Merge branch 'local-connection' of github.com:fosrl/pangolin into local-connection

compose.example.yaml

@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.7
+    image: traefik:v3.6
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

install/config/docker-compose.yml

@@ -50,7 +50,7 @@ services:
       - 80:80{{end}}
 
   traefik:
-    image: docker.io/traefik:v3.7
+    image: docker.io/traefik:v3.6
     container_name: traefik
     restart: unless-stopped
     {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}

messages/en-US.json

@@ -3811,5 +3811,6 @@
     "rdpUploadFailed": "Upload failed",
     "rdpUnicodeKeyboardMode": "Unicode keyboard mode",
     "sessionToolbarShow": "Show toolbar",
-    "sessionToolbarHide": "Hide toolbar"
+    "sessionToolbarHide": "Hide toolbar",
+    "actionUpdateSiteApprovals": "Update Site Approvals"
 }

package.json

@@ -32,10 +32,10 @@
         "format": "prettier --write ."
     },
     "dependencies": {
-        "@asteasolutions/zod-to-openapi": "9.0.0",
+        "@asteasolutions/zod-to-openapi": "8.5.0",
         "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
         "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
-        "@aws-sdk/client-s3": "3.1089.0",
+        "@aws-sdk/client-s3": "3.1056.0",
         "@headlessui/react": "2.2.10",
         "@hookform/resolvers": "5.4.0",
         "@monaco-editor/react": "4.7.0",
@@ -43,38 +43,38 @@
         "@novnc/novnc": "^1.7.0",
         "@oslojs/crypto": "1.0.1",
         "@oslojs/encoding": "1.1.0",
-        "@radix-ui/react-avatar": "1.2.2",
-        "@radix-ui/react-checkbox": "1.3.7",
-        "@radix-ui/react-collapsible": "1.1.16",
-        "@radix-ui/react-dialog": "1.1.19",
-        "@radix-ui/react-dropdown-menu": "2.1.20",
+        "@radix-ui/react-avatar": "1.1.11",
+        "@radix-ui/react-checkbox": "1.3.3",
+        "@radix-ui/react-collapsible": "1.1.12",
+        "@radix-ui/react-dialog": "1.1.15",
+        "@radix-ui/react-dropdown-menu": "2.1.16",
         "@radix-ui/react-icons": "1.3.2",
-        "@radix-ui/react-label": "2.1.11",
-        "@radix-ui/react-popover": "1.1.19",
-        "@radix-ui/react-progress": "1.1.12",
-        "@radix-ui/react-radio-group": "1.4.3",
-        "@radix-ui/react-scroll-area": "1.2.14",
-        "@radix-ui/react-select": "2.3.3",
-        "@radix-ui/react-separator": "1.1.11",
-        "@radix-ui/react-slot": "1.3.0",
-        "@radix-ui/react-switch": "1.3.3",
-        "@radix-ui/react-tabs": "1.1.17",
-        "@radix-ui/react-toast": "1.2.19",
-        "@radix-ui/react-tooltip": "1.2.12",
+        "@radix-ui/react-label": "2.1.8",
+        "@radix-ui/react-popover": "1.1.15",
+        "@radix-ui/react-progress": "1.1.8",
+        "@radix-ui/react-radio-group": "1.3.8",
+        "@radix-ui/react-scroll-area": "1.2.10",
+        "@radix-ui/react-select": "2.2.6",
+        "@radix-ui/react-separator": "1.1.8",
+        "@radix-ui/react-slot": "1.2.4",
+        "@radix-ui/react-switch": "1.2.6",
+        "@radix-ui/react-tabs": "1.1.13",
+        "@radix-ui/react-toast": "1.2.15",
+        "@radix-ui/react-tooltip": "1.2.8",
         "@react-email/body": "0.3.0",
         "@react-email/components": "1.0.12",
-        "@react-email/render": "2.1.0",
+        "@react-email/render": "2.0.8",
         "@react-email/tailwind": "2.0.7",
         "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.2",
+        "@simplewebauthn/server": "13.3.1",
         "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.101.2",
+        "@tanstack/react-query": "5.100.14",
         "@tanstack/react-table": "8.21.3",
         "@xterm/addon-fit": "^0.11.0",
         "@xterm/addon-web-links": "^0.12.0",
         "@xterm/xterm": "^6.0.0",
         "arctic": "3.7.0",
-        "axios": "1.18.1",
+        "axios": "1.16.1",
         "better-sqlite3": "11.9.1",
         "canvas-confetti": "1.9.4",
         "class-variance-authority": "0.7.1",
@@ -86,61 +86,61 @@
         "d3": "7.9.0",
         "drizzle-orm": "0.45.2",
         "express": "5.2.1",
-        "express-rate-limit": "8.6.0",
+        "express-rate-limit": "8.5.2",
         "glob": "13.0.6",
-        "helmet": "8.3.0",
+        "helmet": "8.2.0",
