diff --git a/.github/workflows/integrationtest.yml b/.github/workflows/integrationtest.yml
index 7822cbd..ebb63de 100644
--- a/.github/workflows/integrationtest.yml
+++ b/.github/workflows/integrationtest.yml
@@ -26,20 +26,21 @@ jobs:
           cd ../plexus-agent
           CGO_ENABLED=0 go build -v  . 
 
-  #tests:
-  #  runs-on: ubuntu-latest
-  #  if: ${{ github.actor != 'dependabot[bot]' }}
-  #  steps:
-  #    - name: Checkout
-  #      uses: actions/checkout@v4
-  #    - name: Setup Go
-  #      uses: actions/setup-go@v6
-  #      with:
-  #        go-version-file: ./go.mod
-  #    - name: run tests
-  #      run: |
-  #        go vet ./...
-  #        go test ./... -v
+  tests:
+    runs-on: ubuntu-latest
+    if: ${{ github.actor != 'dependabot[bot]' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: ./go.mod
+      - name: run tests
+        run: |
+          go vet ./...
+          sudo go test -v ./...
+
 
   
   lint:
diff --git a/.gitignore b/.gitignore
index 338c063..3088c65 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,4 +8,5 @@ time.db
 **/launch.json
 devops/experiment/*
 devops/plexus-update/*
-devops/deploy/*
\ No newline at end of file
+devops/deploy/*
+internal/agent/agent.seed
\ No newline at end of file
diff --git a/.golangci.yml b/.golangci.yml
index d3f59b4..c9e097f 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -19,35 +19,40 @@ linters:
     - noinlineerr
     - paralleltest
     - testpackage
-    - thelper
     - wrapcheck
     - wsl
     - wsl_v5
   settings:
     cyclop:
       max-complexity: 20
+    errcheck:
+      exclude-functions:
+        - crypto/rand.Read
     funlen:
       statements: 60
-      lines: 80
+      lines: 82
     gosmopolitan:
       allow-time-local: true
     ireturn:
       allow:
-        - nkeys.KeyPair
         - error
+        - io.Reader
+        - net/http.Handler
+        - nkeys.KeyPair
     varnamelen:
       max-distance: 15
       ignore-names:
         - i
         - wg
       ignore-decls:
-        - c *gin.Context
         - c *nftables.Conn
         - c nftables.Conn
         - ec *nats.Conn
         - f embed.FS
         - id string
         - ns *server.Server
+        - r *http.Request
+        - w http.ResponseWriter
   exclusions:
     warn-unused: true
     generated: lax
@@ -59,23 +64,18 @@ linters:
     rules:
       - path: _test\.go
         linters:
+          - dupl
+          - funlen
           - gocognit
           - goconst
-          - funlen
-          - nonamedreturns
-          - revive
           - predeclared
-      - path: app/plexus-agent/cmd/
-        linters:
           - revive
-      - path: wireguard.go
+      - path: app/plexus-agent/cmd/*
         linters:
           - revive
 formatters:
   enable:
-    - gci
-    - gofmt
     - gofumpt
-    - goimports
+    - golines
   exclusions:
     generated: lax
diff --git a/README.md b/README.md
index e7bae57..9a7e2c2 100644
--- a/README.md
+++ b/README.md
@@ -54,7 +54,7 @@ Agent
 Tech Stack
 ==========
 * Language: [Go](https://go.dev)
-* HTTP Framework: [Gin](https://github.com/gin-gonic/gin)
+* HTTP Router: [devilcove/mux](https://github.com/devilcove/mux)
 * FrontEnd Framework: html/[htmx](https://htmx.org)
 * CSS Library: [w3schools](https://w3schools.com/w3css)
 * Database(key/value): [bbolt](https://github.com/etcd-io/bbolt)
diff --git a/app/plexus-agent/cmd/drop.go b/app/plexus-agent/cmd/drop.go
index 4161ce3..f605c88 100644
--- a/app/plexus-agent/cmd/drop.go
+++ b/app/plexus-agent/cmd/drop.go
@@ -46,5 +46,6 @@ var dropCmd = &cobra.Command{
 
 func init() {
 	rootCmd.AddCommand(dropCmd)
-	statusCmd.Flags().BoolVarP(&force, "force", "f", false, "force deletion even when not connected")
+	statusCmd.Flags().
+		BoolVarP(&force, "force", "f", false, "force deletion even when not connected")
 }
diff --git a/app/plexus-agent/cmd/register.go b/app/plexus-agent/cmd/register.go
index e61fa57..5288a03 100644
--- a/app/plexus-agent/cmd/register.go
+++ b/app/plexus-agent/cmd/register.go
@@ -36,7 +36,9 @@ var registerCmd = &cobra.Command{
 		ec, err := agent.ConnectToAgentBroker()
 		cobra.CheckErr(err)
 		resp := plexus.MessageResponse{}
-		cobra.CheckErr(agent.Request(ec, agent.Agent+plexus.Register, request, &resp, agent.NatsTimeout))
+		cobra.CheckErr(
+			agent.Request(ec, agent.Agent+plexus.Register, request, &resp, agent.NatsTimeout),
+		)
 		fmt.Println(resp.Message)
 	},
 }
diff --git a/app/plexus-agent/cmd/reset.go b/app/plexus-agent/cmd/reset.go
index 3c1c28a..895aed0 100644
--- a/app/plexus-agent/cmd/reset.go
+++ b/app/plexus-agent/cmd/reset.go
@@ -38,7 +38,9 @@ var resetCmd = &cobra.Command{
 		ec, err := agent.ConnectToAgentBroker()
 		cobra.CheckErr(err)
 		resp := plexus.MessageResponse{}
-		cobra.CheckErr(agent.Request(ec, agent.Agent+plexus.Reset, request, &resp, agent.NatsTimeout))
+		cobra.CheckErr(
+			agent.Request(ec, agent.Agent+plexus.Reset, request, &resp, agent.NatsTimeout),
+		)
 		fmt.Println(resp.Message)
 	},
 }
diff --git a/app/plexus-agent/cmd/root.go b/app/plexus-agent/cmd/root.go
index fff15bb..18dc36b 100644
--- a/app/plexus-agent/cmd/root.go
+++ b/app/plexus-agent/cmd/root.go
@@ -16,18 +16,17 @@ limitations under the License.
 package cmd
 
 import (
-	"fmt"
-	"log"
 	"log/slog"
 	"os"
+	"path/filepath"
 	"runtime/debug"
 
+	"github.com/devilcove/plexus"
 	"github.com/devilcove/plexus/internal/agent"
 	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
-var config agent.Configuration
+// var config agent.Configuration
 
 // rootCmd represents the base command when called without any subcommands.
 var rootCmd = &cobra.Command{
@@ -57,9 +56,9 @@ func init() {
 	// Cobra supports persistent flags, which, if defined here,
 	// will be global for your application.
 
-	rootCmd.PersistentFlags().StringP("verbosity", "v", "INFO", "logging verbosity")
-	rootCmd.PersistentFlags().IntP("natsport", "p", 4223, "nats port for cli <-> agent comms")
-
+	agent.Config.Verbosity = *rootCmd.PersistentFlags().StringP("verbosity", "v", "INFO", "logging verbosity")
+	agent.Config.NatsPort = *rootCmd.PersistentFlags().IntP("natsport", "p", 4223, "nats port for cli <-> agent comms")
+	plexus.SetLogging(agent.Config.Verbosity)
 	// Cobra also supports local flags, which will only run
 	// when this action is called directly.
 	// rootCmd.Flags().BoolP("toggle", "t", false, "Help message for toggle")
@@ -67,21 +66,14 @@ func init() {
 
 // initConfig reads in config file and ENV variables if set.
 func initConfig() {
-	viper.SetConfigFile("/etc/plexus-agent/config")
-	viper.SetConfigType("yaml")
-
-	if err := viper.BindPFlags(rootCmd.Flags()); err != nil {
-		log.Println("bindflags", err)
-	}
-	viper.SetEnvPrefix("PLEXUS")
-	viper.AutomaticEnv() // read in environment variables that match
-	if err := viper.ReadInConfig(); err == nil {
-		fmt.Fprintln(os.Stderr, "Using config file:", viper.ConfigFileUsed())
-	}
-	if err := viper.UnmarshalExact(&config); err != nil {
-		log.Println("viper.Unmarshal", err)
+	plexus.SetLogging("INFO")
+	home, err := os.UserHomeDir()
+	if err != nil {
+		panic(err)
 	}
-	agent.Config = config
-	slog.Debug("using configuration", "config", config)
+	agent.Config.DataDir = home + "/.local/share/" + filepath.Base(os.Args[0]) + "/"
+
+	// set defaults
+	slog.Debug("using configuration", "config", agent.Config)
 	debug.SetTraceback("single")
 }
diff --git a/app/plexus-agent/cmd/set.go b/app/plexus-agent/cmd/set.go
index 965bce8..9ca4c79 100644
--- a/app/plexus-agent/cmd/set.go
+++ b/app/plexus-agent/cmd/set.go
@@ -67,7 +67,15 @@ var setCmd = &cobra.Command{
 		resp := plexus.MessageResponse{}
 		ec, err := agent.ConnectToAgentBroker()
 		cobra.CheckErr(err)
-		cobra.CheckErr(agent.Request(ec, agent.Agent+plexus.SetPrivateEndpoint, request, &resp, agent.NatsTimeout))
+		cobra.CheckErr(
+			agent.Request(
+				ec,
+				agent.Agent+plexus.SetPrivateEndpoint,
+				request,
+				&resp,
+				agent.NatsTimeout,
+			),
+		)
 		fmt.Println(resp.Message)
 	},
 }
diff --git a/app/plexus-agent/cmd/status.go b/app/plexus-agent/cmd/status.go
index 71074cc..9cd9be2 100644
--- a/app/plexus-agent/cmd/status.go
+++ b/app/plexus-agent/cmd/status.go
@@ -44,7 +44,9 @@ var statusCmd = &cobra.Command{
 		cobra.CheckErr(err)
 		status := agent.StatusResponse{}
 		// networks := []Network{}
-		cobra.CheckErr(agent.Request(ec, agent.Agent+plexus.Status, nil, &status, agent.NatsTimeout))
+		cobra.CheckErr(
+			agent.Request(ec, agent.Agent+plexus.Status, nil, &status, agent.NatsTimeout),
+		)
 		if status.Server == "" {
 			fmt.Println("agent running... not connected to servers")
 			return
@@ -105,7 +107,11 @@ var statusCmd = &cobra.Command{
 					fmt.Println("\trelay: true")
 					showRelayedPeers(peer.RelayedPeers, network)
 				}
-				fmt.Println("\tprivate-endpoint:", peer.PrivateEndpoint.String()+":", peer.ListenPort)
+				fmt.Println(
+					"\tprivate-endpoint:",
+					peer.PrivateEndpoint.String()+":",
+					peer.ListenPort,
+				)
 				fmt.Println("\tpublic-endpoint:", peer.Endpoint.String()+":", peer.PublicListenPort)
 				fmt.Println("\twg-endpoint:", wgPeer.Endpoint)
 				fmt.Print("\tallowed ips:")
diff --git a/app/plexus-agent/cmd/status_test.go b/app/plexus-agent/cmd/status_test.go
index f9ee3b9..2190635 100644
--- a/app/plexus-agent/cmd/status_test.go
+++ b/app/plexus-agent/cmd/status_test.go
@@ -11,47 +11,47 @@ import (
 func TestPrintHandshake(t *testing.T) {
 	bytes := make([]byte, 128)
 	out, err := os.Open(os.Stdout.Name())
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	t.Run("one second", func(t *testing.T) {
 		printHandshake(time.Now().Add(time.Second * -1))
 		_, err := out.Read(bytes)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(bytes), "1 second ago")
 		should.BeNil(t, out.Close())
 	})
 	t.Run("one minute", func(t *testing.T) {
 		out, err := os.Open(os.Stdout.Name())
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		printHandshake(time.Now().Add(time.Second * -60))
 		_, err = out.Read(bytes)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(bytes), "1 minute 0 seconds ago")
 		should.BeNil(t, out.Close())
 	})
 	t.Run("hours", func(t *testing.T) {
 		out, err := os.Open(os.Stdout.Name())
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		printHandshake(time.Now().Add(time.Second * -3600))
 		_, err = out.Read(bytes)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(bytes), "1 hour 0 minutes 0 seconds ago")
 		should.BeNil(t, out.Close())
 	})
 	t.Run("multi", func(t *testing.T) {
 		out, err := os.Open(os.Stdout.Name())
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		printHandshake(time.Now().Add(time.Second * -7250))
 		_, err = out.Read(bytes)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(bytes), "2 hours 0 minutes 50 seconds ago")
 		should.BeNil(t, out.Close())
 	})
 	t.Run("now", func(t *testing.T) {
 		out, err := os.Open(os.Stdout.Name())
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		printHandshake(time.Now())
 		_, err = out.Read(bytes)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(bytes), "never")
 		should.BeNil(t, out.Close())
 	})
diff --git a/app/plexus-agent/cmd/version.go b/app/plexus-agent/cmd/version.go
index fa8237d..8197dc8 100644
--- a/app/plexus-agent/cmd/version.go
+++ b/app/plexus-agent/cmd/version.go
@@ -26,7 +26,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-const version = "v0.3.0"
+const version = "v0.4.0"
 
 // versionCmd represents the version command.
 var versionCmd = &cobra.Command{
@@ -40,7 +40,13 @@ var versionCmd = &cobra.Command{
 			cobra.CheckErr(err)
 			response := plexus.VersionResponse{}
 			// need longer timeout is case of server timeout
-			err = agent.Request(nc, agent.Agent+plexus.Version, long, &response, agent.NatsLongTimeout)
+			err = agent.Request(
+				nc,
+				agent.Agent+plexus.Version,
+				long,
+				&response,
+				agent.NatsLongTimeout,
+			)
 			if err != nil {
 				fmt.Println("error", err)
 			}
@@ -71,5 +77,6 @@ func init() {
 
 	// Cobra supports local flags which will only run when this command
 	// is called directly, e.g.:
-	versionCmd.Flags().BoolVarP(&long, "long", "l", false, "display server(s)/agent version information")
+	versionCmd.Flags().
+		BoolVarP(&long, "long", "l", false, "display server(s)/agent version information")
 }
diff --git a/docs/agent.md b/docs/agent.md
index e369708..fe5a2fc 100644
--- a/docs/agent.md
+++ b/docs/agent.md
@@ -25,8 +25,8 @@ Available Commands:
   version     display version information
 
 Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
   -h, --help               help for plexus-agent
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 
 Use "plexus-agent [command] --help" for more information about a command.
@@ -48,7 +48,7 @@ Flags:
   -h, --help   help for register
 
 Global Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 ```
 
@@ -65,7 +65,7 @@ Flags:
   -h, --help   help for drop
 
 Global Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 ```
 
@@ -82,7 +82,7 @@ Flags:
   -h, --help   help for join
 
 Global Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 ```
 
@@ -97,7 +97,7 @@ Flags:
   -h, --help   help for leave
 
 Global Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 Leave command deletes current network on peer
 ```
@@ -157,7 +157,7 @@ Flags:
   -h, --help   help for reload
 
 Global Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 ```
 
@@ -174,7 +174,7 @@ Flags:
   -h, --help   help for reset
 
 Global Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 ```
 
@@ -215,7 +215,7 @@ Flags:
   -h, --help   help for loglevel
 
 Global Flags:
-      --config string      config file (default is /etc/plexus/plexus-agent.yaml)
+  -p, --natsport int       nats port for cli <-> agent comms (default 4223)
   -v, --verbosity string   logging verbosity (default "INFO")
 ```
 
diff --git a/docs/configuration.md b/docs/configuration.md
index 7ef2ade..2000eb8 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -1,27 +1,16 @@
 Configuration
 =============
-Order of precedence
-1. Environment variable with prefix of PLEXUS_
-2. Configuration variables in file /etc/plexus/config.yml 
-3. Default values
 
 
 Server
 ------
-| Variable  | Env     | Default  |  Usage |
-| --- | ---- | ---- | --- | 
-| adminname | PLEXUS_ADMINNAME | admin | default admin username |
-| adminpass | PLEXUS_ADMINPASS | password | password for default admin |
-| verbosity | PLEXUS_VERBOSITY | info |  level for logs |
-| secure | PLEXUS_SECURE | true | use TLS for http and nats |
-| port | PLEXUS_PORT | 8080 | web listen port when secure is false |
-| email | PLEXUS_EMAIL | | email for use with Let's Encrypt |
+| Variable  | Default  |  Usage |
+| --- |  ---- | --- | 
+| adminname | admin | default admin username |
+| adminpass | password | password for default admin |
+| verbosity | info |  level for logs |
+| secure |  true | use TLS for http and nats |
+| port |  | 8080 | web listen port when secure is false |
+| email |  | email for use with Let's Encrypt |
 
 * adminname/adminpass is only used to create a default user iff an admin user does not exist on server startup
-
-Agent
------
-| Variable  | Env     | Default  |  Usage |
-| --- | ---- | ---- | --- | 
-| verbosity | PLEXUS_VERBOSITY | info |  level for logs |
-| natsport | PLEXUS_NATSPORT | 4223 | port for cli <-> agent nats comms |
\ No newline at end of file
diff --git a/docs/toc.md b/docs/index.md
similarity index 100%
rename from docs/toc.md
rename to docs/index.md
diff --git a/docs/install.md b/docs/install.md
index 6e80bc6..c8d289d 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -50,4 +50,4 @@ If the server is to be installed behind a reverse proxy or in a lan only setting
 * set secure = false
 * set port (default 8080) to desired listening port for web traffic
 * fqdn must be set (can be an IP address) such that all peers can resolve the address of the server
-> setting fqdn to an IP address in not valid with secure=true.  Let's Encrypt does not support certificates for [IP addresses](https://community.letsencrypt.org/t/ssl-on-a-ip-instead-of-domain/90635)
+> setting fqdn to an IP address is not valid with secure=true.  Let's Encrypt does not support certificates for [IP addresses](https://community.letsencrypt.org/t/ssl-on-a-ip-instead-of-domain/90635)
diff --git a/docs/screenshots/about.png b/docs/screenshots/about.png
index 94c75b9..3181560 100644
Binary files a/docs/screenshots/about.png and b/docs/screenshots/about.png differ
diff --git a/go.mod b/go.mod
index c379a7e..9ee27ff 100644
--- a/go.mod
+++ b/go.mod
@@ -7,18 +7,19 @@ require (
 	github.com/c-robinson/iplib v1.0.8
 	github.com/caddyserver/certmagic v0.25.0
 	github.com/devilcove/boltdb v0.1.7
+	github.com/devilcove/configuration v0.1.0
+	github.com/devilcove/mux v0.2.1
 	github.com/fatih/color v1.18.0
-	github.com/gin-contrib/sessions v1.0.4
-	github.com/gin-gonic/gin v1.11.0
 	github.com/google/nftables v0.3.0
+	github.com/gorilla/sessions v1.4.0
 	github.com/kr/pretty v0.3.1
 	github.com/lmittmann/tint v1.1.2
-	github.com/nats-io/nats-server/v2 v2.12.2
-	github.com/nats-io/nats.go v1.47.0
+	github.com/mattkasun/tools v0.2.3
+	github.com/nats-io/nats-server/v2 v2.12.3
+	github.com/nats-io/nats.go v1.48.0
 	github.com/nats-io/nkeys v0.4.12
 	github.com/pion/stun v0.6.1
 	github.com/spf13/cobra v1.10.2
-	github.com/spf13/viper v1.21.0
 	github.com/vishvananda/netlink v1.3.1
 	go.etcd.io/bbolt v1.4.3
 	golang.org/x/crypto v0.46.0
@@ -26,31 +27,15 @@ require (
 )
 
 require (
-	github.com/antithesishq/antithesis-sdk-go v0.4.3-default-no-op // indirect
-	github.com/bytedance/sonic v1.14.0 // indirect
-	github.com/bytedance/sonic/loader v0.3.0 // indirect
+	github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op // indirect
 	github.com/caddyserver/zerossl v0.1.3 // indirect
-	github.com/cloudwego/base64x v0.1.6 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
-	github.com/gin-contrib/sse v1.1.0 // indirect
-	github.com/go-playground/locales v0.14.1 // indirect
-	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.27.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/go-tpm v0.9.6 // indirect
-	github.com/gorilla/context v1.1.2 // indirect
+	github.com/google/go-tpm v0.9.7 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/gorilla/sessions v1.4.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.1 // indirect
+	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/libdns/libdns v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -60,32 +45,20 @@ require (
 	github.com/mholt/acmez/v3 v3.1.3 // indirect
 	github.com/miekg/dns v1.1.68 // indirect
 	github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/nats-io/jwt/v2 v2.8.0 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pion/dtls/v2 v2.2.7 // indirect
 	github.com/pion/logging v0.2.2 // indirect
 	github.com/pion/transport/v2 v2.2.1 // indirect
-	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.57.0 // indirect
 	github.com/rogpeppe/go-internal v1.10.0 // indirect
-	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
-	github.com/spf13/afero v1.15.0 // indirect
-	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.3.0 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/arch v0.20.0 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
 	golang.org/x/mod v0.30.0 // indirect
 	golang.org/x/net v0.47.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
@@ -94,5 +67,4 @@ require (
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.39.0 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
-	google.golang.org/protobuf v1.36.9 // indirect
 )
diff --git a/go.sum b/go.sum
index debbeb5..de9baf4 100644
--- a/go.sum
+++ b/go.sum
@@ -1,19 +1,13 @@
 github.com/Kairum-Labs/should v0.2.2 h1:bO1kaMGRYRSSpq8MHsmk2MqpA1taLPblPCZy9Jnpt+U=
 github.com/Kairum-Labs/should v0.2.2/go.mod h1:vP/ASEjUAKoWy/M7uIrAXq69p7/IUWOpEe5R+q/+K34=
-github.com/antithesishq/antithesis-sdk-go v0.4.3-default-no-op h1:+OSa/t11TFhqfrX0EOSqQBDJ0YlpmK0rDSiB19dg9M0=
-github.com/antithesishq/antithesis-sdk-go v0.4.3-default-no-op/go.mod h1:IUpT2DPAKh6i/YhSbt6Gl3v2yvUZjmKncl7U91fup7E=
-github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=
-github.com/bytedance/sonic v1.14.0/go.mod h1:WoEbx8WTcFJfzCe0hbmyTGrfjt8PzNEBdxlNUO24NhA=
-github.com/bytedance/sonic/loader v0.3.0 h1:dskwH8edlzNMctoruo8FPTJDF3vLtDT0sXZwvZJyqeA=
-github.com/bytedance/sonic/loader v0.3.0/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
+github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op h1:Ucf+QxEKMbPogRO5guBNe5cgd9uZgfoJLOYs8WWhtjM=
+github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op/go.mod h1:IUpT2DPAKh6i/YhSbt6Gl3v2yvUZjmKncl7U91fup7E=
 github.com/c-robinson/iplib v1.0.8 h1:exDRViDyL9UBLcfmlxxkY5odWX5092nPsQIykHXhIn4=
 github.com/c-robinson/iplib v1.0.8/go.mod h1:i3LuuFL1hRT5gFpBRnEydzw8R6yhGkF4szNDIbF8pgo=
 github.com/caddyserver/certmagic v0.25.0 h1:VMleO/XA48gEWes5l+Fh6tRWo9bHkhwAEhx63i+F5ic=
 github.com/caddyserver/certmagic v0.25.0/go.mod h1:m9yB7Mud24OQbPHOiipAoyKPn9pKHhpSJxXR1jydBxA=
 github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
 github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
-github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
-github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -21,67 +15,40 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/devilcove/boltdb v0.1.7 h1:JVj8aZ/bilaGhduq1+E4qlWRrxYeH5sIjWdrdnBcsr0=
 github.com/devilcove/boltdb v0.1.7/go.mod h1:aXkamUgsGOC3njIPiZ/FzsYqAGGEMQyc5EE1gRHlOuw=
+github.com/devilcove/configuration v0.1.0 h1:Aih99HhJ5lyf8fzjJagQmhjlkjyo3P36Wpr20NnCpI8=
+github.com/devilcove/configuration v0.1.0/go.mod h1:T0EvOgFp4QGf5zVcV2kY78ghkRQnFiF/HPXzV5wMcSQ=
+github.com/devilcove/mux v0.2.1 h1:V9Zu+aXxrmiFqligpgdWSmWYZ8XKYYtOwPrsxyKehI4=
+github.com/devilcove/mux v0.2.1/go.mod h1:Q4ysJcjpLwW7rLNTOYSlYVst5OmwFh1uZxJSCPQ34U4=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
-github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
-github.com/gin-contrib/sessions v1.0.4 h1:ha6CNdpYiTOK/hTp05miJLbpTSNfOnFg5Jm2kbcqy8U=
-github.com/gin-contrib/sessions v1.0.4/go.mod h1:ccmkrb2z6iU2osiAHZG3x3J4suJK+OU27oqzlWOqQgs=
-github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
-github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
-github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
-github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
-github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
-github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
-github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
-github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4=
-github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
-github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-tpm v0.9.6 h1:Ku42PT4LmjDu1H5C5ISWLlpI1mj+Zq7sPGKoRw2XROA=
-github.com/google/go-tpm v0.9.6/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/go-tpm v0.9.7 h1:u89J4tUUeDTlH8xxC3CTW7OHZjbjKoHdQ9W7gCUhtxA=
+github.com/google/go-tpm v0.9.7/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/nftables v0.3.0 h1:bkyZ0cbpVeMHXOrtlFc8ISmfVqq5gPJukoYieyVmITg=
 github.com/google/nftables v0.3.0/go.mod h1:BCp9FsrbF1Fn/Yu6CLUc9GGZFw/+hsxfluNXXmxBfRM=
-github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
-github.com/gorilla/context v1.1.2/go.mod h1:KDPwT9i/MeWHiLl90fuTgrt4/wPcv75vFAZLaOOcbxM=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
-github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
+github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
+github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
-github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
 github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
 github.com/lmittmann/tint v1.1.2 h1:2CQzrL6rslrsyjqLDwD11bZ5OpLBPU+g3G/r5LSfS8w=
 github.com/lmittmann/tint v1.1.2/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE=
+github.com/mattkasun/tools v0.2.3 h1:g3ciN2dtA+NpTGqJvcuMaHy4NRkPKWt8TY8ZnJw8kVc=
+github.com/mattkasun/tools v0.2.3/go.mod h1:WHhDjcX5n0ZAP0Z6XET1p2pCWqUgZDq8M5XEg+Pus9k=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@@ -101,23 +68,16 @@ github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE9
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
 github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76 h1:KGuD/pM2JpL9FAYvBrnBBeENKZNh6eNtjqytV6TYjnk=
 github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/nats-io/jwt/v2 v2.8.0 h1:K7uzyz50+yGZDO5o772eRE7atlcSEENpL7P+b74JV1g=
 github.com/nats-io/jwt/v2 v2.8.0/go.mod h1:me11pOkwObtcBNR8AiMrUbtVOUGkqYjMQZ6jnSdVUIA=
-github.com/nats-io/nats-server/v2 v2.12.2 h1:4TEQd0Y4zvcW0IsVxjlXnRso1hBkQl3TS0BI+SxgPhE=
-github.com/nats-io/nats-server/v2 v2.12.2/go.mod h1:j1AAttYeu7WnvD8HLJ+WWKNMSyxsqmZ160pNtCQRMyE=
-github.com/nats-io/nats.go v1.47.0 h1:YQdADw6J/UfGUd2Oy6tn4Hq6YHxCaJrVKayxxFqYrgM=
-github.com/nats-io/nats.go v1.47.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
+github.com/nats-io/nats-server/v2 v2.12.3 h1:KRv+1n7lddMVgkJPQer+pt36TcO0ENxjilBmeWdjcHs=
+github.com/nats-io/nats-server/v2 v2.12.3/go.mod h1:MQXjG9WjyXKz9koWzUc3jYUMKD8x3CLmTNy91IQQz3Y=
+github.com/nats-io/nats.go v1.48.0 h1:pSFyXApG+yWU/TgbKCjmm5K4wrHu86231/w84qRVR+U=
+github.com/nats-io/nats.go v1.48.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
 github.com/nats-io/nkeys v0.4.12 h1:nssm7JKOG9/x4J8II47VWCL1Ds29avyiQDRn0ckMvDc=
 github.com/nats-io/nkeys v0.4.12/go.mod h1:MT59A1HYcjIcyQDJStTfaOY6vhy9XTUjOFo+SVsvpBg=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pion/dtls/v2 v2.2.7 h1:cSUBsETxepsCSFSxC3mc/aDo14qQLMSL+O6IjG28yV8=
 github.com/pion/dtls/v2 v2.2.7/go.mod h1:8WiMkebSHFD0T+dIU+UeBaoV7kDhOW5oDCzZ7WZ/F9s=
 github.com/pion/logging v0.2.2 h1:M9+AIj/+pxNsDfAT64+MAVgJO0rsyLnoJKCqf//DoeY=
@@ -129,46 +89,24 @@ github.com/pion/transport/v2 v2.2.1/go.mod h1:cXXWavvCnFF6McHTft3DWS9iic2Mftcz1A
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
-github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
-github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
-github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
-github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
-github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
-github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
-github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
-github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
-github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
-github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
-github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA=
-github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
 github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
@@ -184,18 +122,15 @@ go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
-go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
-golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
@@ -255,11 +190,7 @@ golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uI
 golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
-google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
-google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/agent/broker.go b/internal/agent/broker.go
index 4fa275b..549bf1b 100644
--- a/internal/agent/broker.go
+++ b/internal/agent/broker.go
@@ -20,7 +20,9 @@ import (
 
 func startBroker() (*server.Server, *nats.Conn) {
 	defer log.Println("Agent server halting")
-	ns, err := server.NewServer(&server.Options{Host: "localhost", Port: Config.NatsPort, NoSigs: true})
+	ns, err := server.NewServer(
+		&server.Options{Host: "localhost", Port: Config.NatsPort, NoSigs: true},
+	)
 	if err != nil {
 		slog.Error("start nats", "error", err)
 		panic(err)
@@ -129,12 +131,15 @@ func subcribeToServerTopics(self Device) {
 	}
 	subscriptions = append(subscriptions, ping)
 
