Merge branch 'max-netconf-queue' into no-migrate

controller: erase netconf request de-dup key if enqueue throws
set max netconf queue length to 2M requests
2026-09-22 15:29:03 -07:00 · 2026-07-02 14:26:46 -07:00 · 2026-07-02 12:29:32 -07:00 · 2026-07-02 12:28:56 -07:00 · 2026-07-02 12:22:53 -07:00 · 2026-07-02 12:21:50 -07:00
1403 changed files with 10335 additions and 191457 deletions
@@ -4,72 +4,71 @@ BreakBeforeBraces: Stroustrup
 IndentWidth: 4
 TabWidth: 4
 AlignAfterOpenBracket: AlwaysBreak
-AlignConsecutiveMacros: 'true'
-AlignConsecutiveAssignments: 'false'
-AlignConsecutiveDeclarations: 'false'
+AlignConsecutiveMacros: "true"
+AlignConsecutiveAssignments: "false"
+AlignConsecutiveDeclarations: "false"
 AlignEscapedNewlines: Right
-AlignOperands: 'true'
-AlignTrailingComments: 'true'
-AllowAllArgumentsOnNextLine: 'false'
-AllowAllConstructorInitializersOnNextLine: 'false'
-AllowAllParametersOfDeclarationOnNextLine: 'false'
-AllowShortBlocksOnASingleLine: 'true'
-AllowShortCaseLabelsOnASingleLine: 'false'
+AlignOperands: "true"
+AlignTrailingComments: "true"
+AllowAllArgumentsOnNextLine: "false"
+AllowAllConstructorInitializersOnNextLine: "false"
+AllowAllParametersOfDeclarationOnNextLine: "false"
+AllowShortBlocksOnASingleLine: "true"
+AllowShortCaseLabelsOnASingleLine: "false"
 AllowShortFunctionsOnASingleLine: None
 AllowShortIfStatementsOnASingleLine: Never
 AlwaysBreakAfterReturnType: None
-BinPackArguments: 'false'
-BinPackParameters: 'false'
+BinPackArguments: "true"
+BinPackParameters: OnePerLine
 BreakBeforeBinaryOperators: NonAssignment
-BreakBeforeTernaryOperators: 'true'
+BreakBeforeTernaryOperators: "true"
 BreakConstructorInitializers: BeforeComma
 BreakInheritanceList: BeforeComma
-CompactNamespaces: 'false'
-ConstructorInitializerAllOnOneLineOrOnePerLine: 'true'
-ConstructorInitializerIndentWidth: '4'
-ContinuationIndentWidth: '4'
-Cpp11BracedListStyle: 'false'
-FixNamespaceComments: 'true'
+CompactNamespaces: "false"
+ConstructorInitializerAllOnOneLineOrOnePerLine: "true"
+ConstructorInitializerIndentWidth: "4"
+ContinuationIndentWidth: "4"
+Cpp11BracedListStyle: "false"
+FixNamespaceComments: "true"
 IncludeBlocks: Regroup
-IndentCaseLabels: 'true'
+IndentCaseLabels: "true"
 IndentPPDirectives: None
-IndentWrappedFunctionNames: 'false'
-KeepEmptyLinesAtTheStartOfBlocks: 'false'
-MaxEmptyLinesToKeep: '1'
+IndentWrappedFunctionNames: "false"
+KeepEmptyLinesAtTheStartOfBlocks: "false"
+MaxEmptyLinesToKeep: "1"
 NamespaceIndentation: None
 PointerAlignment: Left
-ReflowComments: 'true'
-SortIncludes: 'true'
-SortUsingDeclarations: 'true'
-SpaceAfterCStyleCast: 'false'
-SpaceAfterLogicalNot: 'true'
-SpaceAfterTemplateKeyword: 'true'
-SpaceBeforeAssignmentOperators: 'true'
-SpaceBeforeCpp11BracedList: 'true'
-SpaceBeforeCtorInitializerColon: 'true'
-SpaceBeforeInheritanceColon: 'true'
+ReflowComments: "true"
+SortIncludes: "true"
+SortUsingDeclarations: "true"
+SpaceAfterCStyleCast: "false"
+SpaceAfterLogicalNot: "true"
+SpaceAfterTemplateKeyword: "true"
+SpaceBeforeAssignmentOperators: "true"
+SpaceBeforeCpp11BracedList: "true"
+SpaceBeforeCtorInitializerColon: "true"
+SpaceBeforeInheritanceColon: "true"
 SpaceBeforeParens: ControlStatements
-SpaceBeforeRangeBasedForLoopColon: 'true'
-SpaceInEmptyParentheses: 'false'
-SpacesBeforeTrailingComments: '3'
-SpacesInAngles: 'false'
-SpacesInCStyleCastParentheses: 'false'
-SpacesInContainerLiterals: 'true'
-SpacesInParentheses: 'false'
-SpacesInSquareBrackets: 'false'
-UseTab: 'Always'
+SpaceBeforeRangeBasedForLoopColon: "true"
+SpaceInEmptyParentheses: "false"
+SpacesBeforeTrailingComments: "3"
+SpacesInAngles: "false"
+SpacesInCStyleCastParentheses: "false"
+SpacesInContainerLiterals: "true"
+SpacesInParentheses: "false"
+SpacesInSquareBrackets: "false"
+UseTab: "Always"