         "http-errors": "2.0.1",
         "input-otp": "1.4.2",
-        "ioredis": "5.11.1",
+        "ioredis": "5.11.0",
         "jmespath": "0.16.0",
-        "js-yaml": "5.2.1",
+        "js-yaml": "4.2.0",
         "jsonwebtoken": "9.0.3",
-        "lucide-react": "1.24.0",
+        "lucide-react": "1.17.0",
         "maxmind": "5.0.6",
         "moment": "2.30.1",
-        "next": "16.2.10",
-        "next-intl": "4.13.2",
+        "next": "16.2.6",
+        "next-intl": "4.13.0",
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
         "node-cache": "5.1.2",
-        "nodemailer": "9.0.3",
+        "nodemailer": "9.0.1",
         "oslo": "1.2.1",
-        "pg": "8.22.0",
-        "posthog-node": "5.45.2",
+        "pg": "8.21.0",
+        "posthog-node": "5.35.6",
         "qrcode.react": "4.2.0",
-        "react": "19.2.7",
-        "react-day-picker": "10.0.1",
-        "react-dom": "19.2.7",
+        "react": "19.2.6",
+        "react-day-picker": "9.14.0",
+        "react-dom": "19.2.6",
         "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.81.0",
-        "react-icons": "5.7.0",
-        "recharts": "3.9.2",
+        "react-hook-form": "7.76.1",
+        "react-icons": "5.6.0",
+        "recharts": "3.8.1",
         "reodotdev": "1.1.0",
-        "semver": "7.8.5",
+        "semver": "7.8.1",
         "sshpk": "1.18.0",
-        "stripe": "22.3.2",
+        "stripe": "22.2.0",
         "swagger-ui-express": "5.0.1",
         "tailwind-merge": "3.6.0",
         "topojson-client": "3.1.0",
         "tw-animate-css": "1.4.0",
         "use-debounce": "10.1.1",
-        "uuid": "14.0.1",
+        "uuid": "14.0.0",
         "vaul": "1.1.2",
         "visionscarto-world-atlas": "1.0.0",
         "winston": "3.19.0",
         "winston-daily-rotate-file": "5.0.0",
-        "ws": "8.21.1",
+        "ws": "8.21.0",
         "yaml": "2.9.0",
         "yargs": "18.0.0",
         "zod": "4.4.3",
         "zod-validation-error": "5.0.0"
     },
     "devDependencies": {
-        "@dotenvx/dotenvx": "2.14.0",
+        "@dotenvx/dotenvx": "1.69.1",
         "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.9.0",
-        "@tailwindcss/postcss": "4.3.3",
-        "@tanstack/react-query-devtools": "5.101.2",
+        "@react-email/ui": "^6.5.0",
+        "@tailwindcss/postcss": "4.3.0",
+        "@tanstack/react-query-devtools": "5.100.14",
         "@types/better-sqlite3": "7.6.13",
         "@types/cookie-parser": "1.4.10",
         "@types/cors": "2.8.19",
@@ -151,14 +151,14 @@
         "@types/jmespath": "0.15.2",
         "@types/js-yaml": "4.0.9",
         "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "26.1.1",
-        "@types/nodemailer": "8.0.1",
+        "@types/node": "25.9.1",
+        "@types/nodemailer": "8.0.0",
         "@types/nprogress": "0.2.3",
         "@types/pg": "8.20.0",
-        "@types/react": "19.2.17",
+        "@types/react": "19.2.15",
         "@types/react-dom": "19.2.3",
         "@types/semver": "7.7.1",
-        "@types/sshpk": "1.17.5",
+        "@types/sshpk": "1.17.4",
         "@types/swagger-ui-express": "4.1.8",
         "@types/topojson-client": "3.1.5",
         "@types/ws": "8.18.1",
@@ -166,21 +166,21 @@
         "babel-plugin-react-compiler": "1.0.0",
         "drizzle-kit": "0.31.10",
         "esbuild": "0.28.1",
-        "esbuild-node-externals": "1.23.1",
-        "eslint": "10.7.0",
-        "eslint-config-next": "16.2.10",
-        "postcss": "8.5.19",
-        "prettier": "3.9.5",
-        "react-email": "6.9.0",
-        "tailwindcss": "4.3.3",
-        "tsc-alias": "1.9.1",
-        "tsx": "4.23.1",
-        "typescript": "7.0.2",
-        "typescript-eslint": "8.64.0"
+        "esbuild-node-externals": "1.22.0",
+        "eslint": "10.4.0",
+        "eslint-config-next": "16.2.6",
+        "postcss": "8.5.15",
+        "prettier": "3.8.3",
+        "react-email": "6.5.0",
+        "tailwindcss": "4.3.0",
+        "tsc-alias": "1.8.17",
+        "tsx": "4.22.3",
+        "typescript": "6.0.3",
+        "typescript-eslint": "8.60.0"
     },
     "overrides": {
         "esbuild": "0.28.1",
         "dompurify": "3.4.0",
-        "postcss": "8.5.19"
+        "postcss": "8.5.15"
     }
 }

