server to make sure it's up and running
+func validateHPReady(config *Config) error {
+	testURL := config.HPControlURL
+	if strings.HasSuffix(testURL, "/") {
+		testURL = testURL[:len(testURL)-1]
+	}
+
+	testURL = fmt.Sprintf("%s/healthz", testURL)
+	resp, err := http.Get(testURL)
+	if err != nil {
+		return fmt.Errorf("Failed to connect to HP control server: %s", err)
+	}
+
+	if resp.StatusCode != 200 {
+		return fmt.Errorf("Failed to connect to HP control server: %s", resp.Status)
+	}
+
+	return nil
+}

agent/hpagent/handler.go

@@ -0,0 +1,83 @@
+package hpagent
+
+import (
+	"encoding/json"
+	"log"
+	"sync"
+	"tailscale.com/tailcfg"
+)
+
+// Represents messages from the Headplane master
+type RecvMessage struct {
+	NodeIDs []string `json:omitempty`
+}
+
+// Starts listening for messages from the Headplane master
+func (s *Socket) StartListening() {
+	for {
+		_, message, err := s.ReadMessage()
+		if err != nil {
+			log.Printf("error reading message: %v", err)
+			return
+		}
+
+		var msg RecvMessage
+		err = json.Unmarshal(message, &msg)
+		if err != nil {
+			log.Printf("error unmarshalling message: %v", err)
+			continue
+		}
+
+		if s.Debug {
+			log.Printf("got message: %s", message)
+		}
+
+		if len(msg.NodeIDs) == 0 {
+			log.Printf("got a message with no node IDs? %s", message)
+			continue
+		}
+
+		// Accumulate the results since we invoke via gofunc
+		results := make(map[string]*tailcfg.HostinfoView)
+		mu := sync.Mutex{}
+		wg := sync.WaitGroup{}
+
+		for _, nodeID := range msg.NodeIDs {
+			wg.Add(1)
+			go func(nodeID string) {
+				defer wg.Done()
+				result, err := s.Agent.GetStatusForPeer(nodeID)
+				if err != nil {
+					log.Printf("error getting status: %v", err)
+					return
+				}
+
+				if result == nil {
+					return
+				}
+
+				mu.Lock()
+				results[nodeID] = result
+				mu.Unlock()
+			}(nodeID)
+		}
+
+		wg.Wait()
+
+		// Send the results back to the Headplane master
+		err = s.SendStatus(results)
+		if err != nil {
+			log.Printf("error sending status: %v", err)
+			return
+		}
+
+		if s.Debug {
+			log.Printf("sent status: %s", results)
+		}
+	}
+}
+
+// Stops listening for messages from the Headplane master
+func (s *Socket) StopListening() {
+	s.Close()
+}

agent/hpagent/sender.go

@@ -0,0 +1,11 @@
+package hpagent
+
+import (
+	"tailscale.com/tailcfg"
+)
+
+// Sends the status to the Headplane master
+func (s *Socket) SendStatus(status map[string]*tailcfg.HostinfoView) error {
+	err := s.WriteJSON(status)
+	return err
+}

agent/hpagent/websocket.go

@@ -0,0 +1,56 @@
+package hpagent
+
+import (
+	"fmt"
+	"github.com/gorilla/websocket"
+	"github.com/tale/headplane/agent/tsnet"
+	"log"
+	"net/http"
+	"net/url"
+)
+
+type Socket struct {
+	*websocket.Conn
+	Debug bool
+	Agent *tsnet.TSAgent
+}
+
+// Creates a new websocket connection to the Headplane server.
+func NewSocket(agent *tsnet.TSAgent, controlURL, authKey string, debug bool) (*Socket, error) {
+	wsURL, err := httpToWs(controlURL)
+	if err != nil {
+		return nil, err
+	}
+
+	headers := http.Header{}
+	headers.Add("X-Headplane-TS-Node-ID", agent.ID)
+
+	auth := fmt.Sprintf("Bearer %s", authKey)
+	headers.Add("Authorization", auth)
+
+	log.Printf("dialing websocket at %s", wsURL)
+	ws, _, err := websocket.DefaultDialer.Dial(wsURL, headers)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Socket{ws, debug, agent}, nil
+}
+
+// We need to convert the control URL to a websocket URL
+func httpToWs(controlURL string) (string, error) {
+	u, err := url.Parse(controlURL)
+	if err != nil {
+		return "", err
+	}
+
+	if u.Scheme == "http" {
+		u.Scheme = "ws"
+	} else if u.Scheme == "https" {
+		u.Scheme = "wss"
+	} else {
+		return "", fmt.Errorf("unsupported scheme: %s", u.Scheme)
+	}
+
+	return u.String(), nil
+}

agent/tsnet/peers.go

@@ -0,0 +1,47 @@
+package tsnet
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+
+	"go4.org/mem"
+)
+
+// Returns the raw hostinfo for a peer based on node ID.
+func (s *TSAgent) GetStatusForPeer(id string) (*tailcfg.HostinfoView, error) {
+	if !strings.HasPrefix(id, "nodekey:") {
+		return nil, fmt.Errorf("invalid node ID: %s", id)
+	}
+
+	if s.Debug {
+		log.Printf("querying peer state for %s", id)
+	}
+
+	status, err := s.Lc.Status(context.Background())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get status: %w", err)
+	}
+
+	nodeKey, err := key.ParseNodePublicUntyped(mem.S(id[8:]))
+	peer := status.Peer[nodeKey]
+	if peer == nil {
+		// Check if we are on Self.
+		if status.Self.PublicKey == nodeKey {
+			peer = status.Self
+		} else {
+			return nil, nil
+		}
+	}
+
+	ip := peer.TailscaleIPs[0].String()
+	whois, err := s.Lc.WhoIs(context.Background(), ip)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get whois: %w", err)
+	}
+
+	return &whois.Node.Hostinfo, nil
+}

agent/tsnet/server.go

@@ -0,0 +1,61 @@
+package tsnet
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+
+	"tailscale.com/client/tailscale"
+	"tailscale.com/tsnet"
+)
+
+// Wrapper type so we can add methods to the server.
+type TSAgent struct {
+	*tsnet.Server
+	Lc *tailscale.LocalClient
+	ID string
+	Debug bool
+}
+
+// Creates a new tsnet agent and returns an instance of the server.
+func NewAgent(hostname, controlURL, authKey string, debug bool) *TSAgent {
+	s := &tsnet.Server{
+		Hostname:   hostname,
+		ControlURL: controlURL,
+		AuthKey:    authKey,
+		Logf:       func(string, ...interface{}) {}, // Disabled by default
+	}
+
+	if debug {
+		s.Logf = log.New(
+			os.Stderr,
+			fmt.Sprintf("[DBG:%s] ", hostname),
+			log.LstdFlags,
+		).Printf
+	}
+
+	return &TSAgent{s, nil, "", debug}
+}
+
+// Starts the tsnet agent and sets the node ID.
+func (s *TSAgent) StartAndFetchID() {
+	// Waits until the agent is up and running.
+	status, err := s.Up(context.Background())
+	if err != nil {
+		log.Fatalf("Failed to start agent: %v", err)
+	}
+
+	s.Lc, err = s.LocalClient()
+	if err != nil {
+		log.Fatalf("Failed to create local client: %v", err)
+	}
+
+	log.Printf("Agent running with ID: %s", status.Self.PublicKey)
+	s.ID = string(status.Self.ID)
+}
+
+// Shuts down the tsnet agent.
+func (s *TSAgent) Shutdown() {
+	s.Close()
+}

app/components/Attribute.tsx

@@ -1,40 +1,42 @@
-import { CopyIcon } from '@primer/octicons-react'
+import { CopyIcon } from '@primer/octicons-react';
+import { toast } from './Toaster';
 
-import { toast } from './Toaster'
-
-type Properties = {
-	readonly name: string;
-	readonly value: string;
-	readonly isCopyable?: boolean;
+interface Props {
+	name: string;
+	value: string;
+	isCopyable?: boolean;
+	link?: string;
 }
 
-export default function Attribute({ name, value, isCopyable }: Properties) {
-	const canCopy = isCopyable ?? false
+export default function Attribute({ name, value, link, isCopyable }: Props) {
+	const canCopy = isCopyable ?? false;
 	return (
-		<dl className='flex gap-1 text-sm w-full'>
-			<dt className='w-1/4 shrink-0 min-w-0 truncate text-gray-700 dark:text-gray-300 py-1'>
-				{name}
+		<dl className="flex gap-1 text-sm w-full">
+			<dt className="w-1/2 shrink-0 min-w-0 truncate text-gray-700 dark:text-gray-300 py-1">
+				{link ? (
+					<a className="hover:underline" href={link}>
+						{name}
+					</a>
+				) : (
+					name
+				)}
 			</dt>
 
-			{(canCopy ?? false) ? (
+			{canCopy ? (
 				<button
-					type='button'
-					className='focus:outline-none flex items-center gap-x-1 truncate hover:bg-zinc-100 dark:hover:bg-zinc-800 rounded-md'
+					type="button"
+					className="focus:outline-none flex items-center gap-x-1 truncate hover:bg-zinc-100 dark:hover:bg-zinc-800 rounded-md"
 					onClick={async () => {
-						await navigator.clipboard.writeText(value)
-						toast(`Copied ${name}`)
+						await navigator.clipboard.writeText(value);
+						toast(`Copied ${name}`);
 					}}
 				>
-					<dd className='min-w-0 truncate px-2 py-1'>
-						{value}
-					</dd>
-					<CopyIcon className='text-gray-600 dark:text-gray-200 pr-2 w-max h-4'/>
+					<dd className="min-w-0 truncate px-2 py-1">{value}</dd>
+					<CopyIcon className="text-gray-600 dark:text-gray-200 pr-2 w-max h-3" />
 				</button>
 			) : (
-				<dd className='min-w-0 truncate px-2 py-1'>
-					{value}
-				</dd>
+				<dd className="min-w-0 truncate px-2 py-1">{value}</dd>
 			)}
 		</dl>
-	)
+	);
 }

app/components/Button.tsx

@@ -1,26 +1,38 @@
-import clsx from 'clsx'
-import { type ButtonHTMLAttributes, type DetailedHTMLProps } from 'react'
+import type { Dispatch, SetStateAction } from 'react';
+import { Button as AriaButton } from 'react-aria-components';
+import { cn } from '~/utils/cn';
 
-type Properties = {
-	readonly variant?: 'emphasized' | 'normal' | 'destructive';
-} & DetailedHTMLProps<ButtonHTMLAttributes<HTMLButtonElement>, HTMLButtonElement>
+type Props = Parameters<typeof AriaButton>[0] & {
+	readonly control?: [boolean, Dispatch<SetStateAction<boolean>>];
+	readonly variant?: 'heavy' | 'light';
+};
 
-export default function Action(properties: Properties) {
+export default function Button(props: Props) {
 	return (
-		<button
-			type='button'
-			{...properties}
-			className={clsx(
-				'focus:outline-none focus:ring focus:ring-1',
-				'focus:ring-blue-500 dark:focus:ring-blue-300',
-				properties.className,
-				properties.disabled && 'opacity-50 cursor-not-allowed',
-				properties.variant === 'destructive' ? 'text-red-700 dark:text-red-500' : '',
-				properties.variant === 'emphasized' ? 'rounded-lg px-4 py-2 bg-gray-800 dark:bg-gray-700 text-white' : '',
-				!properties.variant || properties.variant === 'normal' ? 'text-blue-700 dark:text-blue-400' : ''
+		<AriaButton
+			{...props}
+			className={cn(
+				'w-fit text-sm rounded-lg px-4 py-2',
+				props.variant === 'heavy'
+					? 'bg-main-700 dark:bg-main-800'
+					: 'bg-main-200 dark:bg-main-700/30',
+				props.variant === 'heavy'
+					? 'hover:bg-main-800 dark:hover:bg-main-700'
+					: 'hover:bg-main-300 dark:hover:bg-main-600/30',
+				props.variant === 'heavy'
+					? 'text-white'
+					: 'text-ui-700 dark:text-ui-300',
+				props.isDisabled && 'opacity-50 cursor-not-allowed',
+				props.className,
 			)}
-		>
-			{properties.children}
-		</button>
-	)
+			// If control is passed, set the state value
+			onPress={
+				props.control
+					? () => {
+							props.control?.[1](true);
+						}
+					: props.onPress
+			}
+		/>
+	);
 }

app/components/Card.tsx

@@ -1,18 +1,43 @@
-import clsx from 'clsx'
-import { type HTMLProps } from 'react'
+import type { HTMLProps } from 'react';
+import { Heading as AriaHeading } from 'react-aria-components';
+import { cn } from '~/utils/cn';
 
-type Properties = HTMLProps<HTMLDivElement>
+function Title(props: Parameters<typeof AriaHeading>[0]) {
+	return (
+		<AriaHeading
+			{...props}
+			slot="title"
+			className={cn('text-lg font-semibold leading-6 mb-5', props.className)}
+		/>
+	);
+}
 
-export default function Card(properties: Properties) {
+function Text(props: React.HTMLProps<HTMLParagraphElement>) {
+	return (
+		<p {...props} className={cn('text-base leading-6 my-0', props.className)} />
+	);
+}
+
+type Props = HTMLProps<HTMLDivElement> & {
+	variant?: 'raised' | 'flat';
+};
+
+function Card(props: Props) {
 	return (
 		<div
-			{...properties}
-			className={clsx(
-				'p-4 md:p-6 border dark:border-zinc-700 rounded-lg',
-				properties.className
+			{...props}
+			className={cn(
+				'w-full max-w-md overflow-hidden rounded-xl p-4',
+				props.variant === 'flat'
+					? 'bg-transparent shadow-none'
+					: 'bg-ui-50 dark:bg-ui-900 shadow-sm',
+				'border border-ui-200 dark:border-ui-700',
+				props.className,
 			)}
 		>
-			{properties.children}
+			{props.children}
 		</div>
-	)
+	);
 }
+
+export default Object.assign(Card, { Title, Text });

app/components/Code.tsx

@@ -1,12 +1,51 @@
-import clsx from 'clsx'
-import { type HTMLProps } from 'react'
+import { useState, HTMLProps } from 'react';
+import { CopyIcon, CheckIcon } from '@primer/octicons-react';
+import { cn } from '~/utils/cn';
+import { toast } from '~/components/Toaster';
 
-type Properties = HTMLProps<HTMLSpanElement>
-
-export default function Code(properties: Properties) {
-	return (
-		<code className={clsx('bg-gray-100 dark:bg-zinc-700 p-0.5 rounded-md', properties.className)}>
-			{properties.children}
-		</code>
-	)
+interface Props extends HTMLProps<HTMLSpanElement> {
+	isCopyable?: boolean;
+}
+
+export default function Code(props: Props) {
+	const [isCopied, setIsCopied] = useState(false);
+
+	return (
+		<>
+			<code
+				className={cn(
+					'bg-ui-100 dark:bg-ui-800 p-0.5 rounded-md',
+					props.className,
+				)}
+			>
+				{props.children}
+			</code>
+			{props.isCopyable ? (
+				<button
+					className={cn(
+						'ml-1 p-1 rounded-md',
+						'bg-ui-100 dark:bg-ui-800',
+						'text-ui-500 dark:text-ui-400',
+						'inline-flex items-center justify-center',
+					)}
+					onClick={() => {
+						if (!props.children) {
+							throw new Error('Made copyable without children');
+						}
+
+						navigator.clipboard.writeText(props.children.join(''));
+						toast('Copied to clipboard');
+						setIsCopied(true);
+						setTimeout(() => setIsCopied(false), 1000);
+					}}
+				>
+					{isCopied ? (
+						<CheckIcon className="h-3 w-3" />
+					) : (
+						<CopyIcon className="h-3 w-3" />
+					)}
+				</button>
+			) : undefined}
+		</>
+	);
 }

app/components/Dialog.tsx

@@ -1,105 +1,99 @@
-/* eslint-disable unicorn/no-keyword-prefix */
-import { type Dispatch, type ReactNode, type SetStateAction } from 'react'
+import type { Dispatch, ReactNode, SetStateAction } from 'react';
 import {
 	Button as AriaButton,
 	Dialog as AriaDialog,
 	DialogTrigger,
 	Heading as AriaHeading,
 	Modal,
-	ModalOverlay
-} from 'react-aria-components'
+	ModalOverlay,
+} from 'react-aria-components';
+import { cn } from '~/utils/cn';
 
-import { cn } from '~/utils/cn'
-
-type ButtonProperties = Parameters<typeof AriaButton>[0] & {
+type ButtonProps = Parameters<typeof AriaButton>[0] & {
 	readonly control?: [boolean, Dispatch<SetStateAction<boolean>>];
-}
+};
 
-function Button(properties: ButtonProperties) {
+function Button(props: ButtonProps) {
 	return (
 		<AriaButton
-			{...properties}
-			aria-label='Dialog'
+			{...props}
+			aria-label="Dialog"
 			className={cn(
 				'w-fit text-sm rounded-lg px-4 py-2',
 				'bg-main-700 dark:bg-main-800 text-white',
-				properties.isDisabled && 'opacity-50 cursor-not-allowed',
-				properties.className
+				'hover:bg-main-800 dark:hover:bg-main-700',
+				props.isDisabled && 'opacity-50 cursor-not-allowed',
+				props.className,
 			)}
 			// If control is passed, set the state value
-			onPress={properties.control ? () => {
-				properties.control?.[1](true)
-			} : undefined}
+			onPress={
+				props.control
+					? () => {
+							props.control?.[1](true);
+						}
+					: undefined
+			}
 		/>
-	)
+	);
 }
 
-type ActionProperties = Parameters<typeof AriaButton>[0] & {
+type ActionProps = Parameters<typeof AriaButton>[0] & {
 	readonly variant: 'cancel' | 'confirm';
-}
+};
 
-function Action(properties: ActionProperties) {
+function Action(props: ActionProps) {
 	return (
 		<AriaButton
-			{...properties}
-			type={properties.variant === 'confirm' ? 'submit' : 'button'}
+			{...props}
+			type={props.variant === 'confirm' ? 'submit' : 'button'}
 			className={cn(
 				'px-4 py-2 rounded-lg',
-				properties.isDisabled && 'opacity-50 cursor-not-allowed',
-				properties.variant === 'cancel'
+				props.isDisabled && 'opacity-50 cursor-not-allowed',
+				props.variant === 'cancel'
 					? 'text-ui-700 dark:text-ui-300'
 					: 'text-ui-300 dark:text-ui-300',
-				properties.variant === 'confirm'
+				props.variant === 'confirm'
 					? 'bg-main-700 dark:bg-main-700 pressed:bg-main-800 dark:pressed:bg-main-800'
 					: 'bg-ui-200 dark:bg-ui-800 pressed:bg-ui-300 dark:pressed:bg-ui-700',
-				properties.className
+				props.className,
 			)}
 		/>
-	)
+	);
 }
 
-function Title(properties: Parameters<typeof AriaHeading>[0]) {
+function Title(props: Parameters<typeof AriaHeading>[0]) {
 	return (
 		<AriaHeading
-			{...properties}
-			slot='title'
-			className={cn(
-				'text-lg font-semibold leading-6 mb-5',
-				properties.className
-			)}
+			{...props}
+			slot="title"
+			className={cn('text-lg font-semibold leading-6 mb-5', props.className)}
 		/>
-	)
+	);
 }
 
-function Text(properties: React.HTMLProps<HTMLParagraphElement>) {
+function Text(props: React.HTMLProps<HTMLParagraphElement>) {
 	return (
-		<p
-			{...properties}
-			className={cn(
-				'text-base leading-6 my-0',
-				properties.className
-			)}
-		/>
-	)
+		<p {...props} className={cn('text-base leading-6 my-0', props.className)} />
+	);
 }
 
-type PanelProperties = {
-	readonly children: (close: () => void) => ReactNode;
-	readonly control?: [boolean, Dispatch<SetStateAction<boolean>>];
-	readonly className?: string;
+interface PanelProps {
+	children: (close: () => void) => ReactNode;
+	control?: [boolean, Dispatch<SetStateAction<boolean>>];
+	className?: string;
 }
 
-function Panel({ children, control, className }: PanelProperties) {
+function Panel({ children, control, className }: PanelProps) {
 	return (
 		<ModalOverlay
-			aria-hidden='true'
+			aria-hidden="true"
 			className={cn(
 				'fixed inset-0 h-screen w-screen z-50 bg-black/30',
 				'flex items-center justify-center dark:bg-black/70',
 				'entering:animate-in exiting:animate-out',
 				'entering:fade-in entering:duration-200 entering:ease-out',
 				'exiting:fade-out exiting:duration-100 exiting:ease-in',
-				className
+				className,
 			)}
 			isOpen={control ? control[0] : undefined}
 			onOpenChange={control ? control[1] : undefined}
@@ -111,32 +105,28 @@ function Panel({ children, control, className }: PanelProperties) {
 					'entering:animate-in exiting:animate-out',
 					'dark:border dark:border-ui-700',
 					'entering:zoom-in-95 entering:ease-out entering:duration-200',
-					'exiting:zoom-out-95 exiting:ease-in exiting:duration-100'
+					'exiting:zoom-out-95 exiting:ease-in exiting:duration-100',
 				)}
 			>
-				<AriaDialog role='alertdialog' className='outline-none relative'>
+				<AriaDialog role="alertdialog" className="outline-none relative">
 					{({ close }) => children(close)}
 				</AriaDialog>
 			</Modal>
 		</ModalOverlay>
-	)
+	);
 }
 
-type DialogProperties = {
-	readonly children: ReactNode;
-	readonly control?: [boolean, Dispatch<SetStateAction<boolean>>];
+interface DialogProps {
+	children: ReactNode;
+	control?: [boolean, Dispatch<SetStateAction<boolean>>];
 }
 
-function Dialog({ children, control }: DialogProperties) {
+function Dialog({ children, control }: DialogProps) {
 	if (control) {
-		return children
+		return children;
 	}
 
-	return (
-		<DialogTrigger>
-			{children}
-		</DialogTrigger>
-	)
+	return <DialogTrigger>{children}</DialogTrigger>;
 }
 
-export default Object.assign(Dialog, { Button, Title, Text, Panel, Action })
+export default Object.assign(Dialog, { Button, Title, Text, Panel, Action });

app/components/Error.tsx

@@ -1,52 +1,61 @@
-import { AlertIcon } from '@primer/octicons-react'
-import { isRouteErrorResponse, useRouteError } from '@remix-run/react'
-import { useState } from 'react'
+import { AlertIcon } from '@primer/octicons-react';
+import { isRouteErrorResponse, useRouteError } from 'react-router';
+import { cn } from '~/utils/cn';
+import Card from './Card';
+import Code from './Code';
 
-import { cn } from '~/utils/cn'
-
-import Code from './Code'
-import Dialog from './Dialog'
-
-type Properties = {
-	readonly type?: 'full' | 'embedded';
+interface Props {
+	type?: 'full' | 'embedded';
 }
 
-export function ErrorPopup({ type = 'full' }: Properties) {
-	// eslint-disable-next-line react/hook-use-state
-	const open = useState(true)
+function getMessage(error: Error | unknown) {
+	if (!(error instanceof Error)) {
+		return "An unknown error occurred";
+	}
 
-	const error = useRouteError()
-	const routing = isRouteErrorResponse(error)
-	const message = (error instanceof Error ? error.message : 'An unexpected error occurred')
+	let rootError = error;
+
+	// Traverse the error chain to find the root cause
+	if (error.cause) {
+		rootError = error.cause as Error;
+		while (rootError.cause) {
+			rootError = rootError.cause as Error;
+		}
+	}
+
+	// If we are aggregate, concat into a single message
+	if (rootError instanceof AggregateError) {
+		return rootError.errors.map((error) => error.message).join('\n');
+	}
+
+	return rootError.message;
+}
+
+export function ErrorPopup({ type = 'full' }: Props) {
+	const error = useRouteError();
+	const routing = isRouteErrorResponse(error);
+	const message = getMessage(error);
 
 	return (
-		<Dialog>
-			<Dialog.Panel
-				className={cn(
-					type === 'embedded' ? 'pointer-events-none bg-transparent dark:bg-transparent' : ''
-				)}
-				control={open}
-			>
-				{() => (
-					<>
-						<div className='flex items-center justify-between'>
-							<Dialog.Title className='text-3xl mb-0'>
-								{routing ? error.status : 'Error'}
-							</Dialog.Title>
-							<AlertIcon className='w-12 h-12 text-red-500'/>
-						</div>
-						<Dialog.Text className='mt-4 text-lg'>
-							{routing ? (
-								error.statusText
-							) : (
-								<Code>
-									{message}
-								</Code>
-							)}
-						</Dialog.Text>
-					</>
-				)}
-			</Dialog.Panel>
-		</Dialog>
-	)
+		<div
+			className={cn(
+				'flex items-center justify-center',
+				type === 'embedded'
+					? 'pointer-events-none mt-24'
+					: 'fixed inset-0 h-screen w-screen z-50',
+			)}
+		>
+			<Card>
+				<div className="flex items-center justify-between">
+					<Card.Title className="text-3xl mb-0">
+						{routing ? error.status : 'Error'}
+					</Card.Title>
+					<AlertIcon className="w-12 h-12 text-red-500" />
+				</div>
+				<Card.Text className="mt-4 text-lg">
+					{routing ? error.statusText : <Code>{message}</Code>}
+				</Card.Text>
+			</Card>
+		</div>
+	);
 }

app/components/Footer.tsx

@@ -0,0 +1,46 @@
+import { cn } from '~/utils/cn';
+import Link from '~/components/Link';
+import Tooltip from '~/components/Tooltip';
+
+declare global {
+	const __VERSION__: string;
+}
+
+interface FooterProps {
+	url: string;
+	debug: boolean;
+}
+
+export default function Footer({ url, debug }: FooterProps) {
+	return (
+		<footer
+			className={cn(
+				'fixed bottom-0 left-0 z-40 w-full h-14',
+				'bg-ui-100 dark:bg-ui-900 text-ui-500',
+				'flex flex-col justify-center gap-1',
+				'border-t border-ui-200 dark:border-ui-800',
+			)}
+		>
+			<p className="container text-xs">
+				Headplane is entirely free to use. If you find it useful, consider{' '}
+				<Link
+					to="https://github.com/sponsors/tale"
+					name="Aarnav's GitHub Sponsors"
+				>
+					donating
+				</Link>{' '}
+				to support development.{' '}
+			</p>
+			<p className="container text-xs opacity-75">
+				Version: {__VERSION__}
+				{' | '}
+				Connecting to
+				{' '}
+				<strong className="blur-xs hover:blur-none">
+					{url}
+				</strong>
+				{debug && ' (Debug mode enabled)'}
+			</p>
+		</footer>
+	);
+}

app/components/Header.tsx

@@ -1,89 +1,101 @@
-import { GearIcon, GlobeIcon, LockIcon, PaperAirplaneIcon, PeopleIcon, PersonIcon, ServerIcon } from '@primer/octicons-react'
-import { Form } from '@remix-run/react'
+import {
+	GearIcon,
+	GlobeIcon,
+	LockIcon,
+	PaperAirplaneIcon,
+	PeopleIcon,
+	PersonIcon,
+	ServerIcon,
+} from '@primer/octicons-react';
+import { Form } from 'react-router';
 
-import { cn } from '~/utils/cn'
-import { type Context } from '~/utils/config'
-import { type SessionData } from '~/utils/sessions'
+import { cn } from '~/utils/cn';
+import type { HeadplaneContext } from '~/utils/config/headplane';
+import type { SessionData } from '~/utils/sessions.server';
 
-import Menu from './Menu'
-import TabLink from './TabLink'
+import Menu from './Menu';
+import TabLink from './TabLink';
 
-type Properties = {
-	readonly data?: Context & { user?: SessionData['user'] };
+interface Props {
+	config: HeadplaneContext['config'];
+	user?: SessionData['user'];
 }
 
-type LinkProperties = {
-	readonly href: string;
-	readonly text: string;
-	readonly isMenu?: boolean;
+interface LinkProps {
+	href: string;
+	text: string;
+	isMenu?: boolean;
 }
 
-function Link({ href, text, isMenu }: LinkProperties) {
+function Link({ href, text, isMenu }: LinkProps) {
 	return (
 		<a
 			href={href}
-			target='_blank'
-			rel='noreferrer'
+			target="_blank"
+			rel="noreferrer"
 			className={cn(
-				!isMenu && 'text-ui-300 hover:text-ui-50 hover:underline hidden sm:block'
+				!isMenu &&
+					'text-ui-300 hover:text-ui-50 hover:underline hidden sm:block',
 			)}
 		>
 			{text}
 		</a>
-	)
+	);
 }
 
-export default function Header({ data }: Properties) {
+export default function Header(data: Props) {
 	return (
-		<header className='bg-main-700 dark:bg-main-800 text-ui-50'>
-			<div className='container flex items-center justify-between py-4'>
-				<div className='flex items-center gap-x-2'>
-					<PaperAirplaneIcon className='w-6 h-6'/>
-					<h1 className='text-2xl'>Headplane</h1>
+		<header className="bg-main-700 dark:bg-main-800 text-ui-50">
+			<div className="container flex items-center justify-between py-4">
+				<div className="flex items-center gap-x-2">
+					<PaperAirplaneIcon className="w-6 h-6" />
+					<h1 className="text-2xl">Headplane</h1>
 				</div>
-				<div className='flex items-center gap-x-4'>
-					<Link href='https://tailscale.com/download' text='Download'/>
-					<Link href='https://github.com/tale/headplane' text='GitHub'/>
-					<Link href='https://github.com/juanfont/headscale' text='Headscale'/>
-					{data?.user ? (
+				<div className="flex items-center gap-x-4">
+					<Link href="https://tailscale.com/download" text="Download" />
+					<Link href="https://github.com/tale/headplane" text="GitHub" />
+					<Link href="https://github.com/juanfont/headscale" text="Headscale" />
+					{data.user ? (
 						<Menu>
-							<Menu.Button className={cn(
-								'rounded-full h-9 w-9',
-								'border border-main-600 dark:border-main-700',
-								'hover:bg-main-600 dark:hover:bg-main-700'
-							)}
+							<Menu.Button
+								className={cn(
+									'rounded-full h-9 w-9',
+									'border border-main-600 dark:border-main-700',
+									'hover:bg-main-600 dark:hover:bg-main-700',
+									'flex items-center justify-center',
+								)}
 							>
-								<PersonIcon className='h-5 w-5 mt-0.5'/>
+								<PersonIcon className="h-5 w-5 mt-0.5" />
 							</Menu.Button>
 							<Menu.Items>
-								<Menu.Item className='text-right'>
-									<p className='font-bold'>{data.user.name}</p>
+								<Menu.Item className="text-right">
+									<p className="font-bold">{data.user.name}</p>
 									<p>{data.user.email}</p>
 								</Menu.Item>
-								<Menu.Item className='text-right sm:hidden'>
+								<Menu.Item className="text-right sm:hidden">
 									<Link
 										isMenu
-										href='https://tailscale.com/download'
-										text='Download'
+										href="https://tailscale.com/download"
+										text="Download"
 									/>
 								</Menu.Item>
-								<Menu.Item className='text-right sm:hidden'>
+								<Menu.Item className="text-right sm:hidden">
 									<Link
 										isMenu
-										href='https://github.com/tale/headplane'
-										text='GitHub'
+										href="https://github.com/tale/headplane"
+										text="GitHub"
 									/>
 								</Menu.Item>
-								<Menu.Item className='text-right sm:hidden'>
+								<Menu.Item className="text-right sm:hidden">
 									<Link
 										isMenu
-										href='https://github.com/juanfont/headscale'
-										text='Headscale'
+										href="https://github.com/juanfont/headscale"
+										text="Headscale"
 									/>
 								</Menu.Item>
-								<Menu.Item className='text-red-500 dark:text-red-400'>
-									<Form method='POST' action='/logout'>
-										<button type='submit' className='w-full text-right'>
+								<Menu.Item className="text-red-500 dark:text-red-400">
+									<Form method="POST" action="/logout">
+										<button type="submit" className="w-full text-right">
 											Logout
 										</button>
 									</Form>
@@ -93,17 +105,37 @@ export default function Header({ data }: Properties) {
 					) : undefined}
 				</div>
 			</div>
-			<nav className='container flex items-center gap-x-4 overflow-x-auto'>
-				<TabLink to='/machines' name='Machines' icon={<ServerIcon className='w-4 h-4'/>}/>
-				<TabLink to='/users' name='Users' icon={<PeopleIcon className='w-4 h-4'/>}/>
-				{data?.hasAcl ? <TabLink to='/acls' name='Access Control' icon={<LockIcon className='w-4 h-4'/>}/> : undefined}
-				{data?.hasConfig ? (
+			<nav className="container flex items-center gap-x-4 overflow-x-auto">
+				<TabLink
+					to="/machines"
+					name="Machines"
+					icon={<ServerIcon className="w-4 h-4" />}
+				/>
+				<TabLink
+					to="/users"
+					name="Users"
+					icon={<PeopleIcon className="w-4 h-4" />}
+				/>
+				<TabLink
+					to="/acls"
+					name="Access Control"
+					icon={<LockIcon className="w-4 h-4" />}
+				/>
+				{data.config.read ? (
 					<>
-						<TabLink to='/dns' name='DNS' icon={<GlobeIcon className='w-4 h-4'/>}/>
-						<TabLink to='/settings' name='Settings' icon={<GearIcon className='w-4 h-4'/>}/>
+						<TabLink
+							to="/dns"
+							name="DNS"
+							icon={<GlobeIcon className="w-4 h-4" />}
+						/>
+						<TabLink
+							to="/settings"
+							name="Settings"
+							icon={<GearIcon className="w-4 h-4" />}
+						/>
 					</>
 				) : undefined}
 			</nav>
 		</header>
-	)
+	);
 }

app/components/Input.tsx

@@ -1,26 +0,0 @@
-import clsx from 'clsx'
-import { type DetailedHTMLProps, type InputHTMLAttributes } from 'react'
-
-type Properties = {
-	readonly variant?: 'embedded' | 'normal';
-} & DetailedHTMLProps<InputHTMLAttributes<HTMLInputElement>, HTMLInputElement>
-
-export default function Input(properties: Properties) {
-	return (
-		<input
-			{...properties}
-			className={clsx(
-				'block w-full dark:text-gray-300',
-				'border-gray-300 dark:border-zinc-700',
-				'focus:outline-none focus:ring',
-				'focus:ring-blue-500 dark:focus:ring-blue-300',
-				properties.variant === 'embedded' ? 'bg-transparent' : 'dark:bg-zinc-800',
-				properties.variant === 'embedded' ? 'p-0' : 'px-2.5 py-1.5',
-				properties.variant === 'embedded' ? 'border-none' : 'border',
-				properties.variant === 'embedded' ? 'focus:ring-0' : 'focus:ring-1',
-				properties.variant === 'embedded' ? 'rounded-none' : 'rounded-lg',
-				properties.className
-			)}
-		/>
-	)
-}

app/components/Link.tsx

@@ -1,31 +1,29 @@
-import { LinkExternalIcon } from '@primer/octicons-react'
+import { LinkExternalIcon } from '@primer/octicons-react';
+import { cn } from '~/utils/cn';
 
