Add VPN configuration tools and agent documentation

Created comprehensive VPN setup tooling for Peaceful Spirit L2TP/IPsec connection
and enhanced agent documentation framework.

VPN Configuration (PST-NW-VPN):
- Setup-PST-L2TP-VPN.ps1: Automated L2TP/IPsec setup with split-tunnel and DNS
- Connect-PST-VPN.ps1: Connection helper with PPP adapter detection, DNS (192.168.0.2), and route config (192.168.0.0/24)
- Connect-PST-VPN-Standalone.ps1: Self-contained connection script for remote deployment
- Fix-PST-VPN-Auth.ps1: Authentication troubleshooting for CHAP/MSChapv2
- Diagnose-VPN-Interface.ps1: Comprehensive VPN interface and routing diagnostic
- Quick-Test-VPN.ps1: Fast connectivity verification (DNS/router/routes)
- Add-PST-VPN-Route-Manual.ps1: Manual route configuration helper
- vpn-connect.bat, vpn-disconnect.bat: Simple batch file shortcuts
- OpenVPN config files (Windows-compatible, abandoned for L2TP)

Key VPN Implementation Details:
- L2TP creates PPP adapter with connection name as interface description
- UniFi auto-configures DNS (192.168.0.2) but requires manual route to 192.168.0.0/24
- Split-tunnel enabled (only remote traffic through VPN)
- All-user connection for pre-login auto-connect via scheduled task
- Authentication: CHAP + MSChapv2 for UniFi compatibility

Agent Documentation:
- AGENT_QUICK_REFERENCE.md: Quick reference for all specialized agents
- documentation-squire.md: Documentation and task management specialist agent
- Updated all agent markdown files with standardized formatting

Project Organization:
- Moved conversation logs to dedicated directories (guru-connect-conversation-logs, guru-rmm-conversation-logs)
- Cleaned up old session JSONL files from projects/msp-tools/
- Added guru-connect infrastructure (agent, dashboard, proto, scripts, .gitea workflows)
- Added guru-rmm server components and deployment configs

Technical Notes:
- VPN IP pool: 192.168.4.x (client gets 192.168.4.6)
- Remote network: 192.168.0.0/24 (router at 192.168.0.10)
- PSK: rrClvnmUeXEFo90Ol+z7tfsAZHeSK6w7
- Credentials: pst-admin / 24Hearts$

Files: 15 VPN scripts, 2 agent docs, conversation log reorganization,
guru-connect/guru-rmm infrastructure additions