-	leaveServer, err := serverConn.Subscribe(plexus.Update+id+plexus.LeaveServer, func(_ *nats.Msg) {
-		slog.Info("leave server")
-		closeServerConnections()
-		deleteAllInterfaces()
-		deleteAllNetworks()
-	})
+	leaveServer, err := serverConn.Subscribe(
+		plexus.Update+id+plexus.LeaveServer,
+		func(_ *nats.Msg) {
+			slog.Info("leave server")
+			closeServerConnections()
+			deleteAllInterfaces()
+			deleteAllNetworks()
+		},
+	)
 	if err != nil {
 		slog.Error("leave server subscription", "error", err)
 	}
@@ -271,7 +276,11 @@ func sendVersion(msg *nats.Msg, agentConn *nats.Conn) {
 			slog.Error("version request", "error", err)
 		}
 		if err := json.Unmarshal(resp.Data, &response); err != nil {
-			slog.Error("invalid version response from server", "error", err, "data", string(resp.Data))
+			slog.Error(
+				"invalid version response from server",
+				"error", err,
+				"data", string(resp.Data),
+			)
 		}
 	} else {
 		slog.Debug("not connected to server")
diff --git a/internal/agent/config.go b/internal/agent/config.go
index 2c2df45..f9d7553 100644
--- a/internal/agent/config.go
+++ b/internal/agent/config.go
@@ -19,10 +19,9 @@ const (
 	connectivityTimeout   = time.Minute * 3
 	endpointServerTimeout = time.Second * 30
 	networkNotMapped      = "network not mapped to server"
-	version               = "v0.2.3"
+	version               = "v0.4.0"
 	networkTable          = "networks"
 	deviceTable           = "devices"
-	path                  = "/var/lib/plexus/"
 )
 
 var (
@@ -37,4 +36,5 @@ var (
 type Configuration struct {
 	NatsPort  int
 	Verbosity string
+	DataDir   string
 }
diff --git a/internal/agent/daemon.go b/internal/agent/daemon.go
index 0fa9c58..37e834c 100644
--- a/internal/agent/daemon.go
+++ b/internal/agent/daemon.go
@@ -22,7 +22,7 @@ var restartEndpointServer chan struct{}
 
 func Run() {
 	plexus.SetLogging(Config.Verbosity)
-	if err := boltdb.Initialize(path+"plexus-agent.db", []string{deviceTable, networkTable}); err != nil {
+	if err := boltdb.Initialize(Config.DataDir+"plexus-agent.db", []string{deviceTable, networkTable}); err != nil {
 		slog.Error("failed to initialize database", "error", err)
 		return
 	}
@@ -158,8 +158,15 @@ func privateEndpointServer(ctx context.Context, wg *sync.WaitGroup) {
 		if me.PrivateEndpoint == nil {
 			continue
 		}
-		slog.Info("tcp listener starting on private endpoint", "endpoint", me.PrivateEndpoint, "port", me.ListenPort)
-		listener, err := net.ListenTCP("tcp", &net.TCPAddr{IP: me.PrivateEndpoint, Port: me.ListenPort})
+		slog.Info(
+			"tcp listener starting on private endpoint",
+			"endpoint", me.PrivateEndpoint,
+			"port", me.ListenPort,
+		)
+		listener, err := net.ListenTCP(
+			"tcp",
+			&net.TCPAddr{IP: me.PrivateEndpoint, Port: me.ListenPort},
+		)
 		if err != nil {
 			slog.Error("public endpoint server", "error", err)
 			return
diff --git a/internal/agent/handlers.go b/internal/agent/handlers.go
index bd6a682..6cc8607 100644
--- a/internal/agent/handlers.go
+++ b/internal/agent/handlers.go
@@ -20,7 +20,12 @@ func networkUpdates(msg *nats.Msg) {
 		slog.Error("invalid network update", "error", err, "data", string(msg.Data))
 		return
 	}
-	slog.Info("network update for", "network", networkName, "action", update.Action, "peer", update.Peer)
+	slog.Info(
+		"network update for",
+		"network", networkName,
+		"action", update.Action,
+		"peer", update.Peer,
+	)
 	network, err := boltdb.Get[Network](networkName, networkTable)
 	if err != nil {
 		if errors.Is(err, boltdb.ErrNoResults) {
@@ -215,8 +220,12 @@ func processAddPeer(network Network, update *plexus.NetworkUpdate, wg *plexus.Wi
 	slog.Debug("add peer")
 	for _, peer := range network.Peers {
 		if peer.WGPublicKey == update.Peer.WGPublicKey {
-			slog.Error("peer already exists", "network", network.Name, "peer", update.Peer.HostName, "id",
-				update.Peer.WGPublicKey)
+			slog.Error(
+				"peer already exists",
+				"network", network.Name,
+				"peer", update.Peer.HostName,
+				"id", update.Peer.WGPublicKey,
+			)
 			return
 		}
 	}
@@ -241,7 +250,12 @@ func processAddPeer(network Network, update *plexus.NetworkUpdate, wg *plexus.Wi
 	}
 }
 
-func processDeletePeer(network Network, update *plexus.NetworkUpdate, self Device, wg *plexus.Wireguard) {
+func processDeletePeer(
+	network Network,
+	update *plexus.NetworkUpdate,
+	self Device,
+	wg *plexus.Wireguard,
+) {
 	slog.Debug("delete peer")
 	if update.Peer.WGPublicKey == self.WGPublicKey {
 		slog.Info("self delete --> delete network", "network", network.Name)
@@ -428,7 +442,11 @@ func sendListenPorts(msg *nats.Msg, serverConn *nats.Conn) {
 	if err := serverConn.Publish(msg.Reply, bytes); err != nil {
 		slog.Error("publish reply to SendListenPorts", "error", err)
 	}
-	slog.Debug("sent listenports to server", "public", response.PublicListenPort, "private", response.ListenPort)
+	slog.Debug(
+		"sent listenports to server",
+		"public", response.PublicListenPort,
+		"private", response.ListenPort,
+	)
 }
 
 func joinNetwork(msg *nats.Msg, self Device) {
@@ -443,7 +461,12 @@ func joinNetwork(msg *nats.Msg, self Device) {
 		return
 	}
 	if err := startInterface(self, network); err != nil {
-		slog.Error("error starting interface", "interface", network.Interface, "network", network.Name, "error", err)
+		slog.Error(
+			"error starting interface",
+			"interface", network.Interface,
+			"network", network.Name,
+			"error", err,
+		)
 		return
 	}
 }
diff --git a/internal/agent/interface.go b/internal/agent/interface.go
index 0764e60..74298fd 100644
--- a/internal/agent/interface.go
+++ b/internal/agent/interface.go
@@ -62,7 +62,12 @@ func startAllInterfaces(self Device) {
 	for _, network := range networks {
 		slog.Debug("starting interface", "interface", network.Interface, "network", network.Name)
 		if err := startInterface(self, network); err != nil {
-			slog.Error("start interface", "network", network.Name, "interface", network.Interface, "error", err)
+			slog.Error(
+				"start interface",
+				"network", network.Name,
+				"interface", network.Interface,
+				"error", err,
+			)
 		}
 	}
 }
@@ -81,7 +86,7 @@ func startInterface(self Device, network Network) error {
 		}
 	}
 	if address.IPNet == nil {
-		return errors.New("no address for network" + network.Name)
+		return errors.New("no address for network " + network.Name)
 	}
 	privKey, err := wgtypes.ParseKey(self.WGPrivateKey)
 	if err != nil {
@@ -114,7 +119,10 @@ func startInterface(self Device, network Network) error {
 		network.ListenPort = port
 	}
 	if addressChanged {
-		slog.Debug("public address changed ... saving and publishing update", "address", self.Endpoint)
+		slog.Debug(
+			"public address changed ... saving and publishing update",
+			"address", self.Endpoint,
+		)
 		if err := boltdb.Save(self, "self", deviceTable); err != nil {
 			return err
 		}
@@ -232,7 +240,12 @@ func getAllowedIPs(node plexus.NetworkPeer, peers []plexus.NetworkPeer) []net.IP
 		} else {
 			allowed = append(allowed, node.Subnet)
 		}
-		slog.Debug("new allowed ips", "allowed", allowed, "virt", node.VirtSubnet, "subnet", node.Subnet)
+		slog.Debug(
+			"new allowed ips",
+			"allowed", allowed,
+			"virt", node.VirtSubnet,
+			"subnet", node.Subnet,
+		)
 	}
 	if node.IsRelay {
 		for _, peer := range peers {
@@ -250,7 +263,12 @@ func getWGPeers(self Device, network Network) []wgtypes.PeerConfig {
 	keepalive := defaultKeepalive
 	peers := []wgtypes.PeerConfig{}
 	for _, peer := range network.Peers {
-		slog.Debug("checking peer", "peer", peer.WGPublicKey, "address", peer.Address, "mask", network.Net.Mask)
+		slog.Debug(
+			"checking peer",
+			"peer", peer.WGPublicKey,
+			"address", peer.Address,
+			"mask", network.Net.Mask,
+		)
 		if peer.WGPublicKey == self.WGPublicKey {
 			if peer.IsRelayed {
 				slog.Info("I am relayed")
@@ -381,7 +399,10 @@ func getNewListenPorts(name string) (plexus.NetworkPeer, error) {
 	}, nil
 }
 
-func convertPeerToWG(netPeer plexus.NetworkPeer, peers []plexus.NetworkPeer) (wgtypes.PeerConfig, error) {
+func convertPeerToWG(
+	netPeer plexus.NetworkPeer,
+	peers []plexus.NetworkPeer,
+) (wgtypes.PeerConfig, error) {
 	var addr *net.UDPAddr
 	keepalive := defaultKeepalive
 	key, err := wgtypes.ParseKey(netPeer.WGPublicKey)
@@ -389,7 +410,10 @@ func convertPeerToWG(netPeer plexus.NetworkPeer, peers []plexus.NetworkPeer) (wg
 		return wgtypes.PeerConfig{}, err
 	}
 	if netPeer.UsePrivateEndpoint {
-		addr, err = net.ResolveUDPAddr("udp", netPeer.PrivateEndpoint.String()+":"+strconv.Itoa(netPeer.ListenPort))
+		addr, err = net.ResolveUDPAddr(
+			"udp",
+			netPeer.PrivateEndpoint.String()+":"+strconv.Itoa(netPeer.ListenPort),
+		)
 		if err != nil {
 			return wgtypes.PeerConfig{}, err
 		}
diff --git a/internal/agent/interface_test.go b/internal/agent/interface_test.go
new file mode 100644
index 0000000..2a0434e
--- /dev/null
+++ b/internal/agent/interface_test.go
@@ -0,0 +1,36 @@
+package agent
+
+import (
+	"os/user"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/vishvananda/netlink"
+)
+
+func TestInterface(t *testing.T) {
+	user, err := user.Current()
+	should.NotBeError(t, err)
+	if user.Uid != "0" {
+		t.Log("this test must be run as root")
+		t.Skip()
+	}
+	deleteAllNetworks()
+	deleteAllInterfaces()
+	nets := createTestSeverNetworks(t)
+	self, err := newDevice()
+	should.NotBeError(t, err)
+	should.NotBeError(t, saveServerNetworks(self, nets))
+
+	t.Run("startAll", func(t *testing.T) {
+		self, err := newDevice()
+		should.NotBeError(t, err)
+		ifaces, err := netlink.LinkList()
+		should.NotBeError(t, err)
+		number := len(ifaces)
+		startAllInterfaces(self)
+		ifaces, err = netlink.LinkList()
+		should.NotBeError(t, err)
+		should.BeEqual(t, len(ifaces), number+2)
+	})
+}
diff --git a/internal/agent/join_test.go b/internal/agent/join_test.go
index e18fd6d..cce89be 100644
--- a/internal/agent/join_test.go
+++ b/internal/agent/join_test.go
@@ -12,63 +12,61 @@ import (
 
 func TestCheckPort(t *testing.T) {
 	add := net.UDPAddr{
-		Port: 51820,
+		Port: 51830,
 	}
 	conn, err := net.ListenUDP("udp", &add)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.NotBeNil(t, conn)
 	t.Run("portnotavail", func(t *testing.T) {
-		newPort := checkPort(51820)
-		should.BeEqual(t, newPort, 51821)
+		newPort := checkPort(51830)
+		should.BeEqual(t, newPort, 51831)
 	})
 	err = conn.Close()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	t.Run("portavail", func(t *testing.T) {
-		newPort := checkPort(51820)
-		should.BeEqual(t, newPort, 51820)
+		newPort := checkPort(51830)
+		should.BeEqual(t, newPort, 51830)
 	})
 	t.Run("noports", func(t *testing.T) {
 		add1 := net.UDPAddr{
 			Port: 65534,
 		}
 		conn1, err := net.ListenUDP("udp", &add1)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		add2 := net.UDPAddr{
 			Port: 65535,
 		}
 		conn2, err := net.ListenUDP("udp", &add2)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		newPort := checkPort(65534)
 		should.BeEqual(t, newPort, 0)
 		err = conn1.Close()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		err = conn2.Close()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 	})
 }
 
 func TestNewDevice(t *testing.T) {
-	err := boltdb.Initialize("./test.db", []string{deviceTable})
-	should.BeNil(t, err)
+	// err := boltdb.Initialize("./test.db", []string{deviceTable})
+	// should.NotBeError(t, err)
 	device := Device{}
-	err = boltdb.Delete[Device]("self", deviceTable)
+	err := boltdb.Delete[Device]("self", deviceTable)
 	if err != nil && !errors.Is(err, boltdb.ErrNoResults) {
 		t.Fail()
 	}
 	hostname, err := os.Hostname()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	t.Run("newDevice", func(t *testing.T) {
 		device, err = newDevice()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEqual(t, device.Name, hostname)
 	})
 	t.Run("existingDevice", func(t *testing.T) {
 		device, err = newDevice()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		new, err := newDevice()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEqual(t, new.Seed, device.Seed)
 	})
-	err = boltdb.Close()
-	should.BeNil(t, err)
 }
diff --git a/internal/agent/network_test.go b/internal/agent/network_test.go
new file mode 100644
index 0000000..de6c2c8
--- /dev/null
+++ b/internal/agent/network_test.go
@@ -0,0 +1,29 @@
+package agent
+
+import (
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/boltdb"
+)
+
+func TestSaveServerNetwork(t *testing.T) {
+	serverNet := createTestSeverNetworks(t)
+	net, err := saveServerNetwork(serverNet[0])
+	should.BeNil(t, err)
+	should.BeEqual(t, net.Name, serverNet[0].Name)
+	dbNet, err := boltdb.Get[Network](net.Name, networkTable)
+	should.NotBeError(t, err)
+	should.BeEqual(t, dbNet.Name, serverNet[0].Name)
+}
+
+func TestSaveServerNetworks(t *testing.T) {
+	deleteAllNetworks()
+	self, err := newDevice()
+	should.NotBeError(t, err)
+	serverNets := createTestSeverNetworks(t)
+	should.NotBeError(t, saveServerNetworks(self, serverNets))
+	networks, err := boltdb.GetAll[Network](networkTable)
+	should.NotBeError(t, err)
+	should.BeEqual(t, len(networks), 2)
+}
diff --git a/internal/agent/nftables.go b/internal/agent/nftables.go
index ce890b1..7d9dec8 100644
--- a/internal/agent/nftables.go
+++ b/internal/agent/nftables.go
@@ -74,7 +74,12 @@ func checkForNat(self Device, network Network) error {
 				return addNat()
 			}
 			if peer.UseVirtSubnet {
-				slog.Debug("adding virtual subnet", "peer", peer.HostName, "virtual subnet", peer.VirtSubnet, "subnet", peer.Subnet)
+				slog.Debug(
+					"adding virtual subnet",
+					"peer", peer.HostName,
+					"virtual subnet", peer.VirtSubnet,
+					"subnet", peer.Subnet,
+				)
 				return addVirtualSubnet(peer.VirtSubnet, peer.Subnet)
 			}
 		}
diff --git a/internal/agent/nftables_test.go b/internal/agent/nftables_test.go
index e4fcaac..a78313a 100644
--- a/internal/agent/nftables_test.go
+++ b/internal/agent/nftables_test.go
@@ -15,16 +15,16 @@ func TestAddNAT(t *testing.T) {
 	table := &nftables.Table{}
 	chain := &nftables.Chain{}
 	user, err := user.Current()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	if user.Uid != "0" {
 		t.Log("this test must be run as root")
 		t.Skip()
 	}
 	c := nftables.Conn{}
 	err = addNat()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	tables, err := c.ListTables()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	tableFound := false
 	for _, t := range tables {
 		if t.Name == "plexus" {
@@ -34,7 +34,7 @@ func TestAddNAT(t *testing.T) {
 	}
 	should.BeTrue(t, tableFound)
 	chains, err := c.ListChains()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	chainFound := false
 	for _, c := range chains {
 		if c.Name == "plexus-nat" {
@@ -44,7 +44,7 @@ func TestAddNAT(t *testing.T) {
 	}
 	should.BeTrue(t, chainFound)
 	rules, err := c.GetRules(table, chain)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.BeEqual(t, len(rules), 1)
 	should.BeEqual(t, rules[0].Exprs[0], &expr.Masq{
 		Random:      false,
@@ -59,7 +59,7 @@ func TestAddNAT(t *testing.T) {
 
 func TestDelNat(t *testing.T) {
 	user, err := user.Current()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	if user.Uid != "0" {
 		t.Log("this test must be run as root")
 		t.Skip()
@@ -85,11 +85,11 @@ func TestDelNat(t *testing.T) {
 	}
 	c.AddRule(rule)
 	err = c.Flush()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	err = delNat()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	chains, err := c.ListChains()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	found := false
 	for _, chain := range chains {
 		if chain.Name == "plexus-nat" {
@@ -103,13 +103,13 @@ func TestDelNat(t *testing.T) {
 func TestCheckForNat(t *testing.T) {
 	plexus.SetLogging("debug")
 	user, err := user.Current()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	if user.Uid != "0" {
 		t.Log("this test must be run as root")
 		t.Skip()
 	}
 	_, public, err := generateKeys()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	self := Device{}
 	self.WGPublicKey = public.String()
 	peer := plexus.NetworkPeer{
@@ -125,19 +125,19 @@ func TestCheckForNat(t *testing.T) {
 	network.Peers = append(network.Peers, peer)
 	c := &nftables.Conn{}
 	tables, err := c.ListTables()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	for _, table := range tables {
 		if table.Name == "plexus" {
 			c.DelTable(table)
 			err = c.Flush()
-			should.BeNil(t, err)
+			should.NotBeError(t, err)
 		}
 	}
 	t.Run("noSubnetRouter", func(t *testing.T) {
 		err := checkForNat(self, network)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		tables, err := c.ListTables()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		for _, table := range tables {
 			if table.Name == "plexus" {
 				t.FailNow()
@@ -152,9 +152,9 @@ func TestCheckForNat(t *testing.T) {
 		}
 		network.Peers = []plexus.NetworkPeer{peer}
 		err = checkForNat(self, network)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		tables, err := c.ListTables()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		for _, table := range tables {
 			if table.Name == "plexus" {
 				t.FailNow()
@@ -167,9 +167,9 @@ func TestCheckForNat(t *testing.T) {
 		peer.UseNat = true
 		network.Peers = []plexus.NetworkPeer{peer}
 		err = checkForNat(self, network)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		tables, err := c.ListTables()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		tableFound := false
 		for _, t := range tables {
 			if t.Name == "plexus" {
@@ -179,7 +179,7 @@ func TestCheckForNat(t *testing.T) {
 		}
 		should.BeTrue(t, tableFound)
 		chains, err := c.ListChains()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		chainFound := false
 		for _, c := range chains {
 			if c.Name == "plexus-nat" {
@@ -189,7 +189,7 @@ func TestCheckForNat(t *testing.T) {
 		}
 		should.BeTrue(t, chainFound)
 		rules, err := c.GetRules(table, chain)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEqual(t, len(rules), 1)
 		should.BeEqual(t, rules[0].Exprs[0], &expr.Masq{
 			Random:      false,
@@ -212,9 +212,9 @@ func TestCheckForNat(t *testing.T) {
 		network.Peers = []plexus.NetworkPeer{peer}
 		t.Log(self, network)
 		err = checkForNat(self, network)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		tables, err := c.ListTables()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		tableFound := false
 		for _, t := range tables {
 			if t.Name == "plexus" {
@@ -224,7 +224,7 @@ func TestCheckForNat(t *testing.T) {
 		}
 		should.BeTrue(t, tableFound)
 		chains, err := c.ListChains()
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		chainFound := false
 		for _, c := range chains {
 			if c.Name == "plexus-subnet" {
@@ -234,20 +234,21 @@ func TestCheckForNat(t *testing.T) {
 		}
 		should.BeTrue(t, chainFound)
 		rules, err := c.GetRules(table, chain)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEqual(t, len(rules), 254)
 	})
 	cleanNat(t, c)
 }
 
 func cleanNat(t *testing.T, c *nftables.Conn) {
+	t.Helper()
 	tables, err := c.ListTables()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	for _, table := range tables {
 		if table.Name == "plexus" {
 			c.DelTable(table)
 			err := c.Flush()
-			should.BeNil(t, err)
+			should.NotBeError(t, err)
 			break
 		}
 	}
diff --git a/internal/agent/plexus_test.go b/internal/agent/plexus_test.go
new file mode 100644
index 0000000..1644f8e
--- /dev/null
+++ b/internal/agent/plexus_test.go
@@ -0,0 +1,71 @@
+package agent
+
+import (
+	"log"
+	"net"
+	"os"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/boltdb"
+	"github.com/devilcove/plexus"
+)
+
+func TestMain(m *testing.M) {
+	if _, err := os.Stat("./test.db"); err == nil {
+		if err := os.Remove("./test.db"); err != nil {
+			log.Println("remove db", err)
+			os.Exit(1)
+		}
+	}
+	if err := boltdb.Initialize("./test.db",
+		[]string{deviceTable, networkTable},
+	); err != nil {
+		log.Println("init db", err)
+		os.Exit(2)
+	}
+	plexus.SetLogging("debug")
+	code := m.Run()
+	// 	cancel()
+	// 	wg.Wait()
+	boltdb.Close()
+	os.Exit(code)
+}
+
+func createTestSeverNetworks(t *testing.T) []plexus.Network {
+	t.Helper()
+	self, err := newDevice()
+	should.NotBeError(t, err)
+	ip1, cidr1, err := net.ParseCIDR("10.100.0.2/24")
+	should.NotBeError(t, err)
+	ip2, cidr2, err := net.ParseCIDR("10.200.0.2/24")
+	should.NotBeError(t, err)
+	return []plexus.Network{
+		{
+			Name: "one",
+			Net:  *cidr1,
+			Peers: []plexus.NetworkPeer{
+				{
+					WGPublicKey: self.WGPublicKey,
+					Address: net.IPNet{
+						IP:   ip1,
+						Mask: net.CIDRMask(32, 32),
+					},
+				},
+			},
+		},
+		{
+			Name: "two",
+			Net:  *cidr2,
+			Peers: []plexus.NetworkPeer{
+				{
+					WGPublicKey: self.WGPublicKey,
+					Address: net.IPNet{
+						IP:   ip2,
+						Mask: net.CIDRMask(32, 32),
+					},
+				},
+			},
+		},
+	}
+}
diff --git a/internal/agent/publish.go b/internal/agent/publish.go
index 99591a2..e26d332 100644
--- a/internal/agent/publish.go
+++ b/internal/agent/publish.go
@@ -104,10 +104,13 @@ func checkin() {
 				continue
 			}
 			if peer.PrivateEndpoint != nil {
-				checkinData.PrivateEndpoints = append(checkinData.PrivateEndpoints, plexus.PrivateEndpoint{
-					IP:      peer.PrivateEndpoint.String(),
-					Network: network.Name,
-				})
+				checkinData.PrivateEndpoints = append(
+					checkinData.PrivateEndpoints,
+					plexus.PrivateEndpoint{
+						IP:      peer.PrivateEndpoint.String(),
+						Network: network.Name,
+					},
+				)
 			}
 		}
 	}
diff --git a/internal/agent/register.go b/internal/agent/register.go
index b64f23a..b9b6808 100644
--- a/internal/agent/register.go
+++ b/internal/agent/register.go
@@ -94,11 +94,7 @@ func newDevice() (Device, error) {
 		Seed:         seed,
 		WGPrivateKey: privKey.String(),
 	}
-	if err := os.MkdirAll(path, os.ModePerm); err != nil {
-		slog.Error("unable to mkdir", "path", path, "error", err)
-		return device, err
-	}
-	if err := os.WriteFile(path+"agent.seed", []byte(seed), os.ModePerm); err != nil {
+	if err := os.WriteFile(Config.DataDir+"agent.seed", []byte(seed), os.ModePerm); err != nil {
 		slog.Error("save seed", "error", err)
 	}
 	err = boltdb.Save(device, "self", deviceTable)
diff --git a/internal/server/broker.go b/internal/server/broker.go
index 22a3884..bbd90d0 100644
--- a/internal/server/broker.go
+++ b/internal/server/broker.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/devilcove/boltdb"
+	"github.com/devilcove/configuration"
 	"github.com/devilcove/plexus"
 	"github.com/devilcove/plexus/internal/publish"
 	"github.com/nats-io/nats-server/v2/server"
@@ -49,6 +50,11 @@ func broker(ctx context.Context, wg *sync.WaitGroup, tls *tls.Config) {
 	natsOptions.Nkeys = append(natsOptions.Nkeys, tokensUsers...)
 	natsOptions.Nkeys = append(natsOptions.Nkeys, deviceUsers...)
 	natsOptions.NoSigs = true
+	config := &Configuration{}
+	if err := configuration.Get(config); err != nil {
+		slog.Error("configuration", "error", err)
+		return
+	}
 	if config.Secure {
 		natsOptions.TLSConfig = tls
 		natsOptions.Host = config.FQDN
@@ -67,7 +73,7 @@ func broker(ctx context.Context, wg *sync.WaitGroup, tls *tls.Config) {
 		return adminKey.Sign(nonce)
 	}
 	opts := []nats.Option{nats.Nkey(adminPublicKey, SignatureCB)}
-	natsConn, err = nats.Connect(net.JoinHostPort("nats://"+config.FQDN, "4222"), opts...)
+	natsConn, err = nats.Connect("nats://"+net.JoinHostPort(config.FQDN, "4222"), opts...)
 	if err != nil {
 		slog.Error("nats connect", "error", err)
 		brokerfail <- 1
@@ -90,27 +96,6 @@ func startBroker(ctx context.Context) {
 				_ = sub.Drain()
 			}
 			return
-		case token := <-newDevice:
-			slog.Info("new login device", "device", token)
-			keyValue, err := plexus.DecodeToken(token)
-			if err != nil {
-				slog.Error("decode token", "error", err)
-			}
-			key, err := nkeys.FromSeed([]byte(keyValue.Seed))
-			if err != nil {
-				slog.Error("seed failure", "error", err)
-				continue
-			}
-			nPubKey, err := key.PublicKey()
-			if err != nil {
-				slog.Error("publickey", "error", err)
-				continue
-			}
-			natsOptions.Nkeys = append(natsOptions.Nkeys, &server.NkeyUser{
-				Nkey:        nPubKey,
-				Permissions: registerPermissions(),
-			})
-			_ = natServer.ReloadOptions(natsOptions)
 		case <-pingTicker.C:
 			pingPeers()
 		case <-keyTicker.C:
@@ -153,7 +138,12 @@ func createNkeyUser(token string) *server.NkeyUser {
 }
 
 func getAdminKey() nkeys.KeyPair {
-	seed, err := os.ReadFile(path + "server.seed")
+	config := Configuration{}
+	if err := configuration.Get(&config); err != nil {
+		slog.Error("configuration", "error", err)
+		return nil
+	}
+	seed, err := os.ReadFile(config.DataHome + "server.seed")
 	if err != nil {
 		return createAdminNKeyPair()
 	}
@@ -176,7 +166,12 @@ func createAdminNKeyPair() nkeys.KeyPair {
 		slog.Error("admin seed creation", "error", err)
 		return admin
 	}
-	if err := os.WriteFile(path+"server.seed", seed, os.ModePerm); err != nil {
+	config := Configuration{}
+	if err := configuration.Get(&config); err != nil {
+		slog.Error("configuration", "error", err)
+		return nil
+	}
+	if err := os.WriteFile(config.DataHome+"/server.seed", seed, os.ModePerm); err != nil {
 		slog.Error("save admin seed", "error", err)
 	}
 	return admin
diff --git a/internal/server/config.go b/internal/server/config.go
index 6aae283..f1997a6 100644
--- a/internal/server/config.go
+++ b/internal/server/config.go
@@ -4,21 +4,21 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
-	"io/fs"
 	"log/slog"
 	"net"
 	"net/mail"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
 	"github.com/caddyserver/certmagic"
 	"github.com/devilcove/boltdb"
+	"github.com/devilcove/configuration"
 	"github.com/devilcove/plexus"
-	"github.com/spf13/viper"
 )
 