-import { cn } from '~/utils/cn'
-
-/* eslint-disable unicorn/no-keyword-prefix */
-type Properties = {
-	readonly to: string;
-	readonly name: string;
-	readonly children: string;
-	readonly className?: string;
+interface Props {
+	to: string;
+	name: string;
+	children: string;
+	className?: string;
 }
 
-export default function Link({ to, name: alt, children, className }: Properties) {
+export default function Link({ to, name: alt, children, className }: Props) {
 	return (
 		<a
 			href={to}
 			aria-label={alt}
-			target='_blank'
-			rel='noreferrer'
+			target="_blank"
+			rel="noreferrer"
 			className={cn(
 				'inline-flex items-center gap-x-1',
 				'text-blue-500 hover:text-blue-700',
 				'dark:text-blue-400 dark:hover:text-blue-300',
-				className
+				className,
 			)}
 		>
 			{children}
-			<LinkExternalIcon className='h-3 w-3'/>
+			<LinkExternalIcon className="h-3 w-3" />
 		</a>
-	)
+	);
 }

app/components/Menu.tsx

@@ -1,98 +1,91 @@
-import { type Dispatch, type ReactNode, type SetStateAction } from 'react'
+import type { Dispatch, ReactNode, SetStateAction } from 'react';
 import {
 	Button as AriaButton,
 	Menu as AriaMenu,
 	MenuItem,
 	MenuTrigger,
-	Popover
-} from 'react-aria-components'
+	Popover,
+} from 'react-aria-components';
+import { cn } from '~/utils/cn';
 
-import { cn } from '~/utils/cn'
-
-function Button(properties: Parameters<typeof AriaButton>[0]) {
+function Button(props: Parameters<typeof AriaButton>[0]) {
 	return (
 		<AriaButton
-			{...properties}
-			className={cn(
-				'outline-none',
-				properties.className
-			)}
-			aria-label='Menu'
+			{...props}
+			className={cn('outline-none', props.className)}
+			aria-label="Menu"
 		/>
-	)
+	);
 }
 
-function Items(properties: Parameters<typeof AriaMenu>[0]) {
+function Items(props: Parameters<typeof AriaMenu>[0]) {
 	return (
-		<Popover className={cn(
-			'mt-2 rounded-md',
-			'bg-ui-50 dark:bg-ui-800',
-			'overflow-hidden z-50',
-			'border border-ui-200 dark:border-ui-600',
-			'entering:animate-in exiting:animate-out',
-			'entering:fade-in entering:zoom-in-95',
-			'exiting:fade-out exiting:zoom-out-95',
-			'fill-mode-forwards origin-left-right'
-		)}
+		<Popover
+			className={cn(
+				'mt-2 rounded-md',
+				'bg-ui-50 dark:bg-ui-800',
+				'overflow-hidden z-50',
+				'border border-ui-200 dark:border-ui-600',
+				'entering:animate-in exiting:animate-out',
+				'entering:fade-in entering:zoom-in-95',
+				'exiting:fade-out exiting:zoom-out-95',
+				'fill-mode-forwards origin-left-right',
+			)}
 		>
 			<AriaMenu
-				{...properties}
+				{...props}
 				className={cn(
 					'outline-none',
 					'divide-y divide-ui-200 dark:divide-ui-600',
-					properties.className
+					props.className,
 				)}
 			>
-				{properties.children}
+				{props.children}
 			</AriaMenu>
 		</Popover>
-	)
+	);
 }
 
-type ButtonProperties = Parameters<typeof AriaButton>[0] & {
+type ButtonProps = Parameters<typeof AriaButton>[0] & {
 	readonly control?: [boolean, Dispatch<SetStateAction<boolean>>];
-}
+};
 
-function ItemButton(properties: ButtonProperties) {
+function ItemButton(props: ButtonProps) {
 	return (
-		<MenuItem className='outline-none'>
+		<MenuItem className="outline-none">
 			<AriaButton
-				{...properties}
+				{...props}
 				className={cn(
 					'px-4 py-2 w-full outline-none text-left',
 					'hover:bg-ui-200 dark:hover:bg-ui-700',
-					properties.className
+					props.className,
 				)}
-				aria-label='Menu Dialog'
+				aria-label="Menu Dialog"
 				// If control is passed, set the state value
-				onPress={event => {
-					properties.onPress?.(event)
-					properties.control?.[1](true)
+				onPress={(event) => {
+					props.onPress?.(event);
+					props.control?.[1](true);
 				}}
 			/>
 		</MenuItem>
-	)
+	);
 }
 
-function Item(properties: Parameters<typeof MenuItem>[0]) {
+function Item(props: Parameters<typeof MenuItem>[0]) {
 	return (
 		<MenuItem
-			{...properties}
+			{...props}
 			className={cn(
 				'px-4 py-2 w-full outline-none',
 				'hover:bg-ui-200 dark:hover:bg-ui-700',
-				properties.className
+				props.className,
 			)}
 		/>
-	)
+	);
 }
 
-function Menu({ children }: { readonly children: ReactNode }) {
-	return (
-		<MenuTrigger>
-			{children}
-		</MenuTrigger>
-	)
+function Menu({ children }: { children: ReactNode }) {
+	return <MenuTrigger>{children}</MenuTrigger>;
 }
 
-export default Object.assign(Menu, { Button, Item, ItemButton, Items })
+export default Object.assign(Menu, { Button, Item, ItemButton, Items });

app/components/Notice.tsx

@@ -1,16 +1,23 @@
-import { InfoIcon } from '@primer/octicons-react'
-import clsx from 'clsx'
-import { type ReactNode } from 'react'
+import { InfoIcon } from '@primer/octicons-react';
+import type { ReactNode } from 'react';
+import { cn } from '~/utils/cn';
 
-export default function Notice({ children }: { readonly children: ReactNode }) {
+interface Props {
+	className?: string;
+	children: ReactNode;
+}
+
+export default function Notice({ children, className }: Props) {
 	return (
-		<div className={clsx(
-			'p-4 rounded-md w-fit flex items-center gap-3',
-			'bg-slate-400 dark:bg-slate-700'
-		)}
+		<div
+			className={cn(
+				'p-4 rounded-md w-full flex items-center gap-3',
+				'bg-ui-200 dark:bg-ui-800',
+				className,
+			)}
 		>
-			<InfoIcon className='h-6 w-6 text-white'/>
+			<InfoIcon className="h-6 w-6 text-ui-700 dark:text-ui-200" />
 			{children}
 		</div>
-	)
+	);
 }

app/components/NumberField.tsx

@@ -0,0 +1,46 @@
+import { PlusIcon, DashIcon } from '@primer/octicons-react';
+import type { Dispatch, SetStateAction } from 'react';
+import {
+	Button,
+	Group,
+	Input,
+	NumberField as AriaNumberField,
+} from 'react-aria-components';
+import { cn } from '~/utils/cn';
+
+type NumberFieldProps = Parameters<typeof AriaNumberField>[0] & {
+	label: string;
+	state?: [number, Dispatch<SetStateAction<number>>];
+};
+
+export default function NumberField(props: NumberFieldProps) {
+	return (
+		<AriaNumberField
+			{...props}
+			aria-label={props.label}
+			className="w-full"
+			value={props.state?.[0]}
+			onChange={(value) => {
+				props.state?.[1](value);
+			}}
+		>
+			<Group
+				className={cn(
+					'flex px-2.5 py-1.5 w-full rounded-lg my-1',
+					'border border-ui-200 dark:border-ui-600',
+					'dark:bg-ui-800 dark:text-ui-300 gap-2',
+					'focus-within:ring-2 focus-within:ring-blue-600',
+					props.className,
+				)}
+			>
+				<Input className="w-full bg-transparent focus:outline-none" />
+				<Button slot="decrement">
+					<DashIcon className="w-4 h-4" />
+				</Button>
+				<Button slot="increment">
+					<PlusIcon className="w-4 h-4" />
+				</Button>
+			</Group>
+		</AriaNumberField>
+	);
+}

app/components/Select.tsx

@@ -0,0 +1,80 @@
+import { ChevronDownIcon } from '@primer/octicons-react';
+import type { Dispatch, ReactNode, SetStateAction } from 'react';
+import {
+	Button,
+	ListBox,
+	ListBoxItem,
+	Popover,
+	Select as AriaSelect,
+	SelectValue,
+} from 'react-aria-components';
+import { cn } from '~/utils/cn';
+
+type SelectProps = Parameters<typeof AriaSelect>[0] & {
+	readonly label: string;
+	readonly state?: [string, Dispatch<SetStateAction<string>>];
+	readonly children: ReactNode;
+};
+
+function Select(props: SelectProps) {
+	return (
+		<AriaSelect
+			{...props}
+			aria-label={props.label}
+			selectedKey={props.state?.[0]}
+			onSelectionChange={(key) => {
+				props.state?.[1](key.toString());
+			}}
+			className={cn(
+				'block w-full rounded-lg my-1',
+				'border border-ui-200 dark:border-ui-600',
+				'bg-white dark:bg-ui-800 dark:text-ui-300',
+				'focus-within:outline-6',
+				props.className,
+			)}
+		>
+			<Button
+				className={cn(
+					'w-full flex items-center justify-between',
+					'px-2.5 py-1.5 rounded-lg',
+				)}
+			>
+				<SelectValue />
+				<ChevronDownIcon className="w-4 h-4" aria-hidden="true" />
+			</Button>
+			<Popover
+				className={cn(
+					'mt-2 rounded-md w-[var(--trigger-width)]',
+					'bg-ui-100 dark:bg-ui-800 shadow-sm',
+					'z-50 overflow-y-auto',
+					'border border-ui-200 dark:border-ui-600',
+					'entering:animate-in exiting:animate-out',
+					'entering:fade-in entering:zoom-in-95',
+					'exiting:fade-out exiting:zoom-out-95',
+					'fill-mode-forwards origin-left-right',
+				)}
+			>
+				<ListBox orientation="vertical">{props.children}</ListBox>
+			</Popover>
+		</AriaSelect>
+	);
+}
+
+type ItemProps = Parameters<typeof ListBoxItem>[0];
+
+function Item(props: ItemProps) {
+	return (
+		<ListBoxItem
+			{...props}
+			className={cn(
+				'px-4 py-2 w-full outline-none w-full',
+				'hover:bg-ui-200 dark:hover:bg-ui-700',
+				props.className,
+			)}
+		>
+			{props.children}
+		</ListBoxItem>
+	);
+}
+
+export default Object.assign(Select, { Item });

app/components/Spinner.tsx

@@ -1,23 +1,22 @@
-import clsx from 'clsx'
+import clsx from 'clsx';
 
-type Properties = {
-	// eslint-disable-next-line unicorn/no-keyword-prefix
+interface Props {
 	className?: string;
 }
 
-export default function Spinner(properties: Properties) {
+export default function Spinner({ className }: Props) {
 	return (
-		<div className={clsx('mr-1.5 inline-block align-middle mb-0.5', properties.className)}>
+		<div className={clsx('mr-1.5 inline-block align-middle mb-0.5', className)}>
 			<div
 				className={clsx(
 					'animate-spin rounded-full w-full h-full',
 					'border-2 border-current border-t-transparent',
-					properties.className
+					className,
 				)}
-				role='status'
+				role="status"
 			>
-				<span className='sr-only'>Loading...</span>
+				<span className="sr-only">Loading...</span>
 			</div>
 		</div>
-	)
+	);
 }

app/components/StatusCircle.tsx

@@ -1,24 +1,24 @@
-import clsx from 'clsx'
-import { type HTMLProps } from 'react'
+import clsx from 'clsx';
+import type { HTMLProps } from 'react';
 
-type Properties = HTMLProps<SVGElement> & {
+type Props = HTMLProps<SVGElement> & {
 	readonly isOnline: boolean;
-}
+};
 
 // eslint-disable-next-line unicorn/no-keyword-prefix
-export default function StatusCircle({ isOnline, className }: Properties) {
+export default function StatusCircle({ isOnline, className }: Props) {
 	return (
 		<svg
 			className={clsx(
 				className,
 				isOnline
 					? 'text-green-700 dark:text-green-400'
-					: 'text-gray-300 dark:text-gray-500'
+					: 'text-gray-300 dark:text-gray-500',
 			)}
-			viewBox='0 0 24 24'
-			fill='currentColor'
+			viewBox="0 0 24 24"
+			fill="currentColor"
 		>
-			<circle cx='12' cy='12' r='8'/>
+			<circle cx="12" cy="12" r="8" />
 		</svg>
-	)
+	);
 }

app/components/Switch.tsx

@@ -1,40 +1,34 @@
-import { Switch as AriaSwitch } from 'react-aria-components'
+import { Switch as AriaSwitch } from 'react-aria-components';
+import { cn } from '~/utils/cn';
 
-import { cn } from '~/utils/cn'
-
-type SwitchProperties = Parameters<typeof AriaSwitch>[0] & {
+type SwitchProps = Parameters<typeof AriaSwitch>[0] & {
 	readonly label: string;
-}
+};
 
-export default function Switch(properties: SwitchProperties) {
+export default function Switch(props: SwitchProps) {
 	return (
 		<AriaSwitch
-			{...properties}
-			aria-label={properties.label}
-			className='group flex gap-2 items-center'
+			{...props}
+			aria-label={props.label}
+			className="group flex gap-2 items-center"
 		>
 			<div
 				className={cn(
-					'flex h-[26px] w-[44px] shrink-0 cursor-default',
-					'rounded-full shadow-inner bg-clip-padding',
-					'border border-solid border-white/30 p-[3px]',
-					'box-border transition duration-100 ease-in-out',
-					'outline-none group-focus-visible:ring-2 ring-black',
-
-					'bg-main-700 dark:bg-main-800',
-					'group-pressed:bg-main-800 dark:group-pressed:bg-main-900',
-					'group-selected:bg-main-900 group-selected:group-pressed:bg-main-900',
-					properties.isDisabled && 'opacity-50 cursor-not-allowed',
-					properties.className
+					'flex h-[26px] w-[44px] p-[4px] shrink-0',
+					'rounded-full outline-none group-focus-visible:ring-2',
+					'bg-main-600/50 dark:bg-main-600/20 group-selected:bg-main-700',
+					props.isDisabled && 'opacity-50 cursor-not-allowed',
+					props.className,
 				)}
 			>
-				<span className={cn(
-					'h-[18px] w-[18px] transform rounded-full',
-					'bg-white shadow transition duration-100',
-					'ease-in-out translate-x-0 group-selected:translate-x-[100%]'
-				)}
+				<span
+					className={cn(
+						'h-[18px] w-[18px] transform rounded-full',
+						'bg-white transition duration-100 ease-in-out',
+						'translate-x-0 group-selected:translate-x-[100%]',
+					)}
 				/>
 			</div>
 		</AriaSwitch>
-	)
+	);
 }

app/components/TabLink.tsx

@@ -1,24 +1,33 @@
-import { NavLink } from '@remix-run/react'
-import clsx from 'clsx'
-import type { ReactNode } from 'react'
+import { NavLink } from 'react-router';
+import type { ReactNode } from 'react';
+import { cn } from '~/utils/cn';
 
-type Properties = {
-	readonly name: string;
-	readonly to: string;
-	readonly icon: ReactNode;
+interface Props {
+	name: string;
+	to: string;
+	icon: ReactNode;
 }
 
-export default function TabLink({ name, to, icon }: Properties) {
+export default function TabLink({ name, to, icon }: Props) {
 	return (
 		<NavLink
 			to={to}
-			className={({ isActive, isPending }) => clsx(
-				'flex items-center gap-x-2 p-2 border-b-2 text-md text-nowrap',
-				isActive ? 'border-white' : 'border-transparent',
-				isPending && 'animate-pulse'
-			)}
+			prefetch="intent"
+			className={({ isActive }) =>
+				cn(
+					'border-b-2 py-1.5',
+					isActive ? 'border-white' : 'border-transparent',
+				)
+			}
 		>
-			{icon} {name}
+			<div
+				className={cn(
+					'flex items-center gap-x-2 px-2.5 py-1.5 text-md text-nowrap',
+					'hover:bg-ui-100/5 dark:hover:bg-ui-900/40 rounded-md',
+				)}
+			>
+				{icon} {name}
+			</div>
 		</NavLink>
-	)
+	);
 }

app/components/TableList.tsx

@@ -1,37 +1,36 @@
-import clsx from 'clsx'
-import { type HTMLProps } from 'react'
+import clsx from 'clsx';
+import type { HTMLProps } from 'react';
 
-function TableList(properties: HTMLProps<HTMLDivElement>) {
+function TableList(props: HTMLProps<HTMLDivElement>) {
 	return (
 		<div
-			{...properties}
+			{...props}
 			className={clsx(
 				'border border-gray-300 rounded-lg overflow-clip',
 				'dark:border-zinc-700 dark:text-gray-300',
 				// 'dark:bg-zinc-800',
-				properties.className
+				props.className,
 			)}
 		>
-			{properties.children}
+			{props.children}
 		</div>
-	)
+	);
 }
 
-function Item(properties: HTMLProps<HTMLDivElement>) {
+function Item(props: HTMLProps<HTMLDivElement>) {
 	return (
 		<div
-			{...properties}
+			{...props}
 			className={clsx(
-
 				'flex items-center justify-between px-3 py-2',
 				'border-b border-gray-200 last:border-b-0',
 				'dark:border-zinc-800',
-				properties.className
+				props.className,
 			)}
 		>
-			{properties.children}
+			{props.children}
 		</div>
-	)
+	);
 }
 
-export default Object.assign(TableList, { Item })
+export default Object.assign(TableList, { Item });

app/components/TextField.tsx

@@ -1,38 +1,30 @@
-import { type Dispatch, type SetStateAction } from 'react'
-import {
-	Input,
-	TextField as AriaTextField
-} from 'react-aria-components'
+import type { Dispatch, SetStateAction } from 'react';
+import { Input, TextField as AriaTextField } from 'react-aria-components';
+import { cn } from '~/utils/cn';
 
-import { cn } from '~/utils/cn'
-
-type TextFieldProperties = Parameters<typeof AriaTextField>[0] & {
+type TextFieldProps = Parameters<typeof AriaTextField>[0] & {
 	readonly label: string;
 	readonly placeholder: string;
-	readonly state: [string, Dispatch<SetStateAction<string>>];
-}
+	readonly state?: [string, Dispatch<SetStateAction<string>>];
+};
 
-export default function TextField(properties: TextFieldProperties) {
+export default function TextField(props: TextFieldProps) {
 	return (
-		<AriaTextField
-			{...properties}
-			aria-label={properties.label}
-			className='w-full'
-		>
+		<AriaTextField {...props} aria-label={props.label} className="w-full">
 			<Input
-				placeholder={properties.placeholder}
-				value={properties.state[0]}
-				name={properties.name}
+				placeholder={props.placeholder}
+				value={props.state?.[0]}
+				name={props.name}
 				className={cn(
 					'block px-2.5 py-1.5 w-full rounded-lg my-1',
 					'border border-ui-200 dark:border-ui-600',
 					'dark:bg-ui-800 dark:text-ui-300',
-					properties.className
+					props.className,
 				)}
-				onChange={event => {
-					properties.state[1](event.target.value)
+				onChange={(event) => {
+					props.state?.[1](event.target.value);
 				}}
 			/>
 		</AriaTextField>
-	)
+	);
 }

app/components/Toaster.tsx

@@ -1,20 +1,32 @@
-import { XIcon } from '@primer/octicons-react'
-import { type AriaToastProps, useToast, useToastRegion } from '@react-aria/toast'
-import { ToastQueue, type ToastState, useToastQueue } from '@react-stately/toast'
-import { type ReactNode, useRef } from 'react'
-import { Button } from 'react-aria-components'
-import { createPortal } from 'react-dom'
-import { ClientOnly } from 'remix-utils/client-only'
+import { XIcon } from '@primer/octicons-react';
+import {
+	AriaToastProps,
+	useToast,
+	useToastRegion,
+} from '@react-aria/toast';
+import {
+	ToastQueue,
+	ToastState,
+	useToastQueue,
+} from '@react-stately/toast';
+import { ReactNode, useRef } from 'react';
+import { Button } from 'react-aria-components';
+import { createPortal } from 'react-dom';
+import { ClientOnly } from 'remix-utils/client-only';
+import { cn } from '~/utils/cn';
 
-import { cn } from '~/utils/cn'
-
-type ToastProperties = AriaToastProps<ReactNode> & {
+type ToastProps = AriaToastProps<ReactNode> & {
 	readonly state: ToastState<ReactNode>;
-}
+};
 
-function Toast({ state, ...properties }: ToastProperties) {
-	const reference = useRef(null)
-	const { toastProps, titleProps, closeButtonProps } = useToast(properties, state, reference)
+function Toast({ state, ...properties }: ToastProps) {
+	const reference = useRef(null);
+
+	const { toastProps, titleProps, closeButtonProps } = useToast(
+		properties,
+		state,
+		reference,
+	);
 
 	return (
 		<div
@@ -24,7 +36,7 @@ function Toast({ state, ...properties }: ToastProperties) {
 				'bg-main-700 dark:bg-main-800 rounded-lg',
 				'text-main-100 dark:text-main-200 z-50',
 				'border border-main-600 dark:border-main-700',
-				'flex items-center justify-between p-3 pl-4 w-80'
+				'flex items-center justify-between p-3 pl-4 w-80',
 			)}
 		>
 			<div {...titleProps}>{properties.toast.content}</div>
@@ -32,48 +44,48 @@ function Toast({ state, ...properties }: ToastProperties) {
 				{...closeButtonProps}
 				className={cn(
 					'outline-none rounded-full p-1',
-					'hover:bg-main-600 dark:hover:bg-main-700'
+					'hover:bg-main-600 dark:hover:bg-main-700',
 				)}
 			>
-				<XIcon className='w-4 h-4'/>
+				<XIcon className="w-4 h-4" />
 			</Button>
 		</div>
-	)
+	);
 }
 
 const toasts = new ToastQueue<ReactNode>({
-	maxVisibleToasts: 5
-})
+	maxVisibleToasts: 5,
+});
 
 export function toast(text: string) {
-	return toasts.add(text, { timeout: 5000 })
+	return toasts.add(text, { timeout: 5000 });
 }
 
 export function Toaster() {
-	const reference = useRef(null)
-	const state = useToastQueue(toasts)
-	const { regionProps } = useToastRegion({}, state, reference)
+	const reference = useRef(null);
+	const state = useToastQueue(toasts);
+
+	const { regionProps } = useToastRegion({}, state, reference);
 
 	return (
 		<ClientOnly>
-			{() => createPortal(
-				state.visibleToasts.length >= 0 ? (
-					<div
-						className={cn(
-							'fixed bottom-4 right-4',
-							'flex flex-col gap-4'
-						)}
-						{...regionProps}
-						ref={reference}
-					>
-						{state.visibleToasts.map(toast => (
-							<Toast key={toast.key} toast={toast} state={state}/>
-						))}
-					</div>
-				) : undefined,
-				document.body
-			)}
+			{
+				() =>
+					createPortal(
+						state.visibleToasts.length >= 0 ? (
+							<div
+								className={cn('fixed bottom-20 right-4', 'flex flex-col gap-4')}
+								{...regionProps}
+								ref={reference}
+							>
+								{state.visibleToasts.map((toast) => (
+									<Toast key={toast.key} toast={toast} state={state} />
+								))}
+							</div>
+						) : undefined,
+						document.body,
+					)
+			}
 		</ClientOnly>
-	)
+	);
 }
-

app/components/Tooltip.tsx

@@ -0,0 +1,37 @@
+import type { ReactNode } from 'react';
+import {
+	Button as AriaButton,
+	Tooltip as AriaTooltip,
+	TooltipTrigger,
+} from 'react-aria-components';
+import { cn } from '~/utils/cn';
+
+interface Props {
+	children: ReactNode;
+	className?: string;
+}
+
+function Tooltip({ children }: Props) {
+	return <TooltipTrigger delay={0}>{children}</TooltipTrigger>;
+}
+
+function Button(props: Parameters<typeof AriaButton>[0]) {
+	return <AriaButton {...props} />;
+}
+
+function Body({ children, className }: Props) {
+	return (
+		<AriaTooltip
+			className={cn(
+				'text-sm max-w-xs p-2 rounded-lg mb-2',
+				'bg-white dark:bg-ui-900 drop-shadow-sm',
+				'border border-gray-200 dark:border-zinc-700',
+				className,
+			)}
+		>
+			{children}
+		</AriaTooltip>
+	);
+}
+
+export default Object.assign(Tooltip, { Button, Body });

app/entry.client.tsx

@@ -1,18 +1,12 @@
-/**
- * By default, Remix will handle hydrating your app on the client for you.
- * You are free to delete this file if you'd like to, but if you ever want it revealed again, you can run `npx remix reveal` ✨
- * For more information, see https://remix.run/file-conventions/entry.client
- */
-
-import { RemixBrowser } from '@remix-run/react'
-import { startTransition, StrictMode } from 'react'
-import { hydrateRoot } from 'react-dom/client'
+import { startTransition, StrictMode } from "react";
+import { hydrateRoot } from "react-dom/client";
+import { HydratedRouter } from "react-router/dom";
 
 startTransition(() => {
-	hydrateRoot(
-		document,
-		<StrictMode>
-			<RemixBrowser/>
-		</StrictMode>
-	)
-})
+  hydrateRoot(
+    document,
+    <StrictMode>
+      <HydratedRouter />
+    </StrictMode>
+  );
+});

app/entry.server.tsx

@@ -1,137 +1,71 @@
-/**
- * By default, Remix will handle generating the HTTP Response for you.
- * You are free to delete this file if you'd like to, but if you ever want it revealed again, you can run `npx remix reveal` ✨
- * For more information, see https://remix.run/file-conventions/entry.server
- */
+import { PassThrough } from "node:stream";
 
-import { PassThrough } from 'node:stream'
+import type { AppLoadContext, EntryContext } from "react-router";
+import { createReadableStreamFromReadable } from "@react-router/node";
+import { ServerRouter } from "react-router";
+import { isbot } from "isbot";
+import type { RenderToPipeableStreamOptions } from "react-dom/server";
+import { renderToPipeableStream } from "react-dom/server";
+import { loadContext } from "~/utils/config/headplane";
 
-import type { EntryContext } from '@remix-run/node'
-import { createReadableStreamFromReadable } from '@remix-run/node'
-import { RemixServer } from '@remix-run/react'
-import { isbot } from 'isbot'
-import { renderToPipeableStream } from 'react-dom/server'
+loadContext();
 
-// eslint-disable-next-line @typescript-eslint/naming-convention
-const ABORT_DELAY = 5000
+export const streamTimeout = 5_000;
 
