Refactor unit tests

Refactored integration tests
Refactored app code with Node
2026-07-19 14:30:44 +09:00 · 2023-05-01 14:53:23 +00:00 · 2023-05-01 14:52:48 +00:00 · 2023-05-01 14:52:03 +00:00 · 2023-05-01 14:51:01 +00:00 · 2023-05-01 14:50:38 +00:00
114 changed files with 6996 additions and 5932 deletions
@@ -19,6 +19,6 @@ jobs:
      - uses: cachix/install-nix-action@v16

      - name: Run goreleaser
-        run: nix develop --command -- goreleaser release --rm-dist
+        run: nix develop --command -- goreleaser release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -1,35 +0,0 @@
-name: Integration Test DERP
-
-on: [pull_request]
-
-jobs:
-  integration-test-derp:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 2
-
-      - name: Set Swap Space
-        uses: pierotofy/set-swap-space@master
-        with:
-          swap-size-gb: 10
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@v34
-        with:
-          files: |
-            *.nix
-            go.*
-            **/*.go
-            integration_test/
-            config-example.yaml
-
-      - uses: cachix/install-nix-action@v16
-        if: steps.changed-files.outputs.any_changed == 'true'
-
-      - name: Run Embedded DERP server integration tests
-        if: steps.changed-files.outputs.any_changed == 'true'
-        run: nix develop --command -- make test_integration_derp
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -0,0 +1,63 @@
+# DO NOT EDIT, generated with cmd/gh-action-integration-generator/main.go
+# To regenerate, run "go generate" in cmd/gh-action-integration-generator/
+
+name: Integration Test v2 - TestACLDevice1CanAccessDevice2
+
+on: [pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-$${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 2
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v34
+        with:
+          files: |
+            *.nix
+            go.*
+            **/*.go
+            integration_test/
+            config-example.yaml
+
+      - uses: cachix/install-nix-action@v18
+        if: ${{ env.ACT }} || steps.changed-files.outputs.any_changed == 'true'
+
+      - name: Run general integration tests
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+            nix develop --command -- docker run \
+              --tty --rm \
+              --volume ~/.cache/hs-integration-go:/go \
+              --name headscale-test-suite \
+              --volume $PWD:$PWD -w $PWD/integration \
+              --volume /var/run/docker.sock:/var/run/docker.sock \
+              --volume $PWD/control_logs:/tmp/control \
+              golang:1 \
+                go test ./... \
+                  -tags ts2019 \
+                  -failfast \
+                  -timeout 120m \
+                  -parallel 1 \
+                  -run "^TestACLDevice1CanAccessDevice2$"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: logs
+          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -0,0 +1,63 @@
+# DO NOT EDIT, generated with cmd/gh-action-integration-generator/main.go
+# To regenerate, run "go generate" in cmd/gh-action-integration-generator/
+
+name: Integration Test v2 - TestACLNamedHostsCanReach
+
+on: [pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-$${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 2
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v34
+        with:
+          files: |
+            *.nix
+            go.*
+            **/*.go
+            integration_test/
+            config-example.yaml
+
+      - uses: cachix/install-nix-action@v18
+        if: ${{ env.ACT }} || steps.changed-files.outputs.any_changed == 'true'
+
+      - name: Run general integration tests
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+            nix develop --command -- docker run \
+              --tty --rm \
+              --volume ~/.cache/hs-integration-go:/go \
+              --name headscale-test-suite \
+              --volume $PWD:$PWD -w $PWD/integration \
+              --volume /var/run/docker.sock:/var/run/docker.sock \
+              --volume $PWD/control_logs:/tmp/control \
+              golang:1 \
+                go test ./... \
+                  -tags ts2019 \
+                  -failfast \
+                  -timeout 120m \
+                  -parallel 1 \
+                  -run "^TestACLNamedHostsCanReach$"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: logs
+          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -0,0 +1,63 @@
+# DO NOT EDIT, generated with cmd/gh-action-integration-generator/main.go
+# To regenerate, run "go generate" in cmd/gh-action-integration-generator/
+
+name: Integration Test v2 - TestACLNamedHostsCanReachBySubnet
+
+on: [pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-$${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 2
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v34
+        with:
+          files: |
+            *.nix
+            go.*
+            **/*.go
+            integration_test/
+            config-example.yaml
+
+      - uses: cachix/install-nix-action@v18
+        if: ${{ env.ACT }} || steps.changed-files.outputs.any_changed == 'true'
+
+      - name: Run general integration tests
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+            nix develop --command -- docker run \
+              --tty --rm \
+              --volume ~/.cache/hs-integration-go:/go \
+              --name headscale-test-suite \
+              --volume $PWD:$PWD -w $PWD/integration \
+              --volume /var/run/docker.sock:/var/run/docker.sock \
+              --volume $PWD/control_logs:/tmp/control \
+              golang:1 \
+                go test ./... \
+                  -tags ts2019 \
+                  -failfast \
+                  -timeout 120m \
+                  -parallel 1 \
+                  -run "^TestACLNamedHostsCanReachBySubnet$"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: logs
+          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -0,0 +1,63 @@
+# DO NOT EDIT, generated with cmd/gh-action-integration-generator/main.go
+# To regenerate, run "go generate" in cmd/gh-action-integration-generator/
+
+name: Integration Test v2 - TestDERPServerScenario
+
+on: [pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-$${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 2
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v34
+        with:
+          files: |
+            *.nix
+            go.*
+            **/*.go
+            integration_test/
+            config-example.yaml
+
+      - uses: cachix/install-nix-action@v18
+        if: ${{ env.ACT }} || steps.changed-files.outputs.any_changed == 'true'
+
+      - name: Run general integration tests
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+            nix develop --command -- docker run \
+              --tty --rm \
+              --volume ~/.cache/hs-integration-go:/go \
+              --name headscale-test-suite \
+              --volume $PWD:$PWD -w $PWD/integration \
+              --volume /var/run/docker.sock:/var/run/docker.sock \
+              --volume $PWD/control_logs:/tmp/control \
+              golang:1 \
+                go test ./... \
+                  -tags ts2019 \
+                  -failfast \
+                  -timeout 120m \
+                  -parallel 1 \
+                  -run "^TestDERPServerScenario$"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: logs
+          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -55,3 +55,9 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
@@ -1,3 +1,5 @@
+ignored/
+
 # Binaries for programs and plugins
 *.exe
 *.exe~
@@ -12,7 +14,7 @@
 *.out

 # Dependency directories (remove the comment below to include it)
-# vendor/
+vendor/

 dist/
 /headscale
@@ -2,6 +2,7 @@
 before:
  hooks:
    - go mod tidy -compat=1.20
+    - go mod vendor

 release:
  prerelease: auto
@@ -31,19 +32,16 @@ builds:

 archives:
  - id: golang-cross
-    builds:
-      - darwin-amd64
-      - darwin-arm64
-      - freebsd-amd64
-      - linux-386
-      - linux-amd64
-      - linux-arm64
-      - linux-arm-5
-      - linux-arm-6
-      - linux-arm-7
-    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
    format: binary

+source:
+  enabled: true
+  name_template: "{{ .ProjectName }}_{{ .Version }}"
+  format: tar.gz
+  files:
+    - "vendor/"
+
 nfpms:
  # Configure nFPM for .deb and .rpm releases
  #
@@ -65,7 +63,7 @@ nfpms:
    bindir: /usr/bin
    formats:
      - deb
-      - rpm
+      # - rpm
    contents:
      - src: ./config-example.yaml
        dst: /etc/headscale/config.yaml
@@ -73,7 +71,7 @@ nfpms:
        file_info:
          mode: 0644
      - src: ./docs/packaging/headscale.systemd.service
-        dst: /etc/systemd/system/headscale.service
+        dst: /usr/lib/systemd/system/headscale.service
      - dst: /var/lib/headscale
        type: dir
      - dst: /var/run/headscale
@@ -1,12 +1,28 @@
 # CHANGELOG

-## 0.22.0 (2023-XX-XX)
+## 0.23.0 (2023-XX-XX)

 ### Changes

- Add `.deb` and `.rpm` packages to release process [#1297](https://github.com/juanfont/headscale/pull/1297)
+- Add environment flags to enable pprof (profiling) [#1382](https://github.com/juanfont/headscale/pull/1382)
+  - Profiles are continously generated in our integration tests.
+- Fix systemd service file location in `.deb` packages [#1391](https://github.com/juanfont/headscale/pull/1391)
+
+## 0.22.1 (2023-04-20)
+
+### Changes
+
+- Fix issue where SystemD could not bind to port 80 [#1365](https://github.com/juanfont/headscale/pull/1365)
+
+## 0.22.0 (2023-04-20)
+
+### Changes
+
+- Add `.deb` packages to release process [#1297](https://github.com/juanfont/headscale/pull/1297)
+- Update and simplify the documentation to use new `.deb` packages [#1349](https://github.com/juanfont/headscale/pull/1349)
 - Add 32-bit Arm platforms to release process [#1297](https://github.com/juanfont/headscale/pull/1297)
 - Fix longstanding bug that would prevent "\*" from working properly in ACLs (issue [#699](https://github.com/juanfont/headscale/issues/699)) [#1279](https://github.com/juanfont/headscale/pull/1279)
+- Fix issue where IPv6 could not be used in, or while using ACLs (part of [#809](https://github.com/juanfont/headscale/issues/809)) [#1339](https://github.com/juanfont/headscale/pull/1339)
 - Target Go 1.20 and Tailscale 1.38 for Headscale [#1323](https://github.com/juanfont/headscale/pull/1323)

 ## 0.21.0 (2023-03-20)
@@ -36,17 +36,7 @@ test_integration_cli:
 		-v ~/.cache/hs-integration-go:/go \
 		-v $$PWD:$$PWD -w $$PWD \
 		-v /var/run/docker.sock:/var/run/docker.sock golang:1 \
-		go test $(TAGS) -failfast -timeout 30m -count=1 -run IntegrationCLI ./...
-
-test_integration_derp:
-	docker network rm $$(docker network ls --filter name=headscale --quiet) || true
-	docker network create headscale-test || true
-	docker run -t --rm \
-		--network headscale-test \
-		-v ~/.cache/hs-integration-go:/go \
-		-v $$PWD:$$PWD -w $$PWD \
-		-v /var/run/docker.sock:/var/run/docker.sock golang:1 \
-		go test $(TAGS) -failfast -timeout 30m -count=1 -run IntegrationDERP ./...
+		go run gotest.tools/gotestsum@latest -- $(TAGS) -failfast -timeout 30m -count=1 -run IntegrationCLI ./...

 test_integration_v2_general:
 	docker run \
@@ -56,13 +46,7 @@ test_integration_v2_general:
 		-v $$PWD:$$PWD -w $$PWD/integration \
 		-v /var/run/docker.sock:/var/run/docker.sock \
 		golang:1 \
-		go test $(TAGS) -failfast ./... -timeout 120m -parallel 8
-
-coverprofile_func:
-	go tool cover -func=coverage.out
-
-coverprofile_html:
-	go tool cover -html=coverage.out
+		go run gotest.tools/gotestsum@latest -- $(TAGS) -failfast ./... -timeout 120m -parallel 8

 lint:
 	golangci-lint run --fix --timeout 10m
@@ -80,11 +64,4 @@ compress: build

 generate:
 	rm -rf gen
-	go run github.com/bufbuild/buf/cmd/buf generate proto
-
-install-protobuf-plugins:
-	go install \
-		github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway \
-		github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2 \
-		google.golang.org/protobuf/cmd/protoc-gen-go \
-		google.golang.org/grpc/cmd/protoc-gen-go-grpc
+	buf generate proto
@@ -38,7 +38,6 @@ implements a _single_ Tailnet, which is typically what a single organisation, or
 home/personal setup would use.

 `headscale` uses terms that maps to Tailscale's control server, consult the
-[glossary](./docs/glossary.md) for explainations.

 ## Support

@@ -79,7 +78,7 @@ one of the maintainers.

 ## Running headscale

-Please have a look at the documentation under [`docs/`](docs/).
+Please have a look at the [`documentation`](https://headscale.net/).

 ## Graphical Control Panels

@@ -13,6 +13,7 @@ import (
 	"time"

 	"github.com/rs/zerolog/log"
+	"github.com/samber/lo"
 	"github.com/tailscale/hujson"
 	"go4.org/netipx"
 	"gopkg.in/yaml.v3"
@@ -118,7 +119,7 @@ func (h *Headscale) LoadACLPolicy(path string) error {
 }

 func (h *Headscale) UpdateACLRules() error {
-	machines, err := h.ListMachines()
+	nodes, err := h.ListNodes()
 	if err != nil {
 		return err
 	}
@@ -127,7 +128,7 @@ func (h *Headscale) UpdateACLRules() error {
 		return errEmptyPolicy
 	}

-	rules, err := generateACLRules(machines, *h.aclPolicy, h.cfg.OIDC.StripEmaildomain)
+	rules, err := generateACLRules(nodes, *h.aclPolicy, h.cfg.OIDC.StripEmaildomain)
 	if err != nil {
 		return err
 	}
@@ -162,23 +163,20 @@ func (h *Headscale) UpdateACLRules() error {
 // generateACLPeerCacheMap takes a list of Tailscale filter rules and generates a map
 // of which Sources ("*" and IPs) can access destinations. This is to speed up the
 // process of generating MapResponses when deciding which Peers to inform nodes about.
-func generateACLPeerCacheMap(rules []tailcfg.FilterRule) map[string]map[string]struct{} {
-	aclCachePeerMap := make(map[string]map[string]struct{})
+func generateACLPeerCacheMap(rules []tailcfg.FilterRule) map[string][]string {
+	aclCachePeerMap := make(map[string][]string)
 	for _, rule := range rules {
 		for _, srcIP := range rule.SrcIPs {
 			for _, ip := range expandACLPeerAddr(srcIP) {
 				if data, ok := aclCachePeerMap[ip]; ok {
 					for _, dstPort := range rule.DstPorts {
-						for _, dstIP := range expandACLPeerAddr(dstPort.IP) {
-							data[dstIP] = struct{}{}
-						}
+						data = append(data, dstPort.IP)
 					}
+					aclCachePeerMap[ip] = data
 				} else {
-					dstPortsMap := make(map[string]struct{}, len(rule.DstPorts))
+					dstPortsMap := make([]string, 0)
 					for _, dstPort := range rule.DstPorts {
-						for _, dstIP := range expandACLPeerAddr(dstPort.IP) {
-							dstPortsMap[dstIP] = struct{}{}
-						}
+						dstPortsMap = append(dstPortsMap, dstPort.IP)
 					}
 					aclCachePeerMap[ip] = dstPortsMap
 				}
@@ -227,7 +225,7 @@ func expandACLPeerAddr(srcIP string) []string {
 }

 func generateACLRules(
-	machines []Machine,
+	nodes []Node,
 	aclPolicy ACLPolicy,
 	stripEmaildomain bool,
 ) ([]tailcfg.FilterRule, error) {
@@ -240,7 +238,7 @@ func generateACLRules(

 		srcIPs := []string{}
 		for innerIndex, src := range acl.Sources {
-			srcs, err := generateACLPolicySrc(machines, aclPolicy, src, stripEmaildomain)
+			srcs, err := generateACLPolicySrc(nodes, aclPolicy, src, stripEmaildomain)
 			if err != nil {
 				log.Error().
 					Msgf("Error parsing ACL %d, Source %d", index, innerIndex)
@@ -261,7 +259,7 @@ func generateACLRules(
 		destPorts := []tailcfg.NetPortRange{}
 		for innerIndex, dest := range acl.Destinations {
 			dests, err := generateACLPolicyDest(
-				machines,
+				nodes,
 				aclPolicy,
 				dest,
 				needsWildcard,
@@ -293,7 +291,7 @@ func (h *Headscale) generateSSHRules() ([]*tailcfg.SSHRule, error) {
 		return nil, errEmptyPolicy
 	}

-	machines, err := h.ListMachines()
+	nodes, err := h.ListNodes()
 	if err != nil {
 		return nil, err
 	}
@@ -341,7 +339,7 @@ func (h *Headscale) generateSSHRules() ([]*tailcfg.SSHRule, error) {
 		principals := make([]*tailcfg.SSHPrincipal, 0, len(sshACL.Sources))
 		for innerIndex, rawSrc := range sshACL.Sources {
 			expandedSrcs, err := expandAlias(
-				machines,
+				nodes,
 				*h.aclPolicy,
 				rawSrc,
 				h.cfg.OIDC.StripEmaildomain,
@@ -392,30 +390,55 @@ func sshCheckAction(duration string) (*tailcfg.SSHAction, error) {
 }

 func generateACLPolicySrc(
-	machines []Machine,
+	nodes []Node,
 	aclPolicy ACLPolicy,
 	src string,
 	stripEmaildomain bool,
 ) ([]string, error) {
-	return expandAlias(machines, aclPolicy, src, stripEmaildomain)
+	return expandAlias(nodes, aclPolicy, src, stripEmaildomain)
 }

 func generateACLPolicyDest(
-	machines []Machine,
+	nodes []Node,
 	aclPolicy ACLPolicy,
 	dest string,
 	needsWildcard bool,
 	stripEmaildomain bool,
 ) ([]tailcfg.NetPortRange, error) {
-	tokens := strings.Split(dest, ":")
+	var tokens []string
+
+	log.Trace().Str("destination", dest).Msg("generating policy destination")
+
+	// Check if there is a IPv4/6:Port combination, IPv6 has more than
+	// three ":".
+	tokens = strings.Split(dest, ":")
 	if len(tokens) < expectedTokenItems || len(tokens) > 3 {
-		return nil, errInvalidPortFormat
+		port := tokens[len(tokens)-1]
+
+		maybeIPv6Str := strings.TrimSuffix(dest, ":"+port)
+		log.Trace().Str("maybeIPv6Str", maybeIPv6Str).Msg("")
+
+		if maybeIPv6, err := netip.ParseAddr(maybeIPv6Str); err != nil && !maybeIPv6.Is6() {
+			log.Trace().Err(err).Msg("trying to parse as IPv6")
+
+			return nil, fmt.Errorf(
+				"failed to parse destination, tokens %v: %w",
+				tokens,
+				errInvalidPortFormat,
+			)
+		} else {
+			tokens = []string{maybeIPv6Str, port}
+		}
 	}

+	log.Trace().Strs("tokens", tokens).Msg("generating policy destination")
+
 	var alias string
 	// We can have here stuff like:
 	// git-server:*
 	// 192.168.1.0/24:22
+	// fd7a:115c:a1e0::2:22
+	// fd7a:115c:a1e0::2/128:22
 	// tag:montreal-webserver:80,443
 	// tag:api-server:443
 	// example-host-1:*
@@ -426,7 +449,7 @@ func generateACLPolicyDest(
 	}

 	expanded, err := expandAlias(
-		machines,
+		nodes,
 		aclPolicy,
 		alias,
 		stripEmaildomain,
@@ -508,9 +531,11 @@ func parseProtocol(protocol string) ([]int, bool, error) {
 // - a group
 // - a tag
 // - a host
+// - an ip
+// - a cidr
 // and transform these in IPAddresses.
 func expandAlias(
-	machines []Machine,
+	nodes Nodes,
 	aclPolicy ACLPolicy,
 	alias string,
 	stripEmailDomain bool,
@@ -530,7 +555,7 @@ func expandAlias(
 			return ips, err
 		}
 		for _, n := range users {
-			nodes := filterMachinesByUser(machines, n)
+			nodes := filterNodesByUser(nodes, n)
 			for _, node := range nodes {
 				ips = append(ips, node.IPAddresses.ToStringSlice()...)
 			}
@@ -541,9 +566,9 @@ func expandAlias(

 	if strings.HasPrefix(alias, "tag:") {
 		// check for forced tags
-		for _, machine := range machines {
-			if contains(machine.ForcedTags, alias) {
-				ips = append(ips, machine.IPAddresses.ToStringSlice()...)
+		for _, node := range nodes {
+			if contains(node.ForcedTags, alias) {
+				ips = append(ips, node.IPAddresses.ToStringSlice()...)
 			}
 		}

@@ -565,13 +590,13 @@ func expandAlias(
 			}
 		}

-		// filter out machines per tag owner
+		// filter out nodes per tag owner
 		for _, user := range owners {
-			machines := filterMachinesByUser(machines, user)
-			for _, machine := range machines {
-				hi := machine.GetHostInfo()
+			nodes := filterNodesByUser(nodes, user)
+			for _, node := range nodes {
+				hi := node.GetHostInfo()
 				if contains(hi.RequestTags, alias) {
-					ips = append(ips, machine.IPAddresses.ToStringSlice()...)
+					ips = append(ips, node.IPAddresses.ToStringSlice()...)
 				}
 			}
 		}
@@ -580,10 +605,10 @@ func expandAlias(
 	}

 	// if alias is a user
-	nodes := filterMachinesByUser(machines, alias)
-	nodes = excludeCorrectlyTaggedNodes(aclPolicy, nodes, alias, stripEmailDomain)
+	filteredNodes := filterNodesByUser(nodes, alias)
+	filteredNodes = excludeCorrectlyTaggedNodes(aclPolicy, filteredNodes, alias, stripEmailDomain)

-	for _, n := range nodes {
+	for _, n := range filteredNodes {
 		ips = append(ips, n.IPAddresses.ToStringSlice()...)
 	}
 	if len(ips) > 0 {
@@ -592,19 +617,40 @@ func expandAlias(

 	// if alias is an host
 	if h, ok := aclPolicy.Hosts[alias]; ok {
-		return []string{h.String()}, nil
+		log.Trace().Str("host", h.String()).Msg("expandAlias got hosts entry")
+
+		return expandAlias(filteredNodes, aclPolicy, h.String(), stripEmailDomain)
 	}

 	// if alias is an IP
-	ip, err := netip.ParseAddr(alias)
-	if err == nil {
-		return []string{ip.String()}, nil
+	if ip, err := netip.ParseAddr(alias); err == nil {
+		log.Trace().Str("ip", ip.String()).Msg("expandAlias got ip")
+		ips := []string{ip.String()}
+		matches := nodes.FilterByIP(ip)
+
+		for _, node := range matches {
+			ips = append(ips, node.IPAddresses.ToStringSlice()...)
+		}
+
+		return lo.Uniq(ips), nil
 	}

-	// if alias is an CIDR
-	cidr, err := netip.ParsePrefix(alias)
-	if err == nil {
-		return []string{cidr.String()}, nil
+	if cidr, err := netip.ParsePrefix(alias); err == nil {
+		log.Trace().Str("cidr", cidr.String()).Msg("expandAlias got cidr")
+		val := []string{cidr.String()}
+		// This is suboptimal and quite expensive, but if we only add the cidr, we will miss all the relevant IPv6
+		// addresses for the hosts that belong to tailscale. This doesnt really affect stuff like subnet routers.
+		for _, node := range nodes {
+			for _, ip := range node.IPAddresses {
+				// log.Trace().
+				// 	Msgf("checking if node ip (%s) is part of cidr (%s): %v, is single ip cidr (%v), addr: %s", ip.String(), cidr.String(), cidr.Contains(ip), cidr.IsSingleIP(), cidr.Addr().String())
+				if cidr.Contains(ip) {
+					val = append(val, node.IPAddresses.ToStringSlice()...)
+				}
+			}
+		}
+
+		return lo.Uniq(val), nil
 	}

 	log.Warn().Msgf("No IPs found with the alias %v", alias)
@@ -617,11 +663,11 @@ func expandAlias(
 // we assume in this function that we only have nodes from 1 user.
 func excludeCorrectlyTaggedNodes(
 	aclPolicy ACLPolicy,
-	nodes []Machine,
+	nodes []Node,
 	user string,
 	stripEmailDomain bool,
-) []Machine {
-	out := []Machine{}
+) []Node {
+	out := []Node{}
 	tags := []string{}
 	for tag := range aclPolicy.TagOwners {
 		owners, _ := expandTagOwners(aclPolicy, user, stripEmailDomain)
@@ -630,9 +676,9 @@ func excludeCorrectlyTaggedNodes(
 			tags = append(tags, tag)
 		}
 	}
-	// for each machine if tag is in tags list, don't append it.
-	for _, machine := range nodes {
-		hi := machine.GetHostInfo()
+	// for each node if tag is in tags list, don't append it.
+	for _, node := range nodes {
+		hi := node.GetHostInfo()

 		found := false
 		for _, t := range hi.RequestTags {
@@ -642,11 +688,11 @@ func excludeCorrectlyTaggedNodes(
 				break
 			}
 		}
-		if len(machine.ForcedTags) > 0 {
+		if len(node.ForcedTags) > 0 {
 			found = true
 		}
 		if !found {
-			out = append(out, machine)
+			out = append(out, node)
 		}
 	}

@@ -666,6 +712,7 @@ func expandPorts(portsStr string, needsWildcard bool) (*[]tailcfg.PortRange, err

 	ports := []tailcfg.PortRange{}
 	for _, portStr := range strings.Split(portsStr, ",") {
+		log.Trace().Msgf("parsing portstring: %s", portStr)
 		rang := strings.Split(portStr, "-")
 		switch len(rang) {
 		case 1:
@@ -700,11 +747,11 @@ func expandPorts(portsStr string, needsWildcard bool) (*[]tailcfg.PortRange, err
 	return &ports, nil
 }

-func filterMachinesByUser(machines []Machine, user string) []Machine {
-	out := []Machine{}
-	for _, machine := range machines {
-		if machine.User.Name == user {
-			out = append(out, machine)
+func filterNodesByUser(nodes []Node, user string) []Node {
+	out := []Node{}
+	for _, node := range nodes {
+		if node.User.Name == user {
+			out = append(out, node)
 		}
 	}

@@ -54,7 +54,7 @@ func (s *Suite) TestBasicRule(c *check.C) {
 	err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_1.hujson")
 	c.Assert(err, check.IsNil)

-	rules, err := generateACLRules([]Machine{}, *app.aclPolicy, false)
+	rules, err := generateACLRules([]Node{}, *app.aclPolicy, false)
 	c.Assert(err, check.IsNil)
 	c.Assert(rules, check.NotNil)
 }
@@ -83,27 +83,27 @@ func (s *Suite) TestSshRules(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("user1", "testmachine")
+	_, err = app.GetNode("user1", "testnode")
 	c.Assert(err, check.NotNil)
 	hostInfo := tailcfg.Hostinfo{
 		OS:          "centos",
-		Hostname:    "testmachine",
+		Hostname:    "testnode",
 		RequestTags: []string{"tag:test"},
 	}

-	machine := Machine{
+	node := Node{
 		ID:             0,
 		MachineKey:     "foo",
 		NodeKey:        "bar",
 		DiscoKey:       "faa",
-		Hostname:       "testmachine",
-		IPAddresses:    MachineAddresses{netip.MustParseAddr("100.64.0.1")},
+		Hostname:       "testnode",
+		IPAddresses:    NodeAddresses{netip.MustParseAddr("100.64.0.1")},
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 		HostInfo:       HostInfo(hostInfo),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	app.aclPolicy = &ACLPolicy{
 		Groups: Groups{
@@ -193,27 +193,27 @@ func (s *Suite) TestValidExpandTagOwnersInSources(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("user1", "testmachine")
+	_, err = app.GetNode("user1", "testnode")
 	c.Assert(err, check.NotNil)
 	hostInfo := tailcfg.Hostinfo{
 		OS:          "centos",
-		Hostname:    "testmachine",
+		Hostname:    "testnode",
 		RequestTags: []string{"tag:test"},
 	}

-	machine := Machine{
+	node := Node{
 		ID:             0,
 		MachineKey:     "foo",
 		NodeKey:        "bar",
 		DiscoKey:       "faa",
-		Hostname:       "testmachine",
-		IPAddresses:    MachineAddresses{netip.MustParseAddr("100.64.0.1")},
+		Hostname:       "testnode",
+		IPAddresses:    NodeAddresses{netip.MustParseAddr("100.64.0.1")},
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 		HostInfo:       HostInfo(hostInfo),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	app.aclPolicy = &ACLPolicy{
 		Groups:    Groups{"group:test": []string{"user1", "user2"}},
@@ -243,27 +243,27 @@ func (s *Suite) TestValidExpandTagOwnersInDestinations(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("user1", "testmachine")
+	_, err = app.GetNode("user1", "testnode")
 	c.Assert(err, check.NotNil)
 	hostInfo := tailcfg.Hostinfo{
 		OS:          "centos",
-		Hostname:    "testmachine",
+		Hostname:    "testnode",
 		RequestTags: []string{"tag:test"},
 	}

-	machine := Machine{
+	node := Node{
 		ID:             1,
 		MachineKey:     "12345",
 		NodeKey:        "bar",
 		DiscoKey:       "faa",
-		Hostname:       "testmachine",
-		IPAddresses:    MachineAddresses{netip.MustParseAddr("100.64.0.1")},
+		Hostname:       "testnode",
+		IPAddresses:    NodeAddresses{netip.MustParseAddr("100.64.0.1")},
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 		HostInfo:       HostInfo(hostInfo),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	app.aclPolicy = &ACLPolicy{
 		Groups:    Groups{"group:test": []string{"user1", "user2"}},
@@ -293,27 +293,27 @@ func (s *Suite) TestInvalidTagValidUser(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("user1", "testmachine")
+	_, err = app.GetNode("user1", "testnode")
 	c.Assert(err, check.NotNil)
 	hostInfo := tailcfg.Hostinfo{
 		OS:          "centos",
-		Hostname:    "testmachine",
+		Hostname:    "testnode",
 		RequestTags: []string{"tag:foo"},
 	}

-	machine := Machine{
+	node := Node{
 		ID:             1,
 		MachineKey:     "12345",
 		NodeKey:        "bar",
 		DiscoKey:       "faa",
-		Hostname:       "testmachine",
-		IPAddresses:    MachineAddresses{netip.MustParseAddr("100.64.0.1")},
+		Hostname:       "testnode",
+		IPAddresses:    NodeAddresses{netip.MustParseAddr("100.64.0.1")},
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 		HostInfo:       HostInfo(hostInfo),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	app.aclPolicy = &ACLPolicy{
 		TagOwners: TagOwners{"tag:test": []string{"user1"}},
@@ -342,7 +342,7 @@ func (s *Suite) TestValidTagInvalidUser(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("user1", "webserver")
+	_, err = app.GetNode("user1", "webserver")
 	c.Assert(err, check.NotNil)
 	hostInfo := tailcfg.Hostinfo{
 		OS:          "centos",
@@ -350,38 +350,38 @@ func (s *Suite) TestValidTagInvalidUser(c *check.C) {
 		RequestTags: []string{"tag:webapp"},
 	}

-	machine := Machine{
+	node := Node{
 		ID:             1,
 		MachineKey:     "12345",
 		NodeKey:        "bar",
 		DiscoKey:       "faa",
 		Hostname:       "webserver",
-		IPAddresses:    MachineAddresses{netip.MustParseAddr("100.64.0.1")},
+		IPAddresses:    NodeAddresses{netip.MustParseAddr("100.64.0.1")},
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 		HostInfo:       HostInfo(hostInfo),
 	}
-	app.db.Save(&machine)
-	_, err = app.GetMachine("user1", "user")
+	app.db.Save(&node)
+	_, err = app.GetNode("user1", "user")
 	hostInfo2 := tailcfg.Hostinfo{
 		OS:       "debian",
 		Hostname: "Hostname",
 	}
 	c.Assert(err, check.NotNil)
-	machine = Machine{
+	node = Node{
 		ID:             2,
 		MachineKey:     "56789",
 		NodeKey:        "bar2",
 		DiscoKey:       "faab",
 		Hostname:       "user",
-		IPAddresses:    MachineAddresses{netip.MustParseAddr("100.64.0.2")},
+		IPAddresses:    NodeAddresses{netip.MustParseAddr("100.64.0.2")},
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 		HostInfo:       HostInfo(hostInfo2),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	app.aclPolicy = &ACLPolicy{
 		TagOwners: TagOwners{"tag:webapp": []string{"user1"}},
@@ -411,7 +411,7 @@ func (s *Suite) TestPortRange(c *check.C) {
 	err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_range.hujson")
 	c.Assert(err, check.IsNil)

-	rules, err := generateACLRules([]Machine{}, *app.aclPolicy, false)
+	rules, err := generateACLRules([]Node{}, *app.aclPolicy, false)
 	c.Assert(err, check.IsNil)
 	c.Assert(rules, check.NotNil)

@@ -425,7 +425,7 @@ func (s *Suite) TestProtocolParsing(c *check.C) {
 	err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_protocols.hujson")
 	c.Assert(err, check.IsNil)

-	rules, err := generateACLRules([]Machine{}, *app.aclPolicy, false)
+	rules, err := generateACLRules([]Node{}, *app.aclPolicy, false)
 	c.Assert(err, check.IsNil)
 	c.Assert(rules, check.NotNil)

@@ -439,7 +439,7 @@ func (s *Suite) TestPortWildcard(c *check.C) {
 	err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_wildcards.hujson")
 	c.Assert(err, check.IsNil)

-	rules, err := generateACLRules([]Machine{}, *app.aclPolicy, false)
+	rules, err := generateACLRules([]Node{}, *app.aclPolicy, false)
 	c.Assert(err, check.IsNil)
 	c.Assert(rules, check.NotNil)

@@ -455,7 +455,7 @@ func (s *Suite) TestPortWildcardYAML(c *check.C) {
 	err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_wildcards.yaml")
 	c.Assert(err, check.IsNil)

-	rules, err := generateACLRules([]Machine{}, *app.aclPolicy, false)
+	rules, err := generateACLRules([]Node{}, *app.aclPolicy, false)
 	c.Assert(err, check.IsNil)
 	c.Assert(rules, check.NotNil)

@@ -474,31 +474,31 @@ func (s *Suite) TestPortUser(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("testuser", "testmachine")
+	_, err = app.GetNode("testuser", "testnode")
 	c.Assert(err, check.NotNil)
 	ips, _ := app.getAvailableIPs()
-	machine := Machine{
+	node := Node{
 		ID:             0,
 		MachineKey:     "12345",
 		NodeKey:        "bar",
 		DiscoKey:       "faa",
-		Hostname:       "testmachine",
+		Hostname:       "testnode",
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		IPAddresses:    ips,
 		AuthKeyID:      uint(pak.ID),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	err = app.LoadACLPolicy(
 		"./tests/acls/acl_policy_basic_user_as_user.hujson",
 	)
 	c.Assert(err, check.IsNil)

-	machines, err := app.ListMachines()
+	nodes, err := app.ListNodes()
 	c.Assert(err, check.IsNil)

-	rules, err := generateACLRules(machines, *app.aclPolicy, false)
+	rules, err := generateACLRules(nodes, *app.aclPolicy, false)
 	c.Assert(err, check.IsNil)
 	c.Assert(rules, check.NotNil)

@@ -519,29 +519,29 @@ func (s *Suite) TestPortGroup(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("testuser", "testmachine")
+	_, err = app.GetNode("testuser", "testnode")
 	c.Assert(err, check.NotNil)
 	ips, _ := app.getAvailableIPs()
-	machine := Machine{
+	node := Node{
 		ID:             0,
 		MachineKey:     "foo",
 		NodeKey:        "bar",
 		DiscoKey:       "faa",
-		Hostname:       "testmachine",
+		Hostname:       "testnode",
 		UserID:         user.ID,
 		RegisterMethod: RegisterMethodAuthKey,
 		IPAddresses:    ips,
 		AuthKeyID:      uint(pak.ID),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	err = app.LoadACLPolicy("./tests/acls/acl_policy_basic_groups.hujson")
 	c.Assert(err, check.IsNil)

-	machines, err := app.ListMachines()
+	nodes, err := app.ListNodes()
 	c.Assert(err, check.IsNil)

-	rules, err := generateACLRules(machines, *app.aclPolicy, false)
+	rules, err := generateACLRules(nodes, *app.aclPolicy, false)
 	c.Assert(err, check.IsNil)
 	c.Assert(rules, check.NotNil)

