Do not explicitly set the protocols when ommited in ACL

2025-08-22 05:40:53 +00:00 · 2022-12-05 19:12:33 +00:00
39 changed files with 1281 additions and 2555 deletions
--- a/.github/workflows/test-integration-v2-kradalby.yml
+++ b/.github/workflows/test-integration-v2-kradalby.yml
@@ -22,14 +22,6 @@ jobs:
            integration_test/
            config-example.yaml

-      # We currently only run one job at the time, so make sure
-      # we just wipe all containers and all networks.
-      - name: Clean up Docker
-        if: steps.changed-files.outputs.any_changed == 'true'
-        run: |
-          docker kill $(docker ps -q)
-          docker network prune -f
-
      - name: Run general integration tests
        if: steps.changed-files.outputs.any_changed == 'true'
        run: nix develop --command -- make test_integration_v2_general
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,19 +1,10 @@
 # CHANGELOG

-## 0.18.x (2022-xx-xx)
-
-### Changes
-
- Reworked routing and added support for subnet router failover [#1024](https://github.com/juanfont/headscale/pull/1024)
- Added an OIDC AllowGroups Configuration options and authorization check [#1041](https://github.com/juanfont/headscale/pull/1041)
- Set `db_ssl` to false by default [#1052](https://github.com/juanfont/headscale/pull/1052)
-
-## 0.17.1 (2022-12-05)
+## 0.17.1 (2022-x-x)

 ### Changes

 - Correct typo on macOS standalone profile link [#1028](https://github.com/juanfont/headscale/pull/1028)
- Update platform docs with Fast User Switching [#1016](https://github.com/juanfont/headscale/pull/1016)

 ## 0.17.0 (2022-11-26)

--- a/README.md
+++ b/README.md
@@ -299,13 +299,6 @@ make build
            <sub style="font-size:14px"><b>Azz</b></sub>
        </a>
    </td>
-    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
-        <a href=https://github.com/evenh>
-            <img src=https://avatars.githubusercontent.com/u/2701536?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Even Holthe/>
-            <br />
-            <sub style="font-size:14px"><b>Even Holthe</b></sub>
-        </a>
-    </td>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/qbit>
            <img src=https://avatars.githubusercontent.com/u/68368?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Aaron Bieber/>
@@ -334,8 +327,6 @@ make build
            <sub style="font-size:14px"><b>Fernando De Lucchi</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/OrvilleQ>
            <img src=https://avatars.githubusercontent.com/u/21377465?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Orville Q. Song/>
@@ -343,6 +334,8 @@ make build
            <sub style="font-size:14px"><b>Orville Q. Song</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/hdhoang>
            <img src=https://avatars.githubusercontent.com/u/12537?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=hdhoang/>
@@ -378,8 +371,6 @@ make build
            <sub style="font-size:14px"><b>ChibangLW</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/mevansam>
            <img src=https://avatars.githubusercontent.com/u/403630?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Mevan Samaratunga/>
@@ -387,6 +378,8 @@ make build
            <sub style="font-size:14px"><b>Mevan Samaratunga</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/dragetd>
            <img src=https://avatars.githubusercontent.com/u/3639577?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Michael G./>
@@ -422,8 +415,6 @@ make build
            <sub style="font-size:14px"><b>kevinlin</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/artemklevtsov>
            <img src=https://avatars.githubusercontent.com/u/603798?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Artem Klevtsov/>
@@ -431,6 +422,8 @@ make build
            <sub style="font-size:14px"><b>Artem Klevtsov</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/cmars>
            <img src=https://avatars.githubusercontent.com/u/23741?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Casey Marshall/>
@@ -466,8 +459,6 @@ make build
            <sub style="font-size:14px"><b>Steven Honson</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/ratsclub>
            <img src=https://avatars.githubusercontent.com/u/25647735?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Victor Freire/>
@@ -475,6 +466,8 @@ make build
            <sub style="font-size:14px"><b>Victor Freire</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/lachy2849>
            <img src=https://avatars.githubusercontent.com/u/98844035?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=lachy2849/>
@@ -510,8 +503,6 @@ make build
            <sub style="font-size:14px"><b>Antoine POPINEAU</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/aofei>
            <img src=https://avatars.githubusercontent.com/u/5037285?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Aofei Sheng/>
@@ -519,6 +510,8 @@ make build
            <sub style="font-size:14px"><b>Aofei Sheng</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/arnarg>
            <img src=https://avatars.githubusercontent.com/u/1291396?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Arnar/>
@@ -554,8 +547,6 @@ make build
            <sub style="font-size:14px"><b>kundel</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/fkr>
            <img src=https://avatars.githubusercontent.com/u/51063?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Felix Kronlage-Dammers/>
@@ -563,6 +554,8 @@ make build
            <sub style="font-size:14px"><b>Felix Kronlage-Dammers</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/felixonmars>
            <img src=https://avatars.githubusercontent.com/u/1006477?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Felix Yan/>
@@ -598,15 +591,6 @@ make build
            <sub style="font-size:14px"><b>Pierre Carru</b></sub>
        </a>
    </td>
-</tr>
-<tr>
-    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
-        <a href=https://github.com/Donran>
-            <img src=https://avatars.githubusercontent.com/u/4838348?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Pontus N/>
-            <br />
-            <sub style="font-size:14px"><b>Pontus N</b></sub>
-        </a>
-    </td>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/nnsee>
            <img src=https://avatars.githubusercontent.com/u/36747857?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Rasmus Moorats/>
@@ -614,6 +598,8 @@ make build
            <sub style="font-size:14px"><b>Rasmus Moorats</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/rcursaru>
            <img src=https://avatars.githubusercontent.com/u/16259641?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=rcursaru/>
@@ -642,8 +628,6 @@ make build
            <sub style="font-size:14px"><b>Shaanan Cohney</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/stefanvanburen>
            <img src=https://avatars.githubusercontent.com/u/622527?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Stefan VanBuren/>
@@ -658,6 +642,8 @@ make build
            <sub style="font-size:14px"><b>sophware</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/m-tanner-dev0>
            <img src=https://avatars.githubusercontent.com/u/97977342?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Tanner/>
@@ -686,8 +672,6 @@ make build
            <sub style="font-size:14px"><b>Tianon Gravi</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/thetillhoff>
            <img src=https://avatars.githubusercontent.com/u/25052289?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Till Hoffmann/>
@@ -702,6 +686,8 @@ make build
            <sub style="font-size:14px"><b>Tjerk Woudsma</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/y0ngb1n>
            <img src=https://avatars.githubusercontent.com/u/25719408?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Yang Bin/>
@@ -730,8 +716,6 @@ make build
            <sub style="font-size:14px"><b>Zhiyuan Zheng</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/Bpazy>
            <img src=https://avatars.githubusercontent.com/u/9838749?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=Ziyuan Han/>
@@ -746,6 +730,8 @@ make build
            <sub style="font-size:14px"><b>derelm</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/nning>
            <img src=https://avatars.githubusercontent.com/u/557430?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=henning mueller/>
@@ -774,8 +760,6 @@ make build
            <sub style="font-size:14px"><b>sharkonet</b></sub>
        </a>
    </td>
-</tr>
-<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/manju-rn>
            <img src=https://avatars.githubusercontent.com/u/26291847?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=manju-rn/>
@@ -790,6 +774,8 @@ make build
            <sub style="font-size:14px"><b>pernila</b></sub>
        </a>
    </td>
+</tr>
+<tr>
    <td align="center" style="word-wrap: break-word; width: 150.0; height: 150.0">
        <a href=https://github.com/phpmalik>
            <img src=https://avatars.githubusercontent.com/u/26834645?v=4 width="100;"  style="border-radius:50%;align-items:center;justify-content:center;overflow:hidden;padding-top:10px" alt=phpmalik/>
--- a/api_common.go
+++ b/api_common.go
@@ -13,7 +13,7 @@ func (h *Headscale) generateMapResponse(
 		Str("func", "generateMapResponse").
 		Str("machine", mapRequest.Hostinfo.Hostname).
 		Msg("Creating Map response")
-	node, err := h.toNode(*machine, h.cfg.BaseDomain, h.cfg.DNSConfig)
+	node, err := machine.toNode(h.cfg.BaseDomain, h.cfg.DNSConfig)
 	if err != nil {
 		log.Error().
 			Caller().
@@ -37,7 +37,7 @@ func (h *Headscale) generateMapResponse(

 	profiles := h.getMapResponseUserProfiles(*machine, peers)

-	nodePeers, err := h.toNodes(peers, h.cfg.BaseDomain, h.cfg.DNSConfig)
+	nodePeers, err := peers.toNodes(h.cfg.BaseDomain, h.cfg.DNSConfig)
 	if err != nil {
 		log.Error().
 			Caller().
--- a/app.go
+++ b/app.go
@@ -219,16 +219,6 @@ func (h *Headscale) expireEphemeralNodes(milliSeconds int64) {
 	}
 }

-func (h *Headscale) failoverSubnetRoutes(milliSeconds int64) {
-	ticker := time.NewTicker(time.Duration(milliSeconds) * time.Millisecond)
-	for range ticker.C {
-		err := h.handlePrimarySubnetFailover()
-		if err != nil {
-			log.Error().Err(err).Msg("failed to handle primary subnet failover")
-		}
-	}
-}
-
 func (h *Headscale) expireEphemeralNodesWorker() {
 	namespaces, err := h.ListNamespaces()
 	if err != nil {
@@ -507,8 +497,6 @@ func (h *Headscale) Serve() error {

 	go h.expireEphemeralNodes(updateInterval)

-	go h.failoverSubnetRoutes(updateInterval)
-
 	if zl.GlobalLevel() == zl.TraceLevel {
 		zerolog.RespLog = true
 	} else {
--- a/cmd/headscale/cli/routes.go
+++ b/cmd/headscale/cli/routes.go
@@ -11,28 +11,29 @@ import (
 	"google.golang.org/grpc/status"
 )

-const (
-	Base10 = 10
-)
-
 func init() {
 	rootCmd.AddCommand(routesCmd)
+
 	listRoutesCmd.Flags().Uint64P("identifier", "i", 0, "Node identifier (ID)")
+	err := listRoutesCmd.MarkFlagRequired("identifier")
+	if err != nil {
+		log.Fatalf(err.Error())
+	}
 	routesCmd.AddCommand(listRoutesCmd)

-	enableRouteCmd.Flags().Uint64P("route", "r", 0, "Route identifier (ID)")
-	err := enableRouteCmd.MarkFlagRequired("route")
+	enableRouteCmd.Flags().
+		StringSliceP("route", "r", []string{}, "List (or repeated flags) of routes to enable")
+	enableRouteCmd.Flags().Uint64P("identifier", "i", 0, "Node identifier (ID)")
+	enableRouteCmd.Flags().BoolP("all", "a", false, "All routes from host")
+
+	err = enableRouteCmd.MarkFlagRequired("identifier")
 	if err != nil {
 		log.Fatalf(err.Error())
 	}
+
 	routesCmd.AddCommand(enableRouteCmd)

-	disableRouteCmd.Flags().Uint64P("route", "r", 0, "Route identifier (ID)")
-	err = disableRouteCmd.MarkFlagRequired("route")
-	if err != nil {
-		log.Fatalf(err.Error())
-	}
-	routesCmd.AddCommand(disableRouteCmd)
+	nodeCmd.AddCommand(routesCmd)
 }

 var routesCmd = &cobra.Command{
@@ -43,7 +44,7 @@ var routesCmd = &cobra.Command{

 var listRoutesCmd = &cobra.Command{
 	Use:     "list",
-	Short:   "List all routes",
+	Short:   "List routes advertised and enabled by a given node",
 	Aliases: []string{"ls", "show"},
 	Run: func(cmd *cobra.Command, args []string) {
 		output, _ := cmd.Flags().GetString("output")
@@ -63,51 +64,28 @@ var listRoutesCmd = &cobra.Command{
 		defer cancel()
 		defer conn.Close()

-		var routes []*v1.Route
-
-		if machineID == 0 {
-			response, err := client.GetRoutes(ctx, &v1.GetRoutesRequest{})
-			if err != nil {
-				ErrorOutput(
-					err,
-					fmt.Sprintf("Cannot get nodes: %s", status.Convert(err).Message()),
-					output,
-				)
-
-				return
-			}
-
-			if output != "" {
-				SuccessOutput(response.Routes, "", output)
-
-				return
-			}
-
-			routes = response.Routes
-		} else {
-			response, err := client.GetMachineRoutes(ctx, &v1.GetMachineRoutesRequest{
-				MachineId: machineID,
-			})
-			if err != nil {
-				ErrorOutput(
-					err,
-					fmt.Sprintf("Cannot get routes for machine %d: %s", machineID, status.Convert(err).Message()),
-					output,
-				)
-
-				return
-			}
-
-			if output != "" {
-				SuccessOutput(response.Routes, "", output)
-
-				return
-			}
-
-			routes = response.Routes
+		request := &v1.GetMachineRouteRequest{
+			MachineId: machineID,
 		}

-		tableData := routesToPtables(routes)
+		response, err := client.GetMachineRoute(ctx, request)
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Cannot get nodes: %s", status.Convert(err).Message()),
+				output,
+			)
+
+			return
+		}
+
+		if output != "" {
+			SuccessOutput(response.Routes, "", output)
+
+			return
+		}
+
+		tableData := routesToPtables(response.Routes)
 		if err != nil {
 			ErrorOutput(err, fmt.Sprintf("Error converting to table: %s", err), output)

@@ -129,12 +107,16 @@ var listRoutesCmd = &cobra.Command{

 var enableRouteCmd = &cobra.Command{
 	Use:   "enable",
-	Short: "Set a route as enabled",
-	Long:  `This command will make as enabled a given route.`,
+	Short: "Set the enabled routes for a given node",
+	Long: `This command will take a list of routes that will _replace_ 
+the current set of routes on a given node.
+If you would like to disable a route, simply run the command again, but 
+omit the route you do not want to enable.
+	`,
 	Run: func(cmd *cobra.Command, args []string) {
 		output, _ := cmd.Flags().GetString("output")

-		routeID, err := cmd.Flags().GetUint64("route")
+		machineID, err := cmd.Flags().GetUint64("identifier")
 		if err != nil {
 			ErrorOutput(
 				err,
@@ -149,13 +131,52 @@ var enableRouteCmd = &cobra.Command{
 		defer cancel()
 		defer conn.Close()

-		response, err := client.EnableRoute(ctx, &v1.EnableRouteRequest{
-			RouteId: routeID,
-		})
+		var routes []string
+
+		isAll, _ := cmd.Flags().GetBool("all")
+		if isAll {
+			response, err := client.GetMachineRoute(ctx, &v1.GetMachineRouteRequest{
+				MachineId: machineID,
+			})
+			if err != nil {
+				ErrorOutput(
+					err,
+					fmt.Sprintf(
+						"Cannot get machine routes: %s\n",
+						status.Convert(err).Message(),
+					),
+					output,
+				)
+
+				return
+			}
+			routes = response.GetRoutes().GetAdvertisedRoutes()
+		} else {
+			routes, err = cmd.Flags().GetStringSlice("route")
+			if err != nil {
+				ErrorOutput(
+					err,
+					fmt.Sprintf("Error getting routes from flag: %s", err),
+					output,
+				)
+
+				return
+			}
+		}
+
+		request := &v1.EnableMachineRoutesRequest{
+			MachineId: machineID,
+			Routes:    routes,
+		}
+
+		response, err := client.EnableMachineRoutes(ctx, request)
 		if err != nil {
 			ErrorOutput(
 				err,
-				fmt.Sprintf("Cannot enable route %d: %s", routeID, status.Convert(err).Message()),
+				fmt.Sprintf(
+					"Cannot register machine: %s\n",
+					status.Convert(err).Message(),
+				),
 				output,
 			)

@@ -163,71 +184,50 @@ var enableRouteCmd = &cobra.Command{
 		}

 		if output != "" {
-			SuccessOutput(response, "", output)
+			SuccessOutput(response.Routes, "", output)

 			return
 		}
-	},
-}

-var disableRouteCmd = &cobra.Command{
-	Use:   "disable",
-	Short: "Set as disabled a given route",
-	Long:  `This command will make as disabled a given route.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		output, _ := cmd.Flags().GetString("output")
+		tableData := routesToPtables(response.Routes)
+		if err != nil {
+			ErrorOutput(err, fmt.Sprintf("Error converting to table: %s", err), output)

-		routeID, err := cmd.Flags().GetUint64("route")
+			return
+		}
+
+		err = pterm.DefaultTable.WithHasHeader().WithData(tableData).Render()
 		if err != nil {
 			ErrorOutput(
 				err,
-				fmt.Sprintf("Error getting machine id from flag: %s", err),
+				fmt.Sprintf("Failed to render pterm table: %s", err),
 				output,
 			)

 			return
 		}
-
-		ctx, client, conn, cancel := getHeadscaleCLIClient()
-		defer cancel()
-		defer conn.Close()
-
-		response, err := client.DisableRoute(ctx, &v1.DisableRouteRequest{
-			RouteId: routeID,
-		})
-		if err != nil {
-			ErrorOutput(
-				err,
-				fmt.Sprintf("Cannot enable route %d: %s", routeID, status.Convert(err).Message()),
-				output,
-			)
-
-			return
-		}
-
-		if output != "" {
-			SuccessOutput(response, "", output)
-
-			return
-		}
 	},
 }

 // routesToPtables converts the list of routes to a nice table.
-func routesToPtables(routes []*v1.Route) pterm.TableData {
-	tableData := pterm.TableData{{"ID", "Machine", "Prefix", "Advertised", "Enabled", "Primary"}}
+func routesToPtables(routes *v1.Routes) pterm.TableData {
+	tableData := pterm.TableData{{"Route", "Enabled"}}

-	for _, route := range routes {
-		tableData = append(tableData,
-			[]string{
-				strconv.FormatUint(route.Id, Base10),
-				route.Machine.GivenName,
-				route.Prefix,
-				strconv.FormatBool(route.Advertised),
-				strconv.FormatBool(route.Enabled),
-				strconv.FormatBool(route.IsPrimary),
-			})
+	for _, route := range routes.GetAdvertisedRoutes() {
+		enabled := isStringInSlice(routes.EnabledRoutes, route)
+
+		tableData = append(tableData, []string{route, strconv.FormatBool(enabled)})
 	}

 	return tableData
 }
+
+func isStringInSlice(strs []string, s string) bool {
+	for _, s2 := range strs {
+		if s == s2 {
+			return true
+		}
+	}
+
+	return false
+}
--- a/config-example.yaml
+++ b/config-example.yaml
@@ -273,9 +273,6 @@ unix_socket_permission: "0770"
 #
 #   allowed_domains:
 #     - example.com
-# Groups from keycloak have a leading '/'
-#   allowed_groups:
-#     - /headscale
 #   allowed_users:
 #     - alice@example.com
 #
--- a/config.go
+++ b/config.go
@@ -96,7 +96,6 @@ type OIDCConfig struct {
 	ExtraParams                map[string]string
 	AllowedDomains             []string
 	AllowedUsers               []string
-	AllowedGroups              []string
 	StripEmaildomain           bool
 }