 ---
 Language: Cpp
 Standard: Cpp03
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: ObjC
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: Java
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: CSharp
-ColumnLimit: '240'
-...
+ColumnLimit: "120"
@@ -1,2 +1,12 @@
 .git/
 workspace/
+# Local from-source dependency builds (scripts/bootstrap-deps.sh) and CMake output;
+# never ship these into an image -- they are host-specific and large.
+.deps/
+.deps-build/
+build/
+build-*/
+out/
+# Dockerfiles are supplied via -f; keeping them out of the context means editing
+# them does not invalidate the COPY layers (and the heavy build cache).
+ext/central-controller-docker/Dockerfile*
@@ -1,67 +0,0 @@
-name: Central Controller CV1 Build and Push
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  central_controller:
-    name: Central Controller CV1 Build
-    strategy:
-      matrix:
-        runner: [gha-runner-x64, gha-runner-arm64]
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - name: checkout
-        uses: actions/checkout@v4
-
-      - name: Docker Auth
-        run: echo "${{ secrets.PORTUS_PW }}" | docker login registry.zerotier.com -u ${{ secrets.PORTUS_USER }} --password-stdin
-
-      - name: Get branch name and sanitize
-        id: branch
-        run: |
-          BRANCH_NAME="${GITHUB_REF##*/}"
-          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
-          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
-
-      - name: Get short git commit SHA
-        id: sha
-        run: |
-          calculatedSha=$(git rev-parse --short ${{ github.sha }})
-          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
-
-      - name: Build & Push Docker Image
-        run: |
-          docker build --provenance false --no-cache -t registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-${{ runner.arch }} -f ext/central-controller-docker/Dockerfile . --push
-
-  multi-arch-docker:
-    runs-on: gha-runner-x64
-    needs: central_controller
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Docker Auth
-        run: echo "${{ secrets.PORTUS_PW }}" | docker login registry.zerotier.com -u ${{ secrets.PORTUS_USER }} --password-stdin
-
-      - name: Get branch name and sanitize
-        id: branch
-        run: |
-          BRANCH_NAME="${GITHUB_REF##*/}"
-          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
-          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
-
-      - name: Get short git commit SHA
-        id: sha
-        run: |
-          calculatedSha=$(git rev-parse --short ${{ github.sha }})
-          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
-
-      - name: Create and push multi-arch manifest
-        run: |
-          docker manifest create registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }} \
-            --amend registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-X64 \
-            --amend registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-ARM64
-          docker manifest push registry.zerotier.com/zerotier-central/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}
@@ -0,0 +1,104 @@
+# on:
+#     workflow_dispatch:
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  central_controller:
+    name: Central Controller Build
+    strategy:
+      matrix:
+        runner: [gha-runner-x64, gha-runner-arm64]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build & Push Docker Image
+        # Registry layer cache (mode=max) so the expensive builder stage -- which
+        # builds opentelemetry-cpp + google-cloud-cpp from source -- is reused across
+        # runs and fresh runners. The cache invalidates automatically when the
+        # bootstrap inputs change. Cache is per-arch (the deps layer is arch-specific).
+        run: |
+          CACHE=us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller-buildcache:${{ runner.arch }}
+          docker buildx build \
+            -t us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-${{ runner.arch }} \
+            -f ext/central-controller-docker/Dockerfile \
+            --cache-from type=registry,ref=$CACHE \
+            --cache-to type=registry,ref=$CACHE,mode=max \
+            --provenance false \
+            --push .
+
+  multi-arch-docker:
+    runs-on: gha-runner-x64
+    needs: central_controller
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Create and push multi-arch manifest
+        run: |
+          docker manifest create us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }} \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-X64 \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-ARM64
+          docker manifest push us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}
@@ -143,6 +143,11 @@ __pycache__
 *.pyc
 *_source.tar.bz2
 snap/.snapcraft
+build/