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

projects/msp-tools/guru-rmm/server/src/api/agents.rs

@@ -0,0 +1,327 @@
+//! Agent management API endpoints
+
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::db::{self, AgentResponse, AgentStats};
+use crate::ws::{generate_api_key, hash_api_key};
+use crate::AppState;
+
+/// Response for agent registration
+#[derive(Debug, Serialize)]
+pub struct RegisterAgentResponse {
+    pub agent_id: Uuid,
+    pub api_key: String,
+    pub message: String,
+}
+
+/// Request to register a new agent
+#[derive(Debug, Deserialize)]
+pub struct RegisterAgentRequest {
+    pub hostname: String,
+    pub os_type: String,
+    pub os_version: Option<String>,
+}
+
+/// Register a new agent (generates API key)
+pub async fn register_agent(
+    State(state): State<AppState>,
+    Json(req): Json<RegisterAgentRequest>,
+) -> Result<Json<RegisterAgentResponse>, (StatusCode, String)> {
+    // Generate a new API key
+    let api_key = generate_api_key(&state.config.auth.api_key_prefix);
+    let api_key_hash = hash_api_key(&api_key);
+
+    // Create the agent
+    let create = db::CreateAgent {
+        hostname: req.hostname,
+        api_key_hash,
+        os_type: req.os_type,
+        os_version: req.os_version,
+        agent_version: None,
+    };
+
+    let agent = db::create_agent(&state.db, create)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(RegisterAgentResponse {
+        agent_id: agent.id,
+        api_key, // Return the plain API key (only shown once!)
+        message: "Agent registered successfully. Save the API key - it will not be shown again."
+            .to_string(),
+    }))
+}
+
+/// List all agents
+pub async fn list_agents(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<AgentResponse>>, (StatusCode, String)> {
+    let agents = db::get_all_agents(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    let responses: Vec<AgentResponse> = agents.into_iter().map(|a| a.into()).collect();
+    Ok(Json(responses))
+}
+
+/// Get a specific agent
+pub async fn get_agent(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<AgentResponse>, (StatusCode, String)> {
+    let agent = db::get_agent_by_id(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Agent not found".to_string()))?;
+
+    Ok(Json(agent.into()))
+}
+
+/// Delete an agent
+pub async fn delete_agent(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<StatusCode, (StatusCode, String)> {
+    // Check if agent is connected and disconnect it
+    if state.agents.read().await.is_connected(&id) {
+        // In a real implementation, we'd send a disconnect message
+        state.agents.write().await.remove(&id);
+    }
+
+    let deleted = db::delete_agent(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    if deleted {
+        Ok(StatusCode::NO_CONTENT)
+    } else {
+        Err((StatusCode::NOT_FOUND, "Agent not found".to_string()))
+    }
+}
+
+/// Get agent statistics
+pub async fn get_stats(
+    State(state): State<AppState>,
+) -> Result<Json<AgentStats>, (StatusCode, String)> {
+    let stats = db::get_agent_stats(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(stats))
+}
+
+/// Request to move an agent to a different site
+#[derive(Debug, Deserialize)]
+pub struct MoveAgentRequest {
+    pub site_id: Option<Uuid>, // None to unassign from site
+}
+
+/// Move an agent to a different site
+pub async fn move_agent(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<MoveAgentRequest>,
+) -> Result<Json<AgentResponse>, (StatusCode, String)> {
+    // Verify the site exists if provided
+    if let Some(site_id) = req.site_id {
+        let site = db::get_site_by_id(&state.db, site_id)
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+        if site.is_none() {
+            return Err((StatusCode::NOT_FOUND, "Site not found".to_string()));
+        }
+    }
+
+    // Move the agent
+    let agent = db::move_agent_to_site(&state.db, id, req.site_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Agent not found".to_string()))?;
+
+    Ok(Json(agent.into()))
+}
+
+/// List all agents with full details (site/client info)
+pub async fn list_agents_with_details(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<db::AgentWithDetails>>, (StatusCode, String)> {
+    let agents = db::get_all_agents_with_details(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(agents))
+}
+
+/// List unassigned agents (not belonging to any site)
+pub async fn list_unassigned_agents(
+    State(state): State<AppState>,
+) -> Result<Json<Vec<AgentResponse>>, (StatusCode, String)> {
