From 7677fae14b5b8ab052ad8dbe5dcdf41b56354ed3 Mon Sep 17 00:00:00 2001
From: Ferdinand Schober <ferdinandschober20@gmail.com>
Date: Sat, 9 Nov 2024 13:54:43 +0100
Subject: [PATCH] Encryption and One-Way-Control (#200)

This is a major rewrite of the core networking logic enabling one-way control and encryption through the webrtc-dtls crate.

closes #164
closes #104
---
 .gitignore                                    |    5 +-
 Cargo.lock                                    | 1037 ++++++++++++++++-
 Cargo.toml                                    |   12 +-
 README.md                                     |   43 +-
 config.toml                                   |    7 +-
 lan-mouse-cli/src/lib.rs                      |   11 +
 lan-mouse-gtk/resources/fingerprint_window.ui |  101 ++
 lan-mouse-gtk/resources/key_row.ui            |   16 +
 .../resources/resources.gresource.xml         |    2 +
 lan-mouse-gtk/resources/window.ui             |   75 +-
 lan-mouse-gtk/src/fingerprint_window.rs       |   18 +
 lan-mouse-gtk/src/fingerprint_window/imp.rs   |   64 +
 lan-mouse-gtk/src/key_object.rs               |   25 +
 lan-mouse-gtk/src/key_object/imp.rs           |   24 +
 lan-mouse-gtk/src/key_row.rs                  |   48 +
 lan-mouse-gtk/src/key_row/imp.rs              |   68 ++
 lan-mouse-gtk/src/lib.rs                      |   12 +
 lan-mouse-gtk/src/window.rs                   |  113 +-
 lan-mouse-gtk/src/window/imp.rs               |   49 +-
 lan-mouse-ipc/src/lib.rs                      |   33 +-
 lan-mouse-ipc/src/listen.rs                   |   14 +-
 lan-mouse-proto/src/lib.rs                    |   55 +-
 src/capture.rs                                |  418 +++++++
 src/client.rs                                 |  237 +++-
 src/config.rs                                 |   56 +-
 src/connect.rs                                |  281 +++++
 src/crypto.rs                                 |   71 ++
 src/dns.rs                                    |  111 +-
 src/emulation.rs                              |  407 +++++++
 src/lib.rs                                    |   12 +-
 src/listen.rs                                 |  224 ++++
 src/main.rs                                   |   20 +-
 src/server.rs                                 |  562 ---------
 src/server/capture_task.rs                    |  206 ----
 src/server/emulation_task.rs                  |  188 ---
 src/server/network_task.rs                    |   99 --
 src/server/ping_task.rs                       |  138 ---
 src/service.rs                                |  513 ++++++++
 38 files changed, 4002 insertions(+), 1373 deletions(-)
 create mode 100644 lan-mouse-gtk/resources/fingerprint_window.ui
 create mode 100644 lan-mouse-gtk/resources/key_row.ui
 create mode 100644 lan-mouse-gtk/src/fingerprint_window.rs
 create mode 100644 lan-mouse-gtk/src/fingerprint_window/imp.rs
 create mode 100644 lan-mouse-gtk/src/key_object.rs
 create mode 100644 lan-mouse-gtk/src/key_object/imp.rs
 create mode 100644 lan-mouse-gtk/src/key_row.rs
 create mode 100644 lan-mouse-gtk/src/key_row/imp.rs
 create mode 100644 src/capture.rs
 create mode 100644 src/connect.rs
 create mode 100644 src/crypto.rs
 create mode 100644 src/emulation.rs
 create mode 100644 src/listen.rs
 delete mode 100644 src/server.rs
 delete mode 100644 src/server/capture_task.rs
 delete mode 100644 src/server/emulation_task.rs
 delete mode 100644 src/server/network_task.rs
 delete mode 100644 src/server/ping_task.rs
 create mode 100644 src/service.rs

diff --git a/.gitignore b/.gitignore
index 28540a22..2a2cafce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,4 +4,7 @@
 .vs/
 .vscode/
 .direnv/
-result
\ No newline at end of file
+result
+*.pem
+*.csr
+extfile.conf
diff --git a/Cargo.lock b/Cargo.lock
index bb283b18..fd820819 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,6 +17,41 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -113,6 +148,83 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f6fd5ddaf0351dff5b8da21b2fb4ff8e08ddd02857f0bf69c47639106c0fff0"
+dependencies = [
+ "asn1-rs-derive 0.4.0",
+ "asn1-rs-impl 0.1.0",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.68",
+]
+
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive 0.5.1",
+ "asn1-rs-impl 0.2.0",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.68",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "synstructure 0.12.6",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.87",
+ "synstructure 0.13.1",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.87",
+]
+
 [[package]]
 name = "async-broadcast"
 version = "0.7.1"
@@ -194,7 +306,7 @@ checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -229,7 +341,7 @@ checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -259,6 +371,33 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -271,6 +410,24 @@ version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "blocking"
 version = "1.6.1"
@@ -319,6 +476,15 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "cc"
 version = "1.1.36"
@@ -328,6 +494,18 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "ccm"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae3c82e4355234767756212c570e29833699ab63e6ffd161887314cc5b43847"
+dependencies = [
+ "aead",
+ "cipher",
+ "ctr",
+ "subtle",
+]
+
 [[package]]
 name = "cfg-expr"
 version = "0.17.0"
@@ -350,6 +528,16 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
 [[package]]
 name = "clap"
 version = "4.5.20"
@@ -381,7 +569,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -405,6 +593,12 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "core-foundation"
 version = "0.10.0"
@@ -445,18 +639,144 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608697df725056feaccfa42cffdaeeec3fccc4ffc38358ecd19b243e716a78e0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
 
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "typenum",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.87",
+]
+
 [[package]]
 name = "data-encoding"
 version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
 
+[[package]]
+name = "der"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "der-parser"
+version = "8.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbd676fbbab537128ef0278adb5576cf363cff6aa22a7b24effe97347cfab61e"
+dependencies = [
+ "asn1-rs 0.5.2",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs 0.6.2",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -465,7 +785,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -483,6 +803,41 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "hkdf",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "endi"
 version = "1.1.0"
@@ -498,7 +853,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -519,7 +874,7 @@ checksum = "de0d48a183585823424a4ce1aa132d174a6a81bd540895822eb4c8373a8e49e8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -588,13 +943,29 @@ version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8c02a5121d4ea3eb16a80748c74f5549a5665e4c21333c6098f283870fbdea6"
 
+[[package]]
+name = "ff"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
+dependencies = [
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "field-offset"
 version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
 dependencies = [
- "memoffset",
+ "memoffset 0.9.1",
  "rustc_version",
 ]
 
@@ -616,7 +987,7 @@ checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -703,7 +1074,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -793,6 +1164,17 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+ "zeroize",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.15"
@@ -804,6 +1186,16 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
 [[package]]
 name = "gimli"
 version = "0.31.1"
@@ -880,7 +1272,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -927,6 +1319,17 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core",
+ "subtle",
+]
+
 [[package]]
 name = "gsk4"
 version = "0.9.3"
@@ -988,7 +1391,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -1094,6 +1497,24 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "hostname"
 version = "0.3.1"
@@ -1237,7 +1658,7 @@ checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -1281,6 +1702,16 @@ dependencies = [
  "hashbrown",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
 [[package]]
 name = "input-capture"
 version = "0.3.0"
@@ -1419,13 +1850,18 @@ dependencies = [
  "libc",
  "local-channel",
  "log",
+ "rcgen",
+ "rustls",
  "serde",
  "serde_json",
+ "sha2",
  "slab",
  "thiserror 2.0.0",
  "tokio",
  "tokio-util",
  "toml",
+ "webrtc-dtls",
+ "webrtc-util",
 ]
 
 [[package]]
@@ -1473,6 +1909,12 @@ dependencies = [
  "thiserror 2.0.0",
 ]
 
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
 [[package]]
 name = "libadwaita"
 version = "0.7.1"
@@ -1602,6 +2044,15 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -1611,6 +2062,12 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.0"
@@ -1632,6 +2089,19 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "nix"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
+]
+
 [[package]]
 name = "nix"
 version = "0.29.0"
@@ -1642,7 +2112,7 @@ dependencies = [
  "cfg-if",
  "cfg_aliases",
  "libc",
- "memoffset",
+ "memoffset 0.9.1",
 ]
 
 [[package]]
@@ -1652,7 +2122,51 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 
 [[package]]
-name = "num_enum"
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_enum"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e613fc340b2220f734a8595782c551f1250e969d87d3be1ae0579e8d4065179"
@@ -1669,7 +2183,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -1681,12 +2195,27 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs 0.6.2",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "ordered-stream"
 version = "0.2.0"
@@ -1697,6 +2226,30 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70786f51bcc69f6a4c0360e063a4cac5419ef7c5cd5b3c99ad70f3be5ba79209"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
 [[package]]
 name = "pango"
 version = "0.20.4"
@@ -1756,6 +2309,25 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
+[[package]]
+name = "pem"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e459365e590736a54c3fa561947c84837534b8e9af6fc5bf781307e82658fae"
+dependencies = [
+ "base64",
+ "serde",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@@ -1785,6 +2357,16 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.31"
@@ -1806,6 +2388,30 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.20"
@@ -1815,6 +2421,15 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.2.0"
@@ -1887,6 +2502,19 @@ dependencies = [
  "getrandom",
 ]
 
+[[package]]
+name = "rcgen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54077e1872c46788540de1ea3d7f4ccb1983d12f9aa909b234468676c1a36779"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "yasna",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.7"
@@ -1946,6 +2574,31 @@ dependencies = [
  "quick-error",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom",
+ "libc",
+ "spin",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.24"
@@ -1961,6 +2614,15 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "rustix"
 version = "0.38.39"
@@ -1974,6 +2636,37 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eee87ff5d9b36712a58574e12e9f0ea80f915a5b0ac518d322b24a465617925e"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.102.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.18"
@@ -1992,6 +2685,20 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.23"
@@ -2015,7 +2722,7 @@ checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2038,7 +2745,7 @@ checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2050,6 +2757,28 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -2065,6 +2794,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core",
+]
+
 [[package]]
 name = "slab"
 version = "0.4.9"
@@ -2090,6 +2829,22 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@@ -2108,6 +2863,23 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.87"
@@ -2119,6 +2891,18 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "synstructure"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "unicode-xid",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.13.1"
@@ -2127,7 +2911,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2188,7 +2972,7 @@ checksum = "a7c61ec9a6f64d2793d8a45faba21efbe3ced62a886d44c36a009b2b519b4c7e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2199,7 +2983,38 @@ checksum = "22efd00f33f93fa62848a7cab956c3d38c8d43095efda1decfc2b3a5dc0b8972"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
+]
+
+[[package]]
+name = "time"
+version = "0.3.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "time-macros"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+dependencies = [
+ "num-conv",
+ "time-core",
 ]
 
 [[package]]
@@ -2237,6 +3052,7 @@ dependencies = [
  "bytes",
  "libc",
  "mio",
+ "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
@@ -2253,7 +3069,7 @@ checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2333,7 +3149,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2345,13 +3161,19 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
 [[package]]
 name = "uds_windows"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89daebc3e6fd160ac4aa9fc8b3bf71e1f74fbf92367ae71fb83a037e8bf164b9"
 dependencies = [
- "memoffset",
+ "memoffset 0.9.1",
  "tempfile",
  "winapi",
 ]
@@ -2383,6 +3205,28 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.5.3"
@@ -2419,6 +3263,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "852e951cb7832cb45cb1169900d19760cfa39b82bc0ea9c0e5a14ae88411c98b"
 
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -2511,6 +3361,65 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "webrtc-dtls"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86e5eedbb0375aa04da93fc3a189b49ed3ed9ee844b6997d5aade14fc3e2c26e"
+dependencies = [
+ "aes",
+ "aes-gcm",
+ "async-trait",
+ "bincode",
+ "byteorder",
+ "cbc",
+ "ccm",
+ "der-parser 8.2.0",
+ "hkdf",
+ "hmac",
+ "log",
+ "p256",
+ "p384",
+ "pem",
+ "portable-atomic",
+ "rand",
+ "rand_core",
+ "rcgen",
+ "ring",
+ "rustls",
+ "sec1",
+ "serde",
+ "sha1",
+ "sha2",
+ "subtle",
+ "thiserror 1.0.68",
+ "tokio",
+ "webrtc-util",
+ "x25519-dalek",
+ "x509-parser",
+]
+
+[[package]]
+name = "webrtc-util"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc8d9bc631768958ed97b8d68b5d301e63054ae90b09083d43e2fefb939fd77e"
+dependencies = [
+ "async-trait",
+ "bitflags 1.3.2",
+ "bytes",
+ "ipnet",
+ "lazy_static",
+ "libc",
+ "log",
+ "nix 0.26.4",
+ "portable-atomic",
+ "rand",
+ "thiserror 1.0.68",
+ "tokio",
+ "winapi",
+]
+
 [[package]]
 name = "widestring"
 version = "1.1.0"
@@ -2589,7 +3498,7 @@ checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2600,7 +3509,7 @@ checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2811,6 +3720,35 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs 0.6.2",
+ "data-encoding",
+ "der-parser 9.0.0",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "rusticata-macros",
+ "thiserror 1.0.68",
+ "time",
+]
+
 [[package]]
 name = "xdg-home"
 version = "1.3.0"
@@ -2821,6 +3759,15 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.7.4"
@@ -2841,8 +3788,8 @@ checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
- "synstructure",
+ "syn 2.0.87",
+ "synstructure 0.13.1",
 ]
 
 [[package]]
@@ -2860,7 +3807,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "hex",
- "nix",
+ "nix 0.29.0",
  "ordered-stream",
  "serde",
  "serde_repr",
@@ -2885,7 +3832,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
  "zbus_names",
  "zvariant",
  "zvariant_utils",
@@ -2921,7 +3868,7 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2941,8 +3888,28 @@ checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
- "synstructure",
+ "syn 2.0.87",
+ "synstructure 0.13.1",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2964,7 +3931,7 @@ checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -2992,7 +3959,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.87",
  "zvariant_utils",
 ]
 
@@ -3006,6 +3973,6 @@ dependencies = [
  "quote",
  "serde",
  "static_assertions",
- "syn",
+ "syn 2.0.87",
  "winnow",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index e5babf68..8d3bb054 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -18,8 +18,10 @@ license = "GPL-3.0-or-later"
 repository = "https://github.com/feschber/lan-mouse"
 
 [profile.release]
-strip = true
+codegen-units = 1
 lto = "fat"
+strip = true
+panic = "abort"
 
 [dependencies]
 input-event = { path = "input-event", version = "0.3.0" }
@@ -52,6 +54,14 @@ slab = "0.4.9"
 thiserror = "2.0.0"
 tokio-util = "0.7.11"
 local-channel = "0.1.5"
+webrtc-dtls = { version = "0.10.0", features = ["pem"] }
+webrtc-util = "0.9.0"
+rustls = { version = "0.23.12", default-features = false, features = [
+    "std",
+    "ring",
+] }
+rcgen = "0.13.1"
+sha2 = "0.10.8"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2.148"
diff --git a/README.md b/README.md
index 39324664..a893f60e 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ It allows for using multiple PCs via a single set of mouse and keyboard.
 This is also known as a Software KVM switch.
 
 Goal of this project is to be an open-source alternative to proprietary tools like [Synergy 2/3](https://symless.com/synergy), [Share Mouse](https://www.sharemouse.com/de/)
-and an alternative to other open source tools like [Deskflow](https://github.com/deskflow/deskflow) or [Input Leap](https://github.com/input-leap) (Synergy fork).
+and other open source tools like [Deskflow](https://github.com/deskflow/deskflow) or [Input Leap](https://github.com/input-leap) (Synergy fork).
 
 Focus lies on performance, ease of use and a maintainable implementation that can be expanded to support additional backends for e.g. Android, iOS, ... in the future.
 
@@ -19,15 +19,10 @@ Focus lies on performance, ease of use and a maintainable implementation that ca
 </picture>
 
 
-> [!WARNING]
-> DISCLAIMER:
-> Until [#200](https://github.com/feschber/lan-mouse/pull/200) is merged, all network traffic is **unencrypted** and sent in **plaintext**!
->
-> A malicious actor with access to the network could read input data or send input events with spoofed IPs to take control over a device.
->
-> Therefore you should only use this tool in your local network with trusted devices.
-> I take no responsibility for any security breaches!
+## Encryption
 
+Lan Mouse encrypts all network traffic using the DTLS implementation provided by [WebRTC.rs](https://github.com/webrtc-rs/webrtc).
+There are currently no mitigations in place for timing side-channel attacks.
 
 ## OS Support
 
@@ -190,14 +185,14 @@ sudo dnf install libadwaita-devel libXtst-devel libX11-devel
 </details>
 <details>
     <summary>Nix</summary>
-    
+
 ```sh
 nix-shell .
 ```
 </details>
 <details>
     <summary>Nix (flake)</summary>
-    
+
 ```sh
 nix develop
 ```
@@ -252,11 +247,17 @@ the gtk frontend (see conditional compilation).
 
 By default the gtk frontend will open when running `lan-mouse`.
 
-To add a new connection, simply click the `Add` button on *both* devices,
-enter the corresponding hostname and activate it.
+To connect a device you want to control, simply click the `Add` button and enter the hostname
+of the device.
+
+On the *remote* device, authorize your *local* device for incoming traffic using the `Authorize` button
+under the "Incoming Connections" section.
+The fingerprint for authorization can be found under the general section of your *local* device.
+It is of the form "aa:bb:cc:..."
 
