Merge pull request #752 from urbit/https-proxy-config-dns

adds dns app, http(s) server-config and proxy notification moves

app/dns.hoon

@@ -0,0 +1,490 @@
+/-  dns
+=,  dns
+!:
+::
+:: moves and state
+::
+|%
++=  move  (pair bone card)
++=  poke  $%  [%dns-bind for=ship him=ship target]
+              [%dns-bond for=ship him=ship turf]
+              [%dns-authority authority]
+              :: XX some other notification channel?
+              [%helm-send-hi ship (unit tape)]
+          ==
++=  card  $%  [%tend wire ~]
+              [%poke wire dock poke]
+              [%hiss wire [~ ~] %httr %hiss hiss:eyre]
+          ==
+:: +state: complete app state
+::
++=  state
+  $:  :: dom: the set of our bindings
+      ::
+      dom=(set turf)
+      :: per: per-dependent ips &c
+      ::
+      per=(map ship relay)
+      :: nem: authoritative state
+      ::
+      nem=(unit nameserver)
+  ==
+:: +join: dedup with :acme
+::
+++  join
+  |=  [sep=@t hot=(list @t)]
+  ^-  @t
+  ?>  ?=(^ hot)
+  %+  rap  3
+  |-  ^-  (list @t)
+  ?~  t.hot  hot
+  [i.hot sep $(hot t.hot)]
+:: +name: fully-qualified domain name
+::
+++  name
+  |=  [him=ship dom=turf]
+  (cat 3 (join '.' [(crip +:(scow %p him)) (flop dom)]) '.')
+:: +endpoint: append path to purl
+::
+++  endpoint
+  |=  [bas=purl:eyre pat=path]
+  ^+  bas
+  bas(q.q (weld q.q.bas pat))
+:: +reserved: check if an ipv4 address is in a reserved range
+::
+++  reserved
+  |=  a=@if
+  ^-  ?
+  =/  b  (rip 3 a)
+  ?>  ?=([@ @ @ @ ~] b)
+  ?|  :: 0.0.0.0/8 (software)
+      ::
+      =(0 i.b)
+      :: 10.0.0.0/8 (private)
+      ::
+      =(10 i.b)
+      :: 100.64.0.0/10 (carrier-grade NAT)
+      ::
+      &(=(100 i.b) (gte 64 i.t.b) (lte 127 i.t.b))
+      :: 127.0.0.0/8 (localhost)
+      ::
+      =(127 i.b)
+      :: 169.254.0.0/16 (link-local)
+      ::
+      &(=(169 i.b) =(254 i.t.b))
+      :: 172.16.0.0/12 (private)
+      ::
+      &(=(172 i.b) (gte 16 i.t.b) (lte 31 i.t.b))
+      :: 192.0.0.0/24 (protocol assignment)
+      ::
+      &(=(192 i.b) =(0 i.t.b) =(0 i.t.t.b))
+      :: 192.0.2.0/24 (documentation)
+      ::
+      &(=(192 i.b) =(0 i.t.b) =(2 i.t.t.b))
+      :: 192.18.0.0/15 (reserved, benchmark)
+      ::
+      &(=(192 i.b) |(=(18 i.t.b) =(19 i.t.b)))
+      :: 192.51.100.0/24 (documentation)
+      ::
+      &(=(192 i.b) =(51 i.t.b) =(100 i.t.t.b))
+      :: 192.88.99.0/24 (reserved, ex-anycast)
+      ::
+      &(=(192 i.b) =(88 i.t.b) =(99 i.t.t.b))
+      :: 192.168.0.0/16 (private)
+      ::
+      &(=(192 i.b) =(168 i.t.b))
+      :: 203.0.113/24 (documentation)
+      ::
+      &(=(203 i.b) =(0 i.t.b) =(113 i.t.t.b))
+      :: 224.0.0.0/8 (multicast)
+      :: 240.0.0.0/4 (reserved, future)
+      :: 255.255.255.255/32 (broadcast)
+      ::
+      (gte 224 i.b)
+  ==
+:: |gcloud: provider-specific functions
+::
+++  gcloud
+  |_  aut=authority
+  ::  +base: provider service endpoint
+  ::
+  ++  base
+    (need (de-purl:html 'https://www.googleapis.com/dns/v1/projects'))
+  :: +record: JSON-formatted provider-specific dns record
+  ::
+  ++  record
+    |=  [him=ship tar=target]
+    ^-  json
+    :: ?>  ?=([%gcloud *] pro.aut)
+    =+  ^-  [typ=cord dat=cord]
+      ?:  ?=(%direct -.tar)
