Multi-host phase 1: API tokens, auto TLS with pinned fingerprints, hub-side node manager + reverse proxy (WebSockets included), machine switcher in the rail, Machines page

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

cmd/hamlab/main.go

@@ -24,11 +24,13 @@ import (
 	"hamlab/internal/cron"
 	"hamlab/internal/files"
 	"hamlab/internal/metrics"
+	"hamlab/internal/nodes"
 	"hamlab/internal/services"
 	"hamlab/internal/storage"
 	"hamlab/internal/store"
 	"hamlab/internal/tasks"
 	hterm "hamlab/internal/term"
+	"hamlab/internal/tlsauto"
 	"hamlab/internal/updates"
 	"hamlab/internal/web"
 )
@@ -160,7 +162,19 @@ func serve(cfg *config.Config) error {
 	if svc.Sudo() && self != "" {
 		sudoFS = files.Sudo{Self: self}
 	}
-	srv := api.New(cfg, sessions, mgr, col, st, svc, cr, tm, up, sto, files.Local{}, sudoFS, web.FS(), version)
+	host, _ := os.Hostname()
+	nm := nodes.New(cfg, host)
+	go nm.Run(context.Background())
+
+	certPath, keyPath, fingerprint := "", "", ""
+	if cfg.TLS == "auto" {
+		var err error
+		certPath, keyPath, fingerprint, err = tlsauto.Ensure(cfg.DataDir())
+		if err != nil {
+			return fmt.Errorf("tls: %w", err)
+		}
+	}
+	srv := api.New(cfg, sessions, mgr, col, st, svc, cr, tm, up, sto, files.Local{}, sudoFS, nm, fingerprint, web.FS(), version)
 	hs := &http.Server{
 		Addr:              cfg.Listen,
 		Handler:           srv.Handler(),
@@ -176,6 +190,13 @@ func serve(cfg *config.Config) error {
 		_ = hs.Shutdown(ctx)
 		mgr.Shutdown()
 	}()
+	if certPath != "" {
+		log.Printf("hamlab %s listening on https://%s as %s (shell %s) cert %s", version, cfg.Listen, u.Username, shell, fingerprint)
+		if err := hs.ListenAndServeTLS(certPath, keyPath); !errors.Is(err, http.ErrServerClosed) {
+			return err
+		}
+		return nil
+	}
 	log.Printf("hamlab %s listening on %s as %s (shell %s)", version, cfg.Listen, u.Username, shell)
 	if err := hs.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
 		return err