@@ -843,47 +843,47 @@ func Test_expandPorts(t *testing.T) {
 	}
 }

-func Test_listMachinesInUser(t *testing.T) {
+func Test_listNodesInUser(t *testing.T) {
 	type args struct {
-		machines []Machine
-		user     string
+		nodes []Node
+		user  string
 	}
 	tests := []struct {
 		name string
 		args args
-		want []Machine
+		want []Node
 	}{
 		{
-			name: "1 machine in user",
+			name: "1 node in user",
 			args: args{
-				machines: []Machine{
+				nodes: []Node{
 					{User: User{Name: "joe"}},
 				},
 				user: "joe",
 			},
-			want: []Machine{
+			want: []Node{
 				{User: User{Name: "joe"}},
 			},
 		},
 		{
-			name: "3 machines, 2 in user",
+			name: "3 nodes, 2 in user",
 			args: args{
-				machines: []Machine{
+				nodes: []Node{
 					{ID: 1, User: User{Name: "joe"}},
 					{ID: 2, User: User{Name: "marc"}},
 					{ID: 3, User: User{Name: "marc"}},
 				},
 				user: "marc",
 			},
-			want: []Machine{
+			want: []Node{
 				{ID: 2, User: User{Name: "marc"}},
 				{ID: 3, User: User{Name: "marc"}},
 			},
 		},
 		{
-			name: "5 machines, 0 in user",
+			name: "5 nodes, 0 in user",
 			args: args{
-				machines: []Machine{
+				nodes: []Node{
 					{ID: 1, User: User{Name: "joe"}},
 					{ID: 2, User: User{Name: "marc"}},
 					{ID: 3, User: User{Name: "marc"}},
@@ -892,16 +892,16 @@ func Test_listMachinesInUser(t *testing.T) {
 				},
 				user: "mickael",
 			},
-			want: []Machine{},
+			want: []Node{},
 		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if got := filterMachinesByUser(test.args.machines, test.args.user); !reflect.DeepEqual(
+			if got := filterNodesByUser(test.args.nodes, test.args.user); !reflect.DeepEqual(
 				got,
 				test.want,
 			) {
-				t.Errorf("listMachinesInUser() = %v, want %v", got, test.want)
+				t.Errorf("listNodesInUser() = %v, want %v", got, test.want)
 			}
 		})
 	}
@@ -909,7 +909,7 @@ func Test_listMachinesInUser(t *testing.T) {

 func Test_expandAlias(t *testing.T) {
 	type args struct {
-		machines         []Machine
+		nodes            []Node
 		aclPolicy        ACLPolicy
 		alias            string
 		stripEmailDomain bool
@@ -924,10 +924,10 @@ func Test_expandAlias(t *testing.T) {
 			name: "wildcard",
 			args: args{
 				alias: "*",
-				machines: []Machine{
-					{IPAddresses: MachineAddresses{netip.MustParseAddr("100.64.0.1")}},
+				nodes: []Node{
+					{IPAddresses: NodeAddresses{netip.MustParseAddr("100.64.0.1")}},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.78.84.227"),
 						},
 					},
@@ -942,27 +942,27 @@ func Test_expandAlias(t *testing.T) {
 			name: "simple group",
 			args: args{
 				alias: "group:accountant",
-				machines: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.3"),
 						},
 						User: User{Name: "marc"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "mickael"},
@@ -980,27 +980,27 @@ func Test_expandAlias(t *testing.T) {
 			name: "wrong group",
 			args: args{
 				alias: "group:hr",
-				machines: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.3"),
 						},
 						User: User{Name: "marc"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "mickael"},
@@ -1018,7 +1018,7 @@ func Test_expandAlias(t *testing.T) {
 			name: "simple ipaddress",
 			args: args{
 				alias:            "10.0.0.3",
-				machines:         []Machine{},
+				nodes:            []Node{},
 				aclPolicy:        ACLPolicy{},
 				stripEmailDomain: true,
 			},
@@ -1026,36 +1026,77 @@ func Test_expandAlias(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "private network",
-			args: args{
-				alias:    "homeNetwork",
-				machines: []Machine{},
-				aclPolicy: ACLPolicy{
-					Hosts: Hosts{
-						"homeNetwork": netip.MustParsePrefix("192.168.1.0/24"),
-					},
-				},
-				stripEmailDomain: true,
-			},
-			want:    []string{"192.168.1.0/24"},
-			wantErr: false,
-		},
-		{
-			name: "simple host by ip",
+			name: "simple host by ip passed through",
 			args: args{
 				alias:            "10.0.0.1",
-				machines:         []Machine{},
+				nodes:            []Node{},
 				aclPolicy:        ACLPolicy{},
 				stripEmailDomain: true,
 			},
 			want:    []string{"10.0.0.1"},
 			wantErr: false,
 		},
+		{
+			name: "simple host by ipv4 single ipv4",
+			args: args{
+				alias: "10.0.0.1",
+				nodes: []Node{
+					{
+						IPAddresses: NodeAddresses{
+							netip.MustParseAddr("10.0.0.1"),
+						},
+						User: User{Name: "mickael"},
+					},
+				},
+				aclPolicy:        ACLPolicy{},
+				stripEmailDomain: true,
+			},
+			want:    []string{"10.0.0.1"},
+			wantErr: false,
+		},
+		{
+			name: "simple host by ipv4 single dual stack",
+			args: args{
+				alias: "10.0.0.1",
+				nodes: []Node{
+					{
+						IPAddresses: NodeAddresses{
+							netip.MustParseAddr("10.0.0.1"),
+							netip.MustParseAddr("fd7a:115c:a1e0:ab12:4843:2222:6273:2222"),
+						},
+						User: User{Name: "mickael"},
+					},
+				},
+				aclPolicy:        ACLPolicy{},
+				stripEmailDomain: true,
+			},
+			want:    []string{"10.0.0.1", "fd7a:115c:a1e0:ab12:4843:2222:6273:2222"},
+			wantErr: false,
+		},
+		{
+			name: "simple host by ipv6 single dual stack",
+			args: args{
+				alias: "fd7a:115c:a1e0:ab12:4843:2222:6273:2222",
+				nodes: []Node{
+					{
+						IPAddresses: NodeAddresses{
+							netip.MustParseAddr("10.0.0.1"),
+							netip.MustParseAddr("fd7a:115c:a1e0:ab12:4843:2222:6273:2222"),
+						},
+						User: User{Name: "mickael"},
+					},
+				},
+				aclPolicy:        ACLPolicy{},
+				stripEmailDomain: true,
+			},
+			want:    []string{"fd7a:115c:a1e0:ab12:4843:2222:6273:2222", "10.0.0.1"},
+			wantErr: false,
+		},
 		{
 			name: "simple host by hostname alias",
 			args: args{
-				alias:    "testy",
-				machines: []Machine{},
+				alias: "testy",
+				nodes: []Node{},
 				aclPolicy: ACLPolicy{
 					Hosts: Hosts{
 						"testy": netip.MustParsePrefix("10.0.0.132/32"),
@@ -1066,11 +1107,26 @@ func Test_expandAlias(t *testing.T) {
 			want:    []string{"10.0.0.132/32"},
 			wantErr: false,
 		},
+		{
+			name: "private network",
+			args: args{
+				alias: "homeNetwork",
+				nodes: []Node{},
+				aclPolicy: ACLPolicy{
+					Hosts: Hosts{
+						"homeNetwork": netip.MustParsePrefix("192.168.1.0/24"),
+					},
+				},
+				stripEmailDomain: true,
+			},
+			want:    []string{"192.168.1.0/24"},
+			wantErr: false,
+		},
 		{
 			name: "simple CIDR",
 			args: args{
 				alias:            "10.0.0.0/16",
-				machines:         []Machine{},
+				nodes:            []Node{},
 				aclPolicy:        ACLPolicy{},
 				stripEmailDomain: true,
 			},
@@ -1081,9 +1137,9 @@ func Test_expandAlias(t *testing.T) {
 			name: "simple tag",
 			args: args{
 				alias: "tag:hr-webserver",
-				machines: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
@@ -1094,7 +1150,7 @@ func Test_expandAlias(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
@@ -1105,13 +1161,13 @@ func Test_expandAlias(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.3"),
 						},
 						User: User{Name: "marc"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "joe"},
@@ -1129,27 +1185,27 @@ func Test_expandAlias(t *testing.T) {
 			name: "No tag defined",
 			args: args{
 				alias: "tag:hr-webserver",
-				machines: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.3"),
 						},
 						User: User{Name: "marc"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "mickael"},
@@ -1170,29 +1226,29 @@ func Test_expandAlias(t *testing.T) {
 			name: "Forced tag defined",
 			args: args{
 				alias: "tag:hr-webserver",
-				machines: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User:       User{Name: "joe"},
 						ForcedTags: []string{"tag:hr-webserver"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User:       User{Name: "joe"},
 						ForcedTags: []string{"tag:hr-webserver"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.3"),
 						},
 						User: User{Name: "marc"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "mickael"},
@@ -1208,16 +1264,16 @@ func Test_expandAlias(t *testing.T) {
 			name: "Forced tag with legitimate tagOwner",
 			args: args{
 				alias: "tag:hr-webserver",
-				machines: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User:       User{Name: "joe"},
 						ForcedTags: []string{"tag:hr-webserver"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
@@ -1228,13 +1284,13 @@ func Test_expandAlias(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.3"),
 						},
 						User: User{Name: "marc"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "mickael"},
@@ -1254,9 +1310,9 @@ func Test_expandAlias(t *testing.T) {
 			name: "list host in user without correctly tagged servers",
 			args: args{
 				alias: "joe",
-				machines: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
@@ -1267,7 +1323,7 @@ func Test_expandAlias(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
@@ -1278,13 +1334,13 @@ func Test_expandAlias(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.3"),
 						},
 						User: User{Name: "marc"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "joe"},
@@ -1302,7 +1358,7 @@ func Test_expandAlias(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			got, err := expandAlias(
-				test.args.machines,
+				test.args.nodes,
 				test.args.aclPolicy,
 				test.args.alias,
 				test.args.stripEmailDomain,
@@ -1322,14 +1378,14 @@ func Test_expandAlias(t *testing.T) {
 func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 	type args struct {
 		aclPolicy        ACLPolicy
-		nodes            []Machine
+		nodes            []Node
 		user             string
 		stripEmailDomain bool
 	}
 	tests := []struct {
 		name    string
 		args    args
-		want    []Machine
+		want    []Node
 		wantErr bool
 	}{
 		{
@@ -1338,9 +1394,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				aclPolicy: ACLPolicy{
 					TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
 				},
-				nodes: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
@@ -1351,7 +1407,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
@@ -1362,7 +1418,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "joe"},
@@ -1371,9 +1427,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				user:             "joe",
 				stripEmailDomain: true,
 			},
-			want: []Machine{
+			want: []Node{
 				{
-					IPAddresses: MachineAddresses{netip.MustParseAddr("100.64.0.4")},
+					IPAddresses: NodeAddresses{netip.MustParseAddr("100.64.0.4")},
 					User:        User{Name: "joe"},
 				},
 			},
@@ -1389,9 +1445,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						"tag:accountant-webserver": []string{"group:accountant"},
 					},
 				},
-				nodes: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
@@ -1402,7 +1458,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
@@ -1413,7 +1469,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "joe"},
@@ -1422,9 +1478,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				user:             "joe",
 				stripEmailDomain: true,
 			},
-			want: []Machine{
+			want: []Node{
 				{
-					IPAddresses: MachineAddresses{netip.MustParseAddr("100.64.0.4")},
+					IPAddresses: NodeAddresses{netip.MustParseAddr("100.64.0.4")},
 					User:        User{Name: "joe"},
 				},
 			},
@@ -1435,9 +1491,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				aclPolicy: ACLPolicy{
 					TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
 				},
-				nodes: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
@@ -1448,14 +1504,14 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User:       User{Name: "joe"},
 						ForcedTags: []string{"tag:accountant-webserver"},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "joe"},
@@ -1464,9 +1520,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				user:             "joe",
 				stripEmailDomain: true,
 			},
-			want: []Machine{
+			want: []Node{
 				{
-					IPAddresses: MachineAddresses{netip.MustParseAddr("100.64.0.4")},
+					IPAddresses: NodeAddresses{netip.MustParseAddr("100.64.0.4")},
 					User:        User{Name: "joe"},
 				},
 			},
@@ -1477,9 +1533,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				aclPolicy: ACLPolicy{
 					TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
 				},
-				nodes: []Machine{
+				nodes: []Node{
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.1"),
 						},
 						User: User{Name: "joe"},
@@ -1490,7 +1546,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.2"),
 						},
 						User: User{Name: "joe"},
@@ -1501,7 +1557,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 						},
 					},
 					{
-						IPAddresses: MachineAddresses{
+						IPAddresses: NodeAddresses{
 							netip.MustParseAddr("100.64.0.4"),
 						},
 						User: User{Name: "joe"},
@@ -1510,9 +1566,9 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				user:             "joe",
 				stripEmailDomain: true,
 			},
-			want: []Machine{
+			want: []Node{
 				{
-					IPAddresses: MachineAddresses{
+					IPAddresses: NodeAddresses{
 						netip.MustParseAddr("100.64.0.1"),
 					},
 					User: User{Name: "joe"},
@@ -1523,7 +1579,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 					},
 				},
 				{
-					IPAddresses: MachineAddresses{
+					IPAddresses: NodeAddresses{
 						netip.MustParseAddr("100.64.0.2"),
 					},
 					User: User{Name: "joe"},
@@ -1534,7 +1590,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 					},
 				},
 				{
-					IPAddresses: MachineAddresses{
+					IPAddresses: NodeAddresses{
 						netip.MustParseAddr("100.64.0.4"),
 					},
 					User: User{Name: "joe"},
@@ -51,7 +51,7 @@ type AutoApprovers struct {
 	ExitNode []string            `json:"exitNode" yaml:"exitNode"`
 }

-// SSH controls who can ssh into which machines.
+// SSH controls who can ssh into which nodes.
 type SSH struct {
 	Action       string   `json:"action"                yaml:"action"`
 	Sources      []string `json:"src"                   yaml:"src"`
@@ -20,7 +20,7 @@ const (
 	RegisterMethodOIDC                       = "oidc"
 	RegisterMethodCLI                        = "cli"
 	ErrRegisterMethodCLIDoesNotSupportExpire = Error(
-		"machines registered with CLI does not support expire",
+		"node registered with CLI does not support expire",
 	)
 )

@@ -74,9 +74,9 @@ var registerWebAPITemplate = template.Must(
 	</head>
 	<body>
 		<h1>headscale</h1>
-		<h2>Machine registration</h2>
+		<h2>Node registration</h2>
 		<p>
-			Run the command below in the headscale server to add this machine to your network:
+			Run the command below in the headscale server to add this node to your network:
 		</p>
 		<pre><code>headscale nodes register --user USERNAME --key {{.Key}}</code></pre>
 	</body>
@@ -9,13 +9,13 @@ import (

 func (h *Headscale) generateMapResponse(
 	mapRequest tailcfg.MapRequest,
-	machine *Machine,
+	node *Node,
 ) (*tailcfg.MapResponse, error) {
 	log.Trace().
 		Str("func", "generateMapResponse").
-		Str("machine", mapRequest.Hostinfo.Hostname).
+		Str("node", mapRequest.Hostinfo.Hostname).
 		Msg("Creating Map response")
-	node, err := h.toNode(*machine, h.cfg.BaseDomain, h.cfg.DNSConfig)
+	tailNode, err := h.toNode(*node, h.cfg.BaseDomain, h.cfg.DNSConfig)
 	if err != nil {
 		log.Error().
 			Caller().
@@ -26,7 +26,7 @@ func (h *Headscale) generateMapResponse(
 		return nil, err
 	}

-	peers, err := h.getValidPeers(machine)
+	peers, err := h.getValidPeers(node)
 	if err != nil {
 		log.Error().
 			Caller().
@@ -37,7 +37,7 @@ func (h *Headscale) generateMapResponse(
 		return nil, err
 	}

-	profiles := h.getMapResponseUserProfiles(*machine, peers)
+	profiles := h.getMapResponseUserProfiles(*node, peers)

 	nodePeers, err := h.toNodes(peers, h.cfg.BaseDomain, h.cfg.DNSConfig)
 	if err != nil {
@@ -53,7 +53,7 @@ func (h *Headscale) generateMapResponse(
 	dnsConfig := getMapResponseDNSConfig(
 		h.cfg.DNSConfig,
 		h.cfg.BaseDomain,
-		*machine,
+		*node,
 		peers,
 	)

@@ -61,7 +61,7 @@ func (h *Headscale) generateMapResponse(

 	resp := tailcfg.MapResponse{
 		KeepAlive: false,
-		Node:      node,
+		Node:      tailNode,

 		// TODO: Only send if updated
 		DERPMap: h.DERPMap,
@@ -105,7 +105,7 @@ func (h *Headscale) generateMapResponse(

 	log.Trace().
 		Str("func", "generateMapResponse").
-		Str("machine", mapRequest.Hostinfo.Hostname).
+		Str("node", mapRequest.Hostinfo.Hostname).
 		// Interface("payload", resp).
 		Msgf("Generated map response: %s", tailMapResponseToString(resp))

@@ -87,7 +87,7 @@ type Headscale struct {
 	aclPolicy         *ACLPolicy
 	aclRules          []tailcfg.FilterRule
 	aclPeerCacheMapRW sync.RWMutex
-	aclPeerCacheMap   map[string]map[string]struct{}
+	aclPeerCacheMap   map[string][]string
 	sshPolicy         *tailcfg.SSHPolicy

 	lastStateChange *xsync.MapOf[string, time.Time]
@@ -211,7 +211,7 @@ func (h *Headscale) redirect(w http.ResponseWriter, req *http.Request) {
 	http.Redirect(w, req, target, http.StatusFound)
 }

-// expireEphemeralNodes deletes ephemeral machine records that have not been
+// expireEphemeralNodes deletes ephemeral node records that have not been
 // seen for longer than h.cfg.EphemeralNodeInactivityTimeout.
 func (h *Headscale) expireEphemeralNodes(milliSeconds int64) {
 	ticker := time.NewTicker(time.Duration(milliSeconds) * time.Millisecond)
@@ -220,12 +220,12 @@ func (h *Headscale) expireEphemeralNodes(milliSeconds int64) {
 	}
 }

-// expireExpiredMachines expires machines that have an explicit expiry set
+// expireExpiredNodes expires node that have an explicit expiry set
 // after that expiry time has passed.
-func (h *Headscale) expireExpiredMachines(milliSeconds int64) {
+func (h *Headscale) expireExpiredNodes(milliSeconds int64) {
 	ticker := time.NewTicker(time.Duration(milliSeconds) * time.Millisecond)
 	for range ticker.C {
-		h.expireExpiredMachinesWorker()
+		h.expireExpiredNodesWorker()
 	}
 }

@@ -248,32 +248,32 @@ func (h *Headscale) expireEphemeralNodesWorker() {
 	}

 	for _, user := range users {
-		machines, err := h.ListMachinesByUser(user.Name)
+		nodes, err := h.ListNodesByUser(user.Name)
 		if err != nil {
 			log.Error().
 				Err(err).
 				Str("user", user.Name).
-				Msg("Error listing machines in user")
+				Msg("Error listing nodes in user")

 			return
 		}

 		expiredFound := false
-		for _, machine := range machines {
-			if machine.isEphemeral() && machine.LastSeen != nil &&
+		for _, node := range nodes {
+			if node.isEphemeral() && node.LastSeen != nil &&
 				time.Now().
-					After(machine.LastSeen.Add(h.cfg.EphemeralNodeInactivityTimeout)) {
+					After(node.LastSeen.Add(h.cfg.EphemeralNodeInactivityTimeout)) {
 				expiredFound = true
 				log.Info().
-					Str("machine", machine.Hostname).
+					Str("node", node.Hostname).
 					Msg("Ephemeral client removed from database")

-				err = h.db.Unscoped().Delete(machine).Error
+				err = h.db.Unscoped().Delete(node).Error
 				if err != nil {
 					log.Error().
 						Err(err).
-						Str("machine", machine.Hostname).
-						Msg("🤮 Cannot delete ephemeral machine from the database")
+						Str("node", node.Hostname).
+						Msg("Cannot delete ephemeral node from the database")
 				}
 			}
 		}
@@ -284,7 +284,7 @@ func (h *Headscale) expireEphemeralNodesWorker() {
 	}
 }

-func (h *Headscale) expireExpiredMachinesWorker() {
+func (h *Headscale) expireExpiredNodesWorker() {
 	users, err := h.ListUsers()
 	if err != nil {
 		log.Error().Err(err).Msg("Error listing users")
@@ -293,34 +293,34 @@ func (h *Headscale) expireExpiredMachinesWorker() {
 	}

 	for _, user := range users {
-		machines, err := h.ListMachinesByUser(user.Name)
+		nodes, err := h.ListNodesByUser(user.Name)
 		if err != nil {
 			log.Error().
 				Err(err).
 				Str("user", user.Name).
-				Msg("Error listing machines in user")
+				Msg("Error listing nodes in user")

 			return
 		}

 		expiredFound := false
-		for index, machine := range machines {
-			if machine.isExpired() &&
-				machine.Expiry.After(h.getLastStateChange(user)) {
+		for index, node := range nodes {
+			if node.isExpired() &&
+				node.Expiry.After(h.getLastStateChange(user)) {
 				expiredFound = true

-				err := h.ExpireMachine(&machines[index])
+				err := h.ExpireNode(&nodes[index])
 				if err != nil {
 					log.Error().
 						Err(err).
-						Str("machine", machine.Hostname).
-						Str("name", machine.GivenName).
-						Msg("🤮 Cannot expire machine")
+						Str("node", node.Hostname).
+						Str("name", node.GivenName).
+						Msg("Cannot expire node")
 				} else {
 					log.Info().
-						Str("machine", machine.Hostname).
-						Str("name", machine.GivenName).
-						Msg("Machine successfully expired")
+						Str("node", node.Hostname).
+						Str("name", node.GivenName).
+						Msg("Node successfully expired")
 				}
 			}
 		}
@@ -552,7 +552,7 @@ func (h *Headscale) Serve() error {
 	}

 	go h.expireEphemeralNodes(updateInterval)
-	go h.expireExpiredMachines(updateInterval)
+	go h.expireExpiredNodes(updateInterval)

 	go h.failoverSubnetRoutes(updateInterval)

@@ -820,7 +820,6 @@ func (h *Headscale) Serve() error {

 				// And we're done:
 				cancel()
-				os.Exit(0)
 			}
 		}
 	}
@@ -76,6 +76,12 @@ jobs:
        with:
          name: logs
          path: "control_logs/*.log"
+
+      - uses: actions/upload-artifact@v3
+        if: always() && steps.changed-files.outputs.any_changed == 'true'
+        with:
+          name: pprof
+          path: "control_logs/*.pprof.tar"
 `),
 	)
 )
@@ -57,7 +57,7 @@ var debugCmd = &cobra.Command{

 var createNodeCmd = &cobra.Command{
 	Use:   "create-node",
-	Short: "Create a node (machine) that can be registered with `nodes register <>` command",
+	Short: "Create a node that can be registered with `nodes register <>` command",
 	Run: func(cmd *cobra.Command, args []string) {
 		output, _ := cmd.Flags().GetString("output")

@@ -83,7 +83,7 @@ var createNodeCmd = &cobra.Command{
 			return
 		}

-		machineKey, err := cmd.Flags().GetString("key")
+		nodeKey, err := cmd.Flags().GetString("key")
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -93,7 +93,7 @@ var createNodeCmd = &cobra.Command{

 			return
 		}
-		if !headscale.NodePublicKeyRegex.Match([]byte(machineKey)) {
+		if !headscale.NodePublicKeyRegex.Match([]byte(nodeKey)) {
 			err = errPreAuthKeyMalformed
 			ErrorOutput(
 				err,
@@ -115,24 +115,24 @@ var createNodeCmd = &cobra.Command{
 			return
 		}

-		request := &v1.DebugCreateMachineRequest{
-			Key:    machineKey,
+		request := &v1.DebugCreateNodeRequest{
+			Key:    nodeKey,
 			Name:   name,
 			User:   user,
 			Routes: routes,
 		}

-		response, err := client.DebugCreateMachine(ctx, request)
+		response, err := client.DebugCreateNode(ctx, request)
 		if err != nil {
 			ErrorOutput(
 				err,
-				fmt.Sprintf("Cannot create machine: %s", status.Convert(err).Message()),
+				fmt.Sprintf("Cannot create node: %s", status.Convert(err).Message()),
 				output,
 			)

 			return
 		}

-		SuccessOutput(response.Machine, "Machine created", output)
+		SuccessOutput(response.Node, "Node created", output)
 	},
 }
@@ -107,7 +107,7 @@ var nodeCmd = &cobra.Command{

 var registerNodeCmd = &cobra.Command{
 	Use:   "register",
-	Short: "Registers a machine to your network",
+	Short: "Registers a node to your network",
 	Run: func(cmd *cobra.Command, args []string) {
 		output, _ := cmd.Flags().GetString("output")
 		user, err := cmd.Flags().GetString("user")
@@ -132,12 +132,12 @@ var registerNodeCmd = &cobra.Command{
 			return
 		}

-		request := &v1.RegisterMachineRequest{
+		request := &v1.RegisterNodeRequest{
 			Key:  machineKey,
 			User: user,
 		}

-		response, err := client.RegisterMachine(ctx, request)
+		response, err := client.RegisterNode(ctx, request)
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -152,8 +152,8 @@ var registerNodeCmd = &cobra.Command{
 		}

 		SuccessOutput(
-			response.Machine,
-			fmt.Sprintf("Machine %s registered", response.Machine.GivenName), output)
+			response.Node,
+			fmt.Sprintf("Node %s registered", response.Node.GivenName), output)
 	},
 }

@@ -180,11 +180,11 @@ var listNodesCmd = &cobra.Command{
 		defer cancel()
 		defer conn.Close()

-		request := &v1.ListMachinesRequest{
+		request := &v1.ListNodesRequest{
 			User: user,
 		}

-		response, err := client.ListMachines(ctx, request)
+		response, err := client.ListNodes(ctx, request)
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -196,12 +196,12 @@ var listNodesCmd = &cobra.Command{
 		}

 		if output != "" {
-			SuccessOutput(response.Machines, "", output)
+			SuccessOutput(response.Nodes, "", output)

 			return
 		}

-		tableData, err := nodesToPtables(user, showTags, response.Machines)
+		tableData, err := nodesToPtables(user, showTags, response.Nodes)
 		if err != nil {
 			ErrorOutput(err, fmt.Sprintf("Error converting to table: %s", err), output)

@@ -244,11 +244,11 @@ var expireNodeCmd = &cobra.Command{
 		defer cancel()
 		defer conn.Close()

-		request := &v1.ExpireMachineRequest{
-			MachineId: identifier,
+		request := &v1.ExpireNodeRequest{
+			NodeId: identifier,
 		}

-		response, err := client.ExpireMachine(ctx, request)
+		response, err := client.ExpireNode(ctx, request)
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -262,7 +262,7 @@ var expireNodeCmd = &cobra.Command{
 			return
 		}

-		SuccessOutput(response.Machine, "Machine expired", output)
+		SuccessOutput(response.Node, "Node expired", output)
 	},
 }

@@ -291,12 +291,12 @@ var renameNodeCmd = &cobra.Command{
 		if len(args) > 0 {
 			newName = args[0]
 		}
-		request := &v1.RenameMachineRequest{
-			MachineId: identifier,
-			NewName:   newName,
+		request := &v1.RenameNodeRequest{
+			NodeId:  identifier,
+			NewName: newName,
 		}

-		response, err := client.RenameMachine(ctx, request)
+		response, err := client.RenameNode(ctx, request)
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -310,7 +310,7 @@ var renameNodeCmd = &cobra.Command{
 			return
 		}

-		SuccessOutput(response.Machine, "Machine renamed", output)
+		SuccessOutput(response.Node, "Node renamed", output)
 	},
 }

@@ -336,11 +336,11 @@ var deleteNodeCmd = &cobra.Command{
 		defer cancel()
 		defer conn.Close()

-		getRequest := &v1.GetMachineRequest{
-			MachineId: identifier,
+		getRequest := &v1.GetNodeRequest{
+			NodeId: identifier,
 		}

-		getResponse, err := client.GetMachine(ctx, getRequest)
+		getResponse, err := client.GetNode(ctx, getRequest)
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -354,8 +354,8 @@ var deleteNodeCmd = &cobra.Command{
 			return
 		}

-		deleteRequest := &v1.DeleteMachineRequest{
-			MachineId: identifier,
+		deleteRequest := &v1.DeleteNodeRequest{
+			NodeId: identifier,
 		}

 		confirm := false
@@ -364,7 +364,7 @@ var deleteNodeCmd = &cobra.Command{
 			prompt := &survey.Confirm{
 				Message: fmt.Sprintf(
 					"Do you want to remove the node %s?",
-					getResponse.GetMachine().Name,
+					getResponse.GetNode().Name,
 				),
 			}
 			err = survey.AskOne(prompt, &confirm)
@@ -374,7 +374,7 @@ var deleteNodeCmd = &cobra.Command{
 		}

 		if confirm || force {
-			response, err := client.DeleteMachine(ctx, deleteRequest)
+			response, err := client.DeleteNode(ctx, deleteRequest)
 			if output != "" {
 				SuccessOutput(response, "", output)

@@ -436,11 +436,11 @@ var moveNodeCmd = &cobra.Command{
 		defer cancel()
 		defer conn.Close()

-		getRequest := &v1.GetMachineRequest{
-			MachineId: identifier,
+		getRequest := &v1.GetNodeRequest{
+			NodeId: identifier,
 		}

-		_, err = client.GetMachine(ctx, getRequest)
+		_, err = client.GetNode(ctx, getRequest)
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -454,12 +454,12 @@ var moveNodeCmd = &cobra.Command{
 			return
 		}

-		moveRequest := &v1.MoveMachineRequest{
-			MachineId: identifier,
-			User:      user,
+		moveRequest := &v1.MoveNodeRequest{
+			NodeId: identifier,
+			User:   user,
 		}

-		moveResponse, err := client.MoveMachine(ctx, moveRequest)
+		moveResponse, err := client.MoveNode(ctx, moveRequest)
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -473,14 +473,14 @@ var moveNodeCmd = &cobra.Command{
 			return
 		}

-		SuccessOutput(moveResponse.Machine, "Node moved to another user", output)
+		SuccessOutput(moveResponse.Node, "Node moved to another user", output)
 	},
 }

 func nodesToPtables(
 	currentUser string,
 	showTags bool,
-	machines []*v1.Machine,
+	nodes []*v1.Node,
 ) (pterm.TableData, error) {
 	tableHeader := []string{
 		"ID",
@@ -505,23 +505,23 @@ func nodesToPtables(
 	}
 	tableData := pterm.TableData{tableHeader}

-	for _, machine := range machines {
+	for _, node := range nodes {
 		var ephemeral bool
-		if machine.PreAuthKey != nil && machine.PreAuthKey.Ephemeral {
+		if node.PreAuthKey != nil && node.PreAuthKey.Ephemeral {
 			ephemeral = true
 		}

 		var lastSeen time.Time
 		var lastSeenTime string
-		if machine.LastSeen != nil {
-			lastSeen = machine.LastSeen.AsTime()
+		if node.LastSeen != nil {
+			lastSeen = node.LastSeen.AsTime()
 			lastSeenTime = lastSeen.Format("2006-01-02 15:04:05")
 		}

 		var expiry time.Time
 		var expiryTime string
-		if machine.Expiry != nil {
-			expiry = machine.Expiry.AsTime()
+		if node.Expiry != nil {
+			expiry = node.Expiry.AsTime()
 			expiryTime = expiry.Format("2006-01-02 15:04:05")
 		} else {
 			expiryTime = "N/A"
@@ -529,7 +529,7 @@ func nodesToPtables(

 		var machineKey key.MachinePublic
 		err := machineKey.UnmarshalText(
-			[]byte(headscale.MachinePublicKeyEnsurePrefix(machine.MachineKey)),
+			[]byte(headscale.MachinePublicKeyEnsurePrefix(node.MachineKey)),
 		)
 		if err != nil {
 			machineKey = key.MachinePublic{}
@@ -537,14 +537,14 @@ func nodesToPtables(

 		var nodeKey key.NodePublic
 		err = nodeKey.UnmarshalText(
-			[]byte(headscale.NodePublicKeyEnsurePrefix(machine.NodeKey)),
+			[]byte(headscale.NodePublicKeyEnsurePrefix(node.NodeKey)),
 		)
 		if err != nil {
 			return nil, err
 		}

 		var online string
-		if machine.Online {
+		if node.Online {
 			online = pterm.LightGreen("online")
 		} else {
 			online = pterm.LightRed("offline")
@@ -558,36 +558,36 @@ func nodesToPtables(
 		}

 		var forcedTags string
-		for _, tag := range machine.ForcedTags {
+		for _, tag := range node.ForcedTags {
 			forcedTags += "," + tag
 		}
 		forcedTags = strings.TrimLeft(forcedTags, ",")
 		var invalidTags string
-		for _, tag := range machine.InvalidTags {
-			if !contains(machine.ForcedTags, tag) {
+		for _, tag := range node.InvalidTags {
+			if !contains(node.ForcedTags, tag) {
 				invalidTags += "," + pterm.LightRed(tag)
 			}
 		}
 		invalidTags = strings.TrimLeft(invalidTags, ",")
 		var validTags string
-		for _, tag := range machine.ValidTags {
-			if !contains(machine.ForcedTags, tag) {
+		for _, tag := range node.ValidTags {
+			if !contains(node.ForcedTags, tag) {
 				validTags += "," + pterm.LightGreen(tag)
 			}
 		}
 		validTags = strings.TrimLeft(validTags, ",")

 		var user string
-		if currentUser == "" || (currentUser == machine.User.Name) {
-			user = pterm.LightMagenta(machine.User.Name)
+		if currentUser == "" || (currentUser == node.User.Name) {
+			user = pterm.LightMagenta(node.User.Name)
 		} else {
 			// Shared into this user
-			user = pterm.LightYellow(machine.User.Name)
+			user = pterm.LightYellow(node.User.Name)
 		}

 		var IPV4Address string
 		var IPV6Address string
-		for _, addr := range machine.IpAddresses {
+		for _, addr := range node.IpAddresses {
 			if netip.MustParseAddr(addr).Is4() {
 				IPV4Address = addr
 			} else {
@@ -596,9 +596,9 @@ func nodesToPtables(
 		}

 		nodeData := []string{
-			strconv.FormatUint(machine.Id, headscale.Base10),
-			machine.Name,
-			machine.GetGivenName(),
+			strconv.FormatUint(node.Id, headscale.Base10),
+			node.Name,
+			node.GetGivenName(),
 			machineKey.ShortString(),
 			nodeKey.ShortString(),
 			user,
@@ -655,8 +655,8 @@ var tagCmd = &cobra.Command{

 		// Sending tags to machine
 		request := &v1.SetTagsRequest{
-			MachineId: identifier,
-			Tags:      tagsToSet,
+			NodeId: identifier,
+			Tags:   tagsToSet,
 		}
 		resp, err := client.SetTags(ctx, request)
 		if err != nil {
@@ -671,8 +671,8 @@ var tagCmd = &cobra.Command{

 		if resp != nil {
 			SuccessOutput(
-				resp.GetMachine(),
-				"Machine updated",
+				resp.GetNode(),
+				"Node updated",
 				output,
 			)
 		}
@@ -57,11 +57,11 @@ var listRoutesCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		output, _ := cmd.Flags().GetString("output")

-		machineID, err := cmd.Flags().GetUint64("identifier")
+		nodeID, err := cmd.Flags().GetUint64("identifier")
 		if err != nil {
 			ErrorOutput(
 				err,
-				fmt.Sprintf("Error getting machine id from flag: %s", err),
+				fmt.Sprintf("Error getting node id from flag: %s", err),
 				output,
 			)

@@ -74,7 +74,7 @@ var listRoutesCmd = &cobra.Command{

 		var routes []*v1.Route

-		if machineID == 0 {
+		if nodeID == 0 {
 			response, err := client.GetRoutes(ctx, &v1.GetRoutesRequest{})
 			if err != nil {
 				ErrorOutput(
@@ -94,13 +94,13 @@ var listRoutesCmd = &cobra.Command{

 			routes = response.Routes
 		} else {
-			response, err := client.GetMachineRoutes(ctx, &v1.GetMachineRoutesRequest{
-				MachineId: machineID,
+			response, err := client.GetNodeRoutes(ctx, &v1.GetNodeRoutesRequest{
+				NodeId: nodeID,
 			})
 			if err != nil {
 				ErrorOutput(
 					err,
-					fmt.Sprintf("Cannot get routes for machine %d: %s", machineID, status.Convert(err).Message()),
+					fmt.Sprintf("Cannot get routes for node %d: %s", nodeID, status.Convert(err).Message()),
 					output,
 				)

@@ -147,7 +147,7 @@ var enableRouteCmd = &cobra.Command{
 		if err != nil {
 			ErrorOutput(
 				err,
-				fmt.Sprintf("Error getting machine id from flag: %s", err),
+				fmt.Sprintf("Error getting node id from flag: %s", err),
 				output,
 			)

@@ -190,7 +190,7 @@ var disableRouteCmd = &cobra.Command{
 		if err != nil {
 			ErrorOutput(
 				err,
-				fmt.Sprintf("Error getting machine id from flag: %s", err),
+				fmt.Sprintf("Error getting node id from flag: %s", err),
 				output,
 			)

@@ -233,7 +233,7 @@ var deleteRouteCmd = &cobra.Command{
 		if err != nil {
 			ErrorOutput(
 				err,
-				fmt.Sprintf("Error getting machine id from flag: %s", err),
+				fmt.Sprintf("Error getting node id from flag: %s", err),
 				output,
 			)

@@ -267,7 +267,7 @@ var deleteRouteCmd = &cobra.Command{

 // routesToPtables converts the list of routes to a nice table.
 func routesToPtables(routes []*v1.Route) pterm.TableData {
-	tableData := pterm.TableData{{"ID", "Machine", "Prefix", "Advertised", "Enabled", "Primary"}}
+	tableData := pterm.TableData{{"ID", "Node", "Prefix", "Advertised", "Enabled", "Primary"}}

 	for _, route := range routes {
 		var isPrimaryStr string
@@ -286,7 +286,7 @@ func routesToPtables(routes []*v1.Route) pterm.TableData {
 		tableData = append(tableData,
 			[]string{
 				strconv.FormatUint(route.Id, Base10),
-				route.Machine.GivenName,
+				route.Node.GivenName,
 				route.Prefix,
 				strconv.FormatBool(route.Advertised),
 				strconv.FormatBool(route.Enabled),
@@ -6,11 +6,25 @@ import (

 	"github.com/efekarakus/termcolor"
 	"github.com/juanfont/headscale/cmd/headscale/cli"
+	"github.com/pkg/profile"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 )

 func main() {
+	if _, enableProfile := os.LookupEnv("HEADSCALE_PROFILING_ENABLED"); enableProfile {
+		if profilePath, ok := os.LookupEnv("HEADSCALE_PROFILING_PATH"); ok {
+			err := os.MkdirAll(profilePath, os.ModePerm)
+			if err != nil {
+				log.Fatal().Err(err).Msg("failed to create profiling directory")
+			}
+
+			defer profile.Start(profile.ProfilePath(profilePath)).Stop()
+		} else {
+			defer profile.Start().Stop()
+		}
+	}
+
 	var colors bool
 	switch l := termcolor.SupportLevel(os.Stderr); l {
 	case termcolor.Level16M:
@@ -43,49 +43,53 @@ func (h *Headscale) initDB() error {

 	_ = db.Migrator().RenameTable("namespaces", "users")

+	// the big rename from Machine to Node
+	_ = db.Migrator().RenameTable("machines", "nodes")
+	_ = db.Migrator().RenameColumn(&Route{}, "machine_id", "node_id")
+
 	err = db.AutoMigrate(&User{})
 	if err != nil {
 		return err
 	}

-	_ = db.Migrator().RenameColumn(&Machine{}, "namespace_id", "user_id")
+	_ = db.Migrator().RenameColumn(&Node{}, "namespace_id", "user_id")
 	_ = db.Migrator().RenameColumn(&PreAuthKey{}, "namespace_id", "user_id")

-	_ = db.Migrator().RenameColumn(&Machine{}, "ip_address", "ip_addresses")
-	_ = db.Migrator().RenameColumn(&Machine{}, "name", "hostname")
+	_ = db.Migrator().RenameColumn(&Node{}, "ip_address", "ip_addresses")
+	_ = db.Migrator().RenameColumn(&Node{}, "name", "hostname")

 	// GivenName is used as the primary source of DNS names, make sure
 	// the field is populated and normalized if it was not when the
-	// machine was registered.
-	_ = db.Migrator().RenameColumn(&Machine{}, "nickname", "given_name")
+	// node was registered.
+	_ = db.Migrator().RenameColumn(&Node{}, "nickname", "given_name")

-	// If the Machine table has a column for registered,
+	// If the Node table has a column for registered,
 	// find all occourences of "false" and drop them. Then
 	// remove the column.
-	if db.Migrator().HasColumn(&Machine{}, "registered") {
+	if db.Migrator().HasColumn(&Node{}, "registered") {
 		log.Info().
-			Msg(`Database has legacy "registered" column in machine, removing...`)
+			Msg(`Database has legacy "registered" column in node, removing...`)

-		machines := Machines{}
-		if err := h.db.Not("registered").Find(&machines).Error; err != nil {
+		nodes := Nodes{}
+		if err := h.db.Not("registered").Find(&nodes).Error; err != nil {
 			log.Error().Err(err).Msg("Error accessing db")
 		}

-		for _, machine := range machines {
+		for _, node := range nodes {
 			log.Info().
-				Str("machine", machine.Hostname).
-				Str("machine_key", machine.MachineKey).
-				Msg("Deleting unregistered machine")
-			if err := h.db.Delete(&Machine{}, machine.ID).Error; err != nil {
+				Str("node", node.Hostname).
+				Str("machine_key", node.MachineKey).
+				Msg("Deleting unregistered node")
+			if err := h.db.Delete(&Node{}, node.ID).Error; err != nil {
 				log.Error().
 					Err(err).
-					Str("machine", machine.Hostname).
-					Str("machine_key", machine.MachineKey).
-					Msg("Error deleting unregistered machine")
+					Str("node", node.Hostname).
+					Str("machine_key", node.MachineKey).
+					Msg("Error deleting unregistered node")
 			}
 		}

-		err := db.Migrator().DropColumn(&Machine{}, "registered")
+		err := db.Migrator().DropColumn(&Node{}, "registered")
 		if err != nil {
 			log.Error().Err(err).Msg("Error dropping registered column")
 		}
@@ -96,21 +100,21 @@ func (h *Headscale) initDB() error {
 		return err
 	}

-	if db.Migrator().HasColumn(&Machine{}, "enabled_routes") {
-		log.Info().Msgf("Database has legacy enabled_routes column in machine, migrating...")
+	if db.Migrator().HasColumn(&Node{}, "enabled_routes") {
+		log.Info().Msgf("Database has legacy enabled_routes column in node, migrating...")