-type configuration struct {
+type Configuration struct {
 	AdminName string
 	AdminPass string
 	FQDN      string
@@ -26,9 +26,8 @@ type configuration struct {
 	Port      string
 	Email     string
 	Verbosity string
-	DBPath    string
+	DataHome  string
 	DBFile    string
-	Tables    []string
 }
 
 const (
@@ -40,13 +39,14 @@ const (
 )
 
 var (
-	config           configuration
-	ErrServerURL     = errors.New("invalid server URL")
-	ErrInvalidSubnet = errors.New("invalid subnet")
-	ErrSubnetInUse   = errors.New("subnet in use")
-	sessionAge       = 60 * 60 * 24
-	version          = "v0.2.3"
-	path             = "/var/lib/plexus/"
+	ErrServerURL       = errors.New("invalid server URL")
+	ErrInvalidSubnet   = errors.New("invalid subnet")
+	ErrSubnetInUse     = errors.New("subnet in use")
+	ErrDataDir         = errors.New("data dir not found")
+	ErrSecureBlankFQDN = errors.New("secure server requires FQDN")
+	ErrSecureWithIP    = errors.New("cannot use IP address with secure")
+	ErrInValidEmail    = errors.New("valid email address required")
+	version            = "v0.4.0"
 )
 
 const (
@@ -59,44 +59,61 @@ const (
 )
 
 func configureServer() (*tls.Config, error) {
-	var tlsConfig *tls.Config
-	viper.SetDefault("adminname", "admin")
-	viper.SetDefault("adminpass", "password")
-	viper.SetDefault("verbosity", "INFO")
-	viper.SetDefault("secure", true)
-	viper.SetDefault("port", "8080")
-	viper.SetDefault("email", "")
-	viper.SetDefault("dbfile", "plexus-server.db")
-	viper.SetDefault("tables", []string{userTable, keyTable, networkTable, peerTable, settingTable})
-	viper.SetDefault("dbpath", path)
-	viper.SetConfigFile("/etc/plexus/config")
-	viper.SetConfigType("yaml")
-	if err := viper.ReadInConfig(); err != nil && !errors.Is(err, fs.ErrNotExist) {
+	plexus.SetLogging("INFO")
+	home, err := os.UserHomeDir()
+	if err != nil {
 		return nil, err
 	}
-	viper.SetEnvPrefix("PLEXUS")
-	viper.AutomaticEnv()
-	if err := viper.UnmarshalExact(&config); err != nil {
+	config := Configuration{}
+	if err := configuration.Get(&config); err != nil {
 		return nil, err
 	}
+	// set defaults
+	if config.AdminName == "" {
+		config.AdminName = "admin"
+	}
+	if config.AdminPass == "" {
+		config.AdminPass = "password"
+	}
+	if config.Verbosity == "" {
+		config.Verbosity = "INFO"
+	}
+	if config.Port == "" {
+		config.Port = "8080"
+	}
+	if config.DBFile == "" {
+		config.DBFile = "plexus-server.db"
+	}
+	if config.DataHome == "" {
+		config.DataHome = home + "/.local/share/" + filepath.Base(os.Args[0]) + "/"
+	}
+	if _, err := os.Stat(config.DataHome); err != nil {
+		return nil, ErrDataDir
+	}
+
+	slog.Info("configure Server", "config", config)
+	var tlsConfig *tls.Config
 	plexus.SetLogging(config.Verbosity)
 	if config.Secure {
 		if config.FQDN == "" {
-			return nil, errors.New("secure server requires FQDN")
+			return nil, ErrSecureBlankFQDN
 		}
 		if net.ParseIP(config.FQDN) != nil {
-			return nil, errors.New("cannot use IP address with secure")
+			return nil, ErrSecureWithIP
 		}
 		if !emailValid(config.Email) {
-			return nil, errors.New("valid email address required")
+			return nil, ErrInValidEmail
 		}
 	}
 	// initialize database.
-	if err := os.MkdirAll(config.DBPath, os.ModePerm); err != nil {
+	if err := os.MkdirAll(config.DataHome, os.ModePerm); err != nil {
 		return nil, err
 	}
-	slog.Info("init db", "path", config.DBFile, "file", config.DBFile, "tables", config.Tables)
-	if err := boltdb.Initialize(config.DBPath+config.DBFile, config.Tables); err != nil {
+	slog.Info("init db", "path", config.DataHome, "file", config.DBFile)
+	if err := boltdb.Initialize(
+		filepath.Join(config.DataHome, config.DBFile),
+		[]string{"users", "keys", "networks", "peers", "settings"},
+	); err != nil {
 		return nil, fmt.Errorf("init database %w", err)
 	}
 	// check default user exists.
diff --git a/internal/server/config_test.go b/internal/server/config_test.go
index 0aa8d97..9030964 100644
--- a/internal/server/config_test.go
+++ b/internal/server/config_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/boltdb"
 )
 
 func Test_emailValid(t *testing.T) {
@@ -36,3 +37,45 @@ func Test_emailValid(t *testing.T) {
 		})
 	}
 }
+
+func TestConfigureServer(t *testing.T) {
+	setup(t)
+	defer shutdown(t)
+	err := boltdb.Close()
+	should.NotBeError(t, err)
+	defer func() {
+		err := boltdb.Initialize("./test.db",
+			[]string{userTable, keyTable, networkTable, peerTable, settingTable})
+		should.NotBeError(t, err)
+	}()
+
+	t.Run("secureNoFQDM", func(t *testing.T) {
+		writeTmpConfg(t, &Configuration{Secure: true, FQDN: ""})
+		config, err := configureServer()
+		should.BeErrorIs(t, err, ErrSecureBlankFQDN)
+		should.BeNil(t, config)
+	})
+
+	t.Run("secureWithIP", func(t *testing.T) {
+		writeTmpConfg(t, &Configuration{Secure: true, FQDN: "10.10.10.100"})
+		config, err := configureServer()
+		should.BeErrorIs(t, err, ErrSecureWithIP)
+		should.BeNil(t, config)
+	})
+
+	t.Run("secureNoEmail", func(t *testing.T) {
+		writeTmpConfg(t, &Configuration{Secure: true, FQDN: "example.com"})
+		config, err := configureServer()
+		should.BeErrorIs(t, err, ErrInValidEmail)
+		should.BeNil(t, config)
+	})
+
+	t.Run("insecure", func(t *testing.T) {
+		writeTmpConfg(t, &Configuration{FQDN: "example.com", Email: "admin@domain.com"})
+		config, err := configureServer()
+		should.NotBeError(t, err)
+		should.BeNil(t, config)
+		t.Log(err, config)
+		should.BeNil(t, boltdb.Close())
+	})
+}
diff --git a/internal/server/html/about.html b/internal/server/html/about.html
index 2ac930b..0651c6b 100644
--- a/internal/server/html/about.html
+++ b/internal/server/html/about.html
@@ -3,15 +3,13 @@
 <div id="About" class="w3-modal">
     <div class="w3-modal-content w3-card-4 w3-animate-zoom w3-padding" style="width:50%">
         <div class="w3-container w3-center w3-theme-dark">
-            <img src="images/plexus.svg" alt="logo" height="75"><br>
+            <img src="content/images/plexus.svg" alt="logo" height="75"><br>
             <small>Version {{ .Version }}</small>
-            <h3>&copy; 2023-2024 Matthew R. Kasun</h3>
+            <h3>&copy; 2023-2026 Matthew R. Kasun</h3>
             <small>built with
                 <a href="https://go.dev" target="_blank">go</a>
-                <a href="https://github.com/gin-gonic/" target="_blank">gin</a>
                 <a href="https://nats.io" target="_blank">nats</a>
                 <a href="https://pkg.go.dev/go.etcd.io/bbolt" target="_blank">bbolt</a>
-                <a href="https://w3schools.com/w3css" target="_blank">w3css</a>
                 and <a href="https://htmx.org" target="_blank">htmx</a></small><br><br>
             <a href="mailto://mkasun@nusak.ca?subject=plexus">
                 <i class="fa fa-paper-plane w3-small"></i>
@@ -20,7 +18,8 @@ <h3>&copy; 2023-2024 Matthew R. Kasun</h3>
                 <i class="fab fa-github"></i>
                 repo</a>
             <br><br>
-            <button type="submit" class="w3-button w3-block w3-padding" onclick="document.getElementById('About').style.display='none'">Close</button>
+            <button type="submit" class="w3-button w3-block w3-padding"
+                onclick="document.getElementById('About').style.display='none'">Close</button>
         </div>
     </div>
 </div>
diff --git a/internal/server/html/content.html b/internal/server/html/content.html
index 03c45d6..207eed2 100644
--- a/internal/server/html/content.html
+++ b/internal/server/html/content.html
@@ -1,25 +1,21 @@
 {{define "content"}}
 {{if (eq .NeedsLogin true)}}
 {{template "login" .}}
-{{ else if (eq .Page "addNetwork")}}
-{{template "addNetwork"}}
-{{ else if (eq .Page "networks")}}
-{{template "networks" . }}
-{{ else if (eq .Page "peers")}}
-{{template "peers" . }}
-{{ else if (eq .Page "keys")}}
-{{template "keys" . }}
-{{ else if (eq .Page "users")}}
-{{template "users" . }}
-{{ else if (eq .Page "settings")}}
-{{template "settings" . }}
+
 {{ else }}
-<div id="content">
-    <div class="w3-container w3-center w3-theme-dark w3-padding">
-        <div id="error" class="w3-red"></div>
-        <br>
-    </div>
-    {{template "sidebar" .Networks}}
+{{template "sidebar" .Networks}}
+<div id="content" style="margin-left:25%">
+    {{ if (eq .Page "addNetwork")}}
+    {{template "addNetwork"}}
+    {{ else if (eq .Page "networks")}}
+    {{template "networks" . }}
+    {{ else if (eq .Page "peers")}}
+    {{template "peers" . }}
+    {{ else if (eq .Page "keys")}}
+    {{template "keys" . }}
+    {{ else if (eq .Page "users")}}
+    {{template "users" . }}
+    {{end}}
 </div>
 {{end}}
 {{end}}
\ No newline at end of file
diff --git a/internal/server/html/error.html b/internal/server/html/error.html
index 375aeac..cdcf438 100644
--- a/internal/server/html/error.html
+++ b/internal/server/html/error.html
@@ -1,3 +1,13 @@
 {{define "error"}}
-<p class="w3-red w3-center">Error Processing Request: {{ . }}</p>
+<div id="Error" class="w3-modal">
+    <div class="w3-modal-content w3-card-4 w3-animate-zoom w3-padding" style="width:50%">
+        <div class="w3-container w3-center w3-theme-dark">
+            <img src="content/images/plexus.svg" alt="logo" height="75"><br>
+            <p id="errorMessage" class="w3-red w3-center">Error Processing Request: {{ . }}</p>
+            <br><br>
+            <button type="submit" class="w3-button w3-block w3-padding"
+                onclick="document.getElementById('Error').style.display='none'">Close</button>
+        </div>
+    </div>
+</div>
 {{end}}
\ No newline at end of file
diff --git a/internal/server/html/header.html b/internal/server/html/header.html
index 0c316e2..36262a4 100644
--- a/internal/server/html/header.html
+++ b/internal/server/html/header.html
@@ -1,12 +1,12 @@
 {{define "header"}}
 <header class="w3-theme-d5 w3-bar w3-hide-small">
-        <a class="w3-bar-item w3-button w3-hover-black" href="/">
-            <img src="images/plexus.svg" alt="Plexus" height="75"></a>
-        <div id="userDropdown" class="w3-bar-item w3-button w3-right">
-            <details>
-                <summary><i class="fa fa-user">User</i></summary>
-                <a hx-get="/logout" hx-target="#content" class="w3-bar-item w3-button">Logout</a>
-            </details>
-        </div>
+    <a class="w3-bar-item w3-button w3-hover-black" href="/">
+        <img src="content/images/plexus.svg" alt="Plexus" height="75"></a>
+    <div id="userDropdown" class="w3-bar-item w3-button w3-right">
+        <details>
+            <summary><i class="fa fa-user">User</i></summary>
+            <a hx-get="/logout" hx-target="#main" class="w3-bar-item w3-button">Logout</a>
+        </details>
+    </div>
 </header>
-{{end}}
+{{end}}
\ No newline at end of file
diff --git a/internal/server/html/keys.html b/internal/server/html/keys.html
index 38a7c5e..969bcf0 100644
--- a/internal/server/html/keys.html
+++ b/internal/server/html/keys.html
@@ -1,8 +1,7 @@
 {{define "keys"}}
 <!-- [html-validate-disable no-dup-id]-->
 <!-- [html-validate-disable no-inline-style]-->
-<div id="error" class="w3-red" hx-get="/keys/" hx-trigger="every 1m" 
-    hx-target="#content" hx-target-error="#error"></div>
+</div>
 <div class="w3-bar w3-theme-d5">
     <button class="w3-button" type="button" hx-get="/keys/add" hx-target="#content" hx-target-errors="#error">
         <i class="fa fa-key"></i>
@@ -31,11 +30,11 @@ <h1>Plexus Keys</h1>
 {{end}}
 
 {{define "addKey"}}
-<div id="error" class="w3-red"></div>
 <h1>Create Key</h1>
 <form class="w3-container w3-card4" hx-post="/keys/add" hx-target="#content" hx-target-error="#error">
     <label>Key Name</label>
-    <input class="w3-input" type="text" placeholder="key name (lowercase, chars and -)" name="name" required style="width:50%"><br>
+    <input class="w3-input" type="text" placeholder="key name (lowercase, chars and -)" name="name" required
+        style="width:50%"><br>
     <label>Uses</label>
     <input class="w3-input" type="number" value="1" name="usage" style="width:50%"><br>
     <label>Expires</label>
diff --git a/internal/server/html/layout.html b/internal/server/html/layout.html
index 5531497..c4316c2 100644
--- a/internal/server/html/layout.html
+++ b/internal/server/html/layout.html
@@ -4,18 +4,18 @@
 
 <head>
     <title>Plexus</title>
-    <link rel="icon" href:="/images/icon.svg" type="image/x-icon">
+    <link rel="icon" href:="/content/images/icon.svg" type="image/x-icon">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <link rel="stylesheet" href="https://www.w3schools.com/w3css/4/w3.css" type="text/css">
+    <link rel="stylesheet" href="https://www.w3schools.com/w3css/5/w3.css" type="text/css">
     <link rel="stylesheet" href="https://www.w3schools.com/lib/w3-theme-{{.Theme}}.css">
     <link rel="stylesheet" href="https://fonts.googleapis.com/css?family={{.Font}}">
-    <link rel="stylesheet" href="/assets/css/fontawesome.min.css">
-    <link rel="stylesheet" href="/assets/css/brands.min.css">
-    <link rel="stylesheet" href="/assets/css/solid.min.css">
+    <link rel="stylesheet" href="/content/assets/css/fontawesome.min.css">
+    <link rel="stylesheet" href="/content/assets/css/brands.min.css">
+    <link rel="stylesheet" href="/content/assets/css/solid.min.css">
     <script src="https://unpkg.com/htmx.org@1.9.9"
         integrity="sha384-QFjmbokDn2DjBjq+fM+8LUIVrAgqcNW2s0PjAxHETgRn9l4fvX31ZxDxvwQnyMOX"
         crossorigin="anonymous"></script>
-    <script src="https://unpkg.com/htmx.org/dist/ext/response-targets.js"></script>
+    <script src="https://unpkg.com/htmx.org/dist/ext/response-targets.js"> </script>
     <style>
         body,
         h1,
@@ -50,52 +50,62 @@
             text-align: left;
             padding: 10px, 10px;
         }
+
         .grid6 {
             display: grid;
             grid-template-columns: auto auto auto auto auto auto;
             gap: 10px;
             padding: 10px;
         }
+
         .grid6>div {
             text-align: left;
             padding: 10px, 10px;
         }
+
         .grid5 {
             display: grid;
             grid-template-columns: auto auto auto auto auto;
             gap: 10px;
             padding: 10px;
         }
-        .grid5>div {
+
+        templates .grid5>div {
             text-align: left;
             padding: 10px, 10px;
         }
+
         .grid4 {
             display: grid;
             grid-template-columns: auto auto auto auto;
             gap: 10px;
             padding: 10px;
         }
+
         .grid4>div {
             text-align: left;
             padding: 10px, 10px;
         }
+
         .grid3 {
             display: grid;
             grid-template-columns: auto auto auto;
             gap: 10px;
             padding: 10px;
         }
+
         .grid3>div {
             text-align: left;
             padding: 10px, 10px;
         }
+
         .grid2 {
             display: grid;
             grid-template-columns: auto auto;
             gap: 10px;
             padding: 10px;
         }
+
         .grid2>div {
             text-align: left;
             padding: 10px, 10px;
@@ -103,18 +113,18 @@
     </style>
 </head>
 
-<body class="w3-theme-dark" id="main">
-    <div hx-ext="response-targets">
-        {{if (eq .NeedsLogin true)}}
-        {{template "login"}}
-        {{else}}
-        {{template "header"}}
-        {{template "about" . }}
-        {{template "sidebar" .Networks}}
-        <div id="content" class="w3-container w3-theme-dark w3-padding" style="margin-left:15%; margin-right:15%">
-        </div>
-        {{end}}
+<body class="w3-theme-dark" id="main" hx-ext="response-targets">
+    {{template "header"}}
+    {{template "content" .}}
+    {{template "about" . }}
+    {{template "error"}}
     </div>
+    <script>
+        document.body.addEventListener("showError", function (evt) {
+            document.getElementById('errorMessage').innerHTML = evt.detail.value;
+            document.getElementById('Error').style.display = 'block';
+        });
+    </script>
 </body>
 
 </html>
diff --git a/internal/server/html/login.html b/internal/server/html/login.html
index 843cd1f..7e25645 100644
--- a/internal/server/html/login.html
+++ b/internal/server/html/login.html
@@ -1,10 +1,9 @@
 {{define "login"}}
 <div id="content">
     <div class="w3-container w3-center w3-theme-dark">
-        <div id="error"></div>
         <h1>Login</h1>
         <!-- <form action="/login" method="post"> -->
-        <form action="/" method="post">
+        <form hx-post="/login/" hx-target="#main" hx-target-error="#error">
             <label for="username">Username</label><br>
             <input type="text" placeholder="enter username" name="username" required><br>
             <label for="pass">Password</label><br>
diff --git a/internal/server/html/networks.html b/internal/server/html/networks.html
index d4aa384..c1a9824 100644
--- a/internal/server/html/networks.html
+++ b/internal/server/html/networks.html
@@ -4,11 +4,10 @@
 <!-- [html-validate-disable no-dup-id]-->
 <!-- [html-validate-disable no-inline-style]-->
 <!-- Network Nav Bar-->
-<div id="error" class="w3-red" hx-get="/networks/" hx-trigger="every 1m" 
-    hx-target="#content" hx-target-error="#error"></div>
+<div hx-get="/networks/" hx-trigger="every 1m" hx-target="#content" hx-target-error="#error">
+</div>
 <div class="w3-bar w3-theme-d5">
-    <button class="w3-button" type="button" 
-        hx-get="networks/add" hx-target="#content" hx-target-error="#error">
+    <button class="w3-button" type="button" hx-get="networks/add" hx-target="#content" hx-target-error="#error">
         <i class="fa fa-network-wired"></i>
         Create New Network</button>
 </div>
@@ -20,7 +19,7 @@ <h1>Networks</h1>
     <div class="w3-theme-l3">Delete</div>
     {{range .Data}}
     <div>
-        <button class="w3-button" type="button" hx-get="networks/{{.Name}}" hx-target="#content"
+        <button class="w3-button" type="button" hx-get="networks/details/{{.Name}}" hx-target="#content"
             hx-target-error="#error">
             <i class="fas fa-desktop"></i>
             {{.Name}}</button>
@@ -38,7 +37,6 @@ <h1>Networks</h1>
 {{end}}
 
 {{ define "addNetwork"}}
-<div id="error"></div>
 <h1>Add Network</h1>
 <form class="w3-container w3-card4" hx-post="/networks/add" hx-target="#content" hx-target-error="#error">
     <label>Network Name</label>
@@ -46,7 +44,7 @@ <h1>Add Network</h1>
     <label>Network CIDR</label>
     <input class="w3-input" type="text" value="10.10.10.0/24" name="addressstring" required style="width:50%"><br>
     <p>
-        <button class="w3-button w3-theme-dark w3-padding large" type="button" hx-get="/networks" hx-target="#content">
+        <button class="w3-button w3-theme-dark w3-padding large" type="button" hx-get="/networks/" hx-target="#content">
             Cancel</button>
         <button class="w3-button w3-theme-dark" type="reset">Reset</button>
         <button class="W3-button w3-theme-dark" type="submit">Add</button>
@@ -55,8 +53,7 @@ <h1>Add Network</h1>
 {{end}}
 
 {{define "networkDetails"}}
-<div id="error" class="w3-red" hx-get="/networks/{{.Name}}" hx-trigger="every 1m"
-    hx-target="#content" hx-target-error="#error"></div>
+<div hx-get="/networks/{{.Name}}" hx-trigger="every 1m" hx-target="#content" hx-target-error="#error"></div>
 <div class="w3-container w3-theme-dark w3-padding">
     <!-- Network Details Nav Bar-->
     <div class="w3-bar w3-theme-d5 w3-center">
@@ -81,8 +78,8 @@ <h2>Peers</h2>
         <!-- details -->
         {{range .Peers}}
         <div>
-            <button class="w3-button w3-theme" type="button" hx-get="/networks/peers/{{$network}}/{{.WGPublicKey}}" hx-target="#content"
-                hx-target-error="#error">
+            <button class="w3-button w3-theme" type="button" hx-get="/networks/peers/{{$network}}/{{.WGPublicKey}}"
+                hx-target="#content" hx-target-error="#error">
                 <i class="fa fa-desktop"></i>
                 {{.HostName}}</button><br>
         </div>
@@ -117,13 +114,12 @@ <h2>Peers</h2>
                 hx-target="#content" hx-target-error="#error" hx-confirm="Remove Relay from Network?">
                 <i class="fa fa-trash-alt"></i>
                 Delete Relay</button>
-            </div>
+        </div>
         {{else if eq .IsRelayed true}}
-            <div>Relayed</div>
+        <div>Relayed</div>
         {{else}}
         <div>
-            <button type="button" class="w3-button"
-                hx-get="networks/relay/{{$network}}/{{.WGPublicKey}}"
+            <button type="button" class="w3-button" hx-get="networks/relay/{{$network}}/{{.WGPublicKey}}"
                 hx-target="#content" hx-target-error="#error">
                 <i class="fa fa-share"></i>
                 Create Relay</button>
diff --git a/internal/server/html/peers.html b/internal/server/html/peers.html
index e43e0bd..491a7b1 100644
--- a/internal/server/html/peers.html
+++ b/internal/server/html/peers.html
@@ -1,7 +1,7 @@
 {{define "peers"}}
 <!-- [html-validate-disable no-dup-id]-->
 <!-- [html-validate-disable prefer-tbody]-->
-<div id="error" class="w3-red" hx-get="/peers/" hx-trigger="every 1m" hx-target="#content" hx-target-error="#error">
+<div hx-get="/peers/" hx-trigger="every 1m" hx-target="#content" hx-target-error="#error">
 </div>
 <h1>Peers</h1>
 <div class="grid5">
@@ -27,8 +27,7 @@ <h1>Peers</h1>
 {{end}}
 
 {{define "peerDetails"}}
-<div id="error" class="w3-red" hx-get="/peers/{{.WGPublicKey}}" hx-trigger="every 1m" hx-target="#content"
-    hx-target-error="#error"></div>
+<div hx-get="/peers/{{.WGPublicKey}}" hx-trigger="every 1m" hx-target="#content" hx-target-error="#error"></div>
 <h1>Peer: {{.Name}}</h1>
 <div class="grid2">
     <div class="w3-theme-l1">Wireguard Public Key</div>
@@ -49,7 +48,6 @@ <h1>Peer: {{.Name}}</h1>
 {{end}}
 