server/db/pg/schema/schema.ts

@@ -107,6 +107,7 @@ export const sites = pgTable(
         lastPing: integer("lastPing"),
         address: varchar("address"),
         endpoint: varchar("endpoint"),
+        localEndpoints: varchar("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
         publicKey: varchar("publicKey"),
         lastHolePunch: bigint("lastHolePunch", { mode: "number" }),
         listenPort: integer("listenPort"),

server/db/sqlite/schema/schema.ts

@@ -118,6 +118,7 @@ export const sites = sqliteTable("sites", {
     // exit node stuff that is how to connect to the site when it has a wg server
     address: text("address"), // this is the address of the wireguard interface in newt
     endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
+    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
     publicKey: text("publicKey"), // TODO: Fix typo in publicKey
     lastHolePunch: integer("lastHolePunch"),
     listenPort: integer("listenPort"),

server/lib/blueprints/privateResources.ts

@@ -239,6 +239,31 @@ export async function updatePrivateResources(
                 );
             }
 
+            if (resourceData.alias) {
+                const [aliasConflict] = await trx
+                    .select({
+                        siteResourceId: siteResources.siteResourceId
+                    })
+                    .from(siteResources)
+                    .where(
+                        and(
+                            eq(siteResources.orgId, orgId),
+                            eq(siteResources.alias, resourceData.alias),
+                            ne(
+                                siteResources.siteResourceId,
+                                existingResource.siteResourceId
+                            )
+                        )
+                    )
+                    .limit(1);
+
+                if (aliasConflict) {
+                    throw new Error(
+                        `Alias ${resourceData.alias} already in use by another site resource in org ${orgId}`
+                    );
+                }
+            }
+
             // Update existing resource
             const [updatedResource] = await trx
                 .update(siteResources)
@@ -480,6 +505,27 @@ export async function updatePrivateResources(
                 );
             }
 