-		type MachineAux struct {
+		type NodeAux struct {
 			ID            uint64
 			EnabledRoutes IPPrefixes
 		}

-		machinesAux := []MachineAux{}
-		err := db.Table("machines").Select("id, enabled_routes").Scan(&machinesAux).Error
+		nodesAux := []NodeAux{}
+		err := db.Table("nodes").Select("id, enabled_routes").Scan(&nodesAux).Error
 		if err != nil {
 			log.Fatal().Err(err).Msg("Error accessing db")
 		}
-		for _, machine := range machinesAux {
-			for _, prefix := range machine.EnabledRoutes {
+		for _, node := range nodesAux {
+			for _, prefix := range node.EnabledRoutes {
 				if err != nil {
 					log.Error().
 						Err(err).
@@ -120,8 +124,8 @@ func (h *Headscale) initDB() error {
 					continue
 				}

-				err = db.Preload("Machine").
-					Where("machine_id = ? AND prefix = ?", machine.ID, IPPrefix(prefix)).
+				err = db.Preload("Node").
+					Where("node_id = ? AND prefix = ?", node.ID, IPPrefix(prefix)).
 					First(&Route{}).
 					Error
 				if err == nil {
@@ -133,7 +137,7 @@ func (h *Headscale) initDB() error {
 				}

 				route := Route{
-					MachineID:  machine.ID,
+					NodeID:     node.ID,
 					Advertised: true,
 					Enabled:    true,
 					Prefix:     IPPrefix(prefix),
@@ -142,51 +146,51 @@ func (h *Headscale) initDB() error {
 					log.Error().Err(err).Msg("Error creating route")
 				} else {
 					log.Info().
-						Uint64("machine_id", route.MachineID).
+						Uint64("node_id", route.NodeID).
 						Str("prefix", prefix.String()).
 						Msg("Route migrated")
 				}
 			}
 		}

-		err = db.Migrator().DropColumn(&Machine{}, "enabled_routes")
+		err = db.Migrator().DropColumn(&Node{}, "enabled_routes")
 		if err != nil {
 			log.Error().Err(err).Msg("Error dropping enabled_routes column")
 		}
 	}

-	err = db.AutoMigrate(&Machine{})
+	err = db.AutoMigrate(&Node{})
 	if err != nil {
 		return err
 	}

-	if db.Migrator().HasColumn(&Machine{}, "given_name") {
-		machines := Machines{}
-		if err := h.db.Find(&machines).Error; err != nil {
+	if db.Migrator().HasColumn(&Node{}, "given_name") {
+		nodes := Nodes{}
+		if err := h.db.Find(&nodes).Error; err != nil {
 			log.Error().Err(err).Msg("Error accessing db")
 		}

-		for item, machine := range machines {
-			if machine.GivenName == "" {
+		for item, node := range nodes {
+			if node.GivenName == "" {
 				normalizedHostname, err := NormalizeToFQDNRules(
-					machine.Hostname,
+					node.Hostname,
 					h.cfg.OIDC.StripEmaildomain,
 				)
 				if err != nil {
 					log.Error().
 						Caller().
-						Str("hostname", machine.Hostname).
+						Str("hostname", node.Hostname).
 						Err(err).
-						Msg("Failed to normalize machine hostname in DB migration")
+						Msg("Failed to normalize node hostname in DB migration")
 				}

-				err = h.RenameMachine(&machines[item], normalizedHostname)
+				err = h.RenameNode(&nodes[item], normalizedHostname)
 				if err != nil {
 					log.Error().
 						Caller().
-						Str("hostname", machine.Hostname).
+						Str("hostname", node.Hostname).
 						Err(err).
-						Msg("Failed to save normalized machine name in DB migration")
+						Msg("Failed to save normalized node name in DB migration")
 				}
 			}
 		}
@@ -324,7 +328,7 @@ func (hi *HostInfo) Scan(destination interface{}) error {
 		return json.Unmarshal([]byte(value), hi)

 	default:
-		return fmt.Errorf("%w: unexpected data type %T", ErrMachineAddressesInvalid, destination)
+		return fmt.Errorf("%w: unexpected data type %T", ErrNodeAddressesInvalid, destination)
 	}
 }

@@ -370,7 +374,7 @@ func (i *IPPrefixes) Scan(destination interface{}) error {
 		return json.Unmarshal([]byte(value), i)

 	default:
-		return fmt.Errorf("%w: unexpected data type %T", ErrMachineAddressesInvalid, destination)
+		return fmt.Errorf("%w: unexpected data type %T", ErrNodeAddressesInvalid, destination)
 	}
 }

@@ -392,7 +396,7 @@ func (i *StringList) Scan(destination interface{}) error {
 		return json.Unmarshal([]byte(value), i)

 	default:
-		return fmt.Errorf("%w: unexpected data type %T", ErrMachineAddressesInvalid, destination)
+		return fmt.Errorf("%w: unexpected data type %T", ErrNodeAddressesInvalid, destination)
 	}
 }

@@ -159,22 +159,22 @@ func generateIPv6DNSRootDomain(ipPrefix netip.Prefix) []dnsname.FQDN {
 }

 // If any nextdns DoH resolvers are present in the list of resolvers it will
-// take metadata from the machine metadata and instruct tailscale to add it
+// take metadata from the node metadata and instruct tailscale to add it
 // to the requests. This makes it possible to identify from which device the
 // requests come in the NextDNS dashboard.
 //
 // This will produce a resolver like:
 // `https://dns.nextdns.io/<nextdns-id>?device_name=node-name&device_model=linux&device_ip=100.64.0.1`
-func addNextDNSMetadata(resolvers []*dnstype.Resolver, machine Machine) {
+func addNextDNSMetadata(resolvers []*dnstype.Resolver, node Node) {
 	for _, resolver := range resolvers {
 		if strings.HasPrefix(resolver.Addr, nextDNSDoHPrefix) {
 			attrs := url.Values{
-				"device_name":  []string{machine.Hostname},
-				"device_model": []string{machine.HostInfo.OS},
+				"device_name":  []string{node.Hostname},
+				"device_model": []string{node.HostInfo.OS},
 			}

-			if len(machine.IPAddresses) > 0 {
-				attrs.Add("device_ip", machine.IPAddresses[0].String())
+			if len(node.IPAddresses) > 0 {
+				attrs.Add("device_ip", node.IPAddresses[0].String())
 			}

 			resolver.Addr = fmt.Sprintf("%s?%s", resolver.Addr, attrs.Encode())
@@ -185,8 +185,8 @@ func addNextDNSMetadata(resolvers []*dnstype.Resolver, machine Machine) {
 func getMapResponseDNSConfig(
 	dnsConfigOrig *tailcfg.DNSConfig,
 	baseDomain string,
-	machine Machine,
-	peers Machines,
+	node Node,
+	peers Nodes,
 ) *tailcfg.DNSConfig {
 	var dnsConfig *tailcfg.DNSConfig = dnsConfigOrig.Clone()
 	if dnsConfigOrig != nil && dnsConfigOrig.Proxied { // if MagicDNS is enabled
@@ -195,13 +195,13 @@ func getMapResponseDNSConfig(
 			dnsConfig.Domains,
 			fmt.Sprintf(
 				"%s.%s",
-				machine.User.Name,
+				node.User.Name,
 				baseDomain,
 			),
 		)

 		userSet := mapset.NewSet[User]()
-		userSet.Add(machine.User)
+		userSet.Add(node.User)
 		for _, p := range peers {
 			userSet.Add(p.User)
 		}
@@ -213,7 +213,7 @@ func getMapResponseDNSConfig(
 		dnsConfig = dnsConfigOrig
 	}

-	addNextDNSMetadata(dnsConfig.Resolvers, machine)
+	addNextDNSMetadata(dnsConfig.Resolvers, node)

 	return dnsConfig
 }
@@ -157,10 +157,10 @@ func (s *Suite) TestDNSConfigMapResponseWithMagicDNS(c *check.C) {
 	)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine(userShared1.Name, "test_get_shared_nodes_1")
+	_, err = app.GetNode(userShared1.Name, "test_get_shared_nodes_1")
 	c.Assert(err, check.NotNil)

-	machineInShared1 := &Machine{
+	nodesInShared1 := &Node{
 		ID:             1,
 		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
 		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
@@ -172,12 +172,12 @@ func (s *Suite) TestDNSConfigMapResponseWithMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.1")},
 		AuthKeyID:      uint(preAuthKeyInShared1.ID),
 	}
-	app.db.Save(machineInShared1)
+	app.db.Save(nodesInShared1)

-	_, err = app.GetMachine(userShared1.Name, machineInShared1.Hostname)
+	_, err = app.GetNode(userShared1.Name, nodesInShared1.Hostname)
 	c.Assert(err, check.IsNil)

-	machineInShared2 := &Machine{
+	nodesInShared2 := &Node{
 		ID:             2,
 		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
 		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
@@ -189,12 +189,12 @@ func (s *Suite) TestDNSConfigMapResponseWithMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.2")},
 		AuthKeyID:      uint(preAuthKeyInShared2.ID),
 	}
-	app.db.Save(machineInShared2)
+	app.db.Save(nodesInShared2)

-	_, err = app.GetMachine(userShared2.Name, machineInShared2.Hostname)
+	_, err = app.GetNode(userShared2.Name, nodesInShared2.Hostname)
 	c.Assert(err, check.IsNil)

-	machineInShared3 := &Machine{
+	nodesInShared3 := &Node{
 		ID:             3,
 		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
 		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
@@ -206,12 +206,12 @@ func (s *Suite) TestDNSConfigMapResponseWithMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.3")},
 		AuthKeyID:      uint(preAuthKeyInShared3.ID),
 	}
-	app.db.Save(machineInShared3)
+	app.db.Save(nodesInShared3)

-	_, err = app.GetMachine(userShared3.Name, machineInShared3.Hostname)
+	_, err = app.GetNode(userShared3.Name, nodesInShared3.Hostname)
 	c.Assert(err, check.IsNil)

-	machine2InShared1 := &Machine{
+	nodes2InShared1 := &Node{
 		ID:             4,
 		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
 		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
@@ -223,7 +223,7 @@ func (s *Suite) TestDNSConfigMapResponseWithMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.4")},
 		AuthKeyID:      uint(PreAuthKey2InShared1.ID),
 	}
-	app.db.Save(machine2InShared1)
+	app.db.Save(nodes2InShared1)

 	baseDomain := "foobar.headscale.net"
 	dnsConfigOrig := tailcfg.DNSConfig{
@@ -232,14 +232,14 @@ func (s *Suite) TestDNSConfigMapResponseWithMagicDNS(c *check.C) {
 		Proxied: true,
 	}

-	peersOfMachineInShared1, err := app.getPeers(machineInShared1)
+	peersOfNodeInShared1, err := app.getPeers(nodesInShared1)
 	c.Assert(err, check.IsNil)

 	dnsConfig := getMapResponseDNSConfig(
 		&dnsConfigOrig,
 		baseDomain,
-		*machineInShared1,
-		peersOfMachineInShared1,
+		*nodesInShared1,
+		peersOfNodeInShared1,
 	)
 	c.Assert(dnsConfig, check.NotNil)

@@ -304,10 +304,10 @@ func (s *Suite) TestDNSConfigMapResponseWithoutMagicDNS(c *check.C) {
 	)
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine(userShared1.Name, "test_get_shared_nodes_1")
+	_, err = app.GetNode(userShared1.Name, "test_get_shared_nodes_1")
 	c.Assert(err, check.NotNil)

-	machineInShared1 := &Machine{
+	nodesInShared1 := &Node{
 		ID:             1,
 		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
 		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
@@ -319,12 +319,12 @@ func (s *Suite) TestDNSConfigMapResponseWithoutMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.1")},
 		AuthKeyID:      uint(preAuthKeyInShared1.ID),
 	}
-	app.db.Save(machineInShared1)
+	app.db.Save(nodesInShared1)

-	_, err = app.GetMachine(userShared1.Name, machineInShared1.Hostname)
+	_, err = app.GetNode(userShared1.Name, nodesInShared1.Hostname)
 	c.Assert(err, check.IsNil)

-	machineInShared2 := &Machine{
+	nodesInShared2 := &Node{
 		ID:             2,
 		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
 		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
@@ -336,12 +336,12 @@ func (s *Suite) TestDNSConfigMapResponseWithoutMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.2")},
 		AuthKeyID:      uint(preAuthKeyInShared2.ID),
 	}
-	app.db.Save(machineInShared2)
+	app.db.Save(nodesInShared2)

-	_, err = app.GetMachine(userShared2.Name, machineInShared2.Hostname)
+	_, err = app.GetNode(userShared2.Name, nodesInShared2.Hostname)
 	c.Assert(err, check.IsNil)

-	machineInShared3 := &Machine{
+	nodesInShared3 := &Node{
 		ID:             3,
 		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
 		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
@@ -353,12 +353,12 @@ func (s *Suite) TestDNSConfigMapResponseWithoutMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.3")},
 		AuthKeyID:      uint(preAuthKeyInShared3.ID),
 	}
-	app.db.Save(machineInShared3)
+	app.db.Save(nodesInShared3)

-	_, err = app.GetMachine(userShared3.Name, machineInShared3.Hostname)
+	_, err = app.GetNode(userShared3.Name, nodesInShared3.Hostname)
 	c.Assert(err, check.IsNil)

-	machine2InShared1 := &Machine{
+	nodes2InShared1 := &Node{
 		ID:             4,
 		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
 		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
@@ -370,7 +370,7 @@ func (s *Suite) TestDNSConfigMapResponseWithoutMagicDNS(c *check.C) {
 		IPAddresses:    []netip.Addr{netip.MustParseAddr("100.64.0.4")},
 		AuthKeyID:      uint(preAuthKey2InShared1.ID),
 	}
-	app.db.Save(machine2InShared1)
+	app.db.Save(nodes2InShared1)

 	baseDomain := "foobar.headscale.net"
 	dnsConfigOrig := tailcfg.DNSConfig{
@@ -379,14 +379,14 @@ func (s *Suite) TestDNSConfigMapResponseWithoutMagicDNS(c *check.C) {
 		Proxied: false,
 	}

-	peersOfMachine1Shared1, err := app.getPeers(machineInShared1)
+	peersOfNode1Shared1, err := app.getPeers(nodesInShared1)
 	c.Assert(err, check.IsNil)

 	dnsConfig := getMapResponseDNSConfig(
 		&dnsConfigOrig,
 		baseDomain,
-		*machineInShared1,
-		peersOfMachine1Shared1,
+		*nodesInShared1,
+		peersOfNode1Shared1,
 	)
 	c.Assert(dnsConfig, check.NotNil)
 	c.Assert(len(dnsConfig.Routes), check.Equals, 0)
@@ -16,7 +16,7 @@ WorkingDirectory=/var/lib/headscale
 ReadWritePaths=/var/lib/headscale /var/run

 AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
-CapabilityBoundingSet=CAP_CHOWN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
 LockPersonality=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -64,6 +64,7 @@ summary() {
 	echo ""
 	echo " Please follow the next steps to start the software:"
 	echo ""
+	echo "    sudo systemctl enable headscale"
 	echo "    sudo systemctl start headscale"
 	echo ""
 	echo " Configuration settings can be adjusted here:"
@@ -0,0 +1,198 @@
+# Running headscale on Linux
+
+## Note: Outdated and "advanced"
+
+This documentation is considered the "legacy"/advanced/manual version of the documentation, you most likely do not
+want to use this documentation and rather look at the distro specific documentation (TODO LINK)[].
+
+## Goal
+
+This documentation has the goal of showing a user how-to set up and run `headscale` on Linux.
+In additional to the "get up and running section", there is an optional [SystemD section](#running-headscale-in-the-background-with-systemd)
+describing how to make `headscale` run properly in a server environment.
+
+## Configure and run `headscale`
+
+1. Download the latest [`headscale` binary from GitHub's release page](https://github.com/juanfont/headscale/releases):
+
+```shell
+wget --output-document=/usr/local/bin/headscale \
+   https://github.com/juanfont/headscale/releases/download/v<HEADSCALE VERSION>/headscale_<HEADSCALE VERSION>_linux_<ARCH>
+```
+
+2. Make `headscale` executable:
+
+```shell
+chmod +x /usr/local/bin/headscale
+```
+
+3. Prepare a directory to hold `headscale` configuration and the [SQLite](https://www.sqlite.org/) database:
+
+```shell
+# Directory for configuration
+
+mkdir -p /etc/headscale
+
+# Directory for Database, and other variable data (like certificates)
+mkdir -p /var/lib/headscale
+# or if you create a headscale user:
+useradd \
+	--create-home \
+	--home-dir /var/lib/headscale/ \
+	--system \
+	--user-group \
+	--shell /usr/bin/nologin \
+	headscale
+```
+
+4. Create an empty SQLite database:
+
+```shell
+touch /var/lib/headscale/db.sqlite
+```
+
+5. Create a `headscale` configuration:
+
+```shell
+touch /etc/headscale/config.yaml
+```
+
+**(Strongly Recommended)** Download a copy of the [example configuration][config-example.yaml](https://github.com/juanfont/headscale/blob/main/config-example.yaml) from the headscale repository.
+
+6. Start the headscale server:
+
+```shell
+headscale serve
+```
+
+This command will start `headscale` in the current terminal session.
+
+---
+
+To continue the tutorial, open a new terminal and let it run in the background.
+Alternatively use terminal emulators like [tmux](https://github.com/tmux/tmux) or [screen](https://www.gnu.org/software/screen/).
+
+To run `headscale` in the background, please follow the steps in the [SystemD section](#running-headscale-in-the-background-with-systemd) before continuing.
+
+7. Verify `headscale` is running:
+
+Verify `headscale` is available:
+
+```shell
+curl http://127.0.0.1:9090/metrics
+```
+
+8. Create a user ([tailnet](https://tailscale.com/kb/1136/tailnet/)):
+
+```shell
+headscale users create myfirstuser
+```
+
+### Register a machine (normal login)
+
+On a client machine, execute the `tailscale` login command:
+
+```shell
+tailscale up --login-server YOUR_HEADSCALE_URL
+```
+
+Register the machine:
+
+```shell
+headscale --user myfirstuser nodes register --key <YOUR_MACHINE_KEY>
+```
+
+### Register machine using a pre authenticated key
+
+Generate a key using the command line:
+
+```shell
+headscale --user myfirstuser preauthkeys create --reusable --expiration 24h
+```
+
+This will return a pre-authenticated key that can be used to connect a node to `headscale` during the `tailscale` command:
+
+```shell
+tailscale up --login-server <YOUR_HEADSCALE_URL> --authkey <YOUR_AUTH_KEY>
+```
+
+## Running `headscale` in the background with SystemD
+
+:warning: **Deprecated**: This part is very outdated and you should use the [pre-packaged Headscale for this](./running-headscale-linux.md
+
+This section demonstrates how to run `headscale` as a service in the background with [SystemD](https://www.freedesktop.org/wiki/Software/systemd/).
+This should work on most modern Linux distributions.
+
+1. Create a SystemD service configuration at `/etc/systemd/system/headscale.service` containing:
+
+```systemd
+[Unit]
+Description=headscale controller
+After=syslog.target
+After=network.target
+
+[Service]
+Type=simple
+User=headscale
+Group=headscale
+ExecStart=/usr/local/bin/headscale serve
+Restart=always
+RestartSec=5
+
+# Optional security enhancements
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+WorkingDirectory=/var/lib/headscale
+ReadWritePaths=/var/lib/headscale /var/run/headscale
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+RuntimeDirectory=headscale
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Note that when running as the headscale user ensure that, either you add your current user to the headscale group:
+
+```shell
+usermod -a -G headscale current_user
+```
+
+or run all headscale commands as the headscale user:
+
+```shell
+su - headscale
+```
+
+2. In `/etc/headscale/config.yaml`, override the default `headscale` unix socket with path that is writable by the `headscale` user or group:
+
+```yaml
+unix_socket: /var/run/headscale/headscale.sock
+```
+
+3. Reload SystemD to load the new configuration file:
+
+```shell
+systemctl daemon-reload
+```
+
+4. Enable and start the new `headscale` service:
+
+```shell
+systemctl enable --now headscale
+```
+
+5. Verify the headscale service:
+
+```shell
+systemctl status headscale
+```
+
+Verify `headscale` is available:
+
+```shell
+curl http://127.0.0.1:9090/metrics
+```
+
+`headscale` will now run in the background and start at boot.
@@ -1,83 +1,65 @@
 # Running headscale on Linux

+## Requirements
+
+- Ubuntu 20.04 or newer, Debian 11 or newer.
+
 ## Goal

-This documentation has the goal of showing a user how-to set up and run `headscale` on Linux.
-In additional to the "get up and running section", there is an optional [SystemD section](#running-headscale-in-the-background-with-systemd)
-describing how to make `headscale` run properly in a server environment.
+Get Headscale up and running.

-## Configure and run `headscale`
+This includes running Headscale with SystemD.

-1. Download the latest [`headscale` binary from GitHub's release page](https://github.com/juanfont/headscale/releases):
+## Migrating from manual install
+
+If you are migrating from the old manual install, the best thing would be to remove
+the files installed by following [the guide in reverse](./running-headscale-linux-manual.md).
+
+You should _not_ delete the database (`/var/headscale/db.sqlite`) and the
+configuration (`/etc/headscale/config.yaml`).
+
+## Installation
+
+1. Download the lastest Headscale package for your platform (`.deb` for Ubuntu and Debian) from [Headscale's releases page]():

 ```shell
-wget --output-document=/usr/local/bin/headscale \
-   https://github.com/juanfont/headscale/releases/download/v<HEADSCALE VERSION>/headscale_<HEADSCALE VERSION>_linux_<ARCH>
+wget --output-document=headscale.deb \
+  https://github.com/juanfont/headscale/releases/download/v<HEADSCALE VERSION>/headscale_<HEADSCALE VERSION>_linux_<ARCH>.deb
 ```

-2. Make `headscale` executable:
+2. Install Headscale:

 ```shell
-chmod +x /usr/local/bin/headscale
+sudo dpkg --install headscale.deb
 ```

-3. Prepare a directory to hold `headscale` configuration and the [SQLite](https://www.sqlite.org/) database:
+3. Enable Headscale service, this will start Headscale at boot:

 ```shell
-# Directory for configuration
-
-mkdir -p /etc/headscale
-
-# Directory for Database, and other variable data (like certificates)
-mkdir -p /var/lib/headscale
-# or if you create a headscale user:
-useradd \
-	--create-home \
-	--home-dir /var/lib/headscale/ \
-	--system \
-	--user-group \
-	--shell /usr/bin/nologin \
-	headscale
+sudo systemctl enable headscale
 ```

-4. Create an empty SQLite database:
+4. Configure Headscale by editing the configuration file:

 ```shell
-touch /var/lib/headscale/db.sqlite
+nano /etc/headscale/config.yaml
 ```

-5. Create a `headscale` configuration:
+5. Start Headscale:

 ```shell
-touch /etc/headscale/config.yaml
+sudo systemctl start headscale
 ```

-**(Strongly Recommended)** Download a copy of the [example configuration][config-example.yaml](https://github.com/juanfont/headscale/blob/main/config-example.yaml) from the headscale repository.
-
-6. Start the headscale server:
+6. Check that Headscale is running as intended:

 ```shell
-headscale serve
+systemctl status headscale
 ```

-This command will start `headscale` in the current terminal session.
+## Using Headscale

---
-
-To continue the tutorial, open a new terminal and let it run in the background.
-Alternatively use terminal emulators like [tmux](https://github.com/tmux/tmux) or [screen](https://www.gnu.org/software/screen/).
-
-To run `headscale` in the background, please follow the steps in the [SystemD section](#running-headscale-in-the-background-with-systemd) before continuing.
-
-7. Verify `headscale` is running:
-
-Verify `headscale` is available:
-
-```shell
-curl http://127.0.0.1:9090/metrics
-```
-
-8. Create a user ([tailnet](https://tailscale.com/kb/1136/tailnet/)):
+### Create a user

 ```shell
 headscale users create myfirstuser
@@ -85,16 +67,16 @@ headscale users create myfirstuser

 ### Register a machine (normal login)

-On a client machine, execute the `tailscale` login command:
+On a client machine, run the `tailscale` login command:

 ```shell
-tailscale up --login-server YOUR_HEADSCALE_URL
+tailscale up --login-server <YOUR_HEADSCALE_URL>
 ```

 Register the machine:

 ```shell
-headscale --user myfirstuser nodes register --key <YOU_+MACHINE_KEY>
+headscale --user myfirstuser nodes register --key <YOUR_MACHINE_KEY>
 ```

 ### Register machine using a pre authenticated key
@@ -105,87 +87,9 @@ Generate a key using the command line:
 headscale --user myfirstuser preauthkeys create --reusable --expiration 24h
 ```

-This will return a pre-authenticated key that can be used to connect a node to `headscale` during the `tailscale` command:
+This will return a pre-authenticated key that is used to
+connect a node to `headscale` during the `tailscale` command:

 ```shell
 tailscale up --login-server <YOUR_HEADSCALE_URL> --authkey <YOUR_AUTH_KEY>
 ```
-
-## Running `headscale` in the background with SystemD
-
-This section demonstrates how to run `headscale` as a service in the background with [SystemD](https://www.freedesktop.org/wiki/Software/systemd/).
-This should work on most modern Linux distributions.
-
-1. Create a SystemD service configuration at `/etc/systemd/system/headscale.service` containing:
-
-```systemd
-[Unit]
-Description=headscale controller
-After=syslog.target
-After=network.target
-
-[Service]
-Type=simple
-User=headscale
-Group=headscale
-ExecStart=/usr/local/bin/headscale serve
-Restart=always
-RestartSec=5
-
-# Optional security enhancements
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=strict
-ProtectHome=yes
-WorkingDirectory=/var/lib/headscale
-ReadWritePaths=/var/lib/headscale /var/run/headscale
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-RuntimeDirectory=headscale
-
-[Install]
-WantedBy=multi-user.target
-```
-
-Note that when running as the headscale user ensure that, either you add your current user to the headscale group:
-
-```shell
-usermod -a -G headscale current_user
-```
-
-or run all headscale commands as the headscale user:
-
-```shell
-su - headscale
-```
-
-2. In `/etc/headscale/config.yaml`, override the default `headscale` unix socket with path that is writable by the `headscale` user or group:
-
-```yaml
-unix_socket: /var/run/headscale/headscale.sock
-```
-
-3. Reload SystemD to load the new configuration file:
-
-```shell
-systemctl daemon-reload
-```
-
-4. Enable and start the new `headscale` service:
-
-```shell
-systemctl enable --now headscale
-```
-
-5. Verify the headscale service:
-
-```shell
-systemctl status headscale
-```
-
-Verify `headscale` is available:
-
-```shell
-curl http://127.0.0.1:9090/metrics
-```
-
-`headscale` will now run in the background and start at boot.
@@ -1,12 +1,15 @@
 {
  "nodes": {
    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
      "locked": {
-        "lastModified": 1680776469,
-        "narHash": "sha256-3CXUDK/3q/kieWtdsYpDOBJw3Gw4Af6x+2EiSnIkNQw=",
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "411e8764155aa9354dbcd6d5faaeb97e9e3dce24",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
        "type": "github"
      },
      "original": {
@@ -17,11 +20,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1680789907,
-        "narHash": "sha256-0AOMkabjbOauxspnqfzqgLKhB2gSh3sLkz1p/jIckcs=",
+        "lastModified": 1681753173,
+        "narHash": "sha256-MrGmzZWLUqh2VstoikKLFFIELXm/lsf/G9U9zR96VD4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9de84cd029054adc54fdc6442e121fbc5ac33baf",
+        "rev": "0a4206a51b386e5cda731e8ac78d76ad924c7125",
        "type": "github"
      },
      "original": {
@@ -36,6 +39,21 @@
        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs"
      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -36,7 +36,7 @@

            # When updating go.mod or go.sum, a new sha will need to be calculated,
            # update this if you have a mismatch after doing a change to thos files.
-            vendorSha256 = "sha256-+JxS4Q6rTpdBwms2nkVDY/Kluv2qu2T0BaOIjfeX85M=";
+            vendorSha256 = "sha256-5a3SR77vYp8AsVFyFhBQtHn1I2kdlph+RuAkuT6hPIs=";

            ldflags = [ "-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}" ];
          };
@@ -100,6 +100,10 @@
            nfpm
            gotestsum

+            # 'dot' is needed for pprof graphs
+            # go tool pprof -http=: <source>
+            graphviz
+
            # Protobuf dependencies
            protobuf
            protoc-gen-go
@@ -129,6 +133,14 @@

          shellHook = ''
            export GOFLAGS=-tags="ts2019"
+            export PATH="$PWD/result/bin:$PATH"
+
+            mkdir -p ./ignored
+            export HEADSCALE_PRIVATE_KEY_PATH="./ignored/private.key"
+            export HEADSCALE_NOISE_PRIVATE_KEY_PATH="./ignored/noise_private.key"
+            export HEADSCALE_DB_PATH="./ignored/db.sqlite"
+            export HEADSCALE_TLS_LETSENCRYPT_CACHE_DIR="./ignored/cache"
+            export HEADSCALE_UNIX_SOCKET="./ignored/headscale.sock"
          '';
        };

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
+// 	protoc-gen-go v1.29.1
 // 	protoc        (unknown)
 // source: headscale/v1/apikey.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
+// 	protoc-gen-go v1.29.1
 // 	protoc        (unknown)
 // source: headscale/v1/device.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
+// 	protoc-gen-go v1.29.1
 // 	protoc        (unknown)
 // source: headscale/v1/headscale.proto