-# local Claude configurations
-.claude/*.local.*
+# Local dependency bootstrap output (scripts/bootstrap-deps.sh): the install
+# prefix and the build/clone scratch dir. Large + host-specific; never commit.
+.deps/
+.deps-build/
+
+.claude/*.local.*
@@ -0,0 +1,28 @@
+# Central Controller build dependencies for macOS development.
+#
+#   brew bundle            # install the deps below
+#   ZT_CONTROLLER_DEPS=1 scripts/bootstrap-deps.sh   # build the two pinned controller deps (full OTel + google-cloud-cpp)
+#
+# The two version-sensitive C++ libraries (opentelemetry-cpp, google-cloud-cpp)
+# are NOT taken from Homebrew -- they are pinned and built from source by
+# scripts/bootstrap-deps.sh so every dev/CI machine uses the same versions
+# (the role conda previously filled). Everything below is stable enough to take
+# from Homebrew.
+
+brew "cmake"
+brew "ninja"
+brew "pkg-config"
+brew "rustup-init"      # then: rustup-init -y && rustup default stable
+
+brew "libpqxx"
+brew "libpq"           # keg-only; add $(brew --prefix libpq) to CMAKE_PREFIX_PATH so find_package(PostgreSQL) resolves
+brew "hiredis"
+brew "jemalloc"
+brew "nlohmann-json"
+brew "openssl@3"
+brew "abseil"
+brew "protobuf"
+brew "grpc"
+brew "googletest"      # google-cloud-cpp requires GTest/GMock at configure (builds its *_mocks libs)
+brew "curl"
+brew "inja"
@@ -0,0 +1,167 @@
+{
+  "version": 3,
+  "cmakeMinimumRequired": { "major": 3, "minor": 21, "patch": 0 },
+  "configurePresets": [
+    {
+      "name": "unix-base",
+      "hidden": true,
+      "generator": "Unix Makefiles",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps",
+        "CMAKE_BUILD_TYPE": "Release"
+      }
+    },
+    {
+      "name": "linux-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Linux" }
+    },
+    {
+      "name": "macos-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Darwin" },
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps;$env{HOMEBREW_PREFIX};$env{HOMEBREW_PREFIX}/opt/openssl@3;$env{HOMEBREW_PREFIX}/opt/libpq"
+      }
+    },
+
+    { "name": "linux-release",            "inherits": "linux-base", "displayName": "Linux daemon (Release)" },
+    { "name": "linux-debug",              "inherits": "linux-base", "displayName": "Linux daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-controller-release", "inherits": "linux-base", "displayName": "Linux Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "linux-controller-debug",   "inherits": "linux-base", "displayName": "Linux Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-free-release",       "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "linux-free-debug",         "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "macos-release",            "inherits": "macos-base", "displayName": "macOS daemon (Release)" },
+    { "name": "macos-debug",              "inherits": "macos-base", "displayName": "macOS daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-controller-release", "inherits": "macos-base", "displayName": "macOS Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "macos-controller-debug",   "inherits": "macos-base", "displayName": "macOS Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-free-release",       "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "macos-free-debug",         "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-universal-release",  "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Release)", "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64" } },
+    { "name": "macos-universal-debug",    "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Debug)",   "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "freebsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "FreeBSD" }
+    },
+    {
+      "name": "openbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "OpenBSD" }
+    },
+    {
+      "name": "netbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "NetBSD" }
+    },
+
+    { "name": "freebsd-release",          "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Release)" },
+    { "name": "freebsd-debug",            "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "freebsd-free-release",     "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "freebsd-free-debug",       "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "openbsd-release",          "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Release)" },
+    { "name": "openbsd-debug",            "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "openbsd-free-release",     "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "openbsd-free-debug",       "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "netbsd-release",           "inherits": "netbsd-base", "displayName": "NetBSD daemon (Release)" },
+    { "name": "netbsd-debug",             "inherits": "netbsd-base", "displayName": "NetBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "netbsd-free-release",      "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "netbsd-free-debug",        "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "windows-x64",
+      "displayName": "Windows x64 daemon (MSVC + vcpkg)",
+      "generator": "Visual Studio 17 2022",
+      "architecture": "x64",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Windows" },
+      "cacheVariables": {
+        "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static",
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/x64"
+      }
+    },
+    {
+      "name": "windows-arm64",
+      "inherits": "windows-x64",
+      "displayName": "Windows ARM64 daemon (MSVC + vcpkg)",
+      "architecture": "ARM64",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "arm64-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/ARM64" }
+    },
+    {
+      "name": "windows-x86",
+      "inherits": "windows-x64",
+      "displayName": "Windows x86 daemon (MSVC + vcpkg)",
+      "architecture": "Win32",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "x86-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/Win32" }
+    },
+    {
+      "name": "windows-x64-free",
+      "inherits": "windows-x64",
+      "displayName": "Windows x64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-arm64-free",
+      "inherits": "windows-arm64",
+      "displayName": "Windows ARM64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-x86-free",
+      "inherits": "windows-x86",
+      "displayName": "Windows x86 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    }
+  ],
+  "buildPresets": [
+    { "name": "linux-release",            "configurePreset": "linux-release" },
+    { "name": "linux-debug",              "configurePreset": "linux-debug" },
+    { "name": "linux-controller-release", "configurePreset": "linux-controller-release" },
+    { "name": "linux-controller-debug",   "configurePreset": "linux-controller-debug" },
+    { "name": "linux-free-release",       "configurePreset": "linux-free-release" },
+    { "name": "linux-free-debug",         "configurePreset": "linux-free-debug" },
+    { "name": "macos-release",            "configurePreset": "macos-release" },
+    { "name": "macos-debug",              "configurePreset": "macos-debug" },
+    { "name": "macos-controller-release", "configurePreset": "macos-controller-release" },
+    { "name": "macos-controller-debug",   "configurePreset": "macos-controller-debug" },
+    { "name": "macos-free-release",       "configurePreset": "macos-free-release" },
+    { "name": "macos-free-debug",         "configurePreset": "macos-free-debug" },
+    { "name": "macos-universal-release",  "configurePreset": "macos-universal-release" },
+    { "name": "macos-universal-debug",    "configurePreset": "macos-universal-debug" },
+    { "name": "freebsd-release",          "configurePreset": "freebsd-release" },
+    { "name": "freebsd-debug",            "configurePreset": "freebsd-debug" },
+    { "name": "freebsd-free-release",     "configurePreset": "freebsd-free-release" },
+    { "name": "freebsd-free-debug",       "configurePreset": "freebsd-free-debug" },
+    { "name": "openbsd-release",          "configurePreset": "openbsd-release" },
+    { "name": "openbsd-debug",            "configurePreset": "openbsd-debug" },
+    { "name": "openbsd-free-release",     "configurePreset": "openbsd-free-release" },
+    { "name": "openbsd-free-debug",       "configurePreset": "openbsd-free-debug" },
+    { "name": "netbsd-release",           "configurePreset": "netbsd-release" },
+    { "name": "netbsd-debug",             "configurePreset": "netbsd-debug" },
+    { "name": "netbsd-free-release",      "configurePreset": "netbsd-free-release" },
+    { "name": "netbsd-free-debug",        "configurePreset": "netbsd-free-debug" },
+    { "name": "windows-x64-release",        "configurePreset": "windows-x64",        "configuration": "Release" },
+    { "name": "windows-x64-debug",          "configurePreset": "windows-x64",        "configuration": "Debug" },
+    { "name": "windows-arm64-release",      "configurePreset": "windows-arm64",      "configuration": "Release" },
+    { "name": "windows-arm64-debug",        "configurePreset": "windows-arm64",      "configuration": "Debug" },
+    { "name": "windows-x86-release",        "configurePreset": "windows-x86",        "configuration": "Release" },
+    { "name": "windows-x86-debug",          "configurePreset": "windows-x86",        "configuration": "Debug" },
+    { "name": "windows-x64-free-release",   "configurePreset": "windows-x64-free",   "configuration": "Release" },
+    { "name": "windows-x64-free-debug",     "configurePreset": "windows-x64-free",   "configuration": "Debug" },
+    { "name": "windows-arm64-free-release", "configurePreset": "windows-arm64-free", "configuration": "Release" },
+    { "name": "windows-arm64-free-debug",   "configurePreset": "windows-arm64-free", "configuration": "Debug" },
+    { "name": "windows-x86-free-release",   "configurePreset": "windows-x86-free",   "configuration": "Release" },
+    { "name": "windows-x86-free-debug",     "configurePreset": "windows-x86-free",   "configuration": "Debug" }
+  ]
+}
@@ -31,6 +31,79 @@ To build on Mac and Linux just type `make`. On FreeBSD and OpenBSD `gmake` (GNU
 - GNU make is required. Type `gmake` to build.
 - Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.