+        ['A' (crip +:(scow %if p.tar))]
+      ['CNAME' (name p.tar dom.aut)]
+    :-  %o  %-  my  :~
+      name+s+(name him dom.aut)
+      type+s+typ
+      :: XX make configureable?
+      ttl+n+~.300
+      rrdatas+a+[s+dat ~]
+    ==
+  :: +request: provider-specific record-creation request
+  ::
+  ++  request
+    =,  eyre
+    |=  [him=ship tar=target pre=(unit target)]
+    ^-  hiss
+    :: ?>  ?=([%gcloud *] pro.aut)
+    =/  url=purl
+      %+  endpoint  base
+      /[project.pro.aut]/['managedZones']/[zone.pro.aut]/changes
+    =/  hed=math
+      (my content-type+['application/json' ~] ~)
+    =/  bod=octs
+      %-  as-octt:mimes:html
+      %-  en-json:html
+      :-  %o  %-  my
+      :-  additions+a+[(record him tar) ~]
+      ?~  pre  ~
+      [deletions+a+[(record him u.pre) ~] ~]
+    [url %post hed `bod]
+  --
+--
+::
+::  the app itself
+::
+|_  [bow=bowl:gall state]
+++  this  .
+:: +poke-noun: debugging
+::
+++  poke-noun
+  |=  a=*
+  ^-  (quip move _this)
+  ~&  +<+:this
+  [~ this]
+:: +sigh-httr: accept http response
+::
+++  sigh-httr
+  |=  [wir=wire rep=httr:eyre]
+  ^-  (quip move _this)
+  ?-  wir
+      [%authority %confirm ~]
+    ?~  nem
+      ~&  [%strange-authority wire=wir response=rep]
+      [~ this]
+    ?.  =(200 p.rep)
+      ~&  [%authority-confirm-fail rep]
+      [~ this(nem ~)]
+    :: XX anything to do here? parse body?
+    [~ this]
+  ::
+      [%authority %create @ %for @ ~]
+    ?~  nem
+      ~&  [%strange-authority wire=wir response=rep]
+      [~ this]
+    ?.  =(200 p.rep)
+      ~&  [%authority-create-fail wire=wir response=rep]
+      [~ this]
+    =/  him=ship  (slav %p i.t.t.wir)
+    =/  for=ship  (slav %p i.t.t.t.t.wir)
+    abet:(~(confirm bind u.nem) for him)
+  ::
+      [%check @ ~]
+    =/  him=ship  (slav %p i.t.wir)
+    ?:  =(200 p.rep)
+      abet:~(bind tell [him (~(get by per) him)])
+    :: XX specific messages per status code
+    ~&  %direct-confirm-fail
+    abet:(~(fail tell [him (~(get by per) him)]) %failed-request)
+  ::
+      *
+    ~&  +<
+    [~ this]
+  ==
+:: +sigh-tang: failed to make http request
+::
+++  sigh-tang
+  |=  [wir=wire saw=tang]
+  ^-  (quip move _this)
+  ~&  [%sigh-tang wir]
+  ?+  wir
+        [((slog saw) ~) this]
+  ::
+      [%authority %confirm ~]
+    ~&  %authority-confirm-fail
+    [((slog saw) ~) this(nem ~)]
+  ::
+      [%check @ ~]
+    ~&  %direct-confirm-fail
+    =/  him=ship  (slav %p i.t.wir)
+    %-  (slog saw)
+    abet:(~(fail tell [him (~(get by per) him)]) %crash)
+  ==
+::
+:: +poke-dns-authority: configure self as an authority
+::
+++  poke-dns-authority
+  |=  aut=authority
+  ^-  (quip move _this)
+  ~|  %authority-reset-wat-do
+  ?<  ?=(^ nem)
+  abet:(init:bind aut)
+:: +poke-dns-bind: create binding (if authority), forward request
+::
+++  poke-dns-bind
+  |=  [for=ship him=ship tar=target]
+  ^-  (quip move _this)
+  ~&  [%bind src=src.bow +<.$]
+  =/  lan  (clan:title him)
+  ?:  ?=(%czar lan)
+    ~|(%bind-galazy !!)
+  ?:  =(for him)
+    ~|(%bind-yoself !!)
+  ?:  ?&  ?=(%king lan)
+          ?=(%indirect -.tar)
+      ==
+    ~|(%bind-indirect-star !!)
+  :: always forward, there may be multiple authorities
+  ::
+  =^  zom=(list move)  ..this