@@ -31,261 +31,252 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x1a, 0x1d, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76,
 	0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x1a, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31,
-	0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19,
-	0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x68, 0x65, 0x61, 0x64, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x32, 0x8d, 0x18, 0x0a, 0x10, 0x48, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x63, 0x0a, 0x07, 0x47, 0x65, 0x74,
-	0x55, 0x73, 0x65, 0x72, 0x12, 0x1c, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x12, 0x13, 0x2f, 0x61, 0x70, 0x69, 0x2f,
-	0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x7b, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x12, 0x68,
-	0x0a, 0x0a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x68,
-	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e,
-	0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x17, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x11, 0x3a, 0x01, 0x2a, 0x22, 0x0c, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x12, 0x82, 0x01, 0x0a, 0x0a, 0x52, 0x65, 0x6e,
-	0x61, 0x6d, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x55, 0x73, 0x65,
-	0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x55, 0x73,
-	0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x31, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x2b, 0x22, 0x29, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72,
-	0x2f, 0x7b, 0x6f, 0x6c, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x2f, 0x72, 0x65, 0x6e, 0x61,
-	0x6d, 0x65, 0x2f, 0x7b, 0x6e, 0x65, 0x77, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x12, 0x6c, 0x0a,
-	0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68,
-	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1b,
-	0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x2a, 0x13, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
-	0x75, 0x73, 0x65, 0x72, 0x2f, 0x7b, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x12, 0x62, 0x0a, 0x09, 0x4c,
-	0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x1e, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72,
-	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
-	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x14, 0x82, 0xd3, 0xe4, 0x93, 0x02,
-	0x0e, 0x12, 0x0c, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x12,
-	0x80, 0x01, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74,
+	0x74, 0x6f, 0x1a, 0x17, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31,
+	0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x68, 0x65, 0x61,
+	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x32, 0x85, 0x17, 0x0a, 0x10, 0x48, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x63, 0x0a, 0x07, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65,
+	0x72, 0x12, 0x1c, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1d, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1b,
+	0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x12, 0x13, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
+	0x75, 0x73, 0x65, 0x72, 0x2f, 0x7b, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x12, 0x68, 0x0a, 0x0a, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65, 0x61,
+	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x17, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x11, 0x3a, 0x01, 0x2a, 0x22, 0x0c, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x75, 0x73, 0x65, 0x72, 0x12, 0x82, 0x01, 0x0a, 0x0a, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65,
+	0x55, 0x73, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x31, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2b, 0x22,
+	0x29, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x7b, 0x6f,
+	0x6c, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x2f, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x2f,
+	0x7b, 0x6e, 0x65, 0x77, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x12, 0x6c, 0x0a, 0x0a, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73,
+	0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4,
+	0x93, 0x02, 0x15, 0x2a, 0x13, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65,
+	0x72, 0x2f, 0x7b, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x12, 0x62, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74,
+	0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x1e, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x14, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x0e, 0x12, 0x0c,
+	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x12, 0x80, 0x01, 0x0a,
+	0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
+	0x79, 0x12, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x1d, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x17, 0x3a, 0x01, 0x2a, 0x22, 0x12, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6b, 0x65, 0x79, 0x12,
+	0x87, 0x01, 0x0a, 0x10, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74,
 	0x68, 0x4b, 0x65, 0x79, 0x12, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74,
 	0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72,
 	0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x1d, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x17, 0x3a, 0x01, 0x2a, 0x22, 0x12,
+	0x6e, 0x73, 0x65, 0x22, 0x24, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1e, 0x3a, 0x01, 0x2a, 0x22, 0x19,
 	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6b,
-	0x65, 0x79, 0x12, 0x87, 0x01, 0x0a, 0x10, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x50, 0x72, 0x65,
-	0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x50, 0x72, 0x65,
-	0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26,
-	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78,
-	0x70, 0x69, 0x72, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x24, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1e, 0x3a, 0x01,
-	0x2a, 0x22, 0x19, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75,
-	0x74, 0x68, 0x6b, 0x65, 0x79, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x12, 0x7a, 0x0a, 0x0f,
-	0x4c, 0x69, 0x73, 0x74, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x12,
-	0x24, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1a, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x14, 0x12, 0x12, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x72,
-	0x65, 0x61, 0x75, 0x74, 0x68, 0x6b, 0x65, 0x79, 0x12, 0x89, 0x01, 0x0a, 0x12, 0x44, 0x65, 0x62,
-	0x75, 0x67, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12,
-	0x27, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44,
-	0x65, 0x62, 0x75, 0x67, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
+	0x65, 0x79, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x12, 0x7a, 0x0a, 0x0f, 0x4c, 0x69, 0x73,
+	0x74, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x24, 0x2e, 0x68,
+	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1a, 0x82, 0xd3, 0xe4, 0x93, 0x02,
+	0x14, 0x12, 0x12, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75,
+	0x74, 0x68, 0x6b, 0x65, 0x79, 0x12, 0x7d, 0x0a, 0x0f, 0x44, 0x65, 0x62, 0x75, 0x67, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x24, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
 	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x62, 0x75, 0x67, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x20, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x3a, 0x01, 0x2a, 0x22, 0x15, 0x2f,
-	0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x65, 0x62, 0x75, 0x67, 0x2f, 0x6d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x12, 0x75, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x24, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1e, 0x12, 0x1c, 0x2f,
-	0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b,
-	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x12, 0x74, 0x0a, 0x07, 0x53,
-	0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x12, 0x1c, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x2c, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x26, 0x3a, 0x01, 0x2a, 0x22, 0x21,
-	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f,
-	0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x74, 0x61, 0x67,
-	0x73, 0x12, 0x80, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x24, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73,
-	0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x20, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x22, 0x18, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x72, 0x65, 0x67, 0x69,
-	0x73, 0x74, 0x65, 0x72, 0x12, 0x7e, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x68, 0x65, 0x61, 0x64,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x24,
-	0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1e, 0x2a, 0x1c, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
-	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x5f, 0x69, 0x64, 0x7d, 0x12, 0x85, 0x01, 0x0a, 0x0d, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x68, 0x65, 0x61,
-	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65,
-	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x2b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x25, 0x22, 0x23, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
-	0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x12, 0x90, 0x01, 0x0a,
-	0x0d, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x22,
-	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
-	0x6e, 0x61, 0x6d, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x23, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x36, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x30, 0x22,
-	0x2e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25,
+	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65,
+	0x62, 0x75, 0x67, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1d, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x17, 0x3a, 0x01, 0x2a,
+	0x22, 0x12, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x65, 0x62, 0x75, 0x67, 0x2f,
+	0x6e, 0x6f, 0x64, 0x65, 0x12, 0x66, 0x0a, 0x07, 0x47, 0x65, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x12,
+	0x1c, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e,
+	0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1e, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x18, 0x12, 0x16, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x6f,
+	0x64, 0x65, 0x2f, 0x7b, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x12, 0x6e, 0x0a, 0x07,
+	0x53, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x12, 0x1c, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x26, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x20, 0x3a, 0x01, 0x2a, 0x22,
+	0x1b, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2f, 0x7b, 0x6e,
+	0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x74, 0x61, 0x67, 0x73, 0x12, 0x74, 0x0a, 0x0c,
+	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x21, 0x2e, 0x68,
+	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x65, 0x72, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x1d, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x17, 0x22, 0x15, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2f, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74,
+	0x65, 0x72, 0x12, 0x6f, 0x0a, 0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65,
+	0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x1e, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x18, 0x2a, 0x16, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2f, 0x7b, 0x6e, 0x6f, 0x64, 0x65, 0x5f,
+	0x69, 0x64, 0x7d, 0x12, 0x76, 0x0a, 0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4e, 0x6f, 0x64,
+	0x65, 0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x25, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1f, 0x22, 0x1d, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2f, 0x7b, 0x6e, 0x6f, 0x64, 0x65,
+	0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x12, 0x81, 0x01, 0x0a, 0x0a,
+	0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x2e, 0x68, 0x65, 0x61,
+	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65,
+	0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x68, 0x65,
+	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d,
+	0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x30, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x2a, 0x22, 0x28, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e,
+	0x6f, 0x64, 0x65, 0x2f, 0x7b, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x72, 0x65,
 	0x6e, 0x61, 0x6d, 0x65, 0x2f, 0x7b, 0x6e, 0x65, 0x77, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x7d, 0x12,
-	0x6e, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12,
-	0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x17, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x11, 0x12, 0x0f,
-	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12,
-	0x7d, 0x0a, 0x0b, 0x4d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x20,
+	0x62, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x73, 0x12, 0x1e, 0x2e, 0x68,
+	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x68,
+	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x14, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x0e, 0x12, 0x0c, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e,
+	0x6f, 0x64, 0x65, 0x12, 0x6e, 0x0a, 0x08, 0x4d, 0x6f, 0x76, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x12,
+	0x1d, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d,
+	0x6f, 0x76, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e,
 	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x6f,
-	0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x4d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x23, 0x22, 0x21, 0x2f, 0x61, 0x70,
-	0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x12, 0x64,
-	0x0a, 0x09, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1e, 0x2e, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x16, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x10, 0x12, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x12, 0x7c, 0x0a, 0x0b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x28, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x22,
-	0x22, 0x20, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x12, 0x80, 0x01, 0x0a, 0x0c, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x12, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x23, 0x22, 0x21, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74,
-	0x65, 0x73, 0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x64, 0x69,
-	0x73, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x8e, 0x01, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x25, 0x2e, 0x68, 0x65, 0x61,
-	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x26, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b, 0x82, 0xd3, 0xe4, 0x93, 0x02,
-	0x25, 0x12, 0x23, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x75, 0x0a, 0x0b, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x21, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x1b, 0x2a, 0x19, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74,
-	0x65, 0x73, 0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x12, 0x70, 0x0a,
-	0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e,
-	0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x19, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x13, 0x3a, 0x01, 0x2a, 0x22,
-	0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x12,
-	0x77, 0x0a, 0x0c, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x12,
-	0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45,
-	0x78, 0x70, 0x69, 0x72, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
-	0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x20, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x3a, 0x01,
-	0x2a, 0x22, 0x15, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65,
-	0x79, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x12, 0x6a, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63,
-	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70, 0x69, 0x4b, 0x65,
-	0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70, 0x69,
-	0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x16, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x10, 0x12, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70,
-	0x69, 0x6b, 0x65, 0x79, 0x42, 0x29, 0x5a, 0x27, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61, 0x6e, 0x66, 0x6f, 0x6e, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x67, 0x6f, 0x2f, 0x76, 0x31, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x76, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x23,
+	0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1d, 0x22, 0x1b, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
+	0x6e, 0x6f, 0x64, 0x65, 0x2f, 0x7b, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x75,
+	0x73, 0x65, 0x72, 0x12, 0x64, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x12, 0x1e, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1f, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x47, 0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x16, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x10, 0x12, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x7c, 0x0a, 0x0b, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f,
+	0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x68, 0x65, 0x61,
+	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x28, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x22, 0x22, 0x20, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x7d,
+	0x2f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x80, 0x01, 0x0a, 0x0c, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65,
+	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62,
+	0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x29, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x23, 0x22, 0x21, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69,
+	0x64, 0x7d, 0x2f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x7f, 0x0a, 0x0d, 0x47, 0x65,
+	0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x22, 0x2e, 0x68, 0x65,
+	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4e, 0x6f,
+	0x64, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x23, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47,
+	0x65, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x25, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1f, 0x12, 0x1d, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2f, 0x7b, 0x6e, 0x6f, 0x64, 0x65,
+	0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x75, 0x0a, 0x0b, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x68, 0x65, 0x61,
+	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x68,
+	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x21, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1b, 0x2a, 0x19, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69,
+	0x64, 0x7d, 0x12, 0x70, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b,
+	0x65, 0x79, 0x12, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65,
+	0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x19, 0x82, 0xd3, 0xe4, 0x93, 0x02,
+	0x13, 0x3a, 0x01, 0x2a, 0x22, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70,
+	0x69, 0x6b, 0x65, 0x79, 0x12, 0x77, 0x0a, 0x0c, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x41, 0x70,
+	0x69, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63,
+	0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x41, 0x70, 0x69,
+	0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x20, 0x82, 0xd3, 0xe4,
+	0x93, 0x02, 0x1a, 0x3a, 0x01, 0x2a, 0x22, 0x15, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
+	0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x12, 0x6a, 0x0a,
+	0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x20, 0x2e, 0x68,
+	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21,
+	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x16, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x10, 0x12, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x76, 0x31, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x42, 0x29, 0x5a, 0x27, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61, 0x6e, 0x66, 0x6f, 0x6e, 0x74,
+	0x2f, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x67,
+	0x6f, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var file_headscale_v1_headscale_proto_goTypes = []interface{}{
-	(*GetUserRequest)(nil),             // 0: headscale.v1.GetUserRequest
-	(*CreateUserRequest)(nil),          // 1: headscale.v1.CreateUserRequest
-	(*RenameUserRequest)(nil),          // 2: headscale.v1.RenameUserRequest
-	(*DeleteUserRequest)(nil),          // 3: headscale.v1.DeleteUserRequest
-	(*ListUsersRequest)(nil),           // 4: headscale.v1.ListUsersRequest
-	(*CreatePreAuthKeyRequest)(nil),    // 5: headscale.v1.CreatePreAuthKeyRequest
-	(*ExpirePreAuthKeyRequest)(nil),    // 6: headscale.v1.ExpirePreAuthKeyRequest
-	(*ListPreAuthKeysRequest)(nil),     // 7: headscale.v1.ListPreAuthKeysRequest
-	(*DebugCreateMachineRequest)(nil),  // 8: headscale.v1.DebugCreateMachineRequest
-	(*GetMachineRequest)(nil),          // 9: headscale.v1.GetMachineRequest
-	(*SetTagsRequest)(nil),             // 10: headscale.v1.SetTagsRequest
-	(*RegisterMachineRequest)(nil),     // 11: headscale.v1.RegisterMachineRequest
-	(*DeleteMachineRequest)(nil),       // 12: headscale.v1.DeleteMachineRequest
-	(*ExpireMachineRequest)(nil),       // 13: headscale.v1.ExpireMachineRequest
-	(*RenameMachineRequest)(nil),       // 14: headscale.v1.RenameMachineRequest
-	(*ListMachinesRequest)(nil),        // 15: headscale.v1.ListMachinesRequest
-	(*MoveMachineRequest)(nil),         // 16: headscale.v1.MoveMachineRequest
-	(*GetRoutesRequest)(nil),           // 17: headscale.v1.GetRoutesRequest
-	(*EnableRouteRequest)(nil),         // 18: headscale.v1.EnableRouteRequest
-	(*DisableRouteRequest)(nil),        // 19: headscale.v1.DisableRouteRequest
-	(*GetMachineRoutesRequest)(nil),    // 20: headscale.v1.GetMachineRoutesRequest
-	(*DeleteRouteRequest)(nil),         // 21: headscale.v1.DeleteRouteRequest
-	(*CreateApiKeyRequest)(nil),        // 22: headscale.v1.CreateApiKeyRequest
-	(*ExpireApiKeyRequest)(nil),        // 23: headscale.v1.ExpireApiKeyRequest
-	(*ListApiKeysRequest)(nil),         // 24: headscale.v1.ListApiKeysRequest
-	(*GetUserResponse)(nil),            // 25: headscale.v1.GetUserResponse
-	(*CreateUserResponse)(nil),         // 26: headscale.v1.CreateUserResponse
-	(*RenameUserResponse)(nil),         // 27: headscale.v1.RenameUserResponse
-	(*DeleteUserResponse)(nil),         // 28: headscale.v1.DeleteUserResponse
-	(*ListUsersResponse)(nil),          // 29: headscale.v1.ListUsersResponse
-	(*CreatePreAuthKeyResponse)(nil),   // 30: headscale.v1.CreatePreAuthKeyResponse
-	(*ExpirePreAuthKeyResponse)(nil),   // 31: headscale.v1.ExpirePreAuthKeyResponse
-	(*ListPreAuthKeysResponse)(nil),    // 32: headscale.v1.ListPreAuthKeysResponse
-	(*DebugCreateMachineResponse)(nil), // 33: headscale.v1.DebugCreateMachineResponse
-	(*GetMachineResponse)(nil),         // 34: headscale.v1.GetMachineResponse
-	(*SetTagsResponse)(nil),            // 35: headscale.v1.SetTagsResponse
-	(*RegisterMachineResponse)(nil),    // 36: headscale.v1.RegisterMachineResponse
-	(*DeleteMachineResponse)(nil),      // 37: headscale.v1.DeleteMachineResponse
-	(*ExpireMachineResponse)(nil),      // 38: headscale.v1.ExpireMachineResponse
-	(*RenameMachineResponse)(nil),      // 39: headscale.v1.RenameMachineResponse
-	(*ListMachinesResponse)(nil),       // 40: headscale.v1.ListMachinesResponse
-	(*MoveMachineResponse)(nil),        // 41: headscale.v1.MoveMachineResponse
-	(*GetRoutesResponse)(nil),          // 42: headscale.v1.GetRoutesResponse
-	(*EnableRouteResponse)(nil),        // 43: headscale.v1.EnableRouteResponse
-	(*DisableRouteResponse)(nil),       // 44: headscale.v1.DisableRouteResponse
-	(*GetMachineRoutesResponse)(nil),   // 45: headscale.v1.GetMachineRoutesResponse
-	(*DeleteRouteResponse)(nil),        // 46: headscale.v1.DeleteRouteResponse
-	(*CreateApiKeyResponse)(nil),       // 47: headscale.v1.CreateApiKeyResponse
-	(*ExpireApiKeyResponse)(nil),       // 48: headscale.v1.ExpireApiKeyResponse
-	(*ListApiKeysResponse)(nil),        // 49: headscale.v1.ListApiKeysResponse
+	(*GetUserRequest)(nil),           // 0: headscale.v1.GetUserRequest
+	(*CreateUserRequest)(nil),        // 1: headscale.v1.CreateUserRequest
+	(*RenameUserRequest)(nil),        // 2: headscale.v1.RenameUserRequest
+	(*DeleteUserRequest)(nil),        // 3: headscale.v1.DeleteUserRequest
+	(*ListUsersRequest)(nil),         // 4: headscale.v1.ListUsersRequest
+	(*CreatePreAuthKeyRequest)(nil),  // 5: headscale.v1.CreatePreAuthKeyRequest
+	(*ExpirePreAuthKeyRequest)(nil),  // 6: headscale.v1.ExpirePreAuthKeyRequest
+	(*ListPreAuthKeysRequest)(nil),   // 7: headscale.v1.ListPreAuthKeysRequest
+	(*DebugCreateNodeRequest)(nil),   // 8: headscale.v1.DebugCreateNodeRequest
+	(*GetNodeRequest)(nil),           // 9: headscale.v1.GetNodeRequest
+	(*SetTagsRequest)(nil),           // 10: headscale.v1.SetTagsRequest
+	(*RegisterNodeRequest)(nil),      // 11: headscale.v1.RegisterNodeRequest
+	(*DeleteNodeRequest)(nil),        // 12: headscale.v1.DeleteNodeRequest
+	(*ExpireNodeRequest)(nil),        // 13: headscale.v1.ExpireNodeRequest
+	(*RenameNodeRequest)(nil),        // 14: headscale.v1.RenameNodeRequest
+	(*ListNodesRequest)(nil),         // 15: headscale.v1.ListNodesRequest
+	(*MoveNodeRequest)(nil),          // 16: headscale.v1.MoveNodeRequest
+	(*GetRoutesRequest)(nil),         // 17: headscale.v1.GetRoutesRequest
+	(*EnableRouteRequest)(nil),       // 18: headscale.v1.EnableRouteRequest
+	(*DisableRouteRequest)(nil),      // 19: headscale.v1.DisableRouteRequest
+	(*GetNodeRoutesRequest)(nil),     // 20: headscale.v1.GetNodeRoutesRequest
+	(*DeleteRouteRequest)(nil),       // 21: headscale.v1.DeleteRouteRequest
+	(*CreateApiKeyRequest)(nil),      // 22: headscale.v1.CreateApiKeyRequest
+	(*ExpireApiKeyRequest)(nil),      // 23: headscale.v1.ExpireApiKeyRequest
+	(*ListApiKeysRequest)(nil),       // 24: headscale.v1.ListApiKeysRequest
+	(*GetUserResponse)(nil),          // 25: headscale.v1.GetUserResponse
+	(*CreateUserResponse)(nil),       // 26: headscale.v1.CreateUserResponse
+	(*RenameUserResponse)(nil),       // 27: headscale.v1.RenameUserResponse
+	(*DeleteUserResponse)(nil),       // 28: headscale.v1.DeleteUserResponse
+	(*ListUsersResponse)(nil),        // 29: headscale.v1.ListUsersResponse
+	(*CreatePreAuthKeyResponse)(nil), // 30: headscale.v1.CreatePreAuthKeyResponse
+	(*ExpirePreAuthKeyResponse)(nil), // 31: headscale.v1.ExpirePreAuthKeyResponse
+	(*ListPreAuthKeysResponse)(nil),  // 32: headscale.v1.ListPreAuthKeysResponse
+	(*DebugCreateNodeResponse)(nil),  // 33: headscale.v1.DebugCreateNodeResponse
+	(*GetNodeResponse)(nil),          // 34: headscale.v1.GetNodeResponse
+	(*SetTagsResponse)(nil),          // 35: headscale.v1.SetTagsResponse
+	(*RegisterNodeResponse)(nil),     // 36: headscale.v1.RegisterNodeResponse
+	(*DeleteNodeResponse)(nil),       // 37: headscale.v1.DeleteNodeResponse
+	(*ExpireNodeResponse)(nil),       // 38: headscale.v1.ExpireNodeResponse
+	(*RenameNodeResponse)(nil),       // 39: headscale.v1.RenameNodeResponse
+	(*ListNodesResponse)(nil),        // 40: headscale.v1.ListNodesResponse
+	(*MoveNodeResponse)(nil),         // 41: headscale.v1.MoveNodeResponse
+	(*GetRoutesResponse)(nil),        // 42: headscale.v1.GetRoutesResponse
+	(*EnableRouteResponse)(nil),      // 43: headscale.v1.EnableRouteResponse
+	(*DisableRouteResponse)(nil),     // 44: headscale.v1.DisableRouteResponse
+	(*GetNodeRoutesResponse)(nil),    // 45: headscale.v1.GetNodeRoutesResponse
+	(*DeleteRouteResponse)(nil),      // 46: headscale.v1.DeleteRouteResponse
+	(*CreateApiKeyResponse)(nil),     // 47: headscale.v1.CreateApiKeyResponse
+	(*ExpireApiKeyResponse)(nil),     // 48: headscale.v1.ExpireApiKeyResponse
+	(*ListApiKeysResponse)(nil),      // 49: headscale.v1.ListApiKeysResponse
 }
 var file_headscale_v1_headscale_proto_depIdxs = []int32{
 	0,  // 0: headscale.v1.HeadscaleService.GetUser:input_type -> headscale.v1.GetUserRequest
@@ -296,19 +287,19 @@ var file_headscale_v1_headscale_proto_depIdxs = []int32{
 	5,  // 5: headscale.v1.HeadscaleService.CreatePreAuthKey:input_type -> headscale.v1.CreatePreAuthKeyRequest
 	6,  // 6: headscale.v1.HeadscaleService.ExpirePreAuthKey:input_type -> headscale.v1.ExpirePreAuthKeyRequest
 	7,  // 7: headscale.v1.HeadscaleService.ListPreAuthKeys:input_type -> headscale.v1.ListPreAuthKeysRequest
-	8,  // 8: headscale.v1.HeadscaleService.DebugCreateMachine:input_type -> headscale.v1.DebugCreateMachineRequest
-	9,  // 9: headscale.v1.HeadscaleService.GetMachine:input_type -> headscale.v1.GetMachineRequest
+	8,  // 8: headscale.v1.HeadscaleService.DebugCreateNode:input_type -> headscale.v1.DebugCreateNodeRequest
+	9,  // 9: headscale.v1.HeadscaleService.GetNode:input_type -> headscale.v1.GetNodeRequest
 	10, // 10: headscale.v1.HeadscaleService.SetTags:input_type -> headscale.v1.SetTagsRequest
-	11, // 11: headscale.v1.HeadscaleService.RegisterMachine:input_type -> headscale.v1.RegisterMachineRequest
-	12, // 12: headscale.v1.HeadscaleService.DeleteMachine:input_type -> headscale.v1.DeleteMachineRequest
-	13, // 13: headscale.v1.HeadscaleService.ExpireMachine:input_type -> headscale.v1.ExpireMachineRequest
-	14, // 14: headscale.v1.HeadscaleService.RenameMachine:input_type -> headscale.v1.RenameMachineRequest
-	15, // 15: headscale.v1.HeadscaleService.ListMachines:input_type -> headscale.v1.ListMachinesRequest
-	16, // 16: headscale.v1.HeadscaleService.MoveMachine:input_type -> headscale.v1.MoveMachineRequest
+	11, // 11: headscale.v1.HeadscaleService.RegisterNode:input_type -> headscale.v1.RegisterNodeRequest
+	12, // 12: headscale.v1.HeadscaleService.DeleteNode:input_type -> headscale.v1.DeleteNodeRequest
+	13, // 13: headscale.v1.HeadscaleService.ExpireNode:input_type -> headscale.v1.ExpireNodeRequest
+	14, // 14: headscale.v1.HeadscaleService.RenameNode:input_type -> headscale.v1.RenameNodeRequest
+	15, // 15: headscale.v1.HeadscaleService.ListNodes:input_type -> headscale.v1.ListNodesRequest
+	16, // 16: headscale.v1.HeadscaleService.MoveNode:input_type -> headscale.v1.MoveNodeRequest
 	17, // 17: headscale.v1.HeadscaleService.GetRoutes:input_type -> headscale.v1.GetRoutesRequest
 	18, // 18: headscale.v1.HeadscaleService.EnableRoute:input_type -> headscale.v1.EnableRouteRequest
 	19, // 19: headscale.v1.HeadscaleService.DisableRoute:input_type -> headscale.v1.DisableRouteRequest
-	20, // 20: headscale.v1.HeadscaleService.GetMachineRoutes:input_type -> headscale.v1.GetMachineRoutesRequest
+	20, // 20: headscale.v1.HeadscaleService.GetNodeRoutes:input_type -> headscale.v1.GetNodeRoutesRequest
 	21, // 21: headscale.v1.HeadscaleService.DeleteRoute:input_type -> headscale.v1.DeleteRouteRequest
 	22, // 22: headscale.v1.HeadscaleService.CreateApiKey:input_type -> headscale.v1.CreateApiKeyRequest
 	23, // 23: headscale.v1.HeadscaleService.ExpireApiKey:input_type -> headscale.v1.ExpireApiKeyRequest
@@ -321,19 +312,19 @@ var file_headscale_v1_headscale_proto_depIdxs = []int32{
 	30, // 30: headscale.v1.HeadscaleService.CreatePreAuthKey:output_type -> headscale.v1.CreatePreAuthKeyResponse
 	31, // 31: headscale.v1.HeadscaleService.ExpirePreAuthKey:output_type -> headscale.v1.ExpirePreAuthKeyResponse
 	32, // 32: headscale.v1.HeadscaleService.ListPreAuthKeys:output_type -> headscale.v1.ListPreAuthKeysResponse
-	33, // 33: headscale.v1.HeadscaleService.DebugCreateMachine:output_type -> headscale.v1.DebugCreateMachineResponse
-	34, // 34: headscale.v1.HeadscaleService.GetMachine:output_type -> headscale.v1.GetMachineResponse
+	33, // 33: headscale.v1.HeadscaleService.DebugCreateNode:output_type -> headscale.v1.DebugCreateNodeResponse
+	34, // 34: headscale.v1.HeadscaleService.GetNode:output_type -> headscale.v1.GetNodeResponse
 	35, // 35: headscale.v1.HeadscaleService.SetTags:output_type -> headscale.v1.SetTagsResponse
-	36, // 36: headscale.v1.HeadscaleService.RegisterMachine:output_type -> headscale.v1.RegisterMachineResponse
-	37, // 37: headscale.v1.HeadscaleService.DeleteMachine:output_type -> headscale.v1.DeleteMachineResponse
-	38, // 38: headscale.v1.HeadscaleService.ExpireMachine:output_type -> headscale.v1.ExpireMachineResponse
-	39, // 39: headscale.v1.HeadscaleService.RenameMachine:output_type -> headscale.v1.RenameMachineResponse
-	40, // 40: headscale.v1.HeadscaleService.ListMachines:output_type -> headscale.v1.ListMachinesResponse
-	41, // 41: headscale.v1.HeadscaleService.MoveMachine:output_type -> headscale.v1.MoveMachineResponse
+	36, // 36: headscale.v1.HeadscaleService.RegisterNode:output_type -> headscale.v1.RegisterNodeResponse
+	37, // 37: headscale.v1.HeadscaleService.DeleteNode:output_type -> headscale.v1.DeleteNodeResponse
+	38, // 38: headscale.v1.HeadscaleService.ExpireNode:output_type -> headscale.v1.ExpireNodeResponse
+	39, // 39: headscale.v1.HeadscaleService.RenameNode:output_type -> headscale.v1.RenameNodeResponse
+	40, // 40: headscale.v1.HeadscaleService.ListNodes:output_type -> headscale.v1.ListNodesResponse
+	41, // 41: headscale.v1.HeadscaleService.MoveNode:output_type -> headscale.v1.MoveNodeResponse
 	42, // 42: headscale.v1.HeadscaleService.GetRoutes:output_type -> headscale.v1.GetRoutesResponse
 	43, // 43: headscale.v1.HeadscaleService.EnableRoute:output_type -> headscale.v1.EnableRouteResponse
 	44, // 44: headscale.v1.HeadscaleService.DisableRoute:output_type -> headscale.v1.DisableRouteResponse
-	45, // 45: headscale.v1.HeadscaleService.GetMachineRoutes:output_type -> headscale.v1.GetMachineRoutesResponse
+	45, // 45: headscale.v1.HeadscaleService.GetNodeRoutes:output_type -> headscale.v1.GetNodeRoutesResponse
 	46, // 46: headscale.v1.HeadscaleService.DeleteRoute:output_type -> headscale.v1.DeleteRouteResponse
 	47, // 47: headscale.v1.HeadscaleService.CreateApiKey:output_type -> headscale.v1.CreateApiKeyResponse
 	48, // 48: headscale.v1.HeadscaleService.ExpireApiKey:output_type -> headscale.v1.ExpireApiKeyResponse
@@ -352,7 +343,7 @@ func file_headscale_v1_headscale_proto_init() {
 	}
 	file_headscale_v1_user_proto_init()
 	file_headscale_v1_preauthkey_proto_init()
-	file_headscale_v1_machine_proto_init()
+	file_headscale_v1_node_proto_init()
 	file_headscale_v1_routes_proto_init()
 	file_headscale_v1_apikey_proto_init()
 	type x struct{}
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             (unknown)
 // source: headscale/v1/headscale.proto

@@ -18,6 +18,34 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7

+const (
+	HeadscaleService_GetUser_FullMethodName          = "/headscale.v1.HeadscaleService/GetUser"
+	HeadscaleService_CreateUser_FullMethodName       = "/headscale.v1.HeadscaleService/CreateUser"
+	HeadscaleService_RenameUser_FullMethodName       = "/headscale.v1.HeadscaleService/RenameUser"
+	HeadscaleService_DeleteUser_FullMethodName       = "/headscale.v1.HeadscaleService/DeleteUser"
+	HeadscaleService_ListUsers_FullMethodName        = "/headscale.v1.HeadscaleService/ListUsers"
+	HeadscaleService_CreatePreAuthKey_FullMethodName = "/headscale.v1.HeadscaleService/CreatePreAuthKey"
+	HeadscaleService_ExpirePreAuthKey_FullMethodName = "/headscale.v1.HeadscaleService/ExpirePreAuthKey"
+	HeadscaleService_ListPreAuthKeys_FullMethodName  = "/headscale.v1.HeadscaleService/ListPreAuthKeys"
+	HeadscaleService_DebugCreateNode_FullMethodName  = "/headscale.v1.HeadscaleService/DebugCreateNode"
+	HeadscaleService_GetNode_FullMethodName          = "/headscale.v1.HeadscaleService/GetNode"
+	HeadscaleService_SetTags_FullMethodName          = "/headscale.v1.HeadscaleService/SetTags"
+	HeadscaleService_RegisterNode_FullMethodName     = "/headscale.v1.HeadscaleService/RegisterNode"
+	HeadscaleService_DeleteNode_FullMethodName       = "/headscale.v1.HeadscaleService/DeleteNode"
+	HeadscaleService_ExpireNode_FullMethodName       = "/headscale.v1.HeadscaleService/ExpireNode"
+	HeadscaleService_RenameNode_FullMethodName       = "/headscale.v1.HeadscaleService/RenameNode"
+	HeadscaleService_ListNodes_FullMethodName        = "/headscale.v1.HeadscaleService/ListNodes"
+	HeadscaleService_MoveNode_FullMethodName         = "/headscale.v1.HeadscaleService/MoveNode"
+	HeadscaleService_GetRoutes_FullMethodName        = "/headscale.v1.HeadscaleService/GetRoutes"
+	HeadscaleService_EnableRoute_FullMethodName      = "/headscale.v1.HeadscaleService/EnableRoute"
+	HeadscaleService_DisableRoute_FullMethodName     = "/headscale.v1.HeadscaleService/DisableRoute"
+	HeadscaleService_GetNodeRoutes_FullMethodName    = "/headscale.v1.HeadscaleService/GetNodeRoutes"
+	HeadscaleService_DeleteRoute_FullMethodName      = "/headscale.v1.HeadscaleService/DeleteRoute"
+	HeadscaleService_CreateApiKey_FullMethodName     = "/headscale.v1.HeadscaleService/CreateApiKey"
+	HeadscaleService_ExpireApiKey_FullMethodName     = "/headscale.v1.HeadscaleService/ExpireApiKey"
+	HeadscaleService_ListApiKeys_FullMethodName      = "/headscale.v1.HeadscaleService/ListApiKeys"
+)
+
 // HeadscaleServiceClient is the client API for HeadscaleService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -32,21 +60,21 @@ type HeadscaleServiceClient interface {
 	CreatePreAuthKey(ctx context.Context, in *CreatePreAuthKeyRequest, opts ...grpc.CallOption) (*CreatePreAuthKeyResponse, error)
 	ExpirePreAuthKey(ctx context.Context, in *ExpirePreAuthKeyRequest, opts ...grpc.CallOption) (*ExpirePreAuthKeyResponse, error)
 	ListPreAuthKeys(ctx context.Context, in *ListPreAuthKeysRequest, opts ...grpc.CallOption) (*ListPreAuthKeysResponse, error)
-	// --- Machine start ---
-	DebugCreateMachine(ctx context.Context, in *DebugCreateMachineRequest, opts ...grpc.CallOption) (*DebugCreateMachineResponse, error)
-	GetMachine(ctx context.Context, in *GetMachineRequest, opts ...grpc.CallOption) (*GetMachineResponse, error)
+	// --- Node start ---
+	DebugCreateNode(ctx context.Context, in *DebugCreateNodeRequest, opts ...grpc.CallOption) (*DebugCreateNodeResponse, error)
+	GetNode(ctx context.Context, in *GetNodeRequest, opts ...grpc.CallOption) (*GetNodeResponse, error)
 	SetTags(ctx context.Context, in *SetTagsRequest, opts ...grpc.CallOption) (*SetTagsResponse, error)
-	RegisterMachine(ctx context.Context, in *RegisterMachineRequest, opts ...grpc.CallOption) (*RegisterMachineResponse, error)
-	DeleteMachine(ctx context.Context, in *DeleteMachineRequest, opts ...grpc.CallOption) (*DeleteMachineResponse, error)
-	ExpireMachine(ctx context.Context, in *ExpireMachineRequest, opts ...grpc.CallOption) (*ExpireMachineResponse, error)
-	RenameMachine(ctx context.Context, in *RenameMachineRequest, opts ...grpc.CallOption) (*RenameMachineResponse, error)
-	ListMachines(ctx context.Context, in *ListMachinesRequest, opts ...grpc.CallOption) (*ListMachinesResponse, error)
-	MoveMachine(ctx context.Context, in *MoveMachineRequest, opts ...grpc.CallOption) (*MoveMachineResponse, error)
+	RegisterNode(ctx context.Context, in *RegisterNodeRequest, opts ...grpc.CallOption) (*RegisterNodeResponse, error)
+	DeleteNode(ctx context.Context, in *DeleteNodeRequest, opts ...grpc.CallOption) (*DeleteNodeResponse, error)
+	ExpireNode(ctx context.Context, in *ExpireNodeRequest, opts ...grpc.CallOption) (*ExpireNodeResponse, error)
+	RenameNode(ctx context.Context, in *RenameNodeRequest, opts ...grpc.CallOption) (*RenameNodeResponse, error)
+	ListNodes(ctx context.Context, in *ListNodesRequest, opts ...grpc.CallOption) (*ListNodesResponse, error)
+	MoveNode(ctx context.Context, in *MoveNodeRequest, opts ...grpc.CallOption) (*MoveNodeResponse, error)
 	// --- Route start ---
 	GetRoutes(ctx context.Context, in *GetRoutesRequest, opts ...grpc.CallOption) (*GetRoutesResponse, error)
 	EnableRoute(ctx context.Context, in *EnableRouteRequest, opts ...grpc.CallOption) (*EnableRouteResponse, error)
 	DisableRoute(ctx context.Context, in *DisableRouteRequest, opts ...grpc.CallOption) (*DisableRouteResponse, error)
-	GetMachineRoutes(ctx context.Context, in *GetMachineRoutesRequest, opts ...grpc.CallOption) (*GetMachineRoutesResponse, error)
+	GetNodeRoutes(ctx context.Context, in *GetNodeRoutesRequest, opts ...grpc.CallOption) (*GetNodeRoutesResponse, error)
 	DeleteRoute(ctx context.Context, in *DeleteRouteRequest, opts ...grpc.CallOption) (*DeleteRouteResponse, error)
 	// --- ApiKeys start ---
 	CreateApiKey(ctx context.Context, in *CreateApiKeyRequest, opts ...grpc.CallOption) (*CreateApiKeyResponse, error)
@@ -64,7 +92,7 @@ func NewHeadscaleServiceClient(cc grpc.ClientConnInterface) HeadscaleServiceClie

 func (c *headscaleServiceClient) GetUser(ctx context.Context, in *GetUserRequest, opts ...grpc.CallOption) (*GetUserResponse, error) {
 	out := new(GetUserResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/GetUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_GetUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -73,7 +101,7 @@ func (c *headscaleServiceClient) GetUser(ctx context.Context, in *GetUserRequest

 func (c *headscaleServiceClient) CreateUser(ctx context.Context, in *CreateUserRequest, opts ...grpc.CallOption) (*CreateUserResponse, error) {
 	out := new(CreateUserResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/CreateUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_CreateUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -82,7 +110,7 @@ func (c *headscaleServiceClient) CreateUser(ctx context.Context, in *CreateUserR

 func (c *headscaleServiceClient) RenameUser(ctx context.Context, in *RenameUserRequest, opts ...grpc.CallOption) (*RenameUserResponse, error) {
 	out := new(RenameUserResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/RenameUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_RenameUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -91,7 +119,7 @@ func (c *headscaleServiceClient) RenameUser(ctx context.Context, in *RenameUserR

 func (c *headscaleServiceClient) DeleteUser(ctx context.Context, in *DeleteUserRequest, opts ...grpc.CallOption) (*DeleteUserResponse, error) {
 	out := new(DeleteUserResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/DeleteUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_DeleteUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -100,7 +128,7 @@ func (c *headscaleServiceClient) DeleteUser(ctx context.Context, in *DeleteUserR

 func (c *headscaleServiceClient) ListUsers(ctx context.Context, in *ListUsersRequest, opts ...grpc.CallOption) (*ListUsersResponse, error) {
 	out := new(ListUsersResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/ListUsers", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_ListUsers_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -109,7 +137,7 @@ func (c *headscaleServiceClient) ListUsers(ctx context.Context, in *ListUsersReq

 func (c *headscaleServiceClient) CreatePreAuthKey(ctx context.Context, in *CreatePreAuthKeyRequest, opts ...grpc.CallOption) (*CreatePreAuthKeyResponse, error) {
 	out := new(CreatePreAuthKeyResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/CreatePreAuthKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_CreatePreAuthKey_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -118,7 +146,7 @@ func (c *headscaleServiceClient) CreatePreAuthKey(ctx context.Context, in *Creat

 func (c *headscaleServiceClient) ExpirePreAuthKey(ctx context.Context, in *ExpirePreAuthKeyRequest, opts ...grpc.CallOption) (*ExpirePreAuthKeyResponse, error) {
 	out := new(ExpirePreAuthKeyResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/ExpirePreAuthKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_ExpirePreAuthKey_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -127,25 +155,25 @@ func (c *headscaleServiceClient) ExpirePreAuthKey(ctx context.Context, in *Expir

 func (c *headscaleServiceClient) ListPreAuthKeys(ctx context.Context, in *ListPreAuthKeysRequest, opts ...grpc.CallOption) (*ListPreAuthKeysResponse, error) {
 	out := new(ListPreAuthKeysResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/ListPreAuthKeys", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_ListPreAuthKeys_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) DebugCreateMachine(ctx context.Context, in *DebugCreateMachineRequest, opts ...grpc.CallOption) (*DebugCreateMachineResponse, error) {
-	out := new(DebugCreateMachineResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/DebugCreateMachine", in, out, opts...)
+func (c *headscaleServiceClient) DebugCreateNode(ctx context.Context, in *DebugCreateNodeRequest, opts ...grpc.CallOption) (*DebugCreateNodeResponse, error) {
+	out := new(DebugCreateNodeResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_DebugCreateNode_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) GetMachine(ctx context.Context, in *GetMachineRequest, opts ...grpc.CallOption) (*GetMachineResponse, error) {
-	out := new(GetMachineResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/GetMachine", in, out, opts...)
+func (c *headscaleServiceClient) GetNode(ctx context.Context, in *GetNodeRequest, opts ...grpc.CallOption) (*GetNodeResponse, error) {
+	out := new(GetNodeResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_GetNode_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -154,61 +182,61 @@ func (c *headscaleServiceClient) GetMachine(ctx context.Context, in *GetMachineR

 func (c *headscaleServiceClient) SetTags(ctx context.Context, in *SetTagsRequest, opts ...grpc.CallOption) (*SetTagsResponse, error) {
 	out := new(SetTagsResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/SetTags", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_SetTags_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) RegisterMachine(ctx context.Context, in *RegisterMachineRequest, opts ...grpc.CallOption) (*RegisterMachineResponse, error) {
-	out := new(RegisterMachineResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/RegisterMachine", in, out, opts...)
+func (c *headscaleServiceClient) RegisterNode(ctx context.Context, in *RegisterNodeRequest, opts ...grpc.CallOption) (*RegisterNodeResponse, error) {
+	out := new(RegisterNodeResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_RegisterNode_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) DeleteMachine(ctx context.Context, in *DeleteMachineRequest, opts ...grpc.CallOption) (*DeleteMachineResponse, error) {
-	out := new(DeleteMachineResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/DeleteMachine", in, out, opts...)
+func (c *headscaleServiceClient) DeleteNode(ctx context.Context, in *DeleteNodeRequest, opts ...grpc.CallOption) (*DeleteNodeResponse, error) {
+	out := new(DeleteNodeResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_DeleteNode_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) ExpireMachine(ctx context.Context, in *ExpireMachineRequest, opts ...grpc.CallOption) (*ExpireMachineResponse, error) {
-	out := new(ExpireMachineResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/ExpireMachine", in, out, opts...)
+func (c *headscaleServiceClient) ExpireNode(ctx context.Context, in *ExpireNodeRequest, opts ...grpc.CallOption) (*ExpireNodeResponse, error) {
+	out := new(ExpireNodeResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_ExpireNode_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) RenameMachine(ctx context.Context, in *RenameMachineRequest, opts ...grpc.CallOption) (*RenameMachineResponse, error) {
-	out := new(RenameMachineResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/RenameMachine", in, out, opts...)
+func (c *headscaleServiceClient) RenameNode(ctx context.Context, in *RenameNodeRequest, opts ...grpc.CallOption) (*RenameNodeResponse, error) {
+	out := new(RenameNodeResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_RenameNode_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) ListMachines(ctx context.Context, in *ListMachinesRequest, opts ...grpc.CallOption) (*ListMachinesResponse, error) {
-	out := new(ListMachinesResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/ListMachines", in, out, opts...)
+func (c *headscaleServiceClient) ListNodes(ctx context.Context, in *ListNodesRequest, opts ...grpc.CallOption) (*ListNodesResponse, error) {
+	out := new(ListNodesResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_ListNodes_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) MoveMachine(ctx context.Context, in *MoveMachineRequest, opts ...grpc.CallOption) (*MoveMachineResponse, error) {
-	out := new(MoveMachineResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/MoveMachine", in, out, opts...)
+func (c *headscaleServiceClient) MoveNode(ctx context.Context, in *MoveNodeRequest, opts ...grpc.CallOption) (*MoveNodeResponse, error) {
+	out := new(MoveNodeResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_MoveNode_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -217,7 +245,7 @@ func (c *headscaleServiceClient) MoveMachine(ctx context.Context, in *MoveMachin

 func (c *headscaleServiceClient) GetRoutes(ctx context.Context, in *GetRoutesRequest, opts ...grpc.CallOption) (*GetRoutesResponse, error) {
 	out := new(GetRoutesResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/GetRoutes", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_GetRoutes_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -226,7 +254,7 @@ func (c *headscaleServiceClient) GetRoutes(ctx context.Context, in *GetRoutesReq

 func (c *headscaleServiceClient) EnableRoute(ctx context.Context, in *EnableRouteRequest, opts ...grpc.CallOption) (*EnableRouteResponse, error) {
 	out := new(EnableRouteResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/EnableRoute", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_EnableRoute_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -235,16 +263,16 @@ func (c *headscaleServiceClient) EnableRoute(ctx context.Context, in *EnableRout

 func (c *headscaleServiceClient) DisableRoute(ctx context.Context, in *DisableRouteRequest, opts ...grpc.CallOption) (*DisableRouteResponse, error) {
 	out := new(DisableRouteResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/DisableRoute", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_DisableRoute_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) GetMachineRoutes(ctx context.Context, in *GetMachineRoutesRequest, opts ...grpc.CallOption) (*GetMachineRoutesResponse, error) {
-	out := new(GetMachineRoutesResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/GetMachineRoutes", in, out, opts...)
+func (c *headscaleServiceClient) GetNodeRoutes(ctx context.Context, in *GetNodeRoutesRequest, opts ...grpc.CallOption) (*GetNodeRoutesResponse, error) {
+	out := new(GetNodeRoutesResponse)
+	err := c.cc.Invoke(ctx, HeadscaleService_GetNodeRoutes_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -253,7 +281,7 @@ func (c *headscaleServiceClient) GetMachineRoutes(ctx context.Context, in *GetMa

 func (c *headscaleServiceClient) DeleteRoute(ctx context.Context, in *DeleteRouteRequest, opts ...grpc.CallOption) (*DeleteRouteResponse, error) {
 	out := new(DeleteRouteResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/DeleteRoute", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_DeleteRoute_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -262,7 +290,7 @@ func (c *headscaleServiceClient) DeleteRoute(ctx context.Context, in *DeleteRout

 func (c *headscaleServiceClient) CreateApiKey(ctx context.Context, in *CreateApiKeyRequest, opts ...grpc.CallOption) (*CreateApiKeyResponse, error) {
 	out := new(CreateApiKeyResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/CreateApiKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_CreateApiKey_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -271,7 +299,7 @@ func (c *headscaleServiceClient) CreateApiKey(ctx context.Context, in *CreateApi

 func (c *headscaleServiceClient) ExpireApiKey(ctx context.Context, in *ExpireApiKeyRequest, opts ...grpc.CallOption) (*ExpireApiKeyResponse, error) {
 	out := new(ExpireApiKeyResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/ExpireApiKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_ExpireApiKey_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -280,7 +308,7 @@ func (c *headscaleServiceClient) ExpireApiKey(ctx context.Context, in *ExpireApi