+### Building with CMake (optional)
+
+> **Note:** CMake is an *alternative* build path, offered as a convenience. The official
+> builds are still produced by the platform makefiles (above) and the Visual Studio solution
+> in `windows/`.
+
+#### Prerequisites
+
+- **CMake** 3.15 or newer.
+- The same compiler/toolchain (and Rust, if SSO is enabled) as the makefile build for your
+  platform — see *Platform Requirements* above.
+- The header-only **OpenTelemetry API** must be present on `CMAKE_PREFIX_PATH`. Populate it
+  into `./.deps` by running the bootstrap script once, in its **default** (quick, header-only)
+  mode — i.e. *without* `ZT_CONTROLLER_DEPS=1`, which is the heavyweight controller-only path:
+
+  ```bash
+  scripts/bootstrap-deps.sh    # default mode: header-only OTel API into ./.deps
+  ```
+
+  The script prints the exact `-DCMAKE_PREFIX_PATH` to use when it finishes.
+
+#### Free vs. default (non-free) builds
+
+By default the daemon is built **with the bundled FileDB network controller**, which lives
+under `nonfree/` and is "source available" (non-free) — this matches what ships in official
+builds (`ZT_NONFREE=ON`). To produce a **purely free** daemon (MPL-2.0 `node/`, `osdep/`,
+`service/` only, with no `nonfree/` code compiled or linked), set **`-DZT_NONFREE=OFF`** — or
+use one of the `*-free-*` presets, which set it for you.
+
+#### Using presets (recommended)
+
+`cmake --list-presets` shows the presets for your OS. The daemon presets are:
+
+| Preset | Build |
+| --- | --- |
+| `macos-release` / `linux-release` | Default daemon (**includes** the non-free bundled controller) |
+| `macos-free-release` / `linux-free-release` | **Free** daemon (`ZT_NONFREE=OFF`, no non-free code) |
+| `macos-debug` / `linux-debug` (and `*-free-debug`) | Debug variants of the above |
+| `macos-universal-release` | macOS universal (arm64 + x86_64) daemon |
+| `freebsd-release` / `openbsd-release` / `netbsd-release` (and `*-free-release`, `*-debug`) | BSD daemon / free variant |
+| `windows-x64-release` (and `windows-x64-free`) | Windows daemon / free variant |
+
+```bash
+# Default (non-free) daemon:
+cmake --preset macos-release
+cmake --build --preset macos-release
+
+# Purely free daemon:
+cmake --preset macos-free-release
+cmake --build --preset macos-free-release
+```
+
+Each preset builds into its own directory, `build-<presetName>/`, so the binary lands at e.g.
+`build-macos-free-release/zerotier-one`. (macOS/Linux presets use single-config Unix Makefiles,
+so the build type is baked into the preset name — there's no `Release/` subdirectory.)
+
+#### Manual invocation
+
+The equivalent without presets:
+
+```bash
+# Default (non-free) daemon — .deps holds the OTel API from bootstrap-deps.sh:
+cmake -DCMAKE_PREFIX_PATH="$PWD/.deps" -S . -B build
+cmake --build build -j8
+
+# Purely free daemon:
+cmake -DZT_NONFREE=OFF -DCMAKE_PREFIX_PATH="$PWD/.deps" -S . -B build
+cmake --build build -j8
+```
+
+The binary is `build/zerotier-one`. (On macOS, append the Homebrew prefixes to
+`CMAKE_PREFIX_PATH` if your dependencies come from Homebrew, as the presets do.)
+
 ### Testing

