feat: Tailscale sync jobs

Adds a background job system that polls the Tailscale API on a configurable
interval and syncs tailscale status and IPs to instances by hostname match.

- New config table (key/value) in SQLite for persistent server-side settings
- New server/jobs.js: runTailscaleSync + restartJobs scheduler
- GET/PUT /api/config — read and write Tailscale settings; API key masked as **REDACTED** on GET
- POST /api/jobs/tailscale/run — immediate manual sync
- Settings modal: new Tailscale Sync section with enable toggle, tailnet, API key, poll interval, Save + Run Now buttons, last-run status

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/db.js

@@ -53,6 +53,11 @@ function createSchema() {
       changed_at TEXT    NOT NULL DEFAULT (datetime('now'))
     );
     CREATE INDEX IF NOT EXISTS idx_history_vmid ON instance_history(vmid);
+
+    CREATE TABLE IF NOT EXISTS config (
+      key   TEXT PRIMARY KEY,
+      value TEXT NOT NULL DEFAULT ''
+    );
   `);
 }
 
@@ -187,6 +192,18 @@ export function getAllHistory() {
   return db.prepare('SELECT * FROM instance_history ORDER BY vmid, changed_at').all();
 }
 
+export function getConfig(key, defaultVal = '') {
+  const row = db.prepare('SELECT value FROM config WHERE key = ?').get(key);
+  return row ? row.value : defaultVal;
+}
+
+export function setConfig(key, value) {
+  db.prepare(
+    `INSERT INTO config (key, value) VALUES (?, ?)
+     ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+  ).run(key, String(value));
+}
+
 // ── Test helpers ──────────────────────────────────────────────────────────────
 
 export function _resetForTest() {

server/jobs.js

@@ -0,0 +1,63 @@
+import { getInstances, updateInstance, getConfig, setConfig } from './db.js';
+
+const TAILSCALE_API = 'https://api.tailscale.com/api/v2';
+
+let _interval = null;
+
+export async function runTailscaleSync() {
+  const apiKey  = getConfig('tailscale_api_key');
+  const tailnet = getConfig('tailscale_tailnet');
+  if (!apiKey || !tailnet) throw new Error('Tailscale not configured');
+
+  const res = await fetch(
+    `${TAILSCALE_API}/tailnet/${encodeURIComponent(tailnet)}/devices`,
+    { headers: { Authorization: `Bearer ${apiKey}` } }
+  );
+  if (!res.ok) throw new Error(`Tailscale API ${res.status}`);
+
+  const { devices } = await res.json();
+
+  // hostname -> first 100.x.x.x address
+  const tsMap = new Map(
+    devices.map(d => [d.hostname, (d.addresses ?? []).find(a => a.startsWith('100.')) ?? ''])
+  );
+
+  const instances = getInstances();
+  let updated = 0;
+
+  for (const inst of instances) {
+    const tsIp   = tsMap.get(inst.name);   // undefined = not in Tailscale
+    const matched = tsIp !== undefined;
+
+    const newTailscale = matched ? 1 : (inst.tailscale === 1 ? 0 : inst.tailscale);
+    const newIp        = matched ? tsIp : (inst.tailscale === 1 ? '' : inst.tailscale_ip);
+
+    if (newTailscale !== inst.tailscale || newIp !== inst.tailscale_ip) {
+      // Strip db-generated columns — node:sqlite rejects unknown named parameters
+      const { id: _id, created_at: _ca, updated_at: _ua, ...instData } = inst;
+      updateInstance(inst.vmid, { ...instData, tailscale: newTailscale, tailscale_ip: newIp });
+      updated++;
+    }
+  }
+
+  return { updated, total: instances.length };
+}
+
+export function restartJobs() {
+  if (_interval) { clearInterval(_interval); _interval = null; }
+  if (getConfig('tailscale_enabled') !== '1') return;
+
+  const mins = parseInt(getConfig('tailscale_poll_minutes', '15'), 10);
+  const ms   = Math.max(1, Number.isFinite(mins) ? mins : 15) * 60_000;
+
+  _interval = setInterval(async () => {
+    try {
+      const r = await runTailscaleSync();
+      setConfig('tailscale_last_run_at', new Date().toISOString());
+      setConfig('tailscale_last_result', `ok: ${r.updated} updated of ${r.total}`);
+    } catch (e) {
+      setConfig('tailscale_last_run_at', new Date().toISOString());
+      setConfig('tailscale_last_result', `error: ${e.message}`);
+    }
+  }, ms);
+}

server/routes.js

@@ -2,7 +2,9 @@ import { Router } from 'express';
 import {
   getInstances, getInstance, getDistinctStacks,
   createInstance, updateInstance, deleteInstance, importInstances, getInstanceHistory, getAllHistory,
+  getConfig, setConfig,
 } from './db.js';
+import { runTailscaleSync, restartJobs } from './jobs.js';
 
 export const router = Router();
 
@@ -12,6 +14,12 @@ const VALID_STATES  = ['deployed', 'testing', 'degraded'];
 const VALID_STACKS  = ['production', 'development'];
 const SERVICE_KEYS  = ['atlas', 'argus', 'semaphore', 'patchmon', 'tailscale', 'andromeda'];
 
+const CONFIG_KEYS = [
+  'tailscale_api_key', 'tailscale_tailnet', 'tailscale_poll_minutes',
+  'tailscale_enabled', 'tailscale_last_run_at', 'tailscale_last_result',
+];
+const REDACTED = '**REDACTED**';
+
 function validate(body) {
   const errors = [];
   if (!body.name || typeof body.name !== 'string' || !body.name.trim())
@@ -160,3 +168,38 @@ router.delete('/instances/:vmid', (req, res) => {
     handleDbError('DELETE /api/instances/:vmid', e, res);
   }
 });
+
+// GET /api/config
+router.get('/config', (_req, res) => {
+  const cfg = {};
+  for (const key of CONFIG_KEYS) {
+    const val = getConfig(key);
+    cfg[key] = (key === 'tailscale_api_key' && val) ? REDACTED : val;
+  }
+  res.json(cfg);
+});
+
+// PUT /api/config
+router.put('/config', (req, res) => {
+  for (const key of CONFIG_KEYS) {
+    if (!(key in (req.body ?? {}))) continue;
+    if (key === 'tailscale_api_key' && req.body[key] === REDACTED) continue;
+    setConfig(key, req.body[key]);
+  }
+  try { restartJobs(); } catch (e) { console.error('PUT /api/config restartJobs', e); }
+  res.json({ ok: true });
+});
+
+// POST /api/jobs/tailscale/run
+router.post('/jobs/tailscale/run', async (req, res) => {
+  if (!getConfig('tailscale_api_key') || !getConfig('tailscale_tailnet'))
+    return res.status(400).json({ error: 'Tailscale not configured' });
+  try {
+    const result = await runTailscaleSync();
+    setConfig('tailscale_last_run_at', new Date().toISOString());
+    setConfig('tailscale_last_result', `ok: ${result.updated} updated of ${result.total}`);
+    res.json(result);
+  } catch (e) {
+    handleDbError('POST /api/jobs/tailscale/run', e, res);
+  }
+});

server/server.js

@@ -3,6 +3,7 @@ import helmet from 'helmet';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { router } from './routes.js';
+import { restartJobs } from './jobs.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PORT = process.env.PORT ?? 3000;
@@ -47,5 +48,6 @@ app.use((err, _req, res, _next) => {
 
 // Boot — only when run directly, not when imported by tests
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  restartJobs();
   app.listen(PORT, () => console.log(`catalyst on :${PORT}`));
 }