 {{define "displayNetworkPeer"}}
-<div id="error" class="w3-red"></div>
 <h1>Network Peer: {{.HostName}}</h1>
 <div class="grid2">
     <div class="w3-theme-l1">Wireguard Public Key</div>
@@ -73,14 +71,14 @@ <h1>Network Peer: {{.HostName}}</h1>
     <div class="w3-theme-l1">Is Subnet Router</div>
     <div>{{.IsSubnetRouter}}</div>
     {{if eq .IsSubnetRouter true}}
-        <div class="w3-theme-l1">Subnet</div>
-        <div>{{.Subnet}}</div>
-        <div class="w3-theme-l1">Use Nat</div>
-        <div>{{.UseNat}}</div>
-        {{if eq .UseVirtSubnet true}}
-            <div class="w3-theme-l3">Virtual Subnet</div>
-            <div>{{.VirtSubnet}}</div>
-        {{end}}
+    <div class="w3-theme-l1">Subnet</div>
+    <div>{{.Subnet}}</div>
+    <div class="w3-theme-l1">Use Nat</div>
+    <div>{{.UseNat}}</div>
+    {{if eq .UseVirtSubnet true}}
+    <div class="w3-theme-l3">Virtual Subnet</div>
+    <div>{{.VirtSubnet}}</div>
+    {{end}}
     {{end}}
     {{if eq .IsSubnetRouter}}
 </div>
diff --git a/internal/server/html/relay.html b/internal/server/html/relay.html
index 885db65..f985aab 100644
--- a/internal/server/html/relay.html
+++ b/internal/server/html/relay.html
@@ -1,5 +1,4 @@
 {{define "addRelayToNetwork"}}
-<div id="error"></div>
 <h2>Network {{.Network}}</h2>
 <h2>Create Relay</h2>
 <h2>Peers to Relay</h2>
@@ -10,8 +9,8 @@ <h2>Peers to Relay</h2>
     <label>{{.HostName}} {{.Address.IP}}</label>
     {{end}}
     <p>
-        <button class="w3-button w3-theme-dark w3-padding large" type="button" 
-            hx-get="/networks/{{.Network}}/" hx-target="#content" hx-target-error="#error">
+        <button class="w3-button w3-theme-dark w3-padding large" type="button" hx-get="/networks/{{.Network}}/"
+            hx-target="#content" hx-target-error="#error">
             Cancel</button>
         <button class="w3-button w3-theme-dark" type="reset">Reset</button>
         <button class="W3-button w3-theme-dark" type="submit">Add</button>
diff --git a/internal/server/html/router.html b/internal/server/html/router.html
index a07119c..1fe898e 100644
--- a/internal/server/html/router.html
+++ b/internal/server/html/router.html
@@ -1,10 +1,9 @@
 {{define "addRouterToNetwork"}}
 <!-- [html-validate-disable no-inline-style]-->
-<div id="error" class="red"></div>
 <h2>Network: {{.Network}}</h2>
 <h2>Create Subnet Router</h2>
-<form class="w3-container w3-card4" hx-post="/networks/router/{{.Network}}/{{.Router}}"
-    hx-target="#content" hx-target-error="#error">
+<form class="w3-container w3-card4" hx-post="/networks/router/{{.Network}}/{{.Router}}" hx-target="#content"
+    hx-target-error="#error">
     <label>Subnet CIDR</label>
     <input class="w3-input" type="text" name="cidr" required style="width:50%"><br>
     <h3>Nat</h3>
@@ -14,14 +13,14 @@ <h3>Nat</h3>
     <input class="w3-radio" type="radio" name="nat" value="nat"
         onclick="document.getElementById('vcidr').disabled=true">
     <label>Masquerade (peer is not default router for subnet)</label><br>
-    <input class="w3-radio" type="radio" name="nat" value="virt" 
+    <input class="w3-radio" type="radio" name="nat" value="virt"
         onclick="document.getElementById('vcidr').disabled=false">
     <label>Use Virtual Subnet (subnet overlaps with another subnet)</label><br>
     <label>Virtual CIDR</label><br>
     <input id="vcidr" class="w3-input" type="text" name="vcidr" disabled style="width:50%">
     <p>
-        <button class="w3-button w3-theme-dark w3-padding large" type="button" 
-            hx-get="/networks/{{.Network}}/" hx-target="#content" hx-target-error="#error">
+        <button class="w3-button w3-theme-dark w3-padding large" type="button" hx-get="/networks/{{.Network}}/"
+            hx-target="#content" hx-target-error="#error">
             Cancel</button>
         <button class="w3-button w3-theme-dark" type="reset">Reset</button>
         <button class="W3-button w3-theme-dark" type="submit">Add</button>
diff --git a/internal/server/html/server.html b/internal/server/html/server.html
index 206875f..2bf4ef9 100644
--- a/internal/server/html/server.html
+++ b/internal/server/html/server.html
@@ -1,14 +1,16 @@
 {{define "server"}}
 <!-- [html-validate-disable no-inline-style]-->
-<div id="error" class="w3-red" hx-get="/server/" hx-trigger="every 10s" hx-target="#content" hx-target-error="#error">
+<div hx-get="/server/" hx-trigger="every 10s" hx-target="#content" hx-target-error="#error">
 </div>
 <h1>Server Logs</h1>
 <p>Current Log Level: {{.LogLevel}}</p>
 <select class="w3-select" style="width: 200px;" name="level">
     <option value="" disabled selected>Select new log level</option>
     <option value="error" hx-post="/server/logs/error" hx-target="#content" hx-target-error="#error">Error</option>
-    <option value="warn" hx-post="/server/logs/warn" hx-target="#content" hx-target-error="#error">Warn</option>
-    <option value="info" hx-post="/server/logs/info" hx-target="#content" hx-target-error="#error">Info</option>
+    <option value="warn" hx-post="/server/logs/warn" hx-target="#content" hx-target-error="#error">
+        Warn</option>
+    <option value="info" hx-post="/server/logs/info" hx-target="#content" hx-target-error="#error">
+        Info</option>
     <option value="debug" hx-post="/server/logs/debug" hx-target="#content" hx-target-error="#error">Debug</option>
 </select>
 {{range .Logs}}
diff --git a/internal/server/html/sidebar.html b/internal/server/html/sidebar.html
index 0c622e7..2aef480 100644
--- a/internal/server/html/sidebar.html
+++ b/internal/server/html/sidebar.html
@@ -9,8 +9,8 @@
             <summary><i class="fa fa-network-wired w3-large"></i>
                 Networks</summary>
             {{range .}}
-            <button type="button" class="w3-bar-item w3-button w3-padding-large w3-theme-dark" hx-get="/networks/{{.}}"
-                hx-target="#content" hx-target-error="#error">
+            <button type="button" class="w3-bar-item w3-button w3-padding-large w3-theme-dark"
+                hx-get="/networks/details/{{.}}" hx-target="#content" hx-target-error="#error">
                 <i class="fa fa-cloud w3-small"></i>
                 {{.}}</button>
             {{end}}
@@ -47,11 +47,11 @@
     <div class="w3-bar w3-black w3-opacity w3-hover-opacity-off w3-center w3-small">
         <a href="/" class="w3-bar-item w3-button" style="width:25% !important">HOME</a>
         <button type="button" class="w3-bar-item w3-button" style="width:25% !important" hx-get="/about"
-            hx-target="#home" hx-swap="outerHTML">ABOUT</button>
+            hx-target="#home">ABOUT</button>
         <button type="button" class="w3-bar-item w3-button" style="width:25% !important" hx-get="/projects"
-            hx-target="#home" hx-swap="outerHTML">PROJECTS</button>
+            hx-target="#home">PROJECTS</button>
         <button type="button" class="w3-bar-item w3-button" style="width:25% !important" hx-get="/contact"
-            hx-target="#home" hx-swap="outerHTML">CONTACT</button>
+            hx-target="#home">CONTACT</button>
     </div>
 </div>
 {{end}}
@@ -62,8 +62,8 @@
     <summary><i class="fa fa-network-wired w3-large"></i>
         Networks</summary>
     {{range .}}
-    <button type="button" class="w3-bar-item w3-button w3-padding-large w3-theme-dark" hx-get="/networks/{{.Name}}"
-        hx-target="#content" hx-target-error="#error">
+    <button type="button" class="w3-bar-item w3-button w3-padding-large w3-theme-dark"
+        hx-get="/networks/details/{{.Name}}" hx-target="#content" hx-target-error="#error">
         <i class="fa fa-cloud w3-small"></i>
         {{.Name}}</button>
     {{end}}
diff --git a/internal/server/html/users.html b/internal/server/html/users.html
index 6ea85c8..fc105aa 100644
--- a/internal/server/html/users.html
+++ b/internal/server/html/users.html
@@ -1,6 +1,6 @@
 {{define "users"}}
 <!-- [html-validate-disable no-dup-id]-->
-<div id="error" class="w3-red" hx-get="/users/" hx-triger="every 1m" hx-target="#content" hx-target-error="#error">
+<div hx-get="/users/" hx-triger="every 1m" hx-target="#content" hx-target-error="#error">
 </div>
 <div class="w3-container w3-center w3-theme-dark w3-padding">
     <div class="w3-bar w3-theme-d5">
@@ -27,7 +27,6 @@ <h1>Authorized Users</h1>
 {{end}}
 
 {{define "editUser"}}
-<div id="error" class="red"></div>
 <div class="w3-row">
     <div class="w3-third"><br></div>
     <div class="w3-third">
@@ -35,7 +34,7 @@ <h1>Edit User</h1>
         <h2>{{.Username}}</h2>
         <form name="editUser" hx-post="/users/user/{{.Username}}" hx-target="#content" onsubmit="return valPass()">
             <label for="password">New Password: </label>
-            <input type="password" placeholder="new password" name="Password" required><br>
+            <input type="password" placeholder="new password" name="password" required><br>
             <label for="verify">Verify Password: </label>
             <input type="password" placeholder="new password" name="verify" required><br><br>
             <button type="button" hx-get="/users/" hx-target="#content">Cancel</button>
@@ -43,7 +42,7 @@ <h2>{{.Username}}</h2>
         </form>
         <script>
             function valPass() {
-                var x = document.forms["editUser"]["Password"].value;
+                var x = document.forms["editUser"]["password"].value;
                 var y = document.forms["editUser"]["verify"].value;
                 console.log(x, y)
                 if (x != y) {
@@ -57,17 +56,16 @@ <h2>{{.Username}}</h2>
 {{end}}
 
 {{define "newUser"}}
-<div id="error" class="w3-red"></div>
 <h1>New User</h1>
 <form name="newUser" hx-post="/users/add" hx-target="#content" hx-target-error="#error" onsubmit="return valPass()">
     <label for="username">Username</label><br>
-    <input type="text" placeholder="enter username" name="Username" required><br>
+    <input type="text" placeholder="enter username" name="username" required><br>
     <label for="pass">Password</label><br>
-    <input type="password" placeholder="enter password" name="Password" required><br>
+    <input type="password" placeholder="enter password" name="password" required><br>
     <label for="verify">Verify Password</label><br>
-    <input type="password" placeholder="enter password" name="Verify" required><br>
+    <input type="password" placeholder="enter password" name="verify" required><br>
     <label for="admin">Admin</label><br>
-    <input type="checkbox" name="Admin"><br>
+    <input type="checkbox" name="admin"><br>
     <p><button class="w3-button" type="button" hx-get="/users/" hx-target="#content">Cancel</button>
         <button class="w3-button w3-theme-dark" type="reset">Reset</button>
         <button class="w3-button w3-theme-dark" type="submit">Create</button>
@@ -75,8 +73,8 @@ <h1>New User</h1>
 </form>
 <script>
     function valPass() {
-        var x = document.forms["newUser"]["Password"].value;
-        var y = document.forms["newUser"]["Verify"].value;
+        var x = document.forms["newUser"]["password"].value;
+        var y = document.forms["newUser"]["verify"].value;
         console.log(x, y)
         if (x != y) {
             alert("password are not the same");
diff --git a/internal/server/keys.go b/internal/server/keys.go
index a6a728c..bf080f5 100644
--- a/internal/server/keys.go
+++ b/internal/server/keys.go
@@ -8,44 +8,57 @@ import (
 	"net/http"
 	"regexp"
 	"slices"
+	"strconv"
 	"time"
 
 	"github.com/devilcove/boltdb"
+	"github.com/devilcove/configuration"
 	"github.com/devilcove/plexus"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
+	"github.com/nats-io/nats-server/v2/server"
 	"github.com/nats-io/nkeys"
 )
 
-func displayCreateKey(c *gin.Context) {
-	session := sessions.Default(c)
-	page := getPage(session.Get("user"))
+func displayCreateKey(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
+		return
+	}
+	page := getPage(session.UserName)
 	page.Page = "addKey"
-	c.HTML(http.StatusOK, "addKey", page)
+	if err := templates.ExecuteTemplate(w, "addKey", page); err != nil {
+		slog.Error("execute template", "template", "addKey", "page", page, "error", err)
+	}
 }
 
-func addKey(c *gin.Context) {
+func addKey(w http.ResponseWriter, r *http.Request) {
 	var err error
-	key := plexus.Key{}
-	if err := c.Bind(&key); err != nil {
-		processError(c, http.StatusBadRequest, "invalid key data")
-		return
+	usage, err := strconv.Atoi(r.FormValue("usage"))
+	if err != nil {
+		usage = 1
+	}
+	key := plexus.Key{
+		Name:    r.FormValue("name"),
+		Usage:   usage,
+		DispExp: r.FormValue("expires"),
 	}
 	key.Expires, err = time.Parse("2006-01-02", key.DispExp)
 	if err != nil {
-		processError(c, http.StatusBadRequest, "invalid key "+err.Error())
+		processError(w, http.StatusBadRequest, "invalid key "+err.Error())
 		return
 	}
 	if err := validateKey(key); err != nil {
-		processError(c, http.StatusBadRequest, "invalid key "+err.Error())
+		processError(w, http.StatusBadRequest, "invalid key "+err.Error())
 		return
 	}
 	key.Value, err = newValue(key.Name)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, "unable to encode key"+err.Error())
+		processError(w, http.StatusInternalServerError, "unable to encode key"+err.Error())
 		return
 	}
-	newDevice <- key.Value
+	if err := addDevice(key.Value); err != nil {
+		processError(w, http.StatusInternalServerError, "unable to add device"+err.Error())
+	}
 	if key.Usage == 0 {
 		key.Usage = 1
 	}
@@ -54,41 +67,43 @@ func addKey(c *gin.Context) {
 	}
 	existing, err := boltdb.Get[plexus.Key](key.Name, keyTable)
 	if err != nil && !errors.Is(err, boltdb.ErrNoResults) {
-		processError(c, http.StatusInternalServerError, "retrieve key"+err.Error())
+		processError(w, http.StatusInternalServerError, "retrieve key"+err.Error())
 		return
 	}
 	if existing.Name != "" {
-		processError(c, http.StatusBadRequest, "key exists with name:"+existing.Name)
+		processError(w, http.StatusBadRequest, "key exists with name:"+existing.Name)
 		return
 	}
 	if err := boltdb.Save(key, key.Name, keyTable); err != nil {
-		processError(c, http.StatusInternalServerError, "saving key "+err.Error())
+		processError(w, http.StatusInternalServerError, "saving key "+err.Error())
 		return
 	}
-	displayKeys(c)
+	displayKeys(w, r)
 }
 
-func displayKeys(c *gin.Context) {
+func displayKeys(w http.ResponseWriter, _ *http.Request) {
 	keys, err := boltdb.GetAll[plexus.Key](keyTable)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	c.HTML(http.StatusOK, keyTable, keys)
+	if err := templates.ExecuteTemplate(w, keyTable, keys); err != nil {
+		slog.Error("execute template", "template", keyTable, "keys", keys, "error", err)
+	}
 }
 
-func deleteKey(c *gin.Context) {
-	keyid := c.Param("id")
+func deleteKey(w http.ResponseWriter, r *http.Request) {
+	keyid := r.PathValue("id")
 	key, err := boltdb.Get[plexus.Key](keyid, keyTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, "key does not exist")
+		processError(w, http.StatusBadRequest, "key does not exist")
 		return
 	}
 	if err := removeKey(key); err != nil {
-		processError(c, http.StatusInternalServerError, "delete key "+err.Error())
+		processError(w, http.StatusInternalServerError, "delete key "+err.Error())
 		return
 	}
-	displayKeys(c)
+	displayKeys(w, r)
 }
 
 func validateKey(key plexus.Key) error {
@@ -102,6 +117,11 @@ func validateKey(key plexus.Key) error {
 }
 
 func newValue(name string) (string, error) {
+	config := Configuration{}
+	if err := configuration.Get(&config); err != nil {
+		slog.Error("configuration", "error", err)
+		return "", err
+	}
 	device, err := nkeys.CreateUser()
 	if err != nil {
 		return "", err
@@ -145,7 +165,11 @@ func expireKeys() {
 	}
 	for _, key := range keys {
 		if key.Expires.Before(time.Now()) {
-			slog.Info("key has expired ...deleting", "key", key.Name, "expiry time", key.Expires.Format(time.RFC822))
+			slog.Info(
+				"key has expired ...deleting",
+				"key", key.Name,
+				"expiry time", key.Expires.Format(time.RFC822),
+			)
 			if err := removeKey(key); err != nil {
 				slog.Error("remove key", "error", err)
 			}
@@ -178,3 +202,27 @@ func removeKey(key plexus.Key) error {
 	}
 	return errs
 }
+
+func addDevice(token string) error {
+	slog.Info("new login device", "device", token)
+	keyValue, err := plexus.DecodeToken(token)
+	if err != nil {
+		slog.Error("decode token", "error", err)
+		return err
+	}
+	key, err := nkeys.FromSeed([]byte(keyValue.Seed))
+	if err != nil {
+		slog.Error("seed failure", "error", err)
+		return err
+	}
+	nPubKey, err := key.PublicKey()
+	if err != nil {
+		slog.Error("publickey", "error", err)
+		return err
+	}
+	natsOptions.Nkeys = append(natsOptions.Nkeys, &server.NkeyUser{
+		Nkey:        nPubKey,
+		Permissions: registerPermissions(),
+	})
+	return natServer.ReloadOptions(natsOptions)
+}
diff --git a/internal/server/keys_test.go b/internal/server/keys_test.go
index 2135cfb..1fe58ee 100644
--- a/internal/server/keys_test.go
+++ b/internal/server/keys_test.go
@@ -1,12 +1,11 @@
 package server
 
 import (
-	"bytes"
-	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -20,19 +19,14 @@ func TestDisplayKeys(t *testing.T) {
 		Username: "hello",
 		Password: "world",
 	}
-	err := createTestUser(user)
-	should.BeNil(t, err)
-	cookie, err := testLogin(user)
-	should.BeNil(t, err)
-	should.NotBeNil(t, cookie)
-	req, err := http.NewRequest(http.MethodGet, "/keys/", nil)
-	should.BeNil(t, err)
-	req.AddCookie(cookie)
+	createTestUser(t, user)
+	r := httptest.NewRequest(http.MethodGet, "/keys/", nil)
+	r.AddCookie(testLogin(t, user))
 	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
+	router.ServeHTTP(w, r)
 	should.BeEqual(t, w.Code, http.StatusOK)
 	body, err := io.ReadAll(w.Body)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.ContainSubstring(t, string(body), "<h1>Plexus Keys</h1>")
 }
 
@@ -41,234 +35,191 @@ func TestDisplayAddKey(t *testing.T) {
 		Username: "hello",
 		Password: "world",
 	}
-	err := createTestUser(user)
-	should.BeNil(t, err)
-	cookie, err := testLogin(user)
-	should.BeNil(t, err)
-	req, err := http.NewRequest(http.MethodGet, "/keys/add", nil)
-	should.BeNil(t, err)
+	createTestUser(t, user)
+	cookie := testLogin(t, user)
+
+	req := httptest.NewRequest(http.MethodGet, "/keys/add", nil)
 	req.AddCookie(cookie)
 	w := httptest.NewRecorder()
 	router.ServeHTTP(w, req)
 	should.BeEqual(t, w.Code, http.StatusOK)
 	body, err := io.ReadAll(w.Body)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.ContainSubstring(t, string(body), "<h1>Create Key</h1>")
 }
 
 func TestAddKey(t *testing.T) {
-	t.Skip()
-	err := deleteAllKeys()
-	should.BeNil(t, err)
+	deleteAllKeys(t)
 	user := plexus.User{
 		Username: "hello",
 		Password: "world",
 	}
-	err = createTestUser(user)
-	should.BeNil(t, err)
-	cookie, err := testLogin(user)
-	should.BeNil(t, err)
+	createTestUser(t, user)
+	cookie := testLogin(t, user)
+	setup(t)
+	defer shutdown(t)
+
 	t.Run("emptydata", func(t *testing.T) {
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", nil)
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", nil)
+		r.AddCookie(testLogin(t, user))
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid key")
 	})
 	t.Run("spaceInName", func(t *testing.T) {
-		key := plexus.Key{
-			Name:    "this has spaces",
-			DispExp: time.Now().Format("2006-01-02"),
-		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "this has spaces", "expires", time.Now().Format("2006-01-02"))
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.AddCookie(cookie)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "invalid chars")
 	})
 	t.Run("uppercase", func(t *testing.T) {
-		key := plexus.Key{
-			Name:    "Uppercase",
-			DispExp: time.Now().Format("2006-01-02"),
-		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "Uppercase", "expires", time.Now().Format("2006-01-02"))
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.AddCookie(cookie)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "invalid chars")
 	})
 	t.Run("nameTooLong", func(t *testing.T) {
-		key := plexus.Key{
-			DispExp: time.Now().Format("2006-01-02"),
-		}
+		var tmp strings.Builder
 		for range 256 {
-			key.Name += "A"
+			tmp.WriteString("A")
 		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		name := tmp.String()
+		payload := bodyParams("name", name, "expires", time.Now().Format("2006-01-02"))
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.AddCookie(cookie)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "too long")
 	})
 	t.Run("invalidDate", func(t *testing.T) {
-		key := plexus.Key{
-			Name:    "Uppercase",
-			DispExp: time.Now().Format("2006-01-02 03-04"),
-		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "key", "expires", time.Now().Format("2006-01-02 03-04"))
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.AddCookie(cookie)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "parsing time")
 	})
 	t.Run("zeroDate", func(t *testing.T) {
-		key := plexus.Key{
-			Name:    "zerodate",
-			DispExp: time.Time{}.Format("2006-01-02"),
-		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "key", "expires", time.Time{}.Format("2006-01-02"))
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.AddCookie(cookie)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "<h1>Plexus Keys</h1>")
 		keys, err := boltdb.GetAll[plexus.Key](keyTable)
-		should.BeNil(t, err)
-		should.BeEqual(t, keys[0].Expires.Format("2006-01-02 03-04"), time.Now().Add(24*time.Hour).Format("2006-01-02 03-04"))
+		should.NotBeError(t, err)
+		should.BeEqual(
+			t,
+			keys[0].Expires.Format("2006-01-02 03-04"),
+			time.Now().Add(24*time.Hour).Format("2006-01-02 03-04"),
+		)
 	})
 	t.Run("valid", func(t *testing.T) {
-		key := plexus.Key{
-			Name:    "valid",
-			DispExp: time.Now().Format("2006-01-02"),
-		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "valid", "expires",
+			time.Now().Format("2006-01-02"), "usage", "0")
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.AddCookie(cookie)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "<h1>Plexus Keys</h1>")
 	})
 	t.Run("duplicate", func(t *testing.T) {
-		key := plexus.Key{
-			Name:    "valid",
-			DispExp: time.Now().Format("2006-01-02"),
-		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "valid", "expires", time.Now().Format("2006-01-02"))
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(cookie)
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "key exists")
 	})
-	err = deleteAllKeys()
-	should.BeNil(t, err)
+	deleteAllKeys(t)
 }
 
 func TestDeleteKeys(t *testing.T) {
-	t.Skip()
+	setup(t)
+	defer shutdown(t)
+
 	user := plexus.User{
 		Username: "hello",
 		Password: "world",
 	}
-	err := createTestUser(user)
-	should.BeNil(t, err)
-	cookie, err := testLogin(user)
-	should.BeNil(t, err)
+	createTestUser(t, user)
+	cookie := testLogin(t, user)
+
 	t.Run("nosuchkey", func(t *testing.T) {
-		req, err := http.NewRequest(http.MethodDelete, "/keys/network", nil)
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
+		r := httptest.NewRequest(http.MethodDelete, "/keys/network", nil)
+		r.AddCookie(cookie)
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "key does not exist")
 	})
 	t.Run("existingKey", func(t *testing.T) {
-		key := plexus.Key{
-			Name:    "valid",
-			DispExp: time.Now().Format("2006-01-02"),
-		}
-		payload, err := json.Marshal(&key)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/keys/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		req.Header.Set("Content-Type", "application/json")
+		// create key
+		payload := bodyParams("name", "valid", "expires",
+			time.Now().Format("2006-01-02"), "usage", "0")
+		r := httptest.NewRequest(http.MethodPost, "/keys/add", payload)
+		r.AddCookie(cookie)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "<h1>Plexus Keys</h1>")
-		req, err = http.NewRequest(http.MethodDelete, "/keys/valid", nil)
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
-		router.ServeHTTP(w, req)
+		// delete key
+		r = httptest.NewRequest(http.MethodDelete, "/keys/valid", nil)
+		r.AddCookie(cookie)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err = io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "<h1>Plexus Keys</h1>")
 	})
-	err = deleteAllKeys()
-	should.BeNil(t, err)
+	deleteAllKeys(t)
 }
 
 func TestUpdateKey(t *testing.T) {
-	t.Skip()
+	setup(t)
+	defer shutdown(t)
 	value, err := newValue("one")
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	key1 := plexus.Key{
 		Name:  "one",
 		Usage: 1,
@@ -279,9 +230,9 @@ func TestUpdateKey(t *testing.T) {
 		Usage: 10,
 	}
 	err = boltdb.Save(key1, key1.Name, keyTable)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	err = boltdb.Save(key2, key2.Name, keyTable)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	t.Run("keyDoesNotExist", func(t *testing.T) {
 		err := decrementKeyUsage("doesnotexist")
 		should.NotBeNil(t, err)
@@ -289,29 +240,32 @@ func TestUpdateKey(t *testing.T) {
 	})
 	t.Run("deleteKey", func(t *testing.T) {
 		err := decrementKeyUsage(key1.Name)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		newKey, err := boltdb.Get[plexus.Key](key1.Name, keyTable)
 		should.BeEqual(t, newKey, plexus.Key{})
 		should.BeTrue(t, errors.Is(err, boltdb.ErrNoResults))
 	})
 	t.Run("decrement usage", func(t *testing.T) {
 		err := decrementKeyUsage(key2.Name)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 	})
-	err = deleteAllKeys()
-	should.BeNil(t, err)
+	deleteAllKeys(t)
 }
 
-func deleteAllKeys() error {
-	var errs error
-	keys, err := boltdb.GetAll[plexus.Key](keyTable)
-	if err != nil {
-		return err
-	}
-	for _, key := range keys {
-		if err := boltdb.Delete[plexus.Key](key.Name, keyTable); err != nil {
-			errs = errors.Join(errs, err)
-		}
+func TestExpireKeys(t *testing.T) {
+	setup(t)
+	defer shutdown(t)
+	key := plexus.Key{
+		Name:    "testkey",
+		Expires: time.Now().Add(-1 * time.Hour),
 	}
-	return errs
+	err := boltdb.Save(key, key.Name, keyTable)
+	should.NotBeError(t, err)
+	keys, err := boltdb.GetAll[plexus.Key](keyTable)
+	should.NotBeError(t, err)
+	should.BeEqual(t, len(keys), 1)
+	expireKeys()
+	keys, err = boltdb.GetAll[plexus.Key](keyTable)
+	should.NotBeError(t, err)
+	should.BeEqual(t, len(keys), 0)
 }
diff --git a/internal/server/nathandlers.go b/internal/server/nathandlers.go
index c7eaf5a..09897d4 100644
--- a/internal/server/nathandlers.go
+++ b/internal/server/nathandlers.go
@@ -61,7 +61,10 @@ func addNKeyUser(peer plexus.Peer) error {
 	return nil
 }
 
-func addPeerToNetwork(peerID, network string, listenPort, publicListenPort int) (plexus.Network, error) {
+func addPeerToNetwork(
+	peerID, network string,
+	listenPort, publicListenPort int,
+) (plexus.Network, error) {
 	netToUpdate, err := boltdb.Get[plexus.Network](network, networkTable)
 	if err != nil {
 		return netToUpdate, err
@@ -85,7 +88,12 @@ func addPeerToNetwork(peerID, network string, listenPort, publicListenPort int)
 	}
 	addr, err := getNextIP(netToUpdate)
 	if err != nil {
-		return netToUpdate, fmt.Errorf("unable to get ip for peer %s %s %w", peer.WGPublicKey, network, err)
+		return netToUpdate, fmt.Errorf(
+			"unable to get ip for peer %s %s %w",
+			peer.WGPublicKey,
+			network,
+			err,
+		)
 	}
 	slog.Debug("setting ip to", "ip", addr)
 	netPeer.Address = net.IPNet{
@@ -156,7 +164,12 @@ func processCheckin(data *plexus.CheckinData) plexus.MessageResponse {
 		peer.Version = data.Version
 	}
 	if !peer.Endpoint.Equal(data.Endpoint) {
-		slog.Debug("endpoint changed", "peer", peer.Name, "old", peer.Endpoint, "new", data.Endpoint)
+		slog.Debug(
+			"endpoint changed",
+			"peer", peer.Name,
+			"old", peer.Endpoint,
+			"new", data.Endpoint,
+		)
 		peer.Endpoint = data.Endpoint
 		publishUpdate = true
 	}
@@ -266,7 +279,11 @@ func processLeave(id string, request *plexus.LeaveRequest) plexus.MessageRespons
 			Action: plexus.DeletePeer,
 			Peer:   peer,
 		}
-		slog.Debug("publishing network update for peer leaving network", "network", request.Network, "peer", id)
+		slog.Debug(
+			"publishing network update for peer leaving network",
+			"network", request.Network,
+			"peer", id,
+		)
 		publish.Message(natsConn, plexus.Networks+request.Network, update)
 	}
 	if !found {
@@ -413,7 +430,11 @@ func processPortUpdate(id string, ports *plexus.ListenPortResponse) {
 					Action: plexus.UpdatePeer,
 					Peer:   peer,
 				}
-				slog.Debug("publish network update for port change", "network", network.Name, "peer", peer.HostName)
+				slog.Debug(
+					"publish network update for port change",
+					"network", network.Name,
+					"peer", peer.HostName,
+				)
 				publish.Message(natsConn, plexus.Networks+network.Name, data)
 			}
 		}
diff --git a/internal/server/nathandlers_test.go b/internal/server/nathandlers_test.go
index 3e21985..8f6cf45 100644
--- a/internal/server/nathandlers_test.go
+++ b/internal/server/nathandlers_test.go
@@ -11,7 +11,7 @@ import (
 
 func TestGetNextIP(t *testing.T) {
 	_, cidr, err := net.ParseCIDR("192.168.0.10/24")
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	network := plexus.Network{
 		Net: *cidr,
 	}
@@ -37,7 +37,7 @@ func TestGetNextIP(t *testing.T) {
 	}
 	network.Peers = peers
 	ip, err := getNextIP(network)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.BeEqual(t, iplib.CompareIPs(ip, net.ParseIP("192.168.0.3")), 0)
 	t.Log(ip)
 }
diff --git a/internal/server/network_test.go b/internal/server/network_test.go
index 76d0036..1518d39 100644
--- a/internal/server/network_test.go
+++ b/internal/server/network_test.go
@@ -1,17 +1,13 @@
 package server
 
 import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/Kairum-Labs/should"
-	"github.com/devilcove/boltdb"
 	"github.com/devilcove/plexus"
 )
 
@@ -20,18 +16,15 @@ func TestDisplayAddNetwork(t *testing.T) {
 		Username: "hello",
 		Password: "world",
 	}
-	err := createTestUser(user)
-	should.BeNil(t, err)
-	cookie, err := testLogin(user)
-	should.BeNil(t, err)
-	req, err := http.NewRequest(http.MethodGet, "/networks/add", nil)
-	should.BeNil(t, err)
+	createTestUser(t, user)
+	cookie := testLogin(t, user)
+	req := httptest.NewRequest(http.MethodGet, "/networks/add", nil)
 	req.AddCookie(cookie)
 	w := httptest.NewRecorder()
 	router.ServeHTTP(w, req)
 	should.BeEqual(t, w.Code, http.StatusOK)
 	body, err := io.ReadAll(w.Body)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.ContainSubstring(t, string(body), "<h1>Add Network</h1>")
 }
 