@@ -172,8 +171,6 @@ func LoadConfig(path string, isFile bool) error {
 	viper.SetDefault("cli.timeout", "5s")
 	viper.SetDefault("cli.insecure", false)

-	viper.SetDefault("db_ssl", false)
-
 	viper.SetDefault("oidc.scope", []string{oidc.ScopeOpenID, "profile", "email"})
 	viper.SetDefault("oidc.strip_email_domain", true)
 	viper.SetDefault("oidc.only_start_if_oidc_is_available", true)
@@ -571,7 +568,6 @@ func GetHeadscaleConfig() (*Config, error) {
 			ExtraParams:      viper.GetStringMapString("oidc.extra_params"),
 			AllowedDomains:   viper.GetStringSlice("oidc.allowed_domains"),
 			AllowedUsers:     viper.GetStringSlice("oidc.allowed_users"),
-			AllowedGroups:    viper.GetStringSlice("oidc.allowed_groups"),
 			StripEmaildomain: viper.GetBool("oidc.strip_email_domain"),
 		},

--- a/db.go
+++ b/db.go
@@ -18,10 +18,8 @@ import (
 )

 const (
-	dbVersion = "1"
-
-	errValueNotFound     = Error("not found")
-	ErrCannotParsePrefix = Error("cannot parse prefix")
+	dbVersion        = "1"
+	errValueNotFound = Error("not found")
 )

 // KV is a key-value store in a psql table. For future use...
@@ -81,67 +79,6 @@ func (h *Headscale) initDB() error {
 		}
 	}

-	err = db.AutoMigrate(&Route{})
-	if err != nil {
-		return err
-	}
-
-	if db.Migrator().HasColumn(&Machine{}, "enabled_routes") {
-		log.Info().Msgf("Database has legacy enabled_routes column in machine, migrating...")
-
-		type MachineAux struct {
-			ID            uint64
-			EnabledRoutes IPPrefixes
-		}
-
-		machinesAux := []MachineAux{}
-		err := db.Table("machines").Select("id, enabled_routes").Scan(&machinesAux).Error
-		if err != nil {
-			log.Fatal().Err(err).Msg("Error accessing db")
-		}
-		for _, machine := range machinesAux {
-			for _, prefix := range machine.EnabledRoutes {
-				if err != nil {
-					log.Error().
-						Err(err).
-						Str("enabled_route", prefix.String()).
-						Msg("Error parsing enabled_route")
-
-					continue
-				}
-
-				err = db.Preload("Machine").Where("machine_id = ? AND prefix = ?", machine.ID, IPPrefix(prefix)).First(&Route{}).Error
-				if err == nil {
-					log.Info().
-						Str("enabled_route", prefix.String()).
-						Msg("Route already migrated to new table, skipping")
-
-					continue
-				}
-
-				route := Route{
-					MachineID:  machine.ID,
-					Advertised: true,
-					Enabled:    true,
-					Prefix:     IPPrefix(prefix),
-				}
-				if err := h.db.Create(&route).Error; err != nil {
-					log.Error().Err(err).Msg("Error creating route")
-				} else {
-					log.Info().
-						Uint64("machine_id", route.MachineID).
-						Str("prefix", prefix.String()).
-						Msg("Route migrated")
-				}
-			}
-		}
-
-		err = db.Migrator().DropColumn(&Machine{}, "enabled_routes")
-		if err != nil {
-			log.Error().Err(err).Msg("Error dropping enabled_routes column")
-		}
-	}
-
 	err = db.AutoMigrate(&Machine{})
 	if err != nil {
 		return err
@@ -327,30 +264,6 @@ func (hi HostInfo) Value() (driver.Value, error) {
 	return string(bytes), err
 }

-type IPPrefix netip.Prefix
-
-func (i *IPPrefix) Scan(destination interface{}) error {
-	switch value := destination.(type) {
-	case string:
-		prefix, err := netip.ParsePrefix(value)
-		if err != nil {
-			return err
-		}
-		*i = IPPrefix(prefix)
-
-		return nil
-	default:
-		return fmt.Errorf("%w: unexpected data type %T", ErrCannotParsePrefix, destination)
-	}
-}
-
-// Value return json value, implement driver.Valuer interface.
-func (i IPPrefix) Value() (driver.Value, error) {
-	prefixStr := netip.Prefix(i).String()
-
-	return prefixStr, nil
-}
-
 type IPPrefixes []netip.Prefix

 func (i *IPPrefixes) Scan(destination interface{}) error {
--- a/flake.nix
+++ b/flake.nix
@@ -33,7 +33,7 @@

          # When updating go.mod or go.sum, a new sha will need to be calculated,
          # update this if you have a mismatch after doing a change to thos files.
-          vendorSha256 = "sha256-SuKT+b8g6xEK15ry2IAmpS/vwDG+zJqK9nfsWpHNXuU=";
+          vendorSha256 = "sha256-Y1IK9Tx2sv0v27ZYtSxDP9keHQ7skctDOa+37pNGEC8=";

          ldflags = ["-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}"];
        };
@@ -147,13 +147,14 @@
        inherit headscale;
        inherit headscale-docker;
      };
+
      defaultPackage = pkgs.headscale;

      # `nix run`
      apps.headscale = flake-utils.lib.mkApp {
        drv = packages.headscale;
      };
-      apps.default = apps.headscale;
+      defaultApp = apps.headscale;

      checks = {
        format =
--- a/gen/go/headscale/v1/headscale.pb.go
+++ b/gen/go/headscale/v1/headscale.pb.go
@@ -36,7 +36,7 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76,
 	0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19,
 	0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70, 0x69,
-	0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x32, 0x81, 0x18, 0x0a, 0x10, 0x48, 0x65,
+	0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x32, 0xb1, 0x16, 0x0a, 0x10, 0x48, 0x65,
 	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x77,
 	0x0a, 0x0c, 0x47, 0x65, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x21,
 	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65,
@@ -51,9 +51,9 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
 	0x1a, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
 	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1c, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x16, 0x3a,
-	0x01, 0x2a, 0x22, 0x11, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x61, 0x6d, 0x65,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x96, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1c, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x16, 0x22,
+	0x11, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x3a, 0x01, 0x2a, 0x12, 0x96, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65,
 	0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x24, 0x2e, 0x68, 0x65, 0x61, 0x64,
 	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x4e,
 	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
@@ -85,17 +85,17 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
 	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75,
 	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1d, 0x82,
-	0xd3, 0xe4, 0x93, 0x02, 0x17, 0x3a, 0x01, 0x2a, 0x22, 0x12, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76,
-	0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6b, 0x65, 0x79, 0x12, 0x87, 0x01, 0x0a,
+	0xd3, 0xe4, 0x93, 0x02, 0x17, 0x22, 0x12, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x70,
+	0x72, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6b, 0x65, 0x79, 0x3a, 0x01, 0x2a, 0x12, 0x87, 0x01, 0x0a,
 	0x10, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
 	0x79, 0x12, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
 	0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x50, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
 	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
 	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x50, 0x72,
 	0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x24, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1e, 0x3a, 0x01, 0x2a, 0x22, 0x19, 0x2f, 0x61, 0x70,
-	0x69, 0x2f, 0x76, 0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6b, 0x65, 0x79, 0x2f,
-	0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x12, 0x7a, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x72,
+	0x22, 0x24, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1e, 0x22, 0x19, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76,
+	0x31, 0x2f, 0x70, 0x72, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6b, 0x65, 0x79, 0x2f, 0x65, 0x78, 0x70,
+	0x69, 0x72, 0x65, 0x3a, 0x01, 0x2a, 0x12, 0x7a, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x72,
 	0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x24, 0x2e, 0x68, 0x65, 0x61, 0x64,
 	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x72, 0x65,
 	0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
@@ -110,8 +110,8 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x73, 0x74, 0x1a, 0x28, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
 	0x31, 0x2e, 0x44, 0x65, 0x62, 0x75, 0x67, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63,
 	0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x20, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x1a, 0x3a, 0x01, 0x2a, 0x22, 0x15, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
-	0x2f, 0x64, 0x65, 0x62, 0x75, 0x67, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x75,
+	0xe4, 0x93, 0x02, 0x1a, 0x22, 0x15, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x64, 0x65,
+	0x62, 0x75, 0x67, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x3a, 0x01, 0x2a, 0x12, 0x75,
 	0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x1f, 0x2e, 0x68,
 	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d,
 	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e,
@@ -124,9 +124,9 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x53, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d,
 	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65,
 	0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2c, 0x82,
-	0xd3, 0xe4, 0x93, 0x02, 0x26, 0x3a, 0x01, 0x2a, 0x22, 0x21, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76,
-	0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69,
-	0x6e, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x74, 0x61, 0x67, 0x73, 0x12, 0x80, 0x01, 0x0a, 0x0f,
+	0xd3, 0xe4, 0x93, 0x02, 0x26, 0x22, 0x21, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f,
+	0x69, 0x64, 0x7d, 0x2f, 0x74, 0x61, 0x67, 0x73, 0x3a, 0x01, 0x2a, 0x12, 0x80, 0x01, 0x0a, 0x0f,
 	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12,
 	0x24, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
 	0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
@@ -175,37 +175,24 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2e,
 	0x82, 0xd3, 0xe4, 0x93, 0x02, 0x28, 0x22, 0x26, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
 	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x64,
-	0x0a, 0x09, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1e, 0x2e, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x68, 0x65,
-	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x16, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x10, 0x12, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x12, 0x7c, 0x0a, 0x0b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x28, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x22,
-	0x22, 0x20, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x12, 0x80, 0x01, 0x0a, 0x0c, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x12, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61,
-	0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x23, 0x22, 0x21, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x75, 0x74,
-	0x65, 0x73, 0x2f, 0x7b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x64, 0x69,
-	0x73, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x8e, 0x01, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x25, 0x2e, 0x68, 0x65, 0x61,
-	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x26, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x8b,
+	0x01, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x12, 0x24, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
+	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x2b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x25, 0x12, 0x23, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x97, 0x01, 0x0a,
+	0x13, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f,
+	0x75, 0x74, 0x65, 0x73, 0x12, 0x28, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29,
+	0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65,
 	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b, 0x82, 0xd3, 0xe4, 0x93, 0x02,
-	0x25, 0x12, 0x23, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x25, 0x22, 0x23, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x2f, 0x7b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f,
 	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x70, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
 	0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61,
@@ -213,16 +200,16 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 	0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65, 0x61, 0x64,
 	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
 	0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x19, 0x82,
-	0xd3, 0xe4, 0x93, 0x02, 0x13, 0x3a, 0x01, 0x2a, 0x22, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76,
-	0x31, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x12, 0x77, 0x0a, 0x0c, 0x45, 0x78, 0x70, 0x69,
+	0xd3, 0xe4, 0x93, 0x02, 0x13, 0x22, 0x0e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x61,
+	0x70, 0x69, 0x6b, 0x65, 0x79, 0x3a, 0x01, 0x2a, 0x12, 0x77, 0x0a, 0x0c, 0x45, 0x78, 0x70, 0x69,
 	0x72, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73,
 	0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x41, 0x70,
 	0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x68, 0x65,
 	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72,
 	0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x20, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x3a, 0x01, 0x2a, 0x22, 0x15, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x76, 0x31, 0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x65, 0x12, 0x6a, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73,
+	0x20, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x22, 0x15, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x61, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x2f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x3a, 0x01,
+	0x2a, 0x12, 0x6a, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73,
 	0x12, 0x20, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e,
 	0x4c, 0x69, 0x73, 0x74, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76,
@@ -235,54 +222,50 @@ var file_headscale_v1_headscale_proto_rawDesc = []byte{
 }