-If the mouse can not be moved onto a device, make sure you have port `4242` (or the one selected)
-opened up in your firewall.
+Authorized devices can be persisted using the configuration file (see [Configuration](#configuration)).
+
+If the device still can not be entered, make sure you have UDP port `4242` (or the one selected) opened up in your firewall.
 </details>
 
 <details>
@@ -321,9 +322,14 @@ release_bind = [ "KeyA", "KeyS", "KeyD", "KeyF" ]
 # optional port (defaults to 4242)
 port = 4242
 # # optional frontend -> defaults to gtk if available
-# # possible values are "cli" and "gtk" 
+# # possible values are "cli" and "gtk"
 # frontend = "gtk"
 
+# list of authorized tls certificate fingerprints that
+# are accepted for incoming traffic
+[authorized_fingerprints]
+"bc:05:ab:7a:a4:de:88:8c:2f:92:ac:bc:b8:49:b8:24:0d:44:b3:e6:a4:ef:d7:0b:6c:69:6d:77:53:0b:14:80" = "iridium"
+
 # define a client on the right side with host name "iridium"
 [right]
 # hostname
@@ -356,7 +362,7 @@ Where `left` can be either `left`, `right`, `top` or `bottom`.
 - [x] Libei Input Capture
 - [x] MacOS Input Capture
 - [x] Windows Input Capture
-- [ ] *Encryption* (WIP)
+- [x] Encryption
 - [ ] X11 Input Capture
 - [ ] Latency measurement and visualization
 - [ ] Bandwidth usage measurement and visualization
@@ -408,6 +414,3 @@ The following sections detail the emulation and capture backends provided by lan
 - `windows`: Backend for input capture on Windows.
 - `macos`: Backend for input capture on MacOS.
 - `x11`: TODO (not yet supported)
-
-
-
diff --git a/config.toml b/config.toml
index b05d249e..26aebd11 100644
--- a/config.toml
+++ b/config.toml
@@ -3,13 +3,18 @@
 # capture_backend = "LayerShell"
 
 # release bind
-release_bind = [ "KeyA", "KeyS", "KeyD", "KeyF" ]
+release_bind = ["KeyA", "KeyS", "KeyD", "KeyF"]
 
 # optional port (defaults to 4242)
 port = 4242
 # optional frontend -> defaults to gtk if available
 # frontend = "gtk"
 
+# list of authorized tls certificate fingerprints that
+# are accepted for incoming traffic
+[authorized_fingerprints]
+"bc:05:ab:7a:a4:de:88:8c:2f:92:ac:bc:b8:49:b8:24:0d:44:b3:e6:a4:ef:d7:0b:6c:69:6d:77:53:0b:14:80" = "iridium"
+
 # define a client on the right side with host name "iridium"
 [right]
 # hostname
diff --git a/lan-mouse-cli/src/lib.rs b/lan-mouse-cli/src/lib.rs
index a0464953..f74a4061 100644
--- a/lan-mouse-cli/src/lib.rs
+++ b/lan-mouse-cli/src/lib.rs
@@ -274,6 +274,17 @@ impl Cli {
             FrontendEvent::EmulationStatus(s) => {
                 eprintln!("emulation status: {s:?}")
             }
+            FrontendEvent::AuthorizedUpdated(fingerprints) => {
+                eprintln!("authorized keys changed:");
+                for (desc, fp) in fingerprints {
+                    eprintln!("{desc}: {fp}");
+                }
+            }
+            FrontendEvent::PublicKeyFingerprint(fp) => {
+                eprintln!("the public key fingerprint of this device is {fp}");
+            }
+            FrontendEvent::IncomingConnected(..) => {}
+            FrontendEvent::IncomingDisconnected(..) => {}
         }
     }
 
diff --git a/lan-mouse-gtk/resources/fingerprint_window.ui b/lan-mouse-gtk/resources/fingerprint_window.ui
new file mode 100644
index 00000000..35d272f9
--- /dev/null
+++ b/lan-mouse-gtk/resources/fingerprint_window.ui
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <requires lib="gtk" version="4.0"/>
+  <requires lib="libadwaita" version="1.0"/>
+  <template class="FingerprintWindow" parent="AdwWindow">
+    <property name="modal">True</property>
+    <property name="width-request">880</property>
+    <property name="default-width">880</property>
+    <property name="height-request">380</property>
+    <property name="default-height">380</property>
+    <property name="title" translatable="yes">Add Certificate Fingerprint</property>
+    <property name="content">
+      <object class="AdwToolbarView">
+        <child type="top">
+            <object class="AdwHeaderBar"/>
+        </child>
+        <property name="content">
+          <object class="AdwClamp">
+            <property name="maximum-size">770</property>
+            <property name="tightening-threshold">0</property>
+            <property name="child">
+              <object class="GtkBox">
+                <property name="orientation">vertical</property>
+                <property name="spacing">18</property>
+                <child>
+                  <object class="GtkLabel">
+                    <property name="label">The certificate fingerprint serves as a unique identifier for your device.</property>
+                  </object>
+                </child>
+                <child>
+                  <object class="GtkLabel">
+                    <property name="label">You can find it under the `General` section of the device you want to connect</property>
+                  </object>
+                </child>
+                <child>
+                  <object class="AdwPreferencesGroup">
+                    <property name="title">description</property>
+                    <child>
+                      <object class="AdwActionRow">
+                        <property name="child">
+                          <object class="GtkText" id="description">
+                            <property name="margin-top">10</property>
+                            <property name="margin-bottom">10</property>
+                            <property name="margin-start">10</property>
+                            <property name="margin-end">10</property>
+                            <property name="enable-undo">True</property>
+                            <property name="hexpand">True</property>
+                            <property name="vexpand">True</property>
+                            <property name="max-length">0</property>
+                          </object>
+                        </property>
+                      </object>
+                    </child>
+                  </object>
+                </child>
+                <child>
+                  <object class="AdwPreferencesGroup">
+                    <property name="title">sha256 fingerprint</property>
+                    <child>
+                      <object class="AdwActionRow">
+                        <property name="child">
+                          <object class="GtkText" id="fingerprint">
+                            <property name="margin-top">10</property>
+                            <property name="margin-bottom">10</property>
+                            <property name="margin-start">10</property>
+                            <property name="margin-end">10</property>
+                            <property name="enable-undo">True</property>
+                            <property name="hexpand">True</property>
+                            <property name="vexpand">True</property>
+                            <property name="max-length">0</property>
+                          </object>
+                        </property>
+                      </object>
+                    </child>
+                  </object>
+                </child>
+                <child>
+                  <object class="GtkBox">
+                    <property name="orientation">vertical</property>
+                    <property name="halign">center</property>
+                    <child>
+                      <object class="GtkButton" id="confirm_button">
+                        <signal name="clicked" handler="handle_confirm" swapped="true"/>
+                        <property name="label" translatable="yes">Confirm</property>
+                        <property name="can-shrink">True</property>
+                        <style>
+                            <class name="pill"/>
+                            <class name="suggested-action"/>
+                        </style>
+                      </object>
+                    </child>
+                  </object>
+                </child>
+              </object>
+            </property>
+          </object>
+        </property>
+      </object>
+    </property>
+  </template>
+</interface>
diff --git a/lan-mouse-gtk/resources/key_row.ui b/lan-mouse-gtk/resources/key_row.ui
new file mode 100644
index 00000000..48406756
--- /dev/null
+++ b/lan-mouse-gtk/resources/key_row.ui
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+	<template class="KeyRow" parent="AdwActionRow">
+		<child type="prefix">
+			<object class="GtkButton" id="delete_button">
+				<property name="valign">center</property>
+				<property name="halign">end</property>
+				<property name="tooltip-text" translatable="yes">revoke authorization</property>
+                <property name="icon-name">edit-delete-symbolic</property>
+				<style>
+                    <class name="flat"/>
+				</style>
+			</object>
+		</child>
+	</template>
+</interface>
diff --git a/lan-mouse-gtk/resources/resources.gresource.xml b/lan-mouse-gtk/resources/resources.gresource.xml
index b5d9209b..2a6812f0 100644
--- a/lan-mouse-gtk/resources/resources.gresource.xml
+++ b/lan-mouse-gtk/resources/resources.gresource.xml
@@ -2,7 +2,9 @@
 <gresources>
   <gresource prefix="/de/feschber/LanMouse">
     <file compressed="true" preprocess="xml-stripblanks">window.ui</file>
+    <file compressed="true" preprocess="xml-stripblanks">fingerprint_window.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">client_row.ui</file>
+    <file compressed="true" preprocess="xml-stripblanks">key_row.ui</file>
   </gresource>
   <gresource prefix="/de/feschber/LanMouse/icons">
     <file compressed="true" preprocess="xml-stripblanks">de.feschber.LanMouse.svg</file>
diff --git a/lan-mouse-gtk/resources/window.ui b/lan-mouse-gtk/resources/window.ui
index 7c96036d..a3d1c89f 100644
--- a/lan-mouse-gtk/resources/window.ui
+++ b/lan-mouse-gtk/resources/window.ui
@@ -121,7 +121,31 @@
                         -->
                         <child>
                           <object class="AdwActionRow">
-                            <property name="title">port</property>
+                            <property name="title">hostname &#38;amp; port</property>
+                            <child>
+                              <object class="GtkButton" id="copy-hostname-button">
+                                    <!--<property name="icon-name">edit-copy-symbolic</property>-->
+                                <property name="valign">center</property>
+                                <signal name="clicked" handler="handle_copy_hostname" swapped="true"/>
+                                <child>
+                                  <object class="GtkBox">
+                                    <property name="spacing">30</property>
+                                    <child>
+                                      <object class="GtkLabel" id="hostname_label">
+                                        <property name="label">&lt;span font_style=&quot;italic&quot; font_weight=&quot;light&quot; foreground=&quot;darkgrey&quot;&gt;could not determine hostname&lt;/span&gt;</property>
+                                        <property name="use-markup">true</property>
+                                        <property name="valign">center</property>
+                                      </object>
+                                    </child>
+                                    <child>
+                                      <object class="GtkImage" id="hostname_copy_icon">
+                                        <property name="icon-name">edit-copy-symbolic</property>
+                                      </object>
+                                    </child>
+                                  </object>
+                                </child>
+                              </object>
+                            </child>
                             <child>
                               <object class="GtkEntry" id="port_entry">
                                 <property name="max-width-chars">5</property>
@@ -160,20 +184,14 @@
                           </object>
                         </child>
                         <child>
-                          <object class="AdwActionRow">
-                            <property name="title">hostname</property>
+                          <object class="AdwActionRow" id="fingerprint_row">
+                            <property name="title">certificate fingerprint</property>
+                            <property name="icon-name">auth-fingerprint-symbolic</property>
                             <child>
-                              <object class="GtkLabel" id="hostname_label">
-                                <property name="label">&lt;span font_style=&quot;italic&quot; font_weight=&quot;light&quot; foreground=&quot;darkgrey&quot;&gt;could not determine hostname&lt;/span&gt;</property>
-                                <property name="use-markup">true</property>
-                                <property name="valign">center</property>
-                              </object>
-                            </child>
-                            <child>
-                              <object class="GtkButton" id="copy-hostname-button">
+                              <object class="GtkButton" id="copy-fingerprint-button">
                                 <property name="icon-name">edit-copy-symbolic</property>
                                 <property name="valign">center</property>
-                                <signal name="clicked" handler="handle_copy_hostname" swapped="true"/>
+                                <signal name="clicked" handler="handle_copy_fingerprint" swapped="true"/>
                               </object>
                             </child>
                           </object>
@@ -213,6 +231,39 @@
                         </child>
                       </object>
                     </child>
+                    <child>
+                      <object class="AdwPreferencesGroup">
+                        <property name="title" translatable="yes">Incoming Connections</property>
+                        <property name="header-suffix">
+                          <object class="GtkButton">
+                            <signal name="clicked" handler="handle_add_cert_fingerprint" swapped="true"/>
+                            <property name="child">
+                              <object class="AdwButtonContent">
+                                <property name="icon-name">auth-fingerprint-symbolic</property>
+                                <property name="label" translatable="yes">Authorize</property>
+                              </object>
+                            </property>
+                            <style>
+                              <class name="flat"/>
+                            </style>
+                          </object>
+                        </property>
+                        <child>
+                          <object class="GtkListBox" id="authorized_list">
+                            <property name="selection-mode">none</property>
+                            <child type="placeholder">
+                              <object class="AdwActionRow" id="authorized_placeholder">
+                                <property name="title">no devices registered!</property>
+                                <property name="subtitle">authorize a new device via the "Authorize" button</property>
+                              </object>
+                            </child>
+                            <style>
+                              <class name="boxed-list" />
+                            </style>
+                          </object>
+                        </child>
+                      </object>
+                    </child>
                     </object>
                   </property>
                   </object>
diff --git a/lan-mouse-gtk/src/fingerprint_window.rs b/lan-mouse-gtk/src/fingerprint_window.rs
new file mode 100644
index 00000000..9791c73f
--- /dev/null
+++ b/lan-mouse-gtk/src/fingerprint_window.rs
@@ -0,0 +1,18 @@
+mod imp;
+
+use glib::Object;
+use gtk::{gio, glib};
+
+glib::wrapper! {
+    pub struct FingerprintWindow(ObjectSubclass<imp::FingerprintWindow>)
+    @extends adw::Window, gtk::Window, gtk::Widget,
+    @implements gio::ActionGroup, gio::ActionMap, gtk::Accessible, gtk::Buildable,
+                gtk::ConstraintTarget, gtk::Native, gtk::Root, gtk::ShortcutManager;
+}
+
+impl FingerprintWindow {
+    pub(crate) fn new() -> Self {
+        let window: Self = Object::builder().build();
+        window
+    }
+}
diff --git a/lan-mouse-gtk/src/fingerprint_window/imp.rs b/lan-mouse-gtk/src/fingerprint_window/imp.rs
new file mode 100644
index 00000000..1ba80af9
--- /dev/null
+++ b/lan-mouse-gtk/src/fingerprint_window/imp.rs
@@ -0,0 +1,64 @@
+use std::sync::OnceLock;
+
+use adw::prelude::*;
+use adw::subclass::prelude::*;
+use glib::subclass::InitializingObject;
+use gtk::{
+    glib::{self, subclass::Signal},
+    template_callbacks, Button, CompositeTemplate, Text,
+};
+
+#[derive(CompositeTemplate, Default)]
+#[template(resource = "/de/feschber/LanMouse/fingerprint_window.ui")]
+pub struct FingerprintWindow {
+    #[template_child]
+    pub description: TemplateChild<Text>,
+    #[template_child]
+    pub fingerprint: TemplateChild<Text>,
+    #[template_child]
+    pub confirm_button: TemplateChild<Button>,
+}
+
+#[glib::object_subclass]
+impl ObjectSubclass for FingerprintWindow {
+    const NAME: &'static str = "FingerprintWindow";
+    const ABSTRACT: bool = false;
+
+    type Type = super::FingerprintWindow;
+    type ParentType = adw::Window;
+
+    fn class_init(klass: &mut Self::Class) {
+        klass.bind_template();
+        klass.bind_template_callbacks();
+    }
+
+    fn instance_init(obj: &InitializingObject<Self>) {
+        obj.init_template();
+    }
+}
+
+#[template_callbacks]
+impl FingerprintWindow {
+    #[template_callback]
+    fn handle_confirm(&self, _button: Button) {
+        let desc = self.description.text().as_str().trim().to_owned();
+        let fp = self.fingerprint.text().as_str().trim().to_owned();
+        self.obj().emit_by_name("confirm-clicked", &[&desc, &fp])
+    }
+}
+
+impl ObjectImpl for FingerprintWindow {
+    fn signals() -> &'static [Signal] {
+        static SIGNALS: OnceLock<Vec<Signal>> = OnceLock::new();
+        SIGNALS.get_or_init(|| {
+            vec![Signal::builder("confirm-clicked")
+                .param_types([String::static_type(), String::static_type()])
+                .build()]
+        })
+    }
+}
+
+impl WidgetImpl for FingerprintWindow {}
+impl WindowImpl for FingerprintWindow {}
+impl ApplicationWindowImpl for FingerprintWindow {}
+impl AdwWindowImpl for FingerprintWindow {}
diff --git a/lan-mouse-gtk/src/key_object.rs b/lan-mouse-gtk/src/key_object.rs
new file mode 100644
index 00000000..17172438
--- /dev/null
+++ b/lan-mouse-gtk/src/key_object.rs
@@ -0,0 +1,25 @@
+mod imp;
+
+use adw::subclass::prelude::*;
+use gtk::glib::{self, Object};
+
+glib::wrapper! {
+    pub struct KeyObject(ObjectSubclass<imp::KeyObject>);
+}
+
+impl KeyObject {
+    pub fn new(desc: String, fp: String) -> Self {
+        Object::builder()
+            .property("description", desc)
+            .property("fingerprint", fp)
+            .build()
+    }
+
+    pub fn get_description(&self) -> String {
+        self.imp().description.borrow().clone()
+    }
+
+    pub fn get_fingerprint(&self) -> String {
+        self.imp().fingerprint.borrow().clone()
+    }
+}
diff --git a/lan-mouse-gtk/src/key_object/imp.rs b/lan-mouse-gtk/src/key_object/imp.rs
new file mode 100644
index 00000000..e3b6ee45
--- /dev/null
+++ b/lan-mouse-gtk/src/key_object/imp.rs
@@ -0,0 +1,24 @@
+use std::cell::RefCell;
+
+use glib::Properties;
+use gtk::glib;
+use gtk::prelude::*;
+use gtk::subclass::prelude::*;
+
+#[derive(Properties, Default)]
+#[properties(wrapper_type = super::KeyObject)]
+pub struct KeyObject {
+    #[property(name = "description", get, set, type = String)]
+    pub description: RefCell<String>,
+    #[property(name = "fingerprint", get, set, type = String)]
+    pub fingerprint: RefCell<String>,
+}
+
+#[glib::object_subclass]
+impl ObjectSubclass for KeyObject {
+    const NAME: &'static str = "KeyObject";
+    type Type = super::KeyObject;
+}
+
+#[glib::derived_properties]
+impl ObjectImpl for KeyObject {}
diff --git a/lan-mouse-gtk/src/key_row.rs b/lan-mouse-gtk/src/key_row.rs
new file mode 100644
index 00000000..bb8b8861
--- /dev/null
+++ b/lan-mouse-gtk/src/key_row.rs
@@ -0,0 +1,48 @@
+mod imp;
+
+use adw::prelude::*;
+use adw::subclass::prelude::*;
+use gtk::glib::{self, Object};
+
+use super::KeyObject;
+
+glib::wrapper! {
+    pub struct KeyRow(ObjectSubclass<imp::KeyRow>)
+    @extends gtk::ListBoxRow, gtk::Widget, adw::PreferencesRow, adw::ExpanderRow,
+    @implements gtk::Accessible, gtk::Actionable, gtk::Buildable, gtk::ConstraintTarget;
+}
+
+impl Default for KeyRow {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl KeyRow {
+    pub fn new() -> Self {
+        Object::builder().build()
+    }
+
+    pub fn bind(&self, key_object: &KeyObject) {
+        let mut bindings = self.imp().bindings.borrow_mut();
+
+        let title_binding = key_object
+            .bind_property("description", self, "title")
+            .sync_create()
+            .build();
+
+        let subtitle_binding = key_object
+            .bind_property("fingerprint", self, "subtitle")
+            .sync_create()
+            .build();
+
+        bindings.push(title_binding);
+        bindings.push(subtitle_binding);
+    }
+
+    pub fn unbind(&self) {
+        for binding in self.imp().bindings.borrow_mut().drain(..) {
+            binding.unbind();
+        }
+    }
+}
diff --git a/lan-mouse-gtk/src/key_row/imp.rs b/lan-mouse-gtk/src/key_row/imp.rs
new file mode 100644
index 00000000..df248f89
--- /dev/null
+++ b/lan-mouse-gtk/src/key_row/imp.rs
@@ -0,0 +1,68 @@
+use std::cell::RefCell;
+
+use adw::subclass::prelude::*;
+use adw::{prelude::*, ActionRow};
+use glib::{subclass::InitializingObject, Binding};
+use gtk::glib::clone;
+use gtk::glib::subclass::Signal;
+use gtk::{glib, Button, CompositeTemplate};
+use std::sync::OnceLock;
+
+#[derive(CompositeTemplate, Default)]
+#[template(resource = "/de/feschber/LanMouse/key_row.ui")]
+pub struct KeyRow {
+    #[template_child]
+    pub delete_button: TemplateChild<gtk::Button>,
+    pub bindings: RefCell<Vec<Binding>>,
+}
+
+#[glib::object_subclass]
+impl ObjectSubclass for KeyRow {
+    // `NAME` needs to match `class` attribute of template
+    const NAME: &'static str = "KeyRow";
+    const ABSTRACT: bool = false;
+
+    type Type = super::KeyRow;
+    type ParentType = ActionRow;
+
+    fn class_init(klass: &mut Self::Class) {
+        klass.bind_template();
+        klass.bind_template_callbacks();
+    }
+
+    fn instance_init(obj: &InitializingObject<Self>) {
+        obj.init_template();
+    }
+}
+
+impl ObjectImpl for KeyRow {
+    fn constructed(&self) {
+        self.parent_constructed();
+        self.delete_button.connect_clicked(clone!(
+            #[weak(rename_to = row)]
+            self,
+            move |button| {
+                row.handle_delete(button);
+            }
+        ));
+    }
+
+    fn signals() -> &'static [glib::subclass::Signal] {
+        static SIGNALS: OnceLock<Vec<Signal>> = OnceLock::new();
+        SIGNALS.get_or_init(|| vec![Signal::builder("request-delete").build()])
+    }
+}
+
+#[gtk::template_callbacks]
+impl KeyRow {
+    #[template_callback]
+    fn handle_delete(&self, _button: &Button) {
+        self.obj().emit_by_name::<()>("request-delete", &[]);
+    }
+}
+
+impl WidgetImpl for KeyRow {}
+impl BoxImpl for KeyRow {}
+impl ListBoxRowImpl for KeyRow {}
+impl PreferencesRowImpl for KeyRow {}
+impl ActionRowImpl for KeyRow {}
diff --git a/lan-mouse-gtk/src/lib.rs b/lan-mouse-gtk/src/lib.rs
index c2ec5811..005b55dc 100644
--- a/lan-mouse-gtk/src/lib.rs
+++ b/lan-mouse-gtk/src/lib.rs
@@ -1,5 +1,8 @@
 mod client_object;
 mod client_row;
+mod fingerprint_window;
+mod key_object;
+mod key_row;
 mod window;
 