+    abet:(~(forward tell [him (~(get by per) him)]) for tar)
+  =^  zam=(list move)  ..this
+    ?~  nem  [~ this]
+    abet:(~(create bind u.nem) for him tar)
+  [(weld zom zam) this]
+:: +poke-dns-bond: process established dns binding
+::
+++  poke-dns-bond
+  |=  [for=ship him=ship dom=turf]
+  ^-  (quip move _this)
+  ?:  =(for him)
+    ~|(%bond-yoself !!)
+  ?:  =(our.bow him)
+    :: XX notify eyre/hood/acme etc
+    ~&  [%bound-us dom]
+    :-  ~
+    this(dom (~(put in ^dom) dom))
+  ?:  =(our.bow for)
+    ~&  [%bound-him him dom]
+    =<  abet
+    (~(bake tell [him (~(get by per) him)]) dom)
+  ~&  [%strange-bond +<]
+  [~ this]
+:: +coup: general poke acknowledgement or error
+::
+++  coup
+  |=  [wir=wire saw=(unit tang)]
+  ?~  saw  [~ this]
+  ~&  [%coup-fallthru wir]
+  [((slog u.saw) ~) this]
+:: +rove: hear %ames +lane change for child ships
+::
+++  rove
+  |=  [wir=wire p=ship q=lane:ames]
+  ^-  (quip move _this)
+  ?.  =(our.bow (sein:title p))  :: XX check will
+    ~&  [%rove-false p]
+    [~ this]
+  ~&  [%rove wir p q]
+  ::  XX assert that we intend to be listening?
+  =<  abet
+  (~(hear tell [p (~(get by per) p)]) q)
+:: +prep: adapt state
+::
+:: ++  prep  _[~ this]
+++  prep
+  |=  old=(unit state)
+  ^-  (quip move _this)
+  ?^  old
+    [~ this(+<+ u.old)]
+  ?:  ?=(?(%czar %king) (clan:title our.bow))
+    abet:listen:tell
+  [~ this]
+:: |bind: acting as zone authority
+::
+++  bind
+  =|  moz=(list move)
+  |_  nam=nameserver
+  ++  this  .
+  :: +abet: finalize state changes, produce moves
+  ::
+  ++  abet
+    ^-  (quip move _^this)
+    [(flop moz) ^this(nem `nam)]
+  :: +emit: emit a move
+  ::
+  ++  emit
+    |=  car=card
+    ^+  this
+    this(moz [[ost.bow car] moz])
+  :: +init: establish zone authority (request confirmation)
+  ::
+  ++  init
+    |=  aut=authority
+    :: ?>  ?=(%gcloud pro.aut)
+    =/  wir=wire  /authority/confirm
+    =/  url=purl:eyre
+      %+  endpoint  base:gcloud
+      /[project.pro.aut]/['managedZones']/[zone.pro.aut]
+    ~&  url
+    %-  emit(nam [aut ~ ~])
+    [%hiss wir [~ ~] %httr %hiss url %get ~ ~]
+  :: +create: bind :him, on behalf of :for
+  ::
+  ++  create
+    |=  [for=ship him=ship tar=target]
+    :: XX defer %indirect where target isn't yet bound
+    ?>  ?|  ?=(%direct -.tar)
+            (~(has by bon.nam) p.tar)
+        ==
+    =/  wir=wire
+      /authority/create/(scot %p him)/for/(scot %p for)
+    =/  pre=(unit target)
+      =/  bon=(unit bound)  (~(get by bon.nam) him)
+      ?~(bon ~ `cur.u.bon)
+    :: ?>  ?=(%gcloud pro.aut.nam)
+    =/  req=hiss:eyre
+      (~(request gcloud aut.nam) him tar pre)
+    %-  emit(pen.nam (~(put by pen.nam) him tar)) :: XX save for
+    [%hiss wir [~ ~] %httr %hiss req]
+  :: +confirm: successfully bound
+  ::
+  ++  confirm
+    |=  [for=ship him=ship]
+    =/  tar=target  (~(got by pen.nam) him)
+    =/  bon=(unit bound)
+      (~(get by bon.nam) him)
+    =/  nob=bound
+      [now.bow tar ?~(bon ~ [[wen.u.bon cur.u.bon] hit.u.bon])]
+    =.  pen.nam  (~(del by pen.nam) him)
+    =.  bon.nam  (~(put by bon.nam) him nob)
+    =/  wir=wire
+      /bound/(scot %p him)/for/(scot %p for)
+    =/  dom=turf
+      (weld dom.aut.nam /(crip +:(scow %p him)))
+    %-  emit