+    let agents = db::get_unassigned_agents(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    let responses: Vec<AgentResponse> = agents.into_iter().map(|a| a.into()).collect();
+    Ok(Json(responses))
+}
+
+/// Get extended state for an agent (network interfaces, uptime, etc.)
+pub async fn get_agent_state(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<db::AgentState>, (StatusCode, String)> {
+    let agent_state = db::get_agent_state(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Agent state not found".to_string()))?;
+
+    Ok(Json(agent_state))
+}
+
+// ============================================================================
+// Legacy Agent Endpoints (PowerShell agent for 2008 R2)
+// ============================================================================
+
+/// Request to register a legacy agent with site code
+#[derive(Debug, Deserialize)]
+pub struct RegisterLegacyRequest {
+    pub site_code: String,
+    pub hostname: String,
+    pub os_type: String,
+    pub os_version: Option<String>,
+    pub agent_version: Option<String>,
+    pub agent_type: Option<String>,
+}
+
+/// Response for legacy agent registration
+#[derive(Debug, Serialize)]
+pub struct RegisterLegacyResponse {
+    pub agent_id: Uuid,
+    pub api_key: String,
+    pub site_name: String,
+    pub client_name: String,
+    pub message: String,
+}
+
+/// Register a legacy agent using site code
+pub async fn register_legacy(
+    State(state): State<AppState>,
+    Json(req): Json<RegisterLegacyRequest>,
+) -> Result<Json<RegisterLegacyResponse>, (StatusCode, String)> {
+    // Look up site by code
+    let site = db::get_site_by_code(&state.db, &req.site_code)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, format!("Site code '{}' not found", req.site_code)))?;
+
+    // Get client info
+    let client = db::get_client_by_id(&state.db, site.client_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Client not found".to_string()))?;
+
+    // Generate API key for this agent
+    let api_key = generate_api_key(&state.config.auth.api_key_prefix);
+    let api_key_hash = hash_api_key(&api_key);
+
+    // Create the agent
+    let create = db::CreateAgent {
+        hostname: req.hostname,
+        api_key_hash,
+        os_type: req.os_type,
+        os_version: req.os_version,
+        agent_version: req.agent_version,
+    };
+
+    let agent = db::create_agent(&state.db, create)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    // Assign agent to site
+    db::move_agent_to_site(&state.db, agent.id, Some(site.id))
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    tracing::info!(
+        "Legacy agent registered: {} ({}) -> Site: {} ({})",
+        agent.hostname,
+        agent.id,
+        site.name,
+        req.site_code
+    );
+
+    Ok(Json(RegisterLegacyResponse {
+        agent_id: agent.id,
+        api_key,
+        site_name: site.name,
+        client_name: client.name,
+        message: "Agent registered successfully".to_string(),
+    }))
+}
+
+/// Heartbeat request from legacy agent
+#[derive(Debug, Deserialize)]
+pub struct HeartbeatRequest {
+    pub agent_id: Uuid,
+    pub timestamp: String,
+    pub system_info: serde_json::Value,
+}
+
+/// Heartbeat response with pending commands
+#[derive(Debug, Serialize)]
+pub struct HeartbeatResponse {
+    pub success: bool,
+    pub pending_commands: Vec<PendingCommand>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct PendingCommand {
+    pub id: Uuid,
+    #[serde(rename = "type")]
+    pub cmd_type: String,
+    pub script: String,
+}
+
+/// Receive heartbeat from legacy agent
+pub async fn heartbeat(
+    State(state): State<AppState>,
+    Json(req): Json<HeartbeatRequest>,
+) -> Result<Json<HeartbeatResponse>, (StatusCode, String)> {
+    // Update agent last_seen
+    db::update_agent_last_seen(&state.db, req.agent_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    // TODO: Store system_info metrics, get pending commands
+    // For now, return empty pending commands
+    Ok(Json(HeartbeatResponse {
+        success: true,
+        pending_commands: vec![],
+    }))
+}
+
+/// Command result from legacy agent
+#[derive(Debug, Deserialize)]
+pub struct CommandResultRequest {
+    pub command_id: Uuid,
+    pub started_at: String,
+    pub completed_at: String,
+    pub success: bool,
+    pub output: String,
+    pub error: Option<String>,
+}
+
+/// Receive command execution result
+pub async fn command_result(
+    State(_state): State<AppState>,
+    Json(_req): Json<CommandResultRequest>,
+) -> Result<StatusCode, (StatusCode, String)> {
+    // TODO: Store command result in database
+    Ok(StatusCode::OK)
+}