 use std::{env, process, str};
@@ -15,6 +18,7 @@ use gtk::{
 use gtk::{gio, glib, prelude::ApplicationExt};
 
 use self::client_object::ClientObject;
+use self::key_object::KeyObject;
 
 pub fn run() -> glib::ExitCode {
     log::debug!("running gtk frontend");
@@ -132,6 +136,14 @@ fn build_ui(app: &Application) {
                     FrontendEvent::EmulationStatus(s) => {
                         window.set_emulation(s.into());
                     }
+                    FrontendEvent::AuthorizedUpdated(keys) => {
+                        window.set_authorized_keys(keys);
+                    }
+                    FrontendEvent::PublicKeyFingerprint(fp) => {
+                        window.set_pk_fp(&fp);
+                    }
+                    FrontendEvent::IncomingConnected(..) => {}
+                    FrontendEvent::IncomingDisconnected(..) => {}
                 }
             }
         }
diff --git a/lan-mouse-gtk/src/window.rs b/lan-mouse-gtk/src/window.rs
index 269a46df..8be703a7 100644
--- a/lan-mouse-gtk/src/window.rs
+++ b/lan-mouse-gtk/src/window.rs
@@ -1,5 +1,7 @@
 mod imp;
 
+use std::collections::HashMap;
+
 use adw::prelude::*;
 use adw::subclass::prelude::*;
 use glib::{clone, Object};
@@ -14,6 +16,8 @@ use lan_mouse_ipc::{
     DEFAULT_PORT,
 };
 
+use crate::{fingerprint_window::FingerprintWindow, key_object::KeyObject, key_row::KeyRow};
+
 use super::{client_object::ClientObject, client_row::ClientRow};
 
 glib::wrapper! {
@@ -42,10 +46,55 @@ impl Window {
             .expect("Could not get clients")
     }
 
+    pub fn authorized(&self) -> gio::ListStore {
+        self.imp()
+            .authorized
+            .borrow()
+            .clone()
+            .expect("Could not get authorized")
+    }
+
     fn client_by_idx(&self, idx: u32) -> Option<ClientObject> {
         self.clients().item(idx).map(|o| o.downcast().unwrap())
     }
 
+    fn authorized_by_idx(&self, idx: u32) -> Option<KeyObject> {
+        self.authorized().item(idx).map(|o| o.downcast().unwrap())
+    }
+
+    fn setup_authorized(&self) {
+        let store = gio::ListStore::new::<KeyObject>();
+        self.imp().authorized.replace(Some(store));
+        let selection_model = NoSelection::new(Some(self.authorized()));
+        self.imp().authorized_list.bind_model(
+            Some(&selection_model),
+            clone!(
+                #[weak(rename_to = window)]
+                self,
+                #[upgrade_or_panic]
+                move |obj| {
+                    let key_obj = obj.downcast_ref().expect("object of type `KeyObject`");
+                    let row = window.create_key_row(key_obj);
+                    row.connect_closure(
+                        "request-delete",
+                        false,
+                        closure_local!(
+                            #[strong]
+                            window,
+                            move |row: KeyRow| {
+                                if let Some(key_obj) = window.authorized_by_idx(row.index() as u32)
+                                {
+                                    window.request_fingerprint_remove(key_obj.get_fingerprint());
+                                }
+                            }
+                        ),
+                    );
+                    row.upcast()
+                }
+            ),
+        )
+    }
+
     fn setup_clients(&self) {
         let model = gio::ListStore::new::<ClientObject>();
         self.imp().clients.replace(Some(model));
@@ -114,7 +163,8 @@ impl Window {
     /// workaround for a bug in libadwaita that shows an ugly line beneath
     /// the last element if a placeholder is set.
     /// https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/6308
-    pub fn set_placeholder_visible(&self, visible: bool) {
+    pub fn update_placeholder_visibility(&self) {
+        let visible = self.clients().n_items() == 0;
         let placeholder = self.imp().client_placeholder.get();
         self.imp().client_list.set_placeholder(match visible {
             true => Some(&placeholder),
@@ -122,6 +172,15 @@ impl Window {
         });
     }
 
+    pub fn update_auth_placeholder_visibility(&self) {
+        let visible = self.authorized().n_items() == 0;
+        let placeholder = self.imp().authorized_placeholder.get();
+        self.imp().authorized_list.set_placeholder(match visible {
+            true => Some(&placeholder),
+            false => None,
+        });
+    }
+
     fn setup_icon(&self) {
         self.set_icon_name(Some("de.feschber.LanMouse"));
     }
@@ -132,10 +191,16 @@ impl Window {
         row
     }
 
+    fn create_key_row(&self, key_object: &KeyObject) -> KeyRow {
+        let row = KeyRow::new();
+        row.bind(key_object);
+        row
+    }
+
     pub fn new_client(&self, handle: ClientHandle, client: ClientConfig, state: ClientState) {
         let client = ClientObject::new(handle, client, state.clone());
         self.clients().append(&client);
-        self.set_placeholder_visible(false);
+        self.update_placeholder_visibility();
         self.update_dns_state(handle, !state.ips.is_empty());
     }
 
@@ -157,7 +222,7 @@ impl Window {
 
         self.clients().remove(idx as u32);
         if self.clients().n_items() == 0 {
-            self.set_placeholder_visible(true);
+            self.update_placeholder_visibility();
         }
     }
 
@@ -286,6 +351,32 @@ impl Window {
         self.request(FrontendRequest::Delete(client.handle()));
     }
 
+    pub fn open_fingerprint_dialog(&self) {
+        let window = FingerprintWindow::new();
+        window.set_transient_for(Some(self));
+        window.connect_closure(
+            "confirm-clicked",
+            false,
+            closure_local!(
+                #[strong(rename_to = parent)]
+                self,
+                move |w: FingerprintWindow, desc: String, fp: String| {
+                    parent.request_fingerprint_add(desc, fp);
+                    w.close();
+                }
+            ),
+        );
+        window.present();
+    }
+
+    pub fn request_fingerprint_add(&self, desc: String, fp: String) {
+        self.request(FrontendRequest::AuthorizeKey(desc, fp));
+    }
+
+    pub fn request_fingerprint_remove(&self, fp: String) {
+        self.request(FrontendRequest::RemoveAuthorizedKey(fp));
+    }
+
     pub fn request(&self, request: FrontendRequest) {
         let mut requester = self.imp().frontend_request_writer.borrow_mut();
         let requester = requester.as_mut().unwrap();
@@ -319,4 +410,20 @@ impl Window {
             .capture_emulation_group
             .set_visible(!capture || !emulation);
     }
+
+    pub(crate) fn set_authorized_keys(&self, fingerprints: HashMap<String, String>) {
+        let authorized = self.authorized();
+        // clear list
+        authorized.remove_all();
+        // insert fingerprints
+        for (fingerprint, description) in fingerprints {
+            let key_obj = KeyObject::new(description, fingerprint);
+            authorized.append(&key_obj);
+        }
+        self.update_auth_placeholder_visibility();
+    }
+
+    pub(crate) fn set_pk_fp(&self, fingerprint: &str) {
+        self.imp().fingerprint_row.set_subtitle(fingerprint);
+    }
 }
diff --git a/lan-mouse-gtk/src/window/imp.rs b/lan-mouse-gtk/src/window/imp.rs
index b038242a..a0b40f65 100644
--- a/lan-mouse-gtk/src/window/imp.rs
+++ b/lan-mouse-gtk/src/window/imp.rs
@@ -4,13 +4,17 @@ use adw::subclass::prelude::*;
 use adw::{prelude::*, ActionRow, PreferencesGroup, ToastOverlay};
 use glib::subclass::InitializingObject;
 use gtk::glib::clone;
-use gtk::{gdk, gio, glib, Button, CompositeTemplate, Entry, Label, ListBox};
+use gtk::{gdk, gio, glib, Button, CompositeTemplate, Entry, Image, Label, ListBox};
 
 use lan_mouse_ipc::{FrontendRequestWriter, DEFAULT_PORT};
 
 #[derive(CompositeTemplate, Default)]
 #[template(resource = "/de/feschber/LanMouse/window.ui")]
 pub struct Window {
+    #[template_child]
+    pub authorized_placeholder: TemplateChild<ActionRow>,
+    #[template_child]
+    pub fingerprint_row: TemplateChild<ActionRow>,
     #[template_child]
     pub port_edit_apply: TemplateChild<Button>,
     #[template_child]
@@ -22,6 +26,8 @@ pub struct Window {
     #[template_child]
     pub port_entry: TemplateChild<Entry>,
     #[template_child]
+    pub hostname_copy_icon: TemplateChild<Image>,
+    #[template_child]
     pub hostname_label: TemplateChild<Label>,
     #[template_child]
     pub toast_overlay: TemplateChild<ToastOverlay>,
@@ -35,7 +41,10 @@ pub struct Window {
     pub input_emulation_button: TemplateChild<Button>,
     #[template_child]
     pub input_capture_button: TemplateChild<Button>,
+    #[template_child]
+    pub authorized_list: TemplateChild<ListBox>,
     pub clients: RefCell<Option<gio::ListStore>>,
+    pub authorized: RefCell<Option<gio::ListStore>>,
     pub frontend_request_writer: RefCell<Option<FrontendRequestWriter>>,
     pub port: Cell<u16>,
     pub capture_active: Cell<bool>,
@@ -69,25 +78,45 @@ impl Window {
     }
 
     #[template_callback]
-    fn handle_copy_hostname(&self, button: &Button) {
+    fn handle_copy_hostname(&self, _: &Button) {
         if let Ok(hostname) = hostname::get() {
             let display = gdk::Display::default().unwrap();
             let clipboard = display.clipboard();
             clipboard.set_text(hostname.to_str().expect("hostname: invalid utf8"));
-            button.set_icon_name("emblem-ok-symbolic");
-            button.set_css_classes(&["success"]);
+            let icon = self.hostname_copy_icon.clone();
+            icon.set_icon_name(Some("emblem-ok-symbolic"));
+            icon.set_css_classes(&["success"]);
             glib::spawn_future_local(clone!(
                 #[weak]
-                button,
+                icon,
                 async move {
                     glib::timeout_future_seconds(1).await;
-                    button.set_icon_name("edit-copy-symbolic");
-                    button.set_css_classes(&[]);
+                    icon.set_icon_name(Some("edit-copy-symbolic"));
+                    icon.set_css_classes(&[]);
                 }
             ));
         }
     }
 
+    #[template_callback]
+    fn handle_copy_fingerprint(&self, button: &Button) {
+        let fingerprint: String = self.fingerprint_row.property("subtitle");
+        let display = gdk::Display::default().unwrap();
+        let clipboard = display.clipboard();
+        clipboard.set_text(&fingerprint);
+        button.set_icon_name("emblem-ok-symbolic");
+        button.set_css_classes(&["success"]);
+        glib::spawn_future_local(clone!(
+            #[weak]
+            button,
+            async move {
+                glib::timeout_future_seconds(1).await;
+                button.set_icon_name("edit-copy-symbolic");
+                button.set_css_classes(&[]);
+            }
+        ));
+    }
+
     #[template_callback]
     fn handle_port_changed(&self, _entry: &Entry) {
         self.port_edit_apply.set_visible(true);
@@ -118,6 +147,11 @@ impl Window {
         self.obj().request_capture();
     }
 
+    #[template_callback]
+    fn handle_add_cert_fingerprint(&self, _button: &Button) {
+        self.obj().open_fingerprint_dialog();
+    }
+
     pub fn set_port(&self, port: u16) {
         self.port.set(port);
         if port == DEFAULT_PORT {
@@ -141,6 +175,7 @@ impl ObjectImpl for Window {
         let obj = self.obj();
         obj.setup_icon();
         obj.setup_clients();
+        obj.setup_authorized();
     }
 }
 
diff --git a/lan-mouse-ipc/src/lib.rs b/lan-mouse-ipc/src/lib.rs
index 4b5a0dc3..7c2a51be 100644
--- a/lan-mouse-ipc/src/lib.rs
+++ b/lan-mouse-ipc/src/lib.rs
@@ -1,5 +1,5 @@
 use std::{
-    collections::HashSet,
+    collections::{HashMap, HashSet},
     env::VarError,
     fmt::Display,
     io,
@@ -33,7 +33,7 @@ pub enum ConnectionError {
 }
 
 #[derive(Debug, Error)]
-pub enum ListenerCreationError {
+pub enum IpcListenerCreationError {
     #[error("could not determine socket-path: `{0}`")]
     SocketPath(#[from] SocketPathError),
     #[error("service already running!")]
@@ -51,7 +51,7 @@ pub enum IpcError {
     #[error(transparent)]
     Connection(#[from] ConnectionError),
     #[error(transparent)]
-    Listen(#[from] ListenerCreationError),
+    Listen(#[from] IpcListenerCreationError),
 }
 
 pub const DEFAULT_PORT: u16 = 4242;
@@ -65,6 +65,17 @@ pub enum Position {
     Bottom,
 }
 
+impl Position {
+    pub fn opposite(&self) -> Self {
+        match self {
+            Position::Left => Position::Right,
+            Position::Right => Position::Left,
+            Position::Top => Position::Bottom,
+            Position::Bottom => Position::Top,
+        }
+    }
+}
+
 #[derive(Debug, Error)]
 #[error("not a valid position: {pos}")]
 pub struct PositionParseError {
@@ -150,7 +161,7 @@ pub struct ClientState {
     /// This should generally be the socket address where data
     /// was last received from.
     pub active_addr: Option<SocketAddr>,
-    /// tracks whether or not the client is responding to pings
+    /// tracks whether or not the client is available for emulation
     pub alive: bool,
     /// ips from dns
     pub dns_ips: Vec<IpAddr>,
@@ -186,6 +197,14 @@ pub enum FrontendEvent {
     CaptureStatus(Status),
     /// emulation status
     EmulationStatus(Status),
+    /// authorized public key fingerprints have been updated
+    AuthorizedUpdated(HashMap<String, String>),
+    /// public key fingerprint of this device
+    PublicKeyFingerprint(String),
+    /// incoming connected
+    IncomingConnected(String, SocketAddr, Position),
+    /// incoming disconnected
+    IncomingDisconnected(SocketAddr),
 }
 
 #[derive(Debug, Eq, PartialEq, Clone, Serialize, Deserialize)]
@@ -218,9 +237,13 @@ pub enum FrontendRequest {
     EnableEmulation,
     /// synchronize all state
     Sync,
+    /// authorize fingerprint (description, fingerprint)
+    AuthorizeKey(String, String),
+    /// remove fingerprint (fingerprint)
+    RemoveAuthorizedKey(String),
 }
 
-#[derive(Clone, Copy, Debug, Default, Serialize, Deserialize)]
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Default, Serialize, Deserialize)]
 pub enum Status {
     #[default]
     Disabled,
diff --git a/lan-mouse-ipc/src/listen.rs b/lan-mouse-ipc/src/listen.rs
index c051c476..7c9d2a08 100644
--- a/lan-mouse-ipc/src/listen.rs
+++ b/lan-mouse-ipc/src/listen.rs
@@ -20,7 +20,7 @@ use tokio::net::TcpListener;
 #[cfg(windows)]
 use tokio::net::TcpStream;
 