+    [%poke wir [for dap.bow] %dns-bond for him dom]
+  --
+:: |tell: acting as planet parent or relay
+::
+++  tell
+  =|  moz=(list move)
+  |_  [him=ship rel=(unit relay)]
+  ++  this  .
+  :: +abet: finalize state changes, produce moves
+  ::
+  ++  abet
+    ^-  (quip move _^this)
+    :-  (flop moz)
+    ?~  rel
+      ^this
+    ^this(per (~(put by per) him u.rel))
+  :: +emit: emit a move
+  ::
+  ++  emit
+    |=  car=card
+    ^+  this
+    this(moz [[ost.bow car] moz])
+  :: +listen: subscribe to %ames +lane changes for child ships
+  ::
+  ++  listen
+    ^+  this
+    (emit [%tend /tend ~])
+  :: +hear: hear +lane change, maybe emit binding request
+  ::
+  ++  hear
+    |=  lan=lane:ames
+    ^+  this
+    =/  adr=(unit @if)
+      ?.(?=([%if *] lan) ~ `r.lan)
+    =/  tar=target
+      ?:  ?|  ?=(~ adr)
+              ?=(%duke (clan:title him))
+          ==
+        [%indirect our.bow]
+      [%direct %if u.adr]
+    ?.  ?|  ?=(~ rel)
+            !=(tar tar.u.rel)
+        ==
+      this
+    =.  rel  `[wen=now.bow adr bon=| tar]
+    ?:(?=(%indirect -.tar) bind check)
+  :: +check: confirm %direct target is accessible
+  ::
+  ++  check
+    ^+  this
+    ?>  ?=(^ rel)
+    ?>  ?=(%direct -.tar.u.rel)
+    ?:  (reserved p.tar.u.rel)
+      (fail %reserved-ip)
+    =/  wir=wire
+      /check/(scot %p him)
+    =/  url=purl:eyre
+      :-  [sec=| por=~ host=[%| `@if`p.tar.u.rel]]
+      [[ext=`~.md path=~] query=~]
+    :: XX state mgmt
+    %-  emit
+    [%hiss wir [~ ~] %httr %hiss url %get ~ ~]
+  :: +fail: %direct target is invalid or inaccessible
+  ::
+  ++  fail
+    |=  err=@tas
+    ^+  this
+    ?>  ?=(^ rel)
+    ~&  [%fail err him tar.u.rel]
+    =/  wir=wire
+      /fail/(scot %p him)
+    =/  msg=tape
+      ?+  err
+            "dns binding failed"
+      ::
+          %reserved-ip
+        ?>  ?=(%direct -.tar.u.rel)
+        "unable to create dns binding reserved address {(scow %if p.tar.u.rel)}"
+      ==
+    :: XX state mgmt
+    %-  emit
+    [%poke wir [our.bow %hood] %helm-send-hi him `msg]
+  :: +bind: request binding for target
+  ::
+  ::   Since we may be an authority, we poke ourselves.
+  ::
+  ++  bind
+    ^+  this
+    ?>  ?=(^ rel)
+    :: XX state mgmt
+    =/  wir=wire
+      /bind/(scot %p him)/for/(scot %p our.bow)
+    %-  emit
+    [%poke wir [our.bow dap.bow] %dns-bind our.bow him tar.u.rel]
+  :: +bake: successfully bound
+  ::
+  ++  bake
+    |=  dom=turf
+    ~&  [%bake dom]
+    ^+  this
+    ?>  ?=(^ rel)
+    =/  wir=wire
+      /forward/bound/(scot %p him)/for/(scot %p our.bow)
+    :: XX save domain, track bound-state per-domain
+    %-  emit(bon.u.rel &)
+    [%poke wir [him dap.bow] %dns-bond our.bow him dom]
+  :: +forward: sending binding request up the network
+  ::
+  ++  forward
+    |=  [for=ship tar=target]
+    ~&  [%forward tar]
+    ^+  this
+    ?:  ?=(%~zod our.bow)  ::  ~zod don't forward
+      ~&  [%zod-no-forward him tar]
+      this
+    =/  to=ship
+      ?-  (clan:title our.bow)
+        %czar  ~zod
+        *      (sein:title our.bow)
+      ==
+    =/  wir=wire
+      /forward/bind/(scot %p him)/for/(scot %p for)
+    %-  emit  :: XX for
+    [%poke wir [to dap.bow] %dns-bind for him tar]
+  --
+--

