feat: move tailscale device discovery and settings into a plugin

Adds plugins/tailscale/ with a devices sidebar tab, admin settings
section, and re-auth dialog. Host Metrics tailscale manager card and
SSH re-auth banner parsing stay in core.

src/backend/database/database.ts

@@ -28,7 +28,7 @@ import uiPreferencesRoutes from "./routes/ui-preferences.js";
 import proxmoxDispatch from "./routes/proxmox-dispatch.js";
 import termixIdRoutes from "./routes/termix-id.js";
 import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
-import { registerTailscaleRoutes } from "./routes/tailscale-routes.js";
+import tailscaleDispatch from "./routes/tailscale-dispatch.js";
 import vaultRoutes from "./routes/vault.js";
 import secretSourceRoutes from "./routes/secret-sources.js";
 import notificationChannelsRoutes from "./routes/notification-channels-routes.js";
@@ -1771,7 +1771,7 @@ app.use("/ui-preferences", uiPreferencesRoutes);
 app.use("/proxmox", proxmoxDispatch);
 app.use("/termix-id", termixIdRoutes);
 registerAuditLogRoutes(app, authenticateJWT);
-registerTailscaleRoutes(app, authenticateJWT);
+app.use("/tailscale", tailscaleDispatch);
 app.use("/vault", vaultRoutes);
 app.use("/secret-sources", secretSourceRoutes);
 app.use("/automations", automationsDispatch);

src/backend/database/routes/tailscale-dispatch.ts

@@ -0,0 +1,47 @@
+// Mounted at /tailscale. Tailscale ships as a first-party in-process plugin
+// (plugins/tailscale) rather than a route file imported directly here, so
+// this module exists to keep /tailscale/* working at its original path
+// without handing the plugin a reference to the shared app instance. The
+// plugin runtime registers its router via registerTailscaleRouter when it
+// activates, and clears it on deactivate, so a disabled plugin falls back to
+// the 404 below.
+//
+// Unlike /plugin-api, this dispatcher applies no auth of its own: it forwards
+// to exactly one first-party router (the Tailscale plugin's own), and every
+// route in that router already applies authenticateJWT itself, the same as
+// every other router mounted alongside it here. /plugin-api gates at the
+// mount point because it forwards to arbitrary third-party plugin code that
+// cannot be assumed to gate itself; that reasoning does not apply to a single
+// first-party router that already does.
+
+import type { Request, Response, NextFunction, Router } from "express";
+import { databaseLogger } from "../../utils/logger.js";
+
+let activeRouter: Router | null = null;
+
+export function registerTailscaleRouter(router: Router): void {
+  activeRouter = router;
+  databaseLogger.info("Registered Tailscale plugin router", {
+    operation: "tailscale_dispatch_register",
+  });
+}
+
+export function unregisterTailscaleRouter(): void {
+  if (!activeRouter) return;
+  activeRouter = null;
+  databaseLogger.info("Unregistered Tailscale plugin router", {
+    operation: "tailscale_dispatch_register",
+  });
+}
+
+export default function tailscaleDispatch(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): void {
+  if (!activeRouter) {
+    res.status(404).json({ error: "Tailscale is not available" });
+    return;
+  }
+  activeRouter(req, res, next);
+}

src/backend/database/routes/tailscale-routes.ts

@@ -1,128 +0,0 @@
-import {
-  Router,
-  type RequestHandler,
-  type Router as ExpressRouter,
-} from "express";
-import { apiLogger } from "../../utils/logger.js";
-import { fetchWithProxy } from "../../utils/proxy-agent.js";
-import { createCurrentSettingsRepository } from "../repositories/factory.js";
-
-interface TailscaleDevice {
-  id: string;
-  name: string;
-  hostname: string;
-  addresses: string[];
-  os: string;
-  lastSeen: string;
-}
-
-interface TailscaleAPIDevice {
-  id: string;
-  name: string;
-  hostname: string;
-  addresses: string[];
-  os: string;
-  lastSeen: string;
-  nodeId?: string;
-}
-
-const DEFAULT_TAILSCALE_API_BASE = "https://api.tailscale.com/api/v2";
-
-const router = Router();
-
-function normalizeApiBase(raw: string | null): string {
-  const trimmed = (raw ?? "").trim().replace(/\/+$/, "");
-  return trimmed || DEFAULT_TAILSCALE_API_BASE;
-}
-
-export function registerTailscaleRoutes(
-  app: ExpressRouter,
-  authenticateJWT: RequestHandler,
-): void {
-  /**
-   * @openapi
-   * /tailscale/devices:
-   *   get:
-   *     summary: List Tailscale devices
-   *     description: Returns the list of devices in the configured tailnet using the stored API key.
-   *     tags:
-   *       - Tailscale
-   *     responses:
-   *       200:
-   *         description: List of tailnet devices.
-   *         content:
-   *           application/json:
-   *             schema:
-   *               type: object
-   *               properties:
-   *                 devices:
-   *                   type: array
-   *                   items:
-   *                     type: object
-   *       500:
-   *         description: Failed to fetch Tailscale devices.
-   */
-  router.get("/devices", authenticateJWT, async (_req, res) => {
-    try {
-      const settingsRepo = createCurrentSettingsRepository();
-      const apiKey = (await settingsRepo.get("tailscale_api_key")) ?? "";
-      if (!apiKey) {
-        return res.json({ devices: [], hasApiKey: false });
-      }
-      const apiBase = normalizeApiBase(
-        await settingsRepo.get("tailscale_api_base_url"),
-      );
-
-      const url = `${apiBase}/tailnet/-/devices?fields=all`;
-      const response = await fetchWithProxy(url, {
-        headers: {
-          Authorization: `Bearer ${apiKey}`,
-          "User-Agent": "Termix/1.0",
-        },
-      });
-
-      if (!response.ok) {
-        apiLogger.warn("Tailscale API returned non-OK status", {
-          operation: "tailscale_devices",
-          status: response.status,
-        });
-        if (response.status === 401 || response.status === 403) {
-          return res.status(401).json({
-            error: "Invalid Tailscale API key",
-            devices: [],
-            hasApiKey: true,
-          });
-        }
-        return res.status(502).json({
-          error: "Tailscale API error",
-          devices: [],
-          hasApiKey: true,
-        });
-      }
-
-      const data = (await response.json()) as { devices: TailscaleAPIDevice[] };
-
-      const devices: TailscaleDevice[] = (data.devices ?? []).map((d) => ({
-        id: d.id,
-        name: d.name,
-        hostname: d.hostname,
-        addresses: d.addresses ?? [],
-        os: d.os,
-        lastSeen: d.lastSeen,
-      }));
-
-      res.json({ devices, hasApiKey: true });
-    } catch (err) {
-      apiLogger.error("Failed to fetch Tailscale devices", err, {
-        operation: "tailscale_devices",
-      });
-      res.status(500).json({
-        error: "Failed to fetch Tailscale devices",
-        devices: [],
-        hasApiKey: true,
-      });
-    }
-  });
-
-  app.use("/tailscale", router);
-}