 func (c *headscaleServiceClient) ListApiKeys(ctx context.Context, in *ListApiKeysRequest, opts ...grpc.CallOption) (*ListApiKeysResponse, error) {
 	out := new(ListApiKeysResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/ListApiKeys", in, out, opts...)
+	err := c.cc.Invoke(ctx, HeadscaleService_ListApiKeys_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -301,21 +329,21 @@ type HeadscaleServiceServer interface {
 	CreatePreAuthKey(context.Context, *CreatePreAuthKeyRequest) (*CreatePreAuthKeyResponse, error)
 	ExpirePreAuthKey(context.Context, *ExpirePreAuthKeyRequest) (*ExpirePreAuthKeyResponse, error)
 	ListPreAuthKeys(context.Context, *ListPreAuthKeysRequest) (*ListPreAuthKeysResponse, error)
-	// --- Machine start ---
-	DebugCreateMachine(context.Context, *DebugCreateMachineRequest) (*DebugCreateMachineResponse, error)
-	GetMachine(context.Context, *GetMachineRequest) (*GetMachineResponse, error)
+	// --- Node start ---
+	DebugCreateNode(context.Context, *DebugCreateNodeRequest) (*DebugCreateNodeResponse, error)
+	GetNode(context.Context, *GetNodeRequest) (*GetNodeResponse, error)
 	SetTags(context.Context, *SetTagsRequest) (*SetTagsResponse, error)
-	RegisterMachine(context.Context, *RegisterMachineRequest) (*RegisterMachineResponse, error)
-	DeleteMachine(context.Context, *DeleteMachineRequest) (*DeleteMachineResponse, error)
-	ExpireMachine(context.Context, *ExpireMachineRequest) (*ExpireMachineResponse, error)
-	RenameMachine(context.Context, *RenameMachineRequest) (*RenameMachineResponse, error)
-	ListMachines(context.Context, *ListMachinesRequest) (*ListMachinesResponse, error)
-	MoveMachine(context.Context, *MoveMachineRequest) (*MoveMachineResponse, error)
+	RegisterNode(context.Context, *RegisterNodeRequest) (*RegisterNodeResponse, error)
+	DeleteNode(context.Context, *DeleteNodeRequest) (*DeleteNodeResponse, error)
+	ExpireNode(context.Context, *ExpireNodeRequest) (*ExpireNodeResponse, error)
+	RenameNode(context.Context, *RenameNodeRequest) (*RenameNodeResponse, error)
+	ListNodes(context.Context, *ListNodesRequest) (*ListNodesResponse, error)
+	MoveNode(context.Context, *MoveNodeRequest) (*MoveNodeResponse, error)
 	// --- Route start ---
 	GetRoutes(context.Context, *GetRoutesRequest) (*GetRoutesResponse, error)
 	EnableRoute(context.Context, *EnableRouteRequest) (*EnableRouteResponse, error)
 	DisableRoute(context.Context, *DisableRouteRequest) (*DisableRouteResponse, error)
-	GetMachineRoutes(context.Context, *GetMachineRoutesRequest) (*GetMachineRoutesResponse, error)
+	GetNodeRoutes(context.Context, *GetNodeRoutesRequest) (*GetNodeRoutesResponse, error)
 	DeleteRoute(context.Context, *DeleteRouteRequest) (*DeleteRouteResponse, error)
 	// --- ApiKeys start ---
 	CreateApiKey(context.Context, *CreateApiKeyRequest) (*CreateApiKeyResponse, error)
@@ -352,32 +380,32 @@ func (UnimplementedHeadscaleServiceServer) ExpirePreAuthKey(context.Context, *Ex
 func (UnimplementedHeadscaleServiceServer) ListPreAuthKeys(context.Context, *ListPreAuthKeysRequest) (*ListPreAuthKeysResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListPreAuthKeys not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) DebugCreateMachine(context.Context, *DebugCreateMachineRequest) (*DebugCreateMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DebugCreateMachine not implemented")
+func (UnimplementedHeadscaleServiceServer) DebugCreateNode(context.Context, *DebugCreateNodeRequest) (*DebugCreateNodeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DebugCreateNode not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) GetMachine(context.Context, *GetMachineRequest) (*GetMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetMachine not implemented")
+func (UnimplementedHeadscaleServiceServer) GetNode(context.Context, *GetNodeRequest) (*GetNodeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetNode not implemented")
 }
 func (UnimplementedHeadscaleServiceServer) SetTags(context.Context, *SetTagsRequest) (*SetTagsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method SetTags not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) RegisterMachine(context.Context, *RegisterMachineRequest) (*RegisterMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RegisterMachine not implemented")
+func (UnimplementedHeadscaleServiceServer) RegisterNode(context.Context, *RegisterNodeRequest) (*RegisterNodeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RegisterNode not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) DeleteMachine(context.Context, *DeleteMachineRequest) (*DeleteMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteMachine not implemented")
+func (UnimplementedHeadscaleServiceServer) DeleteNode(context.Context, *DeleteNodeRequest) (*DeleteNodeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteNode not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) ExpireMachine(context.Context, *ExpireMachineRequest) (*ExpireMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ExpireMachine not implemented")
+func (UnimplementedHeadscaleServiceServer) ExpireNode(context.Context, *ExpireNodeRequest) (*ExpireNodeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ExpireNode not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) RenameMachine(context.Context, *RenameMachineRequest) (*RenameMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RenameMachine not implemented")
+func (UnimplementedHeadscaleServiceServer) RenameNode(context.Context, *RenameNodeRequest) (*RenameNodeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RenameNode not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) ListMachines(context.Context, *ListMachinesRequest) (*ListMachinesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListMachines not implemented")
+func (UnimplementedHeadscaleServiceServer) ListNodes(context.Context, *ListNodesRequest) (*ListNodesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListNodes not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) MoveMachine(context.Context, *MoveMachineRequest) (*MoveMachineResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method MoveMachine not implemented")
+func (UnimplementedHeadscaleServiceServer) MoveNode(context.Context, *MoveNodeRequest) (*MoveNodeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method MoveNode not implemented")
 }
 func (UnimplementedHeadscaleServiceServer) GetRoutes(context.Context, *GetRoutesRequest) (*GetRoutesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetRoutes not implemented")
@@ -388,8 +416,8 @@ func (UnimplementedHeadscaleServiceServer) EnableRoute(context.Context, *EnableR
 func (UnimplementedHeadscaleServiceServer) DisableRoute(context.Context, *DisableRouteRequest) (*DisableRouteResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DisableRoute not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) GetMachineRoutes(context.Context, *GetMachineRoutesRequest) (*GetMachineRoutesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetMachineRoutes not implemented")
+func (UnimplementedHeadscaleServiceServer) GetNodeRoutes(context.Context, *GetNodeRoutesRequest) (*GetNodeRoutesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetNodeRoutes not implemented")
 }
 func (UnimplementedHeadscaleServiceServer) DeleteRoute(context.Context, *DeleteRouteRequest) (*DeleteRouteResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteRoute not implemented")
@@ -426,7 +454,7 @@ func _HeadscaleService_GetUser_Handler(srv interface{}, ctx context.Context, dec
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/GetUser",
+		FullMethod: HeadscaleService_GetUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).GetUser(ctx, req.(*GetUserRequest))
@@ -444,7 +472,7 @@ func _HeadscaleService_CreateUser_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/CreateUser",
+		FullMethod: HeadscaleService_CreateUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).CreateUser(ctx, req.(*CreateUserRequest))
@@ -462,7 +490,7 @@ func _HeadscaleService_RenameUser_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/RenameUser",
+		FullMethod: HeadscaleService_RenameUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).RenameUser(ctx, req.(*RenameUserRequest))
@@ -480,7 +508,7 @@ func _HeadscaleService_DeleteUser_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/DeleteUser",
+		FullMethod: HeadscaleService_DeleteUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).DeleteUser(ctx, req.(*DeleteUserRequest))
@@ -498,7 +526,7 @@ func _HeadscaleService_ListUsers_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/ListUsers",
+		FullMethod: HeadscaleService_ListUsers_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).ListUsers(ctx, req.(*ListUsersRequest))
@@ -516,7 +544,7 @@ func _HeadscaleService_CreatePreAuthKey_Handler(srv interface{}, ctx context.Con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/CreatePreAuthKey",
+		FullMethod: HeadscaleService_CreatePreAuthKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).CreatePreAuthKey(ctx, req.(*CreatePreAuthKeyRequest))
@@ -534,7 +562,7 @@ func _HeadscaleService_ExpirePreAuthKey_Handler(srv interface{}, ctx context.Con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/ExpirePreAuthKey",
+		FullMethod: HeadscaleService_ExpirePreAuthKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).ExpirePreAuthKey(ctx, req.(*ExpirePreAuthKeyRequest))
@@ -552,7 +580,7 @@ func _HeadscaleService_ListPreAuthKeys_Handler(srv interface{}, ctx context.Cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/ListPreAuthKeys",
+		FullMethod: HeadscaleService_ListPreAuthKeys_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).ListPreAuthKeys(ctx, req.(*ListPreAuthKeysRequest))
@@ -560,38 +588,38 @@ func _HeadscaleService_ListPreAuthKeys_Handler(srv interface{}, ctx context.Cont
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_DebugCreateMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DebugCreateMachineRequest)
+func _HeadscaleService_DebugCreateNode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DebugCreateNodeRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).DebugCreateMachine(ctx, in)
+		return srv.(HeadscaleServiceServer).DebugCreateNode(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/DebugCreateMachine",
+		FullMethod: HeadscaleService_DebugCreateNode_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).DebugCreateMachine(ctx, req.(*DebugCreateMachineRequest))
+		return srv.(HeadscaleServiceServer).DebugCreateNode(ctx, req.(*DebugCreateNodeRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_GetMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetMachineRequest)
+func _HeadscaleService_GetNode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetNodeRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).GetMachine(ctx, in)
+		return srv.(HeadscaleServiceServer).GetNode(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/GetMachine",
+		FullMethod: HeadscaleService_GetNode_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).GetMachine(ctx, req.(*GetMachineRequest))
+		return srv.(HeadscaleServiceServer).GetNode(ctx, req.(*GetNodeRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -606,7 +634,7 @@ func _HeadscaleService_SetTags_Handler(srv interface{}, ctx context.Context, dec
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/SetTags",
+		FullMethod: HeadscaleService_SetTags_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).SetTags(ctx, req.(*SetTagsRequest))
@@ -614,110 +642,110 @@ func _HeadscaleService_SetTags_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_RegisterMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RegisterMachineRequest)
+func _HeadscaleService_RegisterNode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterNodeRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).RegisterMachine(ctx, in)
+		return srv.(HeadscaleServiceServer).RegisterNode(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/RegisterMachine",
+		FullMethod: HeadscaleService_RegisterNode_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).RegisterMachine(ctx, req.(*RegisterMachineRequest))
+		return srv.(HeadscaleServiceServer).RegisterNode(ctx, req.(*RegisterNodeRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_DeleteMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteMachineRequest)
+func _HeadscaleService_DeleteNode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteNodeRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).DeleteMachine(ctx, in)
+		return srv.(HeadscaleServiceServer).DeleteNode(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/DeleteMachine",
+		FullMethod: HeadscaleService_DeleteNode_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).DeleteMachine(ctx, req.(*DeleteMachineRequest))
+		return srv.(HeadscaleServiceServer).DeleteNode(ctx, req.(*DeleteNodeRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_ExpireMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ExpireMachineRequest)
+func _HeadscaleService_ExpireNode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExpireNodeRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).ExpireMachine(ctx, in)
+		return srv.(HeadscaleServiceServer).ExpireNode(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/ExpireMachine",
+		FullMethod: HeadscaleService_ExpireNode_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).ExpireMachine(ctx, req.(*ExpireMachineRequest))
+		return srv.(HeadscaleServiceServer).ExpireNode(ctx, req.(*ExpireNodeRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_RenameMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RenameMachineRequest)
+func _HeadscaleService_RenameNode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RenameNodeRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).RenameMachine(ctx, in)
+		return srv.(HeadscaleServiceServer).RenameNode(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/RenameMachine",
+		FullMethod: HeadscaleService_RenameNode_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).RenameMachine(ctx, req.(*RenameMachineRequest))
+		return srv.(HeadscaleServiceServer).RenameNode(ctx, req.(*RenameNodeRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_ListMachines_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(ListMachinesRequest)
+func _HeadscaleService_ListNodes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListNodesRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).ListMachines(ctx, in)
+		return srv.(HeadscaleServiceServer).ListNodes(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/ListMachines",
+		FullMethod: HeadscaleService_ListNodes_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).ListMachines(ctx, req.(*ListMachinesRequest))
+		return srv.(HeadscaleServiceServer).ListNodes(ctx, req.(*ListNodesRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_MoveMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MoveMachineRequest)
+func _HeadscaleService_MoveNode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MoveNodeRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).MoveMachine(ctx, in)
+		return srv.(HeadscaleServiceServer).MoveNode(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/MoveMachine",
+		FullMethod: HeadscaleService_MoveNode_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).MoveMachine(ctx, req.(*MoveMachineRequest))
+		return srv.(HeadscaleServiceServer).MoveNode(ctx, req.(*MoveNodeRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -732,7 +760,7 @@ func _HeadscaleService_GetRoutes_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/GetRoutes",
+		FullMethod: HeadscaleService_GetRoutes_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).GetRoutes(ctx, req.(*GetRoutesRequest))
@@ -750,7 +778,7 @@ func _HeadscaleService_EnableRoute_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/EnableRoute",
+		FullMethod: HeadscaleService_EnableRoute_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).EnableRoute(ctx, req.(*EnableRouteRequest))
@@ -768,7 +796,7 @@ func _HeadscaleService_DisableRoute_Handler(srv interface{}, ctx context.Context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/DisableRoute",
+		FullMethod: HeadscaleService_DisableRoute_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).DisableRoute(ctx, req.(*DisableRouteRequest))
@@ -776,20 +804,20 @@ func _HeadscaleService_DisableRoute_Handler(srv interface{}, ctx context.Context
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_GetMachineRoutes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetMachineRoutesRequest)
+func _HeadscaleService_GetNodeRoutes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetNodeRoutesRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).GetMachineRoutes(ctx, in)
+		return srv.(HeadscaleServiceServer).GetNodeRoutes(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/GetMachineRoutes",
+		FullMethod: HeadscaleService_GetNodeRoutes_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).GetMachineRoutes(ctx, req.(*GetMachineRoutesRequest))
+		return srv.(HeadscaleServiceServer).GetNodeRoutes(ctx, req.(*GetNodeRoutesRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -804,7 +832,7 @@ func _HeadscaleService_DeleteRoute_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/DeleteRoute",
+		FullMethod: HeadscaleService_DeleteRoute_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).DeleteRoute(ctx, req.(*DeleteRouteRequest))
@@ -822,7 +850,7 @@ func _HeadscaleService_CreateApiKey_Handler(srv interface{}, ctx context.Context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/CreateApiKey",
+		FullMethod: HeadscaleService_CreateApiKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).CreateApiKey(ctx, req.(*CreateApiKeyRequest))
@@ -840,7 +868,7 @@ func _HeadscaleService_ExpireApiKey_Handler(srv interface{}, ctx context.Context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/ExpireApiKey",
+		FullMethod: HeadscaleService_ExpireApiKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).ExpireApiKey(ctx, req.(*ExpireApiKeyRequest))
@@ -858,7 +886,7 @@ func _HeadscaleService_ListApiKeys_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/ListApiKeys",
+		FullMethod: HeadscaleService_ListApiKeys_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HeadscaleServiceServer).ListApiKeys(ctx, req.(*ListApiKeysRequest))
@@ -906,40 +934,40 @@ var HeadscaleService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _HeadscaleService_ListPreAuthKeys_Handler,
 		},
 		{
-			MethodName: "DebugCreateMachine",
-			Handler:    _HeadscaleService_DebugCreateMachine_Handler,
+			MethodName: "DebugCreateNode",
+			Handler:    _HeadscaleService_DebugCreateNode_Handler,
 		},
 		{
-			MethodName: "GetMachine",
-			Handler:    _HeadscaleService_GetMachine_Handler,
+			MethodName: "GetNode",
+			Handler:    _HeadscaleService_GetNode_Handler,
 		},
 		{
 			MethodName: "SetTags",
 			Handler:    _HeadscaleService_SetTags_Handler,
 		},
 		{
-			MethodName: "RegisterMachine",
-			Handler:    _HeadscaleService_RegisterMachine_Handler,
+			MethodName: "RegisterNode",
+			Handler:    _HeadscaleService_RegisterNode_Handler,
 		},
 		{
-			MethodName: "DeleteMachine",
-			Handler:    _HeadscaleService_DeleteMachine_Handler,
+			MethodName: "DeleteNode",
+			Handler:    _HeadscaleService_DeleteNode_Handler,
 		},
 		{
-			MethodName: "ExpireMachine",
-			Handler:    _HeadscaleService_ExpireMachine_Handler,
+			MethodName: "ExpireNode",
+			Handler:    _HeadscaleService_ExpireNode_Handler,
 		},
 		{
-			MethodName: "RenameMachine",
-			Handler:    _HeadscaleService_RenameMachine_Handler,
+			MethodName: "RenameNode",
+			Handler:    _HeadscaleService_RenameNode_Handler,
 		},
 		{
-			MethodName: "ListMachines",
-			Handler:    _HeadscaleService_ListMachines_Handler,
+			MethodName: "ListNodes",
+			Handler:    _HeadscaleService_ListNodes_Handler,
 		},
 		{
-			MethodName: "MoveMachine",
-			Handler:    _HeadscaleService_MoveMachine_Handler,
+			MethodName: "MoveNode",
+			Handler:    _HeadscaleService_MoveNode_Handler,
 		},
 		{
 			MethodName: "GetRoutes",
@@ -954,8 +982,8 @@ var HeadscaleService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _HeadscaleService_DisableRoute_Handler,
 		},
 		{
-			MethodName: "GetMachineRoutes",
-			Handler:    _HeadscaleService_GetMachineRoutes_Handler,
+			MethodName: "GetNodeRoutes",
+			Handler:    _HeadscaleService_GetNodeRoutes_Handler,
 		},
 		{
 			MethodName: "DeleteRoute",
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
+// 	protoc-gen-go v1.29.1
 // 	protoc        (unknown)
 // source: headscale/v1/preauthkey.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
+// 	protoc-gen-go v1.29.1
 // 	protoc        (unknown)
 // source: headscale/v1/routes.proto

@@ -27,7 +27,7 @@ type Route struct {
 	unknownFields protoimpl.UnknownFields

 	Id         uint64                 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	Machine    *Machine               `protobuf:"bytes,2,opt,name=machine,proto3" json:"machine,omitempty"`
+	Node       *Node                  `protobuf:"bytes,2,opt,name=node,proto3" json:"node,omitempty"`
 	Prefix     string                 `protobuf:"bytes,3,opt,name=prefix,proto3" json:"prefix,omitempty"`
 	Advertised bool                   `protobuf:"varint,4,opt,name=advertised,proto3" json:"advertised,omitempty"`
 	Enabled    bool                   `protobuf:"varint,5,opt,name=enabled,proto3" json:"enabled,omitempty"`
@@ -76,9 +76,9 @@ func (x *Route) GetId() uint64 {
 	return 0
 }

-func (x *Route) GetMachine() *Machine {
+func (x *Route) GetNode() *Node {
 	if x != nil {
-		return x.Machine
+		return x.Node
 	}
 	return nil
 }
@@ -387,16 +387,16 @@ func (*DisableRouteResponse) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{6}
 }

-type GetMachineRoutesRequest struct {
+type GetNodeRoutesRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	MachineId uint64 `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	NodeId uint64 `protobuf:"varint,1,opt,name=node_id,json=nodeId,proto3" json:"node_id,omitempty"`
 }

-func (x *GetMachineRoutesRequest) Reset() {
-	*x = GetMachineRoutesRequest{}
+func (x *GetNodeRoutesRequest) Reset() {
+	*x = GetNodeRoutesRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_headscale_v1_routes_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -404,13 +404,13 @@ func (x *GetMachineRoutesRequest) Reset() {
 	}
 }

-func (x *GetMachineRoutesRequest) String() string {
+func (x *GetNodeRoutesRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*GetMachineRoutesRequest) ProtoMessage() {}
+func (*GetNodeRoutesRequest) ProtoMessage() {}

-func (x *GetMachineRoutesRequest) ProtoReflect() protoreflect.Message {
+func (x *GetNodeRoutesRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_headscale_v1_routes_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -422,19 +422,19 @@ func (x *GetMachineRoutesRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use GetMachineRoutesRequest.ProtoReflect.Descriptor instead.
-func (*GetMachineRoutesRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetNodeRoutesRequest.ProtoReflect.Descriptor instead.
+func (*GetNodeRoutesRequest) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{7}
 }

-func (x *GetMachineRoutesRequest) GetMachineId() uint64 {
+func (x *GetNodeRoutesRequest) GetNodeId() uint64 {
 	if x != nil {
-		return x.MachineId
+		return x.NodeId
 	}
 	return 0
 }

-type GetMachineRoutesResponse struct {
+type GetNodeRoutesResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -442,8 +442,8 @@ type GetMachineRoutesResponse struct {
 	Routes []*Route `protobuf:"bytes,1,rep,name=routes,proto3" json:"routes,omitempty"`
 }

-func (x *GetMachineRoutesResponse) Reset() {
-	*x = GetMachineRoutesResponse{}
+func (x *GetNodeRoutesResponse) Reset() {
+	*x = GetNodeRoutesResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_headscale_v1_routes_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -451,13 +451,13 @@ func (x *GetMachineRoutesResponse) Reset() {
 	}
 }

-func (x *GetMachineRoutesResponse) String() string {
+func (x *GetNodeRoutesResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*GetMachineRoutesResponse) ProtoMessage() {}
+func (*GetNodeRoutesResponse) ProtoMessage() {}

-func (x *GetMachineRoutesResponse) ProtoReflect() protoreflect.Message {
+func (x *GetNodeRoutesResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_headscale_v1_routes_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -469,12 +469,12 @@ func (x *GetMachineRoutesResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use GetMachineRoutesResponse.ProtoReflect.Descriptor instead.
-func (*GetMachineRoutesResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetNodeRoutesResponse.ProtoReflect.Descriptor instead.
+func (*GetNodeRoutesResponse) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{8}
 }

-func (x *GetMachineRoutesResponse) GetRoutes() []*Route {
+func (x *GetNodeRoutesResponse) GetRoutes() []*Route {
 	if x != nil {
 		return x.Routes
 	}
@@ -573,62 +573,61 @@ var file_headscale_v1_routes_proto_rawDesc = []byte{
 	0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0c, 0x68, 0x65, 0x61,
 	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x68, 0x65, 0x61, 0x64,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xea, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x2f, 0x0a, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x15, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x64, 0x76,
-	0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x61,
-	0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x73, 0x5f, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72,
-	0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x50, 0x72, 0x69, 0x6d, 0x61,
-	0x72, 0x79, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x39, 0x0a,
-	0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x75,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x64, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x64, 0x41, 0x74, 0x22, 0x12, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x40, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2b, 0x0a, 0x06,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x68,
-	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x2f, 0x0a, 0x12, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x04, 0x52, 0x07, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x64, 0x22, 0x15, 0x0a, 0x13, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x30, 0x0a, 0x13, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x6f, 0x75, 0x74,
-	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x72, 0x6f, 0x75, 0x74,
-	0x65, 0x49, 0x64, 0x22, 0x16, 0x0a, 0x14, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x38, 0x0a, 0x17, 0x47,
-	0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x47, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x2b, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x13, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x2f,
-	0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x64, 0x22,
-	0x15, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x29, 0x5a, 0x27, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61, 0x6e, 0x66, 0x6f, 0x6e, 0x74, 0x2f, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x67, 0x6f, 0x2f, 0x76,
-	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x68, 0x65, 0x61, 0x64,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0xe1, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64, 0x12, 0x26, 0x0a,
+	0x04, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x68, 0x65,
+	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x52,
+	0x04, 0x6e, 0x6f, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1e, 0x0a,
+	0x0a, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0a, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x12, 0x18, 0x0a,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x73, 0x5f, 0x70, 0x72,
+	0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x50,
+	0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x64, 0x5f, 0x61, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41,
+	0x74, 0x12, 0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x39, 0x0a, 0x0a,
+	0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x64, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x64, 0x41, 0x74, 0x22, 0x12, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x52, 0x6f,
+	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x40, 0x0a, 0x11, 0x47,
+	0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x2b, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x13, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x2f, 0x0a,
+	0x12, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x64, 0x22, 0x15,
+	0x0a, 0x13, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x30, 0x0a, 0x13, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x64, 0x22, 0x16, 0x0a, 0x14, 0x44, 0x69, 0x73, 0x61, 0x62,
+	0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x2f, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x6e, 0x6f, 0x64, 0x65, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x6e, 0x6f, 0x64, 0x65, 0x49, 0x64,
+	0x22, 0x44, 0x0a, 0x15, 0x47, 0x65, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2b, 0x0a, 0x06, 0x72, 0x6f, 0x75,
+	0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x68, 0x65, 0x61, 0x64,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x06,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x2f, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x64, 0x22, 0x15, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x29,
+	0x5a, 0x27, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61,
+	0x6e, 0x66, 0x6f, 0x6e, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f,
+	0x67, 0x65, 0x6e, 0x2f, 0x67, 0x6f, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }

 var (
@@ -645,27 +644,27 @@ func file_headscale_v1_routes_proto_rawDescGZIP() []byte {

 var file_headscale_v1_routes_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_headscale_v1_routes_proto_goTypes = []interface{}{
-	(*Route)(nil),                    // 0: headscale.v1.Route
-	(*GetRoutesRequest)(nil),         // 1: headscale.v1.GetRoutesRequest
-	(*GetRoutesResponse)(nil),        // 2: headscale.v1.GetRoutesResponse
-	(*EnableRouteRequest)(nil),       // 3: headscale.v1.EnableRouteRequest
-	(*EnableRouteResponse)(nil),      // 4: headscale.v1.EnableRouteResponse
-	(*DisableRouteRequest)(nil),      // 5: headscale.v1.DisableRouteRequest
-	(*DisableRouteResponse)(nil),     // 6: headscale.v1.DisableRouteResponse
-	(*GetMachineRoutesRequest)(nil),  // 7: headscale.v1.GetMachineRoutesRequest
-	(*GetMachineRoutesResponse)(nil), // 8: headscale.v1.GetMachineRoutesResponse
-	(*DeleteRouteRequest)(nil),       // 9: headscale.v1.DeleteRouteRequest
-	(*DeleteRouteResponse)(nil),      // 10: headscale.v1.DeleteRouteResponse
-	(*Machine)(nil),                  // 11: headscale.v1.Machine
-	(*timestamppb.Timestamp)(nil),    // 12: google.protobuf.Timestamp
+	(*Route)(nil),                 // 0: headscale.v1.Route
+	(*GetRoutesRequest)(nil),      // 1: headscale.v1.GetRoutesRequest
+	(*GetRoutesResponse)(nil),     // 2: headscale.v1.GetRoutesResponse
+	(*EnableRouteRequest)(nil),    // 3: headscale.v1.EnableRouteRequest
+	(*EnableRouteResponse)(nil),   // 4: headscale.v1.EnableRouteResponse
+	(*DisableRouteRequest)(nil),   // 5: headscale.v1.DisableRouteRequest
+	(*DisableRouteResponse)(nil),  // 6: headscale.v1.DisableRouteResponse
+	(*GetNodeRoutesRequest)(nil),  // 7: headscale.v1.GetNodeRoutesRequest
+	(*GetNodeRoutesResponse)(nil), // 8: headscale.v1.GetNodeRoutesResponse
+	(*DeleteRouteRequest)(nil),    // 9: headscale.v1.DeleteRouteRequest
+	(*DeleteRouteResponse)(nil),   // 10: headscale.v1.DeleteRouteResponse
+	(*Node)(nil),                  // 11: headscale.v1.Node
+	(*timestamppb.Timestamp)(nil), // 12: google.protobuf.Timestamp
 }
 var file_headscale_v1_routes_proto_depIdxs = []int32{
-	11, // 0: headscale.v1.Route.machine:type_name -> headscale.v1.Machine
+	11, // 0: headscale.v1.Route.node:type_name -> headscale.v1.Node
 	12, // 1: headscale.v1.Route.created_at:type_name -> google.protobuf.Timestamp
 	12, // 2: headscale.v1.Route.updated_at:type_name -> google.protobuf.Timestamp
 	12, // 3: headscale.v1.Route.deleted_at:type_name -> google.protobuf.Timestamp
 	0,  // 4: headscale.v1.GetRoutesResponse.routes:type_name -> headscale.v1.Route
-	0,  // 5: headscale.v1.GetMachineRoutesResponse.routes:type_name -> headscale.v1.Route
+	0,  // 5: headscale.v1.GetNodeRoutesResponse.routes:type_name -> headscale.v1.Route
 	6,  // [6:6] is the sub-list for method output_type
 	6,  // [6:6] is the sub-list for method input_type
 	6,  // [6:6] is the sub-list for extension type_name
@@ -678,7 +677,7 @@ func file_headscale_v1_routes_proto_init() {
 	if File_headscale_v1_routes_proto != nil {
 		return
 	}
-	file_headscale_v1_machine_proto_init()
+	file_headscale_v1_node_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_headscale_v1_routes_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Route); i {
@@ -765,7 +764,7 @@ func file_headscale_v1_routes_proto_init() {
 			}
 		}
 		file_headscale_v1_routes_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMachineRoutesRequest); i {
+			switch v := v.(*GetNodeRoutesRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -777,7 +776,7 @@ func file_headscale_v1_routes_proto_init() {
 			}
 		}
 		file_headscale_v1_routes_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMachineRoutesResponse); i {
+			switch v := v.(*GetNodeRoutesResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
+// 	protoc-gen-go v1.29.1
 // 	protoc        (unknown)
 // source: headscale/v1/user.proto

@@ -101,15 +101,15 @@
        ]
      }
    },
-    "/api/v1/debug/machine": {
+    "/api/v1/debug/node": {
      "post": {
-        "summary": "--- Machine start ---",
-        "operationId": "HeadscaleService_DebugCreateMachine",
+        "summary": "--- Node start ---",
+        "operationId": "HeadscaleService_DebugCreateNode",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1DebugCreateMachineResponse"
+              "$ref": "#/definitions/v1DebugCreateNodeResponse"
            }
          },
          "default": {
@@ -125,7 +125,7 @@
            "in": "body",
            "required": true,
            "schema": {
-              "$ref": "#/definitions/v1DebugCreateMachineRequest"
+              "$ref": "#/definitions/v1DebugCreateNodeRequest"
            }
          }
        ],
@@ -134,14 +134,14 @@
        ]
      }
    },
-    "/api/v1/machine": {
+    "/api/v1/node": {
      "get": {
-        "operationId": "HeadscaleService_ListMachines",
+        "operationId": "HeadscaleService_ListNodes",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1ListMachinesResponse"
+              "$ref": "#/definitions/v1ListNodesResponse"
            }
          },
          "default": {
@@ -164,14 +164,14 @@
        ]
      }
    },
-    "/api/v1/machine/register": {
+    "/api/v1/node/register": {
      "post": {
-        "operationId": "HeadscaleService_RegisterMachine",
+        "operationId": "HeadscaleService_RegisterNode",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1RegisterMachineResponse"
+              "$ref": "#/definitions/v1RegisterNodeResponse"
            }
          },
          "default": {
@@ -200,14 +200,14 @@
        ]
      }
    },
-    "/api/v1/machine/{machineId}": {
+    "/api/v1/node/{nodeId}": {
      "get": {
-        "operationId": "HeadscaleService_GetMachine",
+        "operationId": "HeadscaleService_GetNode",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1GetMachineResponse"
+              "$ref": "#/definitions/v1GetNodeResponse"
            }
          },
          "default": {
@@ -219,7 +219,7 @@
        },
        "parameters": [
          {
-            "name": "machineId",
+            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string",
@@ -231,12 +231,12 @@
        ]
      },
      "delete": {
-        "operationId": "HeadscaleService_DeleteMachine",
+        "operationId": "HeadscaleService_DeleteNode",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1DeleteMachineResponse"
+              "$ref": "#/definitions/v1DeleteNodeResponse"
            }
          },
          "default": {
@@ -248,7 +248,7 @@
        },
        "parameters": [
          {
-            "name": "machineId",
+            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string",
@@ -260,14 +260,14 @@
        ]
      }
    },
-    "/api/v1/machine/{machineId}/expire": {
+    "/api/v1/node/{nodeId}/expire": {
      "post": {
-        "operationId": "HeadscaleService_ExpireMachine",
+        "operationId": "HeadscaleService_ExpireNode",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1ExpireMachineResponse"
+              "$ref": "#/definitions/v1ExpireNodeResponse"
            }
          },
          "default": {
@@ -279,7 +279,7 @@
        },
        "parameters": [
          {
-            "name": "machineId",
+            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string",
@@ -291,14 +291,14 @@
        ]
      }
    },
-    "/api/v1/machine/{machineId}/rename/{newName}": {
+    "/api/v1/node/{nodeId}/rename/{newName}": {
      "post": {
-        "operationId": "HeadscaleService_RenameMachine",
+        "operationId": "HeadscaleService_RenameNode",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1RenameMachineResponse"
+              "$ref": "#/definitions/v1RenameNodeResponse"
            }
          },
          "default": {
@@ -310,7 +310,7 @@
        },
        "parameters": [
          {
-            "name": "machineId",
+            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string",
@@ -328,14 +328,14 @@
        ]
      }
    },
-    "/api/v1/machine/{machineId}/routes": {
+    "/api/v1/node/{nodeId}/routes": {
      "get": {
-        "operationId": "HeadscaleService_GetMachineRoutes",
+        "operationId": "HeadscaleService_GetNodeRoutes",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1GetMachineRoutesResponse"
+              "$ref": "#/definitions/v1GetNodeRoutesResponse"
            }
          },
          "default": {
@@ -347,7 +347,7 @@
        },
        "parameters": [
          {
-            "name": "machineId",
+            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string",
@@ -359,7 +359,7 @@
        ]
      }
    },
-    "/api/v1/machine/{machineId}/tags": {
+    "/api/v1/node/{nodeId}/tags": {
      "post": {
        "operationId": "HeadscaleService_SetTags",
        "responses": {
@@ -378,7 +378,7 @@
        },
        "parameters": [
          {
-            "name": "machineId",
+            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string",
@@ -406,14 +406,14 @@
        ]
      }
    },
-    "/api/v1/machine/{machineId}/user": {
+    "/api/v1/node/{nodeId}/user": {
      "post": {
-        "operationId": "HeadscaleService_MoveMachine",
+        "operationId": "HeadscaleService_MoveNode",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1MoveMachineResponse"
+              "$ref": "#/definitions/v1MoveNodeResponse"
            }
          },
          "default": {
@@ -425,7 +425,7 @@
        },
        "parameters": [
          {
-            "name": "machineId",
+            "name": "nodeId",
            "in": "path",
            "required": true,
            "type": "string",
@@ -917,7 +917,7 @@
        }
      }
    },
-    "v1DebugCreateMachineRequest": {
+    "v1DebugCreateNodeRequest": {
      "type": "object",
      "properties": {
        "user": {
@@ -937,15 +937,15 @@
        }
      }
    },
-    "v1DebugCreateMachineResponse": {
+    "v1DebugCreateNodeResponse": {
      "type": "object",
      "properties": {
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
+        "node": {
+          "$ref": "#/definitions/v1Node"
        }
      }
    },
-    "v1DeleteMachineResponse": {
+    "v1DeleteNodeResponse": {
      "type": "object"
    },
    "v1DeleteRouteResponse": {
@@ -971,11 +971,11 @@
    "v1ExpireApiKeyResponse": {
      "type": "object"
    },
-    "v1ExpireMachineResponse": {
+    "v1ExpireNodeResponse": {
      "type": "object",
      "properties": {
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
+        "node": {
+          "$ref": "#/definitions/v1Node"
        }
      }
    },
@@ -993,15 +993,15 @@
    "v1ExpirePreAuthKeyResponse": {
      "type": "object"
    },
-    "v1GetMachineResponse": {
+    "v1GetNodeResponse": {
      "type": "object",
      "properties": {
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
+        "node": {
+          "$ref": "#/definitions/v1Node"
        }
      }
    },
-    "v1GetMachineRoutesResponse": {
+    "v1GetNodeRoutesResponse": {
      "type": "object",
      "properties": {
        "routes": {
@@ -1042,13 +1042,13 @@
        }
      }
    },
-    "v1ListMachinesResponse": {
+    "v1ListNodesResponse": {
      "type": "object",
      "properties": {
-        "machines": {
+        "nodes": {
          "type": "array",
          "items": {
-            "$ref": "#/definitions/v1Machine"
+            "$ref": "#/definitions/v1Node"
          }
        }
      }
@@ -1075,7 +1075,15 @@
        }
      }
    },
-    "v1Machine": {
+    "v1MoveNodeResponse": {
+      "type": "object",
+      "properties": {
+        "node": {
+          "$ref": "#/definitions/v1Node"
+        }
+      }
+    },
+    "v1Node": {
      "type": "object",
      "properties": {
        "id": {
@@ -1151,14 +1159,6 @@
        }
      }
    },
-    "v1MoveMachineResponse": {
-      "type": "object",
-      "properties": {
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
-        }
-      }
-    },
    "v1PreAuthKey": {
      "type": "object",
      "properties": {
@@ -1196,14 +1196,6 @@
        }
      }
    },
-    "v1RegisterMachineResponse": {
-      "type": "object",
-      "properties": {
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
-        }
-      }
-    },
    "v1RegisterMethod": {
      "type": "string",
      "enum": [
@@ -1214,11 +1206,19 @@
      ],
      "default": "REGISTER_METHOD_UNSPECIFIED"
    },
-    "v1RenameMachineResponse": {
+    "v1RegisterNodeResponse": {
      "type": "object",
      "properties": {
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
+        "node": {
+          "$ref": "#/definitions/v1Node"
+        }
+      }
+    },
+    "v1RenameNodeResponse": {
+      "type": "object",
+      "properties": {
+        "node": {
+          "$ref": "#/definitions/v1Node"
        }
      }
    },
@@ -1237,8 +1237,8 @@
          "type": "string",
          "format": "uint64"
        },
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
+        "node": {
+          "$ref": "#/definitions/v1Node"
        },
        "prefix": {
          "type": "string"
@@ -1269,8 +1269,8 @@
    "v1SetTagsResponse": {
      "type": "object",
      "properties": {
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
+        "node": {
+          "$ref": "#/definitions/v1Node"
        }
      }
    },
@@ -1,7 +1,7 @@
 {
  "swagger": "2.0",
  "info": {
-    "title": "headscale/v1/machine.proto",
+    "title": "headscale/v1/node.proto",
    "version": "version not set"
  },
  "consumes": [
@@ -64,6 +64,7 @@ require (
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/felixge/fgprof v0.9.3 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
 	github.com/glebarez/go-sqlite v1.20.3 // indirect
@@ -75,6 +76,7 @@ require (
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/go-github v17.0.0+incompatible // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/gookit/color v1.5.3 // indirect
@@ -111,6 +113,7 @@ require (
 	github.com/opencontainers/runc v1.1.4 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.3.0 // indirect
 	github.com/prometheus/procfs v0.9.0 // indirect
@@ -129,6 +129,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
+github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
@@ -238,7 +240,9 @@ github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
+github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
@@ -272,6 +276,7 @@ github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/ianlancetaylor/demangle v0.0.0-20210905161508-09a460cdf81d/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
 github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -384,6 +389,8 @@ github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsK
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
+github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -669,6 +676,7 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211013075003-97ac67df715c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -164,16 +164,16 @@ func (api headscaleV1APIServer) ListPreAuthKeys(
 	return &v1.ListPreAuthKeysResponse{PreAuthKeys: response}, nil
 }

-func (api headscaleV1APIServer) RegisterMachine(
+func (api headscaleV1APIServer) RegisterNode(
 	ctx context.Context,
-	request *v1.RegisterMachineRequest,
-) (*v1.RegisterMachineResponse, error) {
+	request *v1.RegisterNodeRequest,
+) (*v1.RegisterNodeResponse, error) {
 	log.Trace().
 		Str("user", request.GetUser()).
 		Str("node_key", request.GetKey()).
-		Msg("Registering machine")
+		Msg("Registering node")

-	machine, err := api.h.RegisterMachineFromAuthCallback(
+	node, err := api.h.RegisterNodeFromAuthCallback(
 		request.GetKey(),
 		request.GetUser(),
 		nil,
@@ -183,26 +183,26 @@ func (api headscaleV1APIServer) RegisterMachine(
 		return nil, err
 	}

-	return &v1.RegisterMachineResponse{Machine: machine.toProto()}, nil
+	return &v1.RegisterNodeResponse{Node: node.toProto()}, nil
 }

-func (api headscaleV1APIServer) GetMachine(
+func (api headscaleV1APIServer) GetNode(
 	ctx context.Context,
-	request *v1.GetMachineRequest,
-) (*v1.GetMachineResponse, error) {
-	machine, err := api.h.GetMachineByID(request.GetMachineId())
+	request *v1.GetNodeRequest,
+) (*v1.GetNodeResponse, error) {
+	node, err := api.h.GetNodeByID(request.GetNodeId())
 	if err != nil {
 		return nil, err
 	}

-	return &v1.GetMachineResponse{Machine: machine.toProto()}, nil
+	return &v1.GetNodeResponse{Node: node.toProto()}, nil
 }

 func (api headscaleV1APIServer) SetTags(
 	ctx context.Context,
 	request *v1.SetTagsRequest,
 ) (*v1.SetTagsResponse, error) {
-	machine, err := api.h.GetMachineByID(request.GetMachineId())
+	node, err := api.h.GetNodeByID(request.GetNodeId())
 	if err != nil {
 		return nil, err
 	}
@@ -211,24 +211,24 @@ func (api headscaleV1APIServer) SetTags(
 		err := validateTag(tag)
 		if err != nil {
 			return &v1.SetTagsResponse{
-				Machine: nil,
+				Node: nil,
 			}, status.Error(codes.InvalidArgument, err.Error())
 		}
 	}

-	err = api.h.SetTags(machine, request.GetTags())
+	err = api.h.SetTags(node, request.GetTags())
 	if err != nil {
 		return &v1.SetTagsResponse{
-			Machine: nil,
+			Node: nil,
 		}, status.Error(codes.Internal, err.Error())
 	}

 	log.Trace().
-		Str("machine", machine.Hostname).
+		Str("node", node.Hostname).
 		Strs("tags", request.GetTags()).
-		Msg("Changing tags of machine")
+		Msg("Changing tags of node")

-	return &v1.SetTagsResponse{Machine: machine.toProto()}, nil
+	return &v1.SetTagsResponse{Node: node.toProto()}, nil
 }

 func validateTag(tag string) error {
@@ -244,57 +244,57 @@ func validateTag(tag string) error {
 	return nil
 }

-func (api headscaleV1APIServer) DeleteMachine(
+func (api headscaleV1APIServer) DeleteNode(
 	ctx context.Context,
-	request *v1.DeleteMachineRequest,
-) (*v1.DeleteMachineResponse, error) {
-	machine, err := api.h.GetMachineByID(request.GetMachineId())
+	request *v1.DeleteNodeRequest,
+) (*v1.DeleteNodeResponse, error) {
+	node, err := api.h.GetNodeByID(request.GetNodeId())
 	if err != nil {
 		return nil, err
 	}

-	err = api.h.DeleteMachine(
-		machine,
+	err = api.h.DeleteNode(
+		node,
 	)
 	if err != nil {
 		return nil, err
 	}

-	return &v1.DeleteMachineResponse{}, nil
+	return &v1.DeleteNodeResponse{}, nil
 }

-func (api headscaleV1APIServer) ExpireMachine(
+func (api headscaleV1APIServer) ExpireNode(
 	ctx context.Context,
-	request *v1.ExpireMachineRequest,
-) (*v1.ExpireMachineResponse, error) {
-	machine, err := api.h.GetMachineByID(request.GetMachineId())
+	request *v1.ExpireNodeRequest,
+) (*v1.ExpireNodeResponse, error) {
+	node, err := api.h.GetNodeByID(request.GetNodeId())
 	if err != nil {
 		return nil, err
 	}

-	api.h.ExpireMachine(
-		machine,
+	api.h.ExpireNode(
+		node,
 	)

 	log.Trace().
-		Str("machine", machine.Hostname).
-		Time("expiry", *machine.Expiry).
-		Msg("machine expired")
+		Str("node", node.Hostname).
+		Time("expiry", *node.Expiry).
+		Msg("node expired")

-	return &v1.ExpireMachineResponse{Machine: machine.toProto()}, nil
+	return &v1.ExpireNodeResponse{Node: node.toProto()}, nil
 }

-func (api headscaleV1APIServer) RenameMachine(
+func (api headscaleV1APIServer) RenameNode(
 	ctx context.Context,
-	request *v1.RenameMachineRequest,
-) (*v1.RenameMachineResponse, error) {
-	machine, err := api.h.GetMachineByID(request.GetMachineId())
+	request *v1.RenameNodeRequest,
+) (*v1.RenameNodeResponse, error) {
+	node, err := api.h.GetNodeByID(request.GetNodeId())
 	if err != nil {
 		return nil, err
 	}

-	err = api.h.RenameMachine(
-		machine,
+	err = api.h.RenameNode(
+		node,
 		request.GetNewName(),
 	)
 	if err != nil {
@@ -302,42 +302,42 @@ func (api headscaleV1APIServer) RenameMachine(
 	}

 	log.Trace().
-		Str("machine", machine.Hostname).
+		Str("node", node.Hostname).
 		Str("new_name", request.GetNewName()).
-		Msg("machine renamed")
+		Msg("node renamed")