 var file_headscale_v1_headscale_proto_goTypes = []interface{}{
-	(*GetNamespaceRequest)(nil),        // 0: headscale.v1.GetNamespaceRequest
-	(*CreateNamespaceRequest)(nil),     // 1: headscale.v1.CreateNamespaceRequest
-	(*RenameNamespaceRequest)(nil),     // 2: headscale.v1.RenameNamespaceRequest
-	(*DeleteNamespaceRequest)(nil),     // 3: headscale.v1.DeleteNamespaceRequest
-	(*ListNamespacesRequest)(nil),      // 4: headscale.v1.ListNamespacesRequest
-	(*CreatePreAuthKeyRequest)(nil),    // 5: headscale.v1.CreatePreAuthKeyRequest
-	(*ExpirePreAuthKeyRequest)(nil),    // 6: headscale.v1.ExpirePreAuthKeyRequest
-	(*ListPreAuthKeysRequest)(nil),     // 7: headscale.v1.ListPreAuthKeysRequest
-	(*DebugCreateMachineRequest)(nil),  // 8: headscale.v1.DebugCreateMachineRequest
-	(*GetMachineRequest)(nil),          // 9: headscale.v1.GetMachineRequest
-	(*SetTagsRequest)(nil),             // 10: headscale.v1.SetTagsRequest
-	(*RegisterMachineRequest)(nil),     // 11: headscale.v1.RegisterMachineRequest
-	(*DeleteMachineRequest)(nil),       // 12: headscale.v1.DeleteMachineRequest
-	(*ExpireMachineRequest)(nil),       // 13: headscale.v1.ExpireMachineRequest
-	(*RenameMachineRequest)(nil),       // 14: headscale.v1.RenameMachineRequest
-	(*ListMachinesRequest)(nil),        // 15: headscale.v1.ListMachinesRequest
-	(*MoveMachineRequest)(nil),         // 16: headscale.v1.MoveMachineRequest
-	(*GetRoutesRequest)(nil),           // 17: headscale.v1.GetRoutesRequest
-	(*EnableRouteRequest)(nil),         // 18: headscale.v1.EnableRouteRequest
-	(*DisableRouteRequest)(nil),        // 19: headscale.v1.DisableRouteRequest
-	(*GetMachineRoutesRequest)(nil),    // 20: headscale.v1.GetMachineRoutesRequest
-	(*CreateApiKeyRequest)(nil),        // 21: headscale.v1.CreateApiKeyRequest
-	(*ExpireApiKeyRequest)(nil),        // 22: headscale.v1.ExpireApiKeyRequest
-	(*ListApiKeysRequest)(nil),         // 23: headscale.v1.ListApiKeysRequest
-	(*GetNamespaceResponse)(nil),       // 24: headscale.v1.GetNamespaceResponse
-	(*CreateNamespaceResponse)(nil),    // 25: headscale.v1.CreateNamespaceResponse
-	(*RenameNamespaceResponse)(nil),    // 26: headscale.v1.RenameNamespaceResponse
-	(*DeleteNamespaceResponse)(nil),    // 27: headscale.v1.DeleteNamespaceResponse
-	(*ListNamespacesResponse)(nil),     // 28: headscale.v1.ListNamespacesResponse
-	(*CreatePreAuthKeyResponse)(nil),   // 29: headscale.v1.CreatePreAuthKeyResponse
-	(*ExpirePreAuthKeyResponse)(nil),   // 30: headscale.v1.ExpirePreAuthKeyResponse
-	(*ListPreAuthKeysResponse)(nil),    // 31: headscale.v1.ListPreAuthKeysResponse
-	(*DebugCreateMachineResponse)(nil), // 32: headscale.v1.DebugCreateMachineResponse
-	(*GetMachineResponse)(nil),         // 33: headscale.v1.GetMachineResponse
-	(*SetTagsResponse)(nil),            // 34: headscale.v1.SetTagsResponse
-	(*RegisterMachineResponse)(nil),    // 35: headscale.v1.RegisterMachineResponse
-	(*DeleteMachineResponse)(nil),      // 36: headscale.v1.DeleteMachineResponse
-	(*ExpireMachineResponse)(nil),      // 37: headscale.v1.ExpireMachineResponse
-	(*RenameMachineResponse)(nil),      // 38: headscale.v1.RenameMachineResponse
-	(*ListMachinesResponse)(nil),       // 39: headscale.v1.ListMachinesResponse
-	(*MoveMachineResponse)(nil),        // 40: headscale.v1.MoveMachineResponse
-	(*GetRoutesResponse)(nil),          // 41: headscale.v1.GetRoutesResponse
-	(*EnableRouteResponse)(nil),        // 42: headscale.v1.EnableRouteResponse
-	(*DisableRouteResponse)(nil),       // 43: headscale.v1.DisableRouteResponse
-	(*GetMachineRoutesResponse)(nil),   // 44: headscale.v1.GetMachineRoutesResponse
-	(*CreateApiKeyResponse)(nil),       // 45: headscale.v1.CreateApiKeyResponse
-	(*ExpireApiKeyResponse)(nil),       // 46: headscale.v1.ExpireApiKeyResponse
-	(*ListApiKeysResponse)(nil),        // 47: headscale.v1.ListApiKeysResponse
+	(*GetNamespaceRequest)(nil),         // 0: headscale.v1.GetNamespaceRequest
+	(*CreateNamespaceRequest)(nil),      // 1: headscale.v1.CreateNamespaceRequest
+	(*RenameNamespaceRequest)(nil),      // 2: headscale.v1.RenameNamespaceRequest
+	(*DeleteNamespaceRequest)(nil),      // 3: headscale.v1.DeleteNamespaceRequest
+	(*ListNamespacesRequest)(nil),       // 4: headscale.v1.ListNamespacesRequest
+	(*CreatePreAuthKeyRequest)(nil),     // 5: headscale.v1.CreatePreAuthKeyRequest
+	(*ExpirePreAuthKeyRequest)(nil),     // 6: headscale.v1.ExpirePreAuthKeyRequest
+	(*ListPreAuthKeysRequest)(nil),      // 7: headscale.v1.ListPreAuthKeysRequest
+	(*DebugCreateMachineRequest)(nil),   // 8: headscale.v1.DebugCreateMachineRequest
+	(*GetMachineRequest)(nil),           // 9: headscale.v1.GetMachineRequest
+	(*SetTagsRequest)(nil),              // 10: headscale.v1.SetTagsRequest
+	(*RegisterMachineRequest)(nil),      // 11: headscale.v1.RegisterMachineRequest
+	(*DeleteMachineRequest)(nil),        // 12: headscale.v1.DeleteMachineRequest
+	(*ExpireMachineRequest)(nil),        // 13: headscale.v1.ExpireMachineRequest
+	(*RenameMachineRequest)(nil),        // 14: headscale.v1.RenameMachineRequest
+	(*ListMachinesRequest)(nil),         // 15: headscale.v1.ListMachinesRequest
+	(*MoveMachineRequest)(nil),          // 16: headscale.v1.MoveMachineRequest
+	(*GetMachineRouteRequest)(nil),      // 17: headscale.v1.GetMachineRouteRequest
+	(*EnableMachineRoutesRequest)(nil),  // 18: headscale.v1.EnableMachineRoutesRequest
+	(*CreateApiKeyRequest)(nil),         // 19: headscale.v1.CreateApiKeyRequest
+	(*ExpireApiKeyRequest)(nil),         // 20: headscale.v1.ExpireApiKeyRequest
+	(*ListApiKeysRequest)(nil),          // 21: headscale.v1.ListApiKeysRequest
+	(*GetNamespaceResponse)(nil),        // 22: headscale.v1.GetNamespaceResponse
+	(*CreateNamespaceResponse)(nil),     // 23: headscale.v1.CreateNamespaceResponse
+	(*RenameNamespaceResponse)(nil),     // 24: headscale.v1.RenameNamespaceResponse
+	(*DeleteNamespaceResponse)(nil),     // 25: headscale.v1.DeleteNamespaceResponse
+	(*ListNamespacesResponse)(nil),      // 26: headscale.v1.ListNamespacesResponse
+	(*CreatePreAuthKeyResponse)(nil),    // 27: headscale.v1.CreatePreAuthKeyResponse
+	(*ExpirePreAuthKeyResponse)(nil),    // 28: headscale.v1.ExpirePreAuthKeyResponse
+	(*ListPreAuthKeysResponse)(nil),     // 29: headscale.v1.ListPreAuthKeysResponse
+	(*DebugCreateMachineResponse)(nil),  // 30: headscale.v1.DebugCreateMachineResponse
+	(*GetMachineResponse)(nil),          // 31: headscale.v1.GetMachineResponse
+	(*SetTagsResponse)(nil),             // 32: headscale.v1.SetTagsResponse
+	(*RegisterMachineResponse)(nil),     // 33: headscale.v1.RegisterMachineResponse
+	(*DeleteMachineResponse)(nil),       // 34: headscale.v1.DeleteMachineResponse
+	(*ExpireMachineResponse)(nil),       // 35: headscale.v1.ExpireMachineResponse
+	(*RenameMachineResponse)(nil),       // 36: headscale.v1.RenameMachineResponse
+	(*ListMachinesResponse)(nil),        // 37: headscale.v1.ListMachinesResponse
+	(*MoveMachineResponse)(nil),         // 38: headscale.v1.MoveMachineResponse
+	(*GetMachineRouteResponse)(nil),     // 39: headscale.v1.GetMachineRouteResponse
+	(*EnableMachineRoutesResponse)(nil), // 40: headscale.v1.EnableMachineRoutesResponse
+	(*CreateApiKeyResponse)(nil),        // 41: headscale.v1.CreateApiKeyResponse
+	(*ExpireApiKeyResponse)(nil),        // 42: headscale.v1.ExpireApiKeyResponse
+	(*ListApiKeysResponse)(nil),         // 43: headscale.v1.ListApiKeysResponse
 }
 var file_headscale_v1_headscale_proto_depIdxs = []int32{
 	0,  // 0: headscale.v1.HeadscaleService.GetNamespace:input_type -> headscale.v1.GetNamespaceRequest
@@ -302,39 +285,35 @@ var file_headscale_v1_headscale_proto_depIdxs = []int32{
 	14, // 14: headscale.v1.HeadscaleService.RenameMachine:input_type -> headscale.v1.RenameMachineRequest
 	15, // 15: headscale.v1.HeadscaleService.ListMachines:input_type -> headscale.v1.ListMachinesRequest
 	16, // 16: headscale.v1.HeadscaleService.MoveMachine:input_type -> headscale.v1.MoveMachineRequest
-	17, // 17: headscale.v1.HeadscaleService.GetRoutes:input_type -> headscale.v1.GetRoutesRequest
-	18, // 18: headscale.v1.HeadscaleService.EnableRoute:input_type -> headscale.v1.EnableRouteRequest
-	19, // 19: headscale.v1.HeadscaleService.DisableRoute:input_type -> headscale.v1.DisableRouteRequest
-	20, // 20: headscale.v1.HeadscaleService.GetMachineRoutes:input_type -> headscale.v1.GetMachineRoutesRequest
-	21, // 21: headscale.v1.HeadscaleService.CreateApiKey:input_type -> headscale.v1.CreateApiKeyRequest
-	22, // 22: headscale.v1.HeadscaleService.ExpireApiKey:input_type -> headscale.v1.ExpireApiKeyRequest
-	23, // 23: headscale.v1.HeadscaleService.ListApiKeys:input_type -> headscale.v1.ListApiKeysRequest
-	24, // 24: headscale.v1.HeadscaleService.GetNamespace:output_type -> headscale.v1.GetNamespaceResponse
-	25, // 25: headscale.v1.HeadscaleService.CreateNamespace:output_type -> headscale.v1.CreateNamespaceResponse
-	26, // 26: headscale.v1.HeadscaleService.RenameNamespace:output_type -> headscale.v1.RenameNamespaceResponse
-	27, // 27: headscale.v1.HeadscaleService.DeleteNamespace:output_type -> headscale.v1.DeleteNamespaceResponse
-	28, // 28: headscale.v1.HeadscaleService.ListNamespaces:output_type -> headscale.v1.ListNamespacesResponse
-	29, // 29: headscale.v1.HeadscaleService.CreatePreAuthKey:output_type -> headscale.v1.CreatePreAuthKeyResponse
-	30, // 30: headscale.v1.HeadscaleService.ExpirePreAuthKey:output_type -> headscale.v1.ExpirePreAuthKeyResponse
-	31, // 31: headscale.v1.HeadscaleService.ListPreAuthKeys:output_type -> headscale.v1.ListPreAuthKeysResponse
-	32, // 32: headscale.v1.HeadscaleService.DebugCreateMachine:output_type -> headscale.v1.DebugCreateMachineResponse
-	33, // 33: headscale.v1.HeadscaleService.GetMachine:output_type -> headscale.v1.GetMachineResponse
-	34, // 34: headscale.v1.HeadscaleService.SetTags:output_type -> headscale.v1.SetTagsResponse
-	35, // 35: headscale.v1.HeadscaleService.RegisterMachine:output_type -> headscale.v1.RegisterMachineResponse
-	36, // 36: headscale.v1.HeadscaleService.DeleteMachine:output_type -> headscale.v1.DeleteMachineResponse
-	37, // 37: headscale.v1.HeadscaleService.ExpireMachine:output_type -> headscale.v1.ExpireMachineResponse
-	38, // 38: headscale.v1.HeadscaleService.RenameMachine:output_type -> headscale.v1.RenameMachineResponse
-	39, // 39: headscale.v1.HeadscaleService.ListMachines:output_type -> headscale.v1.ListMachinesResponse
-	40, // 40: headscale.v1.HeadscaleService.MoveMachine:output_type -> headscale.v1.MoveMachineResponse
-	41, // 41: headscale.v1.HeadscaleService.GetRoutes:output_type -> headscale.v1.GetRoutesResponse
-	42, // 42: headscale.v1.HeadscaleService.EnableRoute:output_type -> headscale.v1.EnableRouteResponse
-	43, // 43: headscale.v1.HeadscaleService.DisableRoute:output_type -> headscale.v1.DisableRouteResponse
-	44, // 44: headscale.v1.HeadscaleService.GetMachineRoutes:output_type -> headscale.v1.GetMachineRoutesResponse
-	45, // 45: headscale.v1.HeadscaleService.CreateApiKey:output_type -> headscale.v1.CreateApiKeyResponse
-	46, // 46: headscale.v1.HeadscaleService.ExpireApiKey:output_type -> headscale.v1.ExpireApiKeyResponse
-	47, // 47: headscale.v1.HeadscaleService.ListApiKeys:output_type -> headscale.v1.ListApiKeysResponse
-	24, // [24:48] is the sub-list for method output_type
-	0,  // [0:24] is the sub-list for method input_type
+	17, // 17: headscale.v1.HeadscaleService.GetMachineRoute:input_type -> headscale.v1.GetMachineRouteRequest
+	18, // 18: headscale.v1.HeadscaleService.EnableMachineRoutes:input_type -> headscale.v1.EnableMachineRoutesRequest
+	19, // 19: headscale.v1.HeadscaleService.CreateApiKey:input_type -> headscale.v1.CreateApiKeyRequest
+	20, // 20: headscale.v1.HeadscaleService.ExpireApiKey:input_type -> headscale.v1.ExpireApiKeyRequest
+	21, // 21: headscale.v1.HeadscaleService.ListApiKeys:input_type -> headscale.v1.ListApiKeysRequest
+	22, // 22: headscale.v1.HeadscaleService.GetNamespace:output_type -> headscale.v1.GetNamespaceResponse
+	23, // 23: headscale.v1.HeadscaleService.CreateNamespace:output_type -> headscale.v1.CreateNamespaceResponse
+	24, // 24: headscale.v1.HeadscaleService.RenameNamespace:output_type -> headscale.v1.RenameNamespaceResponse
+	25, // 25: headscale.v1.HeadscaleService.DeleteNamespace:output_type -> headscale.v1.DeleteNamespaceResponse
+	26, // 26: headscale.v1.HeadscaleService.ListNamespaces:output_type -> headscale.v1.ListNamespacesResponse
+	27, // 27: headscale.v1.HeadscaleService.CreatePreAuthKey:output_type -> headscale.v1.CreatePreAuthKeyResponse
+	28, // 28: headscale.v1.HeadscaleService.ExpirePreAuthKey:output_type -> headscale.v1.ExpirePreAuthKeyResponse
+	29, // 29: headscale.v1.HeadscaleService.ListPreAuthKeys:output_type -> headscale.v1.ListPreAuthKeysResponse
+	30, // 30: headscale.v1.HeadscaleService.DebugCreateMachine:output_type -> headscale.v1.DebugCreateMachineResponse
+	31, // 31: headscale.v1.HeadscaleService.GetMachine:output_type -> headscale.v1.GetMachineResponse
+	32, // 32: headscale.v1.HeadscaleService.SetTags:output_type -> headscale.v1.SetTagsResponse
+	33, // 33: headscale.v1.HeadscaleService.RegisterMachine:output_type -> headscale.v1.RegisterMachineResponse
+	34, // 34: headscale.v1.HeadscaleService.DeleteMachine:output_type -> headscale.v1.DeleteMachineResponse
+	35, // 35: headscale.v1.HeadscaleService.ExpireMachine:output_type -> headscale.v1.ExpireMachineResponse
+	36, // 36: headscale.v1.HeadscaleService.RenameMachine:output_type -> headscale.v1.RenameMachineResponse
+	37, // 37: headscale.v1.HeadscaleService.ListMachines:output_type -> headscale.v1.ListMachinesResponse
+	38, // 38: headscale.v1.HeadscaleService.MoveMachine:output_type -> headscale.v1.MoveMachineResponse
+	39, // 39: headscale.v1.HeadscaleService.GetMachineRoute:output_type -> headscale.v1.GetMachineRouteResponse
+	40, // 40: headscale.v1.HeadscaleService.EnableMachineRoutes:output_type -> headscale.v1.EnableMachineRoutesResponse
+	41, // 41: headscale.v1.HeadscaleService.CreateApiKey:output_type -> headscale.v1.CreateApiKeyResponse
+	42, // 42: headscale.v1.HeadscaleService.ExpireApiKey:output_type -> headscale.v1.ExpireApiKeyResponse
+	43, // 43: headscale.v1.HeadscaleService.ListApiKeys:output_type -> headscale.v1.ListApiKeysResponse
+	22, // [22:44] is the sub-list for method output_type
+	0,  // [0:22] is the sub-list for method input_type
 	0,  // [0:0] is the sub-list for extension type_name
 	0,  // [0:0] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
--- a/gen/go/headscale/v1/headscale.pb.gw.go
+++ b/gen/go/headscale/v1/headscale.pb.gw.go
--- a/gen/go/headscale/v1/headscale_grpc.pb.go
+++ b/gen/go/headscale/v1/headscale_grpc.pb.go
@@ -43,10 +43,8 @@ type HeadscaleServiceClient interface {
 	ListMachines(ctx context.Context, in *ListMachinesRequest, opts ...grpc.CallOption) (*ListMachinesResponse, error)
 	MoveMachine(ctx context.Context, in *MoveMachineRequest, opts ...grpc.CallOption) (*MoveMachineResponse, error)
 	// --- Route start ---
-	GetRoutes(ctx context.Context, in *GetRoutesRequest, opts ...grpc.CallOption) (*GetRoutesResponse, error)
-	EnableRoute(ctx context.Context, in *EnableRouteRequest, opts ...grpc.CallOption) (*EnableRouteResponse, error)
-	DisableRoute(ctx context.Context, in *DisableRouteRequest, opts ...grpc.CallOption) (*DisableRouteResponse, error)
-	GetMachineRoutes(ctx context.Context, in *GetMachineRoutesRequest, opts ...grpc.CallOption) (*GetMachineRoutesResponse, error)
+	GetMachineRoute(ctx context.Context, in *GetMachineRouteRequest, opts ...grpc.CallOption) (*GetMachineRouteResponse, error)
+	EnableMachineRoutes(ctx context.Context, in *EnableMachineRoutesRequest, opts ...grpc.CallOption) (*EnableMachineRoutesResponse, error)
 	// --- ApiKeys start ---
 	CreateApiKey(ctx context.Context, in *CreateApiKeyRequest, opts ...grpc.CallOption) (*CreateApiKeyResponse, error)
 	ExpireApiKey(ctx context.Context, in *ExpireApiKeyRequest, opts ...grpc.CallOption) (*ExpireApiKeyResponse, error)
@@ -214,36 +212,18 @@ func (c *headscaleServiceClient) MoveMachine(ctx context.Context, in *MoveMachin
 	return out, nil
 }

-func (c *headscaleServiceClient) GetRoutes(ctx context.Context, in *GetRoutesRequest, opts ...grpc.CallOption) (*GetRoutesResponse, error) {
-	out := new(GetRoutesResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/GetRoutes", in, out, opts...)
+func (c *headscaleServiceClient) GetMachineRoute(ctx context.Context, in *GetMachineRouteRequest, opts ...grpc.CallOption) (*GetMachineRouteResponse, error) {
+	out := new(GetMachineRouteResponse)
+	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/GetMachineRoute", in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }

-func (c *headscaleServiceClient) EnableRoute(ctx context.Context, in *EnableRouteRequest, opts ...grpc.CallOption) (*EnableRouteResponse, error) {
-	out := new(EnableRouteResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/EnableRoute", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *headscaleServiceClient) DisableRoute(ctx context.Context, in *DisableRouteRequest, opts ...grpc.CallOption) (*DisableRouteResponse, error) {
-	out := new(DisableRouteResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/DisableRoute", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *headscaleServiceClient) GetMachineRoutes(ctx context.Context, in *GetMachineRoutesRequest, opts ...grpc.CallOption) (*GetMachineRoutesResponse, error) {
-	out := new(GetMachineRoutesResponse)
-	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/GetMachineRoutes", in, out, opts...)
+func (c *headscaleServiceClient) EnableMachineRoutes(ctx context.Context, in *EnableMachineRoutesRequest, opts ...grpc.CallOption) (*EnableMachineRoutesResponse, error) {
+	out := new(EnableMachineRoutesResponse)
+	err := c.cc.Invoke(ctx, "/headscale.v1.HeadscaleService/EnableMachineRoutes", in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -302,10 +282,8 @@ type HeadscaleServiceServer interface {
 	ListMachines(context.Context, *ListMachinesRequest) (*ListMachinesResponse, error)
 	MoveMachine(context.Context, *MoveMachineRequest) (*MoveMachineResponse, error)
 	// --- Route start ---
-	GetRoutes(context.Context, *GetRoutesRequest) (*GetRoutesResponse, error)
-	EnableRoute(context.Context, *EnableRouteRequest) (*EnableRouteResponse, error)
-	DisableRoute(context.Context, *DisableRouteRequest) (*DisableRouteResponse, error)
-	GetMachineRoutes(context.Context, *GetMachineRoutesRequest) (*GetMachineRoutesResponse, error)
+	GetMachineRoute(context.Context, *GetMachineRouteRequest) (*GetMachineRouteResponse, error)
+	EnableMachineRoutes(context.Context, *EnableMachineRoutesRequest) (*EnableMachineRoutesResponse, error)
 	// --- ApiKeys start ---
 	CreateApiKey(context.Context, *CreateApiKeyRequest) (*CreateApiKeyResponse, error)
 	ExpireApiKey(context.Context, *ExpireApiKeyRequest) (*ExpireApiKeyResponse, error)
@@ -368,17 +346,11 @@ func (UnimplementedHeadscaleServiceServer) ListMachines(context.Context, *ListMa
 func (UnimplementedHeadscaleServiceServer) MoveMachine(context.Context, *MoveMachineRequest) (*MoveMachineResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method MoveMachine not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) GetRoutes(context.Context, *GetRoutesRequest) (*GetRoutesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetRoutes not implemented")
+func (UnimplementedHeadscaleServiceServer) GetMachineRoute(context.Context, *GetMachineRouteRequest) (*GetMachineRouteResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetMachineRoute not implemented")
 }
-func (UnimplementedHeadscaleServiceServer) EnableRoute(context.Context, *EnableRouteRequest) (*EnableRouteResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method EnableRoute not implemented")
-}
-func (UnimplementedHeadscaleServiceServer) DisableRoute(context.Context, *DisableRouteRequest) (*DisableRouteResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DisableRoute not implemented")
-}
-func (UnimplementedHeadscaleServiceServer) GetMachineRoutes(context.Context, *GetMachineRoutesRequest) (*GetMachineRoutesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetMachineRoutes not implemented")
+func (UnimplementedHeadscaleServiceServer) EnableMachineRoutes(context.Context, *EnableMachineRoutesRequest) (*EnableMachineRoutesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method EnableMachineRoutes not implemented")
 }
 func (UnimplementedHeadscaleServiceServer) CreateApiKey(context.Context, *CreateApiKeyRequest) (*CreateApiKeyResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateApiKey not implemented")
@@ -708,74 +680,38 @@ func _HeadscaleService_MoveMachine_Handler(srv interface{}, ctx context.Context,
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_GetRoutes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetRoutesRequest)
+func _HeadscaleService_GetMachineRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetMachineRouteRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).GetRoutes(ctx, in)
+		return srv.(HeadscaleServiceServer).GetMachineRoute(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/GetRoutes",
+		FullMethod: "/headscale.v1.HeadscaleService/GetMachineRoute",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).GetRoutes(ctx, req.(*GetRoutesRequest))
+		return srv.(HeadscaleServiceServer).GetMachineRoute(ctx, req.(*GetMachineRouteRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }

-func _HeadscaleService_EnableRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(EnableRouteRequest)
+func _HeadscaleService_EnableMachineRoutes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(EnableMachineRoutesRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).EnableRoute(ctx, in)
+		return srv.(HeadscaleServiceServer).EnableMachineRoutes(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/EnableRoute",
+		FullMethod: "/headscale.v1.HeadscaleService/EnableMachineRoutes",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).EnableRoute(ctx, req.(*EnableRouteRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _HeadscaleService_DisableRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DisableRouteRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).DisableRoute(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/DisableRoute",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).DisableRoute(ctx, req.(*DisableRouteRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _HeadscaleService_GetMachineRoutes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetMachineRoutesRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(HeadscaleServiceServer).GetMachineRoutes(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/headscale.v1.HeadscaleService/GetMachineRoutes",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(HeadscaleServiceServer).GetMachineRoutes(ctx, req.(*GetMachineRoutesRequest))
+		return srv.(HeadscaleServiceServer).EnableMachineRoutes(ctx, req.(*EnableMachineRoutesRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -910,20 +846,12 @@ var HeadscaleService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _HeadscaleService_MoveMachine_Handler,
 		},
 		{
-			MethodName: "GetRoutes",
-			Handler:    _HeadscaleService_GetRoutes_Handler,
+			MethodName: "GetMachineRoute",
+			Handler:    _HeadscaleService_GetMachineRoute_Handler,
 		},
 		{
-			MethodName: "EnableRoute",
-			Handler:    _HeadscaleService_EnableRoute_Handler,
-		},
-		{
-			MethodName: "DisableRoute",
-			Handler:    _HeadscaleService_DisableRoute_Handler,
-		},
-		{
-			MethodName: "GetMachineRoutes",
-			Handler:    _HeadscaleService_GetMachineRoutes_Handler,
+			MethodName: "EnableMachineRoutes",
+			Handler:    _HeadscaleService_EnableMachineRoutes_Handler,
 		},
 		{
 			MethodName: "CreateApiKey",
--- a/gen/go/headscale/v1/routes.pb.go
+++ b/gen/go/headscale/v1/routes.pb.go
@@ -9,7 +9,6 @@ package v1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -21,24 +20,17 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )

-type Route struct {
+type Routes struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Id         uint64                 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	Machine    *Machine               `protobuf:"bytes,2,opt,name=machine,proto3" json:"machine,omitempty"`
-	Prefix     string                 `protobuf:"bytes,3,opt,name=prefix,proto3" json:"prefix,omitempty"`
-	Advertised bool                   `protobuf:"varint,4,opt,name=advertised,proto3" json:"advertised,omitempty"`
-	Enabled    bool                   `protobuf:"varint,5,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	IsPrimary  bool                   `protobuf:"varint,6,opt,name=is_primary,json=isPrimary,proto3" json:"is_primary,omitempty"`
-	CreatedAt  *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
-	UpdatedAt  *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
-	DeletedAt  *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=deleted_at,json=deletedAt,proto3" json:"deleted_at,omitempty"`
+	AdvertisedRoutes []string `protobuf:"bytes,1,rep,name=advertised_routes,json=advertisedRoutes,proto3" json:"advertised_routes,omitempty"`
+	EnabledRoutes    []string `protobuf:"bytes,2,rep,name=enabled_routes,json=enabledRoutes,proto3" json:"enabled_routes,omitempty"`
 }

-func (x *Route) Reset() {
-	*x = Route{}
+func (x *Routes) Reset() {
+	*x = Routes{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_headscale_v1_routes_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -46,13 +38,13 @@ func (x *Route) Reset() {
 	}
 }

-func (x *Route) String() string {
+func (x *Routes) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*Route) ProtoMessage() {}
+func (*Routes) ProtoMessage() {}

-func (x *Route) ProtoReflect() protoreflect.Message {
+func (x *Routes) ProtoReflect() protoreflect.Message {
 	mi := &file_headscale_v1_routes_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -64,82 +56,35 @@ func (x *Route) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use Route.ProtoReflect.Descriptor instead.
-func (*Route) Descriptor() ([]byte, []int) {
+// Deprecated: Use Routes.ProtoReflect.Descriptor instead.
+func (*Routes) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{0}
 }

-func (x *Route) GetId() uint64 {
+func (x *Routes) GetAdvertisedRoutes() []string {
 	if x != nil {
-		return x.Id
-	}
-	return 0
-}
-
-func (x *Route) GetMachine() *Machine {
-	if x != nil {
-		return x.Machine
+		return x.AdvertisedRoutes
 	}
 	return nil
 }

-func (x *Route) GetPrefix() string {
+func (x *Routes) GetEnabledRoutes() []string {
 	if x != nil {
-		return x.Prefix
-	}
-	return ""
-}
-
-func (x *Route) GetAdvertised() bool {
-	if x != nil {
-		return x.Advertised
-	}
-	return false
-}
-
-func (x *Route) GetEnabled() bool {
-	if x != nil {
-		return x.Enabled
-	}
-	return false
-}
-
-func (x *Route) GetIsPrimary() bool {
-	if x != nil {
-		return x.IsPrimary
-	}
-	return false
-}
-
-func (x *Route) GetCreatedAt() *timestamppb.Timestamp {
-	if x != nil {
-		return x.CreatedAt
+		return x.EnabledRoutes
 	}
 	return nil
 }

-func (x *Route) GetUpdatedAt() *timestamppb.Timestamp {
-	if x != nil {
-		return x.UpdatedAt
-	}
-	return nil
-}
-
-func (x *Route) GetDeletedAt() *timestamppb.Timestamp {
-	if x != nil {
-		return x.DeletedAt
-	}
-	return nil
-}
-
-type GetRoutesRequest struct {
+type GetMachineRouteRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	MachineId uint64 `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
 }

-func (x *GetRoutesRequest) Reset() {
-	*x = GetRoutesRequest{}
+func (x *GetMachineRouteRequest) Reset() {
+	*x = GetMachineRouteRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_headscale_v1_routes_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -147,13 +92,13 @@ func (x *GetRoutesRequest) Reset() {
 	}
 }

-func (x *GetRoutesRequest) String() string {
+func (x *GetMachineRouteRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*GetRoutesRequest) ProtoMessage() {}
+func (*GetMachineRouteRequest) ProtoMessage() {}

-func (x *GetRoutesRequest) ProtoReflect() protoreflect.Message {
+func (x *GetMachineRouteRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_headscale_v1_routes_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -165,21 +110,28 @@ func (x *GetRoutesRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use GetRoutesRequest.ProtoReflect.Descriptor instead.
-func (*GetRoutesRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetMachineRouteRequest.ProtoReflect.Descriptor instead.
+func (*GetMachineRouteRequest) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{1}
 }

-type GetRoutesResponse struct {
+func (x *GetMachineRouteRequest) GetMachineId() uint64 {
+	if x != nil {
+		return x.MachineId
+	}
+	return 0
+}
+
+type GetMachineRouteResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	Routes []*Route `protobuf:"bytes,1,rep,name=routes,proto3" json:"routes,omitempty"`
+	Routes *Routes `protobuf:"bytes,1,opt,name=routes,proto3" json:"routes,omitempty"`
 }

-func (x *GetRoutesResponse) Reset() {
-	*x = GetRoutesResponse{}
+func (x *GetMachineRouteResponse) Reset() {
+	*x = GetMachineRouteResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_headscale_v1_routes_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -187,13 +139,13 @@ func (x *GetRoutesResponse) Reset() {
 	}
 }

-func (x *GetRoutesResponse) String() string {
+func (x *GetMachineRouteResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*GetRoutesResponse) ProtoMessage() {}
+func (*GetMachineRouteResponse) ProtoMessage() {}

-func (x *GetRoutesResponse) ProtoReflect() protoreflect.Message {
+func (x *GetMachineRouteResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_headscale_v1_routes_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -205,28 +157,29 @@ func (x *GetRoutesResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use GetRoutesResponse.ProtoReflect.Descriptor instead.
-func (*GetRoutesResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use GetMachineRouteResponse.ProtoReflect.Descriptor instead.
+func (*GetMachineRouteResponse) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{2}
 }

-func (x *GetRoutesResponse) GetRoutes() []*Route {
+func (x *GetMachineRouteResponse) GetRoutes() *Routes {
 	if x != nil {
 		return x.Routes
 	}
 	return nil
 }

-type EnableRouteRequest struct {
+type EnableMachineRoutesRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields

-	RouteId uint64 `protobuf:"varint,1,opt,name=route_id,json=routeId,proto3" json:"route_id,omitempty"`
+	MachineId uint64   `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	Routes    []string `protobuf:"bytes,2,rep,name=routes,proto3" json:"routes,omitempty"`
 }

-func (x *EnableRouteRequest) Reset() {
-	*x = EnableRouteRequest{}
+func (x *EnableMachineRoutesRequest) Reset() {
+	*x = EnableMachineRoutesRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_headscale_v1_routes_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -234,13 +187,13 @@ func (x *EnableRouteRequest) Reset() {
 	}
 }

-func (x *EnableRouteRequest) String() string {
+func (x *EnableMachineRoutesRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*EnableRouteRequest) ProtoMessage() {}
+func (*EnableMachineRoutesRequest) ProtoMessage() {}

-func (x *EnableRouteRequest) ProtoReflect() protoreflect.Message {
+func (x *EnableMachineRoutesRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_headscale_v1_routes_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -252,26 +205,35 @@ func (x *EnableRouteRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use EnableRouteRequest.ProtoReflect.Descriptor instead.
-func (*EnableRouteRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use EnableMachineRoutesRequest.ProtoReflect.Descriptor instead.
+func (*EnableMachineRoutesRequest) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{3}
 }

-func (x *EnableRouteRequest) GetRouteId() uint64 {
+func (x *EnableMachineRoutesRequest) GetMachineId() uint64 {
 	if x != nil {
-		return x.RouteId
+		return x.MachineId
 	}
 	return 0
 }

-type EnableRouteResponse struct {
+func (x *EnableMachineRoutesRequest) GetRoutes() []string {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
+type EnableMachineRoutesResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	Routes *Routes `protobuf:"bytes,1,opt,name=routes,proto3" json:"routes,omitempty"`
 }

-func (x *EnableRouteResponse) Reset() {
-	*x = EnableRouteResponse{}
+func (x *EnableMachineRoutesResponse) Reset() {
+	*x = EnableMachineRoutesResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_headscale_v1_routes_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -279,13 +241,13 @@ func (x *EnableRouteResponse) Reset() {
 	}
 }

-func (x *EnableRouteResponse) String() string {
+func (x *EnableMachineRoutesResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }

-func (*EnableRouteResponse) ProtoMessage() {}
+func (*EnableMachineRoutesResponse) ProtoMessage() {}

-func (x *EnableRouteResponse) ProtoReflect() protoreflect.Message {
+func (x *EnableMachineRoutesResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_headscale_v1_routes_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -297,184 +259,12 @@ func (x *EnableRouteResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }

-// Deprecated: Use EnableRouteResponse.ProtoReflect.Descriptor instead.
-func (*EnableRouteResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use EnableMachineRoutesResponse.ProtoReflect.Descriptor instead.
+func (*EnableMachineRoutesResponse) Descriptor() ([]byte, []int) {
 	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{4}
 }

-type DisableRouteRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	RouteId uint64 `protobuf:"varint,1,opt,name=route_id,json=routeId,proto3" json:"route_id,omitempty"`
-}
-
-func (x *DisableRouteRequest) Reset() {
-	*x = DisableRouteRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_headscale_v1_routes_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DisableRouteRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DisableRouteRequest) ProtoMessage() {}
-
-func (x *DisableRouteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_headscale_v1_routes_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DisableRouteRequest.ProtoReflect.Descriptor instead.
-func (*DisableRouteRequest) Descriptor() ([]byte, []int) {
-	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *DisableRouteRequest) GetRouteId() uint64 {
-	if x != nil {
-		return x.RouteId
-	}
-	return 0
-}
-
-type DisableRouteResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *DisableRouteResponse) Reset() {
-	*x = DisableRouteResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_headscale_v1_routes_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *DisableRouteResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*DisableRouteResponse) ProtoMessage() {}
-
-func (x *DisableRouteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_headscale_v1_routes_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use DisableRouteResponse.ProtoReflect.Descriptor instead.
-func (*DisableRouteResponse) Descriptor() ([]byte, []int) {
-	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{6}
-}
-
-type GetMachineRoutesRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	MachineId uint64 `protobuf:"varint,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
-}
-
-func (x *GetMachineRoutesRequest) Reset() {
-	*x = GetMachineRoutesRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_headscale_v1_routes_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *GetMachineRoutesRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetMachineRoutesRequest) ProtoMessage() {}
-
-func (x *GetMachineRoutesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_headscale_v1_routes_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetMachineRoutesRequest.ProtoReflect.Descriptor instead.
-func (*GetMachineRoutesRequest) Descriptor() ([]byte, []int) {
-	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *GetMachineRoutesRequest) GetMachineId() uint64 {
-	if x != nil {
-		return x.MachineId
-	}
-	return 0
-}
-
-type GetMachineRoutesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Routes []*Route `protobuf:"bytes,1,rep,name=routes,proto3" json:"routes,omitempty"`
-}
-
-func (x *GetMachineRoutesResponse) Reset() {
-	*x = GetMachineRoutesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_headscale_v1_routes_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *GetMachineRoutesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetMachineRoutesResponse) ProtoMessage() {}
-
-func (x *GetMachineRoutesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_headscale_v1_routes_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetMachineRoutesResponse.ProtoReflect.Descriptor instead.
-func (*GetMachineRoutesResponse) Descriptor() ([]byte, []int) {
-	return file_headscale_v1_routes_proto_rawDescGZIP(), []int{8}
-}
-
-func (x *GetMachineRoutesResponse) GetRoutes() []*Route {
+func (x *EnableMachineRoutesResponse) GetRoutes() *Routes {
 	if x != nil {
 		return x.Routes
 	}
@@ -486,60 +276,34 @@ var File_headscale_v1_routes_proto protoreflect.FileDescriptor
 var file_headscale_v1_routes_proto_rawDesc = []byte{
 	0x0a, 0x19, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72,
 	0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0c, 0x68, 0x65, 0x61,
-	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x68, 0x65, 0x61, 0x64,
-	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xea, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x2f, 0x0a, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x15, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x64, 0x76,
-	0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x61,
-	0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x73, 0x5f, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72,
-	0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x50, 0x72, 0x69, 0x6d, 0x61,
-	0x72, 0x79, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x39, 0x0a,
-	0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x75,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x64, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x64, 0x41, 0x74, 0x22, 0x12, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x40, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2b, 0x0a, 0x06,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x68,
-	0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x2f, 0x0a, 0x12, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x04, 0x52, 0x07, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x64, 0x22, 0x15, 0x0a, 0x13, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x30, 0x0a, 0x13, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x6f, 0x75, 0x74,
-	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x72, 0x6f, 0x75, 0x74,
-	0x65, 0x49, 0x64, 0x22, 0x16, 0x0a, 0x14, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x38, 0x0a, 0x17, 0x47,
-	0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x49, 0x64, 0x22, 0x47, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x2b, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x13, 0x2e, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x42, 0x29,
-	0x5a, 0x27, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61,
-	0x6e, 0x66, 0x6f, 0x6e, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f,
-	0x67, 0x65, 0x6e, 0x2f, 0x67, 0x6f, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x22, 0x5c, 0x0a, 0x06, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65,
+	0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10,
+	0x61, 0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x75, 0x74,
+	0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x37, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64,
+	0x22, 0x47, 0x0a, 0x17, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f,
+	0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2c, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x68, 0x65,
+	0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x53, 0x0a, 0x1a, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x4b,
+	0x0a, 0x1b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2c, 0x0a,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x73, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x42, 0x29, 0x5a, 0x27, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61, 0x6e, 0x66, 0x6f,
+	0x6e, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x67, 0x65, 0x6e,
+	0x2f, 0x67, 0x6f, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
@@ -554,32 +318,22 @@ func file_headscale_v1_routes_proto_rawDescGZIP() []byte {
 	return file_headscale_v1_routes_proto_rawDescData
 }