projects/msp-tools/guru-rmm/server/src/api/auth.rs

@@ -0,0 +1,152 @@
+//! Authentication API endpoints
+
+use axum::{
+    extract::State,
+    http::StatusCode,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::auth::{create_jwt, verify_password, hash_password, Claims, AuthUser};
+use crate::db::{self, UserResponse};
+use crate::AppState;
+
+/// Login request
+#[derive(Debug, Deserialize)]
+pub struct LoginRequest {
+    pub email: String,
+    pub password: String,
+}
+
+/// Login response
+#[derive(Debug, Serialize)]
+pub struct LoginResponse {
+    pub token: String,
+    pub user: UserResponse,
+}
+
+/// Register request (for initial admin setup)
+#[derive(Debug, Deserialize)]
+pub struct RegisterRequest {
+    pub email: String,
+    pub password: String,
+    pub name: Option<String>,
+}
+
+/// Register response
+#[derive(Debug, Serialize)]
+pub struct RegisterResponse {
+    pub token: String,
+    pub user: UserResponse,
+    pub message: String,
+}
+
+/// Login with email and password
+pub async fn login(
+    State(state): State<AppState>,
+    Json(req): Json<LoginRequest>,
+) -> Result<Json<LoginResponse>, (StatusCode, String)> {
+    // Find user by email
+    let user = db::get_user_by_email(&state.db, &req.email)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::UNAUTHORIZED, "Invalid credentials".to_string()))?;
+
+    // Verify password
+    let password_hash = user
+        .password_hash
+        .as_ref()
+        .ok_or((StatusCode::UNAUTHORIZED, "Invalid credentials".to_string()))?;
+
+    if !verify_password(&req.password, password_hash) {
+        return Err((StatusCode::UNAUTHORIZED, "Invalid credentials".to_string()));
+    }
+
+    // Update last login
+    let _ = db::update_last_login(&state.db, user.id).await;
+
+    // Generate JWT
+    let token = create_jwt(
+        user.id,
+        &user.role,
+        &state.config.auth.jwt_secret,
+        state.config.auth.jwt_expiry_hours,
+    )
+    .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(LoginResponse {
+        token,
+        user: user.into(),
+    }))
+}
+
+/// Register a new user (only works if no users exist - for initial admin setup)
+pub async fn register(
+    State(state): State<AppState>,
+    Json(req): Json<RegisterRequest>,
+) -> Result<Json<RegisterResponse>, (StatusCode, String)> {
+    // Check if any users exist
+    let has_users = db::has_users(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    // If users exist, only admins can create new users (would need auth check here)
+    // For now, only allow registration if no users exist
+    if has_users {
+        return Err((
+            StatusCode::FORBIDDEN,
+            "Registration is disabled. Contact an administrator.".to_string(),
+        ));
+    }
+
+    // Hash password
+    let password_hash = hash_password(&req.password)
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    // Create user (first user is admin)
+    let create = db::CreateUser {
+        email: req.email,
+        password_hash,
+        name: req.name,
+        role: Some("admin".to_string()),
+    };
+
+    let user = db::create_user(&state.db, create)
+        .await
+        .map_err(|e| {
+            if e.to_string().contains("duplicate key") {
+                (StatusCode::CONFLICT, "Email already registered".to_string())
+            } else {
+                (StatusCode::INTERNAL_SERVER_ERROR, e.to_string())
+            }
+        })?;
+
+    // Generate JWT
+    let token = create_jwt(
+        user.id,
+        &user.role,
+        &state.config.auth.jwt_secret,
+        state.config.auth.jwt_expiry_hours,
+    )
+    .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(RegisterResponse {
+        token,
+        user: user.into(),
+        message: "Admin account created successfully".to_string(),
+    }))
+}
+
+/// Get current user info (requires auth)
+pub async fn me(
+    State(state): State<AppState>,
+    auth: AuthUser,
+) -> Result<Json<UserResponse>, (StatusCode, String)> {
+    // Fetch user from database using authenticated user ID
+    let user = db::get_user_by_id(&state.db, auth.user_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "User not found".to_string()))?;
+
+    Ok(Json(user.into()))
+}