gen/dns/authority.hoon

@@ -0,0 +1,30 @@
+::  DNS: configure zone authority
+::
+::::  /hoon/authority/dns/gen
+  ::
+/-  dns, sole
+=,  [dns sole]
+:-  %ask
+|=  $:  [now=@da eny=@uvJ bec=beak]
+        [arg=$@(~ [dom=path ~])]
+        ~
+    ==
+^-  (sole-result [%dns-authority authority])
+=-  ?~  arg  -
+    (fun.q.q [%& dom.arg])
+%+  sole-lo
+  [%& %dns-domain "dns domain: "]
+%+  sole-go  thos:de-purl:html
+|=  hot=host:eyre
+?:  ?=($| -.hot)
+  ~|(%ips-unsupported !!)
+%+  sole-lo
+  [%& %project "gcloud project: "]
+%+  sole-go  urs:ab
+|=  project=@ta
+%+  sole-lo
+  [%& %zone "dns zone: "]
+%+  sole-go  urs:ab
+|=  zone=@ta
+%+  sole-so  %dns-authority
+[p.hot %gcloud project zone]

lib/hood/drum.hoon

@@ -80,7 +80,12 @@
   =+  myr=(clan:title our)
   ?:  ?=($pawn myr)
     [[%base %collections] [%base %hall] [%base %talk] [%base %dojo] ~]
-  [[%home %collections] [%home %hall] [%home %talk] [%home %dojo] ~]
+  :~  [%home %collections]
+      [%home %dns]
+      [%home %dojo]
+      [%home %hall]
+      [%home %talk]
+  ==
 ::
 ++  deft-fish                                           ::  default connects
   |=  our/ship

mar/dns/bind.hoon

@@ -0,0 +1,11 @@
+::
+::::  /mar/dns/bind/hoon
+  ::
+/-  dns
+=,  dns
+|_  [for=ship him=ship target]
+++  grab
+  |%
+  ++  noun  ,[for=ship him=ship target]
+  --
+--

mar/dns/bond.hoon

@@ -0,0 +1,11 @@
+::
+::::  /mar/dns/bond/hoon
+  ::
+/-  dns
+=,  dns
+|_  [for=ship him=ship turf]
+++  grab
+  |%
+  ++  noun  ,[for=ship him=ship turf]
+  --
+--