-var file_headscale_v1_routes_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_headscale_v1_routes_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
 var file_headscale_v1_routes_proto_goTypes = []interface{}{
-	(*Route)(nil),                    // 0: headscale.v1.Route
-	(*GetRoutesRequest)(nil),         // 1: headscale.v1.GetRoutesRequest
-	(*GetRoutesResponse)(nil),        // 2: headscale.v1.GetRoutesResponse
-	(*EnableRouteRequest)(nil),       // 3: headscale.v1.EnableRouteRequest
-	(*EnableRouteResponse)(nil),      // 4: headscale.v1.EnableRouteResponse
-	(*DisableRouteRequest)(nil),      // 5: headscale.v1.DisableRouteRequest
-	(*DisableRouteResponse)(nil),     // 6: headscale.v1.DisableRouteResponse
-	(*GetMachineRoutesRequest)(nil),  // 7: headscale.v1.GetMachineRoutesRequest
-	(*GetMachineRoutesResponse)(nil), // 8: headscale.v1.GetMachineRoutesResponse
-	(*Machine)(nil),                  // 9: headscale.v1.Machine
-	(*timestamppb.Timestamp)(nil),    // 10: google.protobuf.Timestamp
+	(*Routes)(nil),                      // 0: headscale.v1.Routes
+	(*GetMachineRouteRequest)(nil),      // 1: headscale.v1.GetMachineRouteRequest
+	(*GetMachineRouteResponse)(nil),     // 2: headscale.v1.GetMachineRouteResponse
+	(*EnableMachineRoutesRequest)(nil),  // 3: headscale.v1.EnableMachineRoutesRequest
+	(*EnableMachineRoutesResponse)(nil), // 4: headscale.v1.EnableMachineRoutesResponse
 }
 var file_headscale_v1_routes_proto_depIdxs = []int32{
-	9,  // 0: headscale.v1.Route.machine:type_name -> headscale.v1.Machine
-	10, // 1: headscale.v1.Route.created_at:type_name -> google.protobuf.Timestamp
-	10, // 2: headscale.v1.Route.updated_at:type_name -> google.protobuf.Timestamp
-	10, // 3: headscale.v1.Route.deleted_at:type_name -> google.protobuf.Timestamp
-	0,  // 4: headscale.v1.GetRoutesResponse.routes:type_name -> headscale.v1.Route
-	0,  // 5: headscale.v1.GetMachineRoutesResponse.routes:type_name -> headscale.v1.Route
-	6,  // [6:6] is the sub-list for method output_type
-	6,  // [6:6] is the sub-list for method input_type
-	6,  // [6:6] is the sub-list for extension type_name
-	6,  // [6:6] is the sub-list for extension extendee
-	0,  // [0:6] is the sub-list for field type_name
+	0, // 0: headscale.v1.GetMachineRouteResponse.routes:type_name -> headscale.v1.Routes
+	0, // 1: headscale.v1.EnableMachineRoutesResponse.routes:type_name -> headscale.v1.Routes
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
 }

 func init() { file_headscale_v1_routes_proto_init() }
@@ -587,10 +341,9 @@ func file_headscale_v1_routes_proto_init() {
 	if File_headscale_v1_routes_proto != nil {
 		return
 	}
-	file_headscale_v1_machine_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_headscale_v1_routes_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Route); i {
+			switch v := v.(*Routes); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -602,7 +355,7 @@ func file_headscale_v1_routes_proto_init() {
 			}
 		}
 		file_headscale_v1_routes_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetRoutesRequest); i {
+			switch v := v.(*GetMachineRouteRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -614,7 +367,7 @@ func file_headscale_v1_routes_proto_init() {
 			}
 		}
 		file_headscale_v1_routes_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetRoutesResponse); i {
+			switch v := v.(*GetMachineRouteResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -626,7 +379,7 @@ func file_headscale_v1_routes_proto_init() {
 			}
 		}
 		file_headscale_v1_routes_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnableRouteRequest); i {
+			switch v := v.(*EnableMachineRoutesRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -638,55 +391,7 @@ func file_headscale_v1_routes_proto_init() {
 			}
 		}
 		file_headscale_v1_routes_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnableRouteResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_headscale_v1_routes_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DisableRouteRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_headscale_v1_routes_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DisableRouteResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_headscale_v1_routes_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMachineRoutesRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_headscale_v1_routes_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMachineRoutesResponse); i {
+			switch v := v.(*EnableMachineRoutesResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -704,7 +409,7 @@ func file_headscale_v1_routes_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_headscale_v1_routes_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   9,
+			NumMessages:   5,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
--- a/gen/openapiv2/headscale/v1/headscale.swagger.json
+++ b/gen/openapiv2/headscale/v1/headscale.swagger.json
@@ -367,12 +367,13 @@
    },
    "/api/v1/machine/{machineId}/routes": {
      "get": {
-        "operationId": "HeadscaleService_GetMachineRoutes",
+        "summary": "--- Route start ---",
+        "operationId": "HeadscaleService_GetMachineRoute",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
-              "$ref": "#/definitions/v1GetMachineRoutesResponse"
+              "$ref": "#/definitions/v1GetMachineRouteResponse"
            }
          },
          "default": {
@@ -394,6 +395,45 @@
        "tags": [
          "HeadscaleService"
        ]
+      },
+      "post": {
+        "operationId": "HeadscaleService_EnableMachineRoutes",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1EnableMachineRoutesResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "machineId",
+            "in": "path",
+            "required": true,
+            "type": "string",
+            "format": "uint64"
+          },
+          {
+            "name": "routes",
+            "in": "query",
+            "required": false,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "collectionFormat": "multi"
+          }
+        ],
+        "tags": [
+          "HeadscaleService"
+        ]
      }
    },
    "/api/v1/machine/{machineId}/tags": {
@@ -682,91 +722,6 @@
          "HeadscaleService"
        ]
      }
-    },
-    "/api/v1/routes": {
-      "get": {
-        "summary": "--- Route start ---",
-        "operationId": "HeadscaleService_GetRoutes",
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "$ref": "#/definitions/v1GetRoutesResponse"
-            }
-          },
-          "default": {
-            "description": "An unexpected error response.",
-            "schema": {
-              "$ref": "#/definitions/rpcStatus"
-            }
-          }
-        },
-        "tags": [
-          "HeadscaleService"
-        ]
-      }
-    },
-    "/api/v1/routes/{routeId}/disable": {
-      "post": {
-        "operationId": "HeadscaleService_DisableRoute",
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "$ref": "#/definitions/v1DisableRouteResponse"
-            }
-          },
-          "default": {
-            "description": "An unexpected error response.",
-            "schema": {
-              "$ref": "#/definitions/rpcStatus"
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "routeId",
-            "in": "path",
-            "required": true,
-            "type": "string",
-            "format": "uint64"
-          }
-        ],
-        "tags": [
-          "HeadscaleService"
-        ]
-      }
-    },
-    "/api/v1/routes/{routeId}/enable": {
-      "post": {
-        "operationId": "HeadscaleService_EnableRoute",
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "$ref": "#/definitions/v1EnableRouteResponse"
-            }
-          },
-          "default": {
-            "description": "An unexpected error response.",
-            "schema": {
-              "$ref": "#/definitions/rpcStatus"
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "routeId",
-            "in": "path",
-            "required": true,
-            "type": "string",
-            "format": "uint64"
-          }
-        ],
-        "tags": [
-          "HeadscaleService"
-        ]
-      }
    }
  },
  "definitions": {
@@ -920,11 +875,13 @@
    "v1DeleteNamespaceResponse": {
      "type": "object"
    },
-    "v1DisableRouteResponse": {
-      "type": "object"
-    },
-    "v1EnableRouteResponse": {
-      "type": "object"
+    "v1EnableMachineRoutesResponse": {
+      "type": "object",
+      "properties": {
+        "routes": {
+          "$ref": "#/definitions/v1Routes"
+        }
+      }
    },
    "v1ExpireApiKeyRequest": {
      "type": "object",
@@ -967,14 +924,11 @@
        }
      }
    },
-    "v1GetMachineRoutesResponse": {
+    "v1GetMachineRouteResponse": {
      "type": "object",
      "properties": {
        "routes": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/v1Route"
-          }
+          "$ref": "#/definitions/v1Routes"
        }
      }
    },
@@ -986,17 +940,6 @@
        }
      }
    },
-    "v1GetRoutesResponse": {
-      "type": "object",
-      "properties": {
-        "routes": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/v1Route"
-          }
-        }
-      }
-    },
    "v1ListApiKeysResponse": {
      "type": "object",
      "properties": {
@@ -1208,39 +1151,20 @@
        }
      }
    },
-    "v1Route": {
+    "v1Routes": {
      "type": "object",
      "properties": {
-        "id": {
-          "type": "string",
-          "format": "uint64"
+        "advertisedRoutes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
        },
-        "machine": {
-          "$ref": "#/definitions/v1Machine"
-        },
-        "prefix": {
-          "type": "string"
-        },
-        "advertised": {
-          "type": "boolean"
-        },
-        "enabled": {
-          "type": "boolean"
-        },
-        "isPrimary": {
-          "type": "boolean"
-        },
-        "createdAt": {
-          "type": "string",
-          "format": "date-time"
-        },
-        "updatedAt": {
-          "type": "string",
-          "format": "date-time"
-        },
-        "deletedAt": {
-          "type": "string",
-          "format": "date-time"
+        "enabledRoutes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
        }
      }
    },
--- a/go.mod
+++ b/go.mod
@@ -42,7 +42,7 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/postgres v1.4.5
 	gorm.io/gorm v1.24.2
-	tailscale.com v1.34.0
+	tailscale.com v1.32.3
 )

 require (
@@ -132,7 +132,6 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
-	golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 // indirect
 	golang.org/x/mod v0.7.0 // indirect
 	golang.org/x/sys v0.3.0 // indirect
 	golang.org/x/term v0.2.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -718,7 +718,6 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
-golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
 golang.org/x/exp/typeparams v0.0.0-20220328175248-053ad81199eb h1:fP6C8Xutcp5AlakmT/SkQot0pMicROAsEX7OfNPuG10=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1245,7 +1244,7 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.4.0-0.dev.0.20220517111757-f4a2f64ce238 h1:8Vr1KP9OTjoKQSSeLefzibQgDV4s2ujJElKHqMi7nsA=
+honnef.co/go/tools v0.4.0-0.dev.0.20220404092545-59d7a2877f83 h1:lZ9GIYaU+o5+X6ST702I/Ntyq9Y2oIMZ42rBQpem64A=
 howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
@@ -1296,6 +1295,6 @@ nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-software.sslmate.com/src/go-pkcs12 v0.2.0 h1:nlFkj7bTysH6VkC4fGphtjXRbezREPgrHuJG20hBGPE=
-tailscale.com v1.34.0 h1:ntWjElpoTfjbBjYC4gt0jH/V4tjRfl3FW7ZEDu8u+4s=
-tailscale.com v1.34.0/go.mod h1:ZsBP7rjzzB2rp+UCOumr9DAe0EQ6OPivwSXcz/BrekQ=
+software.sslmate.com/src/go-pkcs12 v0.0.0-20210415151418-c5206de65a78 h1:SqYE5+A2qvRhErbsXFfUEUmpWEKxxRSMgGLkvRAFOV4=
+tailscale.com v1.32.3 h1:zQbS6xdJzk8SXcUxG6kPo+4aDqXByeP7NjivNpnTN+c=
+tailscale.com v1.32.3/go.mod h1:AwKk+tI7z1+EXzmLxVNXA4dBpgTKd6RVV1VjFYEiv94=
--- a/grpcv1.go
+++ b/grpcv1.go
@@ -364,60 +364,36 @@ func (api headscaleV1APIServer) MoveMachine(
 	return &v1.MoveMachineResponse{Machine: machine.toProto()}, nil
 }

-func (api headscaleV1APIServer) GetRoutes(
+func (api headscaleV1APIServer) GetMachineRoute(
 	ctx context.Context,
-	request *v1.GetRoutesRequest,
-) (*v1.GetRoutesResponse, error) {
-	routes, err := api.h.GetRoutes()
-	if err != nil {
-		return nil, err
-	}
-
-	return &v1.GetRoutesResponse{
-		Routes: Routes(routes).toProto(),
-	}, nil
-}
-
-func (api headscaleV1APIServer) EnableRoute(
-	ctx context.Context,
-	request *v1.EnableRouteRequest,
-) (*v1.EnableRouteResponse, error) {
-	err := api.h.EnableRoute(request.GetRouteId())
-	if err != nil {
-		return nil, err
-	}
-
-	return &v1.EnableRouteResponse{}, nil
-}
-
-func (api headscaleV1APIServer) DisableRoute(
-	ctx context.Context,
-	request *v1.DisableRouteRequest,
-) (*v1.DisableRouteResponse, error) {
-	err := api.h.DisableRoute(request.GetRouteId())
-	if err != nil {
-		return nil, err
-	}
-
-	return &v1.DisableRouteResponse{}, nil
-}
-
-func (api headscaleV1APIServer) GetMachineRoutes(
-	ctx context.Context,
-	request *v1.GetMachineRoutesRequest,
-) (*v1.GetMachineRoutesResponse, error) {
+	request *v1.GetMachineRouteRequest,
+) (*v1.GetMachineRouteResponse, error) {
 	machine, err := api.h.GetMachineByID(request.GetMachineId())
 	if err != nil {
 		return nil, err
 	}

-	routes, err := api.h.GetMachineRoutes(machine)
+	return &v1.GetMachineRouteResponse{
+		Routes: machine.RoutesToProto(),
+	}, nil
+}
+
+func (api headscaleV1APIServer) EnableMachineRoutes(
+	ctx context.Context,
+	request *v1.EnableMachineRoutesRequest,
+) (*v1.EnableMachineRoutesResponse, error) {
+	machine, err := api.h.GetMachineByID(request.GetMachineId())
 	if err != nil {
 		return nil, err
 	}

-	return &v1.GetMachineRoutesResponse{
-		Routes: Routes(routes).toProto(),
+	err = api.h.EnableRoutes(machine, request.GetRoutes()...)
+	if err != nil {
+		return nil, err
+	}
+
+	return &v1.EnableMachineRoutesResponse{
+		Routes: machine.RoutesToProto(),
 	}, nil
 }

@@ -521,7 +497,6 @@ func (api headscaleV1APIServer) DebugCreateMachine(

 		HostInfo: HostInfo(hostinfo),
 	}
-
 	nodeKey := key.NodePublic{}
 	err = nodeKey.UnmarshalText([]byte(request.GetKey()))
 	if err != nil {
--- a/integration/cli_test.go
+++ b/integration/cli_test.go
@@ -2,9 +2,7 @@ package integration

 import (
 	"encoding/json"
-	"fmt"
 	"sort"
-	"strconv"
 	"testing"
 	"time"

@@ -391,144 +389,3 @@ func TestPreAuthKeyCommandReusableEphemeral(t *testing.T) {
 	err = scenario.Shutdown()
 	assert.NoError(t, err)
 }
-
-func TestEnablingRoutes(t *testing.T) {
-	IntegrationSkip(t)
-	t.Parallel()
-
-	namespace := "enable-routing"
-
-	scenario, err := NewScenario()
-	assert.NoError(t, err)
-
-	spec := map[string]int{
-		namespace: 3,
-	}
-
-	err = scenario.CreateHeadscaleEnv(spec, []tsic.Option{}, hsic.WithTestName("clienableroute"))
-	assert.NoError(t, err)
-
-	allClients, err := scenario.ListTailscaleClients()
-	if err != nil {
-		t.Errorf("failed to get clients: %s", err)
-	}
-
-	err = scenario.WaitForTailscaleSync()
-	if err != nil {
-		t.Errorf("failed wait for tailscale clients to be in sync: %s", err)
-	}
-
-	headscale, err := scenario.Headscale()
-	assert.NoError(t, err)
-
-	// advertise routes using the up command
-	for i, client := range allClients {
-		routeStr := fmt.Sprintf("10.0.%d.0/24", i)
-		hostname, _ := client.FQDN()
-		_, _, err = client.Execute([]string{
-			"tailscale",
-			"up",
-			fmt.Sprintf("--advertise-routes=%s", routeStr),
-			"-login-server", headscale.GetEndpoint(),
-			"--hostname", hostname,
-		})
-		assert.NoError(t, err)
-	}
-
-	err = scenario.WaitForTailscaleSync()
-	if err != nil {
-		t.Errorf("failed wait for tailscale clients to be in sync: %s", err)
-	}
-
-	var routes []*v1.Route
-	err = executeAndUnmarshal(
-		headscale,
-		[]string{
-			"headscale",
-			"routes",
-			"list",
-			"--output",
-			"json",
-		},
-		&routes,
-	)
-
-	assert.NoError(t, err)
-	assert.Len(t, routes, 3)
-
-	for _, route := range routes {
-		assert.Equal(t, route.Advertised, true)
-		assert.Equal(t, route.Enabled, false)
-		assert.Equal(t, route.IsPrimary, false)
-	}
-
-	for _, route := range routes {
-		_, err = headscale.Execute(
-			[]string{
-				"headscale",
-				"routes",
-				"enable",
-				"--route",
-				strconv.Itoa(int(route.Id)),
-			})
-		assert.NoError(t, err)
-	}
-
-	var enablingRoutes []*v1.Route
-	err = executeAndUnmarshal(
-		headscale,
-		[]string{
-			"headscale",
-			"routes",
-			"list",
-			"--output",
-			"json",
-		},
-		&enablingRoutes,
-	)
-	assert.NoError(t, err)
-
-	for _, route := range enablingRoutes {
-		assert.Equal(t, route.Advertised, true)
-		assert.Equal(t, route.Enabled, true)
-		assert.Equal(t, route.IsPrimary, true)
-	}
-
-	routeIDToBeDisabled := enablingRoutes[0].Id
-
-	_, err = headscale.Execute(
-		[]string{
-			"headscale",
-			"routes",
-			"disable",
-			"--route",
-			strconv.Itoa(int(routeIDToBeDisabled)),
-		})
-	assert.NoError(t, err)
-
-	var disablingRoutes []*v1.Route
-	err = executeAndUnmarshal(
-		headscale,
-		[]string{
-			"headscale",
-			"routes",
-			"list",
-			"--output",
-			"json",
-		},
-		&disablingRoutes,
-	)
-	assert.NoError(t, err)
-
-	for _, route := range disablingRoutes {
-		assert.Equal(t, true, route.Advertised)
-
-		if route.Id == routeIDToBeDisabled {
-			assert.Equal(t, route.Enabled, false)
-			assert.Equal(t, route.IsPrimary, false)
-		} else {
-			assert.Equal(t, route.Enabled, true)
-			assert.Equal(t, route.IsPrimary, true)
-		}
-	}
-}
--- a/integration/scenario.go
+++ b/integration/scenario.go
@@ -32,8 +32,7 @@ var (
 	tailscaleVersions2021 = []string{
 		"head",
 		"unstable",
-		"1.34.0",
-		"1.32.3",
+		"1.32.1",
 		"1.30.2",
 	}

--- a/integration_cli_test.go
+++ b/integration_cli_test.go
@@ -1243,6 +1243,199 @@ func (s *IntegrationCLITestSuite) TestNodeRenameCommand() {
 	assert.Contains(s.T(), listAllAfterRenameAttempt[4].GetGivenName(), "machine-5")
 }