@@ -40,261 +33,200 @@ func TestAddNetwork(t *testing.T) {
 		Username: "hello",
 		Password: "world",
 	}
-	err := createTestUser(user)
-	should.BeNil(t, err)
-	cookie, err := testLogin(user)
-	should.BeNil(t, err)
+	createTestUser(t, user)
+	cookie := testLogin(t, user)
 	t.Run("emptydata", func(t *testing.T) {
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", nil)
-		should.BeNil(t, err)
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", nil)
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request:")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid address")
 	})
 	t.Run("spacesNetworkName", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "this has spaces",
-			AddressString: "10.10.10.0/24",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "this has spaces", "addressstring", "10.10.10.0/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request: invalid network name")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid network name")
 	})
 	t.Run("upperCase", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "UpperCase",
-			AddressString: "10.10.10.0/24",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "UpperCase", "addressstring", "10.10.10.0/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request: invalid network name")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid network name")
 	})
 	t.Run("nameTooLong", func(t *testing.T) {
-		network := plexus.Network{
-			AddressString: "10.10.10.0/24",
-		}
+		var name strings.Builder
+		name.WriteString("A")
 		for range 300 {
-			network.Name += "A"
+			name.WriteString("A")
 		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", name.String(), "addressstring", "10.10.10.0/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request: invalid network name")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid network name")
 	})
 	t.Run("invalidCIDR", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "cidr",
-			AddressString: "10.10.10.0",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "cidr", "addressstring", "10.10.10.0")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request: invalid address for network")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid address for network")
 	})
 	t.Run("normalizeCidr", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "normalcidr",
-			AddressString: "10.10.20.100/24",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "normalcidr", "addressstring", "10.10.20.100/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "<div id=\"error\" class=\"w3-red\"")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<div class=\"w3-margin-top\">10.10.20.0/24")
 	})
 
 	t.Run("duplicateCidr", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "duplicatecidr",
-			AddressString: "10.10.20.100/24",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "duplicatecidr", "addressstring", "10.10.20.100/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "network CIDR in use")
 	})
 	t.Run("addressNotPrivate", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "notprivate",
-			AddressString: "8.8.8.0/24",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "notprivate", "addressstring", "8.8.8.0/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request: network address is not private")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "network address is not private")
 	})
 	t.Run("valid", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "valid",
-			AddressString: "10.10.10.0/24",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "valid", "addressstring", "10.10.10.0/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "<div id=\"error\" class=\"w3-red\"")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<div class=\"w3-margin-top\">10.10.10.0/24")
 	})
 	t.Run("duplicateName", func(t *testing.T) {
-		network := plexus.Network{
-			Name:          "valid",
-			AddressString: "10.10.10.0/24",
-		}
-		payload, err := json.Marshal(&network)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-		should.BeNil(t, err)
-		req.Header.Set("Content-Type", "application/json")
+		payload := bodyParams("name", "valid", "addressstring", "10.10.10.0/24")
+		req := httptest.NewRequest(http.MethodPost, "/networks/add", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "Error Processing Request: network name exists")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "network name exists")
 	})
-	err = deleteAllNetworks()
-	should.BeNil(t, err)
+	deleteAllNetworks(t)
+}
+
+func TestDisplayNetworkDetails(t *testing.T) {
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
+	}
+	createTestUser(t, user)
+	createTestNetwork(t)
+	createTestNetworkPeer(t)
+
+	r := httptest.NewRequest(http.MethodGet, "/networks/details/valid", nil)
+	r.AddCookie(testLogin(t, user))
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, r)
+	should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	body, err := io.ReadAll(w.Body)
+	should.NotBeError(t, err)
+	should.ContainSubstring(t, string(body), "Network: valid")
+	deleteAllNetworks(t)
 }
 
 func TestDeleteNetwork(t *testing.T) {
-	t.Skip()
+	setup(t)
+	defer shutdown(t)
 	user := plexus.User{
 		Username: "hello",
 		Password: "world",
 	}
-	err := createTestUser(user)
-	should.BeNil(t, err)
-	cookie, err := testLogin(user)
-	should.BeNil(t, err)
+	createTestUser(t, user)
+	cookie := testLogin(t, user)
 	t.Run("nosuchnetwork", func(t *testing.T) {
-		req, err := http.NewRequest(http.MethodDelete, "/networks/network", nil)
-		should.BeNil(t, err)
-		req.AddCookie(cookie)
+		r := httptest.NewRequest(http.MethodDelete, "/networks/network", nil)
+		r.AddCookie(cookie)
 		w := httptest.NewRecorder()
-		router.ServeHTTP(w, req)
+		router.ServeHTTP(w, r)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "network does not exist")
 	})
 	t.Run("existingNetwork", func(t *testing.T) {
-		err := createTestNetwork(cookie)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodDelete, "/networks/valid", nil)
-		should.BeNil(t, err)
+		createTestNetwork(t)
+		req := httptest.NewRequest(http.MethodDelete, "/networks/valid", nil)
 		req.AddCookie(cookie)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
-		should.ContainSubstring(t, string(body), "<div id=\"error\" class=\"w3-red\"")
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Networks")
 	})
-	err = deleteAllNetworks()
-	should.BeNil(t, err)
-}
-
-func deleteAllNetworks() error {
-	var errs error
-	nets, err := boltdb.GetAll[plexus.Network](networkTable)
-	if err != nil {
-		return err
-	}
-	for _, net := range nets {
-		if err := boltdb.Delete[plexus.Network](net.Name, networkTable); err != nil {
-			errs = errors.Join(errs, err)
-		}
-	}
-	return errs
+	deleteAllNetworks(t)
 }
 
-func createTestNetwork(cookie *http.Cookie) error {
-	network := plexus.Network{
-		Name:          "valid",
-		AddressString: "10.10.10.0/24",
-	}
-	payload, err := json.Marshal(&network)
-	if err != nil {
-		return err
-	}
-	req, err := http.NewRequest(http.MethodPost, "/networks/add", bytes.NewBuffer(payload))
-	if err != nil {
-		return err
+func TestNetworkSideBar(t *testing.T) {
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
 	}
-	req.Header.Set("Content-Type", "application/json")
-	req.AddCookie(cookie)
+	createTestUser(t, user)
+	r := httptest.NewRequest(http.MethodGet, "/sidebar/", nil)
+	r.AddCookie(testLogin(t, user))
 	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-	if w.Result().StatusCode != http.StatusOK {
-		return fmt.Errorf("bad status response: %s", w.Result().Status)
-	}
-	return nil
+	router.ServeHTTP(w, r)
+	should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	body, err := io.ReadAll(w.Result().Body)
+	should.NotBeError(t, err)
+	should.ContainSubstring(t, string(body), "Networks")
 }
diff --git a/internal/server/networks.go b/internal/server/networks.go
index b95a158..9f44bfd 100644
--- a/internal/server/networks.go
+++ b/internal/server/networks.go
@@ -13,29 +13,35 @@ import (
 	"github.com/devilcove/boltdb"
 	"github.com/devilcove/plexus"
 	"github.com/devilcove/plexus/internal/publish"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
 )
 
-func displayAddNetwork(c *gin.Context) {
-	session := sessions.Default(c)
-	page := getPage(session.Get("user"))
+func displayAddNetwork(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
+		return
+	}
+	page := getPage(session.UserName)
 	page.Page = "addNetwork"
-	_ = session.Save()
-	c.HTML(http.StatusOK, "addNetwork", page)
+
+	if err := session.Session.Save(r, w); err != nil {
+		slog.Error("session save", "error", err)
+	}
+	if err := templates.ExecuteTemplate(w, "addNetwork", page); err != nil {
+		slog.Error("template", "name", "addnetwork", "error", err)
+	}
 }
 
-func addNetwork(c *gin.Context) {
+func addNetwork(w http.ResponseWriter, r *http.Request) {
 	var errs error
-	network := plexus.Network{}
-	if err := c.Bind(&network); err != nil {
-		processError(c, http.StatusBadRequest, "invalid network data")
-		return
+	network := plexus.Network{
+		Name:          r.FormValue("name"),
+		AddressString: r.FormValue("addressstring"),
 	}
 	_, cidr, err := net.ParseCIDR(network.AddressString)
 	if err != nil {
 		log.Println("net.ParseCIDR", network.AddressString)
-		processError(c, http.StatusBadRequest, "invalid address for network")
+		processError(w, http.StatusBadRequest, "invalid address for network")
 		return
 	}
 	network.Net = *cidr
@@ -47,54 +53,62 @@ func addNetwork(c *gin.Context) {
 		errs = errors.Join(errs, errors.New("network address is not private"))
 	}
 	if errs != nil {
-		processError(c, http.StatusBadRequest, errs.Error())
+		processError(w, http.StatusBadRequest, errs.Error())
 		return
 	}
 	networks, err := boltdb.GetAll[plexus.Network](networkTable)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, "database error "+err.Error())
+		processError(w, http.StatusInternalServerError, "database error "+err.Error())
 		return
 	}
 	for _, net := range networks {
 		if net.Name == network.Name {
-			processError(c, http.StatusBadRequest, "network name exists")
+			processError(w, http.StatusBadRequest, "network name exists")
 			return
 		}
 		if net.Net.IP.Equal(network.Net.IP) {
-			processError(c, http.StatusBadRequest, "network CIDR in use by "+net.Name)
+			processError(w, http.StatusBadRequest, "network CIDR in use by "+net.Name)
 			return
 		}
 	}
-	slog.Info("network validation complete ... saving", "network", network)
+	slog.Debug("network validation complete ... saving", "network", network)
 	if err := boltdb.Save(network, network.Name, networkTable); err != nil {
-		processError(c, http.StatusInternalServerError, "unable to save network "+err.Error())
+		processError(w, http.StatusInternalServerError, "unable to save network "+err.Error())
 		return
 	}
-	displayNetworks(c)
+	displayNetworks(w, r)
 }
 
-func displayNetworks(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user")
-	page := getPage(user)
+func displayNetworks(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
+		return
+	}
+	page := getPage(session.UserName)
 	networks, err := boltdb.GetAll[plexus.Network](networkTable)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	page.Data = networks
-	_ = session.Save()
-	c.Header("HX-Trigger", "networkChange")
-	c.HTML(http.StatusOK, "networks", page)
+
+	session.Save(w, r)
+	w.Header().Add("Hx-Trigger", "networkChange")
+	if err := templates.ExecuteTemplate(w, "networks", page); err != nil {
+		slog.Error("template", "name", "networks", "page", page, "error", err)
+	}
 }
 
-func networksSideBar(c *gin.Context) {
+func networksSideBar(w http.ResponseWriter, _ *http.Request) {
 	networks, err := boltdb.GetAll[plexus.Network](networkTable)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	c.HTML(http.StatusOK, "sidebarNetworks", networks)
+	if err := templates.ExecuteTemplate(w, "sidebarNetworks", networks); err != nil {
+		slog.Error("sidebar", "networks", networks, "error", err)
+	}
 }
 
 func getAvailablePeers(network plexus.Network) []plexus.Peer {
@@ -117,71 +131,97 @@ func getAvailablePeers(network plexus.Network) []plexus.Peer {
 	return peers
 }
 
-func networkAddPeer(c *gin.Context) {
-	network := c.Param("id")
-	peerID := c.Param("peer")
+func networkAddPeer(w http.ResponseWriter, r *http.Request) {
+	network := r.PathValue("id")
+	peerID := r.PathValue("peer")
 	slog.Debug("adding peer to network", "peer", peerID, "network", network)
 	priv, pub, err := getListenPorts(peerID, network)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	if _, err := addPeerToNetwork(peerID, network, priv, pub); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	networkDetails(c)
+	networkDetails(w, r)
 }
 
-func networkDetails(c *gin.Context) {
-	session := sessions.Default(c)
+func networkDetails(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
+		return
+	}
 	details := struct {
 		Name           string
 		Peers          []plexus.NetworkPeer
 		AvailablePeers []plexus.Peer
 	}{}
-	networkName := c.Param("id")
+	networkName := r.PathValue("id")
 	network, err := boltdb.Get[plexus.Network](networkName, networkTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	for _, peer := range network.Peers {
 		p, err := boltdb.Get[plexus.Peer](peer.WGPublicKey, peerTable)
 		if err != nil {
-			slog.Error("could not obtains peer for network details", "peer", peer.WGPublicKey, "network", network, "error", err)
+			slog.Error(
+				"could not obtains peer for network details",
+				"peer", peer.WGPublicKey,
+				"network", network,
+				"error", err,
+			)
 			continue
 		}
 		slog.Debug("network details", "peer", peer.HostName, "connected",
 			time.Since(p.Updated) < time.Second*10, "connectivity", peer.Connectivity)
 		details.Peers = append(details.Peers, peer)
-		slog.Debug("connectivity", "network", network.Name, "peer", peer.HostName, "connectivity", peer.Connectivity)
+		slog.Debug(
+			"connectivity",
+			"network", network.Name,
+			"peer", peer.HostName,
+			"connectivity", peer.Connectivity,
+		)
 	}
 	details.Name = networkName
 	details.AvailablePeers = getAvailablePeers(network)
-	_ = session.Save()
-	c.HTML(http.StatusOK, "networkDetails", details)
+	if err := session.Session.Save(r, w); err != nil {
+		slog.Error("session save", "error", err)
+	}
+	if err := templates.ExecuteTemplate(w, "networkDetails", details); err != nil {
+		slog.Error("template", "template", "networkDetails", "details", details, "error", err)
+	}
 }
 
-func deleteNetwork(c *gin.Context) {
-	network := c.Param("id")
+func deleteNetwork(w http.ResponseWriter, r *http.Request) {
+	network := r.PathValue("id")
 	if err := boltdb.Delete[plexus.Network](network, networkTable); err != nil {
 		if errors.Is(err, boltdb.ErrNoResults) {
-			processError(c, http.StatusBadRequest, "network does not exist")
+			processError(w, http.StatusBadRequest, "network does not exist")
 			return
 		}
-		processError(c, http.StatusInternalServerError, "delete network "+err.Error())
+		processError(w, http.StatusInternalServerError, "delete network "+err.Error())
 		return
 	}
 	log.Println("deleting network", network)
 	if natsConn == nil {
 		slog.Error("not connected to nats")
-		processError(c, http.StatusInternalServerError, "nats failure:  network update not published")
+		processError(
+			w,
+			http.StatusInternalServerError,
+			"nats failure:  network update not published",
+		)
 		return
 	}
 	slog.Debug("publish network update", "network", network, "reason", "delete network")
-	publish.Message(natsConn, plexus.Networks+network, plexus.NetworkUpdate{Action: plexus.DeleteNetwork})
-	displayNetworks(c)
+	publish.Message(
+		natsConn,
+		plexus.Networks+network,
+		plexus.NetworkUpdate{Action: plexus.DeleteNetwork},
+	)
+	displayNetworks(w, r)
 }
 
 func validateNetworkName(name string) bool {
@@ -196,12 +236,12 @@ func validateNetworkAddress(address net.IPNet) bool {
 	return address.IP.IsPrivate()
 }
 
-func removePeerFromNetwork(c *gin.Context) {
-	netName := c.Param("id")
-	peerid := c.Param("peer")
+func removePeerFromNetwork(w http.ResponseWriter, r *http.Request) {
+	netName := r.PathValue("id")
+	peerid := r.PathValue("peer")
 	network, err := boltdb.Get[plexus.Network](netName, networkTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, "invalid network"+err.Error())
+		processError(w, http.StatusBadRequest, "invalid network"+err.Error())
 		return
 	}
 	found := false
@@ -212,7 +252,7 @@ func removePeerFromNetwork(c *gin.Context) {
 			network.Peers = slices.Delete(network.Peers, i, i+1)
 			if err := boltdb.Save(network, network.Name, networkTable); err != nil {
 				slog.Error("save network after peer deletion", "error", err)
-				processError(c, http.StatusInternalServerError, err.Error())
+				processError(w, http.StatusInternalServerError, err.Error())
 				return
 			}
 			update := plexus.NetworkUpdate{
@@ -225,10 +265,10 @@ func removePeerFromNetwork(c *gin.Context) {
 		}
 	}
 	if !found {
-		processError(c, http.StatusBadRequest, "invalid peer")
+		processError(w, http.StatusBadRequest, "invalid peer")
 		return
 	}
-	networkDetails(c)
+	networkDetails(w, r)
 }
 
 func getNetworksForPeer(id string) ([]plexus.Network, error) {
@@ -247,126 +287,27 @@ func getNetworksForPeer(id string) ([]plexus.Network, error) {
 	return response, nil
 }
 
-func displayAddRelay(c *gin.Context) {
-	data := struct {
-		Network        string
-		Relay          plexus.NetworkPeer
-		AvailablePeers []plexus.NetworkPeer
-	}{}
-	data.Network = c.Param("id")
-	relay := c.Param("peer")
-	slog.Debug("add relay", "network", data.Network, "relay", relay)
-	network, err := boltdb.Get[plexus.Network](data.Network, networkTable)
-	if err != nil {
-		processError(c, http.StatusBadGateway, err.Error())
-		return
-	}
-	for _, peer := range network.Peers {
-		if peer.WGPublicKey == relay {
-			data.Relay = peer
-			continue
-		}
-		if peer.IsRelay || peer.IsRelayed || peer.IsSubnetRouter {
-			continue
-		}
-		data.AvailablePeers = append(data.AvailablePeers, peer)
-	}
-	c.HTML(http.StatusOK, "addRelayToNetwork", data)
-}
-
-func addRelay(c *gin.Context) {
-	netID := c.Param("id")
-	relayID := c.Param("peer")
-	relayedIDs := c.PostFormArray("relayed")
-	network, err := boltdb.Get[plexus.Network](netID, networkTable)
-	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
-		return
-	}
-	update := plexus.NetworkUpdate{
-		Action: plexus.AddRelay,
-	}
-	peers := []plexus.NetworkPeer{}
-	for _, peer := range network.Peers {
-		if peer.WGPublicKey == relayID {
-			peer.IsRelay = true
-			peer.RelayedPeers = relayedIDs
-			update.Peer = peer
-		}
-		if slices.Contains(relayedIDs, peer.WGPublicKey) {
-			peer.IsRelayed = true
-		}
-		peers = append(peers, peer)
-	}
-	network.Peers = peers
-	if err := boltdb.Save(network, network.Name, networkTable); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
-		return
-	}
-	slog.Debug("publish network update - add relay", "network", network.Name, "relay", relayID)
-	publish.Message(natsConn, "networks."+network.Name, update)
-	networkDetails(c)
-}
-
-func deleteRelay(c *gin.Context) {
-	netName := c.Param("id")
-	peerID := c.Param("peer")
-	slog.Info("delete relay", "network", netName, "relay", peerID)
+func networkPeerDetails(w http.ResponseWriter, r *http.Request) {
+	netName := r.PathValue("id")
+	peerID := r.PathValue("peer")
 	network, err := boltdb.Get[plexus.Network](netName, networkTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
-		return
-	}
-	update := plexus.NetworkUpdate{
-		Action: plexus.DeleteRelay,
-	}
-	peersToUnrelay := []string{}
-	updatedPeers := []plexus.NetworkPeer{}
-	for _, peer := range network.Peers {
-		if peer.WGPublicKey == peerID {
-			// send the original peer to agents which will include the list of peers to unrelay
-			update.Peer = peer
-			peer.IsRelay = false
-			peersToUnrelay = peer.RelayedPeers
-			peer.RelayedPeers = []string{}
-			updatedPeers = append(updatedPeers, peer)
-			break
-		}
-	}
-	for _, peer := range network.Peers {
-		if peer.WGPublicKey == peerID {
-			// already added above.
-			continue
-		}
-		if slices.Contains(peersToUnrelay, peer.WGPublicKey) {
-			peer.IsRelayed = false
-		}
-		updatedPeers = append(updatedPeers, peer)
-	}
-	network.Peers = updatedPeers
-	if err := boltdb.Save(network, network.Name, networkTable); err != nil {
-		processError(c, http.StatusBadRequest, "failed to save update network peers "+err.Error())
-		return
-	}
-	slog.Debug("publish network update", "network", network.Name, "peer", update.Peer.HostName, "reason", "delete relay")
-	publish.Message(natsConn, plexus.Networks+network.Name, update)
-	networkDetails(c)
-}
-
-func networkPeerDetails(c *gin.Context) {
-	netName := c.Param("id")
-	peerID := c.Param("peer")
-	network, err := boltdb.Get[plexus.Network](netName, networkTable)
-	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	for _, peer := range network.Peers {
 		if peer.WGPublicKey == peerID {
 			peer.Connectivity *= 100
-			c.HTML(http.StatusOK, "displayNetworkPeer", peer)
+			if err := templates.ExecuteTemplate(w, "displayNetworkPeer", peer); err != nil {
+				slog.Error(
+					"template execute",
+					"template", "displayNetworkPeer",
+					"peer", peer,
+					"error", err,
+				)
+			}
 			return
 		}
 	}
-	processError(c, http.StatusBadRequest, "peer not found")
+	processError(w, http.StatusBadRequest, "peer not found")
 }
diff --git a/internal/server/page.go b/internal/server/page.go
index 42eaad5..22b6c4f 100644
--- a/internal/server/page.go
+++ b/internal/server/page.go
@@ -7,8 +7,6 @@ import (
 
 	"github.com/devilcove/boltdb"
 	"github.com/devilcove/plexus"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -33,51 +31,43 @@ func init() {
 	pages = make(map[string]Page)
 }
 
-func displayMain(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user")
-	loggedin := session.Get("loggedin")
-	page := getPage(user)
-	if loggedin == nil {
-		page.NeedsLogin = true
+func displayMain(w http.ResponseWriter, r *http.Request) {
+	page := initialize()
+	page.NeedsLogin = true
+	session := GetSession(w, r)
+	if session != nil {
+		networks, err := boltdb.GetAll[plexus.Network](networkTable)
+		if err != nil {
+			slog.Error("get networks for main display", "error", err)
+		}
+		page.Data = networks
+		page.NeedsLogin = !session.LoggedIn
 	}
-	networks, err := boltdb.GetAll[plexus.Network](networkTable)
-	if err != nil {
-		slog.Error("get networks for main display", "error", err)
+	slog.Info("display main page", "session", session, "page", page)
+
+	if err := templates.ExecuteTemplate(w, "layout", page); err != nil {
+		slog.Error("display main", "template", "layout", "page", page, "error", err)
 	}
-	page.Data = networks
-	page.Page = "networks"
-	slog.Debug("display main page", "user", user, "page", page)
-	c.HTML(http.StatusOK, "layout", page)
 }
 
-func login(c *gin.Context) {
-	session := sessions.Default(c)
+func login(w http.ResponseWriter, r *http.Request) {
 	var user plexus.User
-	if err := c.Bind(&user); err != nil {
-		processError(c, http.StatusBadRequest, "invalid user")
-		slog.Error("bind err", "error", err)
-		return
-	}
+	user.Username = r.FormValue("username")
+	user.Password = r.FormValue("password")
+
 	if !validateUser(&user) {
-		session.Clear()
-		_ = session.Save()
-		processError(c, http.StatusBadRequest, "invalid user")
-		slog.Warn("validation error", "user", user.Username)
+		processError(w, http.StatusBadRequest, "invalid user")
 		return
 	}
-	session.Set("loggedin", true)
-	session.Set("user", user.Username)
-	session.Set("admin", user.IsAdmin)
-	session.Set("page", "networks")
-	session.Options(sessions.Options{MaxAge: sessionAge, Secure: false, SameSite: http.SameSiteLaxMode})
-	_ = session.Save()
-	slog.Info("login", "user", user.Username)
-	// page := getPage(user.Username).
-	// page.NeedsLogin = false
-	// page.Page = "networks"
-	displayMain(c)
-	// c.HTML(http.StatusOK, "content", page).
+	NewSession(w, r, user, true, "networks")
+
+	slog.Debug("login", "user", user.Username)
+	page := getPage(user.Username)
+	page.NeedsLogin = false
+	page.Page = "networks"
+	if err := templates.ExecuteTemplate(w, "layout", page); err != nil {
+		slog.Error("execute template", "template", "layout", "page", page, "error", err)
+	}
 }
 
 func validateUser(visitor *plexus.User) bool {
@@ -101,14 +91,12 @@ func checkPassword(plain, hash *plexus.User) bool {
 	return err == nil
 }
 
-func logout(c *gin.Context) {
-	session := sessions.Default(c)
-	user := session.Get("user")
-	slog.Info("logout", "user", user)
-	// delete cookie.
-	session.Clear()
-	_ = session.Save()
-	c.HTML(http.StatusOK, "login", "")
+func logout(w http.ResponseWriter, r *http.Request) {
+	ClearSession(w, r)
+	slog.Debug("logout")
+	// page := initialize()
+	// page.NeedsLogin = true
+	http.Redirect(w, r, "/", http.StatusFound)
 }
 
 func initialize() Page {
@@ -151,3 +139,9 @@ func getPage(user any) Page {
 	pages[user.(string)] = initialize()
 	return pages[user.(string)]
 }
+
+func displayLogin(w http.ResponseWriter, _ *http.Request) {
+	if err := templates.ExecuteTemplate(w, "layout", Page{NeedsLogin: true}); err != nil {
+		slog.Error("display login", "error", err)
+	}
+}
diff --git a/internal/server/page_test.go b/internal/server/page_test.go
index b796af9..4865879 100644
--- a/internal/server/page_test.go
+++ b/internal/server/page_test.go
@@ -1,60 +1,21 @@
 package server
 
 import (
-	"bytes"
-	"encoding/json"
-	"errors"
 	"io"
-	"log"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
-	"os"
-	"strings"
 	"testing"
 
 	"github.com/Kairum-Labs/should"
-	"github.com/devilcove/boltdb"
 	"github.com/devilcove/plexus"
-	"github.com/gin-gonic/gin"
 )
 
-var router *gin.Engine
-
-func TestMain(m *testing.M) {
-	if _, err := os.Stat("./test.db"); err == nil {
-		if err := os.Remove("./test.db"); err != nil {
-			log.Println("remove db", err)
-			os.Exit(1)
-		}
-	}
-	if err := boltdb.Initialize("./test.db",
-		[]string{userTable, keyTable, networkTable, peerTable, settingTable, "keypairs"},
-	); err != nil {
-		log.Println("init db", err)
-		os.Exit(2)
-	}
-	// 	wg := &sync.WaitGroup{}
-	// 	ctx, cancel := context.WithCancel(context.Background())
-	// 	newDevice = make(chan string, 1)
-	// 	wg.Add(1)
-	// 	go broker(ctx, wg, nil)
-	plexus.SetLogging("debug")
-	router = setupRouter()
-	code := m.Run()
-	// 	cancel()
-	// 	wg.Wait()
-	boltdb.Close()
-	os.Exit(code)
-}
-
 func TestDisplayMainPage(t *testing.T) {
-	req, err := http.NewRequest(http.MethodGet, "/", nil)
-	should.BeNil(t, err)
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	w := httptest.NewRecorder()
 	router.ServeHTTP(w, req)
 	body, err := io.ReadAll(w.Body)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.BeEqual(t, w.Code, http.StatusOK)
 	should.ContainSubstring(t, string(body), "<title>Plexus</title>")
 }
@@ -66,77 +27,54 @@ func TestGetPage(t *testing.T) {
 }
 
 func TestLogin(t *testing.T) {
-	err := deleteAllUsers(true)
-	should.BeNil(t, err)
+	deleteAllUsers(t)
 	t.Run("nousers", func(t *testing.T) {
-		form := url.Values{}
-		form.Add("username", "admin")
-		form.Add("password", "testing")
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(form.Encode()))
+		payload := bodyParams("username", "admin", "password", "testing")
+		req := httptest.NewRequest(http.MethodPost, "/login/", payload)
 		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		should.BeNil(t, err)
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "invalid user")
 	})
-	err = createTestUser(plexus.User{
+	createTestUser(t, plexus.User{
 		Username: "testing",
 		Password: "testing",
+		IsAdmin:  true,
 	})
-	should.BeNil(t, err)
 	t.Run("wronguser", func(t *testing.T) {
-		user := plexus.User{
-			Username: "admin",
-			Password: "testing",
-		}
-		payload, err := json.Marshal(&user)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/", bytes.NewBuffer(payload))
-		req.Header.Set("Content-Type", "application/json")
-		should.BeNil(t, err)
+		payload := bodyParams("username", "admin", "password", "testing")
+		req := httptest.NewRequest(http.MethodPost, "/login/", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "invalid user")
 	})
 	t.Run("wrongpass", func(t *testing.T) {
-		user := plexus.User{
-			Username: "testing",
-			Password: "testing2",
-		}
-		payload, err := json.Marshal(&user)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/", bytes.NewBuffer(payload))
-		req.Header.Set("Content-Type", "application/json")
-		should.BeNil(t, err)
+		payload := bodyParams("username", "testing", "password", "testing2")
+		req := httptest.NewRequest(http.MethodPost, "/login/", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusBadRequest)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "invalid user")
 	})
 	t.Run("valid", func(t *testing.T) {
-		user := plexus.User{
-			Username: "testing",
-			Password: "testing",
-		}
-		payload, err := json.Marshal(&user)
-		should.BeNil(t, err)
-		req, err := http.NewRequest(http.MethodPost, "/", bytes.NewBuffer(payload))
-		req.Header.Set("Content-Type", "application/json")
-		should.BeNil(t, err)
+		payload := bodyParams("username", "testing", "password", "testing")
+		req := httptest.NewRequest(http.MethodPost, "/login/", payload)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		should.BeEqual(t, w.Code, http.StatusOK)
 		body, err := io.ReadAll(w.Body)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.ContainSubstring(t, string(body), "<title>Plexus</title>")
 		should.NotBeNil(t, w.Result().Cookies())
 	})
@@ -144,51 +82,8 @@ func TestLogin(t *testing.T) {
 
 func TestLogout(t *testing.T) {
 	w := httptest.NewRecorder()
-	req, err := http.NewRequest(http.MethodGet, "/logout", nil)
-	should.BeNil(t, err)
+	req := httptest.NewRequest(http.MethodGet, "/logout/", nil)
 	router.ServeHTTP(w, req)
-	should.BeEqual(t, w.Code, http.StatusOK)
-	should.BeEqual(t, w.Result().Cookies(), []*http.Cookie{})
-}
-
-func deleteAllUsers(deleteAll bool) (errs error) {
-	users, err := boltdb.GetAll[plexus.User](userTable)
-	if err != nil {
-		return err
-	}
-	for _, user := range users {
-		if user.Username != "admin" || deleteAll == true {
-			if err := boltdb.Delete[plexus.User](user.Username, userTable); err != nil {
-				errs = errors.Join(errs, err)
-			}
-		}
-	}
-	return errs
-}
-
-func testLogin(data plexus.User) (*http.Cookie, error) {
-	w := httptest.NewRecorder()
-	form := url.Values{}
-	form.Add("username", data.Username)
-	form.Add("password", data.Password)
-	req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(form.Encode()))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	router.ServeHTTP(w, req)
-	for _, cookie := range w.Result().Cookies() {
-		if cookie.Name == "plexus" {
-			return cookie, nil
-		}
-	}
-	return nil, errors.New("no cookie")
-}
-
-func createTestUser(user plexus.User) error {
-	user.Password, _ = hashPassword(user.Password)
-	if err := boltdb.Save(&user, user.Username, userTable); err != nil {
-		return err
-	}
-	return nil
+	should.BeEqual(t, w.Code, http.StatusFound)
+	should.BeEqual(t, w.Result().Cookies()[0].MaxAge, -1)
 }
diff --git a/internal/server/peers.go b/internal/server/peers.go
index 91c5edf..88df05c 100644
--- a/internal/server/peers.go
+++ b/internal/server/peers.go
@@ -10,15 +10,14 @@ import (
 	"github.com/devilcove/boltdb"
 	"github.com/devilcove/plexus"
 	"github.com/devilcove/plexus/internal/publish"
-	"github.com/gin-gonic/gin"
 	"github.com/nats-io/nats-server/v2/server"
 )
 