sec/com/googleapis.hoon

@@ -29,6 +29,8 @@
   :~  'https://mail.google.com'
       'https://www.googleapis.com/auth/plus.me'
       'https://www.googleapis.com/auth/userinfo.email'
+      'https://www.googleapis.com/auth/ndev.clouddns.readwrite'
+      'https://www.googleapis.com/auth/cloud-platform.read-only'
   ==
 ::
 ++  exchange-url  'https://www.googleapis.com/oauth2/v4/token'

sur/dns.hoon

@@ -0,0 +1,58 @@
+|%
+:: +turf: a domain, TLD first
+::
++=  turf  (list @t)
+:: +provider: DNS service provider (gcloud only for now)
+::
++=  provider
+  $%  [%gcloud project=@ta zone=@ta]
+  ==
+:: +authority: responsibility for a DNS zone
+::
++=  authority
+  $:  :: dom: authority over a fully-qualified domain
+      ::
+      dom=turf
+      :: pro: DNS service provider
+      ::
+      pro=provider
+  ==
+:: +target: a ship is bound to a ...
+::
++=  target
+  $%  :: %direct: an A record
+      ::
+      [%direct %if p=@if]
+      :: %indirect: a CNAME record
+      ::
+      [%indirect p=ship]
+  ==
+:: +bound: an established binding, plus history
+::
++=  bound
+  $:  :: wen: established
+      ::
+      wen=@da
+      :: cur: current target
+      ::
+      cur=target
+      :: hit: historical targets
+      ::
+      hit=(list (pair @da target))
+  ==
+:: +nameserver: a b s o l u t e  p o w e r
+::
++=  nameserver
+  $:  aut=authority
+      pen=(map ship target)
+      bon=(map ship bound)
+  ==
+:: +relay: a good parent keeps track
+::
++=  relay
+  $:  wen=@da
+      wer=(unit @if)
+      bon=?
+      tar=target
+  ==
+--

sys/vane/ames.hoon

@@ -445,6 +445,7 @@
         +>.$(hoc.saf (~(put by hoc.saf) her [[~31337.1.1 ~ wil] ~ *clot]))
       ::
       ++  lax                                           ::    lax:as:go
+        =|  rov=(unit lane)                             ::  maybe lane change
         |_  [her=ship dur=dore]                         ::  per client
         ++  cluy                                        ::    cluy:lax:as:go
           ^-  [p=life q=gens r=acru]                    ::  client crypto
@@ -518,6 +519,25 @@
                 [~ ryn]
               lun.wod.dur
             [~ ryn]
+          ::
+              rov
+            |-  ^-  (unit lane)
+            :: XX check will
+            ?:  ?|  !=(our (sein:title her))
+                    ?=(?(%earl %pawn) (clan:title her))
+                ==
+              ~
+            ?-  ryn
+              [%if *]  ?.  ?=([~ %if *] lun.wod.dur)
+                         `ryn
+                       ?:(=(r.u.lun.wod.dur r.ryn) ~ `ryn)
+              ::
+              [%ix *]  ?.  ?=([~ %ix *] lun.wod.dur)
+                         `ryn
+                       ?:(=(r.u.lun.wod.dur r.ryn) ~ `ryn)
+              ::
+              [%is *]  ?~(q.ryn ~ $(ryn u.q.ryn))
+            ==
           ==
         ::
         ++  wist                                        ::    wist:lax:as:go
@@ -1471,8 +1491,10 @@
           ==
         ::
         ++  zank                                        ::    zank:ho:um:am
+          =?  bin  ?=(^ rov.diz)
+              [[%maze her u.rov.diz] bin]
           %=  +>.$                                      ::  resolve
-            gus      (nux:gus diz)
+            gus      (nux:gus diz(rov ~))
             wab.weg  (~(put by wab.weg) her bah(sop abet:puz))
           ==
         --                                              ::  --ho:um:am
@@ -1553,9 +1575,14 @@
       (hunt lth doz rtn.sop.bah)
     ::
     ++  load
-      |=  old=fort
+      =/  old-fort
-      ~&  %ames-reload
+        (cork fort |=(fort [%0 gad=gad hop=hop bad=bad ton=ton zac=zac]))
-      ..^$(fox old)
+      |=  old=?(fort old-fort)
+      ?-  old
+        [%0 *]  $(old [%1 gad hop bad ton zac ~]:old)
+        [%1 *]  ~&  %ames-reload
+                ..^$(fox old)
+      ==
     ::
     ++  scry
       |=  [fur=(unit (set monk)) ren=@tas why=shop syd=desk lot=coin tyl=path]
@@ -1604,6 +1631,11 @@
       :_  fox
       :~  [s.bon %give %woot q.p.bon r.bon]
       ==
+    ::
+        %maze
+      :_  fox
+      %+  turn  ~(tap in ten.fox)
+      |=(hen=duct [hen %give %rove p.bon q.bon])
     ::
         %mead  :_(fox [[hen [%give %hear p.bon q.bon]] ~])
         %milk
@@ -1713,6 +1745,14 @@
         ::
             %sith
           (~(czar am [now fox]) p.kyz q.kyz r.kyz)
+        ::
+            %tend
+          :: XX exclude comets and moons? and planets?
+          :: ?>  &(?=(^ hen) ?=([@ @ *] i.hen))
+          :: =/  who=@p  (slav %p i.t.i.hen)
+          :: ?:  ?=((%earl %pawn) (clan:title who))
+          ::   [~ fox]
+          [~ fox(ten (~(put in ten.fox) hen))]
         ::
             %nuke
           :-  ~