 Typing `make selftest` will build a *zerotier-selftest* binary which unit tests various internals and reports on a few aspects of the build environment. It's a good idea to try this on novel platforms or architectures.
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -e
+
+cmake -DCMAKE_BUILD_TYPE=Release -DZT1_CENTRAL_CONTROLLER=1 -DCMAKE_INSTALL_PREFIX=$PWD -S . -B build/ -DCMAKE_INSTALL_PREFIX=$(shell pwd)/build-out
+cmake --build build/ --target all -j4 --verbose
+
+ARCH=$(uname -m)
+if [ "$ARCH" = "x86_64" ]; then
+    ARCH="amd64"
+elif [ "$ARCH" = "aarch64" ]; then
+    ARCH="arm64"
+fi
+
+if [ -z "$TARGET_DOCKER_REPO" ]; then
+    TARGET_DOCKER_REPO="us-central1-docker.pkg.dev/zerotier-421eb9/docker-images"
+fi
+
+docker build -platform linux/$ARCH -t $TARGET_DOCKER_REPO/ztcentral-controller:$(git rev-parse --short HEAD)-$ARCH -f ext/central-controller/docker/Dockerfile.central-controller . --load --push
@@ -0,0 +1,28 @@
+
+set(FETCHCONTENT_QUIET OFF)
+
+FetchContent_Declare(
+    cpp-httplib
+    GIT_REPOSITORY https://github.com/yhirose/cpp-httplib.git
+    # v0.47.0+: supports 32-bit Windows. v0.25.0 had a `#warning` refusing 32-bit
+    # Windows that MSVC's default preprocessor escalates to a fatal C1021 (breaks
+    # the windows-x86 build).
+    GIT_TAG v0.47.0
+    GIT_SHALLOW ON
+)
+set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "")
+set(HTTPLIB_COMPILE OFF CACHE INTERNAL "")
+set(HTTPLIB_USE_ZLIB_IF_AVAILABLE ON CACHE INTERNAL "Use zlib if available")
+set(HTTPLIB_USE_BROTLI_IF_AVAILABLE ON CACHE INTERNAL "Use brotli if available")
+# The ZeroTier control plane is plain HTTP on localhost (no httplib SSLServer/SSLClient
+# anywhere), and outbound SSO/OIDC TLS lives in rustybits (native-tls), so httplib never
+# needs OpenSSL. Keeping this ON would link OpenSSL purely as dead weight -- which also
+# blocks universal macOS builds (Homebrew OpenSSL is single-arch).
+set(HTTPLIB_USE_OPENSSL_IF_AVAILABLE OFF CACHE INTERNAL "ZeroTier uses httplib for plain HTTP only")
+set(HTTPLIB_USE_ZSTD_IF_AVAILABLE ON CACHE INTERNAL "Use zstd if available")
+FetchContent_MakeAvailable(cpp-httplib)
+
+if (NOT TARGET httplib::httplib)
+     message(FATAL_ERROR "A required cpp-httplib target (cpp-httplib) was not imported")
+endif()
+
@@ -0,0 +1,18 @@
+# inja -- header-only C++ templating engine used by service/OneService.cpp
+# (`#include <inja/inja.hpp>`). Homebrew ships no usable CMake config and Debian
+# has no package, so we vendor the headers via FetchContent. We populate the
+# source only and skip inja's own CMakeLists (its build/test/json machinery) by
+# pointing SOURCE_SUBDIR at a non-existent directory. inja consumes
+# nlohmann::json, which the build already provides via find_package(nlohmann_json)
+# and links into the targets that use inja; we only need inja's headers on the
+# include path here (header-only, no link), matching the previous conda setup.
+include(FetchContent)
+FetchContent_Declare(inja
+    GIT_REPOSITORY https://github.com/pantor/inja.git
+    GIT_TAG v3.4.0
+    GIT_SHALLOW ON
+    SOURCE_SUBDIR _skip_inja_cmakelists_)   # populate only; no add_subdirectory
+FetchContent_MakeAvailable(inja)
+
+# inja ships an amalgamated header under single_include/inja/inja.hpp.
+include_directories("${inja_SOURCE_DIR}/single_include")
@@ -0,0 +1,32 @@
+set(FETCHCONTENT_QUIET OFF)
+
+FetchContent_Declare(
+    miniupnpc
+    URL https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_2_3_3/miniupnpc-2.3.3.tar.gz
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+)
+set(UPNPC_BUILD_TESTS FALSE CACHE INTERNAL "Build tests" FORCE)
+set(UPNPC_BUILD_SHARED FALSE CACHE INTERNAL "Build shared library" FORCE)
+set(UPNPC_BUILD_STATIC TRUE CACHE INTERNAL "Build static library" FORCE)
+set(UPNPC_BUILD_SAMPLE FALSE CACHE INTERNAL "Build sample" FORCE)
+
+FetchContent_MakeAvailable(miniupnpc)
+
+if (NOT TARGET miniupnpc::miniupnpc)
+     message(FATAL_ERROR "A required miniupnpc target (miniupnpc::miniupnpc) was not imported")
+endif()
+add_definitions(-DZT_USE_MINIUPNPC)
+
+FetchContent_Declare(
+    libnatpmp
+    GIT_REPOSITORY https://github.com/miniupnp/libnatpmp.git
+    GIT_TAG master
+    GIT_SHALLOW ON
+    PATCH_COMMAND git apply ${CMAKE_SOURCE_DIR}/ext/cmake-patches/libnatpmp.patch
+    UPDATE_DISCONNECTED TRUE
+)
+FetchContent_MakeAvailable(libnatpmp)
+
+if (NOT TARGET natpmp)
+     message(FATAL_ERROR "A required libnatpmp target (natpmp) was not imported")
+endif()
@@ -0,0 +1,28 @@
+set(FETCHCONTENT_QUIET OFF)
+
+FetchContent_Declare(
+    redis-plus-plus
+    GIT_REPOSITORY https://github.com/sewenew/redis-plus-plus.git
+    GIT_TAG 1.3.15
+    GIT_SHALLOW ON
+)
+set(REDIS_PLUS_PLUS_BUILD_STATIC ON CACHE INTERNAL "Build static library" FORCE)
+# We only link redis++::redis++_static, so skip the unused shared library.
+set(REDIS_PLUS_PLUS_BUILD_SHARED OFF CACHE INTERNAL "Build shared library" FORCE)
+set(REDIS_PLUS_PLUS_BUILD_TEST OFF CACHE INTERNAL "Build tests" FORCE)
+set(REDIS_PLUS_PLUS_BUILD_STATIC_WITH_PIC ON CACHE INTERNAL "Build static library with PIC" FORCE)
+set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "Build shared libraries" FORCE)
+
+FetchContent_MakeAvailable(redis-plus-plus)
+if(NOT TARGET redis++::redis++_static)
+    message(FATAL_ERROR "A required redis-plus-plus target (redis++::redis++_static) was not imported")
+endif()
+
+# redis++'s static library calls into hiredis but does not propagate that
+# dependency to consumers, so the final link fails with undefined hiredis
+# symbols (redisAppendCommand, redisFree, freeReplyObject, ...). Attach hiredis
+# to the static target's interface. find_library (not find_package(hiredis))
+# because Debian's libhiredis-dev ships no CMake config.
+find_library(HIREDIS_LIB hiredis REQUIRED)
+target_link_libraries(redis++_static INTERFACE ${HIREDIS_LIB})
+message(STATUS "redis-plus-plus imported (hiredis: ${HIREDIS_LIB})")
@@ -0,0 +1,12 @@
+cmake_minimum_required(VERSION 3.13)
+project(ext)
+
+file(GLOB_RECURSE PROM_CORE_HEADERS ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include/*.h )
+set(PROMETHEUS_CPP_LITE_HEADERS ${PROM_CORE_HEADERS} ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include)
+
+
+add_library(prometheus-cpp-lite INTERFACE)
+target_sources(prometheus-cpp-lite INTERFACE ${PROMETHEUS_CPP_LITE_HEADERS})
+target_include_directories(prometheus-cpp-lite INTERFACE ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include)
+add_custom_target(prometheus-cpp-lite-ide SOURCES ${PROMETHEUS_CPP_LITE_HEADERS})
+set(prometheus-cpp-lite_INCLUDE ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include PARENT_SCOPE)
@@ -1,21 +1,68 @@
-# Dockerfile for ZeroTier Central Controllers
-FROM registry.zerotier.com/zerotier/ctlbuild:2025-07-14 AS builder
-ADD . /ZeroTierOne
-RUN export PATH=$PATH:~/.cargo/bin && cd ZeroTierOne && make clean && make central-controller -j8
+# Central Controller -- conda-free, CMake-based, Debian trixie. Multi-stage:
+#   builder  : apt deps + scripts/bootstrap-deps.sh (OTel 1.27 + google-cloud-cpp
+#              2.38 from source) + CMake build of zerotier-one
+#   go_base  : golang-migrate
+#   runtime  : slim trixie with exactly the runtime libs the binary needs
+#
+# Build (context = repo root, see .dockerignore):
+#   docker build -f ext/central-controller-docker/Dockerfile -t ztctl .
+FROM debian:trixie AS builder