+            if (resourceData.alias) {
+                const [aliasConflict] = await trx
+                    .select({
+                        siteResourceId: siteResources.siteResourceId
+                    })
+                    .from(siteResources)
+                    .where(
+                        and(
+                            eq(siteResources.orgId, orgId),
+                            eq(siteResources.alias, resourceData.alias)
+                        )
+                    )
+                    .limit(1);
+
+                if (aliasConflict) {
+                    throw new Error(
+                        `Alias ${resourceData.alias} already in use by another site resource in org ${orgId}`
+                    );
+                }
+            }
+
             const [network] = await trx
                 .insert(networks)
                 .values({

server/lib/statusHistory.ts

@@ -8,26 +8,42 @@ const STATUS_HISTORY_CACHE_TTL = 60; // seconds
 function statusHistoryCacheKey(
     entityType: string,
     entityId: number,
-    days: number
+    days: number,
+    tzOffsetMinutes: number
 ): string {
-    return `statusHistory:${entityType}:${entityId}:${days}`;
+    return `statusHistory:${entityType}:${entityId}:${days}:${tzOffsetMinutes}`;
+}
+
+// Returns the epoch seconds of the most recent local-calendar-day midnight,
+// where "local" is defined by tzOffsetMinutes (minutes to ADD to UTC to get
+// local time, e.g. Australia/Sydney standard time is 600). Defaults to 0
+// (UTC) so callers that don't pass a timezone keep the original behavior.
+function localMidnightSec(tzOffsetMinutes: number): number {
+    const localNow = new Date(Date.now() + tzOffsetMinutes * 60_000);
+    localNow.setUTCHours(0, 0, 0, 0);
+    return Math.floor(localNow.getTime() / 1000) - tzOffsetMinutes * 60;
 }
 
 export async function getCachedStatusHistory(
     entityType: string,
     entityId: number,
-    days: number
+    days: number,
+    tzOffsetMinutes: number = 0
 ): Promise<StatusHistoryResponse> {
-    const cacheKey = statusHistoryCacheKey(entityType, entityId, days);
+    const cacheKey = statusHistoryCacheKey(
+        entityType,
+        entityId,
+        days,
+        tzOffsetMinutes
+    );
     const cached = await cache.get<StatusHistoryResponse>(cacheKey);
     if (cached !== undefined) {
         return cached;
     }
 
-    // Anchor to UTC midnight so the query window aligns with stable calendar days
-    const utcToday = new Date();
-    utcToday.setUTCHours(0, 0, 0, 0);
-    const todayMidnightSec = Math.floor(utcToday.getTime() / 1000);
+    // Anchor to local midnight (UTC when tzOffsetMinutes is 0) so the query
+    // window aligns with stable calendar days for the requesting client
+    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
     const startSec = todayMidnightSec - days * 86400;
 
     const events = await logsDb
@@ -63,7 +79,8 @@ export async function getCachedStatusHistory(
     const { buckets, totalDowntime } = computeBuckets(
         events,
         days,
-        priorStatus
+        priorStatus,
+        tzOffsetMinutes
     );
     const totalWindow = days * 86400;
     const overallUptime =
@@ -99,11 +116,19 @@ export const statusHistoryQuerySchema = z
         days: z
             .string()
             .optional()
-            .transform((v) => (v ? parseInt(v, 10) : 90))
+            .transform((v) => (v ? parseInt(v, 10) : 90)),
+        // Minutes to add to UTC to get the requesting client's local time
+        // (e.g. Australia/Sydney standard time is 600). Optional and
+        // defaults to 0 (UTC) so older clients keep the prior behavior.
+        tzOffsetMinutes: z
+            .string()
+            .optional()
+            .transform((v) => (v ? parseInt(v, 10) : 0))
     })
     .pipe(
         z.object({
-            days: z.number().int().min(1).max(365)
+            days: z.number().int().min(1).max(365),
+            tzOffsetMinutes: z.number().int().min(-720).max(840)
         })
     );
 