sys/vane/eyre.hoon

@@ -636,7 +636,14 @@
     =.  our  ?~(hov our u.hov)  ::  XX
     =.  p.top  our              ::  XX necessary?
     ?-    -.kyz
-        $born  +>.$(ged hen)                            ::  register external
+        $born
+      %=  +>.$
+        ged  hen                                        ::  register external
+        mow  :_(mow [hen [%give %form [~ ?=(%king our) & &]]])
+      ==
+    ::
+        $live  +>.$             :: XX save ports
+    ::
         $serv
       =<  ~&([%serving (en-beam top)] .)
       ?^(p.kyz +>.$(top p.kyz) +>.$(q.top p.kyz))
@@ -794,9 +801,13 @@
             :+  %call  [%core (norm-beak bek) /wrap/[ext]/ren]
             [[%$ deps+!>(dep)] [%vale res]]
           ==
+      ::
+        $not  +>.$(mow :_(mow [ged [%give %that q.p.kyz p.u.mez q.u.mez]]))
       ==
     ::
       $wegh  !!                                         ::  handled elsewhere
+    ::
+      $wise  (ames-gram p.kyz [%not ~] q.kyz r.kyz)     ::  proxy notification
     ==
   ::
   ::++  axom                                              ::  old response

sys/vane/gall.hoon

@@ -1223,6 +1223,7 @@
         $ogre  `%c
         $perm  `%c
         $serv  `%e
+        $tend  `%a
         $them  `%e
         $wait  `%b
         $want  `%a