projects/msp-tools/guru-rmm/server/src/api/clients.rs

@@ -0,0 +1,168 @@
+//! Client management API endpoints
+
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::auth::AuthUser;
+use crate::db;
+use crate::AppState;
+
+/// Response for client operations
+#[derive(Debug, Serialize)]
+pub struct ClientResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub site_count: i64,
+}
+
+/// Request to create a new client
+#[derive(Debug, Deserialize)]
+pub struct CreateClientRequest {
+    pub name: String,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+}
+
+/// Request to update a client
+#[derive(Debug, Deserialize)]
+pub struct UpdateClientRequest {
+    pub name: Option<String>,
+    pub code: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: Option<bool>,
+}
+
+/// List all clients
+pub async fn list_clients(
+    _user: AuthUser,
+    State(state): State<AppState>,
+) -> Result<Json<Vec<ClientResponse>>, (StatusCode, String)> {
+    let clients = db::get_all_clients_with_counts(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    let responses: Vec<ClientResponse> = clients
+        .into_iter()
+        .map(|c| ClientResponse {
+            id: c.id,
+            name: c.name,
+            code: c.code,
+            notes: c.notes,
+            is_active: c.is_active,
+            created_at: c.created_at,
+            site_count: c.site_count,
+        })
+        .collect();
+
+    Ok(Json(responses))
+}
+
+/// Create a new client
+pub async fn create_client(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Json(req): Json<CreateClientRequest>,
+) -> Result<Json<ClientResponse>, (StatusCode, String)> {
+    let create = db::CreateClient {
+        name: req.name,
+        code: req.code,
+        notes: req.notes,
+    };
+
+    let client = db::create_client(&state.db, create)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(ClientResponse {
+        id: client.id,
+        name: client.name,
+        code: client.code,
+        notes: client.notes,
+        is_active: client.is_active,
+        created_at: client.created_at,
+        site_count: 0,
+    }))
+}
+
+/// Get a specific client
+pub async fn get_client(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<ClientResponse>, (StatusCode, String)> {
+    let client = db::get_client_by_id(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Client not found".to_string()))?;
+
+    // Get site count
+    let sites = db::get_sites_by_client(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(ClientResponse {
+        id: client.id,
+        name: client.name,
+        code: client.code,
+        notes: client.notes,
+        is_active: client.is_active,
+        created_at: client.created_at,
+        site_count: sites.len() as i64,
+    }))
+}
+
+/// Update a client
+pub async fn update_client(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<UpdateClientRequest>,
+) -> Result<Json<ClientResponse>, (StatusCode, String)> {
+    let update = db::UpdateClient {
+        name: req.name,
+        code: req.code,
+        notes: req.notes,
+        is_active: req.is_active,
+    };
+
+    let client = db::update_client(&state.db, id, update)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Client not found".to_string()))?;
+
+    Ok(Json(ClientResponse {
+        id: client.id,
+        name: client.name,
+        code: client.code,
+        notes: client.notes,
+        is_active: client.is_active,
+        created_at: client.created_at,
+        site_count: 0, // Would need to query again
+    }))
+}
+
+/// Delete a client
+pub async fn delete_client(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<StatusCode, (StatusCode, String)> {
+    let deleted = db::delete_client(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    if deleted {
+        Ok(StatusCode::NO_CONTENT)
+    } else {
+        Err((StatusCode::NOT_FOUND, "Client not found".to_string()))
+    }
+}

projects/msp-tools/guru-rmm/server/src/api/commands.rs

@@ -0,0 +1,127 @@
+//! Commands API endpoints
+
+use axum::{
+    extract::{Path, Query, State},
+    http::StatusCode,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::db::{self, Command};
+use crate::ws::{CommandPayload, ServerMessage};
+use crate::AppState;
+
+/// Request to send a command to an agent
+#[derive(Debug, Deserialize)]
+pub struct SendCommandRequest {
+    /// Command type (shell, powershell, python, script)
+    pub command_type: String,
+
+    /// Command text to execute
+    pub command: String,
+
+    /// Timeout in seconds (optional, default 300)
+    pub timeout_seconds: Option<u64>,
+
+    /// Run as elevated/admin (optional, default false)
+    pub elevated: Option<bool>,
+}
+
+/// Response after sending a command
+#[derive(Debug, Serialize)]
+pub struct SendCommandResponse {
+    pub command_id: Uuid,
+    pub status: String,
+    pub message: String,
+}
+
+/// Query parameters for listing commands
+#[derive(Debug, Deserialize)]
+pub struct CommandsQuery {
+    pub limit: Option<i64>,
+}
+
+/// Send a command to an agent
+pub async fn send_command(
+    State(state): State<AppState>,
+    Path(agent_id): Path<Uuid>,
+    Json(req): Json<SendCommandRequest>,
+) -> Result<Json<SendCommandResponse>, (StatusCode, String)> {
+    // Verify agent exists
+    let agent = db::get_agent_by_id(&state.db, agent_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Agent not found".to_string()))?;
+
+    // Create command record
+    let create = db::CreateCommand {
+        agent_id,
+        command_type: req.command_type.clone(),
+        command_text: req.command.clone(),
+        created_by: None, // TODO: Get from JWT
+    };
+
+    let command = db::create_command(&state.db, create)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    // Check if agent is connected
+    let agents = state.agents.read().await;
+    if agents.is_connected(&agent_id) {
+        // Send command via WebSocket
+        let cmd_msg = ServerMessage::Command(CommandPayload {
+            id: command.id,
+            command_type: req.command_type,
+            command: req.command,
+            timeout_seconds: req.timeout_seconds,
+            elevated: req.elevated.unwrap_or(false),
+        });
+
+        if agents.send_to(&agent_id, cmd_msg).await {
+            // Mark as running
+            let _ = db::mark_command_running(&state.db, command.id).await;
+
+            return Ok(Json(SendCommandResponse {
+                command_id: command.id,
+                status: "running".to_string(),
+                message: "Command sent to agent".to_string(),
+            }));
+        }
+    }
+
+    // Agent not connected or send failed - command is queued
+    Ok(Json(SendCommandResponse {
+        command_id: command.id,
+        status: "pending".to_string(),
+        message: "Agent is offline. Command queued for execution when agent reconnects."
+            .to_string(),
+    }))
+}
+
+/// List recent commands
+pub async fn list_commands(
+    State(state): State<AppState>,
+    Query(query): Query<CommandsQuery>,
+) -> Result<Json<Vec<Command>>, (StatusCode, String)> {
+    let limit = query.limit.unwrap_or(50).min(500);
+
+    let commands = db::get_recent_commands(&state.db, limit)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(commands))
+}
+
+/// Get a specific command by ID
+pub async fn get_command(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Command>, (StatusCode, String)> {
+    let command = db::get_command_by_id(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Command not found".to_string()))?;
+
+    Ok(Json(command))
+}