@@ -133,15 +158,15 @@ export function computeBuckets(
         id: number;
     }[],
     days: number,
-    priorStatus: string | null = null
+    priorStatus: string | null = null,
+    tzOffsetMinutes: number = 0
 ): { buckets: StatusHistoryDayBucket[]; totalDowntime: number } {
     const nowSec = Math.floor(Date.now() / 1000);
 
-    // Anchor bucket boundaries to UTC midnight so dates are stable calendar days
-    // and don't drift as the cache expires and is recomputed
-    const utcToday = new Date();
-    utcToday.setUTCHours(0, 0, 0, 0);
-    const todayMidnightSec = Math.floor(utcToday.getTime() / 1000);
+    // Anchor bucket boundaries to local midnight (UTC when tzOffsetMinutes is
+    // 0) so dates are stable calendar days for the requesting client and
+    // don't drift as the cache expires and is recomputed
+    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
 
     const buckets: StatusHistoryDayBucket[] = [];
     let totalDowntime = 0;
@@ -237,7 +262,13 @@ export function computeBuckets(
                   )
                 : 100;
 
-        const dateStr = new Date(dayStartSec * 1000).toISOString().slice(0, 10);
+        // Shift by the client's offset before formatting so the label reflects
+        // their local calendar date rather than the UTC date of dayStartSec
+        const dateStr = new Date(
+            (dayStartSec + tzOffsetMinutes * 60) * 1000
+        )
+            .toISOString()
+            .slice(0, 10);
 
         const hasAnyData = currentStatus !== null || dayEvents.length > 0;
 

server/private/routers/healthChecks/getStatusHistory.ts

@@ -55,9 +55,14 @@ export async function getHealthCheckStatusHistory(
 
         const entityType = "health_check";
         const entityId = parsedParams.data.healthCheckId;
-        const { days } = parsedQuery.data;
+        const { days, tzOffsetMinutes } = parsedQuery.data;
 
-        const data = await getCachedStatusHistory(entityType, entityId, days);
+        const data = await getCachedStatusHistory(
+            entityType,
+            entityId,
+            days,
+            tzOffsetMinutes
+        );
 
         return response<StatusHistoryResponse>(res, {
             data,

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -29,7 +29,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { publicKey, port, chainId } = message.data;
+    const { publicKey, port, localEndpoints, chainId } = message.data;
     const siteId = newt.siteId;
 
     // Get the current site data
@@ -69,7 +69,10 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         .update(sites)
         .set({
             publicKey,
-            listenPort: port
+            listenPort: port,
+            localEndpoints: localEndpoints
+                ? JSON.stringify(localEndpoints)
+                : null
         })
         .where(eq(sites.siteId, siteId))
         .returning();

server/routers/olm/buildConfiguration.ts

@@ -30,6 +30,7 @@ export async function buildSiteConfigurationForOlmClient(
         siteId: number;
         name?: string;
         endpoint?: string;
+        localEndpoints?: string[];
         publicKey?: string;
         serverIP?: string | null;
         serverPort?: number | null;
@@ -206,6 +207,9 @@ export async function buildSiteConfigurationForOlmClient(
             name: site.name,
             // relayEndpoint: relayEndpoint, // this can be undefined now if not relayed // lets not do this for now because it would conflict with the hole punch testing
             endpoint: site.endpoint,
+            localEndpoints: site.localEndpoints
+                ? JSON.parse(site.localEndpoints)
+                : undefined,
             publicKey: site.publicKey,
             serverIP: site.address,
             serverPort: site.listenPort,