+func (s *IntegrationCLITestSuite) TestRouteCommand() {
+	namespace, err := s.createNamespace("routes-namespace")
+	assert.Nil(s.T(), err)
+
+	// Randomly generated machine keys
+	machineKey := "nodekey:9b2ffa7e08cc421a3d2cca9012280f6a236fd0de0b4ce005b30a98ad930306fe"
+
+	_, _, err = ExecuteCommand(
+		&s.headscale,
+		[]string{
+			"headscale",
+			"debug",
+			"create-node",
+			"--name",
+			"route-machine",
+			"--namespace",
+			namespace.Name,
+			"--key",
+			machineKey,
+			"--route",
+			"10.0.0.0/8",
+			"--route",
+			"192.168.1.0/24",
+			"--output",
+			"json",
+		},
+		[]string{},
+	)
+	assert.Nil(s.T(), err)
+
+	machineResult, _, err := ExecuteCommand(
+		&s.headscale,
+		[]string{
+			"headscale",
+			"nodes",
+			"--namespace",
+			namespace.Name,
+			"register",
+			"--key",
+			machineKey,
+			"--output",
+			"json",
+		},
+		[]string{},
+	)
+	assert.Nil(s.T(), err)
+
+	var machine v1.Machine
+	err = json.Unmarshal([]byte(machineResult), &machine)
+	assert.Nil(s.T(), err)
+
+	assert.Equal(s.T(), uint64(1), machine.Id)
+	assert.Equal(s.T(), "route-machine", machine.Name)
+
+	listAllResult, _, err := ExecuteCommand(
+		&s.headscale,
+		[]string{
+			"headscale",
+			"routes",
+			"list",
+			"--output",
+			"json",
+			"--identifier",
+			"0",
+		},
+		[]string{},
+	)
+	assert.Nil(s.T(), err)
+
+	var listAll v1.Routes
+	err = json.Unmarshal([]byte(listAllResult), &listAll)
+	assert.Nil(s.T(), err)
+
+	assert.Len(s.T(), listAll.AdvertisedRoutes, 2)
+	assert.Contains(s.T(), listAll.AdvertisedRoutes, "10.0.0.0/8")
+	assert.Contains(s.T(), listAll.AdvertisedRoutes, "192.168.1.0/24")
+
+	assert.Empty(s.T(), listAll.EnabledRoutes)
+
+	enableTwoRoutesResult, _, err := ExecuteCommand(
+		&s.headscale,
+		[]string{
+			"headscale",
+			"routes",
+			"enable",
+			"--output",
+			"json",
+			"--identifier",
+			"0",
+			"--route",
+			"10.0.0.0/8",
+			"--route",
+			"192.168.1.0/24",
+		},
+		[]string{},
+	)
+	assert.Nil(s.T(), err)
+
+	var enableTwoRoutes v1.Routes
+	err = json.Unmarshal([]byte(enableTwoRoutesResult), &enableTwoRoutes)
+	assert.Nil(s.T(), err)
+
+	assert.Len(s.T(), enableTwoRoutes.AdvertisedRoutes, 2)
+	assert.Contains(s.T(), enableTwoRoutes.AdvertisedRoutes, "10.0.0.0/8")
+	assert.Contains(s.T(), enableTwoRoutes.AdvertisedRoutes, "192.168.1.0/24")
+
+	assert.Len(s.T(), enableTwoRoutes.EnabledRoutes, 2)
+	assert.Contains(s.T(), enableTwoRoutes.EnabledRoutes, "10.0.0.0/8")
+	assert.Contains(s.T(), enableTwoRoutes.EnabledRoutes, "192.168.1.0/24")
+
+	// Enable only one route, effectively disabling one of the routes
+	enableOneRouteResult, _, err := ExecuteCommand(
+		&s.headscale,
+		[]string{
+			"headscale",
+			"routes",
+			"enable",
+			"--output",
+			"json",
+			"--identifier",
+			"0",
+			"--route",
+			"10.0.0.0/8",
+		},
+		[]string{},
+	)
+	assert.Nil(s.T(), err)
+
+	var enableOneRoute v1.Routes
+	err = json.Unmarshal([]byte(enableOneRouteResult), &enableOneRoute)
+	assert.Nil(s.T(), err)
+
+	assert.Len(s.T(), enableOneRoute.AdvertisedRoutes, 2)
+	assert.Contains(s.T(), enableOneRoute.AdvertisedRoutes, "10.0.0.0/8")
+	assert.Contains(s.T(), enableOneRoute.AdvertisedRoutes, "192.168.1.0/24")
+
+	assert.Len(s.T(), enableOneRoute.EnabledRoutes, 1)
+	assert.Contains(s.T(), enableOneRoute.EnabledRoutes, "10.0.0.0/8")
+
+	// Enable only one route, effectively disabling one of the routes
+	failEnableNonAdvertisedRoute, _, err := ExecuteCommand(
+		&s.headscale,
+		[]string{
+			"headscale",
+			"routes",
+			"enable",
+			"--output",
+			"json",
+			"--identifier",
+			"0",
+			"--route",
+			"11.0.0.0/8",
+		},
+		[]string{},
+	)
+	assert.Nil(s.T(), err)
+
+	assert.Contains(
+		s.T(),
+		string(failEnableNonAdvertisedRoute),
+		"route (route-machine) is not available on node",
+	)
+
+	// Enable all routes on host
+	enableAllRouteResult, _, err := ExecuteCommand(
+		&s.headscale,
+		[]string{
+			"headscale",
+			"routes",
+			"enable",
+			"--output",
+			"json",
+			"--identifier",
+			"0",
+			"--all",
+		},
+		[]string{},
+	)
+	assert.Nil(s.T(), err)
+
+	var enableAllRoute v1.Routes
+	err = json.Unmarshal([]byte(enableAllRouteResult), &enableAllRoute)
+	assert.Nil(s.T(), err)
+
+	assert.Len(s.T(), enableAllRoute.AdvertisedRoutes, 2)
+	assert.Contains(s.T(), enableAllRoute.AdvertisedRoutes, "10.0.0.0/8")
+	assert.Contains(s.T(), enableAllRoute.AdvertisedRoutes, "192.168.1.0/24")
+
+	assert.Len(s.T(), enableAllRoute.EnabledRoutes, 2)
+	assert.Contains(s.T(), enableAllRoute.EnabledRoutes, "10.0.0.0/8")
+	assert.Contains(s.T(), enableAllRoute.EnabledRoutes, "192.168.1.0/24")
+}
+
 func (s *IntegrationCLITestSuite) TestApiKeyCommand() {
 	count := 5

--- a/integration_common_test.go
+++ b/integration_common_test.go
@@ -32,8 +32,7 @@ var (
 	tailscaleVersions = []string{
 		"head",
 		"unstable",
-		"1.34.0",
-		"1.32.3",
+		"1.32.0",
 		"1.30.2",
 		"1.28.0",
 		"1.26.2",
--- a/integration_test/etc/alt-config.dump.gold.yaml
+++ b/integration_test/etc/alt-config.dump.gold.yaml
@@ -3,7 +3,6 @@ cli:
  insecure: false
  timeout: 5s
 db_path: /tmp/integration_test_db.sqlite3
-db_ssl: false
 db_type: sqlite3
 derp:
  auto_update_enabled: false
--- a/integration_test/etc/alt-config.yaml
+++ b/integration_test/etc/alt-config.yaml
@@ -16,7 +16,6 @@ dns_config:
    - 127.0.0.11
    - 1.1.1.1
 db_path: /tmp/integration_test_db.sqlite3
-db_ssl: false
 private_key_path: private.key
 noise:
  private_key_path: noise_private.key
--- a/integration_test/etc/alt-env-config.dump.gold.yaml
+++ b/integration_test/etc/alt-env-config.dump.gold.yaml
@@ -3,7 +3,6 @@ cli:
  insecure: false
  timeout: 5s
 db_path: /tmp/integration_test_db.sqlite3
-db_ssl: false
 db_type: sqlite3
 derp:
  auto_update_enabled: false
--- a/integration_test/etc/alt-env-config.yaml
+++ b/integration_test/etc/alt-env-config.yaml
@@ -15,7 +15,6 @@ dns_config:
  nameservers:
    - 1.1.1.1
 db_path: /tmp/integration_test_db.sqlite3
-db_ssl: false
 private_key_path: private.key
 noise:
  private_key_path: noise_private.key
--- a/integration_test/etc/config.dump.gold.yaml
+++ b/integration_test/etc/config.dump.gold.yaml
@@ -3,7 +3,6 @@ cli:
  insecure: false
  timeout: 5s
 db_path: /tmp/integration_test_db.sqlite3
-db_ssl: false
 db_type: sqlite3
 derp:
  auto_update_enabled: false
--- a/machine.go
+++ b/machine.go
@@ -13,7 +13,6 @@ import (
 	v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
 	"github.com/rs/zerolog/log"
 	"google.golang.org/protobuf/types/known/timestamppb"
-	"gorm.io/gorm"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 )
@@ -38,6 +37,11 @@ const (
 	maxHostnameLength = 255
 )

+var (
+	ExitRouteV4 = netip.MustParsePrefix("0.0.0.0/0")
+	ExitRouteV6 = netip.MustParsePrefix("::/0")
+)
+
 // Machine is a Headscale client.
 type Machine struct {
 	ID          uint64 `gorm:"primary_key"`
@@ -72,8 +76,9 @@ type Machine struct {
 	LastSuccessfulUpdate *time.Time
 	Expiry               *time.Time

-	HostInfo  HostInfo
-	Endpoints StringList
+	HostInfo      HostInfo
+	Endpoints     StringList
+	EnabledRoutes IPPrefixes

 	CreatedAt time.Time
 	UpdatedAt time.Time
@@ -138,17 +143,6 @@ func (machine Machine) isExpired() bool {
 	return time.Now().UTC().After(*machine.Expiry)
 }

-// isOnline returns if the machine is connected to Headscale.
-// This is really a naive implementation, as we don't really see
-// if there is a working connection between the client and the server.
-func (machine *Machine) isOnline() bool {
-	if machine.LastSeen == nil {
-		return false
-	}
-
-	return machine.LastSeen.After(time.Now().Add(-keepAliveInterval))
-}
-
 func containsAddresses(inputs []string, addrs []string) bool {
 	for _, addr := range addrs {
 		if contains(inputs, addr) {
@@ -601,15 +595,14 @@ func (machines MachinesP) String() string {
 	return fmt.Sprintf("[ %s ](%d)", strings.Join(temp, ", "), len(temp))
 }

-func (h *Headscale) toNodes(
-	machines Machines,
+func (machines Machines) toNodes(
 	baseDomain string,
 	dnsConfig *tailcfg.DNSConfig,
 ) ([]*tailcfg.Node, error) {
 	nodes := make([]*tailcfg.Node, len(machines))

 	for index, machine := range machines {
-		node, err := h.toNode(machine, baseDomain, dnsConfig)
+		node, err := machine.toNode(baseDomain, dnsConfig)
 		if err != nil {
 			return nil, err
 		}
@@ -622,8 +615,7 @@ func (h *Headscale) toNodes(

 // toNode converts a Machine into a Tailscale Node. includeRoutes is false for shared nodes
 // as per the expected behaviour in the official SaaS.
-func (h *Headscale) toNode(
-	machine Machine,
+func (machine Machine) toNode(
 	baseDomain string,
 	dnsConfig *tailcfg.DNSConfig,
 ) (*tailcfg.Node, error) {
@@ -671,18 +663,23 @@ func (h *Headscale) toNode(
 		[]netip.Prefix{},
 		addrs...) // we append the node own IP, as it is required by the clients

-	enabledRoutes, err := h.GetEnabledRoutes(&machine)
-	if err != nil {
-		return nil, err
-	}
+	allowedIPs = append(allowedIPs, machine.EnabledRoutes...)

-	allowedIPs = append(allowedIPs, enabledRoutes...)
+	// TODO(kradalby): This is kind of a hack where we say that
+	// all the announced routes (except exit), is presented as primary
+	// routes. This might be problematic if two nodes expose the same route.
+	// This was added to address an issue where subnet routers stopped working
+	// when we only populated AllowedIPs.
+	primaryRoutes := []netip.Prefix{}
+	if len(machine.EnabledRoutes) > 0 {
+		for _, route := range machine.EnabledRoutes {
+			if route == ExitRouteV4 || route == ExitRouteV6 {
+				continue
+			}

-	primaryRoutes, err := h.getMachinePrimaryRoutes(&machine)
-	if err != nil {
-		return nil, err
+			primaryRoutes = append(primaryRoutes, route)
+		}
 	}
-	primaryPrefixes := Routes(primaryRoutes).toPrefixes()

 	var derp string
 	if machine.HostInfo.NetInfo != nil {
@@ -719,7 +716,9 @@ func (h *Headscale) toNode(

 	hostInfo := machine.GetHostInfo()

-	online := machine.isOnline()
+	// A node is Online if it is connected to the control server,
+	// and we now we update LastSeen every keepAliveInterval duration at least.
+	online := machine.LastSeen.After(time.Now().Add(-keepAliveInterval))

 	node := tailcfg.Node{
 		ID: tailcfg.NodeID(machine.ID), // this is the actual ID
@@ -734,7 +733,7 @@ func (h *Headscale) toNode(
 		DiscoKey:      discoKey,
 		Addresses:     addrs,
 		AllowedIPs:    allowedIPs,
-		PrimaryRoutes: primaryPrefixes,
+		PrimaryRoutes: primaryRoutes,
 		Endpoints:     machine.Endpoints,
 		DERP:          derp,

@@ -928,69 +927,21 @@ func (h *Headscale) RegisterMachine(machine Machine,
 	return &machine, nil
 }

-// GetAdvertisedRoutes returns the routes that are be advertised by the given machine.
-func (h *Headscale) GetAdvertisedRoutes(machine *Machine) ([]netip.Prefix, error) {
-	routes := []Route{}
-
-	err := h.db.
-		Preload("Machine").
-		Where("machine_id = ? AND advertised = ?", machine.ID, true).Find(&routes).Error
-	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-		log.Error().
-			Caller().
-			Err(err).
-			Str("machine", machine.Hostname).
-			Msg("Could not get advertised routes for machine")
-
-		return nil, err
-	}
-
-	prefixes := []netip.Prefix{}
-	for _, route := range routes {
-		prefixes = append(prefixes, netip.Prefix(route.Prefix))
-	}
-
-	return prefixes, nil
+func (machine *Machine) GetAdvertisedRoutes() []netip.Prefix {
+	return machine.HostInfo.RoutableIPs
 }

-// GetEnabledRoutes returns the routes that are enabled for the machine.
-func (h *Headscale) GetEnabledRoutes(machine *Machine) ([]netip.Prefix, error) {
-	routes := []Route{}
-
-	err := h.db.
-		Preload("Machine").
-		Where("machine_id = ? AND advertised = ? AND enabled = ?", machine.ID, true, true).
-		Find(&routes).Error
-	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-		log.Error().
-			Caller().
-			Err(err).
-			Str("machine", machine.Hostname).
-			Msg("Could not get enabled routes for machine")
-
-		return nil, err
-	}
-
-	prefixes := []netip.Prefix{}
-	for _, route := range routes {
-		prefixes = append(prefixes, netip.Prefix(route.Prefix))
-	}
-
-	return prefixes, nil
+func (machine *Machine) GetEnabledRoutes() []netip.Prefix {
+	return machine.EnabledRoutes
 }

-func (h *Headscale) IsRoutesEnabled(machine *Machine, routeStr string) bool {
+func (machine *Machine) IsRoutesEnabled(routeStr string) bool {
 	route, err := netip.ParsePrefix(routeStr)
 	if err != nil {
 		return false
 	}

-	enabledRoutes, err := h.GetEnabledRoutes(machine)
-	if err != nil {
-		log.Error().Err(err).Msg("Could not get enabled routes")
-
-		return false
-	}
+	enabledRoutes := machine.GetEnabledRoutes()

 	for _, enabledRoute := range enabledRoutes {
 		if route == enabledRoute {
@@ -1001,7 +952,8 @@ func (h *Headscale) IsRoutesEnabled(machine *Machine, routeStr string) bool {
 	return false
 }

-// EnableRoutes enables new routes based on a list of new routes.
+// EnableNodeRoute enables new routes based on a list of new routes. It will _replace_ the
+// previous list of routes.
 func (h *Headscale) EnableRoutes(machine *Machine, routeStrs ...string) error {
 	newRoutes := make([]netip.Prefix, len(routeStrs))
 	for index, routeStr := range routeStrs {
@@ -1013,13 +965,8 @@ func (h *Headscale) EnableRoutes(machine *Machine, routeStrs ...string) error {
 		newRoutes[index] = route
 	}

-	advertisedRoutes, err := h.GetAdvertisedRoutes(machine)
-	if err != nil {
-		return err
-	}
-
 	for _, newRoute := range newRoutes {
-		if !contains(advertisedRoutes, newRoute) {
+		if !contains(machine.GetAdvertisedRoutes(), newRoute) {
 			return fmt.Errorf(
 				"route (%s) is not available on node %s: %w",
 				machine.Hostname,
@@ -1028,77 +975,52 @@ func (h *Headscale) EnableRoutes(machine *Machine, routeStrs ...string) error {
 		}
 	}

-	// Separate loop so we don't leave things in a half-updated state
-	for _, prefix := range newRoutes {
-		route := Route{}
-		err := h.db.Preload("Machine").
-			Where("machine_id = ? AND prefix = ?", machine.ID, IPPrefix(prefix)).
-			First(&route).Error
-		if err == nil {
-			route.Enabled = true
+	machine.EnabledRoutes = newRoutes

-			// Mark already as primary if there is only this node offering this subnet
-			// (and is not an exit route)
-			if !route.isExitRoute() {
-				route.IsPrimary = h.isUniquePrefix(route)
-			}
-
-			err = h.db.Save(&route).Error
-			if err != nil {
-				return fmt.Errorf("failed to enable route: %w", err)
-			}
-		} else {
-			return fmt.Errorf("failed to find route: %w", err)
-		}
+	if err := h.db.Save(machine).Error; err != nil {
+		return fmt.Errorf("failed enable routes for machine in the database: %w", err)
 	}

 	return nil
 }

-// EnableAutoApprovedRoutes enables any routes advertised by a machine that match the ACL autoApprovers policy.
-func (h *Headscale) EnableAutoApprovedRoutes(machine *Machine) error {
+// Enabled any routes advertised by a machine that match the ACL autoApprovers policy.
+func (h *Headscale) EnableAutoApprovedRoutes(machine *Machine) {
 	if len(machine.IPAddresses) == 0 {
-		return nil // This machine has no IPAddresses, so can't possibly match any autoApprovers ACLs
+		return // This machine has no IPAddresses, so can't possibly match any autoApprovers ACLs
 	}

-	routes := []Route{}
-	err := h.db.
-		Preload("Machine").
-		Where("machine_id = ? AND advertised = true AND enabled = false", machine.ID).Find(&routes).Error
-	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-		log.Error().
-			Caller().
-			Err(err).
-			Str("machine", machine.Hostname).
-			Msg("Could not get advertised routes for machine")
+	approvedRoutes := make([]netip.Prefix, 0, len(machine.HostInfo.RoutableIPs))
+	thisMachine := []Machine{*machine}

-		return err
-	}
+	for _, advertisedRoute := range machine.HostInfo.RoutableIPs {
+		if contains(machine.EnabledRoutes, advertisedRoute) {
+			continue // Skip routes that are already enabled for the node
+		}