-	return &v1.RenameMachineResponse{Machine: machine.toProto()}, nil
+	return &v1.RenameNodeResponse{Node: node.toProto()}, nil
 }

-func (api headscaleV1APIServer) ListMachines(
+func (api headscaleV1APIServer) ListNodes(
 	ctx context.Context,
-	request *v1.ListMachinesRequest,
-) (*v1.ListMachinesResponse, error) {
+	request *v1.ListNodesRequest,
+) (*v1.ListNodesResponse, error) {
 	if request.GetUser() != "" {
-		machines, err := api.h.ListMachinesByUser(request.GetUser())
+		nodes, err := api.h.ListNodesByUser(request.GetUser())
 		if err != nil {
 			return nil, err
 		}

-		response := make([]*v1.Machine, len(machines))
-		for index, machine := range machines {
-			response[index] = machine.toProto()
+		response := make([]*v1.Node, len(nodes))
+		for index, node := range nodes {
+			response[index] = node.toProto()
 		}

-		return &v1.ListMachinesResponse{Machines: response}, nil
+		return &v1.ListNodesResponse{Nodes: response}, nil
 	}

-	machines, err := api.h.ListMachines()
+	nodes, err := api.h.ListNodes()
 	if err != nil {
 		return nil, err
 	}

-	response := make([]*v1.Machine, len(machines))
-	for index, machine := range machines {
-		m := machine.toProto()
+	response := make([]*v1.Node, len(nodes))
+	for index, node := range nodes {
+		m := node.toProto()
 		validTags, invalidTags := getTags(
 			api.h.aclPolicy,
-			machine,
+			node,
 			api.h.cfg.OIDC.StripEmaildomain,
 		)
 		m.InvalidTags = invalidTags
@@ -345,24 +345,24 @@ func (api headscaleV1APIServer) ListMachines(
 		response[index] = m
 	}

-	return &v1.ListMachinesResponse{Machines: response}, nil
+	return &v1.ListNodesResponse{Nodes: response}, nil
 }

-func (api headscaleV1APIServer) MoveMachine(
+func (api headscaleV1APIServer) MoveNode(
 	ctx context.Context,
-	request *v1.MoveMachineRequest,
-) (*v1.MoveMachineResponse, error) {
-	machine, err := api.h.GetMachineByID(request.GetMachineId())
+	request *v1.MoveNodeRequest,
+) (*v1.MoveNodeResponse, error) {
+	node, err := api.h.GetNodeByID(request.GetNodeId())
 	if err != nil {
 		return nil, err
 	}

-	err = api.h.SetMachineUser(machine, request.GetUser())
+	err = api.h.SetNodeUser(node, request.GetUser())
 	if err != nil {
 		return nil, err
 	}

-	return &v1.MoveMachineResponse{Machine: machine.toProto()}, nil
+	return &v1.MoveNodeResponse{Node: node.toProto()}, nil
 }

 func (api headscaleV1APIServer) GetRoutes(
@@ -403,21 +403,21 @@ func (api headscaleV1APIServer) DisableRoute(
 	return &v1.DisableRouteResponse{}, nil
 }

-func (api headscaleV1APIServer) GetMachineRoutes(
+func (api headscaleV1APIServer) GetNodeRoutes(
 	ctx context.Context,
-	request *v1.GetMachineRoutesRequest,
-) (*v1.GetMachineRoutesResponse, error) {
-	machine, err := api.h.GetMachineByID(request.GetMachineId())
+	request *v1.GetNodeRoutesRequest,
+) (*v1.GetNodeRoutesResponse, error) {
+	node, err := api.h.GetNodeByID(request.GetNodeId())
 	if err != nil {
 		return nil, err
 	}

-	routes, err := api.h.GetMachineRoutes(machine)
+	routes, err := api.h.GetNodeRoutes(node)
 	if err != nil {
 		return nil, err
 	}

-	return &v1.GetMachineRoutesResponse{
+	return &v1.GetNodeRoutesResponse{
 		Routes: Routes(routes).toProto(),
 	}, nil
 }
@@ -491,10 +491,10 @@ func (api headscaleV1APIServer) ListApiKeys(
 }

 // The following service calls are for testing and debugging
-func (api headscaleV1APIServer) DebugCreateMachine(
+func (api headscaleV1APIServer) DebugCreateNode(
 	ctx context.Context,
-	request *v1.DebugCreateMachineRequest,
-) (*v1.DebugCreateMachineResponse, error) {
+	request *v1.DebugCreateNodeRequest,
+) (*v1.DebugCreateNodeResponse, error) {
 	user, err := api.h.GetUser(request.GetUser())
 	if err != nil {
 		return nil, err
@@ -514,7 +514,7 @@ func (api headscaleV1APIServer) DebugCreateMachine(
 	hostinfo := tailcfg.Hostinfo{
 		RoutableIPs: routes,
 		OS:          "TestOS",
-		Hostname:    "DebugTestMachine",
+		Hostname:    "DebugTestNode",
 	}

 	givenName, err := api.h.GenerateGivenName(request.GetKey(), request.GetName())
@@ -522,7 +522,7 @@ func (api headscaleV1APIServer) DebugCreateMachine(
 		return nil, err
 	}

-	newMachine := Machine{
+	newNode := Node{
 		MachineKey: request.GetKey(),
 		Hostname:   request.GetName(),
 		GivenName:  givenName,
@@ -538,16 +538,16 @@ func (api headscaleV1APIServer) DebugCreateMachine(
 	nodeKey := key.NodePublic{}
 	err = nodeKey.UnmarshalText([]byte(request.GetKey()))
 	if err != nil {
-		log.Panic().Msg("can not add machine for debug. invalid node key")
+		log.Panic().Msg("can not add node for debug. invalid node key")
 	}

 	api.h.registrationCache.Set(
 		NodePublicKeyStripPrefix(nodeKey),
-		newMachine,
+		newNode,
 		registerCacheExpiration,
 	)

-	return &v1.DebugCreateMachineResponse{Machine: newMachine.toProto()}, nil
+	return &v1.DebugCreateNodeResponse{Node: newNode.toProto()}, nil
 }

 func (api headscaleV1APIServer) mustEmbedUnimplementedHeadscaleServiceServer() {}
@@ -12,16 +12,14 @@ import (
 	"github.com/stretchr/testify/assert"
 )

-const numberOfTestClients = 2
-
-func aclScenario(t *testing.T, policy headscale.ACLPolicy) *Scenario {
+func aclScenario(t *testing.T, policy *headscale.ACLPolicy, clientsPerUser int) *Scenario {
 	t.Helper()
 	scenario, err := NewScenario()
 	assert.NoError(t, err)

 	spec := map[string]int{
-		"user1": numberOfTestClients,
-		"user2": numberOfTestClients,
+		"user1": clientsPerUser,
+		"user2": clientsPerUser,
 	}

 	err = scenario.CreateHeadscaleEnv(spec,
@@ -29,18 +27,15 @@ func aclScenario(t *testing.T, policy headscale.ACLPolicy) *Scenario {
 			tsic.WithDockerEntrypoint([]string{
 				"/bin/bash",
 				"-c",
-				"/bin/sleep 3 ; update-ca-certificates ; python3 -m http.server 80 & tailscaled --tun=tsdev",
+				"/bin/sleep 3 ; update-ca-certificates ; python3 -m http.server --bind :: 80 & tailscaled --tun=tsdev",
 			}),
 			tsic.WithDockerWorkdir("/"),
 		},
-		hsic.WithACLPolicy(&policy),
+		hsic.WithACLPolicy(policy),
 		hsic.WithTestName("acl"),
 	)
 	assert.NoError(t, err)

-	// allClients, err := scenario.ListTailscaleClients()
-	// assert.NoError(t, err)
-
 	err = scenario.WaitForTailscaleSync()
 	assert.NoError(t, err)

@@ -224,13 +219,13 @@ func TestACLHostsInNetMapTable(t *testing.T) {
 // Test to confirm that we can use user:80 from one user
 // This should make the node appear in the peer list, but
 // disallow ping.
-// This ACL will not allow user1 access its own machines.
+// This ACL will not allow user1 access its own nodes.
 // Reported: https://github.com/juanfont/headscale/issues/699
 func TestACLAllowUser80Dst(t *testing.T) {
 	IntegrationSkip(t)

 	scenario := aclScenario(t,
-		headscale.ACLPolicy{
+		&headscale.ACLPolicy{
 			ACLs: []headscale.ACL{
 				{
 					Action:       "accept",
@@ -239,6 +234,7 @@ func TestACLAllowUser80Dst(t *testing.T) {
 				},
 			},
 		},
+		1,
 	)

 	user1Clients, err := scenario.ListTailscaleClients("user1")
@@ -285,7 +281,7 @@ func TestACLDenyAllPort80(t *testing.T) {
 	IntegrationSkip(t)

 	scenario := aclScenario(t,
-		headscale.ACLPolicy{
+		&headscale.ACLPolicy{
 			Groups: map[string][]string{
 				"group:integration-acl-test": {"user1", "user2"},
 			},
@@ -297,6 +293,7 @@ func TestACLDenyAllPort80(t *testing.T) {
 				},
 			},
 		},
+		4,
 	)

 	allClients, err := scenario.ListTailscaleClients()
@@ -327,13 +324,13 @@ func TestACLDenyAllPort80(t *testing.T) {
 }

 // Test to confirm that we can use user:* from one user.
-// This ACL will not allow user1 access its own machines.
+// This ACL will not allow user1 access its own nodes.
 // Reported: https://github.com/juanfont/headscale/issues/699
 func TestACLAllowUserDst(t *testing.T) {
 	IntegrationSkip(t)

 	scenario := aclScenario(t,
-		headscale.ACLPolicy{
+		&headscale.ACLPolicy{
 			ACLs: []headscale.ACL{
 				{
 					Action:       "accept",
@@ -342,6 +339,7 @@ func TestACLAllowUserDst(t *testing.T) {
 				},
 			},
 		},
+		2,
 	)

 	user1Clients, err := scenario.ListTailscaleClients("user1")
@@ -390,7 +388,7 @@ func TestACLAllowStarDst(t *testing.T) {
 	IntegrationSkip(t)

 	scenario := aclScenario(t,
-		headscale.ACLPolicy{
+		&headscale.ACLPolicy{
 			ACLs: []headscale.ACL{
 				{
 					Action:       "accept",
@@ -399,6 +397,7 @@ func TestACLAllowStarDst(t *testing.T) {
 				},
 			},
 		},
+		2,
 	)

 	user1Clients, err := scenario.ListTailscaleClients("user1")
@@ -441,155 +440,6 @@ func TestACLAllowStarDst(t *testing.T) {
 	assert.NoError(t, err)
 }

-// This test aims to cover cases where individual hosts are allowed and denied
-// access based on their assigned hostname
-// https://github.com/juanfont/headscale/issues/941
-
-//	ACL = [{
-//			"DstPorts": [{
-//				"Bits": null,
-//				"IP": "100.64.0.3/32",
-//				"Ports": {
-//					"First": 0,
-//					"Last": 65535
-//				}
-//			}],
-//			"SrcIPs": ["*"]
-//		}, {
-//
-//			"DstPorts": [{
-//				"Bits": null,
-//				"IP": "100.64.0.2/32",
-//				"Ports": {
-//					"First": 0,
-//					"Last": 65535
-//				}
-//			}],
-//			"SrcIPs": ["100.64.0.1/32"]
-//		}]
-//
-//	ACL Cache Map= {
-//		"*": {
-//			"100.64.0.3/32": {}
-//		},
-//		"100.64.0.1/32": {
-//			"100.64.0.2/32": {}
-//		}
-//	}
-func TestACLNamedHostsCanReach(t *testing.T) {
-	IntegrationSkip(t)
-
-	scenario := aclScenario(t,
-		headscale.ACLPolicy{
-			Hosts: headscale.Hosts{
-				"test1": netip.MustParsePrefix("100.64.0.1/32"),
-				"test2": netip.MustParsePrefix("100.64.0.2/32"),
-				"test3": netip.MustParsePrefix("100.64.0.3/32"),
-			},
-			ACLs: []headscale.ACL{
-				// Everyone can curl test3
-				{
-					Action:       "accept",
-					Sources:      []string{"*"},
-					Destinations: []string{"test3:*"},
-				},
-				// test1 can curl test2
-				{
-					Action:       "accept",
-					Sources:      []string{"test1"},
-					Destinations: []string{"test2:*"},
-				},
-			},
-		},
-	)
-
-	// Since user/users dont matter here, we basically expect that some clients
-	// will be assigned these ips and that we can pick them up for our own use.
-	test1ip := netip.MustParseAddr("100.64.0.1")
-	test1, err := scenario.FindTailscaleClientByIP(test1ip)
-	assert.NoError(t, err)
-
-	test1fqdn, err := test1.FQDN()
-	assert.NoError(t, err)
-	test1ipURL := fmt.Sprintf("http://%s/etc/hostname", test1ip.String())
-	test1fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test1fqdn)
-
-	test2ip := netip.MustParseAddr("100.64.0.2")
-	test2, err := scenario.FindTailscaleClientByIP(test2ip)
-	assert.NoError(t, err)
-
-	test2fqdn, err := test2.FQDN()
-	assert.NoError(t, err)
-	test2ipURL := fmt.Sprintf("http://%s/etc/hostname", test2ip.String())
-	test2fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test2fqdn)
-
-	test3ip := netip.MustParseAddr("100.64.0.3")
-	test3, err := scenario.FindTailscaleClientByIP(test3ip)
-	assert.NoError(t, err)
-
-	test3fqdn, err := test3.FQDN()
-	assert.NoError(t, err)
-	test3ipURL := fmt.Sprintf("http://%s/etc/hostname", test3ip.String())
-	test3fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test3fqdn)
-
-	// test1 can query test3
-	result, err := test1.Curl(test3ipURL)
-	assert.Len(t, result, 13)
-	assert.NoError(t, err)
-
-	result, err = test1.Curl(test3fqdnURL)
-	assert.Len(t, result, 13)
-	assert.NoError(t, err)
-
-	// test2 can query test3
-	result, err = test2.Curl(test3ipURL)
-	assert.Len(t, result, 13)
-	assert.NoError(t, err)
-
-	result, err = test2.Curl(test3fqdnURL)
-	assert.Len(t, result, 13)
-	assert.NoError(t, err)
-
-	// test3 cannot query test1
-	result, err = test3.Curl(test1ipURL)
-	assert.Empty(t, result)
-	assert.Error(t, err)
-
-	result, err = test3.Curl(test1fqdnURL)
-	assert.Empty(t, result)
-	assert.Error(t, err)
-
-	// test3 cannot query test2
-	result, err = test3.Curl(test2ipURL)
-	assert.Empty(t, result)
-	assert.Error(t, err)
-
-	result, err = test3.Curl(test2fqdnURL)
-	assert.Empty(t, result)
-	assert.Error(t, err)
-
-	// test1 can query test2
-	result, err = test1.Curl(test2ipURL)
-	assert.Len(t, result, 13)
-	assert.NoError(t, err)
-
-	result, err = test1.Curl(test2fqdnURL)
-	assert.Len(t, result, 13)
-	assert.NoError(t, err)
-
-	// test2 cannot query test1
-	result, err = test2.Curl(test1ipURL)
-	assert.Empty(t, result)
-	assert.Error(t, err)
-
-	result, err = test2.Curl(test1fqdnURL)
-	assert.Empty(t, result)
-	assert.Error(t, err)
-
-	err = scenario.Shutdown()
-	assert.NoError(t, err)
-}
-
 // TestACLNamedHostsCanReachBySubnet is the same as
 // TestACLNamedHostsCanReach, but it tests if we expand a
 // full CIDR correctly. All routes should work.
@@ -597,7 +447,7 @@ func TestACLNamedHostsCanReachBySubnet(t *testing.T) {
 	IntegrationSkip(t)

 	scenario := aclScenario(t,
-		headscale.ACLPolicy{
+		&headscale.ACLPolicy{
 			Hosts: headscale.Hosts{
 				"all": netip.MustParsePrefix("100.64.0.0/24"),
 			},
@@ -610,6 +460,7 @@ func TestACLNamedHostsCanReachBySubnet(t *testing.T) {
 				},
 			},
 		},
+		3,
 	)

 	user1Clients, err := scenario.ListTailscaleClients("user1")
@@ -651,3 +502,450 @@ func TestACLNamedHostsCanReachBySubnet(t *testing.T) {
 	err = scenario.Shutdown()
 	assert.NoError(t, err)
 }
+
+// This test aims to cover cases where individual hosts are allowed and denied
+// access based on their assigned hostname
+// https://github.com/juanfont/headscale/issues/941
+//
+//	ACL = [{
+//			"DstPorts": [{
+//				"Bits": null,
+//				"IP": "100.64.0.3/32",
+//				"Ports": {
+//					"First": 0,
+//					"Last": 65535
+//				}
+//			}],
+//			"SrcIPs": ["*"]
+//		}, {
+//
+//			"DstPorts": [{
+//				"Bits": null,
+//				"IP": "100.64.0.2/32",
+//				"Ports": {
+//					"First": 0,
+//					"Last": 65535
+//				}
+//			}],
+//			"SrcIPs": ["100.64.0.1/32"]
+//		}]
+//
+//	ACL Cache Map= {
+//		"*": {
+//			"100.64.0.3/32": {}
+//		},
+//		"100.64.0.1/32": {
+//			"100.64.0.2/32": {}
+//		}
+//	}
+//
+// https://github.com/juanfont/headscale/issues/941
+// Additionally verify ipv6 behaviour, part of
+// https://github.com/juanfont/headscale/issues/809
+func TestACLNamedHostsCanReach(t *testing.T) {
+	IntegrationSkip(t)
+
+	tests := map[string]struct {
+		policy headscale.ACLPolicy
+	}{
+		"ipv4": {
+			policy: headscale.ACLPolicy{
+				Hosts: headscale.Hosts{
+					"test1": netip.MustParsePrefix("100.64.0.1/32"),
+					"test2": netip.MustParsePrefix("100.64.0.2/32"),
+					"test3": netip.MustParsePrefix("100.64.0.3/32"),
+				},
+				ACLs: []headscale.ACL{
+					// Everyone can curl test3
+					{
+						Action:       "accept",
+						Sources:      []string{"*"},
+						Destinations: []string{"test3:*"},
+					},
+					// test1 can curl test2
+					{
+						Action:       "accept",
+						Sources:      []string{"test1"},
+						Destinations: []string{"test2:*"},
+					},
+				},
+			},
+		},
+		"ipv6": {
+			policy: headscale.ACLPolicy{
+				Hosts: headscale.Hosts{
+					"test1": netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+					"test2": netip.MustParsePrefix("fd7a:115c:a1e0::2/128"),
+					"test3": netip.MustParsePrefix("fd7a:115c:a1e0::3/128"),
+				},
+				ACLs: []headscale.ACL{
+					// Everyone can curl test3
+					{
+						Action:       "accept",
+						Sources:      []string{"*"},
+						Destinations: []string{"test3:*"},
+					},
+					// test1 can curl test2
+					{
+						Action:       "accept",
+						Sources:      []string{"test1"},
+						Destinations: []string{"test2:*"},
+					},
+				},
+			},
+		},
+	}
+
+	for name, testCase := range tests {
+		t.Run(name, func(t *testing.T) {
+			scenario := aclScenario(t,
+				&testCase.policy,
+				2,
+			)
+
+			// Since user/users dont matter here, we basically expect that some clients
+			// will be assigned these ips and that we can pick them up for our own use.
+			test1ip4 := netip.MustParseAddr("100.64.0.1")
+			test1ip6 := netip.MustParseAddr("fd7a:115c:a1e0::1")
+			test1, err := scenario.FindTailscaleClientByIP(test1ip6)
+			assert.NoError(t, err)
+
+			test1fqdn, err := test1.FQDN()
+			assert.NoError(t, err)
+			test1ip4URL := fmt.Sprintf("http://%s/etc/hostname", test1ip4.String())
+			test1ip6URL := fmt.Sprintf("http://[%s]/etc/hostname", test1ip6.String())
+			test1fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test1fqdn)
+
+			test2ip4 := netip.MustParseAddr("100.64.0.2")
+			test2ip6 := netip.MustParseAddr("fd7a:115c:a1e0::2")
+			test2, err := scenario.FindTailscaleClientByIP(test2ip6)
+			assert.NoError(t, err)
+
+			test2fqdn, err := test2.FQDN()
+			assert.NoError(t, err)
+			test2ip4URL := fmt.Sprintf("http://%s/etc/hostname", test2ip4.String())
+			test2ip6URL := fmt.Sprintf("http://[%s]/etc/hostname", test2ip6.String())
+			test2fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test2fqdn)
+
+			test3ip4 := netip.MustParseAddr("100.64.0.3")
+			test3ip6 := netip.MustParseAddr("fd7a:115c:a1e0::3")
+			test3, err := scenario.FindTailscaleClientByIP(test3ip6)
+			assert.NoError(t, err)
+
+			test3fqdn, err := test3.FQDN()
+			assert.NoError(t, err)
+			test3ip4URL := fmt.Sprintf("http://%s/etc/hostname", test3ip4.String())
+			test3ip6URL := fmt.Sprintf("http://[%s]/etc/hostname", test3ip6.String())
+			test3fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test3fqdn)
+
+			// test1 can query test3
+			result, err := test1.Curl(test3ip4URL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test3 with URL %s, expected hostname of 13 chars, got %s",
+				test3ip4URL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test1.Curl(test3ip6URL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test3 with URL %s, expected hostname of 13 chars, got %s",
+				test3ip6URL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test1.Curl(test3fqdnURL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test3 with URL %s, expected hostname of 13 chars, got %s",
+				test3fqdnURL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			// test2 can query test3
+			result, err = test2.Curl(test3ip4URL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test3 with URL %s, expected hostname of 13 chars, got %s",
+				test3ip4URL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test2.Curl(test3ip6URL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test3 with URL %s, expected hostname of 13 chars, got %s",
+				test3ip6URL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test2.Curl(test3fqdnURL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test3 with URL %s, expected hostname of 13 chars, got %s",
+				test3fqdnURL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			// test3 cannot query test1
+			result, err = test3.Curl(test1ip4URL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test3.Curl(test1ip6URL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test3.Curl(test1fqdnURL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			// test3 cannot query test2
+			result, err = test3.Curl(test2ip4URL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test3.Curl(test2ip6URL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test3.Curl(test2fqdnURL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			// test1 can query test2
+			result, err = test1.Curl(test2ip4URL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test2 with URL %s, expected hostname of 13 chars, got %s",
+				test2ip4URL,
+				result,
+			)
+
+			assert.NoError(t, err)
+			result, err = test1.Curl(test2ip6URL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test2 with URL %s, expected hostname of 13 chars, got %s",
+				test2ip6URL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test1.Curl(test2fqdnURL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test2 with URL %s, expected hostname of 13 chars, got %s",
+				test2fqdnURL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			// test2 cannot query test1
+			result, err = test2.Curl(test1ip4URL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test2.Curl(test1ip6URL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test2.Curl(test1fqdnURL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			err = scenario.Shutdown()
+			assert.NoError(t, err)
+		})
+	}
+}
+
+// TestACLDevice1CanAccessDevice2 is a table driven test that aims to test
+// the various ways to achieve a connection between device1 and device2 where
+// device1 can access device2, but not the other way around. This can be
+// viewed as one of the most important tests here as it covers most of the
+// syntax that can be used.
+//
+// Before adding new taste cases, consider if it can be reduced to a case
+// in this function.
+func TestACLDevice1CanAccessDevice2(t *testing.T) {
+	IntegrationSkip(t)
+
+	tests := map[string]struct {
+		policy headscale.ACLPolicy
+	}{
+		"ipv4": {
+			policy: headscale.ACLPolicy{
+				ACLs: []headscale.ACL{
+					{
+						Action:       "accept",
+						Sources:      []string{"100.64.0.1"},
+						Destinations: []string{"100.64.0.2:*"},
+					},
+				},
+			},
+		},
+		"ipv6": {
+			policy: headscale.ACLPolicy{
+				ACLs: []headscale.ACL{
+					{
+						Action:       "accept",
+						Sources:      []string{"fd7a:115c:a1e0::1"},
+						Destinations: []string{"fd7a:115c:a1e0::2:*"},
+					},
+				},
+			},
+		},
+		"hostv4cidr": {
+			policy: headscale.ACLPolicy{
+				Hosts: headscale.Hosts{
+					"test1": netip.MustParsePrefix("100.64.0.1/32"),
+					"test2": netip.MustParsePrefix("100.64.0.2/32"),
+				},
+				ACLs: []headscale.ACL{
+					{
+						Action:       "accept",
+						Sources:      []string{"test1"},
+						Destinations: []string{"test2:*"},
+					},
+				},
+			},
+		},
+		"hostv6cidr": {
+			policy: headscale.ACLPolicy{
+				Hosts: headscale.Hosts{
+					"test1": netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+					"test2": netip.MustParsePrefix("fd7a:115c:a1e0::2/128"),
+				},
+				ACLs: []headscale.ACL{
+					{
+						Action:       "accept",
+						Sources:      []string{"test1"},
+						Destinations: []string{"test2:*"},
+					},
+				},
+			},
+		},
+		"group": {
+			policy: headscale.ACLPolicy{
+				Groups: map[string][]string{
+					"group:one": {"user1"},
+					"group:two": {"user2"},
+				},
+				ACLs: []headscale.ACL{
+					{
+						Action:       "accept",
+						Sources:      []string{"group:one"},
+						Destinations: []string{"group:two:*"},
+					},
+				},
+			},
+		},
+		// TODO(kradalby): Add similar tests for Tags, might need support
+		// in the scenario function when we create or join the clients.
+	}
+
+	for name, testCase := range tests {
+		t.Run(name, func(t *testing.T) {
+			scenario := aclScenario(t, &testCase.policy, 1)
+
+			test1ip := netip.MustParseAddr("100.64.0.1")
+			test1ip6 := netip.MustParseAddr("fd7a:115c:a1e0::1")
+			test1, err := scenario.FindTailscaleClientByIP(test1ip)
+			assert.NotNil(t, test1)
+			assert.NoError(t, err)
+
+			test1fqdn, err := test1.FQDN()
+			assert.NoError(t, err)
+			test1ipURL := fmt.Sprintf("http://%s/etc/hostname", test1ip.String())
+			test1ip6URL := fmt.Sprintf("http://[%s]/etc/hostname", test1ip6.String())
+			test1fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test1fqdn)
+
+			test2ip := netip.MustParseAddr("100.64.0.2")
+			test2ip6 := netip.MustParseAddr("fd7a:115c:a1e0::2")
+			test2, err := scenario.FindTailscaleClientByIP(test2ip)
+			assert.NotNil(t, test2)
+			assert.NoError(t, err)
+
+			test2fqdn, err := test2.FQDN()
+			assert.NoError(t, err)
+			test2ipURL := fmt.Sprintf("http://%s/etc/hostname", test2ip.String())
+			test2ip6URL := fmt.Sprintf("http://[%s]/etc/hostname", test2ip6.String())
+			test2fqdnURL := fmt.Sprintf("http://%s/etc/hostname", test2fqdn)
+
+			// test1 can query test2
+			result, err := test1.Curl(test2ipURL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test with URL %s, expected hostname of 13 chars, got %s",
+				test2ipURL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test1.Curl(test2ip6URL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test with URL %s, expected hostname of 13 chars, got %s",
+				test2ip6URL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test1.Curl(test2fqdnURL)
+			assert.Lenf(
+				t,
+				result,
+				13,
+				"failed to connect from test1 to test with URL %s, expected hostname of 13 chars, got %s",
+				test2fqdnURL,
+				result,
+			)
+			assert.NoError(t, err)
+
+			result, err = test2.Curl(test1ipURL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test2.Curl(test1ip6URL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			result, err = test2.Curl(test1fqdnURL)
+			assert.Empty(t, result)
+			assert.Error(t, err)
+
+			err = scenario.Shutdown()
+			assert.NoError(t, err)
+		})
+	}
+}
@@ -362,6 +362,15 @@ func (s *AuthOIDCScenario) runTailscaleUp(

 		user.joinWaitGroup.Wait()

+		for _, client := range user.Clients {
+			err := client.WaitForReady()
+			if err != nil {
+				log.Printf("client %s was not ready: %s", client.Hostname(), err)
+
+				return fmt.Errorf("failed to up tailscale node: %w", err)
+			}
+		}
+
 		return nil
 	}

@@ -274,6 +274,15 @@ func (s *AuthWebFlowScenario) runTailscaleUp(
 		}
 		user.joinWaitGroup.Wait()

+		for _, client := range user.Clients {
+			err := client.WaitForReady()
+			if err != nil {
+				log.Printf("client %s was not ready: %s", client.Hostname(), err)
+
+				return fmt.Errorf("failed to up tailscale node: %w", err)
+			}
+		}
+
 		return nil
 	}

@@ -2,18 +2,21 @@ package integration

 import (
 	v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
+	"github.com/ory/dockertest/v3"
 )

 type ControlServer interface {
 	Shutdown() error
 	SaveLog(string) error
+	SaveProfile(string) error
 	Execute(command []string) (string, error)
+	ConnectToNetwork(network *dockertest.Network) error
 	GetHealthEndpoint() string
 	GetEndpoint() string
 	WaitForReady() error
 	CreateUser(user string) error
 	CreateAuthKey(user string, reusable bool, ephemeral bool) (*v1.PreAuthKey, error)
-	ListMachinesInUser(user string) ([]*v1.Machine, error)
+	ListNodesInUser(user string) ([]*v1.Node, error)
 	GetCert() []byte
 	GetHostname() string
 	GetIP() string
@@ -0,0 +1,236 @@
+package integration
+
+import (
+	"fmt"
+	"log"
+	"net/url"
+	"testing"
+
+	"github.com/juanfont/headscale"
+	"github.com/juanfont/headscale/integration/dockertestutil"
+	"github.com/juanfont/headscale/integration/hsic"
+	"github.com/juanfont/headscale/integration/tsic"
+	"github.com/ory/dockertest/v3"
+)
+
+type EmbeddedDERPServerScenario struct {
+	*Scenario
+
+	tsicNetworks map[string]*dockertest.Network
+}
+
+func TestDERPServerScenario(t *testing.T) {
+	IntegrationSkip(t)
+	// t.Parallel()
+
+	baseScenario, err := NewScenario()
+	if err != nil {
+		t.Errorf("failed to create scenario: %s", err)
+	}
+
+	scenario := EmbeddedDERPServerScenario{
+		Scenario:     baseScenario,
+		tsicNetworks: map[string]*dockertest.Network{},
+	}
+
+	spec := map[string]int{
+		"user1": len(TailscaleVersions),
+	}
+
+	headscaleConfig := map[string]string{}
+	headscaleConfig["HEADSCALE_DERP_URLS"] = ""
+	headscaleConfig["HEADSCALE_DERP_SERVER_ENABLED"] = "true"
+	headscaleConfig["HEADSCALE_DERP_SERVER_REGION_ID"] = "999"
+	headscaleConfig["HEADSCALE_DERP_SERVER_REGION_CODE"] = "headscale"
+	headscaleConfig["HEADSCALE_DERP_SERVER_REGION_NAME"] = "Headscale Embedded DERP"
+	headscaleConfig["HEADSCALE_DERP_SERVER_STUN_LISTEN_ADDR"] = "0.0.0.0:3478"
+
+	err = scenario.CreateHeadscaleEnv(
+		spec,
+		hsic.WithConfigEnv(headscaleConfig),
+		hsic.WithTestName("derpserver"),
+		hsic.WithExtraPorts([]string{"3478/udp"}),
+		hsic.WithTLS(),
+		hsic.WithHostnameAsServerURL(),
+	)
+
+	if err != nil {
+		t.Errorf("failed to create headscale environment: %s", err)
+	}
+
+	allClients, err := scenario.ListTailscaleClients()
+	if err != nil {
+		t.Errorf("failed to get clients: %s", err)
+	}
+
+	allIps, err := scenario.ListTailscaleClientsIPs()
+	if err != nil {
+		t.Errorf("failed to get clients: %s", err)
+	}
+
+	err = scenario.WaitForTailscaleSync()
+	if err != nil {
+		t.Errorf("failed wait for tailscale clients to be in sync: %s", err)
+	}
+
+	allHostnames, err := scenario.ListTailscaleClientsFQDNs()
+	if err != nil {
+		t.Errorf("failed to get FQDNs: %s", err)
+	}
+
+	success := pingDerpAllHelper(t, allClients, allHostnames)
+
+	t.Logf("%d successful pings out of %d", success, len(allClients)*len(allIps))
+
+	err = scenario.Shutdown()
+	if err != nil {
+		t.Errorf("failed to tear down scenario: %s", err)
+	}
+}
+
+func (s *EmbeddedDERPServerScenario) CreateHeadscaleEnv(
+	users map[string]int,
+	opts ...hsic.Option,
+) error {
+	hsServer, err := s.Headscale(opts...)
+	if err != nil {
+		return err
+	}
+
+	headscaleEndpoint := hsServer.GetEndpoint()
+	headscaleURL, err := url.Parse(headscaleEndpoint)
+	if err != nil {
+		return err
+	}
+
+	headscaleURL.Host = fmt.Sprintf("%s:%s", hsServer.GetHostname(), headscaleURL.Port())
+
+	err = hsServer.WaitForReady()
+	if err != nil {
+		return err
+	}
+
+	hash, err := headscale.GenerateRandomStringDNSSafe(scenarioHashLength)
+	if err != nil {
+		return err
+	}
+
+	for userName, clientCount := range users {
+		err = s.CreateUser(userName)
+		if err != nil {
+			return err
+		}
+
+		err = s.CreateTailscaleIsolatedNodesInUser(
+			hash,
+			userName,
+			"all",
+			clientCount,
+		)
+		if err != nil {
+			return err
+		}
+
+		key, err := s.CreatePreAuthKey(userName, true, false)
+		if err != nil {
+			return err
+		}
+
+		err = s.RunTailscaleUp(userName, headscaleURL.String(), key.GetKey())
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (s *EmbeddedDERPServerScenario) CreateTailscaleIsolatedNodesInUser(
+	hash string,
+	userStr string,
+	requestedVersion string,
+	count int,
+	opts ...tsic.Option,
+) error {
+	hsServer, err := s.Headscale()
+	if err != nil {
+		return err
+	}
+
+	if user, ok := s.users[userStr]; ok {
+		for clientN := 0; clientN < count; clientN++ {
+			networkName := fmt.Sprintf("tsnet-%s-%s-%d",
+				hash,
+				userStr,
+				clientN,
+			)
+			network, err := dockertestutil.GetFirstOrCreateNetwork(
+				s.pool,
+				networkName,
+			)
+			if err != nil {
+				return fmt.Errorf("failed to create or get %s network: %w", networkName, err)
+			}
+
+			s.tsicNetworks[networkName] = network
+
+			err = hsServer.ConnectToNetwork(network)
+			if err != nil {
+				return fmt.Errorf("failed to connect headscale to %s network: %w", networkName, err)
+			}
+
+			version := requestedVersion
+			if requestedVersion == "all" {
+				version = TailscaleVersions[clientN%len(TailscaleVersions)]
+			}
+
+			cert := hsServer.GetCert()
+
+			user.createWaitGroup.Add(1)
+
+			opts = append(opts,
+				tsic.WithHeadscaleTLS(cert),
+			)
+
+			go func() {
+				defer user.createWaitGroup.Done()
+
+				// TODO(kradalby): error handle this
+				tsClient, err := tsic.New(
+					s.pool,
+					version,
+					network,
+					opts...,
+				)
+				if err != nil {
+					// return fmt.Errorf("failed to add tailscale node: %w", err)
+					log.Printf("failed to create tailscale node: %s", err)
+				}
+
+				err = tsClient.WaitForReady()
+				if err != nil {
+					// return fmt.Errorf("failed to add tailscale node: %w", err)
+					log.Printf("failed to wait for tailscaled: %s", err)
+				}
+
+				user.Clients[tsClient.Hostname()] = tsClient
+			}()
+		}
+		user.createWaitGroup.Wait()
+
+		return nil
+	}
+
+	return fmt.Errorf("failed to add tailscale node: %w", errNoUserAvailable)
+}
+
+func (s *EmbeddedDERPServerScenario) Shutdown() error {
+	for _, network := range s.tsicNetworks {
+		err := s.pool.RemoveNetwork(network)
+		if err != nil {
+			return err
+		}
+	}
+
+	return s.Scenario.Shutdown()
+}
@@ -266,18 +266,18 @@ func TestEphemeral(t *testing.T) {
 	t.Logf("all clients logged out")

 	for userName := range spec {
-		machines, err := headscale.ListMachinesInUser(userName)
+		nodes, err := headscale.ListNodesInUser(userName)
 		if err != nil {
 			log.Error().
 				Err(err).
 				Str("user", userName).
-				Msg("Error listing machines in user")
+				Msg("Error listing nodes in user")

 			return
 		}

-		if len(machines) != 0 {
-			t.Errorf("expected no machines, got %d in user %s", len(machines), userName)
+		if len(nodes) != 0 {
+			t.Errorf("expected no nodes, got %d in user %s", len(nodes), userName)
 		}
 	}

@@ -617,8 +617,8 @@ func TestExpireNode(t *testing.T) {
 	})
 	assert.NoError(t, err)

-	var machine v1.Machine
-	err = json.Unmarshal([]byte(result), &machine)
+	var node v1.Node
+	err = json.Unmarshal([]byte(result), &node)
 	assert.NoError(t, err)

 	time.Sleep(30 * time.Second)
@@ -634,10 +634,10 @@ func TestExpireNode(t *testing.T) {

 			peerPublicKey := strings.TrimPrefix(peerStatus.PublicKey.String(), "nodekey:")

-			assert.NotEqual(t, machine.NodeKey, peerPublicKey)
+			assert.NotEqual(t, node.NodeKey, peerPublicKey)
 		}

-		if client.Hostname() != machine.Name {
+		if client.Hostname() != node.Name {
 			// Assert that we have the original count - self - expired node
 			assert.Len(t, status.Peers(), len(TailscaleVersions)-2)
 		}
@@ -15,6 +15,10 @@ import (
 	"math/big"
 	"net"
 	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"strings"
 	"time"

 	"github.com/davecgh/go-spew/spew"
@@ -23,6 +27,7 @@ import (
 	"github.com/juanfont/headscale/integration/dockertestutil"
 	"github.com/juanfont/headscale/integration/integrationutil"
 	"github.com/ory/dockertest/v3"
+	"github.com/ory/dockertest/v3/docker"
 )

 const (
@@ -52,6 +57,8 @@ type HeadscaleInContainer struct {

 	// optional config
 	port             int
+	extraPorts       []string
+	hostPortBindings map[string][]string
 	aclPolicy        *headscale.ACLPolicy
 	env              map[string]string
 	tlsCert          []byte
@@ -77,7 +84,7 @@ func WithACLPolicy(acl *headscale.ACLPolicy) Option {
 // WithTLS creates certificates and enables HTTPS.
 func WithTLS() Option {
 	return func(hsic *HeadscaleInContainer) {
-		cert, key, err := createCertificate()
+		cert, key, err := createCertificate(hsic.hostname)
 		if err != nil {
 			log.Fatalf("failed to create certificates for headscale test: %s", err)
 		}
@@ -108,6 +115,19 @@ func WithPort(port int) Option {
 	}
 }

+// WithExtraPorts exposes additional ports on the container (e.g. 3478/udp for STUN).
+func WithExtraPorts(ports []string) Option {
+	return func(hsic *HeadscaleInContainer) {
+		hsic.extraPorts = ports
+	}
+}
+
+func WithHostPortBindings(bindings map[string][]string) Option {
+	return func(hsic *HeadscaleInContainer) {
+		hsic.hostPortBindings = bindings
+	}
+}
+
 // WithTestName sets a name for the test, this will be reflected
 // in the Docker container name.
 func WithTestName(testName string) Option {
@@ -173,12 +193,25 @@ func New(

 	portProto := fmt.Sprintf("%d/tcp", hsic.port)

+	serverURL, err := url.Parse(hsic.env["HEADSCALE_SERVER_URL"])
+	if err != nil {
+		return nil, err
+	}
+
+	if len(hsic.tlsCert) != 0 && len(hsic.tlsKey) != 0 {
+		serverURL.Scheme = "https"
+		hsic.env["HEADSCALE_SERVER_URL"] = serverURL.String()
+	}
+
 	headscaleBuildOptions := &dockertest.BuildOptions{
 		Dockerfile: "Dockerfile.debug",
 		ContextDir: dockerContextPath,
 	}