-use crate::{FrontendEvent, FrontendRequest, IpcError, ListenerCreationError};
+use crate::{FrontendEvent, FrontendRequest, IpcError, IpcListenerCreationError};
 
 pub struct AsyncFrontendListener {
     #[cfg(windows)]
@@ -40,7 +40,7 @@ pub struct AsyncFrontendListener {
 }
 
 impl AsyncFrontendListener {
-    pub async fn new() -> Result<Self, ListenerCreationError> {
+    pub async fn new() -> Result<Self, IpcListenerCreationError> {
         #[cfg(unix)]
         let (socket_path, listener) = {
             let socket_path = crate::default_socket_path()?;
@@ -51,7 +51,7 @@ impl AsyncFrontendListener {
                 // of lan-mouse is already running
                 match UnixStream::connect(&socket_path).await {
                     // connected -> lan-mouse is already running
-                    Ok(_) => return Err(ListenerCreationError::AlreadyRunning),
+                    Ok(_) => return Err(IpcListenerCreationError::AlreadyRunning),
                     // lan-mouse is not running but a socket was left behind
                     Err(e) => {
                         log::debug!("{socket_path:?}: {e} - removing left behind socket");
@@ -63,9 +63,9 @@ impl AsyncFrontendListener {
                 Ok(ls) => ls,
                 // some other lan-mouse instance has bound the socket in the meantime
                 Err(e) if e.kind() == ErrorKind::AddrInUse => {
-                    return Err(ListenerCreationError::AlreadyRunning)
+                    return Err(IpcListenerCreationError::AlreadyRunning)
                 }
-                Err(e) => return Err(ListenerCreationError::Bind(e)),
+                Err(e) => return Err(IpcListenerCreationError::Bind(e)),
             };
             (socket_path, listener)
         };
@@ -75,9 +75,9 @@ impl AsyncFrontendListener {
             Ok(ls) => ls,
             // some other lan-mouse instance has bound the socket in the meantime
             Err(e) if e.kind() == ErrorKind::AddrInUse => {
-                return Err(ListenerCreationError::AlreadyRunning)
+                return Err(IpcListenerCreationError::AlreadyRunning)
             }
-            Err(e) => return Err(ListenerCreationError::Bind(e)),
+            Err(e) => return Err(IpcListenerCreationError::Bind(e)),
         };
 
         let adapter = Self {
diff --git a/lan-mouse-proto/src/lib.rs b/lan-mouse-proto/src/lib.rs
index d4aa5bff..41f2efbf 100644
--- a/lan-mouse-proto/src/lib.rs
+++ b/lan-mouse-proto/src/lib.rs
@@ -2,7 +2,7 @@ use input_event::{Event as InputEvent, KeyboardEvent, PointerEvent};
 use num_enum::{IntoPrimitive, TryFromPrimitive, TryFromPrimitiveError};
 use paste::paste;
 use std::{
-    fmt::{Debug, Display},
+    fmt::{Debug, Display, Formatter},
     mem::size_of,
 };
 use thiserror::Error;
@@ -18,14 +18,39 @@ pub enum ProtocolError {
     /// event type does not exist
     #[error("invalid event id: `{0}`")]
     InvalidEventId(#[from] TryFromPrimitiveError<EventType>),
+    /// position type does not exist
+    #[error("invalid event id: `{0}`")]
+    InvalidPosition(#[from] TryFromPrimitiveError<Position>),
+}
+
+/// Position of a client
+#[derive(Clone, Copy, Debug, TryFromPrimitive, IntoPrimitive)]
+#[repr(u8)]
+pub enum Position {
+    Left,
+    Right,
+    Top,
+    Bottom,
+}
+
+impl Display for Position {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        let pos = match self {
+            Position::Left => "left",
+            Position::Right => "right",
+            Position::Top => "top",
+            Position::Bottom => "bottom",
+        };
+        write!(f, "{pos}")
+    }
 }
 
 /// main lan-mouse protocol event type
 #[derive(Clone, Copy, Debug)]
 pub enum ProtoEvent {
-    /// notify a client that the cursor entered its region
+    /// notify a client that the cursor entered its region at the given position
     /// [`ProtoEvent::Ack`] with the same serial is used for synchronization between devices
-    Enter(u32),
+    Enter(Position),
     /// notify a client that the cursor left its region
     /// [`ProtoEvent::Ack`] with the same serial is used for synchronization between devices
     Leave(u32),
@@ -36,19 +61,25 @@ pub enum ProtoEvent {
     /// Ping event for tracking unresponsive clients.
     /// A client has to respond with [`ProtoEvent::Pong`].
     Ping,
-    /// Response to [`ProtoEvent::Ping`]
-    Pong,
+    /// Response to [`ProtoEvent::Ping`], true if emulation is enabled / available
+    Pong(bool),
 }
 
 impl Display for ProtoEvent {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         match self {
             ProtoEvent::Enter(s) => write!(f, "Enter({s})"),
             ProtoEvent::Leave(s) => write!(f, "Leave({s})"),
             ProtoEvent::Ack(s) => write!(f, "Ack({s})"),
             ProtoEvent::Input(e) => write!(f, "{e}"),
             ProtoEvent::Ping => write!(f, "ping"),
-            ProtoEvent::Pong => write!(f, "pong"),
+            ProtoEvent::Pong(alive) => {
+                write!(
+                    f,
+                    "pong: {}",
+                    if *alive { "alive" } else { "not available" }
+                )
+            }
         }
     }
 }
@@ -85,7 +116,7 @@ impl ProtoEvent {
                 },
             },
             ProtoEvent::Ping => EventType::Ping,
-            ProtoEvent::Pong => EventType::Pong,
+            ProtoEvent::Pong(_) => EventType::Pong,
             ProtoEvent::Enter(_) => EventType::Enter,
             ProtoEvent::Leave(_) => EventType::Leave,
             ProtoEvent::Ack(_) => EventType::Ack,
@@ -139,8 +170,8 @@ impl TryFrom<[u8; MAX_EVENT_SIZE]> for ProtoEvent {
                 },
             ))),
             EventType::Ping => Ok(Self::Ping),
-            EventType::Pong => Ok(Self::Pong),
-            EventType::Enter => Ok(Self::Enter(decode_u32(&mut buf)?)),
+            EventType::Pong => Ok(Self::Pong(decode_u8(&mut buf)? != 0)),
+            EventType::Enter => Ok(Self::Enter(decode_u8(&mut buf)?.try_into()?)),
             EventType::Leave => Ok(Self::Leave(decode_u32(&mut buf)?)),
             EventType::Ack => Ok(Self::Ack(decode_u32(&mut buf)?)),
         }
@@ -203,8 +234,8 @@ impl From<ProtoEvent> for ([u8; MAX_EVENT_SIZE], usize) {
                     },
                 },
                 ProtoEvent::Ping => {}
-                ProtoEvent::Pong => {}
-                ProtoEvent::Enter(serial) => encode_u32(buf, len, serial),
+                ProtoEvent::Pong(alive) => encode_u8(buf, len, alive as u8),
+                ProtoEvent::Enter(pos) => encode_u8(buf, len, pos as u8),
                 ProtoEvent::Leave(serial) => encode_u32(buf, len, serial),
                 ProtoEvent::Ack(serial) => encode_u32(buf, len, serial),
             }
diff --git a/src/capture.rs b/src/capture.rs
new file mode 100644
index 00000000..f2c95b13
--- /dev/null
+++ b/src/capture.rs
@@ -0,0 +1,418 @@
+use std::{
+    cell::{Cell, RefCell},
+    rc::Rc,
+    time::{Duration, Instant},
+};
+
+use futures::StreamExt;
+use input_capture::{
+    CaptureError, CaptureEvent, CaptureHandle, InputCapture, InputCaptureError, Position,
+};
+use input_event::scancode;
+use lan_mouse_proto::ProtoEvent;
+use local_channel::mpsc::{channel, Receiver, Sender};
+use tokio::task::{spawn_local, JoinHandle};
+use tokio_util::sync::CancellationToken;
+
+use crate::connect::LanMouseConnection;
+
+pub(crate) struct Capture {
+    cancellation_token: CancellationToken,
+    request_tx: Sender<CaptureRequest>,
+    task: JoinHandle<()>,
+    event_rx: Receiver<ICaptureEvent>,
+}
+
+pub(crate) enum ICaptureEvent {
+    /// a client was entered
+    CaptureBegin(CaptureHandle),
+    /// capture disabled
+    CaptureDisabled,
+    /// capture disabled
+    CaptureEnabled,
+    /// A (new) client was entered.
+    /// In contrast to [`ICaptureEvent::CaptureBegin`] this
+    /// event is only triggered when the capture was
+    /// explicitly released in the meantime by
+    /// either the remote client leaving its device region,
+    /// a new device entering the screen or the release bind.
+    ClientEntered(u64),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum CaptureType {
+    /// a normal input capture
+    Default,
+    /// A capture only interested in [`CaptureEvent::Begin`] events.
+    /// The capture is released immediately, if there is no
+    /// Default capture at the same position.
+    EnterOnly,
+}
+
+#[derive(Clone, Copy, Debug)]
+enum CaptureRequest {
+    /// capture must release the mouse
+    Release,
+    /// add a capture client
+    Create(CaptureHandle, Position, CaptureType),
+    /// destory a capture client
+    Destroy(CaptureHandle),
+    /// reenable input capture
+    Reenable,
+}
+
+impl Capture {
+    pub(crate) fn new(
+        backend: Option<input_capture::Backend>,
+        conn: LanMouseConnection,
+        release_bind: Vec<scancode::Linux>,
+    ) -> Self {
+        let (request_tx, request_rx) = channel();
+        let (event_tx, event_rx) = channel();
+        let cancellation_token = CancellationToken::new();
+        let capture_task = CaptureTask {
+            active_client: None,
+            backend,
+            cancellation_token: cancellation_token.clone(),
+            captures: Default::default(),
+            conn,
+            event_tx,
+            request_rx,
+            release_bind: Rc::new(RefCell::new(release_bind)),
+            state: Default::default(),
+        };
+        let task = spawn_local(capture_task.run());
+        Self {
+            cancellation_token,
+            request_tx,
+            task,
+            event_rx,
+        }
+    }
+
+    pub(crate) fn reenable(&self) {
+        self.request_tx
+            .send(CaptureRequest::Reenable)
+            .expect("channel closed");
+    }
+
+    pub(crate) async fn terminate(&mut self) {
+        self.cancellation_token.cancel();
+        log::debug!("terminating capture");
+        if let Err(e) = (&mut self.task).await {
+            log::warn!("{e}");
+        }
+    }
+
+    pub(crate) fn create(
+        &self,
+        handle: CaptureHandle,
+        pos: lan_mouse_ipc::Position,
+        capture_type: CaptureType,
+    ) {
+        let pos = to_capture_pos(pos);
+        self.request_tx
+            .send(CaptureRequest::Create(handle, pos, capture_type))
+            .expect("channel closed");
+    }
+
+    pub(crate) fn destroy(&self, handle: CaptureHandle) {
+        self.request_tx
+            .send(CaptureRequest::Destroy(handle))
+            .expect("channel closed");
+    }
+
+    pub(crate) fn release(&self) {
+        self.request_tx
+            .send(CaptureRequest::Release)
+            .expect("channel closed");
+    }
+
+    pub(crate) async fn event(&mut self) -> ICaptureEvent {
+        self.event_rx.recv().await.expect("channel closed")
+    }
+}
+
+/// debounce a statement `$st`, i.e. the statement is executed only if the
+/// time since the previous execution is at least `$dur`.
+/// `$prev` is used to keep track of this timestamp
+macro_rules! debounce {
+    ($prev:ident, $dur:expr, $st:stmt) => {
+        let exec = match $prev.get() {
+            None => true,
+            Some(instant) if instant.elapsed() > $dur => true,
+            _ => false,
+        };
+        if exec {
+            $prev.replace(Some(Instant::now()));
+            $st
+        }
+    };
+}
+
+struct CaptureTask {
+    active_client: Option<CaptureHandle>,
+    backend: Option<input_capture::Backend>,
+    cancellation_token: CancellationToken,
+    captures: Vec<(CaptureHandle, Position, CaptureType)>,
+    conn: LanMouseConnection,
+    event_tx: Sender<ICaptureEvent>,
+    release_bind: Rc<RefCell<Vec<scancode::Linux>>>,
+    request_rx: Receiver<CaptureRequest>,
+    state: State,
+}
+
+impl CaptureTask {
+    fn add_capture(&mut self, handle: CaptureHandle, pos: Position, capture_type: CaptureType) {
+        self.captures.push((handle, pos, capture_type));
+    }
+
+    fn remove_capture(&mut self, handle: CaptureHandle) {
+        self.captures.retain(|&(h, ..)| handle != h);
+    }
+
+    fn is_default_capture_at(&self, pos: Position) -> bool {
+        self.captures
+            .iter()
+            .any(|&(_, p, t)| p == pos && t == CaptureType::Default)
+    }
+
+    fn get_pos(&self, handle: CaptureHandle) -> Position {
+        self.captures
+            .iter()
+            .find(|(h, ..)| *h == handle)
+            .expect("no such capture")
+            .1
+    }
+
+    fn get_type(&self, handle: CaptureHandle) -> CaptureType {
+        self.captures
+            .iter()
+            .find(|(h, ..)| *h == handle)
+            .expect("no such capture")
+            .2
+    }
+
+    async fn run(mut self) {
+        loop {
+            if let Err(e) = self.do_capture().await {
+                log::warn!("input capture exited: {e}");
+            }
+            loop {
+                tokio::select! {
+                    r = self.request_rx.recv() => match r.expect("channel closed") {
+                        CaptureRequest::Reenable => break,
+                        CaptureRequest::Create(h, p, t) => self.add_capture(h, p, t),
+                        CaptureRequest::Destroy(h) => self.remove_capture(h),
+                        CaptureRequest::Release => { /* nothing to do */ }
+                    },
+                    _ = self.cancellation_token.cancelled() => return,
+                }
+            }
+        }
+    }
+
+    async fn do_capture(&mut self) -> Result<(), InputCaptureError> {
+        /* allow cancelling capture request */
+        let mut capture = tokio::select! {
+            r = InputCapture::new(self.backend) => r?,
+            _ = self.cancellation_token.cancelled() => return Ok(()),
+        };
+
+        let _capture_guard = DropGuard::new(
+            self.event_tx.clone(),
+            ICaptureEvent::CaptureEnabled,
+            ICaptureEvent::CaptureDisabled,
+        );
+
+        /* create barriers for active clients */
+        let r = self.create_captures(&mut capture).await;
+        if let Err(e) = r {
+            capture.terminate().await?;
+            return Err(e.into());
+        }
+
+        let r = self.do_capture_session(&mut capture).await;
+
+        // FIXME replace with async drop when stabilized
+        capture.terminate().await?;
+
+        r
+    }
+
+    async fn create_captures(&mut self, capture: &mut InputCapture) -> Result<(), CaptureError> {
+        let captures = self.captures.clone();
+        for (handle, pos, _type) in captures {
+            tokio::select! {
+                r = capture.create(handle, pos) => r?,
+                _ = self.cancellation_token.cancelled() => return Ok(()),
+            }
+        }
+        Ok(())
+    }
+
+    async fn do_capture_session(
+        &mut self,
+        capture: &mut InputCapture,
+    ) -> Result<(), InputCaptureError> {
+        loop {
+            tokio::select! {
+                event = capture.next() => match event {
+                    Some(event) => self.handle_capture_event(capture, event?).await?,
+                    None => return Ok(()),
+                },
+                (handle, event) = self.conn.recv() => {
+                    if let Some(active) = self.active_client {
+                        if handle != active {
+                            // we only care about events coming from the client we are currently connected to
+                            // only `Ack` and `Leave` are relevant
+                            continue
+                        }
+                    }
+
+                    match event {
+                        // connection acknowlegded => set state to Sending
+                        ProtoEvent::Ack(_) => {
+                            log::info!("client {handle} acknowledged the connection!");
+                            self.state = State::Sending;
+                        }
+                        // client disconnected
+                        ProtoEvent::Leave(_) => {
+                            log::info!("releasing capture: left remote client device region");
+                            self.release_capture(capture).await?;
+                        },
+                        _ => {}
+                    }
+                },
+                e = self.request_rx.recv() => match e.expect("channel closed") {
+                    CaptureRequest::Reenable => { /* already active */ },
+                    CaptureRequest::Release => self.release_capture(capture).await?,
+                    CaptureRequest::Create(h, p, t) => {
+                        self.add_capture(h, p, t);
+                        capture.create(h, p).await?;
+                    }
+                    CaptureRequest::Destroy(h) => {
+                        self.remove_capture(h);
+                        capture.destroy(h).await?;
+                    }
+                },
+                _ = self.cancellation_token.cancelled() => break,
+            }
+        }
+        Ok(())
+    }
+
+    async fn handle_capture_event(
+        &mut self,
+        capture: &mut InputCapture,
+        event: (CaptureHandle, CaptureEvent),
+    ) -> Result<(), CaptureError> {
+        let (handle, event) = event;
+        log::trace!("({handle}): {event:?}");
+
+        if capture.keys_pressed(&self.release_bind.borrow()) {
+            log::info!("releasing capture: release-bind pressed");
+            return self.release_capture(capture).await;
+        }
+
+        if event == CaptureEvent::Begin {
+            self.event_tx
+                .send(ICaptureEvent::CaptureBegin(handle))
+                .expect("channel closed");
+        }
+
+        // enter only capture (for incoming connections)
+        if self.get_type(handle) == CaptureType::EnterOnly {
+            // if there is no active outgoing connection at the current capture,
+            // we release the capture
+            if !self.is_default_capture_at(self.get_pos(handle)) {
+                log::info!("releasing capture: no active client at this position");
+                capture.release().await?;
+            }
+            // we dont care about events from incoming handles except for releasing the capture
+            return Ok(());
+        }
+
+        // activated a new client
+        if event == CaptureEvent::Begin && Some(handle) != self.active_client {
+            self.state = State::WaitingForAck;
+            self.active_client.replace(handle);
+            self.event_tx
+                .send(ICaptureEvent::ClientEntered(handle))
+                .expect("channel closed");
+        }
+
+        let opposite_pos = to_proto_pos(self.get_pos(handle).opposite());
+
+        let event = match event {
+            CaptureEvent::Begin => ProtoEvent::Enter(opposite_pos),
+            CaptureEvent::Input(e) => match self.state {
+                // connection not acknowledged, repeat `Enter` event
+                State::WaitingForAck => ProtoEvent::Enter(opposite_pos),
+                State::Sending => ProtoEvent::Input(e),
+            },
+        };
+
+        if let Err(e) = self.conn.send(event, handle).await {
+            const DUR: Duration = Duration::from_millis(500);
+            debounce!(PREV_LOG, DUR, log::warn!("releasing capture: {e}"));
+            capture.release().await?;
+        }
+        Ok(())
+    }
+
+    async fn release_capture(&mut self, capture: &mut InputCapture) -> Result<(), CaptureError> {
+        self.active_client.take();
+        capture.release().await
+    }
+}
+
+thread_local! {
+    static PREV_LOG: Cell<Option<Instant>> = const { Cell::new(None) };
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+enum State {
+    #[default]
+    WaitingForAck,
+    Sending,
+}
+
+fn to_capture_pos(pos: lan_mouse_ipc::Position) -> input_capture::Position {
+    match pos {
+        lan_mouse_ipc::Position::Left => input_capture::Position::Left,
+        lan_mouse_ipc::Position::Right => input_capture::Position::Right,
+        lan_mouse_ipc::Position::Top => input_capture::Position::Top,
+        lan_mouse_ipc::Position::Bottom => input_capture::Position::Bottom,
+    }
+}
+
+fn to_proto_pos(pos: input_capture::Position) -> lan_mouse_proto::Position {
+    match pos {
+        input_capture::Position::Left => lan_mouse_proto::Position::Left,
+        input_capture::Position::Right => lan_mouse_proto::Position::Right,
+        input_capture::Position::Top => lan_mouse_proto::Position::Top,
+        input_capture::Position::Bottom => lan_mouse_proto::Position::Bottom,
+    }
+}
+
+struct DropGuard<T> {
+    tx: Sender<T>,
+    on_drop: Option<T>,
+}
+
+impl<T> DropGuard<T> {
+    fn new(tx: Sender<T>, on_new: T, on_drop: T) -> Self {
+        tx.send(on_new).expect("channel closed");
+        let on_drop = Some(on_drop);
+        Self { tx, on_drop }
+    }
+}
+
+impl<T> Drop for DropGuard<T> {
+    fn drop(&mut self) {
+        self.tx
+            .send(self.on_drop.take().expect("item"))
+            .expect("channel closed");
+    }
+}
diff --git a/src/client.rs b/src/client.rs
index 79ebd002..0b363843 100644
--- a/src/client.rs
+++ b/src/client.rs
@@ -1,18 +1,63 @@
-use std::net::SocketAddr;
+use std::{
+    cell::RefCell,
+    collections::HashSet,
+    net::{IpAddr, SocketAddr},
+    rc::Rc,
+};
 
 use slab::Slab;
 
 use lan_mouse_ipc::{ClientConfig, ClientHandle, ClientState, Position};
 