projects/msp-tools/guru-rmm/server/src/api/metrics.rs

@@ -0,0 +1,65 @@
+//! Metrics API endpoints
+
+use axum::{
+    extract::{Path, Query, State},
+    http::StatusCode,
+    Json,
+};
+use chrono::{DateTime, Duration, Utc};
+use serde::Deserialize;
+use uuid::Uuid;
+
+use crate::db::{self, Metrics, MetricsSummary};
+use crate::AppState;
+
+/// Query parameters for metrics
+#[derive(Debug, Deserialize)]
+pub struct MetricsQuery {
+    /// Number of records to return (default: 100)
+    pub limit: Option<i64>,
+
+    /// Start time for range query
+    pub start: Option<DateTime<Utc>>,
+
+    /// End time for range query
+    pub end: Option<DateTime<Utc>>,
+}
+
+/// Get metrics for a specific agent
+pub async fn get_agent_metrics(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Query(query): Query<MetricsQuery>,
+) -> Result<Json<Vec<Metrics>>, (StatusCode, String)> {
+    // First verify the agent exists
+    let agent = db::get_agent_by_id(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Agent not found".to_string()))?;
+
+    let metrics = if let (Some(start), Some(end)) = (query.start, query.end) {
+        // Range query
+        db::get_agent_metrics_range(&state.db, id, start, end)
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+    } else {
+        // Simple limit query
+        let limit = query.limit.unwrap_or(100).min(1000); // Cap at 1000
+        db::get_agent_metrics(&state.db, id, limit)
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+    };
+
+    Ok(Json(metrics))
+}
+
+/// Get summary metrics across all agents
+pub async fn get_summary(
+    State(state): State<AppState>,
+) -> Result<Json<MetricsSummary>, (StatusCode, String)> {
+    let summary = db::get_metrics_summary(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(summary))
+}