-export default async function handleRequest(
-	request: Request,
-	responseStatusCode: number,
-	responseHeaders: Headers,
-	remixContext: EntryContext
+export default function handleRequest(
+  request: Request,
+  responseStatusCode: number,
+  responseHeaders: Headers,
+  routerContext: EntryContext,
+  loadContext: AppLoadContext
 ) {
-	return isbot(request.headers.get('user-agent') ?? '')
-		? handleBotRequest(
-			request,
-			responseStatusCode,
-			responseHeaders,
-			remixContext
-		)
-		: handleBrowserRequest(
-			request,
-			responseStatusCode,
-			responseHeaders,
-			remixContext
-		)
-}
-
-async function handleBotRequest(
-	request: Request,
-	responseStatusCode: number,
-	responseHeaders: Headers,
-	remixContext: EntryContext
-) {
-	return new Promise((resolve, reject) => {
-		let shellRendered = false
-		const { pipe, abort } = renderToPipeableStream(
-			<RemixServer
-				context={remixContext}
-				url={request.url}
-				abortDelay={ABORT_DELAY}
-			/>,
-			{
-				onAllReady() {
-					shellRendered = true
-					const body = new PassThrough()
-					const stream = createReadableStreamFromReadable(body)
-
-					responseHeaders.set('Content-Type', 'text/html')
-
-					resolve(
-						new Response(stream, {
-							headers: responseHeaders,
-							status: responseStatusCode
-						})
-					)
-
-					pipe(body)
-				},
-				onShellError(error: unknown) {
-					reject(error)
-				},
-				onError(error: unknown) {
-					responseStatusCode = 500
-					// Log streaming rendering errors from inside the shell.  Don't log
-					// errors encountered during initial shell rendering since they'll
-					// reject and get logged in handleDocumentRequest.
-					if (shellRendered) {
-						console.error(error)
-					}
-				}
-			}
-		)
-
-		setTimeout(abort, ABORT_DELAY)
-	})
-}
-
-async function handleBrowserRequest(
-	request: Request,
-	responseStatusCode: number,
-	responseHeaders: Headers,
-	remixContext: EntryContext
-) {
-	return new Promise((resolve, reject) => {
-		let shellRendered = false
-		const { pipe, abort } = renderToPipeableStream(
-			<RemixServer
-				context={remixContext}
-				url={request.url}
-				abortDelay={ABORT_DELAY}
-			/>,
-			{
-				onShellReady() {
-					shellRendered = true
-					const body = new PassThrough()
-					const stream = createReadableStreamFromReadable(body)
-
-					responseHeaders.set('Content-Type', 'text/html')
-
-					resolve(
-						new Response(stream, {
-							headers: responseHeaders,
-							status: responseStatusCode
-						})
-					)
-
-					pipe(body)
-				},
-				onShellError(error: unknown) {
-					reject(error)
-				},
-				onError(error: unknown) {
-					responseStatusCode = 500
-					// Log streaming rendering errors from inside the shell.  Don't log
-					// errors encountered during initial shell rendering since they'll
-					// reject and get logged in handleDocumentRequest.
-					if (shellRendered) {
-						console.error(error)
-					}
-				}
-			}
-		)
-
-		setTimeout(abort, ABORT_DELAY)
-	})
+  return new Promise((resolve, reject) => {
+    let shellRendered = false;
+    const userAgent = request.headers.get("user-agent");
+
+    // Ensure requests from bots and SPA Mode renders wait for all content to load before responding
+    // https://react.dev/reference/react-dom/server/renderToPipeableStream#waiting-for-all-content-to-load-for-crawlers-and-static-generation
+    const readyOption: keyof RenderToPipeableStreamOptions =
+      (userAgent && isbot(userAgent)) || routerContext.isSpaMode
+        ? "onAllReady"
+        : "onShellReady";
+
+    const { pipe, abort } = renderToPipeableStream(
+      <ServerRouter context={routerContext} url={request.url} />,
+      {
+        [readyOption]() {
+          shellRendered = true;
+          const body = new PassThrough();
+          const stream = createReadableStreamFromReadable(body);
+
+          responseHeaders.set("Content-Type", "text/html");
+
+          resolve(
+            new Response(stream, {
+              headers: responseHeaders,
+              status: responseStatusCode,
+            })
+          );
+
+          pipe(body);
+        },
+        onShellError(error: unknown) {
+          reject(error);
+        },
+        onError(error: unknown) {
+          responseStatusCode = 500;
+          // Log streaming rendering errors from inside the shell.  Don't log
+          // errors encountered during initial shell rendering since they'll
+          // reject and get logged in handleDocumentRequest.
+          if (shellRendered) {
+            console.error(error);
+          }
+        },
+      }
+    );
+
+    // Abort the rendering stream after the `streamTimeout` so it has tine to
+    // flush down the rejected boundaries
+    setTimeout(abort, streamTimeout + 1000);
+  });
 }

app/integration/docker.ts

@@ -0,0 +1,149 @@
+import { access, constants } from 'node:fs/promises';
+import { setTimeout } from 'node:timers/promises';
+
+import { Client } from 'undici';
+
+import { HeadscaleError, pull } from '~/utils/headscale';
+import log from '~/utils/log';
+
+import { createIntegration } from './integration';
+
+interface Context {
+	client: Client | undefined;
+	container: string | undefined;
+	maxAttempts: number;
+}
+
+export default createIntegration<Context>({
+	name: 'Docker',
+	context: {
+		client: undefined,
+		container: undefined,
+		maxAttempts: 10,
+	},
+	isAvailable: async (context) => {
+		// Check for the HEADSCALE_CONTAINER environment variable first
+		// to avoid unnecessary fetching of the Docker socket
+		log.debug('INTG', 'Checking Docker integration availability');
+		context.container = process.env.HEADSCALE_CONTAINER?.trim().toLowerCase();
+
+		if (!context.container || context.container.length === 0) {
+			log.error('INTG', 'Missing HEADSCALE_CONTAINER variable');
+			return false;
+		}
+
+		log.info('INTG', 'Using container: %s', context.container);
+		const path = process.env.DOCKER_SOCK ?? 'unix:///var/run/docker.sock';
+		let url: URL | undefined;
+
+		try {
+			url = new URL(path);
+		} catch {
+			log.error('INTG', 'Invalid Docker socket path: %s', path);
+			return false;
+		}
+
+		if (url.protocol !== 'tcp:' && url.protocol !== 'unix:') {
+			log.error('INTG', 'Invalid Docker socket protocol: %s', url.protocol);
+			return false;
+		}
+
+		// The API is available as an HTTP endpoint and this
+		// will simplify the fetching logic in undici
+		if (url.protocol === 'tcp:') {
+			// Apparently setting url.protocol doesn't work anymore?
+			const fetchU = url.href.replace(url.protocol, 'http:');
+
+			try {
+				log.info('INTG', 'Checking API: %s', fetchU);
+				await fetch(new URL('/v1.30/version', fetchU).href);
+			} catch (error) {
+				log.debug('INTG', 'Failed to connect to Docker API', error);
+				log.error('INTG', 'Failed to connect to Docker API');
+				return false;
+			}
+
+			context.client = new Client(fetchU);
+		}
+
+		// Check if the socket is accessible
+		if (url.protocol === 'unix:') {
+			try {
+				log.info('INTG', 'Checking socket: %s', url.pathname);
+				await access(url.pathname, constants.R_OK);
+			} catch (error) {
+				log.debug('INTG', 'Failed to access Docker socket: %s', error);
+				log.error('INTG', 'Failed to access Docker socket: %s', path);
+				return false;
+			}
+
+			context.client = new Client('http://localhost', {
+				socketPath: url.pathname,
+			});
+		}
+
+		return context.client !== undefined;
+	},
+
+	onConfigChange: async (context) => {
+		if (!context.client || !context.container) {
+			return;
+		}
+
+		log.info('INTG', 'Restarting Headscale via Docker');
+
+		let attempts = 0;
+		while (attempts <= context.maxAttempts) {
+			log.debug(
+				'INTG',
+				'Restarting container: %s (attempt %d)',
+				context.container,
+				attempts,
+			);
+
+			const response = await context.client.request({
+				method: 'POST',
+				path: `/v1.30/containers/${context.container}/restart`,
+			});
+
+			if (response.statusCode !== 204) {
+				if (attempts < context.maxAttempts) {
+					attempts++;
+					await setTimeout(1000);
+					continue;
+				}
+
+				const stringCode = response.statusCode.toString();
+				const body = await response.body.text();
+				throw new Error(`API request failed: ${stringCode} ${body}`);
+			}
+
+			break;
+		}
+
+		attempts = 0;
+		while (attempts <= context.maxAttempts) {
+			try {
+				log.debug('INTG', 'Checking Headscale status (attempt %d)', attempts);
+				await pull('v1', '');
+				return;
+			} catch (error) {
+				if (error instanceof HeadscaleError && error.status === 401) {
+					break;
+				}
+
+				if (error instanceof HeadscaleError && error.status === 404) {
+					break;
+				}
+
+				if (attempts < context.maxAttempts) {
+					attempts++;
+					await setTimeout(1000);
+					continue;
+				}
+
+				throw new Error(`Missed restart deadline for ${context.container}`);
+			}
+		}
+	},
+});

app/integration/index.ts

@@ -0,0 +1,68 @@
+import log from '~/utils/log';
+
+import dockerIntegration from './docker';
+import type { IntegrationFactory } from './integration';
+import kubernetesIntegration from './kubernetes';
+import procIntegration from './proc';
+
+export * from './integration';
+
+export async function loadIntegration() {
+	let integration = process.env.HEADSCALE_INTEGRATION?.trim().toLowerCase();
+
+	// Old HEADSCALE_CONTAINER variable upgrade path
+	// This ensures that when people upgrade from older versions of Headplane
+	// they don't explicitly need to define the new HEADSCALE_INTEGRATION
+	// variable that is needed to configure docker
+	if (!integration && process.env.HEADSCALE_CONTAINER) {
+		integration = 'docker';
+	}
+
+	if (!integration) {
+		log.info('INTG', 'No integration set with HEADSCALE_INTEGRATION');
+		return;
+	}
+
+	let integrationFactory: IntegrationFactory | undefined;
+	switch (integration.toLowerCase().trim()) {
+		case 'docker': {
+			integrationFactory = dockerIntegration;
+			break;
+		}
+
+		case 'proc':
+		case 'native':
+		case 'linux': {
+			integrationFactory = procIntegration;
+			break;
+		}
+
+		case 'kubernetes':
+		case 'k8s': {
+			integrationFactory = kubernetesIntegration;
+			break;
+		}
+
+		default: {
+			log.error('INTG', 'Unknown integration: %s', integration);
+			throw new Error(`Unknown integration: ${integration}`);
+		}
+	}
+
+	log.info('INTG', 'Loading integration: %s', integration);
+	try {
+		const res = await integrationFactory.isAvailable(
+			integrationFactory.context,
+		);
+		if (!res) {
+			log.error('INTG', 'Integration %s is not available', integration);
+			return;
+		}
+	} catch (error) {
+		log.error('INTG', 'Failed to load integration %s: %s', integration, error);
+		return;
+	}
+
+	log.info('INTG', 'Loaded integration: %s', integration);
+	return integrationFactory;
+}

app/integration/integration.ts

@@ -0,0 +1,11 @@
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export interface IntegrationFactory<T = any> {
+	name: string;
+	context: T;
+	isAvailable: (context: T) => Promise<boolean> | boolean;
+	onConfigChange?: (context: T) => Promise<void> | void;
+}
+
+export function createIntegration<T>(options: IntegrationFactory<T>) {
+	return options;
+}

app/integration/kubernetes.ts

@@ -0,0 +1,211 @@
+import { readdir, readFile } from 'node:fs/promises';
+import { platform } from 'node:os';
+import { join, resolve } from 'node:path';
+import { kill } from 'node:process';
+
+import { Config, CoreV1Api, KubeConfig } from '@kubernetes/client-node';
+
+import log from '~/utils/log';
+
+import { createIntegration } from './integration';
+
+interface Context {
+	pid: number | undefined;
+}
+
+export default createIntegration<Context>({
+	name: 'Kubernetes (k8s)',
+	context: {
+		pid: undefined,
+	},
+	isAvailable: async (context) => {
+		if (platform() !== 'linux') {
+			log.error('INTG', 'Kubernetes is only available on Linux');
+			return false;
+		}
+
+		const svcRoot = Config.SERVICEACCOUNT_ROOT;
+		try {
+			log.debug('INTG', 'Checking Kubernetes service account at %s', svcRoot);
+			const files = await readdir(svcRoot);
+			if (files.length === 0) {
+				log.error('INTG', 'Kubernetes service account not found');
+				return false;
+			}
+
+			const mappedFiles = new Set(files.map((file) => join(svcRoot, file)));
+			const expectedFiles = [
+				Config.SERVICEACCOUNT_CA_PATH,
+				Config.SERVICEACCOUNT_TOKEN_PATH,
+				Config.SERVICEACCOUNT_NAMESPACE_PATH,
+			];
+
+			log.debug('INTG', 'Looking for %s', expectedFiles.join(', '));
+			if (!expectedFiles.every((file) => mappedFiles.has(file))) {
+				log.error('INTG', 'Malformed Kubernetes service account');
+				return false;
+			}
+		} catch (error) {
+			log.error('INTG', 'Failed to access %s: %s', svcRoot, error);
+			return false;
+		}
+
+		log.debug('INTG', 'Reading Kubernetes service account at %s', svcRoot);
+		const namespace = await readFile(
+			Config.SERVICEACCOUNT_NAMESPACE_PATH,
+			'utf8',
+		);
+
+		// Some very ugly nesting but it's necessary
+		if (process.env.HEADSCALE_INTEGRATION_UNSTRICT === 'true') {
+			log.warn('INTG', 'Skipping strict Pod status check');
+		} else {
+			const pod = process.env.POD_NAME;
+			if (!pod) {
+				log.error('INTG', 'Missing POD_NAME variable');
+				return false;
+			}
+
+			if (pod.trim().length === 0) {
+				log.error('INTG', 'Pod name is empty');
+				return false;
+			}
+
+			log.debug(
+				'INTG',
+				'Checking Kubernetes pod %s in namespace %s',
+				pod,
+				namespace,
+			);
+
+			try {
+				log.debug('INTG', 'Attempgin to get cluster KubeConfig');
+				const kc = new KubeConfig();
+				kc.loadFromCluster();
+
+				const cluster = kc.getCurrentCluster();
+				if (!cluster) {
+					log.error('INTG', 'Malformed kubeconfig');
+					return false;
+				}
+
+				log.info(
+					'INTG',
+					'Service account connected to %s (%s)',
+					cluster.name,
+					cluster.server,
+				);
+
+				const kCoreV1Api = kc.makeApiClient(CoreV1Api);
+
+				log.info(
+					'INTG',
+					'Checking pod %s in namespace %s (%s)',
+					pod,
+					namespace,
+					kCoreV1Api.basePath,
+				);
+
+				log.debug('INTG', 'Reading pod info for %s', pod);
+				const { response, body } = await kCoreV1Api.readNamespacedPod(
+					pod,
+					namespace,
+				);
+
+				if (response.statusCode !== 200) {
+					log.error(
+						'INTG',
+						'Failed to read pod info: http %d',
+						response.statusCode,
+					);
+					return false;
+				}
+
+				log.debug('INTG', 'Got pod info: %o', body.spec);
+				const shared = body.spec?.shareProcessNamespace;
+				if (shared === undefined) {
+					log.error('INTG', 'Pod does not have spec.shareProcessNamespace set');
+					return false;
+				}
+
+				if (!shared) {
+					log.error(
+						'INTG',
+						'Pod has set but disabled spec.shareProcessNamespace',
+					);
+					return false;
+				}
+
+				log.info('INTG', 'Pod %s enabled shared processes', pod);
+			} catch (error) {
+				log.error('INTG', 'Failed to read pod info: %s', error);
+				return false;
+			}
+		}
+
+		log.debug('INTG', 'Looking for namespaced process in /proc');
+		const dir = resolve('/proc');
+		try {
+			const subdirs = await readdir(dir);
+			const promises = subdirs.map(async (dir) => {
+				const pid = Number.parseInt(dir, 10);
+
+				if (Number.isNaN(pid)) {
+					return;
+				}
+
+				const path = join('/proc', dir, 'cmdline');
+				try {
+					log.debug('INTG', 'Reading %s', path);
+					const data = await readFile(path, 'utf8');
+					if (data.includes('headscale')) {
+						return pid;
+					}
+				} catch (error) {
+					log.debug('INTG', 'Failed to read %s: %s', path, error);
+				}
+			});
+
+			const results = await Promise.allSettled(promises);
+			const pids = [];
+
+			for (const result of results) {
+				if (result.status === 'fulfilled' && result.value) {
+					pids.push(result.value);
+				}
+			}
+
+			log.debug('INTG', 'Found Headscale processes: %o', pids);
+			if (pids.length > 1) {
+				log.error(
+					'INTG',
+					'Found %d Headscale processes: %s',
+					pids.length,
+					pids.join(', '),
+				);
+				return false;
+			}
+
+			if (pids.length === 0) {
+				log.error('INTG', 'Could not find Headscale process');
+				return false;
+			}
+
+			context.pid = pids[0];
+			log.info('INTG', 'Found Headscale process with PID: %d', context.pid);
+			return true;
+		} catch {
+			log.error('INTG', 'Failed to read /proc');
+			return false;
+		}
+	},
+
+	onConfigChange: (context) => {
+		if (!context.pid) {
+			return;
+		}
+
+		log.info('INTG', 'Sending SIGTERM to Headscale');
+		kill(context.pid, 'SIGTERM');
+	},
+});

app/integration/proc.ts

@@ -0,0 +1,81 @@
+import { readdir, readFile } from 'node:fs/promises';
+import { platform } from 'node:os';
+import { join, resolve } from 'node:path';
+import { kill } from 'node:process';
+
+import log from '~/utils/log';
+
+import { createIntegration } from './integration';
+
+interface Context {
+	pid: number | undefined;
+}
+
+export default createIntegration<Context>({
+	name: 'Native Linux (/proc)',
+	context: {
+		pid: undefined,
+	},
+	isAvailable: async (context) => {
+		if (platform() !== 'linux') {
+			log.error('INTG', '/proc is only available on Linux');
+			return false;
+		}
+
+		log.debug('INTG', 'Checking /proc for Headscale process');
+		const dir = resolve('/proc');
+		try {
+			const subdirs = await readdir(dir);
+			const promises = subdirs.map(async (dir) => {
+				const pid = Number.parseInt(dir, 10);
+
+				if (Number.isNaN(pid)) {
+					return;
+				}
+
+				const path = join('/proc', dir, 'cmdline');
+				try {
+					log.debug('INTG', 'Reading %s', path);
+					const data = await readFile(path, 'utf8');
+					if (data.includes('headscale')) {
+						return pid;
+					}
+				} catch (error) {
+					log.error('INTG', 'Failed to read %s: %s', path, error);
+				}
+			});
+
+			const results = await Promise.allSettled(promises);
+			const pids = [];
+
+			for (const result of results) {
+				if (result.status === 'fulfilled' && result.value) {
+					pids.push(result.value);
+				}
+			}
+
+			log.debug('INTG', 'Found Headscale processes: %o', pids);
+			if (pids.length > 1) {
+				log.error(
+					'INTG',
+					'Found %d Headscale processes: %s',
+					pids.length,
+					pids.join(', '),
+				);
+				return false;
+			}
+
+			if (pids.length === 0) {
+				log.error('INTG', 'Could not find Headscale process');
+				return false;
+			}
+
+			context.pid = pids[0];
+			log.info('INTG', 'Found Headscale process with PID: %d', context.pid);
+			return true;
+		} catch {
+			log.error('INTG', 'Failed to read /proc');
+			return false;
+		}
+	},
+});

app/layouts/dashboard.tsx

@@ -0,0 +1,77 @@
+import { type LoaderFunctionArgs, redirect } from 'react-router';
+import { Outlet, useLoaderData } from 'react-router';
+import { useEffect } from 'react'
+
+import { ErrorPopup } from '~/components/Error';
+import Header from '~/components/Header';
+import { toast } from '~/components/Toaster';
+import Footer from '~/components/Footer';
+import Link from '~/components/Link';
+import { useLiveData } from '~/utils/useLiveData'
+import { cn } from '~/utils/cn';
+import { loadContext } from '~/utils/config/headplane';
+import { HeadscaleError, pull, healthcheck } from '~/utils/headscale';
+import { destroySession, getSession } from '~/utils/sessions.server';
+import { XCircleFillIcon } from '@primer/octicons-react';
+import log from '~/utils/log';
+
+export async function loader({ request }: LoaderFunctionArgs) {
+	let healthy = false;
+	try {
+		healthy = await healthcheck();
+	} catch (error) {
+		log.debug('APIC', 'Healthcheck failed %o', error);
+	}
+
+	// We shouldn't session invalidate if Headscale is down
+	if (healthy) {
+		// We can assert because shell ensures this is set
+		const session = await getSession(request.headers.get('Cookie'));
+		const apiKey = session.get('hsApiKey')!;
+
+		try {
+			await pull('v1/apikey', apiKey);
+		} catch (error) {
+			if (error instanceof HeadscaleError) {
+				log.debug('APIC', 'API Key validation failed %o', error);
+				return redirect('/login', {
+					headers: {
+						'Set-Cookie': await destroySession(session),
+					},
+				});
+			}
+		}
+	}
+
+	return {
+		healthy,
+	}
+}
+
+export default function Layout() {
+	useLiveData({ interval: 3000 });
+	const { healthy } = useLoaderData<typeof loader>()
+
+	return (
+		<>
+			{!healthy ? (
+				<div className={cn(
+					'fixed bottom-0 right-0 z-50 w-fit h-14',
+					'flex flex-col justify-center gap-1',
+				)}>
+					<div className={cn(
+						'flex items-center gap-1.5 mr-1.5 py-2 px-1.5',
+						'border rounded-lg text-white bg-red-500',
+						'border-red-600 dark:border-red-400 shadow-sm',
+					)}>
+						<XCircleFillIcon className="w-4 h-4 text-white" />
+						Headscale is unreachable
+					</div>
+				</div>
+			) : undefined}
+			<main className="container mx-auto overscroll-contain mt-4 mb-24">
+				<Outlet />
+			</main>
+		</>
+	);
+}

app/layouts/shell.tsx

@@ -0,0 +1,33 @@
+import Header from '~/components/Header';
+import Footer from '~/components/Footer';
+import { getSession } from '~/utils/sessions.server';
+import { loadContext } from '~/utils/config/headplane';
+import { useLoaderData, LoaderFunctionArgs, Outlet, redirect } from 'react-router';
+
+// This loads the bare minimum for the application to function
+// So we know that if context fails to load then well, oops?
+export async function loader({ request }: LoaderFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	if (!session.has('hsApiKey')) {
+		return redirect('/login');
+	}
+
+	const context = await loadContext();
+	return {
+		config: context.config,
+		url: context.headscalePublicUrl ?? context.headscaleUrl,
+		debug: context.debug,
+		user: session.get('user'),
+	};
+}
+
+export default function Shell() {
+	const data = useLoaderData<typeof loader>();
+	return (
+		<>
+			<Header {...data} />
+			<Outlet />
+			<Footer {...data} />
+		</>
+	)
+}

app/root.tsx

@@ -1,65 +1,64 @@
-import type { LinksFunction, MetaFunction } from '@remix-run/node'
-import {
-	Links,
-	Meta,
-	Outlet,
-	Scripts,
-	ScrollRestoration
-} from '@remix-run/react'
+import type { LoaderFunctionArgs, LinksFunction, MetaFunction } from 'react-router';
+import { Links, Meta, Outlet, Scripts, ScrollRestoration, useNavigation } from 'react-router';
+import { loadContext } from '~/utils/config/headplane';
 
-import { ErrorPopup } from '~/components/Error'
-import { Toaster } from '~/components/Toaster'
-import stylesheet from '~/tailwind.css?url'
-import { getContext, registerConfigWatcher } from '~/utils/config'
+import { ProgressBar } from 'react-aria-components';
+import { ErrorPopup } from '~/components/Error';
+// TODO: Make this a default export
+import { Toaster } from '~/components/Toaster';
+import stylesheet from '~/tailwind.css?url';
+import { cn } from '~/utils/cn';
 
 export const meta: MetaFunction = () => [
 	{ title: 'Headplane' },
-	{ name: 'description', content: 'A frontend for the headscale coordination server' }
-]
+	{
+		name: 'description',
+		content: 'A frontend for the headscale coordination server',
+	},
+];
 
 export const links: LinksFunction = () => [
-	{ rel: 'stylesheet', href: stylesheet }
-]
-
-export async function loader() {
-	const context = await getContext()
-	registerConfigWatcher()
-
-	if (context.headscaleUrl.length === 0) {
-		throw new Error('No headscale URL was provided either by the HEADSCALE_URL environment variable or the config file')
-	}
-
-	if (!process.env.COOKIE_SECRET) {
-		throw new Error('The COOKIE_SECRET environment variable is required')
-	}
-
-	// eslint-disable-next-line unicorn/no-null
-	return null
-}
+	{ rel: 'stylesheet', href: stylesheet },
+];
 
 export function Layout({ children }: { readonly children: React.ReactNode }) {
 	return (
-		<html lang='en'>
+		<html lang="en">
 			<head>
-				<meta charSet='utf-8'/>
-				<meta name='viewport' content='width=device-width, initial-scale=1'/>
-				<Meta/>
-				<Links/>
+				<meta charSet="utf-8" />
+				<meta name="viewport" content="width=device-width, initial-scale=1" />
+				<Meta />
+				<Links />
 			</head>
-			<body className='overscroll-none dark:bg-zinc-900 dark:text-white'>
+			<body className="overscroll-none dark:bg-ui-950 dark:text-ui-50">
 				{children}
-				<Toaster/>
-				<ScrollRestoration/>
-				<Scripts/>
+				<Toaster />
+				<ScrollRestoration />
+				<Scripts />
 			</body>
 		</html>
-	)
+	);
 }
 
 export function ErrorBoundary() {
-	return <ErrorPopup/>
+	return <ErrorPopup />;
 }
 
 export default function App() {
-	return <Outlet/>
+	const nav = useNavigation();
+
+	return (
+		<>
+			<ProgressBar aria-label="Loading...">
+				<div
+					className={cn(
+						'fixed top-0 left-0 z-50 w-1/2 h-1',
+						'bg-blue-500 dark:bg-blue-400 opacity-0',
+						nav.state === 'loading' && 'animate-loading opacity-100',
+					)}
+				/>
+			</ProgressBar>
+			<Outlet />
+		</>
+	)
 }

app/routes.ts

@@ -0,0 +1,34 @@
+import { index, layout, prefix, route } from '@react-router/dev/routes';
+
+export default [
+	// Utility Routes
+	index('routes/util/redirect.ts'),
+	route('/healthz', 'routes/util/healthz.ts'),
+
+	// Authentication Routes
+	route('/login', 'routes/auth/login.tsx'),
+	route('/logout', 'routes/auth/logout.ts'),
+	route('/oidc/callback', 'routes/auth/oidc-callback.ts'),
+	route('/oidc/start', 'routes/auth/oidc-start.ts'),
+
+	// All the main logged-in dashboard routes
+	// Double nested to separate error propagations
+	layout('layouts/shell.tsx', [
+		layout('layouts/dashboard.tsx', [
+			...prefix('/machines', [
+				index('routes/machines/overview.tsx'),
+				route('/:id', 'routes/machines/machine.tsx'),
+			]),
+
+			route('/users', 'routes/users/overview.tsx'),
+			route('/acls', 'routes/acls/editor.tsx'),
+			route('/dns', 'routes/dns/overview.tsx'),
+
+			...prefix('/settings', [
+				index('routes/settings/overview.tsx'),
+				route('/auth-keys', 'routes/settings/auth-keys.tsx'),
+				// route('/local-agent', 'routes/settings/local-agent.tsx'),
+			]),
+		]),
+	]),
+];

app/routes/_data.acls._index/editor.tsx

@@ -1,122 +0,0 @@
-import { json } from '@codemirror/lang-json'
-import { yaml } from '@codemirror/lang-yaml'
-import { useFetcher } from '@remix-run/react'
-import { githubDark, githubLight } from '@uiw/codemirror-theme-github'
-import CodeMirror from '@uiw/react-codemirror'
-import clsx from 'clsx'
-import { useEffect, useMemo, useState } from 'react'
-import CodeMirrorMerge from 'react-codemirror-merge'
-
-import Button from '~/components/Button'
-import Spinner from '~/components/Spinner'
-import { toast } from '~/components/Toaster'
-
-import Fallback from './fallback'
-
-type EditorProperties = {
-	readonly acl: string;
-	readonly setAcl: (acl: string) => void;
-	readonly mode: 'edit' | 'diff';
-
-	readonly data: {
-		hasAclWrite: boolean;
-		currentAcl: string;
-		aclType: string;
-	};
-}
-
-export default function Editor({ data, acl, setAcl, mode }: EditorProperties) {
-	const [light, setLight] = useState(false)
-	const [loading, setLoading] = useState(true)
-
-	const fetcher = useFetcher()
-	const aclType = useMemo(() => data.aclType === 'json' ? json() : yaml(), [data.aclType])
-
-	useEffect(() => {
-		const theme = window.matchMedia('(prefers-color-scheme: light)')
-		setLight(theme.matches)
-
-		theme.addEventListener('change', theme => {
-			setLight(theme.matches)
-		})
-
-		// Prevents the FOUC
-		setLoading(false)
-	}, [])
-
-	return (
-		<>
-			<div className={clsx(
-				'border border-gray-200 dark:border-gray-700',
-				'rounded-b-lg rounded-tr-lg mb-2 z-10 overflow-x-hidden'
-			)}
-			>
-				<div className='overflow-y-scroll h-editor text-sm'>
-					{loading ? (
-						<Fallback acl={acl} where='client'/>
-					) : (
-						mode === 'edit' ? (
-							<CodeMirror
-								value={acl}
-								theme={light ? githubLight : githubDark}
-								extensions={[aclType]}
-								readOnly={!data.hasAclWrite}
-								onChange={value => {
-									setAcl(value)
-								}}
-							/>
-						) : (
-							<CodeMirrorMerge
-								theme={light ? githubLight : githubDark}
-								orientation='a-b'
-							>
-								<CodeMirrorMerge.Original
-									readOnly
-									value={data.currentAcl}
-									extensions={[aclType]}
-								/>
-								<CodeMirrorMerge.Modified
-									readOnly
-									value={acl}
-									extensions={[aclType]}
-								/>
-							</CodeMirrorMerge>
-						)
-					)}
-				</div>
-			</div>
-
-			<Button
-				variant='emphasized'
-				className='text-sm w-fit mr-2'
-				onClick={() => {
-					fetcher.submit({
-						acl
-					}, {
-						method: 'PATCH',
-						encType: 'application/json'
-					})
-
-					toast('Updated tailnet ACL policy')
-				}}
-			>
-				{fetcher.state === 'idle' ? undefined : (
-					<Spinner className='w-3 h-3'/>
-				)}
-				Save
-			</Button>
-			<Button
-				variant='emphasized'
-				className={clsx(
-					'text-sm w-fit bg-gray-100 dark:bg-transparent',
-					'border border-gray-200 dark:border-gray-700'
-				)}
-				onClick={() => {
-					setAcl(data.currentAcl)
-				}}
-			>
-				Discard Changes
-			</Button>
-		</>
-	)
-}

app/routes/_data.acls._index/fallback.tsx

@@ -1,51 +0,0 @@
-import clsx from 'clsx'
-
-import Button from '~/components/Button'
-
-type FallbackProperties = {
-	readonly acl: string;
-	readonly where: 'client' | 'server';
-}
-
-export default function Fallback({ acl, where }: FallbackProperties) {
-	return (
-		<>
-			<div className={clsx(
-				where === 'server' ? 'mb-2 overflow-hidden rounded-tr-lg rounded-b-lg' : '',
-				where === 'server' ? 'border border-gray-200 dark:border-gray-700' : ''
-			)}
-			>
-				<textarea
-					readOnly
-					className={clsx(
-						'w-full h-editor font-mono resize-none',
-						'text-sm text-gray-600 dark:text-gray-300',
-						'pl-10 pt-1 leading-snug'
-					)}
-					value={acl}
-				/>
-			</div>
-			{where === 'server' ? (
-				<>
-					<Button
-						disabled
-						variant='emphasized'
-						className='text-sm w-fit mr-2'
-					>
-						Save
-					</Button>
-					<Button
-						disabled
-						variant='emphasized'
-						className={clsx(
-							'text-sm w-fit bg-gray-100 dark:bg-transparent',
-							'border border-gray-200 dark:border-gray-700'
-						)}
-					>
-						Discard Changes
-					</Button>
-				</>
-			) : undefined}
-		</>
-	)
-}