-	env := []string{}
+	env := []string{
+		"HEADSCALE_PROFILING_ENABLED=1",
+		"HEADSCALE_PROFILING_PATH=/tmp/profile",
+	}
 	for key, value := range hsic.env {
 		env = append(env, fmt.Sprintf("%s=%s", key, value))
 	}
@@ -187,15 +220,27 @@ func New(

 	runOptions := &dockertest.RunOptions{
 		Name:         hsic.hostname,
-		ExposedPorts: []string{portProto},
+		ExposedPorts: append([]string{portProto}, hsic.extraPorts...),
 		Networks:     []*dockertest.Network{network},
 		// Cmd:          []string{"headscale", "serve"},
 		// TODO(kradalby): Get rid of this hack, we currently need to give us some
 		// to inject the headscale configuration further down.
-		Entrypoint: []string{"/bin/bash", "-c", "/bin/sleep 3 ; headscale serve"},
+		Entrypoint: []string{"/bin/bash", "-c", "/bin/sleep 3 ; headscale serve ; /bin/sleep 30"},
 		Env:        env,
 	}

+	if len(hsic.hostPortBindings) > 0 {
+		runOptions.PortBindings = map[docker.Port][]docker.PortBinding{}
+		for port, hostPorts := range hsic.hostPortBindings {
+			runOptions.PortBindings[docker.Port(port)] = []docker.PortBinding{}
+			for _, hostPort := range hostPorts {
+				runOptions.PortBindings[docker.Port(port)] = append(
+					runOptions.PortBindings[docker.Port(port)],
+					docker.PortBinding{HostPort: hostPort})
+			}
+		}
+	}
+
 	// dockertest isnt very good at handling containers that has already
 	// been created, this is an attempt to make sure this container isnt
 	// present.
@@ -256,12 +301,43 @@ func New(
 	return hsic, nil
 }

+func (t *HeadscaleInContainer) ConnectToNetwork(network *dockertest.Network) error {
+	return t.container.ConnectToNetwork(network)
+}
+
 func (t *HeadscaleInContainer) hasTLS() bool {
 	return len(t.tlsCert) != 0 && len(t.tlsKey) != 0
 }

 // Shutdown stops and cleans up the Headscale container.
 func (t *HeadscaleInContainer) Shutdown() error {
+	err := t.SaveLog("/tmp/control")
+	if err != nil {
+		log.Printf(
+			"Failed to save log from control: %s",
+			fmt.Errorf("failed to save log from control: %w", err),
+		)
+	}
+
+	// Send a interrupt signal to the "headscale" process inside the container
+	// allowing it to shut down gracefully and flush the profile to disk.
+	// The container will live for a bit longer due to the sleep at the end.
+	err = t.SendInterrupt()
+	if err != nil {
+		log.Printf(
+			"Failed to send graceful interrupt to control: %s",
+			fmt.Errorf("failed to send graceful interrupt to control: %w", err),
+		)
+	}
+
+	err = t.SaveProfile("/tmp/control")
+	if err != nil {
+		log.Printf(
+			"Failed to save profile from control: %s",
+			fmt.Errorf("failed to save profile from control: %w", err),
+		)
+	}
+
 	return t.pool.Purge(t.container)
 }

@@ -271,6 +347,24 @@ func (t *HeadscaleInContainer) SaveLog(path string) error {
 	return dockertestutil.SaveLog(t.pool, t.container, path)
 }

+func (t *HeadscaleInContainer) SaveProfile(savePath string) error {
+	tarFile, err := t.FetchPath("/tmp/profile")
+	if err != nil {
+		return err
+	}
+
+	err = os.WriteFile(
+		path.Join(savePath, t.hostname+".pprof.tar"),
+		tarFile,
+		os.ModePerm,
+	)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // Execute runs a command inside the Headscale container and returns the
 // result of stdout as a string.
 func (t *HeadscaleInContainer) Execute(
@@ -425,11 +519,11 @@ func (t *HeadscaleInContainer) CreateAuthKey(
 	return &preAuthKey, nil
 }

-// ListMachinesInUser list the TailscaleClients (Machine, Headscale internal representation)
+// ListNodesInUser list the TailscaleClients (Machine, Headscale internal representation)
 // associated with a user.
-func (t *HeadscaleInContainer) ListMachinesInUser(
+func (t *HeadscaleInContainer) ListNodesInUser(
 	user string,
-) ([]*v1.Machine, error) {
+) ([]*v1.Node, error) {
 	command := []string{"headscale", "--user", user, "nodes", "list", "--output", "json"}

 	result, _, err := dockertestutil.ExecuteCommand(
@@ -441,7 +535,7 @@ func (t *HeadscaleInContainer) ListMachinesInUser(
 		return nil, fmt.Errorf("failed to execute list node command: %w", err)
 	}

-	var nodes []*v1.Machine
+	var nodes []*v1.Node
 	err = json.Unmarshal([]byte(result), &nodes)
 	if err != nil {
 		return nil, fmt.Errorf("failed to unmarshal nodes: %w", err)
@@ -455,8 +549,28 @@ func (t *HeadscaleInContainer) WriteFile(path string, data []byte) error {
 	return integrationutil.WriteFileToContainer(t.pool, t.container, path, data)
 }

+// FetchPath gets a path from inside the Headscale container and returns a tar
+// file as byte array.
+func (t *HeadscaleInContainer) FetchPath(path string) ([]byte, error) {
+	return integrationutil.FetchPathFromContainer(t.pool, t.container, path)
+}
+
+func (t *HeadscaleInContainer) SendInterrupt() error {
+	pid, err := t.Execute([]string{"pidof", "headscale"})
+	if err != nil {
+		return err
+	}
+
+	_, err = t.Execute([]string{"kill", "-2", strings.Trim(pid, "'\n")})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // nolint
-func createCertificate() ([]byte, []byte, error) {
+func createCertificate(hostname string) ([]byte, []byte, error) {
 	// From:
 	// https://shaneutt.com/blog/golang-ca-and-signed-cert-go/

@@ -468,7 +582,7 @@ func createCertificate() ([]byte, []byte, error) {
 			Locality:     []string{"Leiden"},
 		},
 		NotBefore: time.Now(),
-		NotAfter:  time.Now().Add(30 * time.Minute),
+		NotAfter:  time.Now().Add(60 * time.Minute),
 		IsCA:      true,
 		ExtKeyUsage: []x509.ExtKeyUsage{
 			x509.ExtKeyUsageClientAuth,
@@ -486,16 +600,17 @@ func createCertificate() ([]byte, []byte, error) {
 	cert := &x509.Certificate{
 		SerialNumber: big.NewInt(1658),
 		Subject: pkix.Name{
+			CommonName:   hostname,
 			Organization: []string{"Headscale testing INC"},
 			Country:      []string{"NL"},
 			Locality:     []string{"Leiden"},
 		},
-		IPAddresses:  []net.IP{net.IPv4(127, 0, 0, 1), net.IPv6loopback},
 		NotBefore:    time.Now(),
-		NotAfter:     time.Now().Add(30 * time.Minute),
+		NotAfter:     time.Now().Add(60 * time.Minute),
 		SubjectKeyId: []byte{1, 2, 3, 4, 6},
 		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
 		KeyUsage:     x509.KeyUsageDigitalSignature,
+		DNSNames:     []string{hostname},
 	}

 	certPrivKey, err := rsa.GenerateKey(rand.Reader, 4096)
@@ -72,3 +72,24 @@ func WriteFileToContainer(

 	return nil
 }
+
+func FetchPathFromContainer(
+	pool *dockertest.Pool,
+	container *dockertest.Resource,
+	path string,
+) ([]byte, error) {
+	buf := bytes.NewBuffer([]byte{})
+
+	err := pool.Client.DownloadFromContainer(
+		container.Container.ID,
+		docker.DownloadFromContainerOptions{
+			OutputStream: buf,
+			Path:         path,
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
@@ -149,15 +149,7 @@ func NewScenario() (*Scenario, error) {
 // environment running the tests.
 func (s *Scenario) Shutdown() error {
 	s.controlServers.Range(func(_ string, control ControlServer) bool {
-		err := control.SaveLog("/tmp/control")
-		if err != nil {
-			log.Printf(
-				"Failed to save log from control: %s",
-				fmt.Errorf("failed to save log from control: %w", err),
-			)
-		}
-
-		err = control.Shutdown()
+		err := control.Shutdown()
 		if err != nil {
 			log.Printf(
 				"Failed to shut down control: %s",
@@ -356,6 +348,15 @@ func (s *Scenario) RunTailscaleUp(

 		user.joinWaitGroup.Wait()

+		for _, client := range user.Clients {
+			err := client.WaitForReady()
+			if err != nil {
+				log.Printf("client %s was not ready: %s", client.Hostname(), err)
+
+				return fmt.Errorf("failed to up tailscale node: %w", err)
+			}
+		}
+
 		return nil
 	}

@@ -4,6 +4,7 @@ import (
 	"net/netip"
 	"net/url"

+	"github.com/juanfont/headscale/integration/dockertestutil"
 	"github.com/juanfont/headscale/integration/tsic"
 	"tailscale.com/ipn/ipnstate"
 )
@@ -13,7 +14,7 @@ type TailscaleClient interface {
 	Hostname() string
 	Shutdown() error
 	Version() string
-	Execute(command []string) (string, string, error)
+	Execute(command []string, options ...dockertestutil.ExecuteCommandOption) (string, string, error)
 	Up(loginServer, authKey string) error
 	UpWithLoginURL(loginServer string) (*url.URL, error)
 	Logout() error
@@ -29,6 +29,7 @@ const (

 var (
 	errTailscalePingFailed             = errors.New("ping failed")
+	errTailscalePingNotDERP            = errors.New("ping not via DERP")
 	errTailscaleNotLoggedIn            = errors.New("tailscale not logged in")
 	errTailscaleWrongPeerCount         = errors.New("wrong peer count")
 	errTailscaleCannotUpWithoutAuthkey = errors.New("cannot up without authkey")
@@ -56,6 +57,7 @@ type TailscaleInContainer struct {
 	withSSH           bool
 	withTags          []string
 	withEntrypoint    []string
+	withExtraHosts    []string
 	workdir           string
 }

@@ -124,6 +126,12 @@ func WithDockerWorkdir(dir string) Option {
 	}
 }

+func WithExtraHosts(hosts []string) Option {
+	return func(tsic *TailscaleInContainer) {
+		tsic.withExtraHosts = hosts
+	}
+}
+
 // WithDockerEntrypoint allows the docker entrypoint of the container
 // to be overridden. This is a dangerous option which can make
 // the container not work as intended as a typo might prevent
@@ -169,11 +177,12 @@ func New(

 	tailscaleOptions := &dockertest.RunOptions{
 		Name:     hostname,
-		Networks: []*dockertest.Network{network},
+		Networks: []*dockertest.Network{tsic.network},
 		// Cmd: []string{
 		// 	"tailscaled", "--tun=tsdev",
 		// },
 		Entrypoint: tsic.withEntrypoint,
+		ExtraHosts: tsic.withExtraHosts,
 	}

 	if tsic.headscaleHostname != "" {
@@ -248,11 +257,13 @@ func (t *TailscaleInContainer) ID() string {
 // result of stdout as a string.
 func (t *TailscaleInContainer) Execute(
 	command []string,
+	options ...dockertestutil.ExecuteCommandOption,
 ) (string, string, error) {
 	stdout, stderr, err := dockertestutil.ExecuteCommand(
 		t.container,
 		command,
 		[]string{},
+		options...,
 	)
 	if err != nil {
 		log.Printf("command stderr: %s\n", stderr)
@@ -430,6 +441,15 @@ func (t *TailscaleInContainer) WaitForReady() error {
 			return nil
 		}

+		// ipnstate.Status.CurrentTailnet was added in Tailscale 1.22.0
+		// https://github.com/tailscale/tailscale/pull/3865
+		//
+		// Before that, we can check the BackendState to see if the
+		// tailscaled daemon is connected to the control system.
+		if status.BackendState == "Running" {
+			return nil
+		}
+
 		return errTailscaleNotConnected
 	})
 }
@@ -468,7 +488,7 @@ func (t *TailscaleInContainer) WaitForPeers(expected int) error {
 }

 type (
-	// PingOption repreent optional settings that can be given
+	// PingOption represent optional settings that can be given
 	// to ping another host.
 	PingOption = func(args *pingArgs)

@@ -526,7 +546,12 @@ func (t *TailscaleInContainer) Ping(hostnameOrIP string, opts ...PingOption) err
 	command = append(command, hostnameOrIP)

 	return t.pool.Retry(func() error {
-		result, _, err := t.Execute(command)
+		result, _, err := t.Execute(
+			command,
+			dockertestutil.ExecuteCommandTimeout(
+				time.Duration(int64(args.timeout)*int64(args.count)),
+			),
+		)
 		if err != nil {
 			log.Printf(
 				"failed to run ping command from %s to %s, err: %s",
@@ -538,10 +563,22 @@ func (t *TailscaleInContainer) Ping(hostnameOrIP string, opts ...PingOption) err
 			return err
 		}

-		if !strings.Contains(result, "pong") && !strings.Contains(result, "is local") {
+		if strings.Contains(result, "is local") {
+			return nil
+		}
+
+		if !strings.Contains(result, "pong") {
 			return backoff.Permanent(errTailscalePingFailed)
 		}

+		if !args.direct {
+			if strings.Contains(result, "via DERP") {
+				return nil
+			} else {
+				return backoff.Permanent(errTailscalePingNotDERP)
+			}
+		}
+
 		return nil
 	})
 }
@@ -2,6 +2,14 @@ package integration

 import (
 	"testing"
+	"time"
+
+	"github.com/juanfont/headscale/integration/tsic"
+)
+
+const (
+	derpPingTimeout = 2 * time.Second
+	derpPingCount   = 10
 )

 func pingAllHelper(t *testing.T, clients []TailscaleClient, addrs []string) int {
@@ -22,6 +30,52 @@ func pingAllHelper(t *testing.T, clients []TailscaleClient, addrs []string) int
 	return success
 }

+func pingDerpAllHelper(t *testing.T, clients []TailscaleClient, addrs []string) int {
+	t.Helper()
+	success := 0
+
+	for _, client := range clients {
+		for _, addr := range addrs {
+			if isSelfClient(client, addr) {
+				continue
+			}
+
+			err := client.Ping(
+				addr,
+				tsic.WithPingTimeout(derpPingTimeout),
+				tsic.WithPingCount(derpPingCount),
+				tsic.WithPingUntilDirect(false),
+			)
+			if err != nil {
+				t.Errorf("failed to ping %s from %s: %s", addr, client.Hostname(), err)
+			} else {
+				success++
+			}
+		}
+	}
+
+	return success
+}
+
+func isSelfClient(client TailscaleClient, addr string) bool {
+	if addr == client.Hostname() {
+		return true
+	}
+
+	ips, err := client.IPs()
+	if err != nil {
+		return false
+	}
+
+	for _, ip := range ips {
+		if ip.String() == addr {
+			return true
+		}
+	}
+
+	return false
+}
+
 // pingAllNegativeHelper is intended to have 1 or more nodes timeing out from the ping,
 // it counts failures instead of successes.
 // func pingAllNegativeHelper(t *testing.T, clients []TailscaleClient, addrs []string) int {
@@ -46,3 +100,35 @@ func pingAllHelper(t *testing.T, clients []TailscaleClient, addrs []string) int
 //
 // 	return failures
 // }
+
+// // findPeerByIP takes an IP and a map of peers from status.Peer, and returns a *ipnstate.PeerStatus
+// // if there is a peer with the given IP. If no peer is found, nil is returned.
+// func findPeerByIP(
+// 	ip netip.Addr,
+// 	peers map[key.NodePublic]*ipnstate.PeerStatus,
+// ) *ipnstate.PeerStatus {
+// 	for _, peer := range peers {
+// 		for _, peerIP := range peer.TailscaleIPs {
+// 			if ip == peerIP {
+// 				return peer
+// 			}
+// 		}
+// 	}
+//
+// 	return nil
+// }
+//
+// // findPeerByHostname takes a hostname and a map of peers from status.Peer, and returns a *ipnstate.PeerStatus
+// // if there is a peer with the given hostname. If no peer is found, nil is returned.
+// func findPeerByHostname(
+// 	hostname string,
+// 	peers map[key.NodePublic]*ipnstate.PeerStatus,
+// ) *ipnstate.PeerStatus {
+// 	for _, peer := range peers {
+// 		if hostname == peer.HostName {
+// 			return peer
+// 		}
+// 	}
+//
+// 	return nil
+// }
@@ -553,17 +553,17 @@ func (s *IntegrationCLITestSuite) TestPreAuthKeyCommandReusableEphemeral() {
 }

 func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
-	user, err := s.createUser("machine-user")
+	user, err := s.createUser("node-user")
 	assert.Nil(s.T(), err)

-	machineKeys := []string{
+	nodeKeys := []string{
 		"nodekey:9b2ffa7e08cc421a3d2cca9012280f6a236fd0de0b4ce005b30a98ad930306fe",
 		"nodekey:6abd00bb5fdda622db51387088c68e97e71ce58e7056aa54f592b6a8219d524c",
 	}
-	machines := make([]*v1.Machine, len(machineKeys))
+	nodes := make([]*v1.Node, len(nodeKeys))
 	assert.Nil(s.T(), err)

-	for index, machineKey := range machineKeys {
+	for index, nodeKey := range nodeKeys {
 		_, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
@@ -571,11 +571,11 @@ func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
 				"debug",
 				"create-node",
 				"--name",
-				fmt.Sprintf("machine-%d", index+1),
+				fmt.Sprintf("node-%d", index+1),
 				"--user",
 				user.Name,
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -583,7 +583,7 @@ func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
 		)
 		assert.Nil(s.T(), err)

-		machineResult, _, err := ExecuteCommand(
+		nodeResult, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
 				"headscale",
@@ -592,7 +592,7 @@ func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
 				user.Name,
 				"register",
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -600,13 +600,13 @@ func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
 		)
 		assert.Nil(s.T(), err)

-		var machine v1.Machine
-		err = json.Unmarshal([]byte(machineResult), &machine)
+		var node v1.Node
+		err = json.Unmarshal([]byte(nodeResult), &node)
 		assert.Nil(s.T(), err)

-		machines[index] = &machine
+		nodes[index] = &node
 	}
-	assert.Len(s.T(), machines, len(machineKeys))
+	assert.Len(s.T(), nodes, len(nodeKeys))

 	addTagResult, _, err := ExecuteCommand(
 		&s.headscale,
@@ -622,10 +622,10 @@ func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var machine v1.Machine
-	err = json.Unmarshal([]byte(addTagResult), &machine)
+	var node v1.Node
+	err = json.Unmarshal([]byte(addTagResult), &node)
 	assert.Nil(s.T(), err)
-	assert.Equal(s.T(), []string{"tag:test"}, machine.ForcedTags)
+	assert.Equal(s.T(), []string{"tag:test"}, node.ForcedTags)

 	// try to set a wrong tag and retrieve the error
 	wrongTagResult, _, err := ExecuteCommand(
@@ -660,13 +660,13 @@ func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
 		},
 		[]string{},
 	)
-	resultMachines := make([]*v1.Machine, len(machineKeys))
+	resultNodes := make([]*v1.Node, len(nodeKeys))
 	assert.Nil(s.T(), err)
-	json.Unmarshal([]byte(listAllResult), &resultMachines)
+	json.Unmarshal([]byte(listAllResult), &resultNodes)
 	found := false
-	for _, machine := range resultMachines {
-		if machine.ForcedTags != nil {
-			for _, tag := range machine.ForcedTags {
+	for _, node := range resultNodes {
+		if node.ForcedTags != nil {
+			for _, tag := range node.ForcedTags {
 				if tag == "tag:test" {
 					found = true
 				}
@@ -677,29 +677,29 @@ func (s *IntegrationCLITestSuite) TestNodeTagCommand() {
 		s.T(),
 		true,
 		found,
-		"should find a machine with the tag 'tag:test' in the list of machines",
+		"should find a node with the tag 'tag:test' in the list of nodes",
 	)
 }

 func (s *IntegrationCLITestSuite) TestNodeCommand() {
-	user, err := s.createUser("machine-user")
+	user, err := s.createUser("node-user")
 	assert.Nil(s.T(), err)

 	secondUser, err := s.createUser("other-user")
 	assert.Nil(s.T(), err)

-	// Randomly generated machine keys
-	machineKeys := []string{
+	// Randomly generated node keys
+	nodeKeys := []string{
 		"nodekey:9b2ffa7e08cc421a3d2cca9012280f6a236fd0de0b4ce005b30a98ad930306fe",
 		"nodekey:6abd00bb5fdda622db51387088c68e97e71ce58e7056aa54f592b6a8219d524c",
 		"nodekey:f08305b4ee4250b95a70f3b7504d048d75d899993c624a26d422c67af0422507",
 		"nodekey:8bc13285cee598acf76b1824a6f4490f7f2e3751b201e28aeb3b07fe81d5b4a1",
 		"nodekey:cf7b0fd05da556fdc3bab365787b506fd82d64a70745db70e00e86c1b1c03084",
 	}
-	machines := make([]*v1.Machine, len(machineKeys))
+	nodes := make([]*v1.Node, len(nodeKeys))
 	assert.Nil(s.T(), err)

-	for index, machineKey := range machineKeys {
+	for index, nodeKey := range nodeKeys {
 		_, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
@@ -707,11 +707,11 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 				"debug",
 				"create-node",
 				"--name",
-				fmt.Sprintf("machine-%d", index+1),
+				fmt.Sprintf("node-%d", index+1),
 				"--user",
 				user.Name,
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -719,7 +719,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 		)
 		assert.Nil(s.T(), err)

-		machineResult, _, err := ExecuteCommand(
+		nodeResult, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
 				"headscale",
@@ -728,7 +728,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 				user.Name,
 				"register",
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -736,14 +736,14 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 		)
 		assert.Nil(s.T(), err)

-		var machine v1.Machine
-		err = json.Unmarshal([]byte(machineResult), &machine)
+		var node v1.Node
+		err = json.Unmarshal([]byte(nodeResult), &node)
 		assert.Nil(s.T(), err)

-		machines[index] = &machine
+		nodes[index] = &node
 	}

-	assert.Len(s.T(), machines, len(machineKeys))
+	assert.Len(s.T(), nodes, len(nodeKeys))

 	// Test list all nodes after added seconds
 	listAllResult, _, err := ExecuteCommand(
@@ -759,7 +759,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listAll []v1.Machine
+	var listAll []v1.Node
 	err = json.Unmarshal([]byte(listAllResult), &listAll)
 	assert.Nil(s.T(), err)

@@ -771,20 +771,20 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 	assert.Equal(s.T(), uint64(4), listAll[3].Id)
 	assert.Equal(s.T(), uint64(5), listAll[4].Id)

-	assert.Equal(s.T(), "machine-1", listAll[0].Name)
-	assert.Equal(s.T(), "machine-2", listAll[1].Name)
-	assert.Equal(s.T(), "machine-3", listAll[2].Name)
-	assert.Equal(s.T(), "machine-4", listAll[3].Name)
-	assert.Equal(s.T(), "machine-5", listAll[4].Name)
+	assert.Equal(s.T(), "node-1", listAll[0].Name)
+	assert.Equal(s.T(), "node-2", listAll[1].Name)
+	assert.Equal(s.T(), "node-3", listAll[2].Name)
+	assert.Equal(s.T(), "node-4", listAll[3].Name)
+	assert.Equal(s.T(), "node-5", listAll[4].Name)

-	otherUserMachineKeys := []string{
+	otherUserNodeKeys := []string{
 		"nodekey:b5b444774186d4217adcec407563a1223929465ee2c68a4da13af0d0185b4f8e",
 		"nodekey:dc721977ac7415aafa87f7d4574cbe07c6b171834a6d37375782bdc1fb6b3584",
 	}
-	otherUserMachines := make([]*v1.Machine, len(otherUserMachineKeys))
+	otherUserNodes := make([]*v1.Node, len(otherUserNodeKeys))
 	assert.Nil(s.T(), err)

-	for index, machineKey := range otherUserMachineKeys {
+	for index, nodeKey := range otherUserNodeKeys {
 		_, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
@@ -792,11 +792,11 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 				"debug",
 				"create-node",
 				"--name",
-				fmt.Sprintf("otherUser-machine-%d", index+1),
+				fmt.Sprintf("otherUser-node-%d", index+1),
 				"--user",
 				secondUser.Name,
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -804,7 +804,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 		)
 		assert.Nil(s.T(), err)

-		machineResult, _, err := ExecuteCommand(
+		nodeResult, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
 				"headscale",
@@ -813,7 +813,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 				secondUser.Name,
 				"register",
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -821,14 +821,14 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 		)
 		assert.Nil(s.T(), err)

-		var machine v1.Machine
-		err = json.Unmarshal([]byte(machineResult), &machine)
+		var node v1.Node
+		err = json.Unmarshal([]byte(nodeResult), &node)
 		assert.Nil(s.T(), err)

-		otherUserMachines[index] = &machine
+		otherUserNodes[index] = &node
 	}

-	assert.Len(s.T(), otherUserMachines, len(otherUserMachineKeys))
+	assert.Len(s.T(), otherUserNodes, len(otherUserNodeKeys))

 	// Test list all nodes after added otherUser
 	listAllWithotherUserResult, _, err := ExecuteCommand(
@@ -844,21 +844,21 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listAllWithotherUser []v1.Machine
+	var listAllWithotherUser []v1.Node
 	err = json.Unmarshal(
 		[]byte(listAllWithotherUserResult),
 		&listAllWithotherUser,
 	)
 	assert.Nil(s.T(), err)

-	// All nodes, machines + otherUser
+	// All nodes, nodes + otherUser
 	assert.Len(s.T(), listAllWithotherUser, 7)

 	assert.Equal(s.T(), uint64(6), listAllWithotherUser[5].Id)
 	assert.Equal(s.T(), uint64(7), listAllWithotherUser[6].Id)

-	assert.Equal(s.T(), "otherUser-machine-1", listAllWithotherUser[5].Name)
-	assert.Equal(s.T(), "otherUser-machine-2", listAllWithotherUser[6].Name)
+	assert.Equal(s.T(), "otherUser-node-1", listAllWithotherUser[5].Name)
+	assert.Equal(s.T(), "otherUser-node-2", listAllWithotherUser[6].Name)

 	// Test list all nodes after added otherUser
 	listOnlyotherUserMachineUserResult, _, err := ExecuteCommand(
@@ -876,7 +876,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listOnlyotherUserMachineUser []v1.Machine
+	var listOnlyotherUserMachineUser []v1.Node
 	err = json.Unmarshal(
 		[]byte(listOnlyotherUserMachineUserResult),
 		&listOnlyotherUserMachineUser,
@@ -890,16 +890,16 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {

 	assert.Equal(
 		s.T(),
-		"otherUser-machine-1",
+		"otherUser-node-1",
 		listOnlyotherUserMachineUser[0].Name,
 	)
 	assert.Equal(
 		s.T(),
-		"otherUser-machine-2",
+		"otherUser-node-2",
 		listOnlyotherUserMachineUser[1].Name,
 	)

-	// Delete a machines
+	// Delete a nodes
 	_, _, err = ExecuteCommand(
 		&s.headscale,
 		[]string{
@@ -907,7 +907,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 			"nodes",
 			"delete",
 			"--identifier",
-			// Delete the last added machine
+			// Delete the last added node
 			"4",
 			"--output",
 			"json",
@@ -917,7 +917,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 	)
 	assert.Nil(s.T(), err)

-	// Test: list main user after machine is deleted
+	// Test: list main user after node is deleted
 	listOnlyMachineUserAfterDeleteResult, _, err := ExecuteCommand(
 		&s.headscale,
 		[]string{
@@ -933,7 +933,7 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listOnlyMachineUserAfterDelete []v1.Machine
+	var listOnlyMachineUserAfterDelete []v1.Node
 	err = json.Unmarshal(
 		[]byte(listOnlyMachineUserAfterDeleteResult),
 		&listOnlyMachineUserAfterDelete,
@@ -944,21 +944,21 @@ func (s *IntegrationCLITestSuite) TestNodeCommand() {
 }

 func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
-	user, err := s.createUser("machine-expire-user")
+	user, err := s.createUser("node-expire-user")
 	assert.Nil(s.T(), err)

-	// Randomly generated machine keys
-	machineKeys := []string{
+	// Randomly generated node keys
+	nodeKeys := []string{
 		"nodekey:9b2ffa7e08cc421a3d2cca9012280f6a236fd0de0b4ce005b30a98ad930306fe",
 		"nodekey:6abd00bb5fdda622db51387088c68e97e71ce58e7056aa54f592b6a8219d524c",
 		"nodekey:f08305b4ee4250b95a70f3b7504d048d75d899993c624a26d422c67af0422507",
 		"nodekey:8bc13285cee598acf76b1824a6f4490f7f2e3751b201e28aeb3b07fe81d5b4a1",
 		"nodekey:cf7b0fd05da556fdc3bab365787b506fd82d64a70745db70e00e86c1b1c03084",
 	}
-	machines := make([]*v1.Machine, len(machineKeys))
+	nodes := make([]*v1.Node, len(nodeKeys))
 	assert.Nil(s.T(), err)

-	for index, machineKey := range machineKeys {
+	for index, nodeKey := range nodeKeys {
 		_, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
@@ -966,11 +966,11 @@ func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
 				"debug",
 				"create-node",
 				"--name",
-				fmt.Sprintf("machine-%d", index+1),
+				fmt.Sprintf("node-%d", index+1),
 				"--user",
 				user.Name,
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -978,7 +978,7 @@ func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
 		)
 		assert.Nil(s.T(), err)

-		machineResult, _, err := ExecuteCommand(
+		nodeResult, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
 				"headscale",
@@ -987,7 +987,7 @@ func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
 				user.Name,
 				"register",
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -995,14 +995,14 @@ func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
 		)
 		assert.Nil(s.T(), err)

-		var machine v1.Machine
-		err = json.Unmarshal([]byte(machineResult), &machine)
+		var node v1.Node
+		err = json.Unmarshal([]byte(nodeResult), &node)
 		assert.Nil(s.T(), err)

-		machines[index] = &machine
+		nodes[index] = &node
 	}

-	assert.Len(s.T(), machines, len(machineKeys))
+	assert.Len(s.T(), nodes, len(nodeKeys))

 	listAllResult, _, err := ExecuteCommand(
 		&s.headscale,
@@ -1017,7 +1017,7 @@ func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listAll []v1.Machine
+	var listAll []v1.Node
 	err = json.Unmarshal([]byte(listAllResult), &listAll)
 	assert.Nil(s.T(), err)

@@ -1057,7 +1057,7 @@ func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listAllAfterExpiry []v1.Machine
+	var listAllAfterExpiry []v1.Node
 	err = json.Unmarshal([]byte(listAllAfterExpiryResult), &listAllAfterExpiry)
 	assert.Nil(s.T(), err)

@@ -1071,21 +1071,21 @@ func (s *IntegrationCLITestSuite) TestNodeExpireCommand() {
 }

 func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
-	user, err := s.createUser("machine-rename-command")
+	user, err := s.createUser("node-rename-command")
 	assert.Nil(s.T(), err)

-	// Randomly generated machine keys
-	machineKeys := []string{
+	// Randomly generated node keys
+	nodeKeys := []string{
 		"nodekey:cf7b0fd05da556fdc3bab365787b506fd82d64a70745db70e00e86c1b1c03084",
 		"nodekey:8bc13285cee598acf76b1824a6f4490f7f2e3751b201e28aeb3b07fe81d5b4a1",
 		"nodekey:f08305b4ee4250b95a70f3b7504d048d75d899993c624a26d422c67af0422507",
 		"nodekey:6abd00bb5fdda622db51387088c68e97e71ce58e7056aa54f592b6a8219d524c",
 		"nodekey:9b2ffa7e08cc421a3d2cca9012280f6a236fd0de0b4ce005b30a98ad930306fe",
 	}
-	machines := make([]*v1.Machine, len(machineKeys))
+	nodes := make([]*v1.Node, len(nodeKeys))
 	assert.Nil(s.T(), err)

-	for index, machineKey := range machineKeys {
+	for index, nodeKey := range nodeKeys {
 		_, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
@@ -1093,11 +1093,11 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 				"debug",
 				"create-node",
 				"--name",
-				fmt.Sprintf("machine-%d", index+1),
+				fmt.Sprintf("node-%d", index+1),
 				"--user",
 				user.Name,
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -1105,7 +1105,7 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 		)
 		assert.Nil(s.T(), err)

-		machineResult, _, err := ExecuteCommand(
+		nodeResult, _, err := ExecuteCommand(
 			&s.headscale,
 			[]string{
 				"headscale",
@@ -1114,7 +1114,7 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 				user.Name,
 				"register",
 				"--key",
-				machineKey,
+				nodeKey,
 				"--output",
 				"json",
 			},
@@ -1122,14 +1122,14 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 		)
 		assert.Nil(s.T(), err)

-		var machine v1.Machine
-		err = json.Unmarshal([]byte(machineResult), &machine)
+		var node v1.Node
+		err = json.Unmarshal([]byte(nodeResult), &node)
 		assert.Nil(s.T(), err)

-		machines[index] = &machine
+		nodes[index] = &node
 	}

-	assert.Len(s.T(), machines, len(machineKeys))
+	assert.Len(s.T(), nodes, len(nodeKeys))

 	listAllResult, _, err := ExecuteCommand(
 		&s.headscale,
@@ -1144,17 +1144,17 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listAll []v1.Machine
+	var listAll []v1.Node
 	err = json.Unmarshal([]byte(listAllResult), &listAll)
 	assert.Nil(s.T(), err)

 	assert.Len(s.T(), listAll, 5)

-	assert.Contains(s.T(), listAll[0].GetGivenName(), "machine-1")
-	assert.Contains(s.T(), listAll[1].GetGivenName(), "machine-2")
-	assert.Contains(s.T(), listAll[2].GetGivenName(), "machine-3")
-	assert.Contains(s.T(), listAll[3].GetGivenName(), "machine-4")
-	assert.Contains(s.T(), listAll[4].GetGivenName(), "machine-5")
+	assert.Contains(s.T(), listAll[0].GetGivenName(), "node-1")
+	assert.Contains(s.T(), listAll[1].GetGivenName(), "node-2")
+	assert.Contains(s.T(), listAll[2].GetGivenName(), "node-3")
+	assert.Contains(s.T(), listAll[3].GetGivenName(), "node-4")
+	assert.Contains(s.T(), listAll[4].GetGivenName(), "node-5")

 	for i := 0; i < 3; i++ {
 		_, _, err := ExecuteCommand(
@@ -1165,7 +1165,7 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 				"rename",
 				"--identifier",
 				fmt.Sprintf("%d", listAll[i].Id),
-				fmt.Sprintf("newmachine-%d", i+1),
+				fmt.Sprintf("newnode-%d", i+1),
 			},
 			[]string{},
 		)
@@ -1185,17 +1185,17 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listAllAfterRename []v1.Machine
+	var listAllAfterRename []v1.Node
 	err = json.Unmarshal([]byte(listAllAfterRenameResult), &listAllAfterRename)
 	assert.Nil(s.T(), err)

 	assert.Len(s.T(), listAllAfterRename, 5)

-	assert.Equal(s.T(), "newmachine-1", listAllAfterRename[0].GetGivenName())
-	assert.Equal(s.T(), "newmachine-2", listAllAfterRename[1].GetGivenName())
-	assert.Equal(s.T(), "newmachine-3", listAllAfterRename[2].GetGivenName())
-	assert.Contains(s.T(), listAllAfterRename[3].GetGivenName(), "machine-4")
-	assert.Contains(s.T(), listAllAfterRename[4].GetGivenName(), "machine-5")
+	assert.Equal(s.T(), "newnode-1", listAllAfterRename[0].GetGivenName())
+	assert.Equal(s.T(), "newnode-2", listAllAfterRename[1].GetGivenName())
+	assert.Equal(s.T(), "newnode-3", listAllAfterRename[2].GetGivenName())
+	assert.Contains(s.T(), listAllAfterRename[3].GetGivenName(), "node-4")
+	assert.Contains(s.T(), listAllAfterRename[4].GetGivenName(), "node-5")

 	// Test failure for too long names
 	result, _, err := ExecuteCommand(
@@ -1226,7 +1226,7 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var listAllAfterRenameAttempt []v1.Machine
+	var listAllAfterRenameAttempt []v1.Node
 	err = json.Unmarshal(
 		[]byte(listAllAfterRenameAttemptResult),
 		&listAllAfterRenameAttempt,
@@ -1235,11 +1235,11 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {

 	assert.Len(s.T(), listAllAfterRenameAttempt, 5)

-	assert.Equal(s.T(), "newmachine-1", listAllAfterRenameAttempt[0].GetGivenName())
-	assert.Equal(s.T(), "newmachine-2", listAllAfterRenameAttempt[1].GetGivenName())
-	assert.Equal(s.T(), "newmachine-3", listAllAfterRenameAttempt[2].GetGivenName())
-	assert.Contains(s.T(), listAllAfterRenameAttempt[3].GetGivenName(), "machine-4")
-	assert.Contains(s.T(), listAllAfterRenameAttempt[4].GetGivenName(), "machine-5")
+	assert.Equal(s.T(), "newnode-1", listAllAfterRenameAttempt[0].GetGivenName())
+	assert.Equal(s.T(), "newnode-2", listAllAfterRenameAttempt[1].GetGivenName())
+	assert.Equal(s.T(), "newnode-3", listAllAfterRenameAttempt[2].GetGivenName())
+	assert.Contains(s.T(), listAllAfterRenameAttempt[3].GetGivenName(), "node-4")
+	assert.Contains(s.T(), listAllAfterRenameAttempt[4].GetGivenName(), "node-5")
 }

 func (s *IntegrationCLITestSuite) TestApiKeyCommand() {
@@ -1393,8 +1393,8 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 	newUser, err := s.createUser("new-user")
 	assert.Nil(s.T(), err)

-	// Randomly generated machine key
-	machineKey := "nodekey:688411b767663479632d44140f08a9fde87383adc7cdeb518f62ce28a17ef0aa"
+	// Randomly generated node key
+	nodeKey := "nodekey:688411b767663479632d44140f08a9fde87383adc7cdeb518f62ce28a17ef0aa"

 	_, _, err = ExecuteCommand(
 		&s.headscale,
@@ -1403,11 +1403,11 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 			"debug",
 			"create-node",
 			"--name",
-			"nomad-machine",
+			"nomad-node",
 			"--user",
 			oldUser.Name,
 			"--key",
-			machineKey,
+			nodeKey,
 			"--output",
 			"json",
 		},
@@ -1415,7 +1415,7 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 	)
 	assert.Nil(s.T(), err)

-	machineResult, _, err := ExecuteCommand(
+	nodeResult, _, err := ExecuteCommand(
 		&s.headscale,
 		[]string{
 			"headscale",
@@ -1424,7 +1424,7 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 			oldUser.Name,
 			"register",
 			"--key",
-			machineKey,
+			nodeKey,
 			"--output",
 			"json",
 		},
@@ -1432,15 +1432,15 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var machine v1.Machine
-	err = json.Unmarshal([]byte(machineResult), &machine)
+	var node v1.Node
+	err = json.Unmarshal([]byte(nodeResult), &node)
 	assert.Nil(s.T(), err)

-	assert.Equal(s.T(), uint64(1), machine.Id)
-	assert.Equal(s.T(), "nomad-machine", machine.Name)
-	assert.Equal(s.T(), machine.User.Name, oldUser.Name)
+	assert.Equal(s.T(), uint64(1), node.Id)
+	assert.Equal(s.T(), "nomad-node", node.Name)
+	assert.Equal(s.T(), node.User.Name, oldUser.Name)

-	machineId := fmt.Sprintf("%d", machine.Id)
+	nodeId := fmt.Sprintf("%d", node.Id)

 	moveToNewNSResult, _, err := ExecuteCommand(
 		&s.headscale,
@@ -1449,7 +1449,7 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 			"nodes",
 			"move",
 			"--identifier",
-			machineId,
+			nodeId,
 			"--user",
 			newUser.Name,
 			"--output",
@@ -1459,10 +1459,10 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 	)
 	assert.Nil(s.T(), err)

-	err = json.Unmarshal([]byte(moveToNewNSResult), &machine)
+	err = json.Unmarshal([]byte(moveToNewNSResult), &node)
 	assert.Nil(s.T(), err)