server/routers/olm/handleOlmLocalMessage.ts

@@ -0,0 +1,74 @@
+import { db, sites } from "@server/db";
+import { MessageHandler } from "@server/routers/ws";
+import { clients, Olm } from "@server/db";
+import { and, eq } from "drizzle-orm";
+import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import logger from "@server/logger";
+
+export const handleOlmLocalMessage: MessageHandler = async (context) => {
+    const { message, client: c, sendToClient } = context;
+    const olm = c as Olm;
+
+    logger.info("Handling local olm message!");
+
+    if (!olm) {
+        logger.warn("Olm not found");
+        return;
+    }
+
+    if (!olm.clientId) {
+        logger.warn("Olm has no client!");
+        return;
+    }
+
+    const clientId = olm.clientId;
+
+    const [client] = await db
+        .select()
+        .from(clients)
+        .where(eq(clients.clientId, clientId))
+        .limit(1);
+
+    if (!client) {
+        logger.warn("Client not found");
+        return;
+    }
+
+    // make sure we hand endpoints for both the site and the client and the lastHolePunch is not too old
+    if (!client.pubKey) {
+        logger.warn("Client has no endpoint or listen port");
+        return;
+    }
+
+    const { siteId, chainId } = message.data;
+
+    // Get the site
+    const [site] = await db
+        .select()
+        .from(sites)
+        .where(eq(sites.siteId, siteId))
+        .limit(1);
+
+    if (!site || !site.exitNodeId) {
+        logger.warn("Site not found or has no exit node");
+        return;
+    }
+
+    // update the peer on the newt
+    await newtUpdatePeer(siteId, client.pubKey, {
+        endpoint: "" // this removes the endpoint so the newt knows to accept local
+    });
+
+    // Just ack the message, we don't keep sending it
+    return {
+        message: {
+            type: "olm/wg/peer/local",
+            data: {
+                siteId: siteId,
+                chainId
+            }
+        },
+        broadcast: false,
+        excludeSender: false
+    };
+};

server/routers/olm/handleOlmRelayMessage.ts

@@ -79,9 +79,9 @@ export const handleOlmRelayMessage: MessageHandler = async (context) => {
             )
         );
 
-    // update the peer on the exit node
+    // update the peer on the newt
     await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the exit node knows to relay
+        endpoint: "" // this removes the endpoint so the newt knows to relay
     });
 
     return {

server/routers/olm/handleOlmServerPeerAddMessage.ts

@@ -3,24 +3,15 @@ import {
     db,
     networks,
     siteNetworks,
-    siteResources,
+    siteResources
 } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
-import {
-    clients,
-    clientSitesAssociationsCache,
-    Olm,
-    sites
-} from "@server/db";
+import { clients, clientSitesAssociationsCache, Olm, sites } from "@server/db";
 import { and, eq, inArray, isNotNull, isNull } from "drizzle-orm";
 import logger from "@server/logger";
-import {
-    generateAliasConfig,
-} from "@server/lib/ip";
+import { generateAliasConfig } from "@server/lib/ip";
 import { generateRemoteSubnets } from "@server/lib/ip";
-import {
-    addPeer as newtAddPeer,
-} from "@server/routers/newt/peers";
+import { addPeer as newtAddPeer } from "@server/routers/newt/peers";
 
 export const handleOlmServerPeerAddMessage: MessageHandler = async (
     context
@@ -135,10 +126,7 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 clientSiteResourcesAssociationsCache.siteResourceId
             )
         )
-        .innerJoin(
-            networks,
-            eq(siteResources.networkId, networks.networkId)
-        )
+        .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
         .innerJoin(
             siteNetworks,
             and(
@@ -147,10 +135,7 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
             )
         )
         .where(
-            eq(
-                clientSiteResourcesAssociationsCache.clientId,
-                client.clientId
-            )
+            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
         );
 
     // Return connect message with all site configurations
@@ -161,6 +146,9 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 siteId: site.siteId,
                 name: site.name,
                 endpoint: site.endpoint,
+                localEndpoints: site.localEndpoints
+                    ? JSON.parse(site.localEndpoints)
+                    : undefined,
                 publicKey: site.publicKey,
                 serverIP: site.address,
                 serverPort: site.listenPort,
@@ -170,7 +158,7 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 aliases: generateAliasConfig(
                     allSiteResources.map(({ siteResources }) => siteResources)
                 ),
-                chainId: chainId,
+                chainId: chainId
             }
         },
         broadcast: false,