app/routes/_data.acls._index/route.tsx

@@ -1,174 +0,0 @@
-import { BeakerIcon, EyeIcon, IssueDraftIcon, PencilIcon } from '@primer/octicons-react'
-import { type ActionFunctionArgs, json } from '@remix-run/node'
-import { useLoaderData } from '@remix-run/react'
-import { useState } from 'react'
-import { Tab, TabList, TabPanel, Tabs } from 'react-aria-components'
-import { ClientOnly } from 'remix-utils/client-only'
-
-import Link from '~/components/Link'
-import Notice from '~/components/Notice'
-import { cn } from '~/utils/cn'
-import { getAcl, getContext, patchAcl } from '~/utils/config'
-import { sighupHeadscale } from '~/utils/docker'
-import { getSession } from '~/utils/sessions'
-
-import Editor from './editor'
-import Fallback from './fallback'
-
-export async function loader() {
-	const context = await getContext()
-	if (!context.hasAcl) {
-		throw new Error('No ACL configuration is available')
-	}
-
-	const { data, type } = await getAcl()
-	return {
-		hasAclWrite: context.hasAclWrite,
-		currentAcl: data,
-		aclType: type
-	}
-}
-
-export async function action({ request }: ActionFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-	if (!session.has('hsApiKey')) {
-		return json({ success: false }, {
-			status: 401
-		})
-	}
-
-	const context = await getContext()
-	if (!context.hasAclWrite) {
-		return json({ success: false }, {
-			status: 403
-		})
-	}
-
-	const data = await request.json() as { acl: string }
-	await patchAcl(data.acl)
-
-	if (context.hasDockerSock) {
-		await sighupHeadscale()
-	}
-
-	return json({ success: true })
-}
-
-export default function Page() {
-	const data = useLoaderData<typeof loader>()
-	const [acl, setAcl] = useState(data.currentAcl)
-
-	return (
-		<div>
-			{data.hasAclWrite ? undefined : (
-				<div className='mb-4'>
-					<Notice>
-						The ACL policy file is readonly to Headplane.
-						You will not be able to make changes here.
-					</Notice>
-				</div>
-			)}
-
-			<h1 className='text-2xl font-medium mb-4'>
-				Access Control List (ACL)
-			</h1>
-
-			<p className='mb-4 max-w-prose'>
-				The ACL file is used to define the access control rules for your network.
-				You can find more information about the ACL file in the
-				{' '}
-				<Link
-					to='https://tailscale.com/kb/1018/acls'
-					name='Tailscale ACL documentation'
-				>
-					Tailscale ACL guide
-				</Link>
-				{' '}
-				and the
-				{' '}
-				<Link
-					to='https://headscale.net/acls'
-					name='Headscale ACL documentation'
-				>
-					Headscale docs
-				</Link>
-				.
-			</p>
-
-			<Tabs>
-				<TabList className={cn(
-					'flex border-t border-gray-200 dark:border-gray-700',
-					'w-fit rounded-t-lg overflow-hidden',
-					'text-gray-400 dark:text-gray-500'
-				)}
-				>
-					<Tab
-						id='edit'
-						className={({ isSelected }) => cn(
-							'px-4 py-2 rounded-tl-lg',
-							'focus:outline-none flex items-center gap-2',
-							'border-x border-gray-200 dark:border-gray-700',
-							isSelected ? 'text-gray-900 dark:text-gray-100' : ''
-						)}
-					>
-						<PencilIcon className='w-5 h-5'/>
-						<p>Edit file</p>
-					</Tab>
-					<Tab
-						id='diff'
-						className={({ isSelected }) => cn(
-							'px-4 py-2',
-							'focus:outline-none flex items-center gap-2',
-							'border-x border-gray-200 dark:border-gray-700',
-							isSelected ? 'text-gray-900 dark:text-gray-100' : ''
-						)}
-					>
-						<EyeIcon className='w-5 h-5'/>
-						<p>Preview changes</p>
-					</Tab>
-					<Tab
-						id='preview'
-						className={({ isSelected }) => cn(
-							'px-4 py-2 rounded-tr-lg',
-							'focus:outline-none flex items-center gap-2',
-							'border-x border-gray-200 dark:border-gray-700',
-							isSelected ? 'text-gray-900 dark:text-gray-100' : ''
-						)}
-					>
-						<BeakerIcon className='w-5 h-5'/>
-						<p>Preview rules</p>
-					</Tab>
-				</TabList>
-				<TabPanel id='edit'>
-					<ClientOnly fallback={<Fallback acl={acl} where='server'/>}>
-						{() => (
-							<Editor data={data} acl={acl} setAcl={setAcl} mode='edit'/>
-						)}
-					</ClientOnly>
-				</TabPanel>
-				<TabPanel id='diff'>
-					<ClientOnly fallback={<Fallback acl={acl} where='server'/>}>
-						{() => (
-							<Editor data={data} acl={acl} setAcl={setAcl} mode='diff'/>
-						)}
-					</ClientOnly>
-				</TabPanel>
-				<TabPanel id='preview'>
-					<div
-						className={cn(
-							'border border-gray-200 dark:border-gray-700',
-							'rounded-b-lg rounded-tr-lg mb-4 overflow-hidden',
-							'p-16 flex flex-col items-center justify-center'
-						)}
-					>
-						<IssueDraftIcon className='w-24 h-24 text-gray-300 dark:text-gray-500'/>
-						<p className='w-1/2 text-center mt-4'>
-							The Preview rules is very much still a work in progress.
-							It is a bit complicated to implement right now but hopefully it will be available soon.
-						</p>
-					</div>
-				</TabPanel>
-			</Tabs>
-		</div>
-	)
-}

app/routes/_data.dns._index/domains.tsx

@@ -1,221 +0,0 @@
-/* eslint-disable unicorn/no-keyword-prefix */
-import {
-	closestCorners,
-	DndContext,
-	DragOverlay
-} from '@dnd-kit/core'
-import {
-	restrictToParentElement,
-	restrictToVerticalAxis
-} from '@dnd-kit/modifiers'
-import {
-	arrayMove,
-	SortableContext,
-	useSortable,
-	verticalListSortingStrategy
-} from '@dnd-kit/sortable'
-import { CSS } from '@dnd-kit/utilities'
-import { LockIcon, ThreeBarsIcon } from '@primer/octicons-react'
-import { type FetcherWithComponents, useFetcher } from '@remix-run/react'
-import clsx from 'clsx'
-import { useEffect, useState } from 'react'
-
-import Button from '~/components/Button'
-import Input from '~/components/Input'
-import Spinner from '~/components/Spinner'
-import TableList from '~/components/TableList'
-
-type Properties = {
-	readonly baseDomain?: string;
-	readonly searchDomains: string[];
-	// eslint-disable-next-line react/boolean-prop-naming
-	readonly disabled?: boolean;
-}
-
-export default function Domains({ baseDomain, searchDomains, disabled }: Properties) {
-	// eslint-disable-next-line unicorn/no-null, @typescript-eslint/ban-types
-	const [activeId, setActiveId] = useState<number | string | null>(null)
-	const [localDomains, setLocalDomains] = useState(searchDomains)
-	const [newDomain, setNewDomain] = useState('')
-	const fetcher = useFetcher()
-
-	useEffect(() => {
-		setLocalDomains(searchDomains)
-	}, [searchDomains])
-
-	return (
-		<div className='flex flex-col w-2/3'>
-			<h1 className='text-2xl font-medium mb-4'>Search Domains</h1>
-			<p className='text-gray-700 dark:text-gray-300 mb-2'>
-				Set custom DNS search domains for your Tailnet.
-				When using Magic DNS, your tailnet domain is used as the first search domain.
-			</p>
-			<DndContext
-				modifiers={[restrictToVerticalAxis, restrictToParentElement]}
-				collisionDetection={closestCorners}
-				onDragStart={event => {
-					setActiveId(event.active.id)
-				}}
-				onDragEnd={event => {
-					// eslint-disable-next-line unicorn/no-null
-					setActiveId(null)
-					const { active, over } = event
-					if (!over) {
-						return
-					}
-
-					const activeItem = localDomains[active.id as number - 1]
-					const overItem = localDomains[over.id as number - 1]
-
-					if (!activeItem || !overItem) {
-						return
-					}
-
-					const oldIndex = localDomains.indexOf(activeItem)
-					const newIndex = localDomains.indexOf(overItem)
-
-					if (oldIndex !== newIndex) {
-						setLocalDomains(arrayMove(localDomains, oldIndex, newIndex))
-					}
-				}}
-			>
-				<TableList>
-					{baseDomain ? (
-						<TableList.Item key='magic-dns-sd'>
-							<p className='font-mono text-sm'>{baseDomain}</p>
-							<LockIcon className='h-4 w-4'/>
-						</TableList.Item>
-					) : undefined}
-					<SortableContext
-						items={localDomains}
-						strategy={verticalListSortingStrategy}
-					>
-						{localDomains.map((sd, index) => (
-							<Domain
-								// eslint-disable-next-line react/no-array-index-key
-								key={index}
-								domain={sd}
-								id={index + 1}
-								localDomains={localDomains}
-								disabled={disabled}
-								fetcher={fetcher}
-							/>
-						))}
-						<DragOverlay adjustScale>
-							{activeId ? <Domain
-								isDrag
-								domain={localDomains[activeId as number - 1]}
-								localDomains={localDomains}
-								id={activeId as number - 1}
-								disabled={disabled}
-								fetcher={fetcher}
-							/> : undefined}
-						</DragOverlay>
-					</SortableContext>
-					{disabled ? undefined : (
-						<TableList.Item key='add-sd'>
-							<Input
-								variant='embedded'
-								type='text'
-								className='font-mono text-sm'
-								placeholder='Search Domain'
-								value={newDomain}
-								onChange={event => {
-									setNewDomain(event.target.value)
-								}}
-							/>
-							{fetcher.state === 'idle' ? (
-								<Button
-									className='text-sm'
-									disabled={newDomain.length === 0}
-									onClick={() => {
-										fetcher.submit({
-										// eslint-disable-next-line @typescript-eslint/naming-convention
-											'dns_config.domains': [...localDomains, newDomain]
-										}, {
-											method: 'PATCH',
-											encType: 'application/json'
-										})
-
-										setNewDomain('')
-									}}
-								>
-									Add
-								</Button>
-							) : (
-								<Spinner className='w-3 h-3 mr-0'/>
-							)}
-						</TableList.Item>
-					)}
-				</TableList>
-			</DndContext>
-		</div>
-	)
-}
-
-type DomainProperties = {
-	readonly domain: string;
-	readonly id: number;
-	readonly isDrag?: boolean;
-	readonly localDomains: string[];
-	// eslint-disable-next-line react/boolean-prop-naming
-	readonly disabled?: boolean;
-	readonly fetcher: FetcherWithComponents<unknown>;
-}
-
-function Domain({ domain, id, localDomains, isDrag, disabled, fetcher }: DomainProperties) {
-	const {
-		attributes,
-		listeners,
-		setNodeRef,
-		transform,
-		transition,
-		isDragging
-	} = useSortable({ id })
-
-	// TODO: Figure out why TableList.Item breaks dndkit
-	return (
-		<div
-			ref={setNodeRef}
-			className={clsx(
-				'flex items-center justify-between px-3 py-2',
-				'border-b border-gray-200 last:border-b-0 dark:border-zinc-800',
-				isDragging ? 'text-gray-400' : '',
-				isDrag ? 'outline outline-1 outline-gray-500 bg-gray-200 dark:bg-zinc-800' : ''
-			)}
-			style={{
-				transform: CSS.Transform.toString(transform),
-				transition
-			}}
-		>
-			<p className='font-mono text-sm flex items-center gap-4'>
-				{disabled ? undefined : (
-					<ThreeBarsIcon
-						className='h-4 w-4 text-gray-400 focus:outline-none'
-						{...attributes}
-						{...listeners}
-					/>
-				)}
-				{domain}
-			</p>
-			{isDrag ? undefined : (
-				<Button
-					variant='destructive'
-					className='text-sm'
-					disabled={disabled}
-					onClick={() => {
-						fetcher.submit({
-							// eslint-disable-next-line @typescript-eslint/naming-convention
-							'dns_config.domains': localDomains.filter((_, index) => index !== id - 1)
-						}, {
-							method: 'PATCH',
-							encType: 'application/json'
-						})
-					}}
-				>
-					Remove
-				</Button>
-			)}
-		</div>
-	)
-}

app/routes/_data.dns._index/magic.tsx

@@ -1,70 +0,0 @@
-import { useFetcher } from '@remix-run/react'
-
-import Dialog from '~/components/Dialog'
-import Spinner from '~/components/Spinner'
-import { cn } from '~/utils/cn'
-
-type Properties = {
-	readonly isEnabled: boolean;
-	// eslint-disable-next-line react/boolean-prop-naming
-	readonly disabled?: boolean;
-}
-
-export default function Modal({ isEnabled, disabled }: Properties) {
-	const fetcher = useFetcher()
-
-	return (
-		<Dialog>
-			<Dialog.Button
-				isDisabled={disabled}
-				className={cn(
-					'w-fit text-sm rounded-lg px-4 py-2',
-					'bg-main-700 dark:bg-main-800 text-white',
-					disabled && 'opacity-50 cursor-not-allowed'
-				)}
-			>
-				{fetcher.state === 'idle' ? undefined : (
-					<Spinner className='w-3 h-3'/>
-				)}
-				{isEnabled ? 'Disable' : 'Enable'} Magic DNS
-			</Dialog.Button>
-			<Dialog.Panel>
-				{close => (
-					<>
-						<Dialog.Title>
-							{isEnabled ? 'Disable' : 'Enable'} Magic DNS
-						</Dialog.Title>
-						<Dialog.Text>
-							Devices will no longer be accessible via your tailnet domain.
-							The search domain will also be disabled.
-						</Dialog.Text>
-						<div className='mt-6 flex justify-end gap-2 mt-6'>
-							<Dialog.Action
-								variant='cancel'
-								onPress={close}
-							>
-								Cancel
-							</Dialog.Action>
-							<Dialog.Action
-								variant='confirm'
-								onPress={() => {
-									fetcher.submit({
-										// eslint-disable-next-line @typescript-eslint/naming-convention
-										'dns_config.magic_dns': !isEnabled
-									}, {
-										method: 'PATCH',
-										encType: 'application/json'
-									})
-
-									close()
-								}}
-							>
-								{isEnabled ? 'Disable' : 'Enable'} Magic DNS
-							</Dialog.Action>
-						</div>
-					</>
-				)}
-			</Dialog.Panel>
-		</Dialog>
-	)
-}

app/routes/_data.dns._index/rename.tsx

@@ -1,103 +0,0 @@
-/* eslint-disable @typescript-eslint/naming-convention */
-/* eslint-disable unicorn/no-keyword-prefix */
-import { useFetcher } from '@remix-run/react'
-import { useState } from 'react'
-
-import Code from '~/components/Code'
-import Dialog from '~/components/Dialog'
-import Input from '~/components/Input'
-import Spinner from '~/components/Spinner'
-import TextField from '~/components/TextField'
-import { cn } from '~/utils/cn'
-
-type Properties = {
-	readonly name: string;
-	// eslint-disable-next-line react/boolean-prop-naming
-	readonly disabled?: boolean;
-}
-
-export default function Modal({ name, disabled }: Properties) {
-	const [newName, setNewName] = useState(name)
-	const fetcher = useFetcher()
-
-	return (
-		<div className='flex flex-col w-2/3'>
-			<h1 className='text-2xl font-medium mb-4'>Tailnet Name</h1>
-			<p className='text-gray-700 dark:text-gray-300'>
-				This is the base domain name of your Tailnet.
-				Devices are accessible at
-				{' '}
-				<Code>
-					[device].[user].{name}
-				</Code>
-				{' '}
-				when Magic DNS is enabled.
-			</p>
-			<Input
-				readOnly
-				className='font-mono text-sm my-4 w-1/2'
-				type='text'
-				value={name}
-				onFocus={event => {
-					event.target.select()
-				}}
-			/>
-			<Dialog>
-				<Dialog.Button
-					isDisabled={disabled}
-					className={cn(
-						'w-fit text-sm rounded-lg px-4 py-2',
-						'bg-main-700 dark:bg-main-800 text-white',
-						disabled && 'opacity-50 cursor-not-allowed'
-					)}
-				>
-					{fetcher.state === 'idle' ? undefined : (
-						<Spinner className='w-3 h-3'/>
-					)}
-					Rename Tailnet
-				</Dialog.Button>
-				<Dialog.Panel>
-					{close => (
-						<>
-							<Dialog.Title>
-								Rename Tailnet
-							</Dialog.Title>
-							<Dialog.Text>
-								Keep in mind that changing this can lead to all sorts of unexpected behavior and may break existing devices in your tailnet.
-							</Dialog.Text>
-							<TextField
-								label='Tailnet name'
-								placeholder='ts.net'
-								state={[newName, setNewName]}
-								className='my-2'
-							/>
-							<div className='mt-6 flex justify-end gap-2 mt-6'>
-								<Dialog.Action
-									variant='cancel'
-									onPress={close}
-								>
-									Cancel
-								</Dialog.Action>
-								<Dialog.Action
-									variant='confirm'
-									onPress={() => {
-										fetcher.submit({
-											'dns_config.base_domain': newName
-										}, {
-											method: 'PATCH',
-											encType: 'application/json'
-										})
-
-										close()
-									}}
-								>
-									Rename
-								</Dialog.Action>
-							</div>
-						</>
-					)}
-				</Dialog.Panel>
-			</Dialog>
-		</div>
-	)
-}

app/routes/_data.dns._index/route.tsx

@@ -1,201 +0,0 @@
-import { type ActionFunctionArgs } from '@remix-run/node'
-import { json, useFetcher, useLoaderData } from '@remix-run/react'
-import { useState } from 'react'
-
-import Button from '~/components/Button'
-import Code from '~/components/Code'
-import Input from '~/components/Input'
-import Notice from '~/components/Notice'
-import Spinner from '~/components/Spinner'
-import Switch from '~/components/Switch'
-import TableList from '~/components/TableList'
-import { getConfig, getContext, patchConfig } from '~/utils/config'
-import { restartHeadscale } from '~/utils/docker'
-import { getSession } from '~/utils/sessions'
-import { useLiveData } from '~/utils/useLiveData'
-
-import Domains from './domains'
-import MagicModal from './magic'
-import RenameModal from './rename'
-
-// We do not want to expose every config value
-export async function loader() {
-	const context = await getContext()
-	if (!context.hasConfig) {
-		throw new Error('No configuration is available')
-	}
-
-	const config = await getConfig()
-
-	const dns = {
-		prefixes: config.prefixes,
-		magicDns: config.dns_config.magic_dns,
-		baseDomain: config.dns_config.base_domain,
-		overrideLocal: config.dns_config.override_local_dns,
-		nameservers: config.dns_config.nameservers,
-		splitDns: config.dns_config.restricted_nameservers,
-		searchDomains: config.dns_config.domains,
-		extraRecords: config.dns_config.extra_records
-	}
-
-	return {
-		...dns,
-		...context
-	}
-}
-
-export async function action({ request }: ActionFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-	if (!session.has('hsApiKey')) {
-		return json({ success: false }, {
-			status: 401
-		})
-	}
-
-	const context = await getContext()
-	if (!context.hasConfigWrite) {
-		return json({ success: false }, {
-			status: 403
-		})
-	}
-
-	const data = await request.json() as Record<string, unknown>
-	await patchConfig(data)
-	await restartHeadscale()
-	return json({ success: true })
-}
-
-export default function Page() {
-	useLiveData({ interval: 5000 })
-	const data = useLoaderData<typeof loader>()
-	const fetcher = useFetcher()
-	const [localOverride, setLocalOverride] = useState(data.overrideLocal)
-	const [ns, setNs] = useState('')
-
-	return (
-		<div className='flex flex-col gap-16 max-w-screen-lg'>
-			{data.hasConfigWrite ? undefined : (
-				<Notice>
-					The Headscale configuration is read-only. You cannot make changes to the configuration
-				</Notice>
-			)}
-			<RenameModal name={data.baseDomain} disabled={!data.hasConfigWrite}/>
-			<div className='flex flex-col w-2/3'>
-				<h1 className='text-2xl font-medium mb-4'>Nameservers</h1>
-				<p className='text-gray-700 dark:text-gray-300'>
-					Set the nameservers used by devices on the Tailnet
-					to resolve DNS queries.
-				</p>
-				<div className='mt-4'>
-					<div className='flex items-center justify-between mb-2'>
-						<h2 className='text-md font-medium opacity-80'>
-							Global Nameservers
-						</h2>
-						<div className='flex gap-2 items-center'>
-							<span className='text-sm opacity-50'>
-								Override local DNS
-							</span>
-							<Switch
-								label='Override local DNS'
-								defaultSelected={localOverride}
-								isDisabled={!data.hasConfigWrite}
-								onChange={() => {
-									fetcher.submit({
-										// eslint-disable-next-line @typescript-eslint/naming-convention
-										'dns_config.override_local_dns': !localOverride
-									}, {
-										method: 'PATCH',
-										encType: 'application/json'
-									})
-
-									setLocalOverride(!localOverride)
-								}}
-							/>
-						</div>
-					</div>
-					<TableList>
-						{data.nameservers.map((ns, index) => (
-							// eslint-disable-next-line react/no-array-index-key
-							<TableList.Item key={index}>
-								<p className='font-mono text-sm'>{ns}</p>
-								<Button
-									variant='destructive'
-									className='text-sm'
-									disabled={!data.hasConfigWrite}
-									onClick={() => {
-										fetcher.submit({
-											// eslint-disable-next-line @typescript-eslint/naming-convention
-											'dns_config.nameservers': data.nameservers.filter((_, index_) => index_ !== index)
-										}, {
-											method: 'PATCH',
-											encType: 'application/json'
-										})
-									}}
-								>
-									Remove
-								</Button>
-							</TableList.Item>
-						))}
-						{data.hasConfigWrite ? (
-							<TableList.Item>
-								<Input
-									variant='embedded'
-									type='text'
-									className='font-mono text-sm'
-									placeholder='Nameserver'
-									value={ns}
-									onChange={event => {
-										setNs(event.target.value)
-									}}
-								/>
-								{fetcher.state === 'idle' ? (
-									<Button
-										className='text-sm'
-										disabled={ns.length === 0}
-										onClick={() => {
-											fetcher.submit({
-												// eslint-disable-next-line @typescript-eslint/naming-convention
-												'dns_config.nameservers': [...data.nameservers, ns]
-											}, {
-												method: 'PATCH',
-												encType: 'application/json'
-											})
-
-											setNs('')
-										}}
-									>
-										Add
-									</Button>
-								) : (
-									<Spinner className='w-3 h-3 mr-0'/>
-								)}
-							</TableList.Item>
-						) : undefined}
-					</TableList>
-					{/* TODO: Split DNS and Custom A Records */}
-				</div>
-			</div>
-
-			<Domains
-				baseDomain={data.magicDns ? data.baseDomain : undefined}
-				searchDomains={data.searchDomains}
-				disabled={!data.hasConfigWrite}
-			/>
-
-			<div className='flex flex-col w-2/3'>
-				<h1 className='text-2xl font-medium mb-4'>Magic DNS</h1>
-				<p className='text-gray-700 dark:text-gray-300 mb-4'>
-					Automaticall register domain names for each device
-					on the tailnet. Devices will be accessible at
-					{' '}
-					<Code>
-						[device].[user].{data.baseDomain}
-					</Code>
-					{' '}
-					when Magic DNS is enabled.
-				</p>
-				<MagicModal isEnabled={data.magicDns} disabled={!data.hasConfigWrite}/>
-			</div>
-		</div>
-	)
-}

app/routes/_data.machines.$id.tsx

@@ -1,75 +0,0 @@
-import { type LoaderFunctionArgs } from '@remix-run/node'
-import { Link, useLoaderData } from '@remix-run/react'
-
-import Attribute from '~/components/Attribute'
-import Card from '~/components/Card'
-import StatusCircle from '~/components/StatusCircle'
-import { type Machine } from '~/types'
-import { pull } from '~/utils/headscale'
-import { getSession } from '~/utils/sessions'
-import { useLiveData } from '~/utils/useLiveData'
-
-export async function loader({ request, params }: LoaderFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-	if (!params.id) {
-		throw new Error('No machine ID provided')
-	}
-
-	// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-	const data = await pull<{ node: Machine }>(`v1/node/${params.id}`, session.get('hsApiKey')!)
-	return data.node
-}
-
-export default function Page() {
-	const data = useLoaderData<typeof loader>()
-	useLiveData({ interval: 1000 })
-
-	return (
-		<div>
-			<p className='mb-4 text-gray-500 dark:text-gray-400 text-sm'>
-				<Link
-					to='/machines'
-					className='font-bold text-gray-700 dark:text-gray-300 hover:underline'
-				>
-					All Machines
-				</Link>
-				{' / '}
-				{data.givenName}
-			</p>
-			<span className='flex items-baseline gap-x-4 text-sm mb-4'>
-				<h1 className='text-2xl font-bold'>
-					{data.givenName}
-				</h1>
-				<StatusCircle isOnline={data.online} className='w-4 h-4'/>
-			</span>
-			<Card>
-				<Attribute name='Creator' value={data.user.name}/>
-				<Attribute name='Node ID' value={data.id}/>
-				<Attribute name='Node Name' value={data.givenName}/>
-				<Attribute name='Hostname' value={data.name}/>
-				<Attribute
-					isCopyable
-					name='Node Key'
-					value={data.nodeKey}
-				/>
-				<Attribute
-					name='Created'
-					value={new Date(data.createdAt).toLocaleString()}
-				/>
-				<Attribute
-					name='Last Seen'
-					value={new Date(data.lastSeen).toLocaleString()}
-				/>
-				<Attribute
-					name='Expiry'
-					value={new Date(data.expiry).toLocaleString()}
-				/>
-				<Attribute
-					isCopyable
-					name='Domain'
-					value={`${data.givenName}.${data.user.name}.ts.net`}
-				/>
-			</Card>
-		</div>
-	)
-}

app/routes/_data.machines._index/dialogs/delete.tsx

@@ -1,57 +0,0 @@
-import { type FetcherWithComponents } from '@remix-run/react'
-import { type Dispatch, type SetStateAction } from 'react'
-
-import Dialog from '~/components/Dialog'
-import { type Machine } from '~/types'
-import { cn } from '~/utils/cn'
-
-type DeleteProperties = {
-	readonly machine: Machine;
-	readonly fetcher: FetcherWithComponents<unknown>;
-	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
-}
-
-export default function Delete({ machine, fetcher, state }: DeleteProperties) {
-	return (
-		<Dialog>
-			<Dialog.Panel control={state}>
-				{close => (
-					<>
-						<Dialog.Title>
-							Remove {machine.givenName}
-						</Dialog.Title>
-						<Dialog.Text>
-							This machine will be permanently removed from
-							your network. To re-add it, you will need to
-							reauthenticate to your tailnet from the device.
-						</Dialog.Text>
-						<fetcher.Form method='POST'>
-							<input type='hidden' name='_method' value='delete'/>
-							<input type='hidden' name='id' value={machine.id}/>
-							<div className='mt-6 flex justify-end gap-2 mt-6'>
-								<Dialog.Action
-									variant='cancel'
-									onPress={close}
-								>
-									Cancel
-								</Dialog.Action>
-								<Dialog.Action
-									variant='confirm'
-									className={cn(
-										'bg-red-500 hover:border-red-700',
-										'dark:bg-red-600 dark:hover:border-red-700',
-										'pressed:bg-red-600 hover:bg-red-600',
-										'text-white dark:text-white'
-									)}
-									onPress={close}
-								>
-									Remove
-								</Dialog.Action>
-							</div>
-						</fetcher.Form>
-					</>
-				)}
-			</Dialog.Panel>
-		</Dialog>
-	)
-}

app/routes/_data.machines._index/dialogs/expire.tsx

@@ -1,57 +0,0 @@
-import { type FetcherWithComponents } from '@remix-run/react'
-import { type Dispatch, type SetStateAction } from 'react'
-
-import Dialog from '~/components/Dialog'
-import { type Machine } from '~/types'
-import { cn } from '~/utils/cn'
-
-type DeleteProperties = {
-	readonly machine: Machine;
-	readonly fetcher: FetcherWithComponents<unknown>;
-	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
-}
-
-export default function Expire({ machine, fetcher, state }: DeleteProperties) {
-	return (
-		<Dialog>
-			<Dialog.Panel control={state}>
-				{close => (
-					<>
-						<Dialog.Title>
-							Expire {machine.givenName}
-						</Dialog.Title>
-						<Dialog.Text>
-							This will disconnect the machine from your Tailnet.
-							In order to reconnect, you will need to re-authenticate
-							from the device.
-						</Dialog.Text>
-						<fetcher.Form method='POST'>
-							<input type='hidden' name='_method' value='expire'/>
-							<input type='hidden' name='id' value={machine.id}/>
-							<div className='mt-6 flex justify-end gap-2 mt-6'>
-								<Dialog.Action
-									variant='cancel'
-									onPress={close}
-								>
-									Cancel
-								</Dialog.Action>
-								<Dialog.Action
-									variant='confirm'
-									className={cn(
-										'bg-red-500 hover:border-red-700',
-										'dark:bg-red-600 dark:hover:border-red-700',
-										'pressed:bg-red-600 hover:bg-red-600',
-										'text-white dark:text-white'
-									)}
-									onPress={close}
-								>
-									Expire
-								</Dialog.Action>
-							</div>
-						</fetcher.Form>
-					</>
-				)}
-			</Dialog.Panel>
-		</Dialog>
-	)
-}

app/routes/_data.machines._index/dialogs/rename.tsx

@@ -1,89 +0,0 @@
-import { type FetcherWithComponents } from '@remix-run/react'
-import { type Dispatch, type SetStateAction, useState } from 'react'
-
-import Code from '~/components/Code'
-import Dialog from '~/components/Dialog'
-import TextField from '~/components/TextField'
-import { type Machine } from '~/types'
-
-type RenameProperties = {
-	readonly machine: Machine;
-	readonly fetcher: FetcherWithComponents<unknown>;
-	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
-	readonly magic?: string;
-}
-
-export default function Rename({ machine, fetcher, state, magic }: RenameProperties) {
-	const [name, setName] = useState(machine.givenName)
-
-	return (
-		<Dialog>
-			<Dialog.Panel control={state}>
-				{close => (
-					<>
-						<Dialog.Title>
-							Edit machine name for {machine.givenName}
-						</Dialog.Title>
-						<Dialog.Text>
-							This name is shown in the admin panel, in Tailscale clients,
-							and used when generating MagicDNS names.
-						</Dialog.Text>
-						<fetcher.Form method='POST'>
-							<input type='hidden' name='_method' value='rename'/>
-							<input type='hidden' name='id' value={machine.id}/>
-							<TextField
-								label='Machine name'
-								placeholder='Machine name'
-								name='name'
-								state={[name, setName]}
-								className='my-2'
-							/>
-							{magic ? (
-								name.length > 0 && name !== machine.givenName ? (
-									<p className='text-sm text-gray-500 dark:text-gray-300 leading-tight'>
-										This machine will be accessible by the hostname
-										{' '}
-										<Code className='text-sm'>
-											{name.toLowerCase().replaceAll(/\s+/g, '-')}
-										</Code>
-										{'. '}
-										The hostname
-										{' '}
-										<Code className='text-sm'>
-											{machine.givenName}
-										</Code>
-										{' '}
-										will no longer point to this machine.
-									</p>
-								) : (
-									<p className='text-sm text-gray-500 dark:text-gray-300 leading-tight'>
-										This machine is accessible by the hostname
-										{' '}
-										<Code className='text-sm'>
-											{machine.givenName}
-										</Code>
-										.
-									</p>
-								)
-							) : undefined}
-							<div className='mt-6 flex justify-end gap-2 mt-6'>
-								<Dialog.Action
-									variant='cancel'
-									onPress={close}
-								>
-									Cancel
-								</Dialog.Action>
-								<Dialog.Action
-									variant='confirm'
-									onPress={close}
-								>
-									Rename
-								</Dialog.Action>
-							</div>
-						</fetcher.Form>
-					</>
-				)}
-			</Dialog.Panel>
-		</Dialog>
-	)
-}