-	assert.Equal(s.T(), machine.User, newUser)
+	assert.Equal(s.T(), node.User, newUser)

 	listAllNodesResult, _, err := ExecuteCommand(
 		&s.headscale,
@@ -1477,14 +1477,14 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 	)
 	assert.Nil(s.T(), err)

-	var allNodes []v1.Machine
+	var allNodes []v1.Node
 	err = json.Unmarshal([]byte(listAllNodesResult), &allNodes)
 	assert.Nil(s.T(), err)

 	assert.Len(s.T(), allNodes, 1)

-	assert.Equal(s.T(), allNodes[0].Id, machine.Id)
-	assert.Equal(s.T(), allNodes[0].User, machine.User)
+	assert.Equal(s.T(), allNodes[0].Id, node.Id)
+	assert.Equal(s.T(), allNodes[0].User, node.User)
 	assert.Equal(s.T(), allNodes[0].User, newUser)

 	moveToNonExistingNSResult, _, err := ExecuteCommand(
@@ -1494,7 +1494,7 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 			"nodes",
 			"move",
 			"--identifier",
-			machineId,
+			nodeId,
 			"--user",
 			"non-existing-user",
 			"--output",
@@ -1509,7 +1509,7 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 		string(moveToNonExistingNSResult),
 		"User not found",
 	)
-	assert.Equal(s.T(), machine.User, newUser)
+	assert.Equal(s.T(), node.User, newUser)

 	moveToOldNSResult, _, err := ExecuteCommand(
 		&s.headscale,
@@ -1518,7 +1518,7 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 			"nodes",
 			"move",
 			"--identifier",
-			machineId,
+			nodeId,
 			"--user",
 			oldUser.Name,
 			"--output",
@@ -1528,10 +1528,10 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 	)
 	assert.Nil(s.T(), err)

-	err = json.Unmarshal([]byte(moveToOldNSResult), &machine)
+	err = json.Unmarshal([]byte(moveToOldNSResult), &node)
 	assert.Nil(s.T(), err)

-	assert.Equal(s.T(), machine.User, oldUser)
+	assert.Equal(s.T(), node.User, oldUser)

 	moveToSameNSResult, _, err := ExecuteCommand(
 		&s.headscale,
@@ -1540,7 +1540,7 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 			"nodes",
 			"move",
 			"--identifier",
-			machineId,
+			nodeId,
 			"--user",
 			oldUser.Name,
 			"--output",
@@ -1550,10 +1550,10 @@ func (s *IntegrationCLITestSuite) TestNodeMoveCommand() {
 	)
 	assert.Nil(s.T(), err)

-	err = json.Unmarshal([]byte(moveToSameNSResult), &machine)
+	err = json.Unmarshal([]byte(moveToSameNSResult), &node)
 	assert.Nil(s.T(), err)

-	assert.Equal(s.T(), machine.User, oldUser)
+	assert.Equal(s.T(), node.User, oldUser)
 }

 func (s *IntegrationCLITestSuite) TestLoadConfigFromCommand() {
@@ -215,7 +215,7 @@ func getDNSNames(
 		return nil, err
 	}

-	var listAll []v1.Machine
+	var listAll []v1.Node
 	err = json.Unmarshal([]byte(listAllResult), &listAll)
 	if err != nil {
 		return nil, err
@@ -1,453 +0,0 @@
-// nolint
-package headscale
-
-import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"path"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/ccding/go-stun/stun"
-	v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
-	"github.com/ory/dockertest/v3"
-	"github.com/ory/dockertest/v3/docker"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/suite"
-)
-
-const (
-	headscaleDerpHostname = "headscale-derp"
-	userName              = "derpuser"
-	totalContainers       = 3
-)
-
-type IntegrationDERPTestSuite struct {
-	suite.Suite
-	stats *suite.SuiteInformation
-
-	pool              dockertest.Pool
-	network           dockertest.Network
-	containerNetworks map[int]dockertest.Network // so we keep the containers isolated
-	headscale         dockertest.Resource
-	saveLogs          bool
-
-	tailscales    map[string]dockertest.Resource
-	joinWaitGroup sync.WaitGroup
-}
-
-func TestIntegrationDERPTestSuite(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration tests due to short flag")
-	}
-
-	saveLogs, err := GetEnvBool("HEADSCALE_INTEGRATION_SAVE_LOG")
-	if err != nil {
-		saveLogs = false
-	}
-
-	s := new(IntegrationDERPTestSuite)
-
-	s.tailscales = make(map[string]dockertest.Resource)
-	s.containerNetworks = make(map[int]dockertest.Network)
-	s.saveLogs = saveLogs
-
-	suite.Run(t, s)
-
-	// HandleStats, which allows us to check if we passed and save logs
-	// is called after TearDown, so we cannot tear down containers before
-	// we have potentially saved the logs.
-	if s.saveLogs {
-		for _, tailscale := range s.tailscales {
-			if err := s.pool.Purge(&tailscale); err != nil {
-				log.Printf("Could not purge resource: %s\n", err)
-			}
-		}
-
-		if !s.stats.Passed() {
-			err := s.saveLog(&s.headscale, "test_output")
-			if err != nil {
-				log.Printf("Could not save log: %s\n", err)
-			}
-		}
-		if err := s.pool.Purge(&s.headscale); err != nil {
-			log.Printf("Could not purge resource: %s\n", err)
-		}
-
-		for _, network := range s.containerNetworks {
-			if err := network.Close(); err != nil {
-				log.Printf("Could not close network: %s\n", err)
-			}
-		}
-	}
-}
-
-func (s *IntegrationDERPTestSuite) SetupSuite() {
-	if ppool, err := dockertest.NewPool(""); err == nil {
-		s.pool = *ppool
-	} else {
-		s.FailNow(fmt.Sprintf("Could not connect to docker: %s", err), "")
-	}
-
-	network, err := GetFirstOrCreateNetwork(&s.pool, headscaleNetwork)
-	if err != nil {
-		s.FailNow(fmt.Sprintf("Failed to create or get network: %s", err), "")
-	}
-	s.network = network
-
-	for i := 0; i < totalContainers; i++ {
-		if pnetwork, err := s.pool.CreateNetwork(fmt.Sprintf("headscale-derp-%d", i)); err == nil {
-			s.containerNetworks[i] = *pnetwork
-		} else {
-			s.FailNow(fmt.Sprintf("Could not create network: %s", err), "")
-		}
-	}
-
-	headscaleBuildOptions := &dockertest.BuildOptions{
-		Dockerfile: "Dockerfile",
-		ContextDir: ".",
-	}
-
-	currentPath, err := os.Getwd()
-	if err != nil {
-		s.FailNow(fmt.Sprintf("Could not determine current path: %s", err), "")
-	}
-
-	headscaleOptions := &dockertest.RunOptions{
-		Name: headscaleDerpHostname,
-		Mounts: []string{
-			fmt.Sprintf(
-				"%s/integration_test/etc_embedded_derp:/etc/headscale",
-				currentPath,
-			),
-		},
-		Cmd:          []string{"headscale", "serve"},
-		Networks:     []*dockertest.Network{&s.network},
-		ExposedPorts: []string{"8443/tcp", "3478/udp"},
-		PortBindings: map[docker.Port][]docker.PortBinding{
-			"8443/tcp": {{HostPort: "8443"}},
-			"3478/udp": {{HostPort: "3478"}},
-		},
-	}
-
-	err = s.pool.RemoveContainerByName(headscaleDerpHostname)
-	if err != nil {
-		s.FailNow(
-			fmt.Sprintf(
-				"Could not remove existing container before building test: %s",
-				err,
-			),
-			"",
-		)
-	}
-
-	log.Println("Creating headscale container for DERP integration tests")
-	if pheadscale, err := s.pool.BuildAndRunWithBuildOptions(headscaleBuildOptions, headscaleOptions, DockerRestartPolicy); err == nil {
-		s.headscale = *pheadscale
-	} else {
-		s.FailNow(fmt.Sprintf("Could not start headscale container: %s", err), "")
-	}
-	log.Println("Created headscale container for embedded DERP tests")
-
-	log.Println("Creating tailscale containers for embedded DERP tests")
-
-	for i := 0; i < totalContainers; i++ {
-		version := tailscaleVersions[i%len(tailscaleVersions)]
-		hostname, container := s.tailscaleContainer(
-			fmt.Sprint(i),
-			version,
-			s.containerNetworks[i],
-		)
-		s.tailscales[hostname] = *container
-	}
-
-	log.Println("Waiting for headscale to be ready for embedded DERP tests")
-	hostEndpoint := fmt.Sprintf("%s:%s",
-		s.headscale.GetIPInNetwork(&s.network),
-		s.headscale.GetPort("8443/tcp"))
-
-	if err := s.pool.Retry(func() error {
-		url := fmt.Sprintf("https://%s/health", hostEndpoint)
-		insecureTransport := http.DefaultTransport.(*http.Transport).Clone()
-		insecureTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
-		client := &http.Client{Transport: insecureTransport}
-		resp, err := client.Get(url)
-		if err != nil {
-			fmt.Printf("headscale for embedded DERP tests is not ready: %s\n", err)
-			return err
-		}
-
-		if resp.StatusCode != http.StatusOK {
-			return fmt.Errorf("status code not OK")
-		}
-
-		return nil
-	}); err != nil {
-		// TODO(kradalby): If we cannot access headscale, or any other fatal error during
-		// test setup, we need to abort and tear down. However, testify does not seem to
-		// support that at the moment:
-		// https://github.com/stretchr/testify/issues/849
-		return // fmt.Errorf("Could not connect to headscale: %s", err)
-	}
-	log.Println("headscale container is ready for embedded DERP tests")
-
-	log.Printf("Creating headscale user: %s\n", userName)
-	result, _, err := ExecuteCommand(
-		&s.headscale,
-		[]string{"headscale", "users", "create", userName},
-		[]string{},
-	)
-	log.Println("headscale create user result: ", result)
-	assert.Nil(s.T(), err)
-
-	log.Printf("Creating pre auth key for %s\n", userName)
-	preAuthResult, _, err := ExecuteCommand(
-		&s.headscale,
-		[]string{
-			"headscale",
-			"--user",
-			userName,
-			"preauthkeys",
-			"create",
-			"--reusable",
-			"--expiration",
-			"24h",
-			"--output",
-			"json",
-		},
-		[]string{"LOG_LEVEL=error"},
-	)
-	assert.Nil(s.T(), err)
-
-	var preAuthKey v1.PreAuthKey
-	err = json.Unmarshal([]byte(preAuthResult), &preAuthKey)
-	assert.Nil(s.T(), err)
-	assert.True(s.T(), preAuthKey.Reusable)
-
-	headscaleEndpoint := fmt.Sprintf(
-		"https://headscale:%s",
-		s.headscale.GetPort("8443/tcp"),
-	)
-
-	log.Printf(
-		"Joining tailscale containers to headscale at %s\n",
-		headscaleEndpoint,
-	)
-	for hostname, tailscale := range s.tailscales {
-		s.joinWaitGroup.Add(1)
-		go s.Join(headscaleEndpoint, preAuthKey.Key, hostname, tailscale)
-	}
-
-	s.joinWaitGroup.Wait()
-
-	// The nodes need a bit of time to get their updated maps from headscale
-	// TODO: See if we can have a more deterministic wait here.
-	time.Sleep(60 * time.Second)
-}
-
-func (s *IntegrationDERPTestSuite) Join(
-	endpoint, key, hostname string,
-	tailscale dockertest.Resource,
-) {
-	defer s.joinWaitGroup.Done()
-
-	command := []string{
-		"tailscale",
-		"up",
-		"-login-server",
-		endpoint,
-		"--authkey",
-		key,
-		"--hostname",
-		hostname,
-	}
-
-	log.Println("Join command:", command)
-	log.Printf("Running join command for %s\n", hostname)
-	_, _, err := ExecuteCommand(
-		&tailscale,
-		command,
-		[]string{},
-	)
-	assert.Nil(s.T(), err)
-	log.Printf("%s joined\n", hostname)
-}
-
-func (s *IntegrationDERPTestSuite) tailscaleContainer(
-	identifier, version string,
-	network dockertest.Network,
-) (string, *dockertest.Resource) {
-	tailscaleBuildOptions := getDockerBuildOptions(version)
-
-	hostname := fmt.Sprintf(
-		"tailscale-%s-%s",
-		strings.Replace(version, ".", "-", -1),
-		identifier,
-	)
-	tailscaleOptions := &dockertest.RunOptions{
-		Name:     hostname,
-		Networks: []*dockertest.Network{&network},
-		Cmd: []string{
-			"tailscaled", "--tun=tsdev",
-		},
-
-		// expose the host IP address, so we can access it from inside the container
-		ExtraHosts: []string{
-			"host.docker.internal:host-gateway",
-			"headscale:host-gateway",
-		},
-	}
-
-	pts, err := s.pool.BuildAndRunWithBuildOptions(
-		tailscaleBuildOptions,
-		tailscaleOptions,
-		DockerRestartPolicy,
-		DockerAllowLocalIPv6,
-		DockerAllowNetworkAdministration,
-	)
-	if err != nil {
-		log.Fatalf("Could not start tailscale container version %s: %s", version, err)
-	}
-	log.Printf("Created %s container\n", hostname)
-
-	return hostname, pts
-}
-
-func (s *IntegrationDERPTestSuite) TearDownSuite() {
-	if !s.saveLogs {
-		for _, tailscale := range s.tailscales {
-			if err := s.pool.Purge(&tailscale); err != nil {
-				log.Printf("Could not purge resource: %s\n", err)
-			}
-		}
-
-		if err := s.pool.Purge(&s.headscale); err != nil {
-			log.Printf("Could not purge resource: %s\n", err)
-		}
-
-		for _, network := range s.containerNetworks {
-			if err := network.Close(); err != nil {
-				log.Printf("Could not close network: %s\n", err)
-			}
-		}
-	}
-}
-
-func (s *IntegrationDERPTestSuite) HandleStats(
-	suiteName string,
-	stats *suite.SuiteInformation,
-) {
-	s.stats = stats
-}
-
-func (s *IntegrationDERPTestSuite) saveLog(
-	resource *dockertest.Resource,
-	basePath string,
-) error {
-	err := os.MkdirAll(basePath, os.ModePerm)
-	if err != nil {
-		return err
-	}
-
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-
-	err = s.pool.Client.Logs(
-		docker.LogsOptions{
-			Context:      context.TODO(),
-			Container:    resource.Container.ID,
-			OutputStream: &stdout,
-			ErrorStream:  &stderr,
-			Tail:         "all",
-			RawTerminal:  false,
-			Stdout:       true,
-			Stderr:       true,
-			Follow:       false,
-			Timestamps:   false,
-		},
-	)
-	if err != nil {
-		return err
-	}
-
-	log.Printf("Saving logs for %s to %s\n", resource.Container.Name, basePath)
-
-	err = os.WriteFile(
-		path.Join(basePath, resource.Container.Name+".stdout.log"),
-		stderr.Bytes(),
-		0o644,
-	)
-	if err != nil {
-		return err
-	}
-
-	err = os.WriteFile(
-		path.Join(basePath, resource.Container.Name+".stderr.log"),
-		stderr.Bytes(),
-		0o644,
-	)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *IntegrationDERPTestSuite) TestPingAllPeersByHostname() {
-	hostnames, err := getDNSNames(&s.headscale)
-	assert.Nil(s.T(), err)
-
-	log.Printf("Hostnames: %#v\n", hostnames)
-
-	for hostname, tailscale := range s.tailscales {
-		for _, peername := range hostnames {
-			if strings.Contains(peername, hostname) {
-				continue
-			}
-			s.T().Run(fmt.Sprintf("%s-%s", hostname, peername), func(t *testing.T) {
-				command := []string{
-					"tailscale", "ping",
-					"--timeout=10s",
-					"--c=5",
-					"--until-direct=false",
-					peername,
-				}
-
-				log.Printf(
-					"Pinging using hostname from %s to %s\n",
-					hostname,
-					peername,
-				)
-				log.Println(command)
-				result, _, err := ExecuteCommand(
-					&tailscale,
-					command,
-					[]string{},
-				)
-				assert.Nil(t, err)
-				log.Printf("Result for %s: %s\n", hostname, result)
-				assert.Contains(t, result, "via DERP(headscale)")
-			})
-		}
-	}
-}
-
-func (s *IntegrationDERPTestSuite) TestDERPSTUN() {
-	headscaleSTUNAddr := fmt.Sprintf("%s:%s",
-		s.headscale.GetIPInNetwork(&s.network),
-		s.headscale.GetPort("3478/udp"))
-	client := stun.NewClient()
-	client.SetVerbose(true)
-	client.SetVVerbose(true)
-	client.SetServerAddr(headscaleSTUNAddr)
-	_, _, err := client.Discover()
-	assert.Nil(s.T(), err)
-}
@@ -8,34 +8,34 @@ import (
 const prometheusNamespace = "headscale"

 var (
-	// This is a high cardinality metric (user x machines), we might want to make this
+	// This is a high cardinality metric (user x nodes), we might want to make this
 	// configurable/opt-in in the future.
 	lastStateUpdate = promauto.NewGaugeVec(prometheus.GaugeOpts{
 		Namespace: prometheusNamespace,
 		Name:      "last_update_seconds",
-		Help:      "Time stamp in unix time when a machine or headscale was updated",
-	}, []string{"user", "machine"})
+		Help:      "Time stamp in unix time when a node or headscale was updated",
+	}, []string{"user", "nodes"})

-	machineRegistrations = promauto.NewCounterVec(prometheus.CounterOpts{
+	nodeRegistrations = promauto.NewCounterVec(prometheus.CounterOpts{
 		Namespace: prometheusNamespace,
-		Name:      "machine_registrations_total",
-		Help:      "The total amount of registered machine attempts",
+		Name:      "node_registrations_total",
+		Help:      "The total amount of registered node attempts",
 	}, []string{"action", "auth", "status", "user"})

 	updateRequestsFromNode = promauto.NewCounterVec(prometheus.CounterOpts{
 		Namespace: prometheusNamespace,
 		Name:      "update_request_from_node_total",
 		Help:      "The number of updates requested by a node/update function",
-	}, []string{"user", "machine", "state"})
+	}, []string{"user", "node", "state"})
 	updateRequestsSentToNode = promauto.NewCounterVec(prometheus.CounterOpts{
 		Namespace: prometheusNamespace,
 		Name:      "update_request_sent_to_node_total",
 		Help:      "The number of calls/messages issued on a specific nodes update channel",
-	}, []string{"user", "machine", "status"})
+	}, []string{"user", "node", "status"})
 	// TODO(kradalby): This is very debugging, we might want to remove it.
 	updateRequestsReceivedOnChannel = promauto.NewCounterVec(prometheus.CounterOpts{
 		Namespace: prometheusNamespace,
 		Name:      "update_request_received_on_channel_total",
 		Help:      "The number of update requests received on an update channel",
-	}, []string{"user", "machine"})
+	}, []string{"user", "node"})
 )
@@ -1,5 +1,6 @@
 site_name: Headscale
 site_url: https://juanfont.github.io/headscale
+edit_uri: blob/main/docs/ # Change the master branch to main as we are using main as a main branch
 site_author: Headscale authors
 site_description: >-
  An open source, self-hosted implementation of the Tailscale control server.
@@ -27,8 +27,8 @@ const (
 	errOIDCAllowedDomains      = Error("authenticated principal does not match any allowed domain")
 	errOIDCAllowedGroups       = Error("authenticated principal is not in any allowed group")
 	errOIDCAllowedUsers        = Error("authenticated principal does not match any allowed user")
-	errOIDCInvalidMachineState = Error(
-		"requested machine state key expired before authorisation completed",
+	errOIDCInvalidNodeState    = Error(
+		"requested node state key expired before authorisation completed",
 	)
 	errOIDCNodeKeyMissing = Error("could not get node key from cache")
 )
@@ -181,9 +181,9 @@ var oidcCallbackTemplate = template.Must(
 )

 // OIDCCallback handles the callback from the OIDC endpoint
-// Retrieves the nkey from the state cache and adds the machine to the users email user
-// TODO: A confirmation page for new machines should be added to avoid phishing vulnerabilities
-// TODO: Add groups information from OIDC tokens into machine HostInfo
+// Retrieves the nkey from the state cache and adds the node to the users email user
+// TODO: A confirmation page for new nodes should be added to avoid phishing vulnerabilities
+// TODO: Add groups information from OIDC tokens into node HostInfo
 // Listens in /oidc/callback.
 func (h *Headscale) OIDCCallback(
 	writer http.ResponseWriter,
@@ -229,13 +229,13 @@ func (h *Headscale) OIDCCallback(
 		return
 	}

-	nodeKey, machineExists, err := h.validateMachineForOIDCCallback(
+	nodeKey, nodeExists, err := h.validateNodeForOIDCCallback(
 		writer,
 		state,
 		claims,
 		idTokenExpiry,
 	)
-	if err != nil || machineExists {
+	if err != nil || nodeExists {
 		return
 	}

@@ -244,15 +244,15 @@ func (h *Headscale) OIDCCallback(
 		return
 	}

-	// register the machine if it's new
-	log.Debug().Msg("Registering new machine after successful callback")
+	// register the node if it's new
+	log.Debug().Msg("Registering new node after successful callback")

 	user, err := h.findOrCreateNewUserForOIDCCallback(writer, userName)
 	if err != nil {
 		return
 	}

-	if err := h.registerMachineForOIDCCallback(writer, user, nodeKey, idTokenExpiry); err != nil {
+	if err := h.registerNodeForOIDCCallback(writer, user, nodeKey, idTokenExpiry); err != nil {
 		return
 	}

@@ -484,21 +484,21 @@ func validateOIDCAllowedUsers(
 	return nil
 }

-// validateMachine retrieves machine information if it exist
+// validateNode retrieves node information if it exist
 // The error is not important, because if it does not
-// exist, then this is a new machine and we will move
+// exist, then this is a new node and we will move
 // on to registration.
-func (h *Headscale) validateMachineForOIDCCallback(
+func (h *Headscale) validateNodeForOIDCCallback(
 	writer http.ResponseWriter,
 	state string,
 	claims *IDTokenClaims,
 	expiry time.Time,
 ) (*key.NodePublic, bool, error) {
-	// retrieve machinekey from state cache
+	// retrieve nodekey from state cache
 	nodeKeyIf, nodeKeyFound := h.registrationCache.Get(state)
 	if !nodeKeyFound {
 		log.Error().
-			Msg("requested machine state key expired before authorisation completed")
+			Msg("requested node state key expired before authorisation completed")
 		writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		writer.WriteHeader(http.StatusBadRequest)
 		_, err := writer.Write([]byte("state has expired"))
@@ -516,7 +516,7 @@ func (h *Headscale) validateMachineForOIDCCallback(
 	nodeKeyFromCache, nodeKeyOK := nodeKeyIf.(string)
 	if !nodeKeyOK {
 		log.Error().
-			Msg("requested machine state key is not a string")
+			Msg("requested node state key is not a string")
 		writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		writer.WriteHeader(http.StatusBadRequest)
 		_, err := writer.Write([]byte("state is invalid"))
@@ -527,7 +527,7 @@ func (h *Headscale) validateMachineForOIDCCallback(
 				Msg("Failed to write response")
 		}

-		return nil, false, errOIDCInvalidMachineState
+		return nil, false, errOIDCInvalidNodeState
 	}

 	err := nodeKey.UnmarshalText(
@@ -551,36 +551,36 @@ func (h *Headscale) validateMachineForOIDCCallback(
 		return nil, false, err
 	}

-	// retrieve machine information if it exist
+	// retrieve node information if it exist
 	// The error is not important, because if it does not
-	// exist, then this is a new machine and we will move
+	// exist, then this is a new node and we will move
 	// on to registration.
-	machine, _ := h.GetMachineByNodeKey(nodeKey)
+	node, _ := h.GetNodeByNodeKey(nodeKey)

-	if machine != nil {
+	if node != nil {
 		log.Trace().
 			Caller().
-			Str("machine", machine.Hostname).
-			Msg("machine already registered, reauthenticating")
+			Str("node", node.Hostname).
+			Msg("node already registered, reauthenticating")

-		err := h.RefreshMachine(machine, expiry)
+		err := h.RefreshNode(node, expiry)
 		if err != nil {
 			log.Error().
 				Caller().
 				Err(err).
-				Msg("Failed to refresh machine")
+				Msg("Failed to refresh node")
 			http.Error(
 				writer,
-				"Failed to refresh machine",
+				"Failed to refresh node",
 				http.StatusInternalServerError,
 			)

 			return nil, true, err
 		}
 		log.Debug().
-			Str("machine", machine.Hostname).
+			Str("node", node.Hostname).
 			Str("expiresAt", fmt.Sprintf("%v", expiry)).
-			Msg("successfully refreshed machine")
+			Msg("successfully refreshed node")

 		var content bytes.Buffer
 		if err := oidcCallbackTemplate.Execute(&content, oidcCallbackTemplateConfig{
@@ -696,13 +696,13 @@ func (h *Headscale) findOrCreateNewUserForOIDCCallback(
 	return user, nil
 }

-func (h *Headscale) registerMachineForOIDCCallback(
+func (h *Headscale) registerNodeForOIDCCallback(
 	writer http.ResponseWriter,
 	user *User,
 	nodeKey *key.NodePublic,
 	expiry time.Time,
 ) error {
-	if _, err := h.RegisterMachineFromAuthCallback(
+	if _, err := h.RegisterNodeFromAuthCallback(
 		nodeKey.String(),
 		user.Name,
 		&expiry,
@@ -711,10 +711,10 @@ func (h *Headscale) registerMachineForOIDCCallback(
 		log.Error().
 			Caller().
 			Err(err).
-			Msg("could not register machine")
+			Msg("could not register node")
 		writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		writer.WriteHeader(http.StatusInternalServerError)
-		_, werr := writer.Write([]byte("could not register machine"))
+		_, werr := writer.Write([]byte("could not register node"))
 		if werr != nil {
 			log.Error().
 				Caller().
@@ -193,12 +193,12 @@ func (h *Headscale) checkKeyValidity(k string) (*PreAuthKey, error) {
 		return &pak, nil
 	}

-	machines := []Machine{}
-	if err := h.db.Preload("AuthKey").Where(&Machine{AuthKeyID: uint(pak.ID)}).Find(&machines).Error; err != nil {
+	nodes := []Node{}
+	if err := h.db.Preload("AuthKey").Where(&Node{AuthKeyID: uint(pak.ID)}).Find(&nodes).Error; err != nil {
 		return nil, err
 	}

-	if len(machines) != 0 || pak.Used {
+	if len(nodes) != 0 || pak.Used {
 		return nil, ErrSingleUseAuthKeyHasBeenUsed
 	}

@@ -73,7 +73,7 @@ func (*Suite) TestAlreadyUsedKey(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, false, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	machine := Machine{
+	node := Node{
 		ID:             0,
 		MachineKey:     "foo",
 		NodeKey:        "bar",
@@ -83,7 +83,7 @@ func (*Suite) TestAlreadyUsedKey(c *check.C) {
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	key, err := app.checkKeyValidity(pak.Key)
 	c.Assert(err, check.Equals, ErrSingleUseAuthKeyHasBeenUsed)
@@ -97,7 +97,7 @@ func (*Suite) TestReusableBeingUsedKey(c *check.C) {
 	pak, err := app.CreatePreAuthKey(user.Name, true, false, nil, nil)
 	c.Assert(err, check.IsNil)

-	machine := Machine{
+	node := Node{
 		ID:             1,
 		MachineKey:     "foo",
 		NodeKey:        "bar",
@@ -107,7 +107,7 @@ func (*Suite) TestReusableBeingUsedKey(c *check.C) {
 		RegisterMethod: RegisterMethodAuthKey,
 		AuthKeyID:      uint(pak.ID),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	key, err := app.checkKeyValidity(pak.Key)
 	c.Assert(err, check.IsNil)
@@ -134,7 +134,7 @@ func (*Suite) TestEphemeralKey(c *check.C) {
 	c.Assert(err, check.IsNil)

 	now := time.Now()
-	machine := Machine{
+	node := Node{
 		ID:             0,
 		MachineKey:     "foo",
 		NodeKey:        "bar",
@@ -145,19 +145,19 @@ func (*Suite) TestEphemeralKey(c *check.C) {
 		LastSeen:       &now,
 		AuthKeyID:      uint(pak.ID),
 	}
-	app.db.Save(&machine)
+	app.db.Save(&node)

 	_, err = app.checkKeyValidity(pak.Key)
 	// Ephemeral keys are by definition reusable
 	c.Assert(err, check.IsNil)

-	_, err = app.GetMachine("test7", "testest")
+	_, err = app.GetNode("test7", "testest")
 	c.Assert(err, check.IsNil)

 	app.expireEphemeralNodesWorker()

-	// The machine record should have been deleted
-	_, err = app.GetMachine("test7", "testest")
+	// The node record should have been deleted
+	_, err = app.GetNode("test7", "testest")
 	c.Assert(err, check.NotNil)
 }

@@ -6,7 +6,7 @@ import "google/api/annotations.proto";

 import "headscale/v1/user.proto";
 import "headscale/v1/preauthkey.proto";
-import "headscale/v1/machine.proto";
+import "headscale/v1/node.proto";
 import "headscale/v1/routes.proto";
 import "headscale/v1/apikey.proto";
 // import "headscale/v1/device.proto";
@@ -67,63 +67,63 @@ service HeadscaleService {
    }
    // --- PreAuthKeys end ---

-    // --- Machine start ---
-    rpc DebugCreateMachine(DebugCreateMachineRequest) returns(DebugCreateMachineResponse) {
+    // --- Node start ---
+    rpc DebugCreateNode(DebugCreateNodeRequest) returns(DebugCreateNodeResponse) {
        option(google.api.http) = {
-            post : "/api/v1/debug/machine"
+            post : "/api/v1/debug/node"
            body : "*"
        };
    }

-    rpc GetMachine(GetMachineRequest) returns(GetMachineResponse) {
+    rpc GetNode(GetNodeRequest) returns(GetNodeResponse) {
        option(google.api.http) = {
-            get : "/api/v1/machine/{machine_id}"
+            get : "/api/v1/node/{node_id}"
        };
    }

    rpc SetTags(SetTagsRequest) returns(SetTagsResponse) {
        option(google.api.http) = {
-            post : "/api/v1/machine/{machine_id}/tags"
+            post : "/api/v1/node/{node_id}/tags"
            body : "*"
        };
    }

-    rpc RegisterMachine(RegisterMachineRequest) returns(RegisterMachineResponse) {
+    rpc RegisterNode(RegisterNodeRequest) returns(RegisterNodeResponse) {
        option(google.api.http) = {
-            post : "/api/v1/machine/register"
+            post : "/api/v1/node/register"
        };
    }

-    rpc DeleteMachine(DeleteMachineRequest) returns(DeleteMachineResponse) {
+    rpc DeleteNode(DeleteNodeRequest) returns(DeleteNodeResponse) {
        option(google.api.http) = {
-            delete : "/api/v1/machine/{machine_id}"
+            delete : "/api/v1/node/{node_id}"
        };
    }

-    rpc ExpireMachine(ExpireMachineRequest) returns(ExpireMachineResponse) {
+    rpc ExpireNode(ExpireNodeRequest) returns(ExpireNodeResponse) {
        option(google.api.http) = {
-            post : "/api/v1/machine/{machine_id}/expire"
+            post : "/api/v1/node/{node_id}/expire"
        };
    }

-    rpc RenameMachine(RenameMachineRequest) returns(RenameMachineResponse) {
+    rpc RenameNode(RenameNodeRequest) returns(RenameNodeResponse) {
        option(google.api.http) = {
-            post : "/api/v1/machine/{machine_id}/rename/{new_name}"
+            post : "/api/v1/node/{node_id}/rename/{new_name}"
        };
    }

-    rpc ListMachines(ListMachinesRequest) returns(ListMachinesResponse) {
+    rpc ListNodes(ListNodesRequest) returns(ListNodesResponse) {
        option(google.api.http) = {
-            get : "/api/v1/machine"
+            get : "/api/v1/node"
        };
    }

-    rpc MoveMachine(MoveMachineRequest) returns(MoveMachineResponse) {
+    rpc MoveNode(MoveNodeRequest) returns(MoveNodeResponse) {
        option(google.api.http) = {
-            post : "/api/v1/machine/{machine_id}/user"
+            post : "/api/v1/node/{node_id}/user"
        };
    }
-    // --- Machine end ---
+    // --- Node end ---

    // --- Route start ---
    rpc GetRoutes(GetRoutesRequest) returns(GetRoutesResponse) {
@@ -144,9 +144,9 @@ service HeadscaleService {
        };
    }

-    rpc GetMachineRoutes(GetMachineRoutesRequest) returns(GetMachineRoutesResponse) {
+    rpc GetNodeRoutes(GetNodeRoutesRequest) returns(GetNodeRoutesResponse) {
        option(google.api.http) = {
-            get : "/api/v1/machine/{machine_id}/routes"
+            get : "/api/v1/node/{node_id}/routes"
        };
    }

@@ -13,7 +13,7 @@ enum RegisterMethod {
    REGISTER_METHOD_OIDC        = 3;
 }

-message Machine {
+message Node {
    uint64          id           = 1;
    string          machine_key  = 2;
    string          node_key     = 3;
@@ -47,80 +47,80 @@ message Machine {
    bool            online       = 22;
 }

-message RegisterMachineRequest {
+message RegisterNodeRequest {
    string user = 1;
    string key       = 2;
 }

-message RegisterMachineResponse {
-    Machine machine = 1;
+message RegisterNodeResponse {
+    Node node = 1;
 }

-message GetMachineRequest {
-    uint64 machine_id = 1;
+message GetNodeRequest {
+    uint64 node_id = 1;
 }

-message GetMachineResponse {
-    Machine machine = 1;
+message GetNodeResponse {
+    Node node = 1;
 }

 message SetTagsRequest {
-    uint64          machine_id = 1;
+    uint64          node_id = 1;
    repeated string tags       = 2;
 }

 message SetTagsResponse {
-    Machine machine = 1;
+    Node node = 1;
 }

-message DeleteMachineRequest {
-    uint64 machine_id = 1;
+message DeleteNodeRequest {
+    uint64 node_id = 1;
 }

-message DeleteMachineResponse {
+message DeleteNodeResponse {
 }

-message ExpireMachineRequest {
-    uint64 machine_id = 1;
+message ExpireNodeRequest {
+    uint64 node_id = 1;
 }

-message ExpireMachineResponse {
-    Machine machine = 1;
+message ExpireNodeResponse {
+    Node node = 1;
 }

-message RenameMachineRequest {
-    uint64 machine_id = 1;
+message RenameNodeRequest {
+    uint64 node_id = 1;
    string new_name   = 2;
 }

-message RenameMachineResponse {
-    Machine machine = 1;
+message RenameNodeResponse {
+    Node node = 1;
 }

-message ListMachinesRequest {
+message ListNodesRequest {
    string user = 1;
 }

-message ListMachinesResponse {
-    repeated Machine machines = 1;
+message ListNodesResponse {
+    repeated Node nodes = 1;
 }

-message MoveMachineRequest {
-    uint64 machine_id = 1;
+message MoveNodeRequest {
+    uint64 node_id = 1;
    string user  = 2;
 }

-message MoveMachineResponse {
-    Machine machine = 1;
+message MoveNodeResponse {
+    Node node = 1;
 }

-message DebugCreateMachineRequest {
+message DebugCreateNodeRequest {
    string user       = 1;
    string          key    = 2;
    string          name   = 3;
    repeated string routes = 4;
 }

-message DebugCreateMachineResponse {
-    Machine machine = 1;
+message DebugCreateNodeResponse {
+    Node node = 1;
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Juan Font	9f7c25e853	Refactor unit tests	2023-05-01 14:53:23 +00:00
Juan Font	851da9d674	Refactored integration tests	2023-05-01 14:52:48 +00:00
Juan Font	83b4389090	Refactored app code with Node	2023-05-01 14:52:03 +00:00
Juan Font	89fffeab31	Deleted old pb machine stuff	2023-05-01 14:51:01 +00:00
Juan Font	46221cc220	Updated CLI entries	2023-05-01 14:50:38 +00:00
Juan Font	cf22604a4b	Changed DB objects and added migrations	2023-05-01 14:49:31 +00:00
Juan Font	ae03f440ee	Rename machine in protos and gen code	2023-05-01 14:14:07 +00:00
Juan Font	47bc930ace	Rename files	2023-05-01 10:30:43 +00:00
Juan Font	a2b760834f	Fix extra space	2023-04-30 23:28:16 +02:00
loprima-l	493bcfcf18	Update mkdocs.yml Co-authored-by: Juan Font <juanfontalonso@gmail.com>	2023-04-30 23:28:16 +02:00
loprima-l	df72508089	Fix : Change master branch to main This fix should change the edit branch to main in the documentation	2023-04-30 23:28:16 +02:00
loprima-l	0f8d8fc2d8	Fix : Updating the doc path Updating the doc path to be the doc website url as it's a better documentation tool	2023-04-30 22:56:38 +02:00
Jonathan Wright	744e5a11b6	Update CHANGELOG.md Co-authored-by: Juan Font <juanfontalonso@gmail.com>	2023-04-30 18:25:43 +02:00
Jonathan Wright	3ea1750ea0	Update CHANGELOG.md	2023-04-30 18:25:43 +02:00
Jonathan Wright	a45777d22e	Put systemd service file in proper location	2023-04-30 18:25:43 +02:00
Kristoffer Dalby	56dd734300	Add go profiling flag, and enable on integration tests (#1382 )	2023-04-27 16:57:11 +02:00
Philipp Krivanec	d0113732fe	optimize generateACLPeerCacheMap (#1377 )	2023-04-26 06:02:54 +02:00
Kristoffer Dalby	6215eb6471	update flake hash (#1376 )	2023-04-24 15:52:15 +02:00
Juan Font	1d2b4bca8a	Remove legacy DERP tests	2023-04-24 12:35:29 +02:00
Juan Font	96f9680afd	Reuse Ping function for DERP ping	2023-04-24 12:17:24 +02:00
Juan Font	b465592c07	Do not use host networking in embedded DERP tests fixed linting	2023-04-24 12:17:24 +02:00
Juan Font	991ff25362	Added workflow for embedded derp	2023-04-24 12:17:24 +02:00
Juan Font	eacd687dbf	Added DERP integration tests Linting fixes Set listen addr to :8443	2023-04-24 12:17:24 +02:00
Juan Font	549f5a164d	Expand surface of hsic for better TLS support	2023-04-24 12:17:24 +02:00
Juan Font	bb07aec82c	Expand tsic to offer PingViaDerp	2023-04-24 12:17:24 +02:00
Kristoffer Dalby	a5afe4bd06	Add more capabilities for systemd Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-20 15:53:19 +02:00
Kristoffer Dalby	a71cc81fe7	fix Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-20 12:05:57 +02:00
Kristoffer Dalby	679305c3e4	Add version to binary release Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-20 12:05:57 +02:00
Kristoffer Dalby	c0680f34f1	fix issue where binaries are not released Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-20 11:10:27 +02:00
Kristoffer Dalby	64ebe6b0c8	change date in changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-20 08:13:38 +02:00
Kristoffer Dalby	e6b26499f7	release source code with vendored dependencies Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-20 08:13:38 +02:00
Kristoffer Dalby	977eb1dee3	Update flakes, add some quality of life improvements (#1346 )	2023-04-20 07:56:53 +02:00
Kristoffer Dalby	b2e2b02210	set release date Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:47:31 +02:00
Kristoffer Dalby	2abff4bb08	update changelog for #1339 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:45:27 +02:00
Kristoffer Dalby	54c00645d1	update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:04:58 +02:00
Kristoffer Dalby	cad5ce0ebd	lint fix Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:04:58 +02:00
Kristoffer Dalby	b12a167fa2	remove rpm, might add back later Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:04:58 +02:00
Kristoffer Dalby	667295e15e	add new documentation on how to install on debian/ubuntu Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:04:58 +02:00
Kristoffer Dalby	bea52678e3	move current linux documentation into "manual" Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:04:58 +02:00
Kristoffer Dalby	307cfc3304	add systemd enable to postinstall script Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-04-19 20:04:58 +02:00
Kristoffer Dalby	5e74ca9414	Fix IPv6 in ACLs (#1339 )	2023-04-16 12:26:35 +02:00
Juan Font	9836b097a4	Make sure all clients of a user are ready (#1335 )	2023-04-12 09:25:51 +02:00