server/routers/olm/handleOlmUnLocalMessage.ts

@@ -0,0 +1,95 @@
+import { db, exitNodes, sites } from "@server/db";
+import { MessageHandler } from "@server/routers/ws";
+import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
+import { and, eq } from "drizzle-orm";
+import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import logger from "@server/logger";
+
+export const handleOlmUnLocalMessage: MessageHandler = async (context) => {
+    const { message, client: c, sendToClient } = context;
+    const olm = c as Olm;
+
+    logger.info("Handling unlocal olm message!");
+
+    if (!olm) {
+        logger.warn("Olm not found");
+        return;
+    }
+
+    if (!olm.clientId) {
+        logger.warn("Olm has no client!");
+        return;
+    }
+
+    const clientId = olm.clientId;
+
+    const [client] = await db
+        .select()
+        .from(clients)
+        .where(eq(clients.clientId, clientId))
+        .limit(1);
+
+    if (!client) {
+        logger.warn("Client not found");
+        return;
+    }
+
+    // make sure we hand endpoints for both the site and the client and the lastHolePunch is not too old
+    if (!client.pubKey) {
+        logger.warn("Client has no endpoint or listen port");
+        return;
+    }
+
+    const { siteId, chainId } = message.data;
+
+    // Get the site
+    const [site] = await db
+        .select()
+        .from(sites)
+        .where(eq(sites.siteId, siteId))
+        .limit(1);
+
+    if (!site) {
+        logger.warn("Site not found or has no exit node");
+        return;
+    }
+
+    const [clientSiteAssociation] = await db
+        .select()
+        .from(clientSitesAssociationsCache)
+        .where(
+            and(
+                eq(clientSitesAssociationsCache.clientId, olm.clientId),
+                eq(clientSitesAssociationsCache.siteId, siteId)
+            )
+        );
+
+    if (!clientSiteAssociation) {
+        logger.warn("Client-Site association not found");
+        return;
+    }
+
+    if (!clientSiteAssociation.endpoint) {
+        logger.warn("Client-Site association has no endpoint, cannot unrelay");
+        return;
+    }
+
+    // update the peer on the newt
+    await newtUpdatePeer(siteId, client.pubKey, {
+        endpoint: clientSiteAssociation.isRelayed
+            ? ""
+            : clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+    });
+
+    return {
+        message: {
+            type: "olm/wg/peer/unlocal",
+            data: {
+                siteId: siteId,
+                chainId
+            }
+        },
+        broadcast: false,
+        excludeSender: false
+    };
+};

server/routers/olm/handleOlmUnRelayMessage.ts

@@ -77,9 +77,9 @@ export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
         return;
     }
 
-    // update the peer on the exit node
+    // update the peer on the newt
     await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the exit node
+        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
     });
 
     return {

server/routers/olm/index.ts

@@ -13,3 +13,5 @@ export * from "./recoverOlmWithFingerprint";
 export * from "./handleOlmDisconnectingMessage";
 export * from "./handleOlmServerInitAddPeerHandshake";
 export * from "./offlineChecker";
+export * from "./handleOlmUnLocalMessage";
+export * from "./handleOlmLocalMessage";

server/routers/olm/peers.ts

@@ -18,6 +18,7 @@ export async function addPeer(
         serverPort: number | null;
         remoteSubnets: string[] | null; // optional, comma-separated list of subnets that this site can access
         aliases: Alias[];
+        localEndpoints?: string[]; // optional, list of local endpoints for the peer
     },
     olmId?: string,
     version?: string | null
@@ -44,6 +45,7 @@ export async function addPeer(
                 name: peer.name,
                 publicKey: peer.publicKey,
                 endpoint: peer.endpoint,
+                localEndpoints: peer.localEndpoints,
                 relayEndpoint: peer.relayEndpoint,
                 serverIP: peer.serverIP,
                 serverPort: peer.serverPort,

server/routers/resource/getStatusHistory.ts

@@ -42,9 +42,14 @@ export async function getResourceStatusHistory(
 
         const entityType = "resource";
         const entityId = parsedParams.data.resourceId;
-        const { days } = parsedQuery.data;
+        const { days, tzOffsetMinutes } = parsedQuery.data;
 