app/routes/_data.machines._index/dialogs/routes.tsx

@@ -1,92 +0,0 @@
-import { type FetcherWithComponents } from '@remix-run/react'
-import { type Dispatch, type SetStateAction } from 'react'
-
-import Dialog from '~/components/Dialog'
-import Switch from '~/components/Switch'
-import { type Machine, type Route } from '~/types'
-import { cn } from '~/utils/cn'
-
-type RoutesProperties = {
-	readonly machine: Machine;
-	readonly routes: Route[];
-	readonly fetcher: FetcherWithComponents<unknown>;
-	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
-}
-
-// TODO: Support deleting routes
-export default function Routes({ machine, routes, fetcher, state }: RoutesProperties) {
-	return (
-		<Dialog>
-			<Dialog.Panel control={state}>
-				{close => (
-					<>
-						<Dialog.Title>
-							Edit route settings of {machine.givenName}
-						</Dialog.Title>
-						<Dialog.Text>
-							Connect to devices you can&apos;t install Tailscale on
-							by advertising IP ranges as subnet routes.
-						</Dialog.Text>
-						<div className={cn(
-							'rounded-lg overflow-y-auto my-2',
-							'divide-y divide-zinc-200 dark:divide-zinc-700 align-top',
-							'border border-zinc-200 dark:border-zinc-700'
-						)}
-						>
-							{routes.length === 0 ? (
-								<div
-									className={cn(
-										'flex py-4 px-4 bg-ui-100 dark:bg-ui-800',
-										'items-center justify-center',
-										'text-ui-600 dark:text-ui-300'
-									)}
-								>
-									<p>
-										No routes are advertised on this machine.
-									</p>
-								</div>
-							) : undefined}
-							{routes.map(route => (
-								<div
-									key={route.node.id}
-									className={cn(
-										'flex py-2 px-4 bg-ui-100 dark:bg-ui-800',
-										'items-center justify-between'
-									)}
-								>
-									<p>
-										{route.prefix}
-									</p>
-									<Switch
-										defaultSelected={route.enabled}
-										label='Enabled'
-										onChange={checked => {
-											const form = new FormData()
-											form.set('id', machine.id)
-											form.set('_method', 'routes')
-											form.set('route', route.id)
-
-											form.set('enabled', String(checked))
-											fetcher.submit(form, {
-												method: 'POST'
-											})
-										}}
-									/>
-								</div>
-							))}
-						</div>
-						<div className='mt-6 flex justify-end gap-2 mt-6'>
-							<Dialog.Action
-								variant='cancel'
-								isDisabled={fetcher.state === 'submitting'}
-								onPress={close}
-							>
-								Close
-							</Dialog.Action>
-						</div>
-					</>
-				)}
-			</Dialog.Panel>
-		</Dialog>
-	)
-}

app/routes/_data.machines._index/machine.tsx

@@ -1,204 +0,0 @@
-/* eslint-disable react/hook-use-state */
-import { ChevronDownIcon, CopyIcon, KebabHorizontalIcon } from '@primer/octicons-react'
-import { type FetcherWithComponents, Link } from '@remix-run/react'
-import { useState } from 'react'
-
-import Menu from '~/components/Menu'
-import StatusCircle from '~/components/StatusCircle'
-import { toast } from '~/components/Toaster'
-import { type Machine, type Route } from '~/types'
-import { cn } from '~/utils/cn'
-
-import Delete from './dialogs/delete'
-import Expire from './dialogs/expire'
-import Rename from './dialogs/rename'
-import Routes from './dialogs/routes'
-
-type MachineProperties = {
-	readonly machine: Machine;
-	readonly routes: Route[];
-	readonly fetcher: FetcherWithComponents<unknown>;
-	readonly magic?: string;
-}
-
-export default function MachineRow({ machine, routes, fetcher, magic }: MachineProperties) {
-	const renameState = useState(false)
-	const expireState = useState(false)
-	const removeState = useState(false)
-	const routesState = useState(false)
-
-	const expired = new Date(machine.expiry).getTime() < Date.now()
-	const tags = [
-		...machine.forcedTags,
-		...machine.validTags
-	]
-
-	if (expired) {
-		tags.unshift('Expired')
-	}
-
-	return (
-		<tr
-			key={machine.id}
-			className='hover:bg-zinc-100 dark:hover:bg-zinc-800 group'
-		>
-			<td className='pl-0.5 py-2'>
-				<Link
-					to={`/machines/${machine.id}`}
-					className='group/link h-full'
-				>
-					<p className={cn(
-						'font-semibold leading-snug',
-						'group-hover/link:text-blue-600',
-						'group-hover/link:dark:text-blue-400'
-					)}
-					>
-						{machine.givenName}
-					</p>
-					<p className='text-sm text-gray-500 dark:text-gray-300 font-mono'>
-						{machine.name}
-					</p>
-					<div className='flex gap-1 mt-1'>
-						{tags.map(tag => (
-							<span
-								key={tag}
-								className={cn(
-									'text-xs rounded-sm px-1 py-0.5',
-									'bg-gray-100 dark:bg-zinc-700',
-									'text-gray-600 dark:text-gray-300'
-								)}
-							>
-								{tag}
-							</span>
-						))}
-					</div>
-				</Link>
-			</td>
-			<td className='py-2'>
-				<div className='flex items-center gap-x-1'>
-					{machine.ipAddresses[0]}
-					<Menu>
-						<Menu.Button>
-							<ChevronDownIcon className='w-4 h-4'/>
-						</Menu.Button>
-						<Menu.Items>
-							{machine.ipAddresses.map(ip => (
-								<Menu.ItemButton
-									key={ip}
-									type='button'
-									className={cn(
-										'flex items-center gap-x-1.5 text-sm',
-										'justify-between w-full'
-									)}
-									onPress={async () => {
-										await navigator.clipboard.writeText(ip)
-										toast('Copied IP address to clipboard')
-									}}
-								>
-									{ip}
-									<CopyIcon className='w-3 h-3'/>
-								</Menu.ItemButton>
-							))}
-							{magic ? (
-								<Menu.ItemButton
-									type='button'
-									className={cn(
-										'flex items-center gap-x-1.5 text-sm',
-										'justify-between w-full break-keep'
-									)}
-									onPress={async () => {
-										const ip = `${machine.givenName}.${machine.user.name}.${magic}`
-										await navigator.clipboard.writeText(ip)
-										toast('Copied hostname to clipboard')
-									}}
-								>
-									{machine.givenName}.{machine.user.name}.{magic}
-									<CopyIcon className='w-3 h-3'/>
-								</Menu.ItemButton>
-							) : undefined}
-						</Menu.Items>
-					</Menu>
-				</div>
-			</td>
-			<td className='py-2'>
-				<span className={cn(
-					'flex items-center gap-x-1 text-sm',
-					'text-gray-500 dark:text-gray-400'
-				)}
-				>
-					<StatusCircle
-						isOnline={machine.online && !expired}
-						className='w-4 h-4'
-					/>
-					<p>
-						{machine.online && !expired
-							? 'Connected'
-							: new Date(
-								machine.lastSeen
-							).toLocaleString()}
-					</p>
-				</span>
-			</td>
-			<td className='py-2 pr-0.5'>
-				<Rename
-					machine={machine}
-					fetcher={fetcher}
-					state={renameState}
-					magic={magic}
-				/>
-				<Delete
-					machine={machine}
-					fetcher={fetcher}
-					state={removeState}
-				/>
-				{expired ? undefined : (
-					<Expire
-						machine={machine}
-						fetcher={fetcher}
-						state={expireState}
-					/>
-				)}
-				<Routes
-					machine={machine}
-					routes={routes}
-					fetcher={fetcher}
-					state={routesState}
-				/>
-
-				<Menu>
-					<Menu.Button
-						className={cn(
-							'flex items-center justify-center',
-							'border border-transparent rounded-lg py-0.5 w-10',
-							'group-hover:border-gray-200 dark:group-hover:border-zinc-700'
-						)}
-					>
-						<KebabHorizontalIcon className='w-5'/>
-					</Menu.Button>
-					<Menu.Items>
-						<Menu.ItemButton control={renameState}>
-							Edit machine name
-						</Menu.ItemButton>
-						<Menu.ItemButton control={routesState}>
-							Edit route settings
-						</Menu.ItemButton>
-						<Menu.Item className='opacity-50 hover:bg-transparent'>
-							Edit ACL tags
-						</Menu.Item>
-						{expired ? undefined : (
-							<Menu.ItemButton control={expireState}>
-								Expire
-							</Menu.ItemButton>
-						)}
-						<Menu.ItemButton
-							className='text-red-500 dark:text-red-400'
-							control={removeState}
-						>
-							Remove
-						</Menu.ItemButton>
-					</Menu.Items>
-				</Menu>
-			</td>
-		</tr>
-	)
-}

app/routes/_data.machines._index/route.tsx

@@ -1,165 +0,0 @@
-/* eslint-disable @typescript-eslint/no-non-null-assertion */
-import { InfoIcon } from '@primer/octicons-react'
-import { type ActionFunctionArgs, json, type LoaderFunctionArgs } from '@remix-run/node'
-import { useFetcher, useLoaderData } from '@remix-run/react'
-import { Button, Tooltip, TooltipTrigger } from 'react-aria-components'
-
-import Code from '~/components/Code'
-import { type Machine, type Route } from '~/types'
-import { cn } from '~/utils/cn'
-import { getConfig, getContext } from '~/utils/config'
-import { del, post, pull } from '~/utils/headscale'
-import { getSession } from '~/utils/sessions'
-import { useLiveData } from '~/utils/useLiveData'
-
-import MachineRow from './machine'
-
-export async function loader({ request }: LoaderFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-
-	const machines = await pull<{ nodes: Machine[] }>('v1/node', session.get('hsApiKey')!)
-	const routes = await pull<{ routes: Route[] }>('v1/routes', session.get('hsApiKey')!)
-	const context = await getContext()
-
-	let magic: string | undefined
-	if (context.hasConfig) {
-		const config = await getConfig()
-		if (config.dns_config.magic_dns) {
-			magic = config.dns_config.base_domain
-		}
-	}
-
-	return {
-		nodes: machines.nodes,
-		routes: routes.routes,
-		magic
-	}
-}
-
-export async function action({ request }: ActionFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-	if (!session.has('hsApiKey')) {
-		return json({ message: 'Unauthorized' }, {
-			status: 401
-		})
-	}
-
-	const data = await request.formData()
-	if (!data.has('_method') || !data.has('id')) {
-		return json({ message: 'No method or ID provided' }, {
-			status: 400
-		})
-	}
-
-	const id = String(data.get('id'))
-	const method = String(data.get('_method'))
-
-	switch (method) {
-	case 'delete': {
-		await del(`v1/node/${id}`, session.get('hsApiKey')!)
-		return json({ message: 'Machine removed' })
-	}
-
-	case 'expire': {
-		console.log('expire')
-		const data = await post(`v1/node/${id}/expire`, session.get('hsApiKey')!)
-		console.log(data)
-		return json({ message: 'Machine expired' })
-	}
-
-	case 'rename': {
-		if (!data.has('name')) {
-			return json({ message: 'No name provided' }, {
-				status: 400
-			})
-		}
-
-		const name = String(data.get('name'))
-
-		await post(`v1/node/${id}/rename/${name}`, session.get('hsApiKey')!)
-		return json({ message: 'Machine renamed' })
-	}
-
-	case 'routes': {
-		if (!data.has('route') || !data.has('enabled')) {
-			return json({ message: 'No route or enabled provided' }, {
-				status: 400
-			})
-		}
-
-		const route = String(data.get('route'))
-		const enabled = data.get('enabled') === 'true'
-		const postfix = enabled ? 'enable' : 'disable'
-
-		await post(`v1/routes/${route}/${postfix}`, session.get('hsApiKey')!)
-		return json({ message: 'Route updated' })
-	}
-
-	default: {
-		return json({ message: 'Invalid method' }, {
-			status: 400
-		})
-	}
-	}
-}
-
-export default function Page() {
-	useLiveData({ interval: 3000 })
-	const data = useLoaderData<typeof loader>()
-	const fetcher = useFetcher()
-
-	return (
-		<>
-			<h1 className='text-2xl font-medium mb-4'>Machines</h1>
-			<table className='table-auto w-full rounded-lg'>
-				<thead className='text-gray-500 dark:text-gray-400'>
-					<tr className='text-left uppercase text-xs font-bold px-0.5'>
-						<th className='pb-2'>Name</th>
-						<th className='pb-2'>
-							<div className='flex items-center gap-x-1'>
-								Addresses
-								{data.magic ? (
-									<TooltipTrigger delay={0}>
-										<Button>
-											<InfoIcon className='w-4 h-4'/>
-										</Button>
-										<Tooltip className={cn(
-											'text-sm max-w-xs p-2 rounded-lg mb-2',
-											'bg-white dark:bg-zinc-800',
-											'border border-gray-200 dark:border-zinc-700'
-										)}
-										>
-											Since MagicDNS is enabled, you can access devices
-											based on their name and also at
-											{' '}
-											<Code>
-												[name].[user].{data.magic}
-											</Code>
-										</Tooltip>
-									</TooltipTrigger>
-								) : undefined}
-							</div>
-						</th>
-						<th className='pb-2'>Last Seen</th>
-					</tr>
-				</thead>
-				<tbody className={cn(
-					'divide-y divide-zinc-200 dark:divide-zinc-700 align-top',
-					'border-t border-zinc-200 dark:border-zinc-700'
-				)}
-				>
-					{data.nodes.map(machine => (
-						<MachineRow
-							key={machine.id}
-							// Typescript isn't smart enough yet
-							machine={machine as unknown as Machine}
-							routes={data.routes.filter(route => route.node.id === machine.id) as unknown as Route[]}
-							fetcher={fetcher}
-							magic={data.magic}
-						/>
-					))}
-				</tbody>
-			</table>
-		</>
-	)
-}

app/routes/_data.settings._index.tsx

@@ -1,13 +0,0 @@
-import { IssueDraftIcon } from '@primer/octicons-react'
-
-export default function Page() {
-	return (
-		<div className='w-96 mx-auto flex flex-col justify-center items-center text-center my-8'>
-			<IssueDraftIcon className='w-24 h-24 text-gray-300 dark:text-gray-500'/>
-			<p className='text-lg mt-8'>
-				The settings page is currently unavailable.
-				It will be available in a future release.
-			</p>
-		</div>
-	)
-}

app/routes/_data.tsx

@@ -1,62 +0,0 @@
-import { type LoaderFunctionArgs, redirect } from '@remix-run/node'
-import { Outlet, useLoaderData } from '@remix-run/react'
-
-import { ErrorPopup } from '~/components/Error'
-import Header from '~/components/Header'
-import { getContext } from '~/utils/config'
-import { HeadscaleError, pull } from '~/utils/headscale'
-import { destroySession, getSession } from '~/utils/sessions'
-
-export async function loader({ request }: LoaderFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-	if (!session.has('hsApiKey')) {
-		return redirect('/login')
-	}
-
-	try {
-		// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-		await pull('v1/apikey', session.get('hsApiKey')!)
-	} catch (error) {
-		if (error instanceof HeadscaleError) {
-			// Safest to just redirect to login if we can't pull
-			return redirect('/login', {
-				headers: {
-					// eslint-disable-next-line @typescript-eslint/naming-convention
-					'Set-Cookie': await destroySession(session)
-				}
-			})
-		}
-
-		// Otherwise propagate to boundary
-		throw error
-	}
-
-	const context = await getContext()
-	return {
-		...context,
-		user: session.get('user')
-	}
-}
-
-export default function Layout() {
-	const data = useLoaderData<typeof loader>()
-
-	return (
-		<>
-			<Header data={data}/>
-
-			<main className='container mx-auto overscroll-contain mt-4 mb-24'>
-				<Outlet/>
-			</main>
-		</>
-	)
-}
-
-export function ErrorBoundary() {
-	return (
-		<>
-			<Header/>
-			<ErrorPopup type='embedded'/>
-		</>
-	)
-}

app/routes/_data.users._index.tsx

@@ -1,66 +0,0 @@
-/* eslint-disable unicorn/filename-case */
-import { PersonIcon } from '@primer/octicons-react'
-import { type LoaderFunctionArgs } from '@remix-run/node'
-import { useLoaderData } from '@remix-run/react'
-
-import Attribute from '~/components/Attribute'
-import Card from '~/components/Card'
-import StatusCircle from '~/components/StatusCircle'
-import { type Machine } from '~/types'
-import { pull } from '~/utils/headscale'
-import { getSession } from '~/utils/sessions'
-import { useLiveData } from '~/utils/useLiveData'
-
-export async function loader({ request }: LoaderFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-
-	// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-	const data = await pull<{ nodes: Machine[] }>('v1/node', session.get('hsApiKey')!)
-
-	const users = new Map<string, Machine[]>()
-	for (const machine of data.nodes) {
-		const { user } = machine
-		if (!users.has(user.id)) {
-			users.set(user.id, [])
-		}
-
-		users.get(user.id)?.push(machine)
-	}
-
-	return [...users.values()].map(machines => {
-		const { user } = machines[0]
-
-		return {
-			...user,
-			machines
-		}
-	})
-}
-
-export default function Page() {
-	const data = useLoaderData<typeof loader>()
-	useLiveData({ interval: 3000 })
-
-	return (
-		<div className='grid grid-cols-2 gap-4 auto-rows-min'>
-			{data.map(user => (
-				<Card key={user.id}>
-					<div className='flex items-center gap-4'>
-						<PersonIcon className='w-6 h-6'/>
-						<span className='text-lg font-mono'>
-							{user.name}
-						</span>
-					</div>
-					<div className='py-4'>
-						{user.machines.map(machine => (
-							<div key={machine.id} className='flex items-center w-full gap-4'>
-								<StatusCircle isOnline={machine.online} className='w-4 h-4 px-1 w-fit'/>
-								<Attribute name={`Node ${machine.id}`} value={machine.givenName}/>
-							</div>
-						))}
-					</div>
-				</Card>
-			))}
-		</div>
-	)
-}

app/routes/_index.tsx

@@ -1,5 +0,0 @@
-import { redirect } from '@remix-run/node'
-
-export function loader() {
-	return redirect('/machines')
-}

app/routes/acls/components/cm.client.tsx

@@ -0,0 +1,136 @@
+import React, { useEffect } from 'react';
+import Merge from 'react-codemirror-merge';
+import CodeMirror from '@uiw/react-codemirror';
+import * as shopify from '@shopify/lang-jsonc';
+import { ClientOnly } from 'remix-utils/client-only';
+import { ErrorBoundary } from 'react-error-boundary';
+import { githubDark, githubLight } from '@uiw/codemirror-theme-github';
+import { useState } from 'react';
+import { cn } from '~/utils/cn';
+
+import Fallback from './fallback';
+
+interface EditorProps {
+	isDisabled?: boolean;
+	value: string;
+	onChange: (value: string) => void;
+}
+
+export function Editor(props: EditorProps) {
+	const [light, setLight] = useState(false);
+	useEffect(() => {
+		const theme = window.matchMedia('(prefers-color-scheme: light)');
+		setLight(theme.matches);
+		theme.addEventListener('change', (theme) => {
+			setLight(theme.matches);
+		});
+	});
+
+	return (
+		<div
+			className={cn(
+				'border border-gray-200 dark:border-gray-700',
+				'rounded-b-lg rounded-tr-lg mb-2 z-10 overflow-x-hidden',
+			)}
+		>
+			<div className="overflow-y-scroll h-editor text-sm">
+				<ErrorBoundary
+					fallback={
+						<p
+							className={cn(
+								'w-full h-full flex items-center justify-center',
+								'text-gray-400 dark:text-gray-500 text-xl',
+							)}
+						>
+							Failed to load the editor.
+						</p>
+					}
+				>
+					<ClientOnly fallback={<Fallback acl={props.value} />}>
+						{() => (
+							<CodeMirror
+								value={props.value}
+								height="100%"
+								extensions={[shopify.jsonc()]}
+								style={{ height: '100%' }}
+								theme={light ? githubLight : githubDark}
+								onChange={(value) => props.onChange(value)}
+							/>
+						)}
+					</ClientOnly>
+				</ErrorBoundary>
+			</div>
+		</div>
+	);
+}
+
+interface DifferProps {
+	left: string;
+	right: string;
+}
+
+export function Differ(props: DifferProps) {
+	const [light, setLight] = useState(false);
+	useEffect(() => {
+		const theme = window.matchMedia('(prefers-color-scheme: light)');
+		setLight(theme.matches);
+		theme.addEventListener('change', (theme) => {
+			setLight(theme.matches);
+		});
+	});
+
+	return (
+		<div
+			className={cn(
+				'border border-gray-200 dark:border-gray-700',
+				'rounded-b-lg rounded-tr-lg mb-2 z-10 overflow-x-hidden',
+			)}
+		>
+			<div className="overflow-y-scroll h-editor text-sm">
+				{props.left === props.right ? (
+					<p
+						className={cn(
+							'w-full h-full flex items-center justify-center',
+							'text-gray-400 dark:text-gray-500 text-xl',
+						)}
+					>
+						No changes
+					</p>
+				) : (
+					<ErrorBoundary
+						fallback={
+							<p
+								className={cn(
+									'w-full h-full flex items-center justify-center',
+									'text-gray-400 dark:text-gray-500 text-xl',
+								)}
+							>
+								Failed to load the editor.
+							</p>
+						}
+					>
+						<ClientOnly fallback={<Fallback acl={props.right} />}>
+							{() => (
+								<Merge
+									orientation="a-b"
+									theme={light ? githubLight : githubDark}
+								>
+									<Merge.Original
+										readOnly
+										value={props.left}
+										extensions={[shopify.jsonc()]}
+									/>
+									<Merge.Modified
+										readOnly
+										value={props.right}
+										extensions={[shopify.jsonc()]}
+									/>
+								</Merge>
+							)}
+						</ClientOnly>
+					</ErrorBoundary>
+				)}
+			</div>
+		</div>
+	);
+}

app/routes/acls/components/error.tsx

@@ -0,0 +1,25 @@
+import { cn } from '~/utils/cn';
+import { AlertIcon } from '@primer/octicons-react';
+
+import Card from '~/components/Card';
+import Code from '~/components/Code';
+
+interface Props {
+	message: string;
+}
+
+export function ErrorView({ message }: Props) {
+	return (
+		<Card variant="flat" className="max-w-full mb-4">
+			<div className="flex items-center justify-between">
+				<Card.Title className="text-xl mb-0">Error</Card.Title>
+				<AlertIcon className="w-8 h-8 text-red-500" />
+			</div>
+			<Card.Text className="mt-4">
+				Could not apply changes to your ACL policy due to the following error:
+				<br />
+				<Code>{message}</Code>
+			</Card.Text>
+		</Card>
+	);
+}

app/routes/acls/components/fallback.tsx

@@ -0,0 +1,24 @@
+import Spinner from '~/components/Spinner';
+import { cn } from '~/utils/cn';
+
+interface Props {
+	readonly acl: string;
+}
+
+export default function Fallback({ acl }: Props) {
+	return (
+		<div className="inline-block relative w-full h-editor">
+			<Spinner className="w-4 h-4 absolute p-2" />
+			<textarea
+				readOnly
+				className={cn(
+					'w-full h-editor font-mono resize-none',
+					'text-sm text-gray-600 dark:text-gray-300',
+					'bg-ui-100 dark:bg-ui-800',
+					'pl-10 pt-1 leading-snug',
+				)}
+				value={acl}
+			/>
+		</div>
+	);
+}

app/routes/acls/components/unavailable.tsx

@@ -0,0 +1,39 @@
+import { cn } from '~/utils/cn';
+import { AlertIcon } from '@primer/octicons-react';
+
+import Code from '~/components/Code';
+import Card from '~/components/Card';
+
+interface Props {
+	mode: 'file' | 'database';
+}
+
+export function Unavailable({ mode }: Props) {
+	return (
+		<Card variant="flat" className="max-w-prose mt-12">
+			<div className="flex items-center justify-between">
+				<Card.Title className="text-xl mb-0">ACL Policy Unavailable</Card.Title>
+				<AlertIcon className="w-8 h-8 text-red-500" />
+			</div>
+			<Card.Text className="mt-4">
+				Unable to load a valid ACL policy configuration. This is most likely due
+				to a misconfiguration in your Headscale configuration file.
+			</Card.Text>
+
+			{mode !== 'file' ? (
+				<p className="mt-4 text-sm">
+					According to your configuration, the ACL policy mode is set to{' '}
+					<Code>file</Code> but the ACL file is not available. Ensure that the{' '}
+					<Code>policy.path</Code> is set to a valid path in your Headscale
+					configuration.
+				</p>
+			) : (
+				<p className="mt-4 text-sm">
+					In order to fully utilize the ACL management features of Headplane,
+					please set <Code>policy.mode</Code> to either <Code>file</Code> or{' '}
+					<Code>database</Code> in your Headscale configuration.
+				</p>
+			)}
+		</Card>
+	);
+}

app/routes/acls/editor.tsx

@@ -0,0 +1,352 @@
+import {
+	BeakerIcon,
+	EyeIcon,
+	IssueDraftIcon,
+	PencilIcon,
+} from '@primer/octicons-react';
+import type { ActionFunctionArgs, LoaderFunctionArgs } from 'react-router';
+import { useLoaderData, useRevalidator, useFetcher } from 'react-router';
+//import { useDebounceFetcher } from 'remix-utils/use-debounce-fetcher';
+import { useEffect, useState, useMemo } from 'react';
+import { Tab, TabList, TabPanel, Tabs } from 'react-aria-components';
+import { setTimeout } from 'node:timers/promises';
+
+import Button from '~/components/Button';
+import Code from '~/components/Code';
+import Link from '~/components/Link';
+import Notice from '~/components/Notice';
+import Spinner from '~/components/Spinner';
+import { toast } from '~/components/Toaster';
+import { cn } from '~/utils/cn';
+import { loadContext } from '~/utils/config/headplane';
+import { loadConfig } from '~/utils/config/headscale';
+import { HeadscaleError, pull, put } from '~/utils/headscale';
+import { getSession } from '~/utils/sessions.server';
+import { send } from '~/utils/res';
+import log from '~/utils/log';
+
+import { Editor, Differ } from './components/cm.client';
+import { Unavailable } from './components/unavailable';
+import { ErrorView } from './components/error';
+
+export async function loader({ request }: LoaderFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+
+	// The way policy is handled in 0.23 of Headscale and later is verbose.
+	// The 2 ACL policy modes are either the database one or file one
+	//
+	// File: The ACL policy is readonly to the API and manually edited
+	// Database: The ACL policy is read/write to the API
+	//
+	// To determine if we first have an ACL policy available we need to check
+	// if fetching the v1/policy route gives us a 500 status code or a 200.
+	//
+	// 500 can mean many different things here unfortunately:
+	// - In file based that means the file is not accessible
+	// - In database mode this can mean that we have never set an ACL policy
+	// - In database mode this can mean that the ACL policy is not available
+	// - A general server error may have occurred
+	//
+	// Unfortunately the server errors are not very descriptive so we have to
+	// do some silly guesswork here. If we are running in an integration mode
+	// and have the Headscale configuration available to us, our assumptions
+	// can be more accurate, otherwise we just HAVE to assume that the ACL
+	// policy has never been set.
+	//
+	// We can do damage control by checking for write access and if we are not
+	// able to PUT an ACL policy on the v1/policy route, we can already know
+	// that the policy is at the very-least readonly or not available.
+	const context = await loadContext();
+	let modeGuess = 'database'; // Assume database mode
+	if (context.config.read) {
+		const config = await loadConfig();
+		modeGuess = config.policy?.mode ?? 'database';
+	}
+
+	// Attempt to load the policy, for both the frontend and for checking
+	// if we are able to write to the policy for write access
+	try {
+		const { policy } = await pull<{ policy: string }>(
+			'v1/policy',
+			session.get('hsApiKey')!,
+		);
+
+		let write = false; // On file mode we already know it's readonly
+		if (modeGuess === 'database' && policy.length > 0) {
+			try {
+				await put('v1/policy', session.get('hsApiKey')!, {
+					policy: policy,
+				});
+
+				write = true;
+			} catch (error) {
+				write = false;
+				log.debug('APIC', 'Failed to write to ACL policy with error %s', error);
+			}
+		}
+
+		return {
+			read: true,
+			write,
+			mode: modeGuess,
+			policy,
+		};
+	} catch {
+		// If we are explicit on file mode then this is the end of the road
+		if (modeGuess === 'file') {
+			return {
+				read: false,
+				write: false,
+				mode: modeGuess,
+				policy: null,
+			};
+		}
+
+		// Assume that we have write access otherwise?
+		// This is sort of a brittle assumption to make but we don't want
+		// to create a default policy if we don't have to.
+		return {
+			read: true,
+			write: true,
+			mode: modeGuess,
+			policy: null,
+		};
+	}
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	if (!session.has('hsApiKey')) {
+		return send({ success: false, error: null }, 401);
+	}
+
+	try {
+		const { acl } = (await request.json()) as { acl: string };
+		const { policy } = await put<{ policy: string }>(
+			'v1/policy',
+			session.get('hsApiKey')!,
+			{
+				policy: acl,
+			},
+		);
+
+		return { success: true, policy, error: null };
+	} catch (error) {
+		log.debug('APIC', 'Failed to update ACL policy with error %s', error);
+
+		// @ts-ignore: Shut UP we know it's a string most of the time
+		const text = JSON.parse(error.message);
+		return send(
+			{ success: false, error: text.message },
+			{
+				status: error instanceof HeadscaleError ? error.status : 500,
+			},
+		);
+	}
+
+	return { success: true, error: null };
+}
+
+export default function Page() {
+	const data = useLoaderData<typeof loader>();
+	const fetcher = useFetcher<typeof action>();
+	const revalidator = useRevalidator();
+
+	const [acl, setAcl] = useState(data.policy ?? '');
+	const [toasted, setToasted] = useState(false);
+
+	useEffect(() => {
+		if (!fetcher.data || toasted) {
+			return;
+		}
+
+		// @ts-ignore: useDebounceFetcher is not typed correctly
+		if (fetcher.data.success) {
+			toast('Updated tailnet ACL policy');
+		} else {
+			toast('Failed to update tailnet ACL policy');
+		}
+
+		setToasted(true);
+		if (revalidator.state === 'idle') {
+			revalidator.revalidate();
+		}
+	}, [fetcher.data, toasted, data.policy]);
+
+	// The state for if the save and discard buttons should be disabled
+	// is pretty complicated to calculate and varies on different states.
+	const disabled = useMemo(() => {
+		if (!data.read || !data.write) {
+			return true;
+		}
+
+		// First check our fetcher states
+		if (fetcher.state === 'loading') {
+			return true;
+		}
+
+		if (revalidator.state === 'loading') {
+			return true;
+		}
+
+		// If we have a failed fetcher state allow the user to try again
+		// @ts-ignore: useDebounceFetcher is not typed correctly
+		if (fetcher.data?.success === false) {
+			return false;
+		}
+
+		return data.policy === acl;
+	}, [data, revalidator.state, fetcher.state, fetcher.data, data.policy, acl]);
+
+	return (
+		<div>
+			{data.read && !data.write ? (
+				<div className="mb-4">
+					<Notice className="w-fit">
+						The ACL policy is read-only. You can view the current policy but you
+						cannot make changes to it.
+						<br />
+						To resolve this, you need to set the ACL policy mode to database in
+						your Headscale configuration.
+					</Notice>
+				</div>
+			) : undefined}
+			<h1 className="text-2xl font-medium mb-4">Access Control List (ACL)</h1>
+			<p className="mb-4 max-w-prose">
+				The ACL file is used to define the access control rules for your
+				network. You can find more information about the ACL file in the{' '}
+				<Link
+					to="https://tailscale.com/kb/1018/acls"
+					name="Tailscale ACL documentation"
+				>
+					Tailscale ACL guide
+				</Link>{' '}
+				and the{' '}
+				<Link
+					to="https://headscale.net/stable/ref/acls/"
+					name="Headscale ACL documentation"
+				>
+					Headscale docs
+				</Link>
+				.
+			</p>
+			{
+				// @ts-ignore: useDebounceFetcher is not typed correctly
+				fetcher.data?.success === false ? (
+					// @ts-ignore: useDebounceFetcher is not typed correctly
+					<ErrorView message={fetcher.data.error} />
+				) : undefined
+			}
+			{data.read ? (
+				<>
+					<Tabs>
+						<TabList
+							className={cn(
+								'flex border-t border-gray-200 dark:border-gray-700',
+								'w-fit rounded-t-lg overflow-hidden',
+								'text-gray-400 dark:text-gray-500',
+							)}
+						>
+							<Tab
+								id="edit"
+								className={({ isSelected }) =>
+									cn(
+										'px-4 py-2 rounded-tl-lg',
+										'focus:outline-none flex items-center gap-2',
+										'border-x border-gray-200 dark:border-gray-700',
+										isSelected ? 'text-gray-900 dark:text-gray-100' : '',
+									)
+								}
+							>
+								<PencilIcon className="w-5 h-5" />
+								<p>Edit file</p>
+							</Tab>
+							<Tab
+								id="diff"
+								className={({ isSelected }) =>
+									cn(
+										'px-4 py-2',
+										'focus:outline-none flex items-center gap-2',
+										'border-x border-gray-200 dark:border-gray-700',
+										isSelected ? 'text-gray-900 dark:text-gray-100' : '',
+									)
+								}
+							>
+								<EyeIcon className="w-5 h-5" />
+								<p>Preview changes</p>
+							</Tab>
+							<Tab
+								id="preview"
+								className={({ isSelected }) =>
+									cn(
+										'px-4 py-2 rounded-tr-lg',
+										'focus:outline-none flex items-center gap-2',
+										'border-x border-gray-200 dark:border-gray-700',
+										isSelected ? 'text-gray-900 dark:text-gray-100' : '',
+									)
+								}
+							>
+								<BeakerIcon className="w-5 h-5" />
+								<p>Preview rules</p>
+							</Tab>
+						</TabList>
+						<TabPanel id="edit">
+							<Editor isDisabled={!data.write} value={acl} onChange={setAcl} />
+						</TabPanel>
+						<TabPanel id="diff">
+							<Differ left={data?.policy ?? ''} right={acl} />
+						</TabPanel>
+						<TabPanel id="preview">
+							<div
+								className={cn(
+									'border border-gray-200 dark:border-gray-700',
+									'rounded-b-lg rounded-tr-lg mb-4 overflow-hidden',
+									'p-16 flex flex-col items-center justify-center',
+								)}
+							>
+								<IssueDraftIcon className="w-24 h-24 text-gray-300 dark:text-gray-500" />
+								<p className="w-1/2 text-center mt-4">
+									The Preview rules is very much still a work in progress. It is
+									a bit complicated to implement right now but hopefully it will
+									be available soon.
+								</p>
+							</div>
+						</TabPanel>
+					</Tabs>
+					<Button
+						variant="heavy"
+						className="mr-2"
+						isDisabled={disabled}
+						onPress={() => {
+							setToasted(false);
+							fetcher.submit(
+								{
+									acl,
+								},
+								{
+									method: 'PATCH',
+									encType: 'application/json',
+								},
+							);
+						}}
+					>
+						{fetcher.state === 'idle' ? undefined : (
+							<Spinner className="w-3 h-3" />
+						)}
+						Save
+					</Button>
+					<Button
+						isDisabled={disabled}
+						onPress={() => {
+							setAcl(data?.policy ?? '');
+						}}
+					>
+						Discard Changes
+					</Button>
+				</>
+			) : (
+				<Unavailable mode={data.mode as 'database' | 'file'} />
+			)}
+		</div>
+	);
+}