-FROM golang:1.24.1-bookworm AS go_base
-RUN GONOSUMDB=* GOFLAGS='-p=1' go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        build-essential cmake ninja-build git pkg-config ca-certificates curl \
+        libpqxx-dev libpq-dev libhiredis-dev libjemalloc-dev nlohmann-json3-dev \
+        libabsl-dev libprotobuf-dev protobuf-compiler protobuf-compiler-grpc libgrpc++-dev \
+        libgtest-dev libgmock-dev libssl-dev libcurl4-openssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+        | sh -s -- -y --default-toolchain 1.89.0 --profile minimal
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+WORKDIR /ZeroTierOne
+
+# Pinned from-source deps -> /opt/zt-deps, against apt's abseil/protobuf/grpc.
+# ZT_CONTROLLER_DEPS=1 builds the full controller set (OTel SDK + OTLP exporters +
+# google-cloud-cpp); without it the script only builds the header-only OTel API.
+# Copy only the bootstrap script first so this expensive layer stays cached across
+# changes to the rest of the tree.
+COPY scripts/bootstrap-deps.sh scripts/bootstrap-deps.sh
+RUN ZT_CONTROLLER_DEPS=1 bash scripts/bootstrap-deps.sh /opt/zt-deps
+
+COPY . .
+RUN cmake -DCMAKE_BUILD_TYPE=Release -DZT1_CENTRAL_CONTROLLER=1 \
+        -DCMAKE_PREFIX_PATH=/opt/zt-deps -S . -B build-cmake -G Ninja \
+    && cmake --build build-cmake -j"$(nproc)"
+
+# Compute the exact runtime apt packages the binary links (robust against the
+# trixie t64 package renames). The two non-apt OTel proto .so's are copied
+# explicitly in the runtime stage, so dpkg-S misses there are expected.
+# readlink -f resolves the usrmerge /lib -> /usr/lib symlinks so dpkg -S can
+# attribute each .so to its package (and naturally picks up the trixie t64 names).
+RUN ldd build-cmake/zerotier-one | awk '/=> \//{print $3}' | xargs -r readlink -f \
+        | xargs -r dpkg -S 2>/dev/null | cut -d: -f1 | tr ',' '\n' | sort -u > /opt/runtime-pkgs.txt \
+    && echo "--- runtime packages ---" && cat /opt/runtime-pkgs.txt
+
+# ---------------------------------------------------------------------------
+FROM golang:1.24-bookworm AS go_base
+RUN GOFLAGS='-p=1' go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
+
+# ---------------------------------------------------------------------------
+FROM debian:trixie AS runtime
+COPY --from=builder /opt/runtime-pkgs.txt /opt/runtime-pkgs.txt
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        $(cat /opt/runtime-pkgs.txt) \
+        libjemalloc2 postgresql-client netcat-openbsd ca-certificates \
+    && rm -rf /var/lib/apt/lists/* /opt/runtime-pkgs.txt
+
+COPY --from=builder /ZeroTierOne/build-cmake/zerotier-one /usr/local/bin/zerotier-one
+# The only dynamically-linked from-source libs (OTel/gcloud are otherwise static).
+COPY --from=builder /opt/zt-deps/lib/libopentelemetry_proto.so /opt/zt-deps/lib/libopentelemetry_proto_grpc.so /usr/local/lib/
+RUN echo /usr/local/lib > /etc/ld.so.conf.d/zerotier.conf && ldconfig

-FROM registry.zerotier.com/zerotier/ctlrun:2025-07-14 AS run_base
-COPY --from=builder /ZeroTierOne/zerotier-one /usr/local/bin/zerotier-one
-COPY --from=builder /ZeroTierOne/ext/opentelemetry-cpp-1.21.0/localinstall/lib/*.so /usr/local/lib64/
 COPY --from=go_base /go/bin/migrate /usr/local/bin/migrate
 COPY ext/central-controller-docker/migrations /migrations
+COPY ext/central-controller-docker/main.sh /main.sh
+RUN chmod +x /usr/local/bin/zerotier-one /usr/local/bin/migrate /main.sh

-RUN chmod a+x /usr/local/bin/zerotier-one
-RUN echo "/usr/local/lib64" > /etc/ld.so.conf.d/usr-local-lib64.conf && ldconfig
-
-ADD ext/central-controller-docker/main.sh /
-RUN chmod a+x /main.sh
-
-ENTRYPOINT /main.sh
+ENTRYPOINT ["/main.sh"]
@@ -1,34 +0,0 @@
-# Dockerfile for building ZeroTier Central Controllers
-FROM debian:bookworm
-
-RUN apt update && apt upgrade -y
-RUN apt -y install \
-    build-essential \
-    pkg-config \
-    bash \
-    clang \
-    libjemalloc2 \
-    libjemalloc-dev \
-    libpq5 \
-    libpq-dev \
-    openssl \
-    libssl-dev \
-    postgresql-client \
-    postgresql-client-common \
-    curl \
-    libcurl4-openssl-dev \
-    google-perftools \
-    libgoogle-perftools-dev \
-    protobuf-compiler \
-    protobuf-compiler-grpc \
-    protobuf-c-compiler \
-    grpc-proto \
-    libgrpc++1.51 \
-    libgrpc++-dev \
-    libgrpc-dev \
-    libgrpc29 \
-    cmake \
-    git
-
-
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
@@ -1,19 +0,0 @@
-FROM debian:bookworm
-
-
-
-RUN apt update && apt upgrade -y
-RUN apt -y install \
-    netcat-traditional \
-    postgresql-client \
-    postgresql-client-common \
-    libjemalloc2 \
-    libpq5 \
-    curl \
-    binutils \
-    perf-tools-unstable \
-    google-perftools \
-    gnupg \
-    libgrpc++1.51 \
-    libgrpc29 
-
@@ -1,16 +0,0 @@
-registry = registry.zerotier.com/zerotier
-
-all:	controller-builder controller-runbase
-
-buildx:
-	@echo "docker buildx create"
-	# docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-	docker run --privileged --rm tonistiigi/binfmt --install all
-	@echo docker buildx create --name multiarch --driver docker-container --use
-	@echo docker buildx inspect --bootstrap
-
-controller-builder:	buildx
-	docker buildx build --no-cache --platform linux/amd64,linux/arm64 -t $(registry)/ctlbuild:$(shell date +"%Y-%m-%d") -f Dockerfile.builder . --push 
-
-controller-runbase: buildx
-	docker buildx build --no-cache --platform linux/amd64,linux/arm64 -t $(registry)/ctlrun:$(shell date +"%Y-%m-%d") -f Dockerfile.run_base . --push 
@@ -20,9 +20,6 @@ if [ -z "$ZT_DB_PASSWORD" ]; then
    echo '*** FAILED: ZT_DB_PASSWORD environment variable not defined'
    exit 1
 fi
-if [ -z "$ZT_DB_TYPE" ]; then
-    ZT_DB_TYPE="postgres"
-fi

 REDIS=""
 if [ "$ZT_USE_REDIS" == "true" ]; then
@@ -41,7 +38,7 @@ if [ "$ZT_USE_REDIS" == "true" ]; then
        exit 1
    fi