-func displayPeers(c *gin.Context) {
+func displayPeers(w http.ResponseWriter, _ *http.Request) {
 	displayPeers := []plexus.Peer{}
 	peers, err := boltdb.GetAll[plexus.Peer](peerTable)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	// set Status for display
@@ -28,28 +27,32 @@ func displayPeers(c *gin.Context) {
 		}
 		displayPeers = append(displayPeers, peer)
 	}
-	c.HTML(http.StatusOK, peerTable, displayPeers)
+	if err := templates.ExecuteTemplate(w, peerTable, displayPeers); err != nil {
+		slog.Error("template execute", "template", peerTable, "data", displayPeers, "error", err)
+	}
 }
 
-func peerDetails(c *gin.Context) {
-	id := c.Param("id")
+func peerDetails(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
 	peer, err := boltdb.Get[plexus.Peer](id, peerTable)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	c.HTML(http.StatusOK, "peerDetails", peer)
+	if err := templates.ExecuteTemplate(w, "peerDetails", peer); err != nil {
+		slog.Error("template execute", "template", "peerDetails", "data", peer, "error", err)
+	}
 }
 
-func deletePeer(c *gin.Context) {
-	id := c.Param("id")
+func deletePeer(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
 	peer, err := discardPeer(id)
 	if err != nil {
-		processError(c, http.StatusBadRequest, id+" "+err.Error())
+		processError(w, http.StatusBadRequest, id+" "+err.Error())
 		return
 	}
 	deletePeerFromBroker(peer.PubNkey)
-	displayPeers(c)
+	displayPeers(w, r)
 }
 
 func discardPeer(id string) (plexus.Peer, error) {
@@ -71,7 +74,11 @@ func discardPeer(id string) (plexus.Peer, error) {
 					Action: plexus.DeletePeer,
 					Peer:   netpeer,
 				}
-				slog.Info("publishing network update", "type", update.Action, "network", network.Name)
+				slog.Info(
+					"publishing network update",
+					"type", update.Action,
+					"network", network.Name,
+				)
 				publish.Message(natsConn, "networks."+network.Name, update)
 			}
 		}
@@ -165,7 +172,12 @@ func savePeer(peer plexus.Peer) {
 		for i, netPeer := range network.Peers {
 			if netPeer.WGPublicKey == peer.WGPublicKey {
 				network.Peers[i].NatsConnected = peer.NatsConnected
-				slog.Debug("saving network peer", "network", network.Name, "peer", netPeer.HostName, "key", netPeer.WGPublicKey)
+				slog.Debug(
+					"saving network peer",
+					"network", network.Name,
+					"peer", netPeer.HostName,
+					"key", netPeer.WGPublicKey,
+				)
 				if err := boltdb.Save(network, network.Name, networkTable); err != nil {
 					slog.Error("save network", "network", network.Name, "error", err)
 				}
diff --git a/internal/server/peers_test.go b/internal/server/peers_test.go
new file mode 100644
index 0000000..89681fa
--- /dev/null
+++ b/internal/server/peers_test.go
@@ -0,0 +1,190 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/boltdb"
+	"github.com/devilcove/plexus"
+)
+
+func TestDisplayPeers(t *testing.T) {
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
+	}
+	createTestUser(t, user)
+	createTestNetwork(t)
+	setup(t)
+	defer shutdown(t)
+	peerID := createTestNetworkPeer(t)
+
+	t.Run("displayPeers", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/peers/", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+
+	t.Run("peerDetails", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/peers/"+peerID, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Peer: testing")
+	})
+
+	t.Run("peerDelete", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/peers/"+peerID, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		_, err := boltdb.Get[plexus.Peer](peerID, peerTable)
+		should.BeErrorIs(t, err, boltdb.ErrNoResults)
+	})
+}
+
+func TestAddPeerToNetwork(t *testing.T) {
+	deleteAllNetworks(t)
+	deleteAllPeers(t)
+	deleteAllUsers(t)
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
+	}
+	createTestUser(t, user)
+	createTestNetwork(t)
+	setup(t)
+	defer shutdown(t)
+	peerID := createTestPeer(t)
+
+	t.Run("ok", func(t *testing.T) {
+		t.Skip() // changes required to addPeer when not connected
+		r := httptest.NewRequest(http.MethodPost, "/networks/addPeer/valid/"+peerID, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+
+	t.Run("invalidNetwork", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodPost, "/networks/addPeer/invalid/"+peerID, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusInternalServerError)
+	})
+	t.Run("invalidPeer", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodPost, "/networks/addPeer/valid/invalid", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusInternalServerError)
+	})
+}
+
+func TestRemovePeerFromNetwork(t *testing.T) {
+	deleteAllNetworks(t)
+	deleteAllPeers(t)
+	deleteAllUsers(t)
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
+	}
+	createTestUser(t, user)
+	createTestNetwork(t)
+	setup(t)
+	defer shutdown(t)
+	peer := createTestNetworkPeer(t)
+
+	t.Run("invalidPeer", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/networks/peers/valid/something", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+	})
+
+	t.Run("valid", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/networks/peers/valid/"+peer, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+}
+
+func TestDisplayNetworkPeer(t *testing.T) {
+	deleteAllNetworks(t)
+	deleteAllPeers(t)
+	deleteAllUsers(t)
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
+	}
+	createTestUser(t, user)
+	createTestNetwork(t)
+	setup(t)
+	defer shutdown(t)
+	peer := createTestNetworkPeer(t)
+
+	t.Run("invalidNetwork", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/networks/peers/invalid/peer", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+	})
+
+	t.Run("invalidPeer", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/networks/peers/valid/something", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+	})
+
+	t.Run("valid", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/networks/peers/valid/"+peer, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+}
+
+func TestGetNetworksForPeer(t *testing.T) {
+	deleteAllNetworks(t)
+	deleteAllPeers(t)
+	deleteAllUsers(t)
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
+	}
+	createTestUser(t, user)
+	createTestNetwork(t)
+	setup(t)
+	defer shutdown(t)
+
+	t.Run("noNetwork", func(t *testing.T) {
+		networks, err := getNetworksForPeer("wireguardkey")
+		should.NotBeError(t, err)
+		should.BeEmpty(t, networks)
+	})
+
+	t.Run("good", func(t *testing.T) {
+		createTestNetwork(t)
+		peer := createTestNetworkPeer(t)
+		networks, err := getNetworksForPeer(peer)
+		should.NotBeError(t, err)
+		should.BeEqual(t, len(networks), 1)
+	})
+}
diff --git a/internal/server/plexus_test.go b/internal/server/plexus_test.go
new file mode 100644
index 0000000..fe28a4c
--- /dev/null
+++ b/internal/server/plexus_test.go
@@ -0,0 +1,234 @@
+package server
+
+import (
+	"io"
+	"log"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/boltdb"
+	"github.com/devilcove/configuration"
+	"github.com/devilcove/mux"
+	"github.com/devilcove/plexus"
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
+)
+
+var (
+	dir      string
+	progName = "plexus-testing"
+	router   *mux.Router
+)
+
+func TestMain(m *testing.M) {
+	if _, err := os.Stat("./test.db"); err == nil {
+		if err := os.Remove("./test.db"); err != nil {
+			log.Println("remove db", err)
+			os.Exit(1)
+		}
+	}
+	if err := boltdb.Initialize("./test.db",
+		[]string{userTable, keyTable, networkTable, peerTable, settingTable, "keypairs"},
+	); err != nil {
+		log.Println("init db", err)
+		os.Exit(2)
+	}
+	plexus.SetLogging("debug")
+	router = setupRouter(slog.Default())
+	code := m.Run()
+	// 	cancel()
+	// 	wg.Wait()
+	boltdb.Close()
+	os.Exit(code)
+}
+
+func writeTmpConfg(t *testing.T, content *Configuration) {
+	t.Helper()
+	if err := configuration.Save(content); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func setup(t *testing.T) {
+	t.Helper()
+	dir = t.TempDir()
+	err := os.MkdirAll(filepath.Join(dir, progName), 0o0750)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("XDG_CONFIG_HOME", dir)
+	t.Setenv("HOME", dir)
+	os.Args = []string{progName}
+	if err := os.MkdirAll(filepath.Join(dir, ".local/share", progName), 0o0750); err != nil {
+		t.Fatal(err)
+	}
+	writeTmpConfg(t, &Configuration{
+		FQDN:     "127.0.0.1",
+		Port:     "8080",
+		DataHome: filepath.Join(dir, ".local/share", progName),
+	})
+	startTestBroker(t)
+}
+
+func deleteAllUsers(t *testing.T) {
+	t.Helper()
+	users, err := boltdb.GetAll[plexus.User](userTable)
+	should.NotBeError(t, err)
+	for _, user := range users {
+		err := boltdb.Delete[plexus.User](user.Username, userTable)
+		should.NotBeError(t, err)
+	}
+}
+
+func testLogin(t *testing.T, data plexus.User) *http.Cookie {
+	t.Helper()
+	w := httptest.NewRecorder()
+	form := url.Values{}
+	form.Add("username", data.Username)
+	form.Add("password", data.Password)
+	req := httptest.NewRequest(http.MethodPost, "/login/", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	router.ServeHTTP(w, req)
+	should.BeGreaterOrEqualTo(t, len(w.Result().Cookies()), 1)
+	for _, cookie := range w.Result().Cookies() {
+		if cookie.Name == "plexus" {
+			return cookie
+		}
+	}
+	t.Fail()
+	return nil
+}
+
+func createTestUser(t *testing.T, user plexus.User) {
+	t.Helper()
+	user.Password, _ = hashPassword(user.Password)
+	err := boltdb.Save(&user, user.Username, userTable)
+	should.NotBeError(t, err)
+}
+
+func deleteAllPeers(t *testing.T) {
+	t.Helper()
+	peers, err := boltdb.GetAll[plexus.Peer](peerTable)
+	should.NotBeError(t, err)
+	for _, peer := range peers {
+		err := boltdb.Delete[plexus.Peer](peer.WGPublicKey, peerTable)
+		should.NotBeError(t, err)
+	}
+}
+
+func createTestPeer(t *testing.T) string {
+	t.Helper()
+	pub, err := generateKeys()
+	if err != nil {
+		t.Fatal(err)
+	}
+	savePeer(plexus.Peer{
+		WGPublicKey: pub.String(),
+		Name:        "testing",
+	})
+	return pub.String()
+}
+
+func createTestNetworkPeer(t *testing.T) string {
+	t.Helper()
+	id := createTestPeer(t)
+	_, err := addPeerToNetwork(id, "valid", 51821, 51821)
+	should.NotBeError(t, err)
+	return id
+}
+
+func deleteAllNetworks(t *testing.T) {
+	t.Helper()
+	nets, err := boltdb.GetAll[plexus.Network](networkTable)
+	should.NotBeError(t, err)
+	for _, net := range nets {
+		err := boltdb.Delete[plexus.Network](net.Name, networkTable)
+		should.NotBeError(t, err)
+	}
+}
+
+func createTestNetwork(t *testing.T) {
+	t.Helper()
+	_, cidr, err := net.ParseCIDR("10.200.0.0/24")
+	should.NotBeError(t, err)
+	network := plexus.Network{
+		Name: "valid",
+		Net:  *cidr,
+	}
+	err = boltdb.Save(network, network.Name, networkTable)
+	should.NotBeError(t, err)
+}
+
+func deleteAllKeys(t *testing.T) {
+	t.Helper()
+	keys, err := boltdb.GetAll[plexus.Key](keyTable)
+	should.NotBeError(t, err)
+	for _, key := range keys {
+		err := boltdb.Delete[plexus.Key](key.Name, keyTable)
+		should.NotBeError(t, err)
+	}
+}
+
+func startTestBroker(t *testing.T) {
+	t.Helper()
+	// create admin user.
+	adminKey := getAdminKey()
+	adminPublicKey, err := adminKey.PublicKey()
+	if err != nil {
+		t.Fatal("could not create admin public key", "error", err)
+	}
+	tokensUsers := getTokenUsers()
+	deviceUsers := getDeviceUsers()
+	natsOptions = &server.Options{
+		Nkeys: []*server.NkeyUser{
+			{
+				Nkey: adminPublicKey,
+				Permissions: &server.Permissions{
+					Publish: &server.SubjectPermission{
+						Allow: []string{">"},
+					},
+					Subscribe: &server.SubjectPermission{
+						Allow: []string{">"},
+					},
+				},
+			},
+		},
+	}
+	natsOptions.Nkeys = append(natsOptions.Nkeys, tokensUsers...)
+	natsOptions.Nkeys = append(natsOptions.Nkeys, deviceUsers...)
+	natsOptions.NoSigs = true
+	natsOptions.Host = "127.0.0.1"
+	natServer, err = server.NewServer(natsOptions)
+	if err != nil {
+		t.Fatal(err)
+	}
+	natServer.Start()
+	SignatureCB := func(nonce []byte) ([]byte, error) {
+		return adminKey.Sign(nonce)
+	}
+	opts := []nats.Option{nats.Nkey(adminPublicKey, SignatureCB)}
+	natsConn, err = nats.Connect("nats://127.0.0.1:4222", opts...)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func shutdown(_ *testing.T) {
+	natServer.Shutdown()
+}
+
+func bodyParams(params ...string) io.Reader {
+	body := url.Values{}
+	for i := 0; i < len(params)-1; i += 2 {
+		body.Set(params[i], params[i+1])
+	}
+	return strings.NewReader(body.Encode())
+}
diff --git a/internal/server/relay.go b/internal/server/relay.go
new file mode 100644
index 0000000..25499a8
--- /dev/null
+++ b/internal/server/relay.go
@@ -0,0 +1,124 @@
+package server
+
+import (
+	"log/slog"
+	"net/http"
+	"slices"
+
+	"github.com/devilcove/boltdb"
+	"github.com/devilcove/plexus"
+	"github.com/devilcove/plexus/internal/publish"
+)
+
+func displayAddRelay(w http.ResponseWriter, r *http.Request) {
+	data := struct {
+		Network        string
+		Relay          plexus.NetworkPeer
+		AvailablePeers []plexus.NetworkPeer
+	}{}
+	data.Network = r.PathValue("id")
+	relay := r.PathValue("peer")
+	slog.Debug("add relay", "network", data.Network, "relay", relay)
+	network, err := boltdb.Get[plexus.Network](data.Network, networkTable)
+	if err != nil {
+		processError(w, http.StatusBadGateway, err.Error())
+		return
+	}
+	for _, peer := range network.Peers {
+		if peer.WGPublicKey == relay {
+			data.Relay = peer
+			continue
+		}
+		if peer.IsRelay || peer.IsRelayed || peer.IsSubnetRouter {
+			continue
+		}
+		data.AvailablePeers = append(data.AvailablePeers, peer)
+	}
+	if err := templates.ExecuteTemplate(w, "addRelayToNetwork", data); err != nil {
+		slog.Error("execute template", "template", "addRelayToNetwork", "data", data, "error", err)
+	}
+}
+
+func addRelay(w http.ResponseWriter, r *http.Request) {
+	netID := r.PathValue("id")
+	relayID := r.PathValue("peer")
+	relayedIDs := r.PostForm["relayed"]
+	network, err := boltdb.Get[plexus.Network](netID, networkTable)
+	if err != nil {
+		processError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	update := plexus.NetworkUpdate{
+		Action: plexus.AddRelay,
+	}
+	peers := []plexus.NetworkPeer{}
+	for _, peer := range network.Peers {
+		if peer.WGPublicKey == relayID {
+			peer.IsRelay = true
+			peer.RelayedPeers = relayedIDs
+			update.Peer = peer
+		}
+		if slices.Contains(relayedIDs, peer.WGPublicKey) {
+			peer.IsRelayed = true
+		}
+		peers = append(peers, peer)
+	}
+	network.Peers = peers
+	if err := boltdb.Save(network, network.Name, networkTable); err != nil {
+		processError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	slog.Debug("publish network update - add relay", "network", network.Name, "relay", relayID)
+	publish.Message(natsConn, "networks."+network.Name, update)
+	networkDetails(w, r)
+}
+
+func deleteRelay(w http.ResponseWriter, r *http.Request) {
+	netName := r.PathValue("id")
+	peerID := r.PathValue("peer")
+	slog.Info("delete relay", "network", netName, "relay", peerID)
+	network, err := boltdb.Get[plexus.Network](netName, networkTable)
+	if err != nil {
+		processError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	update := plexus.NetworkUpdate{
+		Action: plexus.DeleteRelay,
+	}
+	peersToUnrelay := []string{}
+	updatedPeers := []plexus.NetworkPeer{}
+	for _, peer := range network.Peers {
+		if peer.WGPublicKey == peerID {
+			// send the original peer to agents which will include the list of peers to unrelay
+			update.Peer = peer
+			peer.IsRelay = false
+			peersToUnrelay = peer.RelayedPeers
+			peer.RelayedPeers = []string{}
+			updatedPeers = append(updatedPeers, peer)
+			break
+		}
+	}
+	for _, peer := range network.Peers {
+		if peer.WGPublicKey == peerID {
+			// already added above.
+			continue
+		}
+		if slices.Contains(peersToUnrelay, peer.WGPublicKey) {
+			peer.IsRelayed = false
+		}
+		updatedPeers = append(updatedPeers, peer)
+	}
+	network.Peers = updatedPeers
+	if err := boltdb.Save(network, network.Name, networkTable); err != nil {
+		processError(w, http.StatusBadRequest, "failed to save update network peers "+err.Error())
+		return
+	}
+	slog.Debug(
+		"publish network update",
+		"network", network.Name,
+		"peer", update.Peer.HostName,
+		"reason", "delete relay",
+	)
+	publish.Message(natsConn, plexus.Networks+network.Name, update)
+	networkDetails(w, r)
+}
diff --git a/internal/server/relay_test.go b/internal/server/relay_test.go
new file mode 100644
index 0000000..9ea92e2
--- /dev/null
+++ b/internal/server/relay_test.go
@@ -0,0 +1,84 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/plexus"
+)
+
+func TestRelay(t *testing.T) {
+	setup(t)
+	defer shutdown(t)
+	deleteAllNetworks(t)
+	deleteAllPeers(t)
+	deleteAllUsers(t)
+
+	user := plexus.User{Username: "admin", Password: "pass"}
+	createTestUser(t, user)
+	createTestNetwork(t)
+	peer := createTestNetworkPeer(t)
+	peer2 := createTestNetworkPeer(t)
+
+	t.Run("displayAdd", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/networks/relay/valid/"+peer, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Create Relay")
+	})
+
+	t.Run("addInvalidNet", func(t *testing.T) {
+		payload := bodyParams("relayed", peer2)
+		r := httptest.NewRequest(http.MethodPost, "/networks/relay/invalid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "no results found")
+	})
+
+	t.Run("addRelay", func(t *testing.T) {
+		payload := bodyParams("relayed", peer2)
+		r := httptest.NewRequest(http.MethodPost, "/networks/relay/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Network:")
+	})
+
+	t.Run("deleteInvalidNet", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/networks/relay/invalid/"+peer2, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "no results found")
+	})
+
+	t.Run("delete", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/networks/relay/valid/"+peer2, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Network: valid")
+	})
+}
diff --git a/internal/server/router.go b/internal/server/router.go
index cbb561d..3c9ccdc 100644
--- a/internal/server/router.go
+++ b/internal/server/router.go
@@ -1,152 +1,141 @@
 package server
 
 import (
-	"crypto/rand"
+	"bytes"
 	"embed"
 	"fmt"
 	"html/template"
+	"log"
 	"log/slog"
 	"net/http"
-	"path/filepath"
-	"runtime"
-	"time"
+	"os"
 
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-contrib/sessions/cookie"
-	"github.com/gin-gonic/gin"
+	"github.com/devilcove/mux"
 )
 
-//go:embed images/* assets/* html/*
-var f embed.FS
-
-func setupRouter() *gin.Engine {
-	authKey, encryptKey, err := sessionKeys()
-	if err != nil {
-		slog.Error("failed to generate session keys ..... using fallback")
-		authKey = []byte("12345678901234567890123456789012")
-		encryptKey = []byte("12345678901234567890123456789012")
-	}
-	store := cookie.NewStore(authKey, encryptKey)
-	session := sessions.Sessions("plexus", store)
-	if config.Verbosity != "DEBUG" {
-		gin.SetMode(gin.ReleaseMode)
-	}
-
-	router := gin.New()
-	templates := template.Must(template.ParseFS(f, "html/*"))
-	router.SetHTMLTemplate(templates)
-	router.GET("/images/*filepath", func(c *gin.Context) {
-		c.FileFromFS(c.Request.URL.Path, http.FS(f))
-	})
-	router.GET("/assets/*filepath", func(c *gin.Context) {
-		c.FileFromFS(c.Request.URL.Path, http.FS(f))
-	})
-	_ = router.SetTrustedProxies(nil)
-	router.Use(gin.Recovery(), session, weblogger())
-	router.GET("/", displayMain)
-	router.POST("/", login)
-	router.GET("/logout", logout)
+//go:embed images assets html
+var content embed.FS
+
+var templates *template.Template
+
+func setupRouter(l *slog.Logger) *mux.Router {
+	InitializeSession()
+
+	router := mux.NewRouter(l, mux.Logger)
+	dir, _ := os.Getwd()
+	slog.Info("here", "pwd", dir)
+	templates = template.Must(template.ParseFS(content, "html/*.html"))
+
+	// static files
+	router.StaticFS("/content/", content)
+	router.ServeFileFS("/favicon.ico", "images/icon.svg", content)
+
+	// unauthorized routes
+	router.Post("/login/", login)
+	router.Get("/logout/", logout)
+	router.Get("/{$}", displayMain)
+
 	sidebar := router.Group("/sidebar", auth)
-	{
-		sidebar.GET("/", networksSideBar)
-	}
+	sidebar.Get("/", networksSideBar)
+
 	networks := router.Group("/networks", auth)
-	{
-		networks.GET("/add", displayAddNetwork)
-		networks.POST("/add", addNetwork)
-		networks.GET("/", displayNetworks)
-		networks.GET("/:id", networkDetails)
-		networks.POST("/addPeer/:id/:peer", networkAddPeer)
-		networks.DELETE("/:id", deleteNetwork)
-		networks.DELETE("/peers/:id/:peer", removePeerFromNetwork)
-		networks.GET("/relay/:id/:peer", displayAddRelay)
-		networks.POST("/relay/:id/:peer", addRelay)
-		networks.DELETE("/relay/:id/:peer", deleteRelay)
-		networks.GET("/peers/:id/:peer", networkPeerDetails)
-		networks.GET("/router/:id/:peer", displayAddRouter)
-		networks.POST("/router/:id/:peer", addRouter)
-		networks.DELETE("/router/:id/:peer", deleteRouter)
-	}
+	networks.Get("/add", displayAddNetwork)
+	networks.Post("/add", addNetwork)
+	networks.Get("/{$}", displayNetworks)
+	networks.Get("/details/{id}", networkDetails)
+	networks.Post("/addPeer/{id}/{peer}", networkAddPeer)
+	networks.Delete("/{id}", deleteNetwork)
+	networks.Delete("/peers/{id}/{peer}", removePeerFromNetwork)
+	networks.Get("/relay/{id}/{peer}", displayAddRelay)
+	networks.Post("/relay/{id}/{peer}", addRelay)
+	networks.Delete("/relay/{id}/{peer}", deleteRelay)
+	networks.Get("/peers/{id}/{peer}", networkPeerDetails)
+	networks.Get("/router/{id}/{peer}", displayAddRouter)
+	networks.Post("/router/{id}/{peer}", addRouter)
+	networks.Delete("/router/{id}/{peer}", deleteRouter)
+
 	keys := router.Group("/keys", auth)
-	{
-		keys.GET("/", displayKeys)
-		keys.GET("/add", displayCreateKey)
-		keys.POST("/add", addKey)
-		keys.DELETE("/:id", deleteKey)
-	}
+	keys.Get("/", displayKeys)
+	keys.Get("/add", displayCreateKey)
+	keys.Post("/add", addKey)
+	keys.Delete("/{id}", deleteKey)
+
 	peers := router.Group("/peers", auth)
-	{
-		peers.GET("/", displayPeers)
-		peers.GET("/:id", peerDetails)
-		peers.DELETE("/:id", deletePeer)
-	}
+	peers.Get("/{$}", displayPeers)
+	peers.Get("/{id}", peerDetails)
+	peers.Delete("/{id}", deletePeer)
+
 	users := router.Group("/users", auth)
-	{
-		users.GET("/", getUsers)
-		users.GET("/add", displayAddUser)
-		users.POST("/add", addUser)
-		users.DELETE(":name", deleteUser)
-		users.GET("/user/:name", getUser)
-		users.POST("user/:name", editUser)
-	}
+	users.Get("/{$}", getUsers)
+	users.Get("/add", displayAddUser)
+	users.Post("/add", addUser)
+	users.Delete("/{name}", deleteUser)
+	users.Get("/user/{name}", getUser)
+	users.Post("/user/{name}", editUser)
+
 	server := router.Group("/server", auth)
-	{
-		server.GET("/", getServer)
-		server.POST("/logs/:level", setLogLevel)
-	}
+	server.Get("/", getServer)
+	server.Post("/logs/{level}", setLogLevel)
+
 	return router
 }
 
-func processError(c *gin.Context, status int, message string) {
-	pc, fn, line, _ := runtime.Caller(1)
-	source := fmt.Sprintf("%s[%s:%d]", runtime.FuncForPC(pc).Name(), filepath.Base(fn), line)
-	slog.Error(message, "status", status, "source", source)
-	c.HTML(status, "error", message)
-	c.Abort()
+func processError(w http.ResponseWriter, status int, message string) {
+	header := fmt.Sprintf(`{"showError":"%s"}`, message)
+	buf := bytes.Buffer{}
+	l := log.New(&buf, "", log.Lshortfile)
+	_ = l.Output(2, message)
+	slog.Error(buf.String())
+	w.Header().Set("Hx-Trigger", header)
+	http.Error(w, message, status)
 }
 
-func auth(c *gin.Context) {
-	session := sessions.Default(c)
-	loggedIn := session.Get("loggedin")
-	if loggedIn == nil {
-		slog.Info("not logged in display login page")
-		page := getPage(nil)
-		page.NeedsLogin = true
-		c.HTML(http.StatusOK, "login", page)
-		c.Abort()
-		return
-	}
+func auth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		session := GetSession(w, r)
+		if session == nil {
+			displayLogin(w, r)
+			return
+		}
+		if !session.LoggedIn {
+			displayLogin(w, r)
+			return
+		}
+		if err := session.Session.Save(r, w); err != nil {
+			slog.Error("save session", "error", err)
+		}
+		next.ServeHTTP(w, r)
+	})
 }
 