-	approvedRoutes := []Route{}
-
-	for _, advertisedRoute := range routes {
-		routeApprovers, err := h.aclPolicy.AutoApprovers.GetRouteApprovers(netip.Prefix(advertisedRoute.Prefix))
+		routeApprovers, err := h.aclPolicy.AutoApprovers.GetRouteApprovers(
+			advertisedRoute,
+		)
 		if err != nil {
 			log.Err(err).
 				Str("advertisedRoute", advertisedRoute.String()).
 				Uint64("machineId", machine.ID).
 				Msg("Failed to resolve autoApprovers for advertised route")

-			return err
+			return
 		}

 		for _, approvedAlias := range routeApprovers {
 			if approvedAlias == machine.Namespace.Name {
 				approvedRoutes = append(approvedRoutes, advertisedRoute)
 			} else {
-				approvedIps, err := expandAlias([]Machine{*machine}, *h.aclPolicy, approvedAlias, h.cfg.OIDC.StripEmaildomain)
+				approvedIps, err := expandAlias(thisMachine, *h.aclPolicy, approvedAlias, h.cfg.OIDC.StripEmaildomain)
 				if err != nil {
 					log.Err(err).
 						Str("alias", approvedAlias).
 						Msg("Failed to expand alias when processing autoApprovers policy")

-					return err
+					return
 				}

 				// approvedIPs should contain all of machine's IPs if it matches the rule, so check for first
@@ -1109,20 +1031,26 @@ func (h *Headscale) EnableAutoApprovedRoutes(machine *Machine) error {
 		}
 	}

-	for i, approvedRoute := range approvedRoutes {
-		approvedRoutes[i].Enabled = true
-		err = h.db.Save(&approvedRoutes[i]).Error
-		if err != nil {
-			log.Err(err).
-				Str("approvedRoute", approvedRoute.String()).
-				Uint64("machineId", machine.ID).
-				Msg("Failed to enable approved route")
-
-			return err
+	for _, approvedRoute := range approvedRoutes {
+		if !contains(machine.EnabledRoutes, approvedRoute) {
+			log.Info().
+				Str("route", approvedRoute.String()).
+				Uint64("client", machine.ID).
+				Msg("Enabling autoApproved route for client")
+			machine.EnabledRoutes = append(machine.EnabledRoutes, approvedRoute)
 		}
 	}
+}

-	return nil
+func (machine *Machine) RoutesToProto() *v1.Routes {
+	availableRoutes := machine.GetAdvertisedRoutes()
+
+	enabledRoutes := machine.GetEnabledRoutes()
+
+	return &v1.Routes{
+		AdvertisedRoutes: ipPrefixToString(availableRoutes),
+		EnabledRoutes:    ipPrefixToString(enabledRoutes),
+	}
 }

 func (h *Headscale) generateGivenName(suppliedName string, randomSuffix bool) (string, error) {
--- a/machine_test.go
+++ b/machine_test.go
@@ -1153,16 +1153,9 @@ func (s *Suite) TestAutoApproveRoutes(c *check.C) {

 	app.db.Save(&machine)

-	err = app.processMachineRoutes(&machine)
-	c.Assert(err, check.IsNil)
-
 	machine0ByID, err := app.GetMachineByID(0)
 	c.Assert(err, check.IsNil)

-	err = app.EnableAutoApprovedRoutes(machine0ByID)
-	c.Assert(err, check.IsNil)
-
-	enabledRoutes, err := app.GetEnabledRoutes(machine0ByID)
-	c.Assert(err, check.IsNil)
-	c.Assert(enabledRoutes, check.HasLen, 3)
+	app.EnableAutoApprovedRoutes(machine0ByID)
+	c.Assert(machine0ByID.GetEnabledRoutes(), check.HasLen, 3)
 }
--- a/noise.go
+++ b/noise.go
@@ -36,7 +36,7 @@ func (h *Headscale) NoiseUpgradeHandler(
 		return
 	}

-	noiseConn, err := controlhttp.AcceptHTTP(req.Context(), writer, req, *h.noisePrivateKey, nil)
+	noiseConn, err := controlhttp.AcceptHTTP(req.Context(), writer, req, *h.noisePrivateKey)
 	if err != nil {
 		log.Error().Err(err).Msg("noise upgrade failed")
 		http.Error(writer, err.Error(), http.StatusInternalServerError)
--- a/oidc.go
+++ b/oidc.go
@@ -25,7 +25,6 @@ const (
 	errEmptyOIDCCallbackParams = Error("empty OIDC callback params")
 	errNoOIDCIDToken           = Error("could not extract ID Token for OIDC callback")
 	errOIDCAllowedDomains      = Error("authenticated principal does not match any allowed domain")
-	errOIDCAllowedGroups       = Error("authenticated principal is not in any allowed group")
 	errOIDCAllowedUsers        = Error("authenticated principal does not match any allowed user")
 	errOIDCInvalidMachineState = Error("requested machine state key expired before authorisation completed")
 	errOIDCNodeKeyMissing      = Error("could not get node key from cache")
@@ -210,10 +209,6 @@ func (h *Headscale) OIDCCallback(
 		return
 	}

-	if err := validateOIDCAllowedGroups(writer, h.cfg.OIDC.AllowedGroups, claims); err != nil {
-		return
-	}
-
 	if err := validateOIDCAllowedUsers(writer, h.cfg.OIDC.AllowedUsers, claims); err != nil {
 		return
 	}
@@ -409,39 +404,6 @@ func validateOIDCAllowedDomains(
 	return nil
 }

-// validateOIDCAllowedGroups checks if AllowedGroups is provided,
-// and that the user has one group in the list.
-// claims.Groups can be populated by adding a client scope named
-// 'groups' that contains group membership.
-func validateOIDCAllowedGroups(
-	writer http.ResponseWriter,
-	allowedGroups []string,
-	claims *IDTokenClaims,
-) error {
-	if len(allowedGroups) > 0 {
-		for _, group := range allowedGroups {
-			if IsStringInSlice(claims.Groups, group) {
-				return nil
-			}
-		}
-
-		log.Error().Msg("authenticated principal not in any allowed groups")
-		writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
-		writer.WriteHeader(http.StatusBadRequest)
-		_, err := writer.Write([]byte("unauthorized principal (allowed groups)"))
-		if err != nil {
-			log.Error().
-				Caller().
-				Err(err).
-				Msg("Failed to write response")
-		}
-
-		return errOIDCAllowedGroups
-	}
-
-	return nil
-}
-
 // validateOIDCAllowedUsers checks that if AllowedUsers is provided,
 // that the authenticated principal is part of that list.
 func validateOIDCAllowedUsers(
--- a/proto/headscale/v1/headscale.proto
+++ b/proto/headscale/v1/headscale.proto
@@ -126,31 +126,17 @@ service HeadscaleService {
    // --- Machine end ---

    // --- Route start ---
-    rpc GetRoutes(GetRoutesRequest) returns (GetRoutesResponse) {
-        option (google.api.http) = {
-            get: "/api/v1/routes"
-        };
-    }
-
-    rpc EnableRoute(EnableRouteRequest) returns (EnableRouteResponse) {
-        option (google.api.http) = {
-            post: "/api/v1/routes/{route_id}/enable"
-        };
-    }
-
-    rpc DisableRoute(DisableRouteRequest) returns (DisableRouteResponse) {
-        option (google.api.http) = {
-            post: "/api/v1/routes/{route_id}/disable"
-        };
-    }
-
-
-    rpc GetMachineRoutes(GetMachineRoutesRequest) returns (GetMachineRoutesResponse) {
+    rpc GetMachineRoute(GetMachineRouteRequest) returns (GetMachineRouteResponse) {
        option (google.api.http) = {
            get: "/api/v1/machine/{machine_id}/routes"
        };
    }

+    rpc EnableMachineRoutes(EnableMachineRoutesRequest) returns (EnableMachineRoutesResponse) {
+        option (google.api.http) = {
+            post: "/api/v1/machine/{machine_id}/routes"
+        };
+    }
    // --- Route end ---

    // --- ApiKeys start ---
--- a/proto/headscale/v1/routes.proto
+++ b/proto/headscale/v1/routes.proto
@@ -2,47 +2,24 @@ syntax = "proto3";
 package headscale.v1;
 option  go_package = "github.com/juanfont/headscale/gen/go/v1";

-import "google/protobuf/timestamp.proto";
-import "headscale/v1/machine.proto";
-
-message Route {
-    uint64  id          = 1;
-    Machine machine     = 2;
-    string  prefix      = 3;
-    bool    advertised   = 4;
-    bool    enabled     = 5;
-    bool    is_primary  = 6;
-
-    google.protobuf.Timestamp created_at = 7;
-    google.protobuf.Timestamp updated_at = 8;
-    google.protobuf.Timestamp deleted_at = 9;
+message Routes {
+    repeated string advertised_routes = 1;
+    repeated string enabled_routes    = 2;
 }

-message GetRoutesRequest {
-}
-
-message GetRoutesResponse {
-    repeated Route routes = 1;
-}
-
-message EnableRouteRequest {
-    uint64 route_id = 1;
-}
-
-message EnableRouteResponse {
-}
-
-message DisableRouteRequest {
-    uint64 route_id = 1;
-}
-
-message DisableRouteResponse {
-}
-
-message GetMachineRoutesRequest {
+message GetMachineRouteRequest {
    uint64 machine_id = 1;
 }

-message GetMachineRoutesResponse {
-    repeated Route routes = 1;
-}
+message GetMachineRouteResponse {
+    Routes routes = 1;
+}
+
+message EnableMachineRoutesRequest {
+    uint64          machine_id = 1;
+    repeated string routes     = 2;
+}
+
+message EnableMachineRoutesResponse {
+    Routes routes = 1;
+}
--- a/protocol_common_poll.go
+++ b/protocol_common_poll.go
@@ -32,15 +32,6 @@ func (h *Headscale) handlePollCommon(
 	machine.DiscoKey = DiscoPublicKeyStripPrefix(mapRequest.DiscoKey)
 	now := time.Now().UTC()

-	err := h.processMachineRoutes(machine)
-	if err != nil {
-		log.Error().
-			Caller().
-			Err(err).
-			Str("machine", machine.Hostname).
-			Msg("Error processing machine routes")
-	}
-
 	// update ACLRules with peer informations (to update server tags if necessary)
 	if h.aclPolicy != nil {
 		err := h.UpdateACLRules()
@@ -53,15 +44,7 @@ func (h *Headscale) handlePollCommon(
 		}

 		// update routes with peer information
-		err = h.EnableAutoApprovedRoutes(machine)
-		if err != nil {
-			log.Error().
-				Caller().
-				Bool("noise", isNoise).
-				Str("machine", machine.Hostname).
-				Err(err).
-				Msg("Error running auto approved routes")
-		}
+		h.EnableAutoApprovedRoutes(machine)
 	}

 	// From Tailscale client:
--- a/routes.go
+++ b/routes.go
@@ -1,338 +1,118 @@
 package headscale

 import (
-	"errors"
 	"fmt"
 	"net/netip"
-
-	v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
-	"github.com/rs/zerolog/log"
-	"google.golang.org/protobuf/types/known/timestamppb"
-	"gorm.io/gorm"
 )

 const (
 	ErrRouteIsNotAvailable = Error("route is not available")
 )

-var (
-	ExitRouteV4 = netip.MustParsePrefix("0.0.0.0/0")
-	ExitRouteV6 = netip.MustParsePrefix("::/0")
-)
-
-type Route struct {
-	gorm.Model
-
-	MachineID uint64
-	Machine   Machine
-	Prefix    IPPrefix
-
-	Advertised bool
-	Enabled    bool
-	IsPrimary  bool
-}
-
-type Routes []Route
-
-func (r *Route) String() string {
-	return fmt.Sprintf("%s:%s", r.Machine, netip.Prefix(r.Prefix).String())
-}
-
-func (r *Route) isExitRoute() bool {
-	return netip.Prefix(r.Prefix) == ExitRouteV4 || netip.Prefix(r.Prefix) == ExitRouteV6
-}
-
-func (rs Routes) toPrefixes() []netip.Prefix {
-	prefixes := make([]netip.Prefix, len(rs))
-	for i, r := range rs {
-		prefixes[i] = netip.Prefix(r.Prefix)
-	}
-
-	return prefixes
-}
-
-func (h *Headscale) GetRoutes() ([]Route, error) {
-	var routes []Route
-	err := h.db.Preload("Machine").Find(&routes).Error
+// Deprecated: use machine function instead
+// GetAdvertisedNodeRoutes returns the subnet routes advertised by a node (identified by
+// namespace and node name).
+func (h *Headscale) GetAdvertisedNodeRoutes(
+	namespace string,
+	nodeName string,
+) (*[]netip.Prefix, error) {
+	machine, err := h.GetMachine(namespace, nodeName)
 	if err != nil {
 		return nil, err
 	}

-	return routes, nil
+	return &machine.HostInfo.RoutableIPs, nil
 }

-func (h *Headscale) GetMachineRoutes(m *Machine) ([]Route, error) {
-	var routes []Route
-	err := h.db.
-		Preload("Machine").
-		Where("machine_id = ?", m.ID).
-		Find(&routes).Error
-	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, err
-	}
-
-	return routes, nil
-}
-
-func (h *Headscale) GetRoute(id uint64) (*Route, error) {
-	var route Route
-	err := h.db.Preload("Machine").First(&route, id).Error
+// Deprecated: use machine function instead
+// GetEnabledNodeRoutes returns the subnet routes enabled by a node (identified by
+// namespace and node name).
+func (h *Headscale) GetEnabledNodeRoutes(
+	namespace string,
+	nodeName string,
+) ([]netip.Prefix, error) {
+	machine, err := h.GetMachine(namespace, nodeName)
 	if err != nil {
 		return nil, err
 	}

-	return &route, nil
+	return machine.EnabledRoutes, nil
 }

-func (h *Headscale) EnableRoute(id uint64) error {
-	route, err := h.GetRoute(id)
+// Deprecated: use machine function instead
+// IsNodeRouteEnabled checks if a certain route has been enabled.
+func (h *Headscale) IsNodeRouteEnabled(
+	namespace string,
+	nodeName string,
+	routeStr string,
+) bool {
+	route, err := netip.ParsePrefix(routeStr)
+	if err != nil {
+		return false
+	}
+
+	enabledRoutes, err := h.GetEnabledNodeRoutes(namespace, nodeName)
+	if err != nil {
+		return false
+	}
+
+	for _, enabledRoute := range enabledRoutes {
+		if route == enabledRoute {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Deprecated: use EnableRoute in machine.go
+// EnableNodeRoute enables a subnet route advertised by a node (identified by
+// namespace and node name).
+func (h *Headscale) EnableNodeRoute(
+	namespace string,
+	nodeName string,
+	routeStr string,
+) error {
+	machine, err := h.GetMachine(namespace, nodeName)
 	if err != nil {
 		return err
 	}

-	return h.EnableRoutes(&route.Machine, netip.Prefix(route.Prefix).String())
-}
-
-func (h *Headscale) DisableRoute(id uint64) error {
-	route, err := h.GetRoute(id)
+	route, err := netip.ParsePrefix(routeStr)
 	if err != nil {
 		return err
 	}

-	route.Enabled = false
-	route.IsPrimary = false
-	err = h.db.Save(route).Error
+	availableRoutes, err := h.GetAdvertisedNodeRoutes(namespace, nodeName)
 	if err != nil {
 		return err
 	}

-	return h.handlePrimarySubnetFailover()
-}
-
-// isUniquePrefix returns if there is another machine providing the same route already.
-func (h *Headscale) isUniquePrefix(route Route) bool {
-	var count int64
-	h.db.
-		Model(&Route{}).
-		Where("prefix = ? AND machine_id != ? AND advertised = ? AND enabled = ?",
-			route.Prefix,
-			route.MachineID,
-			true, true).Count(&count)
-
-	return count == 0
-}
-
-func (h *Headscale) getPrimaryRoute(prefix netip.Prefix) (*Route, error) {
-	var route Route
-	err := h.db.
-		Preload("Machine").
-		Where("prefix = ? AND advertised = ? AND enabled = ? AND is_primary = ?", IPPrefix(prefix), true, true, true).
-		First(&route).Error
-	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, err
-	}
-
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, gorm.ErrRecordNotFound
-	}
-
-	return &route, nil
-}
-
-// getMachinePrimaryRoutes returns the routes that are enabled and marked as primary (for subnet failover)
-// Exit nodes are not considered for this, as they are never marked as Primary.
-func (h *Headscale) getMachinePrimaryRoutes(m *Machine) ([]Route, error) {
-	var routes []Route
-	err := h.db.
-		Preload("Machine").
-		Where("machine_id = ? AND advertised = ? AND enabled = ? AND is_primary = ?", m.ID, true, true, true).
-		Find(&routes).Error
-	if err != nil {
-		return nil, err
-	}
-
-	return routes, nil
-}
-
-func (h *Headscale) processMachineRoutes(machine *Machine) error {
-	currentRoutes := []Route{}
-	err := h.db.Where("machine_id = ?", machine.ID).Find(&currentRoutes).Error
+	enabledRoutes, err := h.GetEnabledNodeRoutes(namespace, nodeName)
 	if err != nil {
 		return err
 	}

-	advertisedRoutes := map[netip.Prefix]bool{}
-	for _, prefix := range machine.HostInfo.RoutableIPs {
-		advertisedRoutes[prefix] = false
-	}
-
-	for pos, route := range currentRoutes {
-		if _, ok := advertisedRoutes[netip.Prefix(route.Prefix)]; ok {
-			if !route.Advertised {
-				currentRoutes[pos].Advertised = true
-				err := h.db.Save(&currentRoutes[pos]).Error
-				if err != nil {
-					return err
-				}
-			}
-			advertisedRoutes[netip.Prefix(route.Prefix)] = true
-		} else if route.Advertised {
-			currentRoutes[pos].Advertised = false
-			currentRoutes[pos].Enabled = false
-			err := h.db.Save(&currentRoutes[pos]).Error
-			if err != nil {
-				return err
+	available := false
+	for _, availableRoute := range *availableRoutes {
+		// If the route is available, and not yet enabled, add it to the new routing table
+		if route == availableRoute {
+			available = true
+			if !h.IsNodeRouteEnabled(namespace, nodeName, routeStr) {
+				enabledRoutes = append(enabledRoutes, route)
 			}
 		}
 	}