projects/msp-tools/guru-rmm/server/src/api/mod.rs

@@ -0,0 +1,65 @@
+//! REST API routes
+//!
+//! Provides endpoints for:
+//! - Agent management (registration, listing, deletion)
+//! - Client and site management
+//! - Metrics retrieval
+//! - Command execution
+//! - User authentication
+
+pub mod agents;
+pub mod auth;
+pub mod clients;
+pub mod commands;
+pub mod metrics;
+pub mod sites;
+
+use axum::{
+    routing::{delete, get, post, put},
+    Router,
+};
+
+use crate::AppState;
+
+/// Build all API routes
+pub fn routes() -> Router<AppState> {
+    Router::new()
+        // Authentication
+        .route("/auth/login", post(auth::login))
+        .route("/auth/register", post(auth::register))
+        .route("/auth/me", get(auth::me))
+        // Clients
+        .route("/clients", get(clients::list_clients))
+        .route("/clients", post(clients::create_client))
+        .route("/clients/:id", get(clients::get_client))
+        .route("/clients/:id", put(clients::update_client))
+        .route("/clients/:id", delete(clients::delete_client))
+        .route("/clients/:id/sites", get(sites::list_sites_by_client))
+        // Sites
+        .route("/sites", get(sites::list_sites))
+        .route("/sites", post(sites::create_site))
+        .route("/sites/:id", get(sites::get_site))
+        .route("/sites/:id", put(sites::update_site))
+        .route("/sites/:id", delete(sites::delete_site))
+        .route("/sites/:id/regenerate-key", post(sites::regenerate_api_key))
+        // Agents
+        .route("/agents", get(agents::list_agents_with_details))
+        .route("/agents", post(agents::register_agent))
+        .route("/agents/stats", get(agents::get_stats))
+        .route("/agents/unassigned", get(agents::list_unassigned_agents))
+        .route("/agents/:id", get(agents::get_agent))
+        .route("/agents/:id", delete(agents::delete_agent))
+        .route("/agents/:id/move", post(agents::move_agent))
+        .route("/agents/:id/state", get(agents::get_agent_state))
+        // Metrics
+        .route("/agents/:id/metrics", get(metrics::get_agent_metrics))
+        .route("/metrics/summary", get(metrics::get_summary))
+        // Commands
+        .route("/agents/:id/command", post(commands::send_command))
+        .route("/commands", get(commands::list_commands))
+        .route("/commands/:id", get(commands::get_command))
+        // Legacy Agent (PowerShell for 2008 R2)
+        .route("/agent/register-legacy", post(agents::register_legacy))
+        .route("/agent/heartbeat", post(agents::heartbeat))
+        .route("/agent/command-result", post(agents::command_result))
+}