-#[derive(Default)]
+#[derive(Clone, Default)]
 pub struct ClientManager {
-    clients: Slab<(ClientConfig, ClientState)>,
+    clients: Rc<RefCell<Slab<(ClientConfig, ClientState)>>>,
 }
 
 impl ClientManager {
     /// add a new client to this manager
-    pub fn add_client(&mut self) -> ClientHandle {
-        self.clients.insert(Default::default()) as ClientHandle
+    pub fn add_client(&self) -> ClientHandle {
+        self.clients.borrow_mut().insert(Default::default()) as ClientHandle
+    }
+
+    /// set the config of the given client
+    pub fn set_config(&self, handle: ClientHandle, config: ClientConfig) {
+        if let Some((c, _)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            *c = config;
+        }
+    }
+
+    /// set the state of the given client
+    pub fn set_state(&self, handle: ClientHandle, state: ClientState) {
+        if let Some((_, s)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            *s = state;
+        }
+    }
+
+    /// activate the given client
+    /// returns, whether the client was activated
+    pub fn activate_client(&self, handle: ClientHandle) -> bool {
+        let mut clients = self.clients.borrow_mut();
+        match clients.get_mut(handle as usize) {
+            Some((_, s)) if !s.active => {
+                s.active = true;
+                true
+            }
+            _ => false,
+        }
+    }
+
+    /// deactivate the given client
+    /// returns, whether the client was deactivated
+    pub fn deactivate_client(&self, handle: ClientHandle) -> bool {
+        let mut clients = self.clients.borrow_mut();
+        match clients.get_mut(handle as usize) {
+            Some((_, s)) if s.active => {
+                s.active = false;
+                true
+            }
+            _ => false,
+        }
     }
 
     /// find a client by its address
@@ -20,6 +65,7 @@ impl ClientManager {
         // since there shouldn't be more than a handful of clients at any given
         // time this is likely faster than using a HashMap
         self.clients
+            .borrow()
             .iter()
             .find_map(|(k, (_, s))| {
                 if s.active && s.ips.contains(&addr.ip()) {
@@ -31,8 +77,10 @@ impl ClientManager {
             .map(|p| p as ClientHandle)
     }
 
-    pub fn find_client(&self, pos: Position) -> Option<ClientHandle> {
+    /// get the client at the given position
+    pub fn client_at(&self, pos: Position) -> Option<ClientHandle> {
         self.clients
+            .borrow()
             .iter()
             .find_map(|(k, (c, s))| {
                 if s.active && c.pos == pos {
@@ -44,31 +92,176 @@ impl ClientManager {
             .map(|p| p as ClientHandle)
     }
 
+    pub(crate) fn get_hostname(&self, handle: ClientHandle) -> Option<String> {
+        self.clients
+            .borrow_mut()
+            .get_mut(handle as usize)
+            .and_then(|(c, _)| c.hostname.clone())
+    }
+
+    /// get the position of the corresponding client
+    pub(crate) fn get_pos(&self, handle: ClientHandle) -> Option<Position> {
+        self.clients
+            .borrow()
+            .get(handle as usize)
+            .map(|(c, _)| c.pos)
+    }
+
     /// remove a client from the list
-    pub fn remove_client(&mut self, client: ClientHandle) -> Option<(ClientConfig, ClientState)> {
+    pub fn remove_client(&self, client: ClientHandle) -> Option<(ClientConfig, ClientState)> {
         // remove id from occupied ids
-        self.clients.try_remove(client as usize)
+        self.clients.borrow_mut().try_remove(client as usize)
+    }
+
+    /// get the config & state of the given client
+    pub fn get_state(&self, handle: ClientHandle) -> Option<(ClientConfig, ClientState)> {
+        self.clients.borrow().get(handle as usize).cloned()
+    }
+
+    /// get the current config & state of all clients
+    pub fn get_client_states(&self) -> Vec<(ClientHandle, ClientConfig, ClientState)> {
+        self.clients
+            .borrow()
+            .iter()
+            .map(|(k, v)| (k as ClientHandle, v.0.clone(), v.1.clone()))
+            .collect()
+    }
+
+    /// update the fix ips of the client
+    pub fn set_fix_ips(&self, handle: ClientHandle, fix_ips: Vec<IpAddr>) {
+        if let Some((c, _)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            c.fix_ips = fix_ips
+        }
+        self.update_ips(handle);
+    }
+
+    /// update the dns-ips of the client
+    pub fn set_dns_ips(&self, handle: ClientHandle, dns_ips: Vec<IpAddr>) {
+        if let Some((_, s)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            s.dns_ips = dns_ips
+        }
+        self.update_ips(handle);
+    }
+
+    fn update_ips(&self, handle: ClientHandle) {
+        if let Some((c, s)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            s.ips = c
+                .fix_ips
+                .iter()
+                .cloned()
+                .chain(s.dns_ips.iter().cloned())
+                .collect::<HashSet<_>>();
+        }
+    }
+
+    /// update the hostname of the given client
+    /// this automatically clears the active ip address and ips from dns
+    pub fn set_hostname(&self, handle: ClientHandle, hostname: Option<String>) -> bool {
+        let mut clients = self.clients.borrow_mut();
+        let Some((c, s)) = clients.get_mut(handle as usize) else {
+            return false;
+        };
+
+        // hostname changed
+        if c.hostname != hostname {
+            c.hostname = hostname;
+            s.active_addr = None;
+            s.dns_ips.clear();
+            drop(clients);
+            self.update_ips(handle);
+            true
+        } else {
+            false
+        }
     }
 
-    // returns an immutable reference to the client state corresponding to `client`
-    pub fn get(&self, handle: ClientHandle) -> Option<&(ClientConfig, ClientState)> {
-        self.clients.get(handle as usize)
+    /// update the port of the client
+    pub(crate) fn set_port(&self, handle: ClientHandle, port: u16) {
+        match self.clients.borrow_mut().get_mut(handle as usize) {
+            Some((c, s)) if c.port != port => {
+                c.port = port;
+                s.active_addr = s.active_addr.map(|a| SocketAddr::new(a.ip(), port));
+            }
+            _ => {}
+        };
     }
 
-    /// returns a mutable reference to the client state corresponding to `client`
-    pub fn get_mut(&mut self, handle: ClientHandle) -> Option<&mut (ClientConfig, ClientState)> {
-        self.clients.get_mut(handle as usize)
+    /// update the position of the client
+    /// returns true, if a change in capture position is required (pos changed & client is active)
+    pub(crate) fn set_pos(&self, handle: ClientHandle, pos: Position) -> bool {
+        match self.clients.borrow_mut().get_mut(handle as usize) {
+            Some((c, s)) if c.pos != pos => {
+                log::info!("update pos {handle} {} -> {}", c.pos, pos);
+                c.pos = pos;
+                s.active
+            }
+            _ => false,
+        }
+    }
+
+    /// set resolving status of the client
+    pub(crate) fn set_resolving(&self, handle: ClientHandle, status: bool) {
+        if let Some((_, s)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            s.resolving = status;
+        }
+    }
+
+    /// get the enter hook command
+    pub(crate) fn get_enter_cmd(&self, handle: ClientHandle) -> Option<String> {
+        self.clients
+            .borrow()
+            .get(handle as usize)
+            .and_then(|(c, _)| c.cmd.clone())
+    }
+
+    /// returns all clients that are currently active
+    pub(crate) fn active_clients(&self) -> Vec<ClientHandle> {
+        self.clients
+            .borrow()
+            .iter()
+            .filter(|(_, (_, s))| s.active)
+            .map(|(h, _)| h as ClientHandle)
+            .collect()
     }
 
-    pub fn get_client_states(
-        &self,
-    ) -> impl Iterator<Item = (ClientHandle, &(ClientConfig, ClientState))> {
-        self.clients.iter().map(|(k, v)| (k as ClientHandle, v))
+    pub(crate) fn set_active_addr(&self, handle: ClientHandle, addr: Option<SocketAddr>) {
+        if let Some((_, s)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            s.active_addr = addr;
+        }
     }
 
-    pub fn get_client_states_mut(
-        &mut self,
-    ) -> impl Iterator<Item = (ClientHandle, &mut (ClientConfig, ClientState))> {
-        self.clients.iter_mut().map(|(k, v)| (k as ClientHandle, v))
+    pub(crate) fn set_alive(&self, handle: ClientHandle, alive: bool) {
+        if let Some((_, s)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            s.alive = alive;
+        }
+    }
+
+    pub(crate) fn active_addr(&self, handle: ClientHandle) -> Option<SocketAddr> {
+        self.clients
+            .borrow()
+            .get(handle as usize)
+            .and_then(|(_, s)| s.active_addr)
+    }
+
+    pub(crate) fn alive(&self, handle: ClientHandle) -> bool {
+        self.clients
+            .borrow()
+            .get(handle as usize)
+            .map(|(_, s)| s.alive)
+            .unwrap_or(false)
+    }
+
+    pub(crate) fn get_port(&self, handle: ClientHandle) -> Option<u16> {
+        self.clients
+            .borrow()
+            .get(handle as usize)
+            .map(|(c, _)| c.port)
+    }
+
+    pub(crate) fn get_ips(&self, handle: ClientHandle) -> Option<HashSet<IpAddr>> {
+        self.clients
+            .borrow()
+            .get(handle as usize)
+            .map(|(_, s)| s.ips.clone())
     }
 }
diff --git a/src/config.rs b/src/config.rs
index f672d467..493b813e 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,9 +1,11 @@
 use clap::{Parser, ValueEnum};
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
 use std::env::{self, VarError};
 use std::fmt::Display;
 use std::fs;
 use std::net::IpAddr;
+use std::path::{Path, PathBuf};
 use std::{collections::HashSet, io};
 use thiserror::Error;
 use toml;
@@ -22,10 +24,12 @@ pub struct ConfigToml {
     pub port: Option<u16>,
     pub frontend: Option<Frontend>,
     pub release_bind: Option<Vec<scancode::Linux>>,
+    pub cert_path: Option<PathBuf>,
     pub left: Option<TomlClient>,
     pub right: Option<TomlClient>,
     pub top: Option<TomlClient>,
     pub bottom: Option<TomlClient>,
+    pub authorized_fingerprints: Option<HashMap<String, String>>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Eq, PartialEq)]
@@ -40,9 +44,8 @@ pub struct TomlClient {
 }
 
 impl ConfigToml {
-    pub fn new(path: &str) -> Result<ConfigToml, ConfigError> {
+    pub fn new(path: &Path) -> Result<ConfigToml, ConfigError> {
         let config = fs::read_to_string(path)?;
-        log::info!("using config: \"{path}\"");
         Ok(toml::from_str::<_>(&config)?)
     }
 }
@@ -81,6 +84,10 @@ struct CliArgs {
     /// emulation backend override
     #[arg(long)]
     emulation_backend: Option<EmulationBackend>,
+
+    /// path to non-default certificate location
+    #[arg(long)]
+    cert_path: Option<PathBuf>,
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize, ValueEnum)]
@@ -224,15 +231,30 @@ impl Default for Frontend {
 
 #[derive(Debug)]
 pub struct Config {
+    /// the path to the configuration file used
+    pub path: PathBuf,
+    /// public key fingerprints authorized for connection
+    pub authorized_fingerprints: HashMap<String, String>,
+    /// optional input-capture backend override
     pub capture_backend: Option<CaptureBackend>,
+    /// optional input-emulation backend override
     pub emulation_backend: Option<EmulationBackend>,
+    /// the frontend to use
     pub frontend: Frontend,
+    /// the port to use (initially)
     pub port: u16,
+    /// list of clients
     pub clients: Vec<(TomlClient, Position)>,
+    /// whether or not to run as a daemon
     pub daemon: bool,
+    /// configured release bind
     pub release_bind: Vec<scancode::Linux>,
+    /// test capture instead of running the app
     pub test_capture: bool,
+    /// test emulation instead of running the app
     pub test_emulation: bool,
+    /// path to the tls certificate to use
+    pub cert_path: PathBuf,
 }
 
 pub struct ConfigClient {
@@ -260,27 +282,32 @@ const DEFAULT_RELEASE_KEYS: [scancode::Linux; 4] =
 impl Config {
     pub fn new() -> Result<Self, ConfigError> {
         let args = CliArgs::parse();
-        let config_file = "config.toml";
+        const CONFIG_FILE_NAME: &str = "config.toml";
+        const CERT_FILE_NAME: &str = "lan-mouse.pem";
+
         #[cfg(unix)]
         let config_path = {
             let xdg_config_home =
                 env::var("XDG_CONFIG_HOME").unwrap_or(format!("{}/.config", env::var("HOME")?));
-            format!("{xdg_config_home}/lan-mouse/{config_file}")
+            format!("{xdg_config_home}/lan-mouse/")
         };
 
         #[cfg(not(unix))]
         let config_path = {
             let app_data =
                 env::var("LOCALAPPDATA").unwrap_or(format!("{}/.config", env::var("USERPROFILE")?));
-            format!("{app_data}\\lan-mouse\\{config_file}")
+            format!("{app_data}\\lan-mouse\\")
         };
 
+        let config_path = PathBuf::from(config_path);
+        let config_file = config_path.join(CONFIG_FILE_NAME);
+
         // --config <file> overrules default location
-        let config_path = args.config.unwrap_or(config_path);
+        let config_file = args.config.map(PathBuf::from).unwrap_or(config_file);
 
-        let config_toml = match ConfigToml::new(config_path.as_str()) {
+        let mut config_toml = match ConfigToml::new(&config_file) {
             Err(e) => {
-                log::warn!("{config_path}: {e}");
+                log::warn!("{config_file:?}: {e}");
                 log::warn!("Continuing without config file ...");
                 None
             }
@@ -310,6 +337,16 @@ impl Config {
             .emulation_backend
             .or(config_toml.as_ref().and_then(|c| c.emulation_backend));
 
+        let cert_path = args
+            .cert_path
+            .or(config_toml.as_ref().and_then(|c| c.cert_path.clone()))
+            .unwrap_or(config_path.join(CERT_FILE_NAME));
+
+        let authorized_fingerprints = config_toml
+            .as_mut()
+            .and_then(|c| std::mem::take(&mut c.authorized_fingerprints))
+            .unwrap_or_default();
+
         let mut clients: Vec<(TomlClient, Position)> = vec![];
 
         if let Some(config_toml) = config_toml {
@@ -332,6 +369,8 @@ impl Config {
         let test_emulation = args.test_emulation;
 