-	for prefix, exists := range advertisedRoutes {
-		if !exists {
-			route := Route{
-				MachineID:  machine.ID,
-				Prefix:     IPPrefix(prefix),
-				Advertised: true,
-				Enabled:    false,
-			}
-			err := h.db.Create(&route).Error
-			if err != nil {
-				return err
-			}
-		}
+	if !available {
+		return ErrRouteIsNotAvailable
+	}
+
+	machine.EnabledRoutes = enabledRoutes
+
+	if err := h.db.Save(&machine).Error; err != nil {
+		return fmt.Errorf("failed to update node routes in the database: %w", err)
 	}

 	return nil
 }
-
-func (h *Headscale) handlePrimarySubnetFailover() error {
-	// first, get all the enabled routes
-	var routes []Route
-	err := h.db.
-		Preload("Machine").
-		Where("advertised = ? AND enabled = ?", true, true).
-		Find(&routes).Error
-	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-		log.Error().Err(err).Msg("error getting routes")
-	}
-
-	for pos, route := range routes {
-		if route.isExitRoute() {
-			continue
-		}
-
-		if !route.IsPrimary {
-			_, err := h.getPrimaryRoute(netip.Prefix(route.Prefix))
-			if h.isUniquePrefix(route) || errors.Is(err, gorm.ErrRecordNotFound) {
-				log.Info().
-					Str("prefix", netip.Prefix(route.Prefix).String()).
-					Str("machine", route.Machine.GivenName).
-					Msg("Setting primary route")
-				routes[pos].IsPrimary = true
-				err := h.db.Save(&routes[pos]).Error
-				if err != nil {
-					log.Error().Err(err).Msg("error marking route as primary")
-
-					return err
-				}
-
-				continue
-			}
-		}
-
-		if route.IsPrimary {
-			if route.Machine.isOnline() {
-				continue
-			}
-
-			// machine offline, find a new primary
-			log.Info().
-				Str("machine", route.Machine.Hostname).
-				Str("prefix", netip.Prefix(route.Prefix).String()).
-				Msgf("machine offline, finding a new primary subnet")
-
-			// find a new primary route
-			var newPrimaryRoutes []Route
-			err := h.db.
-				Preload("Machine").
-				Where("prefix = ? AND machine_id != ? AND advertised = ? AND enabled = ?",
-					route.Prefix,
-					route.MachineID,
-					true, true).
-				Find(&newPrimaryRoutes).Error
-			if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
-				log.Error().Err(err).Msg("error finding new primary route")
-
-				return err
-			}
-
-			var newPrimaryRoute *Route
-			for pos, r := range newPrimaryRoutes {
-				if r.Machine.isOnline() {
-					newPrimaryRoute = &newPrimaryRoutes[pos]
-
-					break
-				}
-			}
-
-			if newPrimaryRoute == nil {
-				log.Warn().
-					Str("machine", route.Machine.Hostname).
-					Str("prefix", netip.Prefix(route.Prefix).String()).
-					Msgf("no alternative primary route found")
-
-				continue
-			}
-
-			log.Info().
-				Str("old_machine", route.Machine.Hostname).
-				Str("prefix", netip.Prefix(route.Prefix).String()).
-				Str("new_machine", newPrimaryRoute.Machine.Hostname).
-				Msgf("found new primary route")
-
-			// disable the old primary route
-			routes[pos].IsPrimary = false
-			err = h.db.Save(&routes[pos]).Error
-			if err != nil {
-				log.Error().Err(err).Msg("error disabling old primary route")
-
-				return err
-			}
-
-			// enable the new primary route
-			newPrimaryRoute.IsPrimary = true
-			err = h.db.Save(&newPrimaryRoute).Error
-			if err != nil {
-				log.Error().Err(err).Msg("error enabling new primary route")
-
-				return err
-			}
-		}
-	}
-
-	return nil
-}
-
-func (rs Routes) toProto() []*v1.Route {
-	protoRoutes := []*v1.Route{}
-
-	for _, route := range rs {
-		protoRoute := v1.Route{
-			Id:         uint64(route.ID),
-			Machine:    route.Machine.toProto(),
-			Prefix:     netip.Prefix(route.Prefix).String(),
-			Advertised: route.Advertised,
-			Enabled:    route.Enabled,
-			IsPrimary:  route.IsPrimary,
-			CreatedAt:  timestamppb.New(route.CreatedAt),
-			UpdatedAt:  timestamppb.New(route.UpdatedAt),
-		}
-
-		if route.DeletedAt.Valid {
-			protoRoute.DeletedAt = timestamppb.New(route.DeletedAt.Time)
-		}
-
-		protoRoutes = append(protoRoutes, &protoRoute)
-	}
-
-	return protoRoutes
-}
--- a/routes_test.go
+++ b/routes_test.go
@@ -2,7 +2,6 @@ package headscale

 import (
 	"net/netip"
-	"time"

 	"gopkg.in/check.v1"
 	"tailscale.com/tailcfg"
@@ -38,17 +37,17 @@ func (s *Suite) TestGetRoutes(c *check.C) {
 	}
 	app.db.Save(&machine)

-	err = app.processMachineRoutes(&machine)
+	advertisedRoutes, err := app.GetAdvertisedNodeRoutes(
+		"test",
+		"test_get_route_machine",
+	)
 	c.Assert(err, check.IsNil)
+	c.Assert(len(*advertisedRoutes), check.Equals, 1)

-	advertisedRoutes, err := app.GetAdvertisedRoutes(&machine)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(advertisedRoutes), check.Equals, 1)
-
-	err = app.EnableRoutes(&machine, "192.168.0.0/24")
+	err = app.EnableNodeRoute("test", "test_get_route_machine", "192.168.0.0/24")
 	c.Assert(err, check.NotNil)

-	err = app.EnableRoutes(&machine, "10.0.0.0/24")
+	err = app.EnableNodeRoute("test", "test_get_route_machine", "10.0.0.0/24")
 	c.Assert(err, check.IsNil)
 }

@@ -89,266 +88,48 @@ func (s *Suite) TestGetEnableRoutes(c *check.C) {
 	}
 	app.db.Save(&machine)

-	err = app.processMachineRoutes(&machine)
+	availableRoutes, err := app.GetAdvertisedNodeRoutes(
+		"test",
+		"test_enable_route_machine",
+	)
 	c.Assert(err, check.IsNil)
+	c.Assert(len(*availableRoutes), check.Equals, 2)

-	availableRoutes, err := app.GetAdvertisedRoutes(&machine)
-	c.Assert(err, check.IsNil)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(availableRoutes), check.Equals, 2)
-
-	noEnabledRoutes, err := app.GetEnabledRoutes(&machine)
+	noEnabledRoutes, err := app.GetEnabledNodeRoutes(
+		"test",
+		"test_enable_route_machine",
+	)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(noEnabledRoutes), check.Equals, 0)

-	err = app.EnableRoutes(&machine, "192.168.0.0/24")
+	err = app.EnableNodeRoute("test", "test_enable_route_machine", "192.168.0.0/24")
 	c.Assert(err, check.NotNil)

-	err = app.EnableRoutes(&machine, "10.0.0.0/24")
+	err = app.EnableNodeRoute("test", "test_enable_route_machine", "10.0.0.0/24")
 	c.Assert(err, check.IsNil)

-	enabledRoutes, err := app.GetEnabledRoutes(&machine)
+	enabledRoutes, err := app.GetEnabledNodeRoutes("test", "test_enable_route_machine")
 	c.Assert(err, check.IsNil)
 	c.Assert(len(enabledRoutes), check.Equals, 1)

 	// Adding it twice will just let it pass through
-	err = app.EnableRoutes(&machine, "10.0.0.0/24")
+	err = app.EnableNodeRoute("test", "test_enable_route_machine", "10.0.0.0/24")
 	c.Assert(err, check.IsNil)

-	enableRoutesAfterDoubleApply, err := app.GetEnabledRoutes(&machine)
+	enableRoutesAfterDoubleApply, err := app.GetEnabledNodeRoutes(
+		"test",
+		"test_enable_route_machine",
+	)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(enableRoutesAfterDoubleApply), check.Equals, 1)

-	err = app.EnableRoutes(&machine, "150.0.10.0/25")
+	err = app.EnableNodeRoute("test", "test_enable_route_machine", "150.0.10.0/25")
 	c.Assert(err, check.IsNil)

-	enabledRoutesWithAdditionalRoute, err := app.GetEnabledRoutes(&machine)
+	enabledRoutesWithAdditionalRoute, err := app.GetEnabledNodeRoutes(
+		"test",
+		"test_enable_route_machine",
+	)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(enabledRoutesWithAdditionalRoute), check.Equals, 2)
 }
-
-func (s *Suite) TestIsUniquePrefix(c *check.C) {
-	namespace, err := app.CreateNamespace("test")
-	c.Assert(err, check.IsNil)
-
-	pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil, nil)
-	c.Assert(err, check.IsNil)
-
-	_, err = app.GetMachine("test", "test_enable_route_machine")
-	c.Assert(err, check.NotNil)
-
-	route, err := netip.ParsePrefix(
-		"10.0.0.0/24",
-	)
-	c.Assert(err, check.IsNil)
-
-	route2, err := netip.ParsePrefix(
-		"150.0.10.0/25",
-	)
-	c.Assert(err, check.IsNil)
-
-	hostInfo1 := tailcfg.Hostinfo{
-		RoutableIPs: []netip.Prefix{route, route2},
-	}
-	machine1 := Machine{
-		ID:             1,
-		MachineKey:     "foo",
-		NodeKey:        "bar",
-		DiscoKey:       "faa",
-		Hostname:       "test_enable_route_machine",
-		NamespaceID:    namespace.ID,
-		RegisterMethod: RegisterMethodAuthKey,
-		AuthKeyID:      uint(pak.ID),
-		HostInfo:       HostInfo(hostInfo1),
-	}
-	app.db.Save(&machine1)
-
-	err = app.processMachineRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-
-	err = app.EnableRoutes(&machine1, route.String())
-	c.Assert(err, check.IsNil)
-
-	err = app.EnableRoutes(&machine1, route2.String())
-	c.Assert(err, check.IsNil)
-
-	hostInfo2 := tailcfg.Hostinfo{
-		RoutableIPs: []netip.Prefix{route2},
-	}
-	machine2 := Machine{
-		ID:             2,
-		MachineKey:     "foo",
-		NodeKey:        "bar",
-		DiscoKey:       "faa",
-		Hostname:       "test_enable_route_machine",
-		NamespaceID:    namespace.ID,
-		RegisterMethod: RegisterMethodAuthKey,
-		AuthKeyID:      uint(pak.ID),
-		HostInfo:       HostInfo(hostInfo2),
-	}
-	app.db.Save(&machine2)
-
-	err = app.processMachineRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-
-	err = app.EnableRoutes(&machine2, route2.String())
-	c.Assert(err, check.IsNil)
-
-	enabledRoutes1, err := app.GetEnabledRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(enabledRoutes1), check.Equals, 2)
-
-	enabledRoutes2, err := app.GetEnabledRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(enabledRoutes2), check.Equals, 1)
-
-	routes, err := app.getMachinePrimaryRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 2)
-
-	routes, err = app.getMachinePrimaryRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 0)
-}
-
-func (s *Suite) TestSubnetFailover(c *check.C) {
-	namespace, err := app.CreateNamespace("test")
-	c.Assert(err, check.IsNil)
-
-	pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil, nil)
-	c.Assert(err, check.IsNil)
-
-	_, err = app.GetMachine("test", "test_enable_route_machine")
-	c.Assert(err, check.NotNil)
-
-	prefix, err := netip.ParsePrefix(
-		"10.0.0.0/24",
-	)
-	c.Assert(err, check.IsNil)
-
-	prefix2, err := netip.ParsePrefix(
-		"150.0.10.0/25",
-	)
-	c.Assert(err, check.IsNil)
-
-	hostInfo1 := tailcfg.Hostinfo{
-		RoutableIPs: []netip.Prefix{prefix, prefix2},
-	}
-
-	now := time.Now()
-	machine1 := Machine{
-		ID:             1,
-		MachineKey:     "foo",
-		NodeKey:        "bar",
-		DiscoKey:       "faa",
-		Hostname:       "test_enable_route_machine",
-		NamespaceID:    namespace.ID,
-		RegisterMethod: RegisterMethodAuthKey,
-		AuthKeyID:      uint(pak.ID),
-		HostInfo:       HostInfo(hostInfo1),
-		LastSeen:       &now,
-	}
-	app.db.Save(&machine1)
-
-	err = app.processMachineRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-
-	err = app.EnableRoutes(&machine1, prefix.String())
-	c.Assert(err, check.IsNil)
-
-	err = app.EnableRoutes(&machine1, prefix2.String())
-	c.Assert(err, check.IsNil)
-
-	err = app.handlePrimarySubnetFailover()
-	c.Assert(err, check.IsNil)
-
-	enabledRoutes1, err := app.GetEnabledRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(enabledRoutes1), check.Equals, 2)
-
-	route, err := app.getPrimaryRoute(prefix)
-	c.Assert(err, check.IsNil)
-	c.Assert(route.MachineID, check.Equals, machine1.ID)
-
-	hostInfo2 := tailcfg.Hostinfo{
-		RoutableIPs: []netip.Prefix{prefix2},
-	}
-	machine2 := Machine{
-		ID:             2,
-		MachineKey:     "foo",
-		NodeKey:        "bar",
-		DiscoKey:       "faa",
-		Hostname:       "test_enable_route_machine",
-		NamespaceID:    namespace.ID,
-		RegisterMethod: RegisterMethodAuthKey,
-		AuthKeyID:      uint(pak.ID),
-		HostInfo:       HostInfo(hostInfo2),
-		LastSeen:       &now,
-	}
-	app.db.Save(&machine2)
-
-	err = app.processMachineRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-
-	err = app.EnableRoutes(&machine2, prefix2.String())
-	c.Assert(err, check.IsNil)
-
-	err = app.handlePrimarySubnetFailover()
-	c.Assert(err, check.IsNil)
-
-	enabledRoutes1, err = app.GetEnabledRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(enabledRoutes1), check.Equals, 2)
-
-	enabledRoutes2, err := app.GetEnabledRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(enabledRoutes2), check.Equals, 1)
-
-	routes, err := app.getMachinePrimaryRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 2)
-
-	routes, err = app.getMachinePrimaryRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 0)
-
-	// lets make machine1 lastseen 10 mins ago
-	before := now.Add(-10 * time.Minute)
-	machine1.LastSeen = &before
-	err = app.db.Save(&machine1).Error
-	c.Assert(err, check.IsNil)
-
-	err = app.handlePrimarySubnetFailover()
-	c.Assert(err, check.IsNil)
-
-	routes, err = app.getMachinePrimaryRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 1)
-
-	routes, err = app.getMachinePrimaryRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 1)
-
-	machine2.HostInfo = HostInfo(tailcfg.Hostinfo{
-		RoutableIPs: []netip.Prefix{prefix, prefix2},
-	})
-	err = app.db.Save(&machine2).Error
-	c.Assert(err, check.IsNil)
-
-	err = app.processMachineRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-
-	err = app.EnableRoutes(&machine2, prefix.String())
-	c.Assert(err, check.IsNil)
-
-	err = app.handlePrimarySubnetFailover()
-	c.Assert(err, check.IsNil)
-
-	routes, err = app.getMachinePrimaryRoutes(&machine1)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 0)
-
-	routes, err = app.getMachinePrimaryRoutes(&machine2)
-	c.Assert(err, check.IsNil)
-	c.Assert(len(routes), check.Equals, 2)
-}
--- a/templates/apple.html
+++ b/templates/apple.html
@@ -9,29 +9,7 @@

  <body>
    <h1>headscale</h1>
-    <h2>Recent Tailscale versions (1.34.0 and higher)</h2>
-    <p>
-      Tailscale added Fast User Switching in version 1.34 and you can now use
-      the new login command to connect to one or more headscale (and Tailscale)
-      servers. The previously used profiles does not have an effect anymore.
-    </p>
-    <h3>Command line</h3>
-    <p>Use Tailscale's login command to add your profile:</p>
-    <pre><code>tailscale login --login-server {{.URL}}</code></pre>
-
-    <h3>GUI</h3>
-    <ol>
-      <li>
-        ALT + Click the Tailscale icon in the menu and hover over the Debug menu
-      </li>
-      <li>Under "Custm Login Server", select "Add Account..."</li>
-      <li>
-        Enter "{{.URL}}" of the headscale instance and press "Add Account"
-      </li>
-      <li>Follow the login procedure in the browser</li>
-    </ol>
-
-    <h2>Apple configuration profiles (1.32.0 and lower)</h2>
+    <h2>Apple configuration profiles</h2>
    <p>
      This page provides
      <a href="https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/web">
--- a/templates/windows.html
+++ b/templates/windows.html
@@ -9,16 +9,7 @@

  <body>
    <h1>headscale</h1>
-    <h2>Recent Tailscale versions (1.34.0 and higher)</h2>
-    <p>
-      Tailscale added Fast User Switching in version 1.34 and you can now use
-      the new login command to connect to one or more headscale (and Tailscale)
-      servers. The previously used profiles does not have an effect anymore.
-    </p>
-    <p>Use Tailscale's login command to add your profile:</p>
-    <pre><code>tailscale login --login-server {{.URL}}</code></pre>
-
-    <h2>Windows registry configuration (1.32.0 and lower)</h2>
+    <h2>Windows registry configuration</h2>
    <p>
      This page provides Windows registry information for the official Windows
      Tailscale client.
@@ -64,9 +55,8 @@
      commands to add the required registry entries:
    </p>
    <pre>
-    <code>REG ADD "HKLM\Software\Tailscale IPN" /v UnattendedMode /t REG_SZ /d always
-      REG ADD "HKLM\Software\Tailscale IPN" /v LoginURL /t REG_SZ /d "{{.URL}}"</code>
-  </pre>
+<code>REG ADD "HKLM\Software\Tailscale IPN" /v UnattendedMode /t REG_SZ /d always
+REG ADD "HKLM\Software\Tailscale IPN" /v LoginURL /t REG_SZ /d "{{.URL}}"</code></pre>
    <p>Restart Tailscale and log in.</p>

    <p></p>
--- a/utils.go
+++ b/utils.go
@@ -254,6 +254,16 @@ func GrpcSocketDialer(ctx context.Context, addr string) (net.Conn, error) {
 	return d.DialContext(ctx, "unix", addr)
 }

+func ipPrefixToString(prefixes []netip.Prefix) []string {
+	result := make([]string, len(prefixes))
+
+	for index, prefix := range prefixes {
+		result[index] = prefix.String()
+	}
+
+	return result
+}
+
 func stringToIPPrefix(prefixes []string) ([]netip.Prefix, error) {
 	result := make([]netip.Prefix, len(prefixes))