-    REDIS="\"redis\": {
+    REDIS=", \"redis\": {
            \"hostname\": \"${ZT_REDIS_HOST}\",
            \"port\": ${ZT_REDIS_PORT},
            \"clusterMode\": ${ZT_REDIS_CLUSTER_MODE},
@@ -49,7 +46,7 @@ if [ "$ZT_USE_REDIS" == "true" ]; then
        }
    "
 else
-    REDIS="\"redis\": null"
+    REDIS=", \"redis\": null"
 fi

 mkdir -p /var/lib/zerotier-one
@@ -60,8 +57,9 @@ if [ -d "$ZT_IDENTITY_PATH" ]; then

    ln -s $ZT_IDENTITY_PATH/identity.public identity.public
    ln -s $ZT_IDENTITY_PATH/identity.secret identity.secret
-    if [ -f  "$ZT_IDENTITY_PATH/authtoken.secret" ]; then
+    if [ -L  "$ZT_IDENTITY_PATH/authtoken.secret" ] && [ -e "$ZT_IDENTITY_PATH/authtoken.secret" ]; then
        ln -s $ZT_IDENTITY_PATH/authtoken.secret authtoken.secret
+        ln -s $ZT_IDENTITY_PATH/authtoken.secret metricstoken.secret
    fi
 fi
 popd
@@ -71,9 +69,90 @@ DEFAULT_LB_MODE=false

 APP_NAME="controller-$(cat /var/lib/zerotier-one/identity.public | cut -d ':' -f 1)"

+BIGTABLE_CONF=""
+if [ "$ZT_USE_BIGTABLE" == "true" ]; then
+    if [ -z "$ZT_BIGTABLE_PROJECT" ] || [ -z "$ZT_BIGTABLE_INSTANCE" ] || [ -z "$ZT_BIGTABLE_TABLE" ]; then
+        echo '*** FAILED: ZT_BIGTABLE_PROJECT, ZT_BIGTABLE_INSTANCE, and ZT_BIGTABLE_TABLE environment variables must all be defined to use Bigtable as a controller backend'
+        exit 1
+    fi
+
+    BIGTABLE_CONF=", \"bigtable\": {
+        \"project_id\": \"${ZT_BIGTABLE_PROJECT}\",
+        \"instance_id\": \"${ZT_BIGTABLE_INSTANCE}\",
+        \"table_id\": \"${ZT_BIGTABLE_TABLE}\"
+    }
+    "
+fi
+
+
+PUBSUB_CONF=""
+if [ "$ZT_USE_PUBSUB" == "true" ]; then
+    if [ -z "$ZT_PUBSUB_PROJECT" ]; then
+        echo '*** FAILED: ZT_PUBSUB_PROJECT environment variable must be defined to use PubSub as a controller backend'
+        exit 1
+    fi
+
+    if [ -z "$ZT_PUBSUB_MEMBER_CHANGE_RECV_TOPIC" ] || [ -z "$ZT_PUBSUB_MEMBER_CHANGE_SEND_TOPIC" ] || [ -z "$ZT_PUBSUB_NETWORK_CHANGE_RECV_TOPIC" ] || [ -z "$ZT_PUBSUB_NETWORK_CHANGE_SEND_TOPIC" ]; then
+        echo '*** FAILED: ZT_PUBSUB_MEMBER_CHANGE_RECV_TOPIC, ZT_PUBSUB_MEMBER_CHANGE_SEND_TOPIC, ZT_PUBSUB_NETWORK_CHANGE_RECV_TOPIC, and ZT_PUBSUB_NETWORK_CHANGE_SEND_TOPIC environment variables must all be defined to use PubSub as a controller backend'
+        exit 1
+    fi
+
+    PUBSUB_CONF=", \"pubsub\": {
+        \"project_id\": \"${ZT_PUBSUB_PROJECT}\",
+        \"member_change_recv_topic\": \"${ZT_PUBSUB_MEMBER_CHANGE_RECV_TOPIC}\",
+        \"member_change_send_topic\": \"${ZT_PUBSUB_MEMBER_CHANGE_SEND_TOPIC}\",
+        \"network_change_recv_topic\": \"${ZT_PUBSUB_NETWORK_CHANGE_RECV_TOPIC}\",
+        \"network_change_send_topic\": \"${ZT_PUBSUB_NETWORK_CHANGE_SEND_TOPIC}\",
+        \"sso_nonce_publish_topic\": \"${ZT_PUBSUB_SSO_NONCE_PUBLISH_TOPIC}\",
+        \"sso_auth_subscribe_topic\": \"${ZT_PUBSUB_SSO_AUTH_SUBSCRIBE_TOPIC}\"
+    }
+"
+fi
+
+# Backwards compatibility: if the per-frontend URLs aren't set but the legacy
+# ZT_SSO_REDIRECT_URL and ZT_ASSIGNED_CENTRAL_VERSION are both populated, map
+# the legacy URL into the new format keyed by the assigned Central version.
+if [ -z "$ZT_SSO_REDIRECT_URL_CV1" ] && [ -z "$ZT_SSO_REDIRECT_URL_CV2" ]; then
+    if [ -n "$ZT_SSO_REDIRECT_URL" ] && [ -n "$ZT_ASSIGNED_CENTRAL_VERSION" ]; then
+        case "$ZT_ASSIGNED_CENTRAL_VERSION" in
+            cv1)
+                ZT_SSO_REDIRECT_URL_CV1="$ZT_SSO_REDIRECT_URL"
+                ;;
+            cv2)
+                ZT_SSO_REDIRECT_URL_CV2="$ZT_SSO_REDIRECT_URL"
+                ;;
+            all)
+                echo '*** FAILED: controllers assigned to "all" must define ZT_SSO_REDIRECT_URL_CV1 and ZT_SSO_REDIRECT_URL_CV2; the legacy ZT_SSO_REDIRECT_URL cannot serve both Central versions'
+                exit 1
+                ;;
+        esac
+    fi
+fi
+
+# Per-frontend Central SSO redirect URLs. SSO-enabled networks are routed to the
+# SSO endpoint of the Central version ("cv1" or "cv2") they belong to.
+SSO_REDIRECT_URLS_CONF=""
+if [ -n "$ZT_SSO_REDIRECT_URL_CV1" ] || [ -n "$ZT_SSO_REDIRECT_URL_CV2" ]; then
+    SSO_REDIRECT_URLS=""
+    if [ -n "$ZT_SSO_REDIRECT_URL_CV1" ]; then
+        SSO_REDIRECT_URLS="\"cv1\": \"${ZT_SSO_REDIRECT_URL_CV1}\""
+    fi
+    if [ -n "$ZT_SSO_REDIRECT_URL_CV2" ]; then
+        if [ -n "$SSO_REDIRECT_URLS" ]; then
+            SSO_REDIRECT_URLS="${SSO_REDIRECT_URLS},
+        "
+        fi
+        SSO_REDIRECT_URLS="${SSO_REDIRECT_URLS}\"cv2\": \"${ZT_SSO_REDIRECT_URL_CV2}\""
+    fi
+    SSO_REDIRECT_URLS_CONF=", \"ssoRedirectURLs\": {
+        ${SSO_REDIRECT_URLS}
+    }
+"
+fi
+
 echo "{
    \"settings\": {
-        \"controllerDbPath\": \"${ZT_DB_TYPE}:host=${ZT_DB_HOST} port=${ZT_DB_PORT} dbname=${ZT_DB_NAME} user=${ZT_DB_USER} password=${ZT_DB_PASSWORD} application_name=${APP_NAME} sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}\",
+        \"controllerDbPath\": \"postgres:host=${ZT_DB_HOST} port=${ZT_DB_PORT} dbname=${ZT_DB_NAME} user=${ZT_DB_USER} password=${ZT_DB_PASSWORD} application_name=${APP_NAME} sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}\",
        \"portMappingEnabled\": true,
        \"softwareUpdate\": \"disable\",
        \"interfacePrefixBlacklist\": [
@@ -83,38 +162,48 @@ echo "{
        \"lowBandwidthMode\": ${ZT_LB_MODE:-$DEFAULT_LB_MODE},
        \"ssoRedirectURL\": \"${ZT_SSO_REDIRECT_URL}\",
        \"allowManagementFrom\": [\"127.0.0.1\", \"::1\", \"10.0.0.0/8\"],
+        \"enableMetrics\": ${ZT_ENABLE_METRICS:-true},
        \"otel\": {
            \"exporterEndpoint\": \"${ZT_EXPORTER_ENDPOINT}\",
            \"exporterSampleRate\": ${ZT_EXPORTER_SAMPLE_RATE:-0}
-        },
+        }
        ${REDIS}
+    },
+    \"controller\": {
+        \"listenMode\": \"${ZT_LISTEN_MODE:-pgsql}\",
+        \"statusMode\": \"${ZT_STATUS_MODE:-pgsql}\",
+        \"assignedCentralVersion\": \"${ZT_ASSIGNED_CENTRAL_VERSION:-all}\",
+        \"ssoEnabled\": ${ZT_SSO_ENABLED:-false}
+        ${SSO_REDIRECT_URLS_CONF}
+        ${REDIS}
+        ${BIGTABLE_CONF}
+        ${PUBSUB_CONF}
    }
-}    
+}
 " > /var/lib/zerotier-one/local.conf