         Ok(Config {
+            path: config_path,
+            authorized_fingerprints,
             capture_backend,
             emulation_backend,
             daemon,
@@ -341,6 +380,7 @@ impl Config {
             release_bind,
             test_capture,
             test_emulation,
+            cert_path,
         })
     }
 
diff --git a/src/connect.rs b/src/connect.rs
new file mode 100644
index 00000000..4fccc75a
--- /dev/null
+++ b/src/connect.rs
@@ -0,0 +1,281 @@
+use crate::client::ClientManager;
+use lan_mouse_ipc::{ClientHandle, DEFAULT_PORT};
+use lan_mouse_proto::{ProtoEvent, MAX_EVENT_SIZE};
+use local_channel::mpsc::{channel, Receiver, Sender};
+use std::{
+    cell::RefCell,
+    collections::{HashMap, HashSet},
+    io,
+    net::SocketAddr,
+    rc::Rc,
+    sync::Arc,
+    time::Duration,
+};
+use thiserror::Error;
+use tokio::{
+    net::UdpSocket,
+    sync::Mutex,
+    task::{spawn_local, JoinSet},
+};
+use webrtc_dtls::{
+    config::{Config, ExtendedMasterSecretType},
+    conn::DTLSConn,
+    crypto::Certificate,
+};
+use webrtc_util::Conn;
+
+#[derive(Debug, Error)]
+pub(crate) enum LanMouseConnectionError {
+    #[error(transparent)]
+    Bind(#[from] io::Error),
+    #[error(transparent)]
+    Dtls(#[from] webrtc_dtls::Error),
+    #[error(transparent)]
+    Webrtc(#[from] webrtc_util::Error),
+    #[error("not connected")]
+    NotConnected,
+    #[error("emulation is disabled on the target device")]
+    TargetEmulationDisabled,
+    #[error("Connection timed out")]
+    Timeout,
+}
+
+const DEFAULT_CONNECTION_TIMEOUT: Duration = Duration::from_secs(5);
+
+async fn connect(
+    addr: SocketAddr,
+    cert: Certificate,
+) -> Result<(Arc<dyn Conn + Sync + Send>, SocketAddr), (SocketAddr, LanMouseConnectionError)> {
+    log::info!("connecting to {addr} ...");
+    let conn = Arc::new(
+        UdpSocket::bind("0.0.0.0:0")
+            .await
+            .map_err(|e| (addr, e.into()))?,
+    );
+    conn.connect(addr).await.map_err(|e| (addr, e.into()))?;
+    let config = Config {
+        certificates: vec![cert],
+        server_name: "ignored".to_owned(),
+        insecure_skip_verify: true,
+        extended_master_secret: ExtendedMasterSecretType::Require,
+        ..Default::default()
+    };
+    let timeout = tokio::time::sleep(DEFAULT_CONNECTION_TIMEOUT);
+    tokio::select! {
+        _ = timeout => Err((addr, LanMouseConnectionError::Timeout)),
+        result = DTLSConn::new(conn, config, true, None) => match result {
+            Ok(dtls_conn) => Ok((Arc::new(dtls_conn), addr)),
+            Err(e) => Err((addr, e.into())),
+        }
+    }
+}
+
+async fn connect_any(
+    addrs: &[SocketAddr],
+    cert: Certificate,
+) -> Result<(Arc<dyn Conn + Send + Sync>, SocketAddr), LanMouseConnectionError> {
+    let mut joinset = JoinSet::new();
+    for &addr in addrs {
+        joinset.spawn_local(connect(addr, cert.clone()));
+    }
+    loop {
+        match joinset.join_next().await {
+            None => return Err(LanMouseConnectionError::NotConnected),
+            Some(r) => match r.expect("join error") {
+                Ok(conn) => return Ok(conn),
+                Err((a, e)) => {
+                    log::warn!("failed to connect to {a}: `{e}`")
+                }
+            },
+        };
+    }
+}
+
+pub(crate) struct LanMouseConnection {
+    cert: Certificate,
+    client_manager: ClientManager,
+    conns: Rc<Mutex<HashMap<SocketAddr, Arc<dyn Conn + Send + Sync>>>>,
+    connecting: Rc<Mutex<HashSet<ClientHandle>>>,
+    recv_rx: Receiver<(ClientHandle, ProtoEvent)>,
+    recv_tx: Sender<(ClientHandle, ProtoEvent)>,
+    ping_response: Rc<RefCell<HashSet<SocketAddr>>>,
+}
+
+impl LanMouseConnection {
+    pub(crate) fn new(cert: Certificate, client_manager: ClientManager) -> Self {
+        let (recv_tx, recv_rx) = channel();
+        Self {
+            cert,
+            client_manager,
+            conns: Default::default(),
+            connecting: Default::default(),
+            recv_rx,
+            recv_tx,
+            ping_response: Default::default(),
+        }
+    }
+
+    pub(crate) async fn recv(&mut self) -> (ClientHandle, ProtoEvent) {
+        self.recv_rx.recv().await.expect("channel closed")
+    }
+
+    pub(crate) async fn send(
+        &self,
+        event: ProtoEvent,
+        handle: ClientHandle,
+    ) -> Result<(), LanMouseConnectionError> {
+        let (buf, len): ([u8; MAX_EVENT_SIZE], usize) = event.into();
+        let buf = &buf[..len];
+        if let Some(addr) = self.client_manager.active_addr(handle) {
+            let conn = {
+                let conns = self.conns.lock().await;
+                conns.get(&addr).cloned()
+            };
+            if let Some(conn) = conn {
+                if !self.client_manager.alive(handle) {
+                    return Err(LanMouseConnectionError::TargetEmulationDisabled);
+                }
+                match conn.send(buf).await {
+                    Ok(_) => {}
+                    Err(e) => {
+                        log::warn!("client {handle} failed to send: {e}");
+                        disconnect(&self.client_manager, handle, addr, &self.conns).await;
+                    }
+                }
+                log::trace!("{event} >->->->->- {addr}");
+                return Ok(());
+            }
+        }
+
+        // check if we are already trying to connect
+        let mut connecting = self.connecting.lock().await;
+        if !connecting.contains(&handle) {
+            connecting.insert(handle);
+            // connect in the background
+            spawn_local(connect_to_handle(
+                self.client_manager.clone(),
+                self.cert.clone(),
+                handle,
+                self.conns.clone(),
+                self.connecting.clone(),
+                self.recv_tx.clone(),
+                self.ping_response.clone(),
+            ));
+        }
+        Err(LanMouseConnectionError::NotConnected)
+    }
+}
+
+async fn connect_to_handle(
+    client_manager: ClientManager,
+    cert: Certificate,
+    handle: ClientHandle,
+    conns: Rc<Mutex<HashMap<SocketAddr, Arc<dyn Conn + Send + Sync>>>>,
+    connecting: Rc<Mutex<HashSet<ClientHandle>>>,
+    tx: Sender<(ClientHandle, ProtoEvent)>,
+    ping_response: Rc<RefCell<HashSet<SocketAddr>>>,
+) -> Result<(), LanMouseConnectionError> {
+    log::info!("client {handle} connecting ...");
+    // sending did not work, figure out active conn.
+    if let Some(addrs) = client_manager.get_ips(handle) {
+        let port = client_manager.get_port(handle).unwrap_or(DEFAULT_PORT);
+        let addrs = addrs
+            .into_iter()
+            .map(|a| SocketAddr::new(a, port))
+            .collect::<Vec<_>>();
+        log::info!("client ({handle}) connecting ... (ips: {addrs:?})");
+        let res = connect_any(&addrs, cert).await;
+        let (conn, addr) = match res {
+            Ok(c) => c,
+            Err(e) => {
+                connecting.lock().await.remove(&handle);
+                return Err(e);
+            }
+        };
+        log::info!("client ({handle}) connected @ {addr}");
+        client_manager.set_active_addr(handle, Some(addr));
+        conns.lock().await.insert(addr, conn.clone());
+        connecting.lock().await.remove(&handle);
+
+        // poll connection for active
+        spawn_local(ping_pong(addr, conn.clone(), ping_response.clone()));
+
+        // receiver
+        spawn_local(receive_loop(
+            client_manager,
+            handle,
+            addr,
+            conn,
+            conns,
+            tx,
+            ping_response.clone(),
+        ));
+        return Ok(());
+    }
+    connecting.lock().await.remove(&handle);
+    Err(LanMouseConnectionError::NotConnected)
+}
+
+async fn ping_pong(
+    addr: SocketAddr,
+    conn: Arc<dyn Conn + Send + Sync>,
+    ping_response: Rc<RefCell<HashSet<SocketAddr>>>,
+) {
+    loop {
+        let (buf, len) = ProtoEvent::Ping.into();
+        if let Err(e) = conn.send(&buf[..len]).await {
+            log::warn!("{addr}: send error `{e}`, closing connection");
+            let _ = conn.close().await;
+            break;
+        }
+        log::trace!("PING >->->->->- {addr}");
+
+        tokio::time::sleep(Duration::from_millis(500)).await;
+
+        if !ping_response.borrow_mut().remove(&addr) {
+            log::warn!("{addr} did not respond, closing connection");
+            let _ = conn.close().await;
+            return;
+        }
+    }
+}
+
+async fn receive_loop(
+    client_manager: ClientManager,
+    handle: ClientHandle,
+    addr: SocketAddr,
+    conn: Arc<dyn Conn + Send + Sync>,
+    conns: Rc<Mutex<HashMap<SocketAddr, Arc<dyn Conn + Send + Sync>>>>,
+    tx: Sender<(ClientHandle, ProtoEvent)>,
+    ping_response: Rc<RefCell<HashSet<SocketAddr>>>,
+) {
+    let mut buf = [0u8; MAX_EVENT_SIZE];
+    while conn.recv(&mut buf).await.is_ok() {
+        if let Ok(event) = buf.try_into() {
+            log::trace!("{addr} <==<==<== {event}");
+            match event {
+                ProtoEvent::Pong(b) => {
+                    client_manager.set_active_addr(handle, Some(addr));
+                    client_manager.set_alive(handle, b);
+                    ping_response.borrow_mut().insert(addr);
+                }
+                event => tx.send((handle, event)).expect("channel closed"),
+            }
+        }
+    }
+    log::warn!("recv error");
+    disconnect(&client_manager, handle, addr, &conns).await;
+}
+
+async fn disconnect(
+    client_manager: &ClientManager,
+    handle: ClientHandle,
+    addr: SocketAddr,
+    conns: &Mutex<HashMap<SocketAddr, Arc<dyn Conn + Send + Sync>>>,
+) {
+    log::warn!("client ({handle}) @ {addr} connection closed");
+    conns.lock().await.remove(&addr);
+    client_manager.set_active_addr(handle, None);
+    let active: Vec<SocketAddr> = conns.lock().await.keys().copied().collect();
+    log::info!("active connections: {active:?}");
+}
diff --git a/src/crypto.rs b/src/crypto.rs
new file mode 100644
index 00000000..4feabd4e
--- /dev/null
+++ b/src/crypto.rs
@@ -0,0 +1,71 @@
+use std::fs;
+use std::io::{self, BufWriter, Read, Write};
+use std::path::Path;
+use std::{fs::File, io::BufReader};
+
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
+use sha2::{Digest, Sha256};
+use thiserror::Error;
+use webrtc_dtls::crypto::Certificate;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error(transparent)]
+    Dtls(#[from] webrtc_dtls::Error),
+}
+
+pub fn generate_fingerprint(cert: &[u8]) -> String {
+    let mut hash = Sha256::new();
+    hash.update(cert);
+    let bytes = hash
+        .finalize()
+        .iter()
+        .map(|x| format!("{x:02x}"))
+        .collect::<Vec<_>>();
+    bytes.join(":").to_lowercase()
+}
+
+pub fn certificate_fingerprint(cert: &Certificate) -> String {
+    let certificate = cert.certificate.first().expect("certificate missing");
+    generate_fingerprint(certificate)
+}
+
+/// load certificate from file
+pub fn load_certificate(path: &Path) -> Result<Certificate, Error> {
+    let f = File::open(path)?;
+
+    let mut reader = BufReader::new(f);
+    let mut pem = String::new();
+    reader.read_to_string(&mut pem)?;
+    Ok(Certificate::from_pem(pem.as_str())?)
+}
+
+pub(crate) fn load_or_generate_key_and_cert(path: &Path) -> Result<Certificate, Error> {
+    if path.exists() && path.is_file() {
+        Ok(load_certificate(path)?)
+    } else {
+        generate_key_and_cert(path)
+    }
+}
+
+pub(crate) fn generate_key_and_cert(path: &Path) -> Result<Certificate, Error> {
+    let cert = Certificate::generate_self_signed(["ignored".to_owned()])?;
+    let serialized = cert.serialize_pem();
+    let parent = path.parent().expect("is a path");
+    fs::create_dir_all(parent)?;
+    let f = File::create(path)?;
+    #[cfg(unix)]
+    {
+        let mut perm = f.metadata()?.permissions();
+        perm.set_mode(0o400); /* r-- --- --- */
+        f.set_permissions(perm)?;
+    }
+    /* FIXME windows permissions */
+    let mut writer = BufWriter::new(f);
+    writer.write_all(serialized.as_bytes())?;
+    Ok(cert)
+}
diff --git a/src/dns.rs b/src/dns.rs
index 496b79d7..68647a3a 100644
--- a/src/dns.rs
+++ b/src/dns.rs
@@ -1,63 +1,106 @@
-use local_channel::mpsc::Receiver;
 use std::net::IpAddr;
 
+use local_channel::mpsc::{channel, Receiver, Sender};
+use tokio::task::{spawn_local, JoinHandle};
+
 use hickory_resolver::{error::ResolveError, TokioAsyncResolver};
+use tokio_util::sync::CancellationToken;
 
-use crate::server::Server;
 use lan_mouse_ipc::ClientHandle;
 
 pub(crate) struct DnsResolver {
+    cancellation_token: CancellationToken,
+    task: Option<JoinHandle<()>>,
+    request_tx: Sender<DnsRequest>,
+    event_rx: Receiver<DnsEvent>,
+}
+
+struct DnsRequest {
+    handle: ClientHandle,
+    hostname: String,
+}
+
+pub(crate) enum DnsEvent {
+    Resolving(ClientHandle),
+    Resolved(ClientHandle, String, Result<Vec<IpAddr>, ResolveError>),
+}
+
+struct DnsTask {
     resolver: TokioAsyncResolver,
-    dns_request: Receiver<ClientHandle>,
+    request_rx: Receiver<DnsRequest>,
+    event_tx: Sender<DnsEvent>,
+    cancellation_token: CancellationToken,
 }
 
 impl DnsResolver {
-    pub(crate) fn new(dns_request: Receiver<ClientHandle>) -> Result<Self, ResolveError> {
+    pub(crate) fn new() -> Result<Self, ResolveError> {
         let resolver = TokioAsyncResolver::tokio_from_system_conf()?;
-        Ok(Self {
+        let (request_tx, request_rx) = channel();
+        let (event_tx, event_rx) = channel();
+        let cancellation_token = CancellationToken::new();
+        let dns_task = DnsTask {
             resolver,
-            dns_request,
+            request_rx,
+            event_tx,
+            cancellation_token: cancellation_token.clone(),
+        };
+        let task = Some(spawn_local(dns_task.run()));
+        Ok(Self {
+            cancellation_token,
+            task,
+            event_rx,
+            request_tx,
         })
     }
 
-    async fn resolve(&self, host: &str) -> Result<Vec<IpAddr>, ResolveError> {
-        let response = self.resolver.lookup_ip(host).await?;
-        for ip in response.iter() {
-            log::info!("{host}: adding ip {ip}");
-        }
-        Ok(response.iter().collect())
+    pub(crate) fn resolve(&self, handle: ClientHandle, hostname: String) {
+        let request = DnsRequest { handle, hostname };
+        self.request_tx.send(request).expect("channel closed");
+    }
+
+    pub(crate) async fn event(&mut self) -> DnsEvent {
+        self.event_rx.recv().await.expect("channel closed")
     }
 
-    pub(crate) async fn run(mut self, server: Server) {
+    pub(crate) async fn terminate(&mut self) {
+        self.cancellation_token.cancel();
+        self.task.take().expect("task").await.expect("join error");
+    }
+}
+
+impl DnsTask {
+    async fn run(mut self) {
+        let cancellation_token = self.cancellation_token.clone();
         tokio::select! {
-            _ = server.cancelled() => {},
-            _ = self.do_dns(&server) => {},
+            _ = self.do_dns() => {},
+            _ = cancellation_token.cancelled() => {},
         }
     }
 
-    async fn do_dns(&mut self, server: &Server) {
-        loop {
-            let handle = self.dns_request.recv().await.expect("channel closed");
+    async fn do_dns(&mut self) {
+        while let Some(dns_request) = self.request_rx.recv().await {
+            let DnsRequest { handle, hostname } = dns_request;
 
-            /* update resolving status */
-            let hostname = match server.get_hostname(handle) {
-                Some(hostname) => hostname,
-                None => continue,
-            };
+            self.event_tx
+                .send(DnsEvent::Resolving(handle))
+                .expect("channel closed");
 
-            log::info!("resolving ({handle}) `{hostname}` ...");
-            server.set_resolving(handle, true);
+            /* spawn task for dns request */
+            let event_tx = self.event_tx.clone();
+            let resolver = self.resolver.clone();
+            let cancellation_token = self.cancellation_token.clone();
 