sys/zuse.hoon

@@ -135,6 +135,7 @@
           {$init p/@p}                                  ::  report install
           {$mack p/(unit tang)}                         ::  
           {$mass p/mass}                                ::  memory usage
+          {$rove p/ship q/lane}                         ::  lane change
           {$send p/lane q/@}                            ::  transmit packet
           {$woot p/ship q/coop}                         ::  reaction message
       ==                                                ::
@@ -161,6 +162,7 @@
           {$nuke p/@p}                                  ::  toggle auto-block
           {$make p/(unit @t) q/@ud r/@ s/?}             ::  wild license
           {$sith p/@p q/@uw r/?}                        ::  imperial generator
+          {$tend $~}                                    ::  watch lane changes
           {$wake $~}                                    ::  timer activate
           {$wegh $~}                                    ::  report memory
           {$west p/sack q/path r/*}                     ::  network request
@@ -203,6 +205,7 @@
   ++  boon                                              ::  fort output
     $%  {$beer p/ship q/@uvG}                           ::  gained ownership
         {$cake p/sock q/soap r/coop s/duct}             ::  e2e message result
+        {$maze p/ship q/lane}                           ::  lane change
         {$mead p/lane q/rock}                           ::  accept packet
         {$milk p/sock q/soap r/*}                       ::  e2e pass message
         {$ouzo p/lane q/rock}                           ::  transmit packet
@@ -240,12 +243,13 @@
         wid/@ud                                         ::  logical wdow msgs
     ==                                                  ::
   ++  fort                                              ::  formal state
-    $:  $0                                              ::  version
+    $:  $1                                              ::  version
         gad/duct                                        ::  client interface
         hop/@da                                         ::  network boot date
         bad/(set @p)                                    ::  bad ships
         ton/town                                        ::  security
         zac/(map ship corn)                             ::  flows by server
+        ten/(set duct)                                  ::  watch lanes
     ==                                                  ::
   ++  gcos                                              ::  id description
     $%  {$czar $~}                                      ::  8-bit ship
@@ -661,9 +665,11 @@
   ++  able  ^?
     |%
     +=  gift                                            ::  out result <-$
-      $%  [%mass p=mass]                                ::  memory usage
+      $%  [%form p=http-config]                         ::  configuration
+          [%mass p=mass]                                ::  memory usage
           [%mack p=(unit tang)]                         ::  message ack
           [%sigh p=cage]                                ::  marked http response
+          [%that p=@p q=@ud r=?]                        ::  get proxied request
           [%thou p=httr]                                ::  raw http response
           [%thus p=@ud q=(unit hiss)]                   ::  http request+cancel
           [%veer p=@ta q=path r=@t]                     ::  drop-through
@@ -675,6 +681,7 @@
           [%crud p=@tas q=(list tank)]                  ::  XX rethink
           [%hiss p=(unit user) q=mark r=cage]           ::  outbound user req
           [%init p=@p]                                  ::  report install
+          [%live p=@ud q=(unit @ud)]                    ::  http/s ports
           [%serv p=$@(desk beam)]                       ::  set serving root
           [%them p=(unit hiss)]                         ::  outbound request
           [%they p=@ud q=httr]                          ::  inbound response
@@ -684,6 +691,7 @@
           [%wegh ~]                                     ::  report memory
           [%went p=sack q=path r=@ud s=coop]            ::  response confirm
           [%west p=sack q=[path *]]                     ::  network request
+          [%wise p=@p q=@ud r=?]                        ::  proxy notification
       ==                                                ::
     --  ::able
   ::
@@ -720,6 +728,8 @@
       ::
         [[%get-inner ~] p=@uvH q=beam r=mark]  ::TODO details?
         [[%got-inner ~] p=@uvH q=(each (cask) tang)]  ::TODO details?
+      ::
+        [[%not ~] p=@ud q=?]                            ::  proxy notification
     ==                                                  ::
   ++  hart  {p/? q/(unit @ud) r/host}                   ::  http sec+port+host
   ++  hate  {p/purl q/@p r/moth}                        ::  semi-cooked request
@@ -730,6 +740,24 @@
   ++  host  (each (list @t) @if)                        ::  http host
   ++  hoke  %+  each   {$localhost $~}                  ::  local host
             ?($.0.0.0.0 $.127.0.0.1)                    ::
+  :: +http-config: full http-server configuration
+  ::
+  +=  http-config
+    $:  :: secure: PEM-encoded RSA private key and certificate chain
+        ::
+        secure=(unit [key=wain certificate=wain])
+        :: proxy: reverse TCP proxy HTTP(s)
+        ::
+        proxy=?
+        :: log: keep HTTP(s) access logs
+        ::
+        log=?
+        :: redirect: send 301 redirects to upgrade HTTP to HTTPS
+        ::
+        ::   Note: requires certificate.
+        ::
+        redirect=?
+    ==
   ++  httq                                              ::  raw http request
     $:  p/meth                                          ::  method
         q/@t                                            ::  unparsed url