-func sessionKeys() ([]byte, []byte, error) {
-	authKey := make([]byte, 32)
-	encryptKey := make([]byte, 32)
-	_, err := rand.Read(authKey)
-	if err != nil {
-		return authKey, encryptKey, err
-	}
-	_, err = rand.Read(encryptKey)
-	if err != nil {
-		return authKey, encryptKey, err
-	}
-	return authKey, encryptKey, nil
-}
+// func auth(c *gin.Context) {
+// 	session := sessions.Default(c)
+// 	loggedIn := session.Get("loggedin")
+// 	if loggedIn == nil {
+// 		slog.Info("not logged in display login page")
+// 		page := getPage(nil)
+// 		page.NeedsLogin = true
+// 		if err := templates.ExecuteTemplate(w, "login", page)
+// 		c.Abort()
+// 		return
+// 	}
+// }
 
-func weblogger() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		start := time.Now()
-		c.Next()
-		status := c.Writer.Status()
-		switch {
-		case status >= 500:
-			slog.Error("request", "Code", c.Writer.Status(), "method", c.Request.Method,
-				"route", c.Request.URL.Path, "latency", time.Since(start), "client", c.ClientIP())
-		case status >= 400:
-			slog.Warn("request", "Code", c.Writer.Status(), "method", c.Request.Method,
-				"route", c.Request.URL.Path, "latency", time.Since(start), "client", c.ClientIP())
-		default:
-			slog.Debug("request", "Code", c.Writer.Status(), "method", c.Request.Method,
-				"route", c.Request.URL.Path, "latency", time.Since(start), "client", c.ClientIP())
-		}
-	}
-}
+// func weblogger() gin.HandlerFunc {
+// 	return func(w http.ResponseWriter, r *http.Request) {
+// 		start := time.Now()
+// 		c.Next()
+// 		status := c.Writer.Status()
+// 		switch {
+// 		case status >= 500:
+// 			slog.Error("request", "Code", c.Writer.Status(), "method", c.Request.Method,
+// 				"route", c.Request.URL.Path, "latency", time.Since(start), "client", c.ClientIP())
+// 		case status >= 400:
+// 			slog.Warn("request", "Code", c.Writer.Status(), "method", c.Request.Method,
+// 				"route", c.Request.URL.Path, "latency", time.Since(start), "client", c.ClientIP())
+// 		default:
+// 			slog.Debug("request", "Code", c.Writer.Status(), "method", c.Request.Method,
+// 				"route", c.Request.URL.Path, "latency", time.Since(start), "client", c.ClientIP())
+// 		}
+// 	}
+// }
diff --git a/internal/server/router_test.go b/internal/server/router_test.go
index 9b90b9e..1ac2ed1 100644
--- a/internal/server/router_test.go
+++ b/internal/server/router_test.go
@@ -13,42 +13,39 @@ import (
 
 func TestDefaultUser(t *testing.T) {
 	t.Run("noadmim", func(t *testing.T) {
-		err := deleteAllUsers(true)
-		should.BeNil(t, err)
-		err = checkDefaultUser("admin", "pass")
-		should.BeNil(t, err)
+		deleteAllUsers(t)
+		err := checkDefaultUser("admin", "pass")
+		should.NotBeError(t, err)
 		user, err := boltdb.Get[plexus.User]("admin", userTable)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEqual(t, user.Username, "admin")
 		should.BeTrue(t, user.IsAdmin)
 	})
 	t.Run("env", func(t *testing.T) {
-		err := deleteAllUsers(true)
-		should.BeNil(t, err)
-		err = checkDefaultUser("Administrator", "password")
-		should.BeNil(t, err)
+		deleteAllUsers(t)
+		err := checkDefaultUser("Administrator", "password")
+		should.NotBeError(t, err)
 		user, err := boltdb.Get[plexus.User]("Administrator", userTable)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEqual(t, user.Username, "Administrator")
 		should.BeTrue(t, user.IsAdmin)
 	})
 	t.Run("adminexists", func(t *testing.T) {
 		err := checkDefaultUser("Administator", "password")
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		user, err := boltdb.Get[plexus.User]("Administrator", userTable)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEqual(t, user.Username, "Administrator")
 		should.BeTrue(t, user.IsAdmin)
 	})
 }
 
 func TestAuthFail(t *testing.T) {
-	req, err := http.NewRequest(http.MethodGet, "/server/", nil)
-	should.BeNil(t, err)
+	req := httptest.NewRequest(http.MethodGet, "/server/", nil)
 	w := httptest.NewRecorder()
 	router.ServeHTTP(w, req)
 	should.BeEqual(t, w.Code, http.StatusOK)
 	body, err := io.ReadAll(w.Body)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	should.ContainSubstring(t, string(body), "<h1>Login</h1")
 }
diff --git a/internal/server/server.go b/internal/server/server.go
index 5887ba9..7feeccb 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -12,16 +12,17 @@ import (
 	"strings"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/devilcove/boltdb"
+	"github.com/devilcove/configuration"
 	"github.com/devilcove/plexus"
-	"github.com/gin-gonic/gin"
+	"github.com/mattkasun/tools/logging"
 	"github.com/nats-io/nats-server/v2/server"
 	"github.com/nats-io/nats.go"
 )
 
 var (
-	newDevice   chan string
 	brokerfail  chan int
 	webfail     chan int
 	natServer   *server.Server
@@ -43,7 +44,6 @@ func Run() {
 	reset := make(chan os.Signal, 1)
 	brokerfail = make(chan int, 1)
 	webfail = make(chan int, 1)
-	newDevice = make(chan string, 1)
 	signal.Notify(quit, syscall.SIGTERM, os.Interrupt)
 	signal.Notify(reset, syscall.SIGHUP)
 	ctx, cancel := context.WithCancel(context.Background())
@@ -85,8 +85,15 @@ func start(ctx context.Context, wg *sync.WaitGroup, tls *tls.Config) {
 
 func web(ctx context.Context, wg *sync.WaitGroup, tls *tls.Config) {
 	defer wg.Done()
-	slog.Info("Starting web server...")
-	router := setupRouter()
+	config := Configuration{}
+	if err := configuration.Get(&config); err != nil {
+		slog.Error("configuration", "error", err)
+		webfail <- 1
+		return
+	}
+	router := setupRouter(
+		logging.TextLogger(logging.TruncateSource(), logging.TimeFormat(time.DateTime)).Logger,
+	)
 	server := http.Server{
 		Addr:    ":" + config.Port,
 		Handler: router,
@@ -99,7 +106,8 @@ func web(ctx context.Context, wg *sync.WaitGroup, tls *tls.Config) {
 		server.TLSConfig = tls
 		server.Addr = ":443"
 		go func() {
-			if err := server.ListenAndServeTLS("", ""); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			if err := server.ListenAndServeTLS("", ""); err != nil &&
+				!errors.Is(err, http.ErrServerClosed) {
 				slog.Error("https server", "error", err)
 				webfail <- 1
 			}
@@ -112,7 +120,8 @@ func web(ctx context.Context, wg *sync.WaitGroup, tls *tls.Config) {
 			}
 		}()
 	}
-	slog.Info("web server started")
+
+	slog.Info("web server started", "at", server.Addr)
 	<-ctx.Done()
 	slog.Info("shutting down web server")
 	if err := server.Shutdown(ctx); err != nil {
@@ -121,25 +130,47 @@ func web(ctx context.Context, wg *sync.WaitGroup, tls *tls.Config) {
 	slog.Info("http server shutdown")
 }
 
-func getServer(c *gin.Context) {
+func getServer(w http.ResponseWriter, _ *http.Request) {
+	config := Configuration{}
+	if err := configuration.Get(&config); err != nil {
+		slog.Error("configuration", "error", err)
+		processError(w, http.StatusInternalServerError, "unable to read configuration")
+		return
+	}
 	server := struct {
 		LogLevel string
 		Logs     []string
 	}{
 		LogLevel: config.Verbosity,
 	}
-	cmd := exec.Command("/usr/bin/journalctl", "-eu", "plexus-server", "--no-pager", "-n", "25", "-r")
+	cmd := exec.Command(
+		"/usr/bin/journalctl",
+		"-eu",
+		"plexus-server",
+		"--no-pager",
+		"-n",
+		"25",
+		"-r",
+	)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		slog.Error("journalctl", "error", err)
 	}
 	logs := string(out)
 	server.Logs = strings.Split(logs, "\n")
-	c.HTML(http.StatusOK, "server", server)
+	if err := templates.ExecuteTemplate(w, "server", server); err != nil {
+		slog.Error("execute template", "template", "server", "data", server, "error", err)
+	}
 }
 
-func setLogLevel(c *gin.Context) {
-	config.Verbosity = c.Param("level")
+func setLogLevel(w http.ResponseWriter, r *http.Request) {
+	config := Configuration{}
+	if err := configuration.Get(&config); err != nil {
+		slog.Error("configuration", "error", err)
+		processError(w, http.StatusInternalServerError, "unable to read configuration")
+		return
+	}
+	config.Verbosity = r.PathValue("level")
 	plexus.SetLogging(config.Verbosity)
-	getServer(c)
+	getServer(w, r)
 }
diff --git a/internal/server/server_test.go b/internal/server/server_test.go
new file mode 100644
index 0000000..63f8044
--- /dev/null
+++ b/internal/server/server_test.go
@@ -0,0 +1,92 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/plexus"
+)
+
+func TestServerLogs(t *testing.T) {
+	user := plexus.User{
+		Username: "hello",
+		Password: "world",
+	}
+	createTestUser(t, user)
+	setup(t)
+	defer shutdown(t)
+
+	t.Run("get", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/server/", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Server Logs")
+	})
+
+	t.Run("loglevel", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodPost, "/server/logs/Debug", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Server Logs")
+	})
+}
+
+func TestServer(t *testing.T) {
+	// skip for now: need a better way to test this
+	t.Skip()
+	setup(t)
+	shutdown(t)
+
+	t.Run("reset", func(t *testing.T) {
+		go Run()
+		time.Sleep(time.Second * 1)
+		r := httptest.NewRequest(http.MethodGet, "http://localhost:8080/", nil)
+		resp, err := http.DefaultClient.Do(r)
+		should.NotBeError(t, err)
+		should.NotBeNil(t, resp)
+		defer resp.Body.Close()
+		should.BeEqual(t, resp.StatusCode, http.StatusOK)
+		p, err := os.FindProcess(os.Getpid())
+		should.NotBeError(t, err)
+		should.NotBeError(t, p.Signal(syscall.SIGHUP))
+	})
+
+	t.Run("brokerfail", func(t *testing.T) {
+		t.Skip()
+		go Run()
+		r := httptest.NewRequest(http.MethodGet, "http://localhost:8080/", nil)
+		resp, err := http.DefaultClient.Do(r)
+		should.NotBeError(t, err)
+		should.NotBeNil(t, resp)
+		defer resp.Body.Close()
+		should.BeEqual(t, resp.StatusCode, http.StatusOK)
+		brokerfail <- 1
+	})
+
+	t.Run("webfail", func(t *testing.T) {
+		t.Skip()
+		go Run()
+		time.Sleep(time.Second * 1)
+		r := httptest.NewRequest(http.MethodGet, "http://localhost:8080/", nil)
+		resp, err := http.DefaultClient.Do(r)
+		should.NotBeError(t, err)
+		should.NotBeNil(t, resp)
+		defer resp.Body.Close()
+		should.BeEqual(t, resp.StatusCode, http.StatusOK)
+		webfail <- 1
+	})
+}
diff --git a/internal/server/sessions.go b/internal/server/sessions.go
new file mode 100644
index 0000000..d775adf
--- /dev/null
+++ b/internal/server/sessions.go
@@ -0,0 +1,125 @@
+package server
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"log"
+	"log/slog"
+	"net/http"
+
+	"github.com/devilcove/plexus"
+	"github.com/gorilla/sessions"
+)
+
+const (
+	cookieAge   = 300
+	sessionName = "plexus"
+)
+
+var (
+	store              *sessions.CookieStore
+	sessionInitialized bool
+)
+
+// Session represents a user session.
+type Session struct {
+	UserName string
+	LoggedIn bool
+	Admin    bool
+	Page     string
+	Session  *sessions.Session
+}
+
+func InitializeSession() {
+	if sessionInitialized {
+		slog.Error("session already initialized")
+		return
+	}
+	store = sessions.NewCookieStore(keypairs())
+	store.MaxAge(cookieAge)
+	store.Options.HttpOnly = true
+	store.Options.SameSite = http.SameSiteStrictMode
+}
+
+func keypairs() ([]byte, []byte) {
+	buf1 := make([]byte, 32)
+	buf2 := make([]byte, 32)
+	rand.Read(buf1)
+	rand.Read(buf2)
+	return buf1, buf2
+}
+
+func GetSession(_ http.ResponseWriter, r *http.Request) *Session {
+	sess := &Session{}
+	session, err := store.Get(r, sessionName)
+	if err != nil {
+		slog.Error("session err", "error", err)
+		return nil
+	}
+	user := session.Values["username"]
+	slog.Debug("GetSession", "userName", session.Values)
+	if u, ok := user.(string); ok {
+		sess.UserName = u
+	}
+	loggedIn := session.Values["loggedIn"]
+	if l, ok := loggedIn.(bool); ok {
+		sess.LoggedIn = l
+	}
+	admin := session.Values["admin"]
+	if a, ok := admin.(bool); ok {
+		sess.Admin = a
+	}
+
+	page := session.Values["page"]
+	if p, ok := page.(string); ok {
+		sess.Page = p
+	}
+	slog.Debug("getSession", "session", sess, "values", session.Values)
+	sess.Session = session
+	return sess
+}
+
+func ClearSession(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		s := sessions.NewSession(store, sessionName)
+		s.Options.MaxAge = -1
+		if err := s.Save(r, w); err != nil {
+			slog.Error("save session", "error", err)
+		}
+		return
+	}
+	session.Session.Options.MaxAge = -1
+	if err := session.Session.Save(r, w); err != nil {
+		slog.Error("save session", "error", err)
+	}
+}
+
+func NewSession(
+	w http.ResponseWriter,
+	r *http.Request,
+	user plexus.User,
+	loggedIn bool,
+	page string,
+) {
+	session := sessions.NewSession(store, sessionName)
+	session.Values["username"] = user.Username
+	session.Values["admin"] = user.IsAdmin
+	session.Values["loggedIn"] = loggedIn
+	session.Values["page"] = page
+	session.Options = store.Options
+	if err := session.Save(r, w); err != nil {
+		slog.Error("save session", "error", err)
+	}
+	slog.Debug("NewSession", "session", session.Values)
+}
+
+func (s *Session) Save(w http.ResponseWriter, r *http.Request) {
+	if err := s.Session.Save(r, w); err != nil {
+		buf := bytes.Buffer{}
+		l := log.New(&buf, "", log.Lshortfile)
+		_ = l.Output(2, fmt.Sprintf("%s %s %s", "session save", "error", err))
+		slog.Error(buf.String())
+	}
+}
diff --git a/internal/server/subnetrouter.go b/internal/server/subnetrouter.go
index 8e29b51..7ad4161 100644
--- a/internal/server/subnetrouter.go
+++ b/internal/server/subnetrouter.go
@@ -9,59 +9,57 @@ import (
 	"github.com/devilcove/boltdb"
 	"github.com/devilcove/plexus"
 	"github.com/devilcove/plexus/internal/publish"
-	"github.com/gin-gonic/gin"
 )
 
-func displayAddRouter(c *gin.Context) {
+func displayAddRouter(w http.ResponseWriter, r *http.Request) {
 	data := struct {
 		Network string
 		Router  string
 	}{
-		Network: c.Param("id"),
-		Router:  c.Param("peer"),
+		Network: r.PathValue("id"),
+		Router:  r.PathValue("peer"),
 	}
 	slog.Debug("add router")
-	c.HTML(http.StatusOK, "addRouterToNetwork", data)
+	if err := templates.ExecuteTemplate(w, "addRouterToNetwork", data); err != nil {
+		slog.Error("execute template", "template", "addRouterToNetwork", "data", data, "error", err)
+	}
 }
 
-func addRouter(c *gin.Context) {
-	netID := c.Param("id")
-	router := c.Param("peer")
-	cidr := c.PostForm("cidr")
-	nat := c.PostForm("nat")
-	vcidr := c.PostForm("vcidr")
+func addRouter(w http.ResponseWriter, r *http.Request) {
+	netID := r.PathValue("id")
+	router := r.PathValue("peer")
+	cidr := r.FormValue("cidr")
+	nat := r.FormValue("nat")
+	vcidr := r.FormValue("vcidr")
 	var virtSubnet *net.IPNet
 	slog.Debug("subnet router", "network", netID, "router", router, "subnet", cidr, "use NAT", nat)
 	_, subnet, err := net.ParseCIDR(cidr)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	if nat == "virt" {
 		_, virtSubnet, err = net.ParseCIDR(vcidr)
 		if err != nil {
-			processError(c, http.StatusBadRequest, err.Error())
+			processError(w, http.StatusBadRequest, err.Error())
 			return
 		}
 		if virtSubnet.Mask.String() != subnet.Mask.String() {
-			processError(c, http.StatusBadRequest, "subnet/virtual subnet masks must be the same")
+			processError(w, http.StatusBadRequest, "subnet/virtual subnet masks must be the same")
+			return
 		}
 		if message, err := validateSubnet(virtSubnet); err != nil {
-			processError(c, http.StatusBadRequest, message)
+			processError(w, http.StatusBadRequest, message)
 			return
 		}
 	}
 	if message, err := validateSubnet(subnet); err != nil {
-		processError(c, http.StatusBadRequest, message)
-		return
-	}
-	if !validateNetworkAddress(*subnet) {
-		processError(c, http.StatusBadRequest, "invalid subnet: must be a private network")
+		processError(w, http.StatusBadRequest, message)
 		return
 	}
 	network, err := boltdb.Get[plexus.Network](netID, networkTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	update := plexus.NetworkUpdate{
@@ -84,21 +82,21 @@ func addRouter(c *gin.Context) {
 		}
 	}
 	if err := boltdb.Save(network, network.Name, networkTable); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	publish.Message(natsConn, "networks."+network.Name, update)
 	publish.Message(natsConn, plexus.Update+update.Peer.WGPublicKey+plexus.AddRouter, update.Peer)
-	networkDetails(c)
+	networkDetails(w, r)
 }
 
-func deleteRouter(c *gin.Context) {
-	netID := c.Param("id")
-	router := c.Param("peer")
+func deleteRouter(w http.ResponseWriter, r *http.Request) {
+	netID := r.PathValue("id")
+	router := r.PathValue("peer")
 	slog.Info("delete subnet router", "network", netID, "router", router)
 	network, err := boltdb.Get[plexus.Network](netID, networkTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	update := plexus.NetworkUpdate{
@@ -115,13 +113,21 @@ func deleteRouter(c *gin.Context) {
 		}
 	}
 	if err := boltdb.Save(network, network.Name, networkTable); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	slog.Debug("publish network update - delete router", "network", network.Name, "peer", update.Peer.HostName)
+	slog.Debug(
+		"publish network update - delete router",
+		"network", network.Name,
+		"peer", update.Peer.HostName,
+	)
 	publish.Message(natsConn, "networks."+network.Name, update)
-	publish.Message(natsConn, plexus.Update+update.Peer.WGPublicKey+plexus.DeleteRouter, update.Peer)
-	networkDetails(c)
+	publish.Message(
+		natsConn,
+		plexus.Update+update.Peer.WGPublicKey+plexus.DeleteRouter,
+		update.Peer,
+	)
+	networkDetails(w, r)
 }
 
 func subnetInUse(subnet *net.IPNet) (string, string, error) {
@@ -132,7 +138,12 @@ func subnetInUse(subnet *net.IPNet) (string, string, error) {
 	}
 	for _, network := range networks {
 		if network.Net.Contains(subnet.IP) || subnet.Contains(network.Net.IP) {
-			slog.Debug("subnet in use - network", "network", network.Name, "net", network.Net, "subnet", subnet)
+			slog.Debug(
+				"subnet in use - network",
+				"network", network.Name,
+				"net", network.Net,
+				"subnet", subnet,
+			)
 			return "network", network.Name, ErrSubnetInUse
 		}
 		for _, peer := range network.Peers {
diff --git a/internal/server/subnetrouter_test.go b/internal/server/subnetrouter_test.go
index 81aec57..6988739 100644
--- a/internal/server/subnetrouter_test.go
+++ b/internal/server/subnetrouter_test.go
@@ -2,7 +2,10 @@ package server
 
 import (
 	"errors"
+	"io"
 	"net"
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
@@ -12,9 +15,160 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
+func TestSubnetRouter(t *testing.T) {
+	deleteAllPeers(t)
+	deleteAllNetworks(t)
+	deleteAllUsers(t)
+	createTestNetwork(t)
+	peer := createTestNetworkPeer(t)
+	user := plexus.User{Username: "test", Password: "pass", IsAdmin: false}
+	createTestUser(t, user)
+
+	t.Run("display", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/networks/router/valid/"+peer, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+	})
+
+	t.Run("badCIDR", func(t *testing.T) {
+		payload := bodyParams("cidr", "192.168.0.256/24")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid CIDR address")
+	})
+
+	t.Run("badvirtCIDR", func(t *testing.T) {
+		payload := bodyParams("cidr", "192.168.0.0/24", "nat", "virt", "vcidr", "192.168.0.256/24")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid CIDR address")
+	})
+
+	t.Run("badvirtMask", func(t *testing.T) {
+		payload := bodyParams("cidr", "192.168.0.0/24", "nat", "virt", "vcidr", "10.10.10.0/23")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "subnet/virtual subnet masks must be the same")
+	})
+
+	t.Run("publicVirtSubnet", func(t *testing.T) {
+		payload := bodyParams("cidr", "192.168.0.0/24", "nat", "virt", "vcidr", "8.8.8.8/24")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid subnet: must be a private network")
+	})
+
+	t.Run("virtSubnetInUse", func(t *testing.T) {
+		_, cidr, err := net.ParseCIDR("10.100.0.0/24")
+		should.NotBeError(t, err)
+		network := plexus.Network{
+			Name: "overlapping",
+			Net:  *cidr,
+		}
+		err = boltdb.Save(network, network.Name, networkTable)
+		should.NotBeError(t, err)
+		payload := bodyParams("cidr", "192.168.0.0/24", "nat", "virt", "vcidr", "10.100.0.0/24")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "subnet in use")
+	})
+
+	t.Run("publicSubnet", func(t *testing.T) {
+		payload := bodyParams("cidr", "8.8.8.8/24")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "invalid subnet: must be a private network")
+	})
+
+	t.Run("subnetInUse", func(t *testing.T) {
+		t.Skip()
+	})
+
+	t.Run("goodVirt", func(t *testing.T) {
+		setup(t)
+		defer shutdown(t)
+		payload := bodyParams("cidr", "192.168.0.0/24", "nat", "virt", "vcidr", "10.10.10.0/24")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Network:")
+	})
+
+	t.Run("goodNat", func(t *testing.T) {
+		setup(t)
+		defer shutdown(t)
+		payload := bodyParams("cidr", "192.168.0.0/24", "nat", "nat", "vcidr", "10.10.10.0/24")
+		r := httptest.NewRequest(http.MethodPost, "/networks/router/valid/"+peer, payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Network:")
+	})
+
+	t.Run("delete", func(t *testing.T) {
+		setup(t)
+		defer shutdown(t)
+		r := httptest.NewRequest(http.MethodDelete, "/networks/router/valid/"+peer, nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "Network:")
+	})
+}
+
 func TestSubnetInUse(t *testing.T) {
-	_, public, err := generateKeys()
-	should.BeNil(t, err)
+	public, err := generateKeys()
+	should.NotBeError(t, err)
 	err = boltdb.Delete[plexus.Network]("plexus", networkTable)
 	should.BeTrue(t, err == nil || errors.Is(err, boltdb.ErrNoResults))
 	peer := plexus.NetworkPeer{
@@ -30,7 +184,7 @@ func TestSubnetInUse(t *testing.T) {
 	}
 	network.Peers = append(network.Peers, peer)
 	err = boltdb.Save(network, network.Name, networkTable)
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	t.Run("overlap network", func(t *testing.T) {
 		subnet := &net.IPNet{
 			IP:   net.ParseIP("10.10.11.0"),
@@ -47,7 +201,7 @@ func TestSubnetInUse(t *testing.T) {
 			Mask: net.CIDRMask(24, 32),
 		}
 		kind, name, err := subnetInUse(subnet)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEmpty(t, kind)
 		should.BeEmpty(t, name)
 	})
@@ -59,13 +213,13 @@ func TestSubnetInUse(t *testing.T) {
 		peer.IsSubnetRouter = true
 		network.Peers = []plexus.NetworkPeer{peer}
 		err = boltdb.Save(network, network.Name, networkTable)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		subnet := &net.IPNet{
 			IP:   net.ParseIP("10.10.100.0"),
 			Mask: net.CIDRMask(24, 32),
 		}
 		kind, name, err := subnetInUse(subnet)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		should.BeEmpty(t, kind)
 		should.BeEmpty(t, name)
 	})
@@ -88,7 +242,7 @@ func TestSubnetInUse(t *testing.T) {
 		}
 		network.Peers = []plexus.NetworkPeer{peer}
 		err = boltdb.Save(network, network.Name, networkTable)
-		should.BeNil(t, err)
+		should.NotBeError(t, err)
 		subnet := &net.IPNet{
 			IP:   net.ParseIP("172.16.1.0"),
 			Mask: net.CIDRMask(24, 32),
@@ -101,15 +255,15 @@ func TestSubnetInUse(t *testing.T) {
 }
 
 // generateKeys generates wgkeys that do not have a / in pubkey.
-func generateKeys() (*wgtypes.Key, *wgtypes.Key, error) {
+func generateKeys() (*wgtypes.Key, error) {
 	for {
 		priv, err := wgtypes.GeneratePrivateKey()
 		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
 		pub := priv.PublicKey()
 		if !strings.Contains(pub.String(), "/") {
-			return &priv, &pub, nil
+			return &pub, nil
 		}
 	}
 }
diff --git a/internal/server/users.go b/internal/server/users.go
index ca2740b..032d660 100644
--- a/internal/server/users.go
+++ b/internal/server/users.go
@@ -8,8 +8,6 @@ import (
 
 	"github.com/devilcove/boltdb"
 	"github.com/devilcove/plexus"
-	"github.com/gin-contrib/sessions"
-	"github.com/gin-gonic/gin"
 	"go.etcd.io/bbolt"
 	"golang.org/x/crypto/bcrypt"
 )
@@ -67,22 +65,24 @@ func hashPassword(password string) (string, error) {
 	return string(bytes), err
 }
 
-func getUsers(c *gin.Context) {
-	session := sessions.Default(c)
-	admin := session.Get("admin").(bool)
-	slog.Debug("getUsers", "admin", admin, "ad", session.Get("admin"), "visitor", session.Get("user"))
-	if !admin {
-		getCurrentUser(c)
+func getUsers(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
 		return
 	}
-	slog.Debug("getting uses", "admin", admin)
+	if !session.Admin {
+		getCurrentUser(w, r)
+		return
+	}
+	slog.Debug("getting users", "admin", session.Admin)
 	users, err := boltdb.GetAll[plexus.User](userTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	if len(users) == 0 {
-		processError(c, http.StatusFailedDependency, "no users")
+		processError(w, http.StatusFailedDependency, "no users")
 		return
 	}
 	returnedUsers := []plexus.User{}
@@ -90,137 +90,162 @@ func getUsers(c *gin.Context) {
 		user.Password = ""
 		returnedUsers = append(returnedUsers, user)
 	}
-	_ = session.Save()
-	c.HTML(http.StatusOK, "users", returnedUsers)
+	if err := session.Session.Save(r, w); err != nil {
+		slog.Error("save session", "error", err)
+	}
+	if err := templates.ExecuteTemplate(w, "users", returnedUsers); err != nil {
+		slog.Error("template execute", "template", "users", "data", returnedUsers, "error", err)
+	}
 }
 
-func getUser(c *gin.Context) {
-	session := sessions.Default(c)
-	visitor := session.Get("user").(string)
-	admin := session.Get("admin").(bool)
-	userToEdit := c.Param("name")
-	slog.Debug("getUser", "admin", admin, "visitor", visitor, "to edit", userToEdit)
-	if !admin && visitor != userToEdit {
-		processError(c, http.StatusUnauthorized, "you need to be an admin to edit other users")
+func getUser(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
+		return
+	}
+	userToEdit := r.PathValue("name")
+	slog.Debug(
+		"getUser",
+		"admin",
+		session.Admin,
+		"visitor",
+		session.UserName,
+		"to edit",
+		userToEdit,
+	)
+	if !session.Admin && session.UserName != userToEdit {
+		processError(w, http.StatusUnauthorized, "you need to be an admin to edit other users")
 		return
 	}
 	user, err := boltdb.Get[plexus.User](userToEdit, userTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	user.Password = ""
-	_ = session.Save()
-	c.HTML(http.StatusOK, "editUser", user)
+	if err := session.Session.Save(r, w); err != nil {
+		slog.Error("session save", "error", err)
+	}
+	if err := templates.ExecuteTemplate(w, "editUser", user); err != nil {
+		slog.Error("template execute", "template", "editUser", "data", user, "error", err)
+	}
 }
 