-            let ips = match self.resolve(&hostname).await {
-                Ok(ips) => ips,
-                Err(e) => {
-                    log::warn!("could not resolve host '{hostname}': {e}");
-                    vec![]
+            tokio::task::spawn_local(async move {
+                tokio::select! {
+                    ips = resolver.lookup_ip(&hostname) => {
+                       let ips = ips.map(|ips| ips.iter().collect::<Vec<_>>());
+                       event_tx
+                           .send(DnsEvent::Resolved(handle, hostname, ips))
+                           .expect("channel closed");
+                    }
+                    _ = cancellation_token.cancelled() => {},
                 }
-            };
-
-            server.update_dns_ips(handle, ips);
-            server.set_resolving(handle, false);
+            });
         }
     }
 }
diff --git a/src/emulation.rs b/src/emulation.rs
new file mode 100644
index 00000000..fac175e0
--- /dev/null
+++ b/src/emulation.rs
@@ -0,0 +1,407 @@
+use crate::listen::{LanMouseListener, ListenerCreationError};
+use futures::StreamExt;
+use input_emulation::{EmulationHandle, InputEmulation, InputEmulationError};
+use input_event::Event;
+use lan_mouse_proto::{Position, ProtoEvent};
+use local_channel::mpsc::{channel, Receiver, Sender};
+use std::{
+    cell::Cell,
+    collections::HashMap,
+    net::SocketAddr,
+    rc::Rc,
+    time::{Duration, Instant},
+};
+use tokio::{
+    select,
+    task::{spawn_local, JoinHandle},
+};
+
+/// emulation handling events received from a listener
+pub(crate) struct Emulation {
+    task: JoinHandle<()>,
+    request_tx: Sender<EmulationRequest>,
+    event_rx: Receiver<EmulationEvent>,
+}
+
+pub(crate) enum EmulationEvent {
+    /// new connection
+    Connected {
+        /// address of the connection
+        addr: SocketAddr,
+        /// position of the connection
+        pos: lan_mouse_ipc::Position,
+        /// certificate fingerprint of the connection
+        fingerprint: String,
+    },
+    /// connection closed
+    Disconnected { addr: SocketAddr },
+    /// the port of the listener has changed
+    PortChanged(Result<u16, ListenerCreationError>),
+    /// emulation was disabled
+    EmulationDisabled,
+    /// emulation was enabled
+    EmulationEnabled,
+    /// capture should be released
+    ReleaseNotify,
+}
+
+enum EmulationRequest {
+    Reenable,
+    Release(SocketAddr),
+    ChangePort(u16),
+    Terminate,
+}
+
+impl Emulation {
+    pub(crate) fn new(
+        backend: Option<input_emulation::Backend>,
+        listener: LanMouseListener,
+    ) -> Self {
+        let emulation_proxy = EmulationProxy::new(backend);
+        let (request_tx, request_rx) = channel();
+        let (event_tx, event_rx) = channel();
+        let emulation_task = ListenTask {
+            listener,
+            emulation_proxy,
+            request_rx,
+            event_tx,
+        };
+        let task = spawn_local(emulation_task.run());
+        Self {
+            task,
+            request_tx,
+            event_rx,
+        }
+    }
+
+    pub(crate) fn send_leave_event(&self, addr: SocketAddr) {
+        self.request_tx
+            .send(EmulationRequest::Release(addr))
+            .expect("channel closed");
+    }
+
+    pub(crate) fn reenable(&self) {
+        self.request_tx
+            .send(EmulationRequest::Reenable)
+            .expect("channel closed");
+    }
+
+    pub(crate) fn request_port_change(&self, port: u16) {
+        self.request_tx
+            .send(EmulationRequest::ChangePort(port))
+            .expect("channel closed")
+    }
+
+    pub(crate) async fn event(&mut self) -> EmulationEvent {
+        self.event_rx.recv().await.expect("channel closed")
+    }
+
+    /// wait for termination
+    pub(crate) async fn terminate(&mut self) {
+        log::debug!("terminating emulation");
+        self.request_tx
+            .send(EmulationRequest::Terminate)
+            .expect("channel closed");
+        if let Err(e) = (&mut self.task).await {
+            log::warn!("{e}");
+        }
+    }
+}
+
+struct ListenTask {
+    listener: LanMouseListener,
+    emulation_proxy: EmulationProxy,
+    request_rx: Receiver<EmulationRequest>,
+    event_tx: Sender<EmulationEvent>,
+}
+
+impl ListenTask {
+    async fn run(mut self) {
+        let mut interval = tokio::time::interval(Duration::from_secs(5));
+        let mut last_response = HashMap::new();
+        loop {
+            select! {
+                e = self.listener.next() =>  {
+                    let (event, addr) = match e {
+                        Some(e) => e,
+                        None => break,
+                    };
+                    log::trace!("{event} <-<-<-<-<- {addr}");
+                    last_response.insert(addr, Instant::now());
+                    match event {
+                        ProtoEvent::Enter(pos) => {
+                            if let Some(fingerprint) = self.listener.get_certificate_fingerprint(addr).await {
+                                log::info!("releasing capture: {addr} entered this device");
+                                self.event_tx.send(EmulationEvent::ReleaseNotify).expect("channel closed");
+                                self.listener.reply(addr, ProtoEvent::Ack(0)).await;
+                                self.event_tx.send(EmulationEvent::Connected{addr, pos: to_ipc_pos(pos), fingerprint}).expect("channel closed");
+                            }
+                        }
+                        ProtoEvent::Leave(_) => {
+                            self.emulation_proxy.remove(addr);
+                            self.listener.reply(addr, ProtoEvent::Ack(0)).await;
+                        }
+                        ProtoEvent::Input(event) => self.emulation_proxy.consume(event, addr),
+                        ProtoEvent::Ping => self.listener.reply(addr, ProtoEvent::Pong(self.emulation_proxy.emulation_active.get())).await,
+                        _ => {}
+                    }
+                }
+                event = self.emulation_proxy.event() => {
+                    self.event_tx.send(event).expect("channel closed");
+                }
+                request = self.request_rx.recv() => match request.expect("channel closed") {
+                    // reenable emulation
+                    EmulationRequest::Reenable => self.emulation_proxy.reenable(),
+                    // notify the other end that we hit a barrier (should release capture)
+                    EmulationRequest::Release(addr) => self.listener.reply(addr, ProtoEvent::Leave(0)).await,
+                    EmulationRequest::ChangePort(port) => {
+                        self.listener.request_port_change(port);
+                        let result = self.listener.port_changed().await;
+                        self.event_tx.send(EmulationEvent::PortChanged(result)).expect("channel closed");
+                    }
+                    EmulationRequest::Terminate => break,
+                },
+                _ = interval.tick() => {
+                    last_response.retain(|&addr,instant| {
+                        if instant.elapsed() > Duration::from_secs(1) {
+                            log::warn!("releasing keys: {addr} not responding!");
+                            self.emulation_proxy.remove(addr);
+                            self.event_tx.send(EmulationEvent::Disconnected { addr }).expect("channel closed");
+                            false
+                        } else {
+                            true
+                        }
+                    });
+                }
+            }
+        }
+        self.listener.terminate().await;
+        self.emulation_proxy.terminate().await;
+    }
+}
+
+/// proxy handling the actual input emulation,
+/// discarding events when it is disabled
+pub(crate) struct EmulationProxy {
+    emulation_active: Rc<Cell<bool>>,
+    exit_requested: Rc<Cell<bool>>,
+    request_tx: Sender<ProxyRequest>,
+    event_rx: Receiver<EmulationEvent>,
+    task: JoinHandle<()>,
+}
+
+enum ProxyRequest {
+    Input(Event, SocketAddr),
+    Remove(SocketAddr),
+    Terminate,
+    Reenable,
+}
+
+impl EmulationProxy {
+    fn new(backend: Option<input_emulation::Backend>) -> Self {
+        let (request_tx, request_rx) = channel();
+        let (event_tx, event_rx) = channel();
+        let emulation_active = Rc::new(Cell::new(false));
+        let exit_requested = Rc::new(Cell::new(false));
+        let emulation_task = EmulationTask {
+            backend,
+            exit_requested: exit_requested.clone(),
+            request_rx,
+            event_tx,
+            handles: Default::default(),
+            next_id: 0,
+        };
+        let task = spawn_local(emulation_task.run());
+        Self {
+            emulation_active,
+            exit_requested,
+            request_tx,
+            task,
+            event_rx,
+        }
+    }
+
+    async fn event(&mut self) -> EmulationEvent {
+        let event = self.event_rx.recv().await.expect("channel closed");
+        if let EmulationEvent::EmulationEnabled = event {
+            self.emulation_active.replace(true);
+        }
+        if let EmulationEvent::EmulationDisabled = event {
+            self.emulation_active.replace(false);
+        }
+        event
+    }
+
+    fn consume(&self, event: Event, addr: SocketAddr) {
+        // ignore events if emulation is currently disabled
+        if self.emulation_active.get() {
+            self.request_tx
+                .send(ProxyRequest::Input(event, addr))
+                .expect("channel closed");
+        }
+    }
+
+    fn remove(&self, addr: SocketAddr) {
+        self.request_tx
+            .send(ProxyRequest::Remove(addr))
+            .expect("channel closed");
+    }
+
+    fn reenable(&self) {
+        self.request_tx
+            .send(ProxyRequest::Reenable)
+            .expect("channel closed");
+    }
+
+    async fn terminate(&mut self) {
+        self.exit_requested.replace(true);
+        self.request_tx
+            .send(ProxyRequest::Terminate)
+            .expect("channel closed");
+        let _ = (&mut self.task).await;
+    }
+}
+
+struct EmulationTask {
+    backend: Option<input_emulation::Backend>,
+    exit_requested: Rc<Cell<bool>>,
+    request_rx: Receiver<ProxyRequest>,
+    event_tx: Sender<EmulationEvent>,
+    handles: HashMap<SocketAddr, EmulationHandle>,
+    next_id: EmulationHandle,
+}
+
+impl EmulationTask {
+    async fn run(mut self) {
+        loop {
+            if let Err(e) = self.do_emulation().await {
+                log::warn!("input emulation exited: {e}");
+            }
+            if self.exit_requested.get() {
+                break;
+            }
+            // wait for reenable request
+            loop {
+                match self.request_rx.recv().await.expect("channel closed") {
+                    ProxyRequest::Reenable => break,
+                    ProxyRequest::Terminate => return,
+                    ProxyRequest::Input(..) => { /* emulation inactive => ignore */ }
+                    ProxyRequest::Remove(..) => { /* emulation inactive => ignore */ }
+                }
+            }
+        }
+    }
+
+    async fn do_emulation(&mut self) -> Result<(), InputEmulationError> {
+        log::info!("creating input emulation ...");
+        let mut emulation = tokio::select! {
+            r = InputEmulation::new(self.backend) => r?,
+            // allow termination event while requesting input emulation
+            _ = wait_for_termination(&mut self.request_rx) => return Ok(()),
+        };
+
+        // used to send enabled and disabled events
+        let _emulation_guard = DropGuard::new(
+            self.event_tx.clone(),
+            EmulationEvent::EmulationEnabled,
+            EmulationEvent::EmulationDisabled,
+        );
+
+        // create active handles
+        if let Err(e) = self.create_clients(&mut emulation).await {
+            emulation.terminate().await;
+            return Err(e);
+        }
+
+        let res = self.do_emulation_session(&mut emulation).await;
+        // FIXME replace with async drop when stabilized
+        emulation.terminate().await;
+        res
+    }
+
+    async fn create_clients(
+        &mut self,
+        emulation: &mut InputEmulation,
+    ) -> Result<(), InputEmulationError> {
+        for handle in self.handles.values() {
+            tokio::select! {
+                _ = emulation.create(*handle) => {},
+                _ = wait_for_termination(&mut self.request_rx) => return Ok(()),
+            }
+        }
+        Ok(())
+    }
+
+    async fn do_emulation_session(
+        &mut self,
+        emulation: &mut InputEmulation,
+    ) -> Result<(), InputEmulationError> {
+        loop {
+            tokio::select! {
+                e = self.request_rx.recv() => match e.expect("channel closed") {
+                    ProxyRequest::Input(event, addr) => {
+                        let handle = match self.handles.get(&addr) {
+                            Some(&handle) => handle,
+                            None => {
+                                let handle = self.next_id;
+                                self.next_id += 1;
+                                emulation.create(handle).await;
+                                self.handles.insert(addr, handle);
+                                handle
+                            }
+                        };
+                        emulation.consume(event, handle).await?;
+                    },
+                    ProxyRequest::Remove(addr) => {
+                        if let Some(handle) = self.handles.remove(&addr) {
+                            emulation.destroy(handle).await;
+                        }
+                    }
+                    ProxyRequest::Terminate => break Ok(()),
+                    ProxyRequest::Reenable => continue,
+                },
+            }
+        }
+    }
+}
+
+fn to_ipc_pos(pos: Position) -> lan_mouse_ipc::Position {
+    match pos {
+        Position::Left => lan_mouse_ipc::Position::Left,
+        Position::Right => lan_mouse_ipc::Position::Right,
+        Position::Top => lan_mouse_ipc::Position::Top,
+        Position::Bottom => lan_mouse_ipc::Position::Bottom,
+    }
+}
+
+async fn wait_for_termination(rx: &mut Receiver<ProxyRequest>) {
+    loop {
+        match rx.recv().await.expect("channel closed") {
+            ProxyRequest::Terminate => return,
+            ProxyRequest::Input(_, _) => continue,
+            ProxyRequest::Remove(_) => continue,
+            ProxyRequest::Reenable => continue,
+        }
+    }
+}
+
+struct DropGuard<T> {
+    tx: Sender<T>,
+    on_drop: Option<T>,
+}
+
+impl<T> DropGuard<T> {
+    fn new(tx: Sender<T>, on_new: T, on_drop: T) -> Self {
+        tx.send(on_new).expect("channel closed");
+        let on_drop = Some(on_drop);
+        Self { tx, on_drop }
+    }
+}
+
+impl<T> Drop for DropGuard<T> {
+    fn drop(&mut self) {
+        self.tx
+            .send(self.on_drop.take().expect("item"))
+            .expect("channel closed");
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index f66d0df3..ae9c66e5 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,7 +1,11 @@
+mod capture;
+pub mod capture_test;
 pub mod client;
 pub mod config;
-pub mod dns;
-pub mod server;
-
-pub mod capture_test;
+mod connect;
+mod crypto;
+mod dns;
+mod emulation;
 pub mod emulation_test;
+mod listen;
+pub mod service;
diff --git a/src/listen.rs b/src/listen.rs
new file mode 100644
index 00000000..b80b2eac
--- /dev/null
+++ b/src/listen.rs
@@ -0,0 +1,224 @@
+use futures::{Stream, StreamExt};
+use lan_mouse_proto::{ProtoEvent, MAX_EVENT_SIZE};
+use local_channel::mpsc::{channel, Receiver, Sender};
+use rustls::pki_types::CertificateDer;
+use std::{
+    collections::HashMap,
+    net::SocketAddr,
+    rc::Rc,
+    sync::{Arc, RwLock},
+    time::Duration,
+};
+use thiserror::Error;
+use tokio::{
+    sync::Mutex,
+    task::{spawn_local, JoinHandle},
+};
+use webrtc_dtls::{
+    config::{ClientAuthType::RequireAnyClientCert, Config, ExtendedMasterSecretType},
+    conn::DTLSConn,
+    crypto::Certificate,
+    listener::listen,
+};
+use webrtc_util::{conn::Listener, Conn, Error};
+
+use crate::crypto;
+
+#[derive(Error, Debug)]
+pub enum ListenerCreationError {
+    #[error(transparent)]
+    WebrtcUtil(#[from] webrtc_util::Error),
+    #[error(transparent)]
+    WebrtcDtls(#[from] webrtc_dtls::Error),
+}
+
+type ArcConn = Arc<dyn Conn + Send + Sync>;
+
+pub(crate) struct LanMouseListener {
+    listen_rx: Receiver<(ProtoEvent, SocketAddr)>,
+    listen_tx: Sender<(ProtoEvent, SocketAddr)>,
+    listen_task: JoinHandle<()>,
+    conns: Rc<Mutex<Vec<(SocketAddr, ArcConn)>>>,
+    request_port_change: Sender<u16>,
+    port_changed: Receiver<Result<u16, ListenerCreationError>>,
+}
+
+type VerifyPeerCertificateFn = Arc<
+    dyn (Fn(&[Vec<u8>], &[CertificateDer<'static>]) -> Result<(), webrtc_dtls::Error>)
+        + Send
+        + Sync,
+>;
+
+impl LanMouseListener {
+    pub(crate) async fn new(
+        port: u16,
+        cert: Certificate,
+        authorized_keys: Arc<RwLock<HashMap<String, String>>>,
+    ) -> Result<Self, ListenerCreationError> {
+        let (listen_tx, listen_rx) = channel();
+        let (request_port_change, mut request_port_change_rx) = channel();
+        let (port_changed_tx, port_changed) = channel();
+
+        let authorized = authorized_keys.clone();
+        let verify_peer_certificate: Option<VerifyPeerCertificateFn> = Some(Arc::new(
+            move |certs: &[Vec<u8>], _chains: &[CertificateDer<'static>]| {
+                assert!(certs.len() == 1);
+                let fingerprints = certs
+                    .iter()
+                    .map(|c| crypto::generate_fingerprint(c))
+                    .collect::<Vec<_>>();
+                if authorized
+                    .read()
+                    .expect("lock")
+                    .contains_key(&fingerprints[0])
+                {
+                    Ok(())
+                } else {
+                    Err(webrtc_dtls::Error::ErrVerifyDataMismatch)
+                }
+            },
+        ));
+        let cfg = Config {
+            certificates: vec![cert.clone()],
+            extended_master_secret: ExtendedMasterSecretType::Require,
+            client_auth: RequireAnyClientCert,
+            verify_peer_certificate,
+            ..Default::default()
+        };
+
+        let listen_addr = SocketAddr::new("0.0.0.0".parse().expect("invalid ip"), port);
+        let mut listener = listen(listen_addr, cfg.clone()).await?;
+
+        let conns: Rc<Mutex<Vec<(SocketAddr, ArcConn)>>> = Rc::new(Mutex::new(Vec::new()));
+
+        let conns_clone = conns.clone();
+        let tx = listen_tx.clone();
+        let listen_task: JoinHandle<()> = spawn_local(async move {
+            loop {
+                let sleep = tokio::time::sleep(Duration::from_secs(2));
+                tokio::select! {
+                    /* workaround for https://github.com/webrtc-rs/webrtc/issues/614 */
+                    _ = sleep => continue,
+                    c = listener.accept() => match c {
+                        Ok((conn, addr)) => {
+                            log::info!("dtls client connected, ip: {addr}");
+                            let mut conns = conns_clone.lock().await;
+                            conns.push((addr, conn.clone()));
+                            spawn_local(read_loop(conns_clone.clone(), addr, conn, tx.clone()));
+                        },
+                        Err(e) => log::warn!("accept: {e}"),
+                    },
+                    port = request_port_change_rx.recv() => {
+                        let port = port.expect("channel closed");
+                        let listen_addr = SocketAddr::new("0.0.0.0".parse().expect("invalid ip"), port);
+                        match listen(listen_addr, cfg.clone()).await {
+                            Ok(new_listener) => {
+                                let _ = listener.close().await;
+                                listener = new_listener;
+                                port_changed_tx.send(Ok(port)).expect("channel closed");
+                            }
+                            Err(e) => {
+                                log::warn!("unable to change port: {e}");
+                                port_changed_tx.send(Err(e.into())).expect("channel closed");
+                            }
+                        };
+                    },
+                };
+            }
+        });
+
+        Ok(Self {
+            conns,
+            listen_rx,
+            listen_tx,
+            listen_task,
+            port_changed,
+            request_port_change,
+        })
+    }
+
+    pub(crate) fn request_port_change(&mut self, port: u16) {
+        self.request_port_change.send(port).expect("channel closed");
+    }
+
+    pub(crate) async fn port_changed(&mut self) -> Result<u16, ListenerCreationError> {
+        self.port_changed.recv().await.expect("channel closed")
+    }
+
+    pub(crate) async fn terminate(&mut self) {
+        self.listen_task.abort();
+        let conns = self.conns.lock().await;
+        for (_, conn) in conns.iter() {
+            let _ = conn.close().await;
+        }
+        self.listen_tx.close();
+    }
+
+    pub(crate) async fn reply(&self, addr: SocketAddr, event: ProtoEvent) {
+        log::trace!("reply {event} >=>=>=>=>=> {addr}");
+        let (buf, len): ([u8; MAX_EVENT_SIZE], usize) = event.into();
+        let conns = self.conns.lock().await;
+        for (a, conn) in conns.iter() {
+            if *a == addr {
+                let _ = conn.send(&buf[..len]).await;
+            }
+        }
+    }
+
+    pub(crate) async fn get_certificate_fingerprint(&self, addr: SocketAddr) -> Option<String> {
+        if let Some(conn) = self
+            .conns
+            .lock()
+            .await
+            .iter()
+            .find(|(a, _)| *a == addr)
+            .map(|(_, c)| c.clone())
+        {
+            let conn: &DTLSConn = conn.as_any().downcast_ref().expect("dtls conn");
+            let certs = conn.connection_state().await.peer_certificates;
+            let cert = certs.first()?;
+            let fingerprint = crypto::generate_fingerprint(cert);
+            Some(fingerprint)
+        } else {
+            None
+        }
+    }
+}
+
+impl Stream for LanMouseListener {
+    type Item = (ProtoEvent, SocketAddr);
+
+    fn poll_next(
+        mut self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Option<Self::Item>> {
+        self.listen_rx.poll_next_unpin(cx)
+    }
+}
+
+async fn read_loop(
+    conns: Rc<Mutex<Vec<(SocketAddr, ArcConn)>>>,
+    addr: SocketAddr,
+    conn: ArcConn,
+    dtls_tx: Sender<(ProtoEvent, SocketAddr)>,
+) -> Result<(), Error> {
+    let mut b = [0u8; MAX_EVENT_SIZE];
+
+    while conn.recv(&mut b).await.is_ok() {
+        match b.try_into() {
+            Ok(event) => dtls_tx.send((event, addr)).expect("channel closed"),
+            Err(e) => {
+                log::warn!("error receiving event: {e}");
+                break;
+            }
+        }
+    }
+    log::info!("dtls client disconnected {:?}", addr);
+    let mut conns = conns.lock().await;
+    let index = conns
+        .iter()
+        .position(|(a, _)| *a == addr)
+        .expect("connection not found");
+    conns.remove(index);
+    Ok(())
+}
diff --git a/src/main.rs b/src/main.rs
index c6632787..85b9470c 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -5,9 +5,9 @@ use lan_mouse::{
     capture_test,
     config::{Config, ConfigError, Frontend},
     emulation_test,
-    server::{Server, ServiceError},
+    service::{Service, ServiceError},
 };
-use lan_mouse_ipc::IpcError;
+use lan_mouse_ipc::{IpcError, IpcListenerCreationError};
 use std::{
     future::Future,
     io,
@@ -32,7 +32,7 @@ enum LanMouseError {
     Emulation(#[from] InputEmulationError),
 }
 