app/routes/auth/login.tsx

@@ -0,0 +1,142 @@
+import {
+	type ActionFunctionArgs,
+	type LoaderFunctionArgs,
+	redirect,
+} from 'react-router';
+import { Form, useActionData, useLoaderData } from 'react-router';
+import { useMemo } from 'react';
+
+import Button from '~/components/Button';
+import Card from '~/components/Card';
+import Code from '~/components/Code';
+import TextField from '~/components/TextField';
+import type { Key } from '~/types';
+import { loadContext } from '~/utils/config/headplane';
+import { pull } from '~/utils/headscale';
+import { beginAuthFlow, getRedirectUri } from '~/utils/oidc';
+import { commitSession, getSession } from '~/utils/sessions.server';
+
+export async function loader({ request }: LoaderFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	if (session.has('hsApiKey')) {
+		return redirect('/machines', {
+			headers: {
+				'Set-Cookie': await commitSession(session),
+			},
+		});
+	}
+
+	const context = await loadContext();
+
+	// Only set if OIDC is properly enabled anyways
+	if (context.oidc?.disableKeyLogin) {
+		return redirect('/oidc/start');
+	}
+
+	return {
+		oidc: context.oidc?.issuer,
+		apiKey: !context.oidc?.disableKeyLogin,
+	};
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+	const formData = await request.formData();
+	const oidcStart = formData.get('oidc-start');
+	const session = await getSession(request.headers.get('Cookie'));
+
+	if (oidcStart) {
+		const context = await loadContext();
+
+		if (!context.oidc) {
+			throw new Error('An invalid OIDC configuration was provided');
+		}
+
+		return redirect('/oidc/start');
+	}
+
+	const apiKey = String(formData.get('api-key'));
+
+	// Test the API key
+	try {
+		const apiKeys = await pull<{ apiKeys: Key[] }>('v1/apikey', apiKey);
+		const key = apiKeys.apiKeys.find((k) => apiKey.startsWith(k.prefix));
+		if (!key) {
+			throw new Error('Invalid API key');
+		}
+
+		const expiry = new Date(key.expiration);
+		const expiresIn = expiry.getTime() - Date.now();
+		const expiresDays = Math.round(expiresIn / 1000 / 60 / 60 / 24);
+
+		session.set('hsApiKey', apiKey);
+		session.set('user', {
+			subject: 'unknown-non-oauth',
+			name: key.prefix,
+			email: `${expiresDays.toString()} days`,
+		});
+
+		return redirect('/machines', {
+			headers: {
+				'Set-Cookie': await commitSession(session, {
+					maxAge: expiresIn,
+				}),
+			},
+		});
+	} catch {
+		return {
+			error: 'Invalid API key',
+		};
+	}
+}
+
+export default function Page() {
+	const data = useLoaderData<typeof loader>();
+	const actionData = useActionData<typeof action>();
+	const showOr = useMemo(() => data.oidc && data.apiKey, [data]);
+
+	return (
+		<div className="flex min-h-screen items-center justify-center">
+			<Card className="max-w-sm m-4 sm:m-0 rounded-2xl">
+				<Card.Title>Welcome to Headplane</Card.Title>
+				{data.apiKey ? (
+					<Form method="post">
+						<Card.Text className="mb-8 text-sm">
+							Enter an API key to authenticate with Headplane. You can generate
+							one by running <Code>headscale apikeys create</Code> in your
+							terminal.
+						</Card.Text>
+
+						{actionData?.error ? (
+							<p className="text-red-500 text-sm mb-2">{actionData.error}</p>
+						) : undefined}
+						<TextField
+							isRequired
+							label="API Key"
+							name="api-key"
+							placeholder="API Key"
+							type="password"
+						/>
+						<Button className="w-full mt-2.5" variant="heavy" type="submit">
+							Login
+						</Button>
+					</Form>
+				) : undefined}
+				{showOr ? (
+					<div className="flex items-center gap-x-1.5 py-1">
+						<hr className="flex-1 border-ui-300 dark:border-ui-800" />
+						<span className="text-gray-500 text-sm">or</span>
+						<hr className="flex-1 border-ui-300 dark:border-ui-800" />
+					</div>
+				) : undefined}
+				{data.oidc ? (
+					<Form method="POST">
+						<input type="hidden" name="oidc-start" value="true" />
+						<Button className="w-full" variant="heavy" type="submit">
+							Login with SSO
+						</Button>
+					</Form>
+				) : undefined}
+			</Card>
+		</div>
+	);
+}

app/routes/auth/logout.ts

@@ -0,0 +1,15 @@
+import { type ActionFunctionArgs, redirect } from 'react-router';
+import { destroySession, getSession } from '~/utils/sessions.server';
+
+export async function loader() {
+	return redirect('/machines');
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	return redirect('/login', {
+		headers: {
+			'Set-Cookie': await destroySession(session),
+		},
+	});
+}

app/routes/auth/oidc-callback.ts

@@ -0,0 +1,83 @@
+import { type LoaderFunctionArgs, redirect } from 'react-router';
+import { loadContext } from '~/utils/config/headplane';
+import { getSession, commitSession } from '~/utils/sessions.server';
+import { finishAuthFlow, getRedirectUri, formatError } from '~/utils/oidc';
+import { send } from '~/utils/res';
+
+export async function loader({ request }: LoaderFunctionArgs) {
+	// Check if we have 0 query parameters
+	const url = new URL(request.url);
+	if (url.searchParams.toString().length === 0) {
+		return redirect('/machines');
+	}
+
+	const session = await getSession(request.headers.get('Cookie'));
+	if (session.has('hsApiKey')) {
+		return redirect('/machines')
+	}
+
+	// This is a hold-over from the old code
+	// TODO: Rewrite checkOIDC in the context loader
+	const { oidc } = await loadContext();
+	if (!oidc) {
+		throw new Error('An invalid OIDC configuration was provided');
+	}
+
+	const oidcConfig = {
+		issuer: oidc.issuer,
+		clientId: oidc.client,
+		clientSecret: oidc.secret,
+		redirectUri: oidc.redirectUri,
+		tokenEndpointAuthMethod: oidc.method,
+	}
+
+	const codeVerifier = session.get('oidc_code_verif');
+	const state = session.get('oidc_state');
+	const nonce = session.get('oidc_nonce');
+	const redirectUri = session.get('oidc_redirect_uri');
+
+	if (!codeVerifier || !state || !nonce) {
+		return send({ error: 'Missing OIDC state' }, { status: 400 });
+	}
+
+	// Reconstruct the redirect URI using the query parameters
+	// and the one we saved in the session
+	const flowRedirectUri = new URL(redirectUri);
+	flowRedirectUri.search = url.search;
+
+	const flowOptions = {
+		redirect_uri: flowRedirectUri.toString(),
+		codeVerifier,
+		state,
+		nonce: nonce === '<none>' ? undefined : nonce,
+	}
+
+	try {
+		const user = await finishAuthFlow(oidcConfig, flowOptions);
+		session.set('user', user);
+		session.unset('oidc_code_verif');
+		session.unset('oidc_state');
+		session.unset('oidc_nonce');
+
+		// TODO: This is breaking, to stop the "over-generation" of API
+		// keys because they are currently non-deletable in the headscale
+		// database. Look at this in the future once we have a solution
+		// or we have permissioned API keys.
+		session.set('hsApiKey', oidc.rootKey);
+		return redirect('/machines', {
+			headers: {
+				'Set-Cookie': await commitSession(session),
+			},
+		});
+	} catch (error) {
+		return new Response(
+			JSON.stringify(formatError(error)),
+			{
+				status: 500,
+				headers: {
+					'Content-Type': 'application/json',
+				},
+			}
+		);
+	}
+}

app/routes/auth/oidc-start.ts

@@ -0,0 +1,41 @@
+import { type LoaderFunctionArgs, data, redirect } from 'react-router';
+import { commitSession, getSession } from '~/utils/sessions.server';
+import { send } from '~/utils/res';
+import { beginAuthFlow, getRedirectUri } from '~/utils/oidc';
+import { loadContext } from '~/utils/config/headplane';
+
+export async function loader({ request }: LoaderFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	if (session.has('hsApiKey')) {
+		return redirect('/machines')
+	}
+
+	// This is a hold-over from the old code
+	// TODO: Rewrite checkOIDC in the context loader
+	const { oidc } = await loadContext();
+	if (!oidc) {
+		throw new Error('An invalid OIDC configuration was provided');
+	}
+
+	const oidcConfig = {
+		issuer: oidc.issuer,
+		clientId: oidc.client,
+		clientSecret: oidc.secret,
+		redirectUri: oidc.redirectUri,
+		tokenEndpointAuthMethod: oidc.method,
+	}
+
+	const redirectUri = oidcConfig.redirectUri ?? getRedirectUri(request);
+	const data = await beginAuthFlow(oidcConfig, redirectUri);
+	session.set('oidc_code_verif', data.codeVerifier);
+	session.set('oidc_state', data.state);
+	session.set('oidc_nonce', data.nonce);
+	session.set('oidc_redirect_uri', redirectUri)
+
+	return redirect(data.url, {
+		status: 302,
+		headers: {
+			'Set-Cookie': await commitSession(session),
+		},
+	});
+}

app/routes/dns/components/dns.tsx

@@ -0,0 +1,81 @@
+import { useSubmit } from 'react-router';
+import { Button } from 'react-aria-components';
+
+import Code from '~/components/Code';
+import Link from '~/components/Link';
+import TableList from '~/components/TableList';
+import { cn } from '~/utils/cn';
+
+import AddDNS from '../dialogs/dns';
+
+interface Props {
+	records: { name: string; type: 'A'; value: string }[];
+	isDisabled: boolean;
+}
+
+export default function DNS({ records, isDisabled }: Props) {
+	const submit = useSubmit();
+
+	return (
+		<div className="flex flex-col w-2/3">
+			<h1 className="text-2xl font-medium mb-4">DNS Records</h1>
+			<p className="text-gray-700 dark:text-gray-300">
+				Headscale supports adding custom DNS records to your Tailnet. As of now,
+				only <Code>A</Code> records are supported.{' '}
+				<Link
+					to="https://headscale.net/stable/ref/dns"
+					name="Headscale DNS Records documentation"
+				>
+					Learn More
+				</Link>
+			</p>
+			<div className="mt-4">
+				<TableList className="mb-8">
+					{records.length === 0 ? (
+						<TableList.Item>
+							<p className="opacity-50 text-sm mx-auto">No DNS records found</p>
+						</TableList.Item>
+					) : (
+						records.map((record, index) => (
+							<TableList.Item key={index}>
+								<div className="flex gap-24">
+									<div className="flex gap-2">
+										<p className="font-mono text-sm font-bold">{record.type}</p>
+										<p className="font-mono text-sm">{record.name}</p>
+									</div>
+									<p className="font-mono text-sm">{record.value}</p>
+								</div>
+								<Button
+									className={cn(
+										'text-sm',
+										'text-red-600 dark:text-red-400',
+										'hover:text-red-700 dark:hover:text-red-300',
+										isDisabled && 'opacity-50 cursor-not-allowed',
+									)}
+									isDisabled={isDisabled}
+									onPress={() => {
+										submit(
+											{
+												'dns.extra_records': records.filter(
+													(_, i) => i !== index,
+												),
+											},
+											{
+												method: 'PATCH',
+												encType: 'application/json',
+											},
+										);
+									}}
+								>
+									Remove
+								</Button>
+							</TableList.Item>
+						))
+					)}
+				</TableList>
+
+				{isDisabled ? undefined : <AddDNS records={records} />}
+			</div>
+		</div>
+	);
+}

app/routes/dns/components/domains.tsx

@@ -0,0 +1,246 @@
+/* eslint-disable unicorn/no-keyword-prefix */
+import { closestCorners, DndContext, DragOverlay } from '@dnd-kit/core';
+import {
+	restrictToParentElement,
+	restrictToVerticalAxis,
+} from '@dnd-kit/modifiers';
+import {
+	arrayMove,
+	SortableContext,
+	useSortable,
+	verticalListSortingStrategy,
+} from '@dnd-kit/sortable';
+import { CSS } from '@dnd-kit/utilities';
+import { LockIcon, ThreeBarsIcon } from '@primer/octicons-react';
+import { type FetcherWithComponents, useFetcher } from 'react-router';
+import { useEffect, useState } from 'react';
+import { Button, Input } from 'react-aria-components';
+
+import Spinner from '~/components/Spinner';
+import TableList from '~/components/TableList';
+import { cn } from '~/utils/cn';
+
+type Properties = {
+	readonly baseDomain?: string;
+	readonly searchDomains: string[];
+	// eslint-disable-next-line react/boolean-prop-naming
+	readonly disabled?: boolean;
+};
+
+export default function Domains({
+	baseDomain,
+	searchDomains,
+	disabled,
+}: Properties) {
+	// eslint-disable-next-line unicorn/no-null, @typescript-eslint/ban-types
+	const [activeId, setActiveId] = useState<number | string | null>(null);
+	const [localDomains, setLocalDomains] = useState(searchDomains);
+	const [newDomain, setNewDomain] = useState('');
+	const fetcher = useFetcher();
+
+	useEffect(() => {
+		setLocalDomains(searchDomains);
+	}, [searchDomains]);
+
+	return (
+		<div className="flex flex-col w-2/3">
+			<h1 className="text-2xl font-medium mb-4">Search Domains</h1>
+			<p className="text-gray-700 dark:text-gray-300 mb-2">
+				Set custom DNS search domains for your Tailnet. When using Magic DNS,
+				your tailnet domain is used as the first search domain.
+			</p>
+			<DndContext
+				modifiers={[restrictToVerticalAxis, restrictToParentElement]}
+				collisionDetection={closestCorners}
+				onDragStart={(event) => {
+					setActiveId(event.active.id);
+				}}
+				onDragEnd={(event) => {
+					// eslint-disable-next-line unicorn/no-null
+					setActiveId(null);
+					const { active, over } = event;
+					if (!over) {
+						return;
+					}
+
+					const activeItem = localDomains[(active.id as number) - 1];
+					const overItem = localDomains[(over.id as number) - 1];
+
+					if (!activeItem || !overItem) {
+						return;
+					}
+
+					const oldIndex = localDomains.indexOf(activeItem);
+					const newIndex = localDomains.indexOf(overItem);
+
+					if (oldIndex !== newIndex) {
+						setLocalDomains(arrayMove(localDomains, oldIndex, newIndex));
+					}
+				}}
+			>
+				<TableList>
+					{baseDomain ? (
+						<TableList.Item key="magic-dns-sd">
+							<p className="font-mono text-sm">{baseDomain}</p>
+							<LockIcon className="h-4 w-4" />
+						</TableList.Item>
+					) : undefined}
+					<SortableContext
+						items={localDomains}
+						strategy={verticalListSortingStrategy}
+					>
+						{localDomains.map((sd, index) => (
+							<Domain
+								// eslint-disable-next-line react/no-array-index-key
+								key={index}
+								domain={sd}
+								id={index + 1}
+								localDomains={localDomains}
+								disabled={disabled}
+								fetcher={fetcher}
+							/>
+						))}
+						<DragOverlay adjustScale>
+							{activeId ? (
+								<Domain
+									isDrag
+									domain={localDomains[(activeId as number) - 1]}
+									localDomains={localDomains}
+									id={(activeId as number) - 1}
+									disabled={disabled}
+									fetcher={fetcher}
+								/>
+							) : undefined}
+						</DragOverlay>
+					</SortableContext>
+					{disabled ? undefined : (
+						<TableList.Item key="add-sd">
+							<Input
+								type="text"
+								className="font-mono text-sm bg-transparent w-full mr-2"
+								placeholder="Search Domain"
+								value={newDomain}
+								onChange={(event) => {
+									setNewDomain(event.target.value);
+								}}
+							/>
+							{fetcher.state === 'idle' ? (
+								<Button
+									className={cn(
+										'text-sm font-semibold',
+										'text-blue-600 dark:text-blue-400',
+										'hover:text-blue-700 dark:hover:text-blue-300',
+										newDomain.length === 0 && 'opacity-50 cursor-not-allowed',
+									)}
+									isDisabled={newDomain.length === 0}
+									onPress={() => {
+										fetcher.submit(
+											{
+												// eslint-disable-next-line @typescript-eslint/naming-convention
+												'dns.search_domains': [...localDomains, newDomain],
+											},
+											{
+												method: 'PATCH',
+												encType: 'application/json',
+											},
+										);
+
+										setNewDomain('');
+									}}
+								>
+									Add
+								</Button>
+							) : (
+								<Spinner className="w-3 h-3 mr-0" />
+							)}
+						</TableList.Item>
+					)}
+				</TableList>
+			</DndContext>
+		</div>
+	);
+}
+
+type DomainProperties = {
+	readonly domain: string;
+	readonly id: number;
+	readonly isDrag?: boolean;
+	readonly localDomains: string[];
+	// eslint-disable-next-line react/boolean-prop-naming
+	readonly disabled?: boolean;
+	readonly fetcher: FetcherWithComponents<unknown>;
+};
+
+function Domain({
+	domain,
+	id,
+	localDomains,
+	isDrag,
+	disabled,
+	fetcher,
+}: DomainProperties) {
+	const {
+		attributes,
+		listeners,
+		setNodeRef,
+		transform,
+		transition,
+		isDragging,
+	} = useSortable({ id });
+
+	// TODO: Figure out why TableList.Item breaks dndkit
+	return (
+		<div
+			ref={setNodeRef}
+			className={cn(
+				'flex items-center justify-between px-3 py-2',
+				'border-b border-gray-200 last:border-b-0 dark:border-zinc-800',
+				isDragging ? 'text-gray-400' : '',
+				isDrag
+					? 'outline outline-1 outline-gray-500 bg-gray-200 dark:bg-zinc-800'
+					: '',
+			)}
+			style={{
+				transform: CSS.Transform.toString(transform),
+				transition,
+			}}
+		>
+			<p className="font-mono text-sm flex items-center gap-4">
+				{disabled ? undefined : (
+					<ThreeBarsIcon
+						className="h-4 w-4 text-gray-400 focus:outline-none"
+						{...attributes}
+						{...listeners}
+					/>
+				)}
+				{domain}
+			</p>
+			{isDrag ? undefined : (
+				<Button
+					className={cn(
+						'text-sm',
+						'text-red-600 dark:text-red-400',
+						'hover:text-red-700 dark:hover:text-red-300',
+						disabled && 'opacity-50 cursor-not-allowed',
+					)}
+					isDisabled={disabled}
+					onPress={() => {
+						fetcher.submit(
+							{
+								'dns.search_domains': localDomains.filter(
+									(_, index) => index !== id - 1,
+								),
+							},
+							{
+								method: 'PATCH',
+								encType: 'application/json',
+							},
+						);
+					}}
+				>
+					Remove
+				</Button>
+			)}
+		</div>
+	);
+}

app/routes/dns/components/magic.tsx

@@ -0,0 +1,59 @@
+import { useFetcher } from 'react-router';
+
+import Dialog from '~/components/Dialog';
+import Spinner from '~/components/Spinner';
+
+type Properties = {
+	readonly isEnabled: boolean;
+	readonly disabled?: boolean;
+};
+
+export default function Modal({ isEnabled, disabled }: Properties) {
+	const fetcher = useFetcher();
+
+	return (
+		<Dialog>
+			<Dialog.Button isDisabled={disabled}>
+				{fetcher.state === 'idle' ? undefined : <Spinner className="w-3 h-3" />}
+				{isEnabled ? 'Disable' : 'Enable'} Magic DNS
+			</Dialog.Button>
+			<Dialog.Panel>
+				{(close) => (
+					<>
+						<Dialog.Title>
+							{isEnabled ? 'Disable' : 'Enable'} Magic DNS
+						</Dialog.Title>
+						<Dialog.Text>
+							Devices will no longer be accessible via your tailnet domain. The
+							search domain will also be disabled.
+						</Dialog.Text>
+						<div className="mt-6 flex justify-end gap-2 mt-6">
+							<Dialog.Action variant="cancel" onPress={close}>
+								Cancel
+							</Dialog.Action>
+							<Dialog.Action
+								variant="confirm"
+								onPress={() => {
+									fetcher.submit(
+										{
+											// eslint-disable-next-line @typescript-eslint/naming-convention
+											'dns.magic_dns': !isEnabled,
+										},
+										{
+											method: 'PATCH',
+											encType: 'application/json',
+										},
+									);
+
+									close();
+								}}
+							>
+								{isEnabled ? 'Disable' : 'Enable'} Magic DNS
+							</Dialog.Action>
+						</div>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/dns/components/nameservers.tsx

@@ -0,0 +1,125 @@
+import { useSubmit } from 'react-router';
+import { useState } from 'react';
+import { Button } from 'react-aria-components';
+
+import Link from '~/components/Link';
+import Switch from '~/components/Switch';
+import TableList from '~/components/TableList';
+import { cn } from '~/utils/cn';
+
+import AddNameserver from '../dialogs/nameserver';
+
+interface Props {
+	nameservers: Record<string, string[]>;
+	isDisabled: boolean;
+}
+
+export default function Nameservers({ nameservers, isDisabled }: Props) {
+	return (
+		<div className="flex flex-col w-2/3">
+			<h1 className="text-2xl font-medium mb-4">Nameservers</h1>
+			<p className="text-gray-700 dark:text-gray-300">
+				Set the nameservers used by devices on the Tailnet to resolve DNS
+				queries.{' '}
+				<Link
+					to="https://tailscale.com/kb/1054/dns"
+					name="Tailscale DNS Documentation"
+				>
+					Learn more
+				</Link>
+			</p>
+			<div className="mt-4">
+				{Object.keys(nameservers).map((key) => (
+					<NameserverList
+						key={key}
+						isGlobal={key === 'global'}
+						isDisabled={isDisabled}
+						nameservers={nameservers}
+						name={key}
+					/>
+				))}
+
+				{isDisabled ? undefined : <AddNameserver nameservers={nameservers} />}
+			</div>
+		</div>
+	);
+}
+
+interface ListProps {
+	isGlobal: boolean;
+	isDisabled: boolean;
+	nameservers: Record<string, string[]>;
+	name: string;
+}
+
+function NameserverList({
+	isGlobal,
+	isDisabled,
+	nameservers,
+	name,
+}: ListProps) {
+	const submit = useSubmit();
+	const list = isGlobal ? nameservers['global'] : nameservers[name];
+	if (list.length === 0) {
+		return null;
+	}
+
+	return (
+		<div className="mb-8">
+			<div className="flex items-center justify-between mb-2">
+				<h2 className="text-md font-medium opacity-80">
+					{isGlobal ? 'Global Nameservers' : name}
+				</h2>
+			</div>
+			<TableList>
+				{list.length > 0
+					? list.map((ns, index) => (
+							// eslint-disable-next-line react/no-array-index-key
+							<TableList.Item key={index}>
+								<p className="font-mono text-sm">{ns}</p>
+								<Button
+									className={cn(
+										'text-sm',
+										'text-red-600 dark:text-red-400',
+										'hover:text-red-700 dark:hover:text-red-300',
+										isDisabled && 'opacity-50 cursor-not-allowed',
+									)}
+									isDisabled={isDisabled}
+									onPress={() => {
+										if (isGlobal) {
+											submit(
+												{
+													'dns.nameservers.global': list.filter(
+														(_, i) => i !== index,
+													),
+												},
+												{
+													method: 'PATCH',
+													encType: 'application/json',
+												},
+											);
+										} else {
+											submit(
+												{
+													'dns.nameservers.split': {
+														...nameservers,
+														[name]: list.filter((_, i) => i !== index),
+													},
+												},
+												{
+													method: 'PATCH',
+													encType: 'application/json',
+												},
+											);
+										}
+									}}
+								>
+									Remove
+								</Button>
+							</TableList.Item>
+						))
+					: undefined}
+			</TableList>
+		</div>
+	);
+}

app/routes/dns/components/rename.tsx

@@ -0,0 +1,92 @@
+import { useFetcher } from 'react-router';
+import { useState } from 'react';
+import { Input } from 'react-aria-components';
+
+import Code from '~/components/Code';
+import Dialog from '~/components/Dialog';
+import Spinner from '~/components/Spinner';
+import TextField from '~/components/TextField';
+import { cn } from '~/utils/cn';
+
+type Properties = {
+	readonly name: string;
+	readonly disabled?: boolean;
+};
+
+export default function Modal({ name, disabled }: Properties) {
+	const [newName, setNewName] = useState(name);
+	const fetcher = useFetcher();
+
+	return (
+		<div className="flex flex-col w-2/3">
+			<h1 className="text-2xl font-medium mb-4">Tailnet Name</h1>
+			<p className="text-gray-700 dark:text-gray-300">
+				This is the base domain name of your Tailnet. Devices are accessible at{' '}
+				<Code>[device].{name}</Code> when Magic DNS is enabled.
+			</p>
+			<Input
+				readOnly
+				className={cn(
+					'block px-2.5 py-1.5 w-1/2 rounded-lg my-4',
+					'border border-ui-200 dark:border-ui-600',
+					'dark:bg-ui-800 dark:text-ui-300 text-sm',
+					'outline-none',
+				)}
+				type="text"
+				value={name}
+				onFocus={(event) => {
+					event.target.select();
+				}}
+			/>
+			<Dialog>
+				<Dialog.Button isDisabled={disabled}>
+					{fetcher.state === 'idle' ? undefined : (
+						<Spinner className="w-3 h-3" />
+					)}
+					Rename Tailnet
+				</Dialog.Button>
+				<Dialog.Panel>
+					{(close) => (
+						<>
+							<Dialog.Title>Rename Tailnet</Dialog.Title>
+							<Dialog.Text>
+								Keep in mind that changing this can lead to all sorts of
+								unexpected behavior and may break existing devices in your
+								tailnet.
+							</Dialog.Text>
+							<TextField
+								label="Tailnet name"
+								placeholder="ts.net"
+								state={[newName, setNewName]}
+								className="my-2"
+							/>
+							<div className="mt-6 flex justify-end gap-2 mt-6">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action
+									variant="confirm"
+									onPress={() => {
+										fetcher.submit(
+											{
+												'dns.base_domain': newName,
+											},
+											{
+												method: 'PATCH',
+												encType: 'application/json',
+											},
+										);
+
+										close();
+									}}
+								>
+									Rename
+								</Dialog.Action>
+							</div>
+						</>
+					)}
+				</Dialog.Panel>
+			</Dialog>
+		</div>
+	);
+}

app/routes/dns/dialogs/dns.tsx

@@ -0,0 +1,103 @@
+import { Form, useSubmit } from 'react-router';
+import { useMemo, useState } from 'react';
+
+import Code from '~/components/Code';
+import Dialog from '~/components/Dialog';
+import TextField from '~/components/TextField';
+import { cn } from '~/utils/cn';
+
+interface Props {
+	records: { name: string; type: 'A'; value: string }[];
+}
+
+export default function AddDNS({ records }: Props) {
+	const submit = useSubmit();
+	const [name, setName] = useState('');
+	const [ip, setIp] = useState('');
+
+	const isDuplicate = useMemo(() => {
+		if (name.length === 0 || ip.length === 0) return false;
+		const lookup = records.find((record) => record.name === name);
+		if (!lookup) return false;
+
+		return lookup.value === ip;
+	}, [records, name, ip]);
+
+	return (
+		<Dialog>
+			<Dialog.Button>Add DNS record</Dialog.Button>
+			<Dialog.Panel>
+				{(close) => (
+					<>
+						<Dialog.Title>Add DNS record</Dialog.Title>
+						<Dialog.Text>
+							Enter the domain and IP address for the new DNS record.
+						</Dialog.Text>
+						<Form
+							method="POST"
+							onSubmit={(event) => {
+								event.preventDefault();
+								if (!name || !ip) return;
+
+								setName('');
+								setIp('');
+
+								submit(
+									{
+										'dns.extra_records': [
+											...records,
+											{
+												name,
+												type: 'A',
+												value: ip,
+											},
+										],
+									},
+									{
+										method: 'PATCH',
+										encType: 'application/json',
+									},
+								);
+
+								close();
+							}}
+						>
+							<TextField
+								label="Domain"
+								placeholder="test.example.com"
+								name="domain"
+								state={[name, setName]}
+								className={cn('mt-2', isDuplicate && 'outline outline-red-500')}
+							/>
+							<TextField
+								label="IP Address"
+								placeholder="101.101.101.101"
+								name="ip"
+								state={[ip, setIp]}
+								className={cn(isDuplicate && 'outline outline-red-500')}
+							/>
+							{isDuplicate ? (
+								<p className="text-sm opacity-50">
+									A record with the domain name <Code>{name}</Code> and IP
+									address <Code>{ip}</Code> already exists.
+								</p>
+							) : undefined}
+							<div className="mt-6 flex justify-end gap-2 mt-8">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action
+									variant="confirm"
+									onPress={close}
+									isDisabled={isDuplicate}
+								>
+									Add
+								</Dialog.Action>
+							</div>
+						</Form>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/dns/dialogs/nameserver.tsx