-func getCurrentUser(c *gin.Context) {
+func getCurrentUser(w http.ResponseWriter, r *http.Request) {
 	slog.Debug("get current user")
-	session := sessions.Default(c)
-	visitor := session.Get("user").(string)
-	user, err := boltdb.Get[plexus.User](visitor, userTable)
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
+		return
+	}
+	slog.Error("session", "session", session)
+	user, err := boltdb.Get[plexus.User](session.UserName, userTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, "no such user "+err.Error())
+		processError(w, http.StatusBadRequest, "no such user "+err.Error())
 		return
 	}
-	_ = session.Save()
-	c.HTML(http.StatusOK, "editUser", user)
+	if err := session.Session.Save(r, w); err != nil {
+		slog.Error("session save", "error", err)
+	}
+	if err := templates.ExecuteTemplate(w, "editUser", user); err != nil {
+		slog.Error("template execute", "template", "editUser", "data", user, "error", err)
+	}
 }
 
-func deleteUser(c *gin.Context) {
-	session := sessions.Default(c)
-	admin := session.Get("admin").(bool)
-	if !admin {
-		processError(c, http.StatusUnauthorized, "admin rights required")
+func deleteUser(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
+		return
+	}
+	if !session.Admin {
+		processError(w, http.StatusUnauthorized, "admin rights required")
 		return
 	}
-	user := c.Param("name")
+	user := r.PathValue("name")
 	if err := boltdb.Delete[plexus.User](user, userTable); err != nil {
-		processError(c, http.StatusFailedDependency, err.Error())
+		processError(w, http.StatusNotFound, err.Error())
 		return
 	}
-	getUsers(c)
+	getUsers(w, r)
 }
 
-func displayAddUser(c *gin.Context) {
-	session := sessions.Default(c)
-	if !session.Get("admin").(bool) {
-		processError(c, http.StatusUnauthorized, "admin rights required")
+func displayAddUser(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if !session.Admin {
+		processError(w, http.StatusUnauthorized, "admin rights required")
 		return
 	}
-	c.HTML(http.StatusOK, "newUser", nil)
+	if err := templates.ExecuteTemplate(w, "newUser", nil); err != nil {
+		slog.Error("template execute", "template", "newUser", "data", "nil", "error", err)
+	}
 }
 
-func addUser(c *gin.Context) {
-	input := struct {
-		Username string
-		Password string
-		Admin    string
-	}{}
-	session := sessions.Default(c)
-	if !session.Get("admin").(bool) {
-		processError(c, http.StatusUnauthorized, "admin rights required")
+func addUser(w http.ResponseWriter, r *http.Request) {
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
 		return
 	}
-	if err := c.Bind(&input); err != nil {
-		processError(c, http.StatusBadRequest, "invalid user data")
+	if !session.Admin {
+		processError(w, http.StatusUnauthorized, "admin rights required")
 		return
 	}
-	password, err := hashPassword(input.Password)
+	user := plexus.User{
+		Username: r.FormValue("username"),
+	}
+	password, err := hashPassword(r.FormValue("password"))
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	user := plexus.User{
-		Username: input.Username,
-		Password: password,
-		Updated:  time.Now(),
-	}
-	if input.Admin == "on" {
+	user.Password = password
+	if r.FormValue("admin") == "on" {
 		user.IsAdmin = true
 	}
 	if _, err := boltdb.Get[plexus.User](user.Username, userTable); err == nil {
-		processError(c, http.StatusBadRequest, "user exists")
+		processError(w, http.StatusBadRequest, "user exists")
 		return
 	}
-	slog.Debug("saving new user", "user", user)
-	if err := boltdb.Save(user, input.Username, userTable); err != nil {
-		processError(c, http.StatusInternalServerError, "unable to save user "+err.Error())
+	slog.Info("saving new user", "user", user)
+	if err := boltdb.Save(user, user.Username, userTable); err != nil {
+		processError(w, http.StatusInternalServerError, "unable to save user "+err.Error())
 		return
 	}
-	getUsers(c)
+	getUsers(w, r)
 }
 
-func editUser(c *gin.Context) {
-	input := struct {
-		Password string
-	}{}
-	if err := c.Bind(&input); err != nil {
-		processError(c, http.StatusBadRequest, "invalid user data")
+func editUser(w http.ResponseWriter, r *http.Request) {
+	input := r.FormValue("password")
+	if input == "" {
+		processError(w, http.StatusBadRequest, "blank password")
+		return
+	}
+	session := GetSession(w, r)
+	if session == nil {
+		displayLogin(w, r)
 		return
 	}
-	session := sessions.Default(c)
-	admin := session.Get("admin").(bool)
-	visitor := session.Get("user").(string)
-	userToEdit := c.Param("name")
-	if !admin && visitor != userToEdit {
-		processError(c, http.StatusUnauthorized, "admin right required to update other users")
+	userToEdit := r.PathValue("name")
+	if !session.Admin && session.UserName != userToEdit {
+		processError(w, http.StatusUnauthorized, "admin rights required to update other users")
 		return
 	}
 	user, err := boltdb.Get[plexus.User](userToEdit, userTable)
 	if err != nil {
-		processError(c, http.StatusBadRequest, err.Error())
+		processError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	password, err := hashPassword(input.Password)
+	password, err := hashPassword(input)
 	if err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
 	user.Password = password
 	if err := boltdb.Save(user, user.Username, userTable); err != nil {
-		processError(c, http.StatusInternalServerError, err.Error())
+		processError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	getUsers(c)
+	getUsers(w, r)
 }
diff --git a/internal/server/users_test.go b/internal/server/users_test.go
new file mode 100644
index 0000000..fdb2129
--- /dev/null
+++ b/internal/server/users_test.go
@@ -0,0 +1,268 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+	"github.com/devilcove/plexus"
+)
+
+func TestGetUsers(t *testing.T) {
+	deleteAllUsers(t)
+	admin := plexus.User{Username: "admin", Password: "pass", IsAdmin: true}
+	user := plexus.User{Username: "test", Password: "pass", IsAdmin: false}
+	createTestUser(t, admin)
+	createTestUser(t, user)
+
+	t.Run("admin", func(t *testing.T) {
+		cookie := testLogin(t, admin)
+		r := httptest.NewRequest(http.MethodGet, "/users/", nil)
+		r.AddCookie(cookie)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		t.Log(w.Result())
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Authorized Users</h1>")
+	})
+
+	t.Run("user", func(t *testing.T) {
+		cookie := testLogin(t, user)
+		r := httptest.NewRequest(http.MethodGet, "/users/", nil)
+		r.AddCookie(cookie)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Edit User</h1>")
+	})
+}
+
+func TestGetUser(t *testing.T) {
+	deleteAllUsers(t)
+	admin := plexus.User{Username: "admin", Password: "pass", IsAdmin: true}
+	user := plexus.User{Username: "test", Password: "pass", IsAdmin: false}
+	createTestUser(t, admin)
+	createTestUser(t, user)
+
+	t.Run("nosuchuser", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/users/user/user", nil)
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "no results found")
+	})
+
+	t.Run("user", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/users/user/admin", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusUnauthorized)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "need to be an admin to edit other users")
+	})
+
+	t.Run("admin", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/users/user/test", nil)
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Edit User</h1>")
+	})
+}
+
+func TestAddUser(t *testing.T) {
+	deleteAllUsers(t)
+	admin := plexus.User{Username: "admin", Password: "pass", IsAdmin: true}
+	user := plexus.User{Username: "test", Password: "pass", IsAdmin: false}
+	createTestUser(t, admin)
+	createTestUser(t, user)
+
+	t.Run("displayAsUser", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/users/add", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusUnauthorized)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "admin rights required")
+	})
+
+	t.Run("displayAsAdmin", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/users/add", nil)
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>New User</h1>")
+	})
+
+	t.Run("addAsUser", func(t *testing.T) {
+		payload := bodyParams("username", "test2", "password", "pass")
+		r := httptest.NewRequest(http.MethodPost, "/users/add", payload)
+		r.AddCookie(testLogin(t, user))
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusUnauthorized)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "admin rights required")
+	})
+
+	t.Run("addAsAdmin", func(t *testing.T) {
+		payload := bodyParams("username", "test2", "password", "pass")
+		r := httptest.NewRequest(http.MethodPost, "/users/add", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Authorized Users</h1>")
+	})
+
+	t.Run("userExists", func(t *testing.T) {
+		payload := bodyParams("username", "test2", "password", "pass", "admin", "on")
+		r := httptest.NewRequest(http.MethodPost, "/users/add", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "user exists")
+	})
+}
+
+func TestDeleteUser(t *testing.T) {
+	deleteAllUsers(t)
+	admin := plexus.User{Username: "admin", Password: "pass", IsAdmin: true}
+	user := plexus.User{Username: "test", Password: "pass", IsAdmin: false}
+	createTestUser(t, admin)
+	createTestUser(t, user)
+
+	t.Run("AsUser", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/users/admin", nil)
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusUnauthorized)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "admin rights required")
+	})
+
+	t.Run("NoSuchUser", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/users/notexit", nil)
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusNotFound)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "no results found")
+	})
+
+	t.Run("valid", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodDelete, "/users/test", nil)
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Authorized Users</h1>")
+	})
+}
+
+func TestEditUser(t *testing.T) {
+	deleteAllUsers(t)
+	admin := plexus.User{Username: "admin", Password: "pass", IsAdmin: true}
+	user := plexus.User{Username: "test", Password: "pass", IsAdmin: false}
+	createTestUser(t, admin)
+	createTestUser(t, user)
+
+	t.Run("AsUserForOther", func(t *testing.T) {
+		payload := bodyParams("password", "newpass")
+		r := httptest.NewRequest(http.MethodPost, "/users/user/admin", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusUnauthorized)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "admin rights required")
+	})
+
+	t.Run("AsUser", func(t *testing.T) {
+		payload := bodyParams("password", "newpass")
+		r := httptest.NewRequest(http.MethodPost, "/users/user/test", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, user))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Edit User</h1>")
+	})
+
+	t.Run("blankPass", func(t *testing.T) {
+		payload := bodyParams("password", "")
+		r := httptest.NewRequest(http.MethodPost, "/users/user/test", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "blank password")
+	})
+
+	t.Run("AsAdmin", func(t *testing.T) {
+		payload := bodyParams("password", "newpass")
+		r := httptest.NewRequest(http.MethodPost, "/users/user/test", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusOK)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "<h1>Authorized Users</h1>")
+	})
+
+	t.Run("NoSuchUser", func(t *testing.T) {
+		payload := bodyParams("password", "newpass")
+		r := httptest.NewRequest(http.MethodPost, "/users/user/notexist", payload)
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.AddCookie(testLogin(t, admin))
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, r)
+		should.BeEqual(t, w.Result().StatusCode, http.StatusBadRequest)
+		body, err := io.ReadAll(w.Result().Body)
+		should.NotBeError(t, err)
+		should.ContainSubstring(t, string(body), "no results found")
+	})
+}
diff --git a/log_test.go b/log_test.go
new file mode 100644
index 0000000..c860559
--- /dev/null
+++ b/log_test.go
@@ -0,0 +1,35 @@
+package plexus_test
+
+import (
+	"testing"
+
+	"github.com/devilcove/plexus"
+)
+
+func TestSetLogging(t *testing.T) {
+	tests := []struct {
+		name string // description of this test case
+		// Named input parameters for target function.
+	}{
+		{
+			name: "debug",
+		},
+		{
+			name: "info",
+		},
+		{
+			name: "warn",
+		},
+		{
+			name: "error",
+		},
+		{
+			name: "junk",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(_ *testing.T) {
+			plexus.SetLogging(tt.name)
+		})
+	}
+}
diff --git a/models_test.go b/models_test.go
new file mode 100644
index 0000000..00bdf42
--- /dev/null
+++ b/models_test.go
@@ -0,0 +1,36 @@
+package plexus
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/Kairum-Labs/should"
+)
+
+func TestDecodeToken(t *testing.T) {
+	t.Run("badEncoding", func(t *testing.T) {
+		value, err := DecodeToken("bad")
+		var expectedErr base64.CorruptInputError
+		should.BeEqual(t, true, errors.As(err, &expectedErr))
+		should.BeEqual(t, value, KeyValue{})
+	})
+	t.Run("bad", func(t *testing.T) {
+		value, err := DecodeToken(base64.StdEncoding.EncodeToString([]byte("bad")))
+		should.ContainSubstring(t, err.Error(), "invalid character")
+		should.BeEqual(t, value, KeyValue{})
+	})
+	t.Run("good", func(t *testing.T) {
+		value := KeyValue{
+			URL:     "example.com",
+			Seed:    "seed",
+			KeyName: "testing",
+		}
+		payload, err := json.Marshal(&value)
+		should.NotBeError(t, err)
+		keyValue, err := DecodeToken(base64.StdEncoding.EncodeToString(payload))
+		should.NotBeError(t, err)
+		should.BeEqual(t, keyValue, value)
+	})
+}
diff --git a/scripts/install-agent.sh b/scripts/install-agent.sh
index 83894f7..e5a8b7c 100755
--- a/scripts/install-agent.sh
+++ b/scripts/install-agent.sh
@@ -15,12 +15,13 @@ useradd -r -d /var/lib/plexus -s /sbin/nologin -m plexus
 
 ##get files
 echo "installing files"
-wget https://raw.githubusercontent.com/devilcove/plexus/master/files/plexus-agent.service -O /lib/systemd/system/plexus-agent.service
-wget https://github.com/devilcove/plexus/releases/latest/download/plexus-agent-linux-amd64 -O /usr/local/bin/plexus-agent
+wget -4 https://raw.githubusercontent.com/devilcove/plexus/master/files/plexus-agent.service -O /lib/systemd/system/plexus-agent.service
+wget -4 https://file.nusak.ca/plexus/plexus-agent -O /usr/local/bin/plexus-agent
 setcap cap_net_admin=ep /usr/local/bin/plexus-agent
 chmod +x /usr/local/bin/plexus-agent
-mkdir /etc/plexus-agent
-chown plexus:plexus /etc/plexus-agent
+install -o plexus -g plexus -d /var/lib/plexus/.local/share/plexus-agent
+cd /var/lib/plexus
+chown -R plexus:plexus .local/share/
 
 echo "installing systemd service"
 systemctl daemon-reload
diff --git a/scripts/install-server.sh b/scripts/install-server.sh
index 1fb2451..dce31c3 100755
--- a/scripts/install-server.sh
+++ b/scripts/install-server.sh
@@ -23,18 +23,20 @@ useradd -r -d /var/lib/plexus -G systemd-journal -s /sbin/nologin -m plexus
 
 ##get files
 echo "installing files"
-wget https://raw.githubusercontent.com/devilcove/plexus/master/files/plexus-agent.service -O /lib/systemd/system/plexus-agent.service
-wget https://github.com/devilcove/plexus/releases/latest/download/plexus-agent-linux-amd64 -O /usr/local/bin/plexus-agent
-wget https://raw.githubusercontent.com/devilcove/plexus/master/files/plexus-server.service -O /lib/systemd/system/plexus-server.service
-wget https://github.com/devilcove/plexus/releases/latest/download/plexus-server-linux-amd64 -O /usr/local/bin/plexus-server
+wget -4 https://raw.githubusercontent.com/devilcove/plexus/master/files/plexus-agent.service -O /lib/systemd/system/plexus-agent.service
+wget -4 https://file.nusak.ca/plexus/plexus-agent -O /usr/local/bin/plexus-agent
+wget -4 https://raw.githubusercontent.com/devilcove/plexus/master/files/plexus-server.service -O /lib/systemd/system/plexus-server.service
+wget -4 https://file.nusak.ca/plexus/plexus-server -O /usr/local/bin/plexus-server
 setcap cap_net_admin=ep /usr/local/bin/plexus-agent
 setcap cap_net_bind_service=ep /usr/local/bin/plexus-server
 chmod +x /usr/local/bin/plexus-agent
 chmod +x /usr/local/bin/plexus-server
-mkdir /etc/plexus
-chown plexus:plexus /etc/plexus
-mkdir /etc/plexus-agent
-chown plexus:plexus /etc/plexus-agent
+install -o plexus -g plexus -d /var/lib/plexus/.config/plexus-server
+install -o plexus -g plexus -d /var/lib/plexus/.local/share/plexus-server
+install -o plexus -g plexus -d /var/lib/plexus/.local/share/plexus-agent
+cd /var/lib/plexus
+chown plexus:plexus .config
+chown -R plexus:plexus .local/share/
 
 #get input
 echo "Enter Fully Qualified Domain Name of plexus server (eg. plexus.example.com)"
@@ -52,13 +54,16 @@ do
     get_passwd
 done
 
-cat << EOF > /etc/plexus/config
+cat << EOF > /tmp/plexus.config
 fqdn: $fqdn
 email: $email
 adminname: $user
 adminpass: $pass1
+secure: true
 EOF
 
+install -o plexus -g plexus -D /tmp/plexus.config /var/lib/plexus/.config/plexus-server/config
+
 set +e
 echo "installing systemd service"
 systemctl daemon-reload
@@ -71,4 +76,4 @@ systemctl status plexus-agent --no-pager -l
 
 echo ""
 echo "plexus-agent and plexus-server are installed"
-echo "log into the server at https://$fqdn"
\ No newline at end of file
+echo "log into the server at https://$fqdn"
diff --git a/scripts/uninstall-agent.sh b/scripts/uninstall-agent.sh
index 1f74ce6..c99485e 100755
--- a/scripts/uninstall-agent.sh
+++ b/scripts/uninstall-agent.sh
@@ -14,7 +14,6 @@ systemctl daemon-reload
 echo "deleting files"
 rm /usr/local/bin/plexus-agent
 rm -r /var/lib/plexus
-rm -r /etc/plexus-agent
 
 echo "deleting plexus user"
-userdel plexus
+userdel --remove plexus
diff --git a/scripts/uninstall-server.sh b/scripts/uninstall-server.sh
index e6a9ebb..0b4afcc 100755
--- a/scripts/uninstall-server.sh
+++ b/scripts/uninstall-server.sh
@@ -18,9 +18,6 @@ systemctl daemon-reload
 echo "deleting files"
 rm /usr/local/bin/plexus-agent
 rm /usr/local/bin/plexus-server
-rm -r /var/lib/plexus
-rm -r /etc/plexus
-rm -r /etc/plexus-agent
 
 echo "deleting plexus user"
-userdel plexus
+userdel --remove plexus
diff --git a/scripts/update-agent.sh b/scripts/update-agent.sh
index 99037d0..6fd2d4f 100755
--- a/scripts/update-agent.sh
+++ b/scripts/update-agent.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
 systemctl stop plexus-agent
-wget https://github.com/devilcove/plexus/releases/latest/download/plexus-agent-linux-amd64 -O /usr/local/bin/plexus-agent
+wget -4 https://file.nusak.ca/plexus/plexus-agent -O /usr/local/bin/plexus-agent
 setcap cap_net_admin=ep /usr/local/bin/plexus-agent
 systemctl start plexus-agent
\ No newline at end of file
diff --git a/scripts/update-server.sh b/scripts/update-server.sh
index 9432c2f..87e4cf0 100755
--- a/scripts/update-server.sh
+++ b/scripts/update-server.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
 systemctl stop plexus-server
-wget https://github.com/devilcove/plexus/releases/latest/download/plexus-server-linux-amd64 -O /usr/local/bin/plexus-server
+wget https://file.nusak.ca/plexus/plexus-server -O /usr/local/bin/plexus-server
 setcap cap_net_bind_service=ep /usr/local/bin/plexus-server
 systemctl start plexus-server
\ No newline at end of file
diff --git a/scripts/update.sh b/scripts/update.sh
index 08f6ed1..8412d8c 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -1,10 +1,10 @@
 #!/bin/bash
 #
-cd ~/plexus/app/plexus-server || exit
-CGO_ENABLED=0 go build -ldflags "-s -w" -o /tmp/plexus-server-linux-amd64 .
-cd ~/plexus/app/plexus-agent || exit
-CCG_ENABLED=0 go build -ldflags "-s -w" -o /tmp/plexus-agent-linux-amd64 .
-#cd /tmp || exit
-#scp plexus-server root@file.nusak.ca:/srv/http
-#scp plexus-agent root@file.nusak.ca:/srv/http
+cd ~/sandbox/plexus/app/plexus-server || exit
+CGO_ENABLED=0 go build -ldflags "-s -w" -v -o /tmp/plexus-server .
+cd ~/sandbox/plexus/app/plexus-agent || exit
+CCG_ENABLED=0 go build -ldflags "-s -w" -v -o /tmp/plexus-agent .
+cd /tmp || exit
+scp plexus-server file.nusak.ca:/srv/http/plexus/plexus-server
+scp plexus-agent file.nusak.ca:/srv/http/plexus/plexus-agent
 
diff --git a/wireguard.go b/wireguard.go
index 31bcb87..5110dc2 100644
--- a/wireguard.go
+++ b/wireguard.go
@@ -174,7 +174,12 @@ func convertPeers(input []wgtypes.Peer) []wgtypes.PeerConfig {
 }
 
 func (wg *Wireguard) ReplacePeer(newPeer wgtypes.PeerConfig) {
-	slog.Debug("replacing wg peer", "key", newPeer.PublicKey, "allowed", newPeer.AllowedIPs, "endpoint", newPeer.Endpoint)
+	slog.Debug(
+		"replacing wg peer",
+		"key", newPeer.PublicKey,
+		"allowed", newPeer.AllowedIPs,
+		"endpoint", newPeer.Endpoint,
+	)
 	for i, peer := range wg.Config.Peers {
 		if peer.PublicKey != newPeer.PublicKey {
 			continue
diff --git a/wireguard_test.go b/wireguard_test.go
index 355f5eb..f5b9a18 100644
--- a/wireguard_test.go
+++ b/wireguard_test.go
@@ -13,15 +13,21 @@ import (
 
 func TestNew(t *testing.T) {
 	user, err := user.Current()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	if user.Uid != "0" {
 		t.Log("this test must be run as root")
 		t.Skip()
 	}
 	key, err := wgtypes.GeneratePrivateKey()
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
 	peerKey, err := wgtypes.ParseKey("uREcerxMksoD3K0dy1ciJDRGzGCJ8jvIzJ5r9jWApXY=")
-	should.BeNil(t, err)
+	should.NotBeError(t, err)
+	key2, err := wgtypes.GeneratePrivateKey()
+	should.NotBeError(t, err)
+	peer2Key := key2.PublicKey()
+	key3, err := wgtypes.GeneratePrivateKey()
+	should.NotBeError(t, err)
+	peer3Key := key3.PublicKey()
 	port := 51820
 	keepalive := time.Second * 25
 	config := wgtypes.Config{
@@ -44,6 +50,21 @@ func TestNew(t *testing.T) {
 				},
 				PersistentKeepaliveInterval: &keepalive,
 			},
+			{
+				PublicKey:         peer2Key,
+				ReplaceAllowedIPs: true,
+				AllowedIPs: []net.IPNet{
+					{
+						IP:   net.ParseIP("10.100.10.3"),
+						Mask: net.CIDRMask(32, 32),
+					},
+				},
+				Endpoint: &net.UDPAddr{
+					IP:   net.ParseIP("8.8.8.9"),
+					Port: 51820,
+				},
+				PersistentKeepaliveInterval: &keepalive,
+			},
 		},
 	}
 	address := netlink.Addr{
@@ -52,18 +73,112 @@ func TestNew(t *testing.T) {
 			Mask: net.CIDRMask(24, 32),
 		},
 	}
-	wg := New("wgtest", 1420, address, config)
-	should.BeEqual(t, wg.Attrs().Name, "wgtest")
-	should.BeEqual(t, wg.Attrs().MTU, 1420)
-	err = wg.Up()
-	should.BeNil(t, err)
-	should.BeEqual(t, wg.Type(), "wireguard")
-	link, err := netlink.LinkByName(wg.Name)
-	should.BeNil(t, err)
-	should.BeEqual(t, wg.Attrs().Index, link.Attrs().Index)
-	routes, err := netlink.RouteGet(net.ParseIP("10.100.10.10"))
-	should.BeNil(t, err)
-	should.BeEqual(t, routes[0].LinkIndex, wg.Attrs().Index)
-	err = wg.Down()
-	should.BeNil(t, err)
+	newPeer := wgtypes.PeerConfig{
+		PublicKey: peer3Key,
+		Endpoint: &net.UDPAddr{
+			IP:   net.ParseIP("8.8.8.10"),
+			Port: 51820,
+		},
+		ReplaceAllowedIPs: true,
+		AllowedIPs: []net.IPNet{
+			{
+				IP:   net.ParseIP("10.100.10.4"),
+				Mask: net.CIDRMask(32, 32),
+			},
+			{
+				IP:   net.ParseIP("10.200.10.1"),
+				Mask: net.CIDRMask(32, 32),
+			},
+		},
+	}
+	t.Run("new", func(t *testing.T) {
+		wg := New("wgtest", 1420, address, config)
+		should.BeEqual(t, wg.Attrs().Name, "wgtest")
+		should.BeEqual(t, wg.Attrs().MTU, 1420)
+		should.BeEqual(t, len(wg.Config.Peers), 2)
+		err = wg.Up()
+		should.NotBeError(t, err)
+		should.BeEqual(t, wg.Type(), "wireguard")
+		link, err := netlink.LinkByName(wg.Name)
+		should.NotBeError(t, err)
+		should.BeEqual(t, wg.Attrs().Index, link.Attrs().Index)
+		routes, err := netlink.RouteGet(net.ParseIP("10.100.10.10"))
+		should.NotBeError(t, err)
+		should.BeEqual(t, routes[0].LinkIndex, wg.Attrs().Index)
+		device, err := GetDevice("wgtest")
+		should.NotBeError(t, err)
+		should.BeEqual(t, device.Name, "wgtest")
+		should.BeEqual(t, device.Type, wgtypes.LinuxKernel)
+		should.BeEqual(t, len(device.Peers), 2)
+		wg, err = Get("wgtest")
+		should.NotBeError(t, err)
+		should.BeEqual(t, wg.Name, "wgtest")
+		should.BeEqual(t, len(wg.Config.Peers), 2)
+	})
+	// Peers
+	t.Run("addPeer", func(t *testing.T) {
+		wg, err := Get("wgtest")
+		should.NotBeError(t, err)
+		should.BeEqual(t, len(wg.Config.Peers), 2)
+		wg.AddPeer(newPeer)
+		err = wg.Apply()
+		should.NotBeError(t, err)
+		device, err := GetDevice("wgtest")
+		should.NotBeError(t, err)
+		should.BeEqual(t, len(device.Peers), 3)
+	})
+	t.Run("replacePeer", func(t *testing.T) {
+		newPeer.Endpoint = &net.UDPAddr{
+			IP:   net.ParseIP("8.8.8.20"),
+			Port: 51821,
+		}
+		wg, err := Get("wgtest")
+		should.NotBeError(t, err)
+		wg.ReplacePeer(newPeer)
+		err = wg.Apply()
+		should.NotBeError(t, err)
+		device, err := GetDevice("wgtest")
+		should.NotBeError(t, err)
+		should.BeEqual(t, len(device.Peers), 3)
+		found := false
+		for _, peer := range wg.Config.Peers {
+			if peer.PublicKey == newPeer.PublicKey {
+				found = true
+				should.BeEqual(t, peer.Endpoint, newPeer.Endpoint)
+			}
+		}
+		should.BeTrue(t, found)
+	})
+	t.Run("deletePeer", func(t *testing.T) {
+		wg, err := Get("wgtest")
+		should.NotBeError(t, err)
+		t.Log(key2.PublicKey())
+		wg.DeletePeer(key2.PublicKey().String())
+		err = wg.Apply()
+		should.NotBeError(t, err)
+		device, err := GetDevice("wgtest")
+		should.NotBeError(t, err)
+		should.BeEqual(t, len(device.Peers), 2)
+	})
+
+	// shutdown
+	t.Run("shutdown", func(t *testing.T) {
+		wg, err := Get("wgtest")
+		should.NotBeError(t, err)
+		err = wg.Down()
+		should.NotBeError(t, err)
+	})
+}
+
+func TestGet(t *testing.T) {
+	t.Run("noSuchDevice", func(t *testing.T) {
+		device, err := GetDevice("doesnotexist")
+		should.BeNil(t, device)
+		should.BeError(t, err)
+	})
+	t.Run("noSuchInterface", func(t *testing.T) {
+		wg, err := Get("doesnotexist")
+		should.BeNil(t, wg)
+		should.BeError(t, err)
+	})
 }