-        const data = await getCachedStatusHistory(entityType, entityId, days);
+        const data = await getCachedStatusHistory(
+            entityType,
+            entityId,
+            days,
+            tzOffsetMinutes
+        );
 
         return response<StatusHistoryResponse>(res, {
             data,

server/routers/site/getStatusHistory.ts

@@ -42,9 +42,14 @@ export async function getSiteStatusHistory(
 
         const entityType = "site";
         const entityId = parsedParams.data.siteId;
-        const { days } = parsedQuery.data;
+        const { days, tzOffsetMinutes } = parsedQuery.data;
 
-        const data = await getCachedStatusHistory(entityType, entityId, days);
+        const data = await getCachedStatusHistory(
+            entityType,
+            entityId,
+            days,
+            tzOffsetMinutes
+        );
 
         return response<StatusHistoryResponse>(res, {
             data,

server/routers/ws/messageHandlers.ts

@@ -20,7 +20,9 @@ import {
     handleOlmServerPeerAddMessage,
     handleOlmUnRelayMessage,
     handleOlmDisconnectingMessage,
-    handleOlmServerInitAddPeerHandshake
+    handleOlmServerInitAddPeerHandshake,
+    handleOlmLocalMessage,
+    handleOlmUnLocalMessage
 } from "../olm";
 import { handleHealthcheckStatusMessage } from "../target";
 import { handleRoundTripMessage } from "./handleRoundTripMessage";
@@ -32,6 +34,8 @@ export const messageHandlers: Record<string, MessageHandler> = {
     "olm/wg/register": handleOlmRegisterMessage,
     "olm/wg/relay": handleOlmRelayMessage,
     "olm/wg/unrelay": handleOlmUnRelayMessage,
+    "olm/wg/local": handleOlmLocalMessage,
+    "olm/wg/unlocal": handleOlmUnLocalMessage,
     "olm/ping": handleOlmPingMessage,
     "olm/disconnecting": handleOlmDisconnectingMessage,
     "newt/disconnecting": handleNewtDisconnectingMessage,

src/lib/queries.ts

@@ -650,9 +650,13 @@ export const orgQueries = {
         queryOptions({
             queryKey: ["SITE_STATUS_HISTORY", siteId, days] as const,
             queryFn: async ({ signal, meta }) => {
+                const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
                     AxiosResponse<StatusHistoryResponse>
-                >(`/site/${siteId}/status-history?days=${days}`, { signal });
+                >(
+                    `/site/${siteId}/status-history?days=${days}&tzOffsetMinutes=${tzOffsetMinutes}`,
+                    { signal }
+                );
                 return res.data.data;
             }
         }),
@@ -667,11 +671,13 @@ export const orgQueries = {
         queryOptions({
             queryKey: ["RESOURCE_STATUS_HISTORY", resourceId, days] as const,
             queryFn: async ({ signal, meta }) => {
+                const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
                     AxiosResponse<StatusHistoryResponse>
-                >(`/resource/${resourceId}/status-history?days=${days}`, {
-                    signal
-                });
+                >(
+                    `/resource/${resourceId}/status-history?days=${days}&tzOffsetMinutes=${tzOffsetMinutes}`,
+                    { signal }
+                );
                 return res.data.data;
             }
         }),
@@ -693,10 +699,11 @@ export const orgQueries = {
                 days
             ] as const,
             queryFn: async ({ signal, meta }) => {
+                const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
                     AxiosResponse<StatusHistoryResponse>
                 >(
-                    `/org/${orgId}/health-check/${healthCheckId}/status-history?days=${days}`,
+                    `/org/${orgId}/health-check/${healthCheckId}/status-history?days=${days}&tzOffsetMinutes=${tzOffsetMinutes}`,
                     { signal }
                 );
                 return res.data.data;