@@ -0,0 +1,156 @@
+import { RepoForkedIcon } from '@primer/octicons-react';
+import { Form, useSubmit } from 'react-router';
+import { useState } from 'react';
+
+import Dialog from '~/components/Dialog';
+import Switch from '~/components/Switch';
+import TextField from '~/components/TextField';
+import Tooltip from '~/components/Tooltip';
+import { cn } from '~/utils/cn';
+
+interface Props {
+	nameservers: Record<string, string[]>;
+}
+
+export default function AddNameserver({ nameservers }: Props) {
+	const submit = useSubmit();
+	const [split, setSplit] = useState(false);
+	const [ns, setNs] = useState('');
+	const [domain, setDomain] = useState('');
+
+	return (
+		<Dialog>
+			<Dialog.Button>Add nameserver</Dialog.Button>
+			<Dialog.Panel>
+				{(close) => (
+					<>
+						<Dialog.Title>Add nameserver</Dialog.Title>
+						<Dialog.Text className="font-semibold">Nameserver</Dialog.Text>
+						<Dialog.Text className="text-sm">
+							Use this IPv4 or IPv6 address to resolve names.
+						</Dialog.Text>
+						<Form
+							method="POST"
+							onSubmit={(event) => {
+								event.preventDefault();
+								if (!ns) return;
+
+								if (split) {
+									const splitNs: Record<string, string[]> = {};
+									for (const [key, value] of Object.entries(nameservers)) {
+										if (key === 'global') continue;
+										splitNs[key] = value;
+									}
+
+									if (Object.keys(splitNs).includes(domain)) {
+										splitNs[domain].push(ns);
+									} else {
+										splitNs[domain] = [ns];
+									}
+
+									submit(
+										{
+											'dns.nameservers.split': splitNs,
+										},
+										{
+											method: 'PATCH',
+											encType: 'application/json',
+										},
+									);
+								} else {
+									const globalNs = nameservers.global;
+									globalNs.push(ns);
+
+									submit(
+										{
+											'dns.nameservers.global': globalNs,
+										},
+										{
+											method: 'PATCH',
+											encType: 'application/json',
+										},
+									);
+								}
+
+								setNs('');
+								setDomain('');
+								setSplit(false);
+								close();
+							}}
+						>
+							<TextField
+								label="DNS Server"
+								placeholder="1.2.3.4"
+								name="ns"
+								state={[ns, setNs]}
+								className="mt-2 mb-8"
+							/>
+							<div className="flex items-center justify-between">
+								<div className="block">
+									<div className="inline-flex items-center gap-2">
+										<Dialog.Text className="font-semibold">
+											Restrict to domain
+										</Dialog.Text>
+										<Tooltip>
+											<Tooltip.Button
+												className={cn(
+													'text-xs rounded-md px-1.5 py-0.5',
+													'bg-ui-200 dark:bg-ui-800',
+													'text-ui-600 dark:text-ui-300',
+												)}
+											>
+												<RepoForkedIcon className="w-4 h-4 mr-0.5" />
+												Split DNS
+											</Tooltip.Button>
+											<Tooltip.Body>
+												Only clients that support split DNS (Tailscale v1.8 or
+												later for most platforms) will use this nameserver.
+												Older clients will ignore it.
+											</Tooltip.Body>
+										</Tooltip>
+									</div>
+									<Dialog.Text className="text-sm">
+										This nameserver will only be used for some domains.
+									</Dialog.Text>
+								</div>
+								<Switch
+									label="Split DNS"
+									defaultSelected={split}
+									onChange={() => {
+										setSplit(!split);
+									}}
+								/>
+							</div>
+							{split ? (
+								<>
+									<Dialog.Text className="font-semibold mt-8">
+										Domain
+									</Dialog.Text>
+									<TextField
+										label="Domain"
+										placeholder="example.com"
+										name="domain"
+										state={[domain, setDomain]}
+										className="my-2"
+									/>
+									<Dialog.Text className="text-sm">
+										Only single-label or fully-qualified queries matching this
+										suffix should use the nameserver.
+									</Dialog.Text>
+								</>
+							) : undefined}
+							<div className="mt-6 flex justify-end gap-2 mt-6">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action variant="confirm" onPress={close}>
+									Add
+								</Dialog.Action>
+							</div>
+						</Form>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/dns/overview.tsx

@@ -0,0 +1,109 @@
+import type { ActionFunctionArgs } from 'react-router';
+import { data, useLoaderData } from 'react-router';
+
+import Code from '~/components/Code';
+import Notice from '~/components/Notice';
+import { loadContext } from '~/utils/config/headplane';
+import { loadConfig, patchConfig } from '~/utils/config/headscale';
+import { getSession } from '~/utils/sessions.server';
+import { useLiveData } from '~/utils/useLiveData';
+
+import DNS from './components/dns';
+import Domains from './components/domains';
+import MagicModal from './components/magic';
+import Nameservers from './components/nameservers';
+import RenameModal from './components/rename';
+
+// We do not want to expose every config value
+export async function loader() {
+	const context = await loadContext();
+	if (!context.config.read) {
+		throw new Error('No configuration is available');
+	}
+
+	const config = await loadConfig();
+	const dns = {
+		prefixes: config.prefixes,
+		magicDns: config.dns.magic_dns,
+		baseDomain: config.dns.use_username_in_magic_dns
+			? `[user].${config.dns.base_domain}`
+			: config.dns.base_domain,
+		nameservers: config.dns.nameservers.global,
+		splitDns: config.dns.nameservers.split,
+		searchDomains: config.dns.search_domains,
+		extraRecords: config.dns.extra_records,
+	};
+
+	return {
+		...dns,
+		...context,
+	};
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	if (!session.has('hsApiKey')) {
+		return data({ success: false }, { status: 401 });
+	}
+
+	const context = await loadContext();
+	if (!context.config.write) {
+		return data({ success: false }, { status: 403 });
+	}
+
+	const patch = (await request.json()) as Record<string, unknown>;
+	await patchConfig(patch);
+
+	if (context.integration?.onConfigChange) {
+		await context.integration.onConfigChange(context.integration.context);
+	}
+
+	return data({ success: true });
+}
+
+export default function Page() {
+	useLiveData({ interval: 5000 });
+	const data = useLoaderData<typeof loader>();
+
+	const allNs: Record<string, string[]> = {};
+	for (const key of Object.keys(data.splitDns)) {
+		allNs[key] = data.splitDns[key];
+	}
+
+	allNs.global = data.nameservers;
+
+	return (
+		<div className="flex flex-col gap-16 max-w-screen-lg">
+			{data.config.write ? undefined : (
+				<Notice>
+					The Headscale configuration is read-only. You cannot make changes to
+					the configuration
+				</Notice>
+			)}
+			<RenameModal name={data.baseDomain} disabled={!data.config.write} />
+			<Nameservers nameservers={allNs} isDisabled={!data.config.write} />
+
+			<DNS records={data.extraRecords} isDisabled={!data.config.write} />
+
+			<Domains
+				baseDomain={data.magicDns ? data.baseDomain : undefined}
+				searchDomains={data.searchDomains}
+				disabled={!data.config.write}
+			/>
+
+			<div className="flex flex-col w-2/3">
+				<h1 className="text-2xl font-medium mb-4">Magic DNS</h1>
+				<p className="text-gray-700 dark:text-gray-300 mb-4">
+					Automatically register domain names for each device on the tailnet.
+					Devices will be accessible at{' '}
+					<Code>
+						[device].
+						{data.baseDomain}
+					</Code>{' '}
+					when Magic DNS is enabled.
+				</p>
+				<MagicModal isEnabled={data.magicDns} disabled={!data.config.write} />
+			</div>
+		</div>
+	);
+}

app/routes/login.tsx

@@ -1,169 +0,0 @@
-import { type ActionFunctionArgs, json, type LoaderFunctionArgs, redirect } from '@remix-run/node'
-import { Form, useActionData, useLoaderData } from '@remix-run/react'
-import { useMemo } from 'react'
-
-import Button from '~/components/Button'
-import Card from '~/components/Card'
-import Code from '~/components/Code'
-import Input from '~/components/Input'
-import { type Key } from '~/types'
-import { getContext } from '~/utils/config'
-import { pull } from '~/utils/headscale'
-import { startOidc } from '~/utils/oidc'
-import { commitSession, getSession } from '~/utils/sessions'
-
-export async function loader({ request }: LoaderFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-	if (session.has('hsApiKey')) {
-		return redirect('/machines', {
-			headers: {
-				// eslint-disable-next-line @typescript-eslint/naming-convention
-				'Set-Cookie': await commitSession(session)
-			}
-		})
-	}
-
-	const context = await getContext()
-	const issuer = context.oidcConfig?.issuer
-	const id = context.oidcConfig?.client
-	const secret = context.oidcConfig?.secret
-	const normal = process.env.DISABLE_API_KEY_LOGIN
-
-	if (issuer && (!id || !secret)) {
-		throw new Error('An invalid OIDC configuration was provided')
-	}
-
-	const data = {
-		oidc: issuer,
-		apiKey: normal === undefined
-	}
-
-	if (!data.oidc && !data.apiKey) {
-		throw new Error('No authentication method is enabled')
-	}
-
-	if (data.oidc && !data.apiKey) {
-		// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-		return startOidc(data.oidc, id!, request)
-	}
-
-	return data
-}
-
-export async function action({ request }: ActionFunctionArgs) {
-	const formData = await request.formData()
-	const oidcStart = formData.get('oidc-start')
-
-	if (oidcStart) {
-		const context = await getContext()
-		const issuer = context.oidcConfig?.issuer
-		const id = context.oidcConfig?.client
-
-		// We know it exists here because this action only happens on OIDC
-		// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-		return startOidc(issuer!, id!, request)
-	}
-
-	const apiKey = String(formData.get('api-key'))
-	const session = await getSession(request.headers.get('Cookie'))
-
-	// Test the API key
-	try {
-		const apiKeys = await pull<{ apiKeys: Key[] }>('v1/apikey', apiKey)
-		const key = apiKeys.apiKeys.find(k => apiKey.startsWith(k.prefix))
-		if (!key) {
-			throw new Error('Invalid API key')
-		}
-
-		const expiry = new Date(key.expiration)
-		const expiresIn = expiry.getTime() - Date.now()
-		const expiresDays = Math.round(expiresIn / 1000 / 60 / 60 / 24)
-
-		session.set('hsApiKey', apiKey)
-		session.set('user', {
-			name: key.prefix,
-			email: `${expiresDays} days`
-		})
-
-		return redirect('/machines', {
-			headers: {
-				// eslint-disable-next-line @typescript-eslint/naming-convention
-				'Set-Cookie': await commitSession(session, {
-					maxAge: expiresIn
-				})
-			}
-		})
-	} catch (error) {
-		console.error(error)
-		return json({
-			error: 'Invalid API key'
-		})
-	}
-}
-
-export default function Page() {
-	const data = useLoaderData<typeof loader>()
-	const actionData = useActionData<typeof action>()
-	const showOr = useMemo(() => data.oidc && data.apiKey, [data])
-
-	return (
-		<div className='flex min-h-screen items-center justify-center'>
-			<Card className='w-96'>
-				<h1 className='text-2xl mb-8'>Login</h1>
-				{data.apiKey ? (
-					<Form method='post'>
-						<p className='text-sm text-gray-500 mb-4'>
-							Enter an API key to authenticate with Headplane. You can generate
-							one by running
-							{' '}
-							<Code>
-								headscale apikeys create
-							</Code>
-							{' '}
-							in your terminal.
-						</p>
-
-						{actionData?.error ? (
-							<p className='text-red-500 text-sm mb-2'>{actionData.error}</p>
-						) : undefined}
-						<Input
-							required
-							type='text'
-							name='api-key'
-							id='api-key'
-							className='border rounded-md p-2 w-full'
-							placeholder='API Key'
-						/>
-
-						<Button
-							variant='emphasized'
-							type='submit'
-							className='bg-gray-800 text-white rounded-md p-2 w-full mt-4'
-						>
-							Login
-						</Button>
-					</Form>
-				) : undefined}
-				{showOr ? (
-					<div className='flex items-center gap-x-2 py-2'>
-						<hr className='flex-1 dark:border-zinc-700'/>
-						<span className='text-gray-500'>or</span>
-						<hr className='flex-1 dark:border-zinc-700'/>
-					</div>
-				) : undefined}
-				{data.oidc ? (
-					<Form method='POST'>
-						<input type='hidden' name='oidc-start' value='true'/>
-						<Button
-							variant='emphasized'
-							type='submit'
-							className='bg-gray-800 text-white rounded-md p-2 w-full'
-						>
-							Login with SSO
-						</Button>
-					</Form>
-				) : undefined}
-			</Card>
-		</div>
-	)
-}

app/routes/logout.tsx

@@ -1,15 +0,0 @@
-import { type ActionFunctionArgs, redirect } from '@remix-run/node'
-
-import { destroySession, getSession } from '~/utils/sessions'
-
-export async function action({ request }: ActionFunctionArgs) {
-	const session = await getSession(request.headers.get('Cookie'))
-	const returnTo = new URL(request.url).pathname
-
-	return redirect(`/login?returnTo=${returnTo}`, {
-		headers: {
-			// eslint-disable-next-line @typescript-eslint/naming-convention
-			'Set-Cookie': await destroySession(session)
-		}
-	})
-}

app/routes/machines/action.tsx

@@ -0,0 +1,208 @@
+import type { ActionFunctionArgs } from 'react-router';
+import { del, post } from '~/utils/headscale';
+import { getSession } from '~/utils/sessions.server';
+import { send } from '~/utils/res';
+import log from '~/utils/log';
+
+export async function menuAction(request: ActionFunctionArgs['request']) {
+	const session = await getSession(request.headers.get('Cookie'));
+	if (!session.has('hsApiKey')) {
+		return send(
+			{ message: 'Unauthorized' },
+			{
+				status: 401,
+			},
+		);
+	}
+
+	const data = await request.formData();
+	if (!data.has('_method') || !data.has('id')) {
+		return send(
+			{ message: 'No method or ID provided' },
+			{
+				status: 400,
+			},
+		);
+	}
+
+	const id = String(data.get('id'));
+	const method = String(data.get('_method'));
+
+	switch (method) {
+		case 'delete': {
+			await del(`v1/node/${id}`, session.get('hsApiKey')!);
+			return { message: 'Machine removed' };
+		}
+
+		case 'expire': {
+			await post(`v1/node/${id}/expire`, session.get('hsApiKey')!);
+			return { message: 'Machine expired' };
+		}
+
+		case 'rename': {
+			if (!data.has('name')) {
+				return send(
+					{ message: 'No name provided' },
+					{
+						status: 400,
+					},
+				);
+			}
+
+			const name = String(data.get('name'));
+
+			await post(`v1/node/${id}/rename/${name}`, session.get('hsApiKey')!);
+			return { message: 'Machine renamed' };
+		}
+
+		case 'routes': {
+			if (!data.has('route') || !data.has('enabled')) {
+				return send(
+					{ message: 'No route or enabled provided' },
+					{
+						status: 400,
+					},
+				);
+			}
+
+			const route = String(data.get('route'));
+			const enabled = data.get('enabled') === 'true';
+			const postfix = enabled ? 'enable' : 'disable';
+
+			await post(`v1/routes/${route}/${postfix}`, session.get('hsApiKey')!);
+			return { message: 'Route updated' };
+		}
+
+		case 'exit-node': {
+			if (!data.has('routes') || !data.has('enabled')) {
+				return send(
+					{ message: 'No route or enabled provided' },
+					{
+						status: 400,
+					},
+				);
+			}
+
+			const routes = data.get('routes')?.toString().split(',') ?? [];
+			const enabled = data.get('enabled') === 'true';
+			const postfix = enabled ? 'enable' : 'disable';
+
+			await Promise.all(
+				routes.map(async (route) => {
+					await post(`v1/routes/${route}/${postfix}`, session.get('hsApiKey')!);
+				}),
+			);
+
+			return { message: 'Exit node updated' };
+		}
+
+		case 'move': {
+			if (!data.has('to')) {
+				return send(
+					{ message: 'No destination provided' },
+					{
+						status: 400,
+					},
+				);
+			}
+
+			const to = String(data.get('to'));
+
+			try {
+				await post(`v1/node/${id}/user?user=${to}`, session.get('hsApiKey')!);
+				return { message: `Moved node ${id} to ${to}` };
+			} catch {
+				return send(
+					{ message: `Failed to move node ${id} to ${to}` },
+					{
+						status: 500,
+					},
+				);
+			}
+		}
+
+		case 'tags': {
+			const tags =
+				data
+					.get('tags')
+					?.toString()
+					.split(',')
+					.filter((tag) => tag.trim() !== '') ?? [];
+
+			try {
+				await post(`v1/node/${id}/tags`, session.get('hsApiKey')!, {
+					tags,
+				});
+
+				return { message: 'Tags updated' };
+			} catch (error) {
+				log.debug('APIC', 'Failed to update tags: %s', error);
+				return send(
+					{ message: 'Failed to update tags' },
+					{
+						status: 500,
+					},
+				);
+			}
+		}
+
+		case 'register': {
+			const key = data.get('mkey')?.toString();
+			const user = data.get('user')?.toString();
+
+			if (!key) {
+				return send(
+					{ message: 'No machine key provided' },
+					{
+						status: 400,
+					},
+				);
+			}
+
+			if (!user) {
+				return send(
+					{ message: 'No user provided' },
+					{
+						status: 400,
+					},
+				);
+			}
+
+			try {
+				const qp = new URLSearchParams();
+				qp.append('user', user);
+				qp.append('key', key);
+
+				const url = `v1/node/register?${qp.toString()}`;
+				await post(url, session.get('hsApiKey')!, {
+					user,
+					key,
+				});
+
+				return {
+					success: true,
+					message: 'Machine registered',
+				};
+			} catch {
+				return send(
+					{
+						success: false,
+						message: 'Failed to register machine',
+					},
+					{
+						status: 500,
+					},
+				);
+			}
+		}
+
+		default: {
+			return send(
+				{ message: 'Invalid method' },
+				{
+					status: 400,
+				},
+			);
+		}
+	}
+}

app/routes/machines/components/machine.tsx

@@ -0,0 +1,202 @@
+import { ChevronDownIcon, CopyIcon } from '@primer/octicons-react';
+import { Link } from 'react-router';
+import { useMemo } from 'react';
+import Menu from '~/components/Menu';
+import StatusCircle from '~/components/StatusCircle';
+import { toast } from '~/components/Toaster';
+import type { Machine, Route, User, HostInfo } from '~/types';
+import { cn } from '~/utils/cn';
+import * as hinfo from '~/utils/host-info';
+
+import MenuOptions from './menu';
+
+interface Props {
+	machine: Machine;
+	routes: Route[];
+	users: User[];
+	magic?: string;
+	stats?: HostInfo;
+}
+
+export default function MachineRow({ machine, routes, magic, users, stats }: Props) {
+	const expired =
+		machine.expiry === '0001-01-01 00:00:00' ||
+		machine.expiry === '0001-01-01T00:00:00Z' ||
+		machine.expiry === null
+			? false
+			: new Date(machine.expiry).getTime() < Date.now();
+
+	const tags = [...machine.forcedTags, ...machine.validTags];
+
+	if (expired) {
+		tags.unshift('Expired');
+	}
+
+	const prefix = magic?.startsWith('[user]')
+		? magic.replace('[user]', machine.user.name)
+		: magic;
+
+	// This is much easier with Object.groupBy but it's too new for us
+	const { exit, subnet, subnetApproved } = routes.reduce<{
+		exit: Route[];
+		subnetApproved: Route[];
+		subnet: Route[];
+	}>(
+		(acc, route) => {
+			if (route.prefix === '::/0' || route.prefix === '0.0.0.0/0') {
+				acc.exit.push(route);
+				return acc;
+			}
+
+			if (route.enabled) {
+				acc.subnetApproved.push(route);
+				return acc;
+			}
+
+			acc.subnet.push(route);
+			return acc;
+		},
+		{ exit: [], subnetApproved: [], subnet: [] },
+	);
+
+	const exitEnabled = useMemo(() => {
+		if (exit.length !== 2) return false;
+		return exit[0].enabled && exit[1].enabled;
+	}, [exit]);
+
+	if (exitEnabled) {
+		tags.unshift('Exit Node');
+	}
+
+	if (subnetApproved.length > 0) {
+		tags.unshift('Subnets');
+	}
+
+	return (
+		<tr
+			key={machine.id}
+			className="hover:bg-zinc-100 dark:hover:bg-zinc-800 group"
+		>
+			<td className="pl-0.5 py-2">
+				<Link to={`/machines/${machine.id}`} className="group/link h-full">
+					<p
+						className={cn(
+							'font-semibold leading-snug',
+							'group-hover/link:text-blue-600',
+							'group-hover/link:dark:text-blue-400',
+						)}
+					>
+						{machine.givenName}
+					</p>
+					<p className="text-sm text-gray-500 dark:text-gray-300 font-mono">
+						{machine.name}
+					</p>
+					<div className="flex gap-1 mt-1">
+						{tags.map((tag) => (
+							<span
+								key={tag}
+								className={cn(
+									'text-xs rounded-md px-1.5 py-0.5',
+									'bg-ui-200 dark:bg-ui-800',
+									'text-ui-600 dark:text-ui-300',
+								)}
+							>
+								{tag}
+							</span>
+						))}
+					</div>
+				</Link>
+			</td>
+			<td className="py-2">
+				<div className="flex items-center gap-x-1">
+					{machine.ipAddresses[0]}
+					<Menu>
+						<Menu.Button>
+							<ChevronDownIcon className="w-4 h-4" />
+						</Menu.Button>
+						<Menu.Items>
+							{machine.ipAddresses.map((ip) => (
+								<Menu.ItemButton
+									key={ip}
+									type="button"
+									className={cn(
+										'flex items-center gap-x-1.5 text-sm',
+										'justify-between w-full',
+									)}
+									onPress={async () => {
+										await navigator.clipboard.writeText(ip);
+										toast('Copied IP address to clipboard');
+									}}
+								>
+									{ip}
+									<CopyIcon className="w-3 h-3" />
+								</Menu.ItemButton>
+							))}
+							{magic ? (
+								<Menu.ItemButton
+									type="button"
+									className={cn(
+										'flex items-center gap-x-1.5 text-sm',
+										'justify-between w-full break-keep',
+									)}
+									onPress={async () => {
+										const ip = `${machine.givenName}.${prefix}`;
+										await navigator.clipboard.writeText(ip);
+										toast('Copied hostname to clipboard');
+									}}
+								>
+									{machine.givenName}.{prefix}
+									<CopyIcon className="w-3 h-3" />
+								</Menu.ItemButton>
+							) : undefined}
+						</Menu.Items>
+					</Menu>
+				</div>
+			</td>
+			{/**
+			<td className="py-2">
+					{stats !== undefined ? (
+						<>
+						<p className="leading-snug">
+							{hinfo.getTSVersion(stats)}
+						</p>
+						<p className="text-sm text-gray-500 dark:text-gray-300 max-w-48 truncate">
+							{hinfo.getOSInfo(stats)}
+						</p>
+						</>
+					) : (
+						<p className="text-sm text-gray-500 dark:text-gray-300">
+							Unknown
+						</p>
+					)}
+			</td>
+			**/}
+			<td className="py-2">
+				<span
+					className={cn(
+						'flex items-center gap-x-1 text-sm',
+						'text-gray-500 dark:text-gray-400',
+					)}
+				>
+					<StatusCircle
+						isOnline={machine.online && !expired}
+						className="w-4 h-4"
+					/>
+					<p>
+						{machine.online && !expired
+							? 'Connected'
+							: new Date(machine.lastSeen).toLocaleString()}
+					</p>
+				</span>
+			</td>
+			<td className="py-2 pr-0.5">
+				<MenuOptions
+					machine={machine}
+					routes={routes}
+					users={users}
+					magic={magic}
+				/>
+			</td>
+		</tr>
+	);
+}

app/routes/machines/components/menu.tsx

@@ -0,0 +1,93 @@
+import { KebabHorizontalIcon } from '@primer/octicons-react';
+import { type ReactNode, useState } from 'react';
+
+import MenuComponent from '~/components/Menu';
+import type { Machine, Route, User } from '~/types';
+import { cn } from '~/utils/cn';
+
+import Delete from '../dialogs/delete';
+import Expire from '../dialogs/expire';
+import Move from '../dialogs/move';
+import Rename from '../dialogs/rename';
+import Routes from '../dialogs/routes';
+import Tags from '../dialogs/tags';
+
+interface MenuProps {
+	machine: Machine;
+	routes: Route[];
+	users: User[];
+	magic?: string;
+	buttonChild?: ReactNode;
+}
+
+export default function Menu({
+	machine,
+	routes,
+	magic,
+	users,
+	buttonChild,
+}: MenuProps) {
+	const renameState = useState(false);
+	const expireState = useState(false);
+	const removeState = useState(false);
+	const routesState = useState(false);
+	const moveState = useState(false);
+	const tagsState = useState(false);
+
+	const expired =
+		machine.expiry === '0001-01-01 00:00:00' ||
+		machine.expiry === '0001-01-01T00:00:00Z' ||
+		machine.expiry === null
+			? false
+			: new Date(machine.expiry).getTime() < Date.now();
+
+	return (
+		<>
+			<Rename machine={machine} state={renameState} magic={magic} />
+			<Delete machine={machine} state={removeState} />
+			{expired ? undefined : <Expire machine={machine} state={expireState} />}
+			<Routes machine={machine} routes={routes} state={routesState} />
+			<Tags machine={machine} state={tagsState} />
+			<Move machine={machine} state={moveState} users={users} magic={magic} />
+
+			<MenuComponent>
+				{buttonChild ?? (
+					<MenuComponent.Button
+						className={cn(
+							'flex items-center justify-center',
+							'border border-transparent rounded-lg py-0.5 w-10',
+							'group-hover:border-gray-200 dark:group-hover:border-zinc-700',
+						)}
+					>
+						<KebabHorizontalIcon className="w-5" />
+					</MenuComponent.Button>
+				)}
+				<MenuComponent.Items>
+					<MenuComponent.ItemButton control={renameState}>
+						Edit machine name
+					</MenuComponent.ItemButton>
+					<MenuComponent.ItemButton control={routesState}>
+						Edit route settings
+					</MenuComponent.ItemButton>
+					<MenuComponent.ItemButton control={tagsState}>
+						Edit ACL tags
+					</MenuComponent.ItemButton>
+					<MenuComponent.ItemButton control={moveState}>
+						Change owner
+					</MenuComponent.ItemButton>
+					{expired ? undefined : (
+						<MenuComponent.ItemButton control={expireState}>
+							Expire
+						</MenuComponent.ItemButton>
+					)}
+					<MenuComponent.ItemButton
+						className="text-red-500 dark:text-red-400"
+						control={removeState}
+					>
+						Remove
+					</MenuComponent.ItemButton>
+				</MenuComponent.Items>
+			</MenuComponent>
+		</>
+	);
+}

app/routes/machines/dialogs/delete.tsx

@@ -0,0 +1,58 @@
+import { Form, useSubmit } from 'react-router';
+import type { Dispatch, SetStateAction } from 'react';
+
+import Dialog from '~/components/Dialog';
+import type { Machine } from '~/types';
+import { cn } from '~/utils/cn';
+
+interface DeleteProps {
+	readonly machine: Machine;
+	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
+}
+
+export default function Delete({ machine, state }: DeleteProps) {
+	const submit = useSubmit();
+
+	return (
+		<Dialog>
+			<Dialog.Panel control={state}>
+				{(close) => (
+					<>
+						<Dialog.Title>Remove {machine.givenName}</Dialog.Title>
+						<Dialog.Text>
+							This machine will be permanently removed from your network. To
+							re-add it, you will need to reauthenticate to your tailnet from
+							the device.
+						</Dialog.Text>
+						<Form
+							method="POST"
+							onSubmit={(e) => {
+								submit(e.currentTarget);
+							}}
+						>
+							<input type="hidden" name="_method" value="delete" />
+							<input type="hidden" name="id" value={machine.id} />
+							<div className="mt-6 flex justify-end gap-2 mt-6">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action
+									variant="confirm"
+									className={cn(
+										'bg-red-500 hover:border-red-700',
+										'dark:bg-red-600 dark:hover:border-red-700',
+										'pressed:bg-red-600 hover:bg-red-600',
+										'text-white dark:text-white',
+									)}
+									onPress={close}
+								>
+									Remove
+								</Dialog.Action>
+							</div>
+						</Form>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/machines/dialogs/expire.tsx

@@ -0,0 +1,57 @@
+import { Form, useSubmit } from 'react-router';
+import type { Dispatch, SetStateAction } from 'react';
+
+import Dialog from '~/components/Dialog';
+import type { Machine } from '~/types';
+import { cn } from '~/utils/cn';
+
+interface ExpireProps {
+	readonly machine: Machine;
+	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
+}
+
+export default function Expire({ machine, state }: ExpireProps) {
+	const submit = useSubmit();
+
+	return (
+		<Dialog>
+			<Dialog.Panel control={state}>
+				{(close) => (
+					<>
+						<Dialog.Title>Expire {machine.givenName}</Dialog.Title>
+						<Dialog.Text>
+							This will disconnect the machine from your Tailnet. In order to
+							reconnect, you will need to re-authenticate from the device.
+						</Dialog.Text>
+						<Form
+							method="POST"
+							onSubmit={(e) => {
+								submit(e.currentTarget);
+							}}
+						>
+							<input type="hidden" name="_method" value="expire" />
+							<input type="hidden" name="id" value={machine.id} />
+							<div className="mt-6 flex justify-end gap-2 mt-6">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action
+									variant="confirm"
+									className={cn(
+										'bg-red-500 hover:border-red-700',
+										'dark:bg-red-600 dark:hover:border-red-700',
+										'pressed:bg-red-600 hover:bg-red-600',
+										'text-white dark:text-white',
+									)}
+									onPress={close}
+								>
+									Expire
+								</Dialog.Action>
+							</div>
+						</Form>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/machines/dialogs/move.tsx

@@ -0,0 +1,72 @@
+import { Form, useSubmit } from 'react-router';
+import { type Dispatch, type SetStateAction, useState } from 'react';
+
+import Code from '~/components/Code';
+import Dialog from '~/components/Dialog';
+import Select from '~/components/Select';
+import type { Machine, User } from '~/types';
+
+interface MoveProps {
+	readonly machine: Machine;
+	readonly users: User[];
+	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
+	readonly magic?: string;
+}
+
+export default function Move({ machine, state, magic, users }: MoveProps) {
+	const [owner, setOwner] = useState(machine.user.name);
+	const submit = useSubmit();
+
+	return (
+		<Dialog>
+			<Dialog.Panel control={state}>
+				{(close) => (
+					<>
+						<Dialog.Title>Change the owner of {machine.givenName}</Dialog.Title>
+						<Dialog.Text>
+							The owner of the machine is the user associated with it.
+						</Dialog.Text>
+						<Form
+							method="POST"
+							onSubmit={(e) => {
+								submit(e.currentTarget);
+							}}
+						>
+							<input type="hidden" name="_method" value="move" />
+							<input type="hidden" name="id" value={machine.id} />
+							<Select
+								label="Owner"
+								name="to"
+								placeholder="Select a user"
+								state={[owner, setOwner]}
+							>
+								{users.map((user) => (
+									<Select.Item key={user.id} id={user.name}>
+										{user.name}
+									</Select.Item>
+								))}
+							</Select>
+							{magic ? (
+								<p className="text-sm text-gray-500 dark:text-gray-300 leading-tight">
+									This machine is accessible by the hostname{' '}
+									<Code className="text-sm">
+										{machine.givenName}.{magic}
+									</Code>
+									.
+								</p>
+							) : undefined}
+							<div className="mt-6 flex justify-end gap-2 mt-6">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action variant="confirm" onPress={close}>
+									Change owner
+								</Dialog.Action>
+							</div>
+						</Form>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/machines/dialogs/new.tsx

