Multi-host phase 1: API tokens, auto TLS with pinned fingerprints, hub-side node manager + reverse proxy (WebSockets included), machine switcher in the rail, Machines page

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/config/config.go

@@ -7,13 +7,37 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sync"
+	"time"
 )
 
+// Token is an API token another Ham Lab (a hub) uses to manage this host. Only the
+// SHA-256 of the token is kept.
+type Token struct {
+	Name    string    `json:"name"`
+	Hash    string    `json:"hash"`
+	Created time.Time `json:"created"`
+}
+
+// Node is a remote Ham Lab this host (as hub) manages. The token is the one that
+// node issued to us; the fingerprint pins its self-signed certificate.
+type Node struct {
+	Name        string    `json:"name"`
+	URL         string    `json:"url"`
+	Fingerprint string    `json:"fingerprint,omitempty"`
+	Token       string    `json:"token"`
+	Added       time.Time `json:"added"`
+}
+
 type Config struct {
-	Listen       string `json:"listen"`
-	PasswordHash string `json:"password_hash"`
+	Listen       string  `json:"listen"`
+	PasswordHash string  `json:"password_hash"`
+	TLS          string  `json:"tls,omitempty"` // "auto" → self-signed cert in the data dir; "" → plain HTTP
+	Tokens       []Token `json:"tokens,omitempty"`
+	Nodes        []Node  `json:"nodes,omitempty"`
 
 	path string
+	mu   sync.Mutex
 }
 
 func Default(path string) *Config {
@@ -40,6 +64,12 @@ func (c *Config) Path() string    { return c.path }
 func (c *Config) DataDir() string { return filepath.Dir(c.path) }
 
 func (c *Config) Save() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.save()
+}
+
+func (c *Config) save() error {
 	if err := os.MkdirAll(c.DataDir(), 0o700); err != nil {
 		return err
 	}
@@ -53,3 +83,18 @@ func (c *Config) Save() error {
 	}
 	return os.Rename(tmp, c.path)
 }
+
+// Update applies fn under the lock and saves.
+func (c *Config) Update(fn func(*Config)) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	fn(c)
+	return c.save()
+}
+
+// View reads under the lock.
+func (c *Config) View(fn func(*Config)) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	fn(c)
+}