-pub fn main() {
+fn main() {
     // init logging
     let env = Env::default().filter_or("LAN_MOUSE_LOG_LEVEL", "info");
     env_logger::init_from_env(env);
@@ -46,16 +46,18 @@ pub fn main() {
 fn run() -> Result<(), LanMouseError> {
     // parse config file + cli args
     let config = Config::new()?;
-    log::debug!("{config:?}");
-    log::info!("release bind: {:?}", config.release_bind);
-
     if config.test_capture {
         run_async(capture_test::run(config))?;
     } else if config.test_emulation {
         run_async(emulation_test::run(config))?;
     } else if config.daemon {
         // if daemon is specified we run the service
-        run_async(run_service(config))?;
+        match run_async(run_service(config)) {
+            Err(LanMouseError::Service(ServiceError::IpcListen(
+                IpcListenerCreationError::AlreadyRunning,
+            ))) => log::info!("service already running!"),
+            r => r?,
+        }
     } else {
         //  otherwise start the service as a child process and
         //  run a frontend
@@ -100,8 +102,10 @@ fn start_service() -> Result<Child, io::Error> {
 }
 
 async fn run_service(config: Config) -> Result<(), ServiceError> {
+    log::info!("using config: {:?}", config.path);
     log::info!("Press {:?} to release the mouse", config.release_bind);
-    Server::new(config).run().await?;
+    let mut service = Service::new(config).await?;
+    service.run().await?;
     log::info!("service exited!");
     Ok(())
 }
diff --git a/src/server.rs b/src/server.rs
deleted file mode 100644
index bc20304d..00000000
--- a/src/server.rs
+++ /dev/null
@@ -1,562 +0,0 @@
-use capture_task::CaptureRequest;
-use emulation_task::EmulationRequest;
-use futures::StreamExt;
-use hickory_resolver::error::ResolveError;
-use local_channel::mpsc::{channel, Sender};
-use log;
-use std::{
-    cell::{Cell, RefCell},
-    collections::{HashSet, VecDeque},
-    io,
-    net::{IpAddr, SocketAddr},
-    rc::Rc,
-};
-use thiserror::Error;
-use tokio::{join, signal, sync::Notify};
-use tokio_util::sync::CancellationToken;
-
-use crate::{client::ClientManager, config::Config, dns::DnsResolver};
-
-use lan_mouse_ipc::{
-    AsyncFrontendListener, ClientConfig, ClientHandle, ClientState, FrontendEvent, FrontendRequest,
-    ListenerCreationError, Position, Status,
-};
-
-mod capture_task;
-mod emulation_task;
-mod network_task;
-mod ping_task;
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum State {
-    /// Currently sending events to another device
-    Sending,
-    /// Currently receiving events from other devices
-    Receiving,
-    /// Entered the deadzone of another device but waiting
-    /// for acknowledgement (Leave event) from the device
-    AwaitAck,
-}
-
-#[derive(Debug, Error)]
-pub enum ServiceError {
-    #[error(transparent)]
-    Dns(#[from] ResolveError),
-    #[error(transparent)]
-    Listen(#[from] ListenerCreationError),
-    #[error(transparent)]
-    Io(#[from] io::Error),
-}
-
-#[derive(Clone)]
-pub struct Server {
-    active_client: Rc<Cell<Option<ClientHandle>>>,
-    pub(crate) client_manager: Rc<RefCell<ClientManager>>,
-    port: Rc<Cell<u16>>,
-    state: Rc<Cell<State>>,
-    release_bind: Vec<input_event::scancode::Linux>,
-    notifies: Rc<Notifies>,
-    config: Rc<Config>,
-    pending_frontend_events: Rc<RefCell<VecDeque<FrontendEvent>>>,
-    capture_status: Rc<Cell<Status>>,
-    emulation_status: Rc<Cell<Status>>,
-}
-
-#[derive(Default)]
-struct Notifies {
-    capture: Notify,
-    emulation: Notify,
-    ping: Notify,
-    port_changed: Notify,
-    frontend_event_pending: Notify,
-    cancel: CancellationToken,
-}
-
-impl Server {
-    pub fn new(config: Config) -> Self {
-        let active_client = Rc::new(Cell::new(None));
-        let client_manager = Rc::new(RefCell::new(ClientManager::default()));
-        let state = Rc::new(Cell::new(State::Receiving));
-        let port = Rc::new(Cell::new(config.port));
-        for config_client in config.get_clients() {
-            let client = ClientConfig {
-                hostname: config_client.hostname,
-                fix_ips: config_client.ips.into_iter().collect(),
-                port: config_client.port,
-                pos: config_client.pos,
-                cmd: config_client.enter_hook,
-            };
-            let state = ClientState {
-                active: config_client.active,
-                ips: HashSet::from_iter(client.fix_ips.iter().cloned()),
-                ..Default::default()
-            };
-            let mut client_manager = client_manager.borrow_mut();
-            let handle = client_manager.add_client();
-            let c = client_manager.get_mut(handle).expect("invalid handle");
-            *c = (client, state);
-        }
-
-        // task notification tokens
-        let notifies = Rc::new(Notifies::default());
-        let release_bind = config.release_bind.clone();
-
-        let config = Rc::new(config);
-
-        Self {
-            config,
-            active_client,
-            client_manager,
-            port,
-            state,
-            release_bind,
-            notifies,
-            pending_frontend_events: Rc::new(RefCell::new(VecDeque::new())),
-            capture_status: Default::default(),
-            emulation_status: Default::default(),
-        }
-    }
-
-    pub async fn run(&mut self) -> Result<(), ServiceError> {
-        // create frontend communication adapter, exit if already running
-        let mut frontend = match AsyncFrontendListener::new().await {
-            Ok(f) => f,
-            Err(ListenerCreationError::AlreadyRunning) => {
-                log::info!("service already running, exiting");
-                return Ok(());
-            }
-            e => e?,
-        };
-
-        let (capture_tx, capture_rx) = channel(); /* requests for input capture */
-        let (emulation_tx, emulation_rx) = channel(); /* emulation requests */
-        let (udp_recv_tx, udp_recv_rx) = channel(); /* udp receiver */
-        let (udp_send_tx, udp_send_rx) = channel(); /* udp sender */
-        let (dns_tx, dns_rx) = channel(); /* dns requests */
-
-        let network = network_task::new(self.clone(), udp_recv_tx.clone(), udp_send_rx).await?;
-        let capture = capture_task::new(self.clone(), capture_rx, udp_send_tx.clone());
-        let emulation =
-            emulation_task::new(self.clone(), emulation_rx, udp_recv_rx, udp_send_tx.clone());
-        let resolver = DnsResolver::new(dns_rx)?;
-        let dns_task = tokio::task::spawn_local(resolver.run(self.clone()));
-
-        // task that pings clients to see if they are responding
-        let ping = ping_task::new(
-            self.clone(),
-            udp_send_tx.clone(),
-            emulation_tx.clone(),
-            capture_tx.clone(),
-        );
-
-        for handle in self.active_clients() {
-            dns_tx.send(handle).expect("channel closed");
-        }
-
-        loop {
-            tokio::select! {
-                request = frontend.next() => {
-                    let request = match request {
-                        Some(Ok(r)) => r,
-                        Some(Err(e)) => {
-                            log::error!("error receiving request: {e}");
-                            continue;
-                        }
-                        None => break,
-                    };
-                    log::debug!("handle frontend request: {request:?}");
-                    self.handle_request(&capture_tx.clone(), &emulation_tx.clone(), request, &dns_tx);
-                }
-                _ = self.notifies.frontend_event_pending.notified() => {
-                    while let Some(event) = {
-                        /* need to drop borrow before next iteration! */
-                        let event = self.pending_frontend_events.borrow_mut().pop_front();
-                        event
-                    } {
-                        frontend.broadcast(event).await;
-                    }
-                },
-                _ = self.cancelled() => break,
-                r = signal::ctrl_c() => {
-                    r.expect("failed to wait for CTRL+C");
-                    break;
-                }
-            }
-        }
-
-        log::info!("terminating service");
-
-        self.cancel();
-        let _ = join!(capture, dns_task, emulation, network, ping);
-
-        Ok(())
-    }
-
-    fn notify_frontend(&self, event: FrontendEvent) {
-        self.pending_frontend_events.borrow_mut().push_back(event);
-        self.notifies.frontend_event_pending.notify_one();
-    }
-
-    fn cancel(&self) {
-        self.notifies.cancel.cancel();
-    }
-
-    pub(crate) async fn cancelled(&self) {
-        self.notifies.cancel.cancelled().await
-    }
-
-    fn is_cancelled(&self) -> bool {
-        self.notifies.cancel.is_cancelled()
-    }
-
-    fn notify_capture(&self) {
-        log::info!("received capture enable request");
-        self.notifies.capture.notify_waiters()
-    }
-
-    async fn capture_enabled(&self) {
-        self.notifies.capture.notified().await
-    }
-
-    fn notify_emulation(&self) {
-        log::info!("received emulation enable request");
-        self.notifies.emulation.notify_waiters()
-    }
-
-    async fn emulation_notified(&self) {
-        self.notifies.emulation.notified().await
-    }
-
-    fn restart_ping_timer(&self) {
-        self.notifies.ping.notify_waiters()
-    }
-
-    async fn ping_timer_notified(&self) {
-        self.notifies.ping.notified().await
-    }
-
-    fn request_port_change(&self, port: u16) {
-        self.port.replace(port);
-        self.notifies.port_changed.notify_one();
-    }
-
-    fn notify_port_changed(&self, port: u16, msg: Option<String>) {
-        self.port.replace(port);
-        self.notify_frontend(FrontendEvent::PortChanged(port, msg));
-    }
-
-    pub(crate) fn client_updated(&self, handle: ClientHandle) {
-        self.notify_frontend(FrontendEvent::Changed(handle));
-    }
-
-    fn active_clients(&self) -> Vec<ClientHandle> {
-        self.client_manager
-            .borrow()
-            .get_client_states()
-            .filter(|(_, (_, s))| s.active)
-            .map(|(h, _)| h)
-            .collect()
-    }
-
-    fn handle_request(
-        &self,
-        capture: &Sender<CaptureRequest>,
-        emulate: &Sender<EmulationRequest>,
-        event: FrontendRequest,
-        dns: &Sender<ClientHandle>,
-    ) -> bool {
-        log::debug!("frontend: {event:?}");
-        match event {
-            FrontendRequest::EnableCapture => self.notify_capture(),
-            FrontendRequest::EnableEmulation => self.notify_emulation(),
-            FrontendRequest::Create => {
-                self.add_client();
-            }
-            FrontendRequest::Activate(handle, active) => {
-                if active {
-                    self.activate_client(capture, emulate, handle);
-                } else {
-                    self.deactivate_client(capture, emulate, handle);
-                }
-            }
-            FrontendRequest::ChangePort(port) => self.request_port_change(port),
-            FrontendRequest::Delete(handle) => {
-                self.remove_client(capture, emulate, handle);
-                self.notify_frontend(FrontendEvent::Deleted(handle));
-            }
-            FrontendRequest::Enumerate() => self.enumerate(),
-            FrontendRequest::GetState(handle) => self.broadcast_client(handle),
-            FrontendRequest::UpdateFixIps(handle, fix_ips) => self.update_fix_ips(handle, fix_ips),
-            FrontendRequest::UpdateHostname(handle, host) => {
-                self.update_hostname(handle, host, dns)
-            }
-            FrontendRequest::UpdatePort(handle, port) => self.update_port(handle, port),
-            FrontendRequest::UpdatePosition(handle, pos) => {
-                self.update_pos(handle, capture, emulate, pos)
-            }
-            FrontendRequest::ResolveDns(handle) => dns.send(handle).expect("channel closed"),
-            FrontendRequest::Sync => {
-                self.enumerate();
-                self.notify_frontend(FrontendEvent::EmulationStatus(self.emulation_status.get()));
-                self.notify_frontend(FrontendEvent::CaptureStatus(self.capture_status.get()));
-                self.notify_frontend(FrontendEvent::PortChanged(self.port.get(), None));
-            }
-        };
-        false
-    }
-
-    fn enumerate(&self) {
-        let clients = self
-            .client_manager
-            .borrow()
-            .get_client_states()
-            .map(|(h, (c, s))| (h, c.clone(), s.clone()))
-            .collect();
-        self.notify_frontend(FrontendEvent::Enumerate(clients));
-    }
-
-    fn add_client(&self) -> ClientHandle {
-        let handle = self.client_manager.borrow_mut().add_client();
-        log::info!("added client {handle}");
-        let (c, s) = self.client_manager.borrow().get(handle).unwrap().clone();
-        self.notify_frontend(FrontendEvent::Created(handle, c, s));
-        handle
-    }
-
-    fn deactivate_client(
-        &self,
-        capture: &Sender<CaptureRequest>,
-        emulate: &Sender<EmulationRequest>,
-        handle: ClientHandle,
-    ) {
-        match self.client_manager.borrow_mut().get_mut(handle) {
-            None => return,
-            Some((_, s)) if !s.active => return,
-            Some((_, s)) => s.active = false,
-        };
-
-        let _ = capture.send(CaptureRequest::Destroy(handle));
-        let _ = emulate.send(EmulationRequest::Destroy(handle));
-        self.client_updated(handle);
-        log::info!("deactivated client {handle}");
-    }
-
-    fn activate_client(
-        &self,
-        capture: &Sender<CaptureRequest>,
-        emulate: &Sender<EmulationRequest>,
-        handle: ClientHandle,
-    ) {
-        /* deactivate potential other client at this position */
-        let pos = match self.client_manager.borrow().get(handle) {
-            None => return,
-            Some((_, s)) if s.active => return,
-            Some((client, _)) => client.pos,
-        };
-
-        let other = self.client_manager.borrow_mut().find_client(pos);
-        if let Some(other) = other {
-            self.deactivate_client(capture, emulate, other);
-        }
-
-        /* activate the client */
-        if let Some((_, s)) = self.client_manager.borrow_mut().get_mut(handle) {
-            s.active = true;
-        } else {
-            return;
-        };
-
-        /* notify emulation, capture and frontends */
-        let _ = capture.send(CaptureRequest::Create(handle, to_capture_pos(pos)));
-        let _ = emulate.send(EmulationRequest::Create(handle));
-
-        self.client_updated(handle);
-
-        log::info!("activated client {handle} ({pos})");
-    }
-
-    fn remove_client(
-        &self,
-        capture: &Sender<CaptureRequest>,
-        emulate: &Sender<EmulationRequest>,
-        handle: ClientHandle,
-    ) {
-        let Some(active) = self
-            .client_manager
-            .borrow_mut()
-            .remove_client(handle)
-            .map(|(_, s)| s.active)
-        else {
-            return;
-        };
-
-        if active {
-            let _ = capture.send(CaptureRequest::Destroy(handle));
-            let _ = emulate.send(EmulationRequest::Destroy(handle));
-        }
-    }
-
-    fn update_pressed_keys(&self, handle: ClientHandle, has_pressed_keys: bool) {
-        if let Some((_, s)) = self.client_manager.borrow_mut().get_mut(handle) {
-            s.has_pressed_keys = has_pressed_keys;
-        }
-    }
-
-    fn update_fix_ips(&self, handle: ClientHandle, fix_ips: Vec<IpAddr>) {
-        if let Some((c, _)) = self.client_manager.borrow_mut().get_mut(handle) {
-            c.fix_ips = fix_ips;
-        };
-        self.update_ips(handle);
-        self.client_updated(handle);
-    }
-
-    pub(crate) fn update_dns_ips(&self, handle: ClientHandle, dns_ips: Vec<IpAddr>) {
-        if let Some((_, s)) = self.client_manager.borrow_mut().get_mut(handle) {
-            s.dns_ips = dns_ips;
-        };
-        self.update_ips(handle);
-        self.client_updated(handle);
-    }
-
-    fn update_ips(&self, handle: ClientHandle) {
-        if let Some((c, s)) = self.client_manager.borrow_mut().get_mut(handle) {
-            s.ips = c
-                .fix_ips
-                .iter()
-                .cloned()
-                .chain(s.dns_ips.iter().cloned())
-                .collect::<HashSet<_>>();
-        }
-    }
-
-    fn update_hostname(
-        &self,
-        handle: ClientHandle,
-        hostname: Option<String>,
-        dns: &Sender<ClientHandle>,
-    ) {
-        let mut client_manager = self.client_manager.borrow_mut();
-        let Some((c, s)) = client_manager.get_mut(handle) else {
-            return;
-        };
-
-        // hostname changed
-        if c.hostname != hostname {
-            c.hostname = hostname;
-            s.active_addr = None;
-            s.dns_ips.clear();
-            drop(client_manager);
-            self.update_ips(handle);
-            dns.send(handle).expect("channel closed");
-        }
-        self.client_updated(handle);
-    }
-
-    fn update_port(&self, handle: ClientHandle, port: u16) {
-        let mut client_manager = self.client_manager.borrow_mut();
-        let Some((c, s)) = client_manager.get_mut(handle) else {
-            return;
-        };
-
-        if c.port != port {
-            c.port = port;
-            s.active_addr = s.active_addr.map(|a| SocketAddr::new(a.ip(), port));
-        }
-    }
-
-    fn update_pos(
-        &self,
-        handle: ClientHandle,
-        capture: &Sender<CaptureRequest>,
-        emulate: &Sender<EmulationRequest>,
-        pos: Position,
-    ) {
-        let (changed, active) = {
-            let mut client_manager = self.client_manager.borrow_mut();
-            let Some((c, s)) = client_manager.get_mut(handle) else {