@@ -0,0 +1,130 @@
+import { Form, useFetcher, Link } from 'react-router';
+import { Dispatch, SetStateAction, useState, useEffect } from 'react';
+import { PlusIcon, ServerIcon, KeyIcon } from '@primer/octicons-react';
+import { cn } from '~/utils/cn';
+
+import Code from '~/components/Code';
+import Dialog from '~/components/Dialog';
+import TextField from '~/components/TextField';
+import Select from '~/components/Select';
+import Menu from '~/components/Menu';
+import Spinner from '~/components/Spinner';
+import { toast } from '~/components/Toaster';
+import { Machine, type User } from '~/types';
+
+export interface NewProps {
+	server: string;
+	users: User[];
+}
+
+export default function New(data: NewProps) {
+	const fetcher = useFetcher<{ success?: boolean }>();
+	const mkeyState = useState(false);
+	const [mkey, setMkey] = useState('');
+	const [user, setUser] = useState('');
+	const [toasted, setToasted] = useState(false);
+
+	useEffect(() => {
+		if (!fetcher.data || toasted) {
+			return;
+		}
+
+		if (fetcher.data.success) {
+			toast('Registered new machine');
+		} else {
+			toast('Failed to register machine due to an invalid key');
+		}
+
+		setToasted(true);
+	}, [fetcher.data, toasted, mkey]);
+
+	return (
+		<>
+			<Dialog>
+				<Dialog.Panel control={mkeyState}>
+					{(close) => (
+						<>
+							<Dialog.Title>Register Machine Key</Dialog.Title>
+							<Dialog.Text className="mb-4">
+								The machine key is given when you run{' '}
+								<Code isCopyable>
+									tailscale up --login-server=
+									{data.server}
+								</Code>{' '}
+								on your device.
+							</Dialog.Text>
+							<fetcher.Form
+								method="POST"
+								onSubmit={(e) => {
+									fetcher.submit(e.currentTarget);
+									close();
+								}}
+							>
+								<input type="hidden" name="_method" value="register" />
+								<input type="hidden" name="id" value="_" />
+								<TextField
+									label="Machine Key"
+									placeholder="mkey:ff....."
+									name="mkey"
+									state={[mkey, setMkey]}
+									className="my-2 font-mono"
+								/>
+								<Select
+									label="Owner"
+									name="user"
+									placeholder="Select a user"
+									state={[user, setUser]}
+								>
+									{data.users.map((user) => (
+										<Select.Item key={user.id} id={user.name}>
+											{user.name}
+										</Select.Item>
+									))}
+								</Select>
+								<div className="mt-6 flex justify-end gap-2 mt-6">
+									<Dialog.Action variant="cancel" onPress={close}>
+										Cancel
+									</Dialog.Action>
+									<Dialog.Action
+										variant="confirm"
+										isDisabled={
+											!mkey || !mkey.trim().startsWith('mkey:') || !user
+										}
+									>
+										{fetcher.state === 'idle' ? undefined : (
+											<Spinner className="w-3 h-3" />
+										)}
+										Register
+									</Dialog.Action>
+								</div>
+							</fetcher.Form>
+						</>
+					)}
+				</Dialog.Panel>
+			</Dialog>
+			<Menu>
+				<Menu.Button
+					className={cn(
+						'w-fit text-sm rounded-lg px-4 py-2',
+						'bg-main-700 dark:bg-main-800 text-white',
+						'hover:bg-main-800 dark:hover:bg-main-700',
+					)}
+				>
+					Add Device
+				</Menu.Button>
+				<Menu.Items>
+					<Menu.ItemButton control={mkeyState}>
+						<ServerIcon className="w-4 h-4 mr-2" />
+						Register Machine Key
+					</Menu.ItemButton>
+					<Menu.ItemButton>
+						<Link to="/settings/auth-keys">
+							<KeyIcon className="w-4 h-4 mr-2" />
+							Generate Pre-auth Key
+						</Link>
+					</Menu.ItemButton>
+				</Menu.Items>
+			</Menu>
+		</>
+	);
+}

app/routes/machines/dialogs/rename.tsx

@@ -0,0 +1,79 @@
+import { Form, useSubmit } from 'react-router';
+import { type Dispatch, type SetStateAction, useState } from 'react';
+
+import Code from '~/components/Code';
+import Dialog from '~/components/Dialog';
+import TextField from '~/components/TextField';
+import type { Machine } from '~/types';
+
+interface RenameProps {
+	readonly machine: Machine;
+	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
+	readonly magic?: string;
+}
+
+export default function Rename({ machine, state, magic }: RenameProps) {
+	const [name, setName] = useState(machine.givenName);
+	const submit = useSubmit();
+
+	return (
+		<Dialog>
+			<Dialog.Panel control={state}>
+				{(close) => (
+					<>
+						<Dialog.Title>
+							Edit machine name for {machine.givenName}
+						</Dialog.Title>
+						<Dialog.Text>
+							This name is shown in the admin panel, in Tailscale clients, and
+							used when generating MagicDNS names.
+						</Dialog.Text>
+						<Form
+							method="POST"
+							onSubmit={(e) => {
+								submit(e.currentTarget);
+							}}
+						>
+							<input type="hidden" name="_method" value="rename" />
+							<input type="hidden" name="id" value={machine.id} />
+							<TextField
+								label="Machine name"
+								placeholder="Machine name"
+								name="name"
+								state={[name, setName]}
+								className="my-2"
+							/>
+							{magic ? (
+								name.length > 0 && name !== machine.givenName ? (
+									<p className="text-sm text-gray-500 dark:text-gray-300 leading-tight">
+										This machine will be accessible by the hostname{' '}
+										<Code className="text-sm">
+											{name.toLowerCase().replaceAll(/\s+/g, '-')}
+										</Code>
+										{'. '}
+										The hostname{' '}
+										<Code className="text-sm">{machine.givenName}</Code> will no
+										longer point to this machine.
+									</p>
+								) : (
+									<p className="text-sm text-gray-500 dark:text-gray-300 leading-tight">
+										This machine is accessible by the hostname{' '}
+										<Code className="text-sm">{machine.givenName}</Code>.
+									</p>
+								)
+							) : undefined}
+							<div className="mt-6 flex justify-end gap-2 mt-6">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action variant="confirm" onPress={close}>
+									Rename
+								</Dialog.Action>
+							</div>
+						</Form>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/machines/dialogs/routes.tsx

@@ -0,0 +1,176 @@
+import { useFetcher } from 'react-router';
+import { Dispatch, SetStateAction, useMemo } from 'react';
+
+import Dialog from '~/components/Dialog';
+import Switch from '~/components/Switch';
+import Link from '~/components/Link';
+import type { Machine, Route } from '~/types';
+import { cn } from '~/utils/cn';
+
+interface RoutesProps {
+	readonly machine: Machine;
+	readonly routes: Route[];
+	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
+}
+
+// TODO: Support deleting routes
+export default function Routes({ machine, routes, state }: RoutesProps) {
+	const fetcher = useFetcher();
+
+	// This is much easier with Object.groupBy but it's too new for us
+	const { exit, subnet } = routes.reduce<{
+		exit: Route[];
+		subnet: Route[];
+	}>(
+		(acc, route) => {
+			if (route.prefix === '::/0' || route.prefix === '0.0.0.0/0') {
+				acc.exit.push(route);
+				return acc;
+			}
+
+			acc.subnet.push(route);
+			return acc;
+		},
+		{ exit: [], subnet: [] },
+	);
+
+	const exitEnabled = useMemo(() => {
+		if (exit.length !== 2) return false;
+		return exit[0].enabled && exit[1].enabled;
+	}, [exit]);
+
+	return (
+		<Dialog>
+			<Dialog.Panel control={state}>
+				{(close) => (
+					<>
+						<Dialog.Title>
+							Edit route settings of {machine.givenName}
+						</Dialog.Title>
+						<Dialog.Text className="font-bold">Subnet routes</Dialog.Text>
+						<Dialog.Text>
+							Connect to devices you can&apos;t install Tailscale on by
+							advertising IP ranges as subnet routes.{' '}
+							<Link
+								to="https://tailscale.com/kb/1019/subnets"
+								name="Tailscale Subnets Documentation"
+							>
+								Learn More
+							</Link>
+						</Dialog.Text>
+						<div
+							className={cn(
+								'rounded-lg overflow-y-auto my-2',
+								'divide-y divide-zinc-200 dark:divide-zinc-700 align-top',
+								'border border-zinc-200 dark:border-zinc-700',
+							)}
+						>
+							{subnet.length === 0 ? (
+								<div
+									className={cn(
+										'flex py-4 px-4 bg-ui-100 dark:bg-ui-800',
+										'items-center justify-center',
+										'text-ui-600 dark:text-ui-300',
+									)}
+								>
+									<p>No routes are advertised on this machine.</p>
+								</div>
+							) : undefined}
+							{subnet.map((route) => (
+								<div
+									key={route.id}
+									className={cn(
+										'flex py-2 px-4 bg-ui-100 dark:bg-ui-800',
+										'items-center justify-between',
+									)}
+								>
+									<p>{route.prefix}</p>
+									<Switch
+										defaultSelected={route.enabled}
+										label="Enabled"
+										onChange={(checked) => {
+											const form = new FormData();
+											form.set('id', machine.id);
+											form.set('_method', 'routes');
+											form.set('route', route.id);
+
+											form.set('enabled', String(checked));
+											fetcher.submit(form, {
+												method: 'POST',
+											});
+										}}
+									/>
+								</div>
+							))}
+						</div>
+						<Dialog.Text className="font-bold mt-8">Exit nodes</Dialog.Text>
+						<Dialog.Text>
+							Allow your network to route internet traffic through this machine.{' '}
+							<Link
+								to="https://tailscale.com/kb/1103/exit-nodes"
+								name="Tailscale Exit-node Documentation"
+							>
+								Learn More
+							</Link>
+						</Dialog.Text>
+						<div
+							className={cn(
+								'rounded-lg overflow-y-auto my-2',
+								'divide-y divide-zinc-200 dark:divide-zinc-700 align-top',
+								'border border-zinc-200 dark:border-zinc-700',
+							)}
+						>
+							{exit.length === 0 ? (
+								<div
+									className={cn(
+										'flex py-4 px-4 bg-ui-100 dark:bg-ui-800',
+										'items-center justify-center',
+										'text-ui-600 dark:text-ui-300',
+									)}
+								>
+									<p>This machine is not an exit node.</p>
+								</div>
+							) : (
+								<div
+									className={cn(
+										'flex py-2 px-4 bg-ui-100 dark:bg-ui-800',
+										'items-center justify-between',
+									)}
+								>
+									<p>Use as exit node</p>
+									<Switch
+										defaultSelected={exitEnabled}
+										label="Enabled"
+										onChange={(checked) => {
+											const form = new FormData();
+											form.set('id', machine.id);
+											form.set('_method', 'exit-node');
+											form.set(
+												'routes',
+												exit.map((route) => route.id).join(','),
+											);
+
+											form.set('enabled', String(checked));
+											fetcher.submit(form, {
+												method: 'POST',
+											});
+										}}
+									/>
+								</div>
+							)}
+						</div>
+						<div className="mt-6 flex justify-end gap-2 mt-6">
+							<Dialog.Action
+								variant="cancel"
+								isDisabled={fetcher.state === 'submitting'}
+								onPress={close}
+							>
+								Close
+							</Dialog.Action>
+						</div>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/machines/dialogs/tags.tsx

@@ -0,0 +1,147 @@
+import { PlusIcon, XIcon } from '@primer/octicons-react';
+import { Form, useSubmit } from 'react-router';
+import { type Dispatch, type SetStateAction, useState } from 'react';
+import { Button, Input } from 'react-aria-components';
+
+import Dialog from '~/components/Dialog';
+import Link from '~/components/Link';
+import type { Machine } from '~/types';
+import { cn } from '~/utils/cn';
+
+interface TagsProps {
+	readonly machine: Machine;
+	readonly state: [boolean, Dispatch<SetStateAction<boolean>>];
+}
+
+export default function Tags({ machine, state }: TagsProps) {
+	const [tags, setTags] = useState(machine.forcedTags);
+	const [tag, setTag] = useState('');
+	const submit = useSubmit();
+
+	return (
+		<Dialog>
+			<Dialog.Panel control={state}>
+				{(close) => (
+					<>
+						<Dialog.Title>Edit ACL tags for {machine.givenName}</Dialog.Title>
+						<Dialog.Text>
+							ACL tags can be used to reference machines in your ACL policies.
+							See the{' '}
+							<Link
+								to="https://tailscale.com/kb/1068/acl-tags"
+								name="Tailscale documentation"
+							>
+								Tailscale documentation
+							</Link>{' '}
+							for more information.
+						</Dialog.Text>
+						<Form
+							method="POST"
+							onSubmit={(e) => {
+								submit(e.currentTarget);
+							}}
+						>
+							<input type="hidden" name="_method" value="tags" />
+							<input type="hidden" name="id" value={machine.id} />
+							<input type="hidden" name="tags" value={tags.join(',')} />
+							<div
+								className={cn(
+									'border border-ui-300 rounded-lg overflow-visible',
+									'dark:border-ui-700 dark:text-ui-300 mt-4',
+								)}
+							>
+								<div className="divide-y divide-ui-200 dark:divide-ui-600">
+									{tags.length === 0 ? (
+										<div
+											className={cn(
+												'flex py-4 px-4 bg-ui-100 dark:bg-ui-800',
+												'items-center justify-center rounded-t-lg',
+												'text-ui-600 dark:text-ui-300',
+											)}
+										>
+											<p>No tags are set on this machine.</p>
+										</div>
+									) : (
+										tags.map((item) => (
+											<div
+												key={item}
+												id={item}
+												className={cn(
+													'px-2.5 py-1.5 flex',
+													'items-center justify-between',
+													'font-mono text-sm',
+												)}
+											>
+												{item}
+												<Button
+													className="rounded-full p-0 w-6 h-6"
+													onPress={() => {
+														setTags(tags.filter((tag) => tag !== item));
+													}}
+												>
+													<XIcon className="w-4 h-4" />
+												</Button>
+											</div>
+										))
+									)}
+								</div>
+								<div
+									className={cn(
+										'flex px-2.5 py-1.5 w-full',
+										'border-t border-ui-300 dark:border-ui-700',
+										'rounded-b-lg justify-between items-center',
+										'dark:bg-ui-800 dark:text-ui-300',
+										'focus-within:ring-2 focus-within:ring-blue-600',
+										tag.length > 0 &&
+											!tag.startsWith('tag:') &&
+											'outline outline-red-500',
+									)}
+								>
+									<Input
+										placeholder="tag:example"
+										className={cn(
+											'bg-transparent w-full',
+											'border-none focus:ring-0',
+											'focus:outline-none font-mono text-sm',
+											'dark:bg-transparent dark:text-ui-300',
+										)}
+										value={tag}
+										onChange={(e) => {
+											setTag(e.currentTarget.value);
+										}}
+									/>
+									<Button
+										className={cn(
+											'rounded-lg p-0 h-6 w-6',
+											!tag.startsWith('tag:') &&
+												'opacity-50 cursor-not-allowed',
+										)}
+										isDisabled={
+											tag.length === 0 ||
+											!tag.startsWith('tag:') ||
+											tags.includes(tag)
+										}
+										onPress={() => {
+											setTags([...tags, tag]);
+											setTag('');
+										}}
+									>
+										<PlusIcon className="w-4 h-4" />
+									</Button>
+								</div>
+							</div>
+							<div className="mt-6 flex justify-end gap-2 mt-6">
+								<Dialog.Action variant="cancel" onPress={close}>
+									Cancel
+								</Dialog.Action>
+								<Dialog.Action variant="confirm" onPress={close}>
+									Save
+								</Dialog.Action>
+							</div>
+						</Form>
+					</>
+				)}
+			</Dialog.Panel>
+		</Dialog>
+	);
+}

app/routes/machines/machine.tsx

@@ -0,0 +1,366 @@
+import type { ActionFunctionArgs, LoaderFunctionArgs } from 'react-router';
+import { Link as RemixLink, useLoaderData } from 'react-router';
+import {
+	InfoIcon,
+	GearIcon,
+	CheckCircleIcon,
+	SkipIcon,
+	PersonIcon,
+} from '@primer/octicons-react';
+import { useMemo, useState } from 'react';
+
+import Attribute from '~/components/Attribute';
+import Button from '~/components/Button';
+import Card from '~/components/Card';
+import Menu from '~/components/Menu';
+import Tooltip from '~/components/Tooltip';
+import StatusCircle from '~/components/StatusCircle';
+import type { Machine, Route, User } from '~/types';
+import { cn } from '~/utils/cn';
+import { loadContext } from '~/utils/config/headplane';
+import { loadConfig } from '~/utils/config/headscale';
+import { pull } from '~/utils/headscale';
+import { getSession } from '~/utils/sessions.server';
+import { useLiveData } from '~/utils/useLiveData';
+import Link from '~/components/Link';
+
+import { menuAction } from './action';
+import MenuOptions from './components/menu';
+import Routes from './dialogs/routes';
+
+export async function loader({ request, params }: LoaderFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	if (!params.id) {
+		throw new Error('No machine ID provided');
+	}
+
+	const context = await loadContext();
+	let magic: string | undefined;
+
+	if (context.config.read) {
+		const config = await loadConfig();
+		if (config.dns.magic_dns) {
+			magic = config.dns.base_domain;
+		}
+	}
+
+	const [machine, routes, users] = await Promise.all([
+		pull<{ node: Machine }>(`v1/node/${params.id}`, session.get('hsApiKey')!),
+		pull<{ routes: Route[] }>('v1/routes', session.get('hsApiKey')!),
+		pull<{ users: User[] }>('v1/user', session.get('hsApiKey')!),
+	]);
+
+	return {
+		machine: machine.node,
+		routes: routes.routes.filter((route) => route.node.id === params.id),
+		users: users.users,
+		magic,
+	};
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+	return menuAction(request);
+}
+
+export default function Page() {
+	const { machine, magic, routes, users } = useLoaderData<typeof loader>();
+	const routesState = useState(false);
+	useLiveData({ interval: 1000 });
+
+	const expired =
+		machine.expiry === '0001-01-01 00:00:00' ||
+		machine.expiry === '0001-01-01T00:00:00Z' ||
+		machine.expiry === null
+			? false
+			: new Date(machine.expiry).getTime() < Date.now();
+
+	const tags = [...machine.forcedTags, ...machine.validTags];
+
+	if (expired) {
+		tags.unshift('Expired');
+	}
+
+	// This is much easier with Object.groupBy but it's too new for us
+	const { exit, subnet, subnetApproved } = routes.reduce<{
+		exit: Route[];
+		subnet: Route[];
+		subnetApproved: Route[];
+	}>(
+		(acc, route) => {
+			if (route.prefix === '::/0' || route.prefix === '0.0.0.0/0') {
+				acc.exit.push(route);
+				return acc;
+			}
+
+			if (route.enabled) {
+				acc.subnetApproved.push(route);
+				return acc;
+			}
+
+			acc.subnet.push(route);
+			return acc;
+		},
+		{ exit: [], subnetApproved: [], subnet: [] },
+	);
+
+	const exitEnabled = useMemo(() => {
+		if (exit.length !== 2) return false;
+		return exit[0].enabled && exit[1].enabled;
+	}, [exit]);
+
+	if (exitEnabled) {
+		tags.unshift('Exit Node');
+	}
+
+	if (subnetApproved.length > 0) {
+		tags.unshift('Subnets');
+	}
+
+	return (
+		<div>
+			<p className="mb-8 text-md">
+				<RemixLink to="/machines" className="font-medium">
+					All Machines
+				</RemixLink>
+				<span className="mx-2">/</span>
+				{machine.givenName}
+			</p>
+			<div
+				className={cn(
+					'flex justify-between items-center',
+					'border-b border-ui-100 dark:border-ui-800',
+				)}
+			>
+				<span className="flex items-baseline gap-x-4 text-sm mb-4">
+					<h1 className="text-2xl font-medium">{machine.givenName}</h1>
+					<StatusCircle isOnline={machine.online} className="w-4 h-4" />
+				</span>
+
+				<MenuOptions
+					machine={machine}
+					routes={routes}
+					users={users}
+					magic={magic}
+					buttonChild={
+						<Menu.Button
+							className={cn(
+								'flex items-center justify-center gap-x-2',
+								'bg-main-200 dark:bg-main-700/30',
+								'hover:bg-main-300 dark:hover:bg-main-600/30',
+								'text-ui-700 dark:text-ui-300 mb-2',
+								'w-fit text-sm rounded-lg px-3 py-2',
+							)}
+						>
+							<GearIcon className="w-5" />
+							Machine Settings
+						</Menu.Button>
+					}
+				/>
+			</div>
+			<div className="flex gap-1 mb-4">
+				<div className="border-r border-ui-100 dark:border-ui-800 p-2 pr-4">
+					<span className="text-sm text-ui-600 dark:text-ui-300 flex items-center gap-x-1">
+						Managed by
+						<Tooltip>
+							<Tooltip.Button>
+								<InfoIcon className="w-3.5 h-3.5" />
+							</Tooltip.Button>
+							<Tooltip.Body>
+								By default, a machine’s permissions match its creator’s.
+							</Tooltip.Body>
+						</Tooltip>
+					</span>
+					<div className="flex items-center gap-x-2.5 mt-1">
+						<div
+							className={cn(
+								'rounded-full h-7 w-7 flex items-center justify-center',
+								'border border-ui-200 dark:border-ui-700',
+							)}
+						>
+							<PersonIcon className="w-4 h-4" />
+						</div>
+						{machine.user.name}
+					</div>
+				</div>
+				<div className="p-2 pl-4">
+					<p className="text-sm text-ui-600 dark:text-ui-300">Status</p>
+					<div className="flex gap-1 mt-1 mb-8">
+						{tags.map((tag) => (
+							<span
+								key={tag}
+								className={cn(
+									'text-xs rounded-md px-1.5 py-0.5',
+									'bg-ui-200 dark:bg-ui-800',
+									'text-ui-600 dark:text-ui-300',
+								)}
+							>
+								{tag}
+							</span>
+						))}
+					</div>
+				</div>
+			</div>
+			<h2 className="text-xl font-medium mb-4 mt-8">Subnets & Routing</h2>
+			<Routes machine={machine} routes={routes} state={routesState} />
+			<div className="flex items-center justify-between mb-4">
+				<p>
+					Subnets let you expose physical network routes onto Tailscale.{' '}
+					<Link
+						to="https://tailscale.com/kb/1019/subnets"
+						name="Tailscale Subnets Documentation"
+					>
+						Learn More
+					</Link>
+				</p>
+				<Button variant="light" control={routesState}>
+					Review
+				</Button>
+			</div>
+			<Card
+				variant="flat"
+				className={cn(
+					'w-full max-w-full grid sm:grid-cols-2',
+					'md:grid-cols-4 gap-8 mr-2 text-sm mb-8',
+				)}
+			>
+				<div>
+					<span className="text-ui-600 dark:text-ui-300 flex items-center gap-x-1">
+						Approved
+						<Tooltip>
+							<Tooltip.Button>
+								<InfoIcon className="w-3.5 h-3.5" />
+							</Tooltip.Button>
+							<Tooltip.Body>
+								Traffic to these routes are being routed through this machine.
+							</Tooltip.Body>
+						</Tooltip>
+					</span>
+					<div className="mt-1">
+						{subnetApproved.length === 0 ? (
+							<span className="text-ui-400 dark:text-ui-300">—</span>
+						) : (
+							<ul className="leading-normal">
+								{subnetApproved.map((route) => (
+									<li key={route.id}>{route.prefix}</li>
+								))}
+							</ul>
+						)}
+					</div>
+					<Button
+						className={cn(
+							'p-0 rounded-sm bg-transparent mt-1',
+							'text-blue-500 dark:text-blue-400',
+							'hover:bg-transparent',
+							'hover:text-blue-600 dark:hover:text-blue-500',
+						)}
+						control={routesState}
+					>
+						Edit
+					</Button>
+				</div>
+				<div>
+					<span className="text-ui-600 dark:text-ui-300 flex items-center gap-x-1">
+						Awaiting Approval
+						<Tooltip>
+							<Tooltip.Button>
+								<InfoIcon className="w-3.5 h-3.5" />
+							</Tooltip.Button>
+							<Tooltip.Body>
+								This machine is advertising these routes, but they must be
+								approved before traffic will be routed to them.
+							</Tooltip.Body>
+						</Tooltip>
+					</span>
+					<div className="mt-1">
+						{subnet.length === 0 ? (
+							<span className="text-ui-400 dark:text-ui-300">—</span>
+						) : (
+							<ul className="leading-normal">
+								{subnet.map((route) => (
+									<li key={route.id}>{route.prefix}</li>
+								))}
+							</ul>
+						)}
+					</div>
+					<Button
+						className={cn(
+							'p-0 rounded-sm bg-transparent mt-1',
+							'text-blue-500 dark:text-blue-400',
+							'hover:bg-transparent',
+							'hover:text-blue-600 dark:hover:text-blue-500',
+						)}
+						control={routesState}
+					>
+						Edit
+					</Button>
+				</div>
+				<div>
+					<span className="text-ui-600 dark:text-ui-300 flex items-center gap-x-1">
+						Exit Node
+						<Tooltip>
+							<Tooltip.Button>
+								<InfoIcon className="w-3.5 h-3.5" />
+							</Tooltip.Button>
+							<Tooltip.Body>
+								Whether this machine can act as an exit node for your tailnet.
+							</Tooltip.Body>
+						</Tooltip>
+					</span>
+					<div className="mt-1">
+						{exit.length === 0 ? (
+							<span className="text-ui-400 dark:text-ui-300">—</span>
+						) : exitEnabled ? (
+							<span className="flex items-center gap-x-1">
+								<CheckCircleIcon className="w-3.5 h-3.5 text-green-700" />
+								Allowed
+							</span>
+						) : (
+							<span className="flex items-center gap-x-1">
+								<SkipIcon className="w-3.5 h-3.5 text-red-700" />
+								Awaiting Approval
+							</span>
+						)}
+					</div>
+					<Button
+						className={cn(
+							'p-0 rounded-sm bg-transparent mt-1',
+							'text-blue-500 dark:text-blue-400',
+							'hover:bg-transparent',
+							'hover:text-blue-600 dark:hover:text-blue-500',
+						)}
+						control={routesState}
+					>
+						Edit
+					</Button>
+				</div>
+			</Card>
+			<h2 className="text-xl font-medium mb-4">Machine Details</h2>
+			<Card variant="flat" className="w-full max-w-full">
+				<Attribute name="Creator" value={machine.user.name} />
+				<Attribute name="Node ID" value={machine.id} />
+				<Attribute name="Node Name" value={machine.givenName} />
+				<Attribute name="Hostname" value={machine.name} />
+				<Attribute isCopyable name="Node Key" value={machine.nodeKey} />
+				<Attribute
+					name="Created"
+					value={new Date(machine.createdAt).toLocaleString()}
+				/>
+				<Attribute
+					name="Last Seen"
+					value={new Date(machine.lastSeen).toLocaleString()}
+				/>
+				<Attribute
+					name="Expiry"
+					value={expired ? new Date(machine.expiry).toLocaleString() : 'Never'}
+				/>
+				{magic ? (
+					<Attribute
+						isCopyable
+						name="Domain"
+						value={`${machine.givenName}.${magic}`}
+					/>
+				) : undefined}
+			</Card>
+		</div>
+	);
+}

app/routes/machines/overview.tsx

@@ -0,0 +1,148 @@
+import { InfoIcon } from '@primer/octicons-react';
+import type { ActionFunctionArgs, LoaderFunctionArgs } from 'react-router';
+import { useLoaderData } from 'react-router';
+import { Button, Tooltip, TooltipTrigger } from 'react-aria-components';
+
+import Code from '~/components/Code';
+import Link from '~/components/Link';
+import { cn } from '~/utils/cn';
+import { loadContext } from '~/utils/config/headplane';
+import { loadConfig } from '~/utils/config/headscale';
+import { pull } from '~/utils/headscale';
+import { getSession } from '~/utils/sessions.server';
+import { useLiveData } from '~/utils/useLiveData';
+import type { Machine, Route, User } from '~/types';
+import { queryAgent, initAgentSocket } from '~/utils/ws-agent';
+import { ErrorPopup } from '~/components/Error'
+
+import { menuAction } from './action';
+import MachineRow from './components/machine';
+import NewMachine from './dialogs/new';
+
+export async function loader({ request, context: lC }: LoaderFunctionArgs) {
+	const session = await getSession(request.headers.get('Cookie'));
+	const [machines, routes, users] = await Promise.all([
+		pull<{ nodes: Machine[] }>('v1/node', session.get('hsApiKey')!),
+		pull<{ routes: Route[] }>('v1/routes', session.get('hsApiKey')!),
+		pull<{ users: User[] }>('v1/user', session.get('hsApiKey')!),
+	]);
+
+	initAgentSocket(lC);
+
+	const stats = await queryAgent(machines.nodes.map((node) => node.nodeKey));
+	const context = await loadContext();
+	let magic: string | undefined;
+
+	if (context.config.read) {
+		const config = await loadConfig();
+		if (config.dns.magic_dns) {
+			magic = config.dns.base_domain;
+		}
+
+		if (config.dns.use_username_in_magic_dns) {
+			magic = `[user].${magic}`;
+		}
+	}
+
+	return {
+		nodes: machines.nodes,
+		routes: routes.routes,
+		users: users.users,
+		magic,
+		stats,
+		server: context.headscaleUrl,
+		publicServer: context.headscalePublicUrl,
+	};
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+	return menuAction(request);
+}
+
+export default function Page() {
+	useLiveData({ interval: 3000 });
+	const data = useLoaderData<typeof loader>();
+
+	return (
+		<>
+			<div className="flex justify-between items-center mb-8">
+				<div className="flex flex-col w-2/3">
+					<h1 className="text-2xl font-medium mb-4">Machines</h1>
+					<p className="text-gray-700 dark:text-gray-300">
+						Manage the devices connected to your Tailnet.{' '}
+						<Link
+							to="https://tailscale.com/kb/1372/manage-devices"
+							name="Tailscale Manage Devices Documentation"
+						>
+							Learn more
+						</Link>
+					</p>
+				</div>
+				<NewMachine
+					server={data.publicServer ?? data.server}
+					users={data.users}
+				/>
+			</div>
+			<table className="table-auto w-full rounded-lg">
+				<thead className="text-gray-500 dark:text-gray-400">
+					<tr className="text-left uppercase text-xs font-bold px-0.5">
+						<th className="pb-2">Name</th>
+						<th className="pb-2 w-1/4">
+							<div className="flex items-center gap-x-1">
+								Addresses
+								{data.magic ? (
+									<TooltipTrigger delay={0}>
+										<Button>
+											<InfoIcon className="w-4 h-4" />
+										</Button>
+										<Tooltip
+											className={cn(
+												'text-sm max-w-xs p-2 rounded-lg mb-2',
+												'bg-white dark:bg-zinc-800',
+												'border border-gray-200 dark:border-zinc-700',
+											)}
+										>
+											Since MagicDNS is enabled, you can access devices based on
+											their name and also at{' '}
+											<Code>
+												[name].
+												{data.magic}
+											</Code>
+										</Tooltip>
+									</TooltipTrigger>
+								) : undefined}
+							</div>
+						</th>
+						{/**<th className="pb-2">Version</th>**/}
+						<th className="pb-2">Last Seen</th>
+					</tr>
+				</thead>
+				<tbody
+					className={cn(
+						'divide-y divide-zinc-200 dark:divide-zinc-700 align-top',
+						'border-t border-zinc-200 dark:border-zinc-700',
+					)}
+				>
+					{data.nodes.map((machine) => (
+						<MachineRow
+							key={machine.id}
+							machine={machine}
+							routes={data.routes.filter(
+								(route) => route.node.id === machine.id,
+							)}
+							users={data.users}
+							magic={data.magic}
+							stats={data.stats?.[machine.nodeKey]}
+						/>
+					))}
+				</tbody>
+			</table>
+		</>
+	);
+}
+
+export function ErrorBoundary() {
+	return (
+		<ErrorPopup type="embedded" />
+	)
+}

app/routes/oidc.callback.tsx

@@ -1,15 +0,0 @@
-import { type LoaderFunctionArgs } from '@remix-run/node'
-
-import { getContext } from '~/utils/config'
-import { finishOidc } from '~/utils/oidc'
-
-export async function loader({ request }: LoaderFunctionArgs) {
-	const context = await getContext()
-	const oidc = context.oidcConfig
-
-	if (!oidc) {
-		throw new Error('An invalid OIDC configuration was provided')
-	}
-
-	return finishOidc(oidc.issuer, oidc.client, oidc.secret, request)
-}