 if [ -n "$DB_SERVER_CA" ]; then
    echo "secret list"
    chmod 600 /secrets/db/*.pem
    ls -l /secrets/db/
-    until /usr/bin/pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT} -d "sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}"; do
+    until pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT} -d "sslmode=prefer sslcert=${DB_CLIENT_CERT} sslkey=${DB_CLIENT_KEY} sslrootcert=${DB_SERVER_CA}"; do
 	    echo "Waiting for PostgreSQL...";
 	    sleep 2;
    done
 else
-    until /usr/bin/pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT}; do
+    until pg_isready -h ${ZT_DB_HOST} -p ${ZT_DB_PORT}; do
 	    echo "Waiting for PostgreSQL...";
 	    sleep 2;
    done
 fi

-if [ "$ZT_DB_TYPE" == "cv2" ]; then
-    echo "Migrating database (if needed)..."
-    if [ -n "$DB_SERVER_CA" ]; then
-        /usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=verify-full&sslrootcert=$DB_SERVER_CA&sslcert=$DB_CLIENT_CERT&sslkey=$DB_CLIENT_KEY" up  
-    else 
-        /usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=disable" up
-    fi
-fi
+
+# echo "Migrating database (if needed)..."
+# if [ -n "$DB_SERVER_CA" ]; then
+#     /usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=verify-full&sslrootcert=$DB_SERVER_CA&sslcert=$DB_CLIENT_CERT&sslkey=$DB_CLIENT_KEY" up
+# else
+#     /usr/local/bin/migrate -source file:///migrations -database "postgres://$ZT_DB_USER:$ZT_DB_PASSWORD@$ZT_DB_HOST:$ZT_DB_PORT/$ZT_DB_NAME?x-migrations-table=controller_migrations&sslmode=disable" up
+# fi

 if [ -n "$ZT_TEMPORAL_HOST" ] && [ -n "$ZT_TEMPORAL_PORT" ]; then
    echo "waiting for temporal..."
@@ -125,7 +214,16 @@ if [ -n "$ZT_TEMPORAL_HOST" ] && [ -n "$ZT_TEMPORAL_PORT" ]; then
    echo "Temporal is up"
 fi

+cat /var/lib/zerotier-one/local.conf
+
+export GOOGLE_CLOUD_CPP_ENABLE_CLOG=yes
+export LIBC_FATAL_STDERR_=1
 export GLIBCXX_FORCE_NEW=1
 export GLIBCPP_FORCE_NEW=1
-export LD_PRELOAD="/usr/lib/x86_64-linux-gnu/libjemalloc.so.2"
+# Preload jemalloc, located arch-agnostically (libjemalloc2 installs it under the
+# multiarch dir, e.g. /usr/lib/<triple>/libjemalloc.so.2). Skip if not present.
+JEMALLOC="$(ldconfig -p 2>/dev/null | awk '/libjemalloc\.so\.2/ {print $NF; exit}')"
+if [ -n "$JEMALLOC" ]; then
+    export LD_PRELOAD="$JEMALLOC"
+fi
 exec /usr/local/bin/zerotier-one -p${ZT_CONTROLLER_PORT:-$DEFAULT_PORT} /var/lib/zerotier-one