projects/msp-tools/guru-rmm/server/src/api/sites.rs

@@ -0,0 +1,280 @@
+//! Site management API endpoints
+
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::auth::AuthUser;
+use crate::db;
+use crate::ws::{generate_api_key, hash_api_key};
+use crate::AppState;
+
+/// Response for site operations
+#[derive(Debug, Serialize)]
+pub struct SiteResponse {
+    pub id: Uuid,
+    pub client_id: Uuid,
+    pub client_name: Option<String>,
+    pub name: String,
+    pub site_code: String,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub agent_count: i64,
+}
+
+/// Response when creating a site (includes one-time API key)
+#[derive(Debug, Serialize)]
+pub struct CreateSiteResponse {
+    pub site: SiteResponse,
+    /// The API key for agents at this site (shown only once!)
+    pub api_key: String,
+    pub message: String,
+}
+
+/// Request to create a new site
+#[derive(Debug, Deserialize)]
+pub struct CreateSiteRequest {
+    pub client_id: Uuid,
+    pub name: String,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+}
+
+/// Request to update a site
+#[derive(Debug, Deserialize)]
+pub struct UpdateSiteRequest {
+    pub name: Option<String>,
+    pub address: Option<String>,
+    pub notes: Option<String>,
+    pub is_active: Option<bool>,
+}
+
+/// List all sites
+pub async fn list_sites(
+    _user: AuthUser,
+    State(state): State<AppState>,
+) -> Result<Json<Vec<SiteResponse>>, (StatusCode, String)> {
+    let sites = db::get_all_sites_with_details(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    let responses: Vec<SiteResponse> = sites
+        .into_iter()
+        .map(|s| SiteResponse {
+            id: s.id,
+            client_id: s.client_id,
+            client_name: Some(s.client_name),
+            name: s.name,
+            site_code: s.site_code,
+            address: s.address,
+            notes: s.notes,
+            is_active: s.is_active,
+            created_at: s.created_at,
+            agent_count: s.agent_count,
+        })
+        .collect();
+
+    Ok(Json(responses))
+}
+
+/// List sites for a specific client
+pub async fn list_sites_by_client(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(client_id): Path<Uuid>,
+) -> Result<Json<Vec<SiteResponse>>, (StatusCode, String)> {
+    let sites = db::get_sites_by_client(&state.db, client_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    let responses: Vec<SiteResponse> = sites
+        .into_iter()
+        .map(|s| SiteResponse {
+            id: s.id,
+            client_id: s.client_id,
+            client_name: None,
+            name: s.name,
+            site_code: s.site_code,
+            address: s.address,
+            notes: s.notes,
+            is_active: s.is_active,
+            created_at: s.created_at,
+            agent_count: 0, // Would need separate query
+        })
+        .collect();
+
+    Ok(Json(responses))
+}
+
+/// Create a new site
+pub async fn create_site(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Json(req): Json<CreateSiteRequest>,
+) -> Result<Json<CreateSiteResponse>, (StatusCode, String)> {
+    // Verify client exists
+    let client = db::get_client_by_id(&state.db, req.client_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Client not found".to_string()))?;
+
+    // Generate unique site code and API key
+    let site_code = db::generate_unique_site_code(&state.db)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    let api_key = generate_api_key(&state.config.auth.api_key_prefix);
+    let api_key_hash = hash_api_key(&api_key);
+
+    let create = db::CreateSiteInternal {
+        client_id: req.client_id,
+        name: req.name,
+        site_code: site_code.clone(),
+        api_key_hash,
+        address: req.address,
+        notes: req.notes,
+    };
+
+    let site = db::create_site(&state.db, create)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(CreateSiteResponse {
+        site: SiteResponse {
+            id: site.id,
+            client_id: site.client_id,
+            client_name: Some(client.name),
+            name: site.name,
+            site_code: site.site_code,
+            address: site.address,
+            notes: site.notes,
+            is_active: site.is_active,
+            created_at: site.created_at,
+            agent_count: 0,
+        },
+        api_key,
+        message: "Site created. Save the API key - it will not be shown again.".to_string(),
+    }))
+}
+
+/// Get a specific site
+pub async fn get_site(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<SiteResponse>, (StatusCode, String)> {
+    let site = db::get_site_by_id(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Site not found".to_string()))?;
+
+    // Get client name and agent count
+    let client = db::get_client_by_id(&state.db, site.client_id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    let agents = db::get_agents_by_site(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(SiteResponse {
+        id: site.id,
+        client_id: site.client_id,
+        client_name: client.map(|c| c.name),
+        name: site.name,
+        site_code: site.site_code,
+        address: site.address,
+        notes: site.notes,
+        is_active: site.is_active,
+        created_at: site.created_at,
+        agent_count: agents.len() as i64,
+    }))
+}
+
+/// Update a site
+pub async fn update_site(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<UpdateSiteRequest>,
+) -> Result<Json<SiteResponse>, (StatusCode, String)> {
+    let update = db::UpdateSite {
+        name: req.name,
+        address: req.address,
+        notes: req.notes,
+        is_active: req.is_active,
+    };
+
+    let site = db::update_site(&state.db, id, update)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Site not found".to_string()))?;
+
+    Ok(Json(SiteResponse {
+        id: site.id,
+        client_id: site.client_id,
+        client_name: None,
+        name: site.name,
+        site_code: site.site_code,
+        address: site.address,
+        notes: site.notes,
+        is_active: site.is_active,
+        created_at: site.created_at,
+        agent_count: 0,
+    }))
+}
+
+/// Regenerate API key for a site
+#[derive(Debug, Serialize)]
+pub struct RegenerateApiKeyResponse {
+    pub api_key: String,
+    pub message: String,
+}
+
+pub async fn regenerate_api_key(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<RegenerateApiKeyResponse>, (StatusCode, String)> {
+    // Verify site exists
+    let _site = db::get_site_by_id(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Site not found".to_string()))?;
+
+    // Generate new API key
+    let api_key = generate_api_key(&state.config.auth.api_key_prefix);
+    let api_key_hash = hash_api_key(&api_key);
+
+    db::regenerate_site_api_key(&state.db, id, &api_key_hash)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    Ok(Json(RegenerateApiKeyResponse {
+        api_key,
+        message: "API key regenerated. Save it - it will not be shown again. Existing agents will need to be reconfigured.".to_string(),
+    }))
+}
+
+/// Delete a site
+pub async fn delete_site(
+    _user: AuthUser,
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<StatusCode, (StatusCode, String)> {
+    let deleted = db::delete_site(&state.db, id)
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+    if deleted {
+        Ok(StatusCode::NO_CONTENT)
+    } else {
+        Err((StatusCode::NOT_FOUND, "Site not found".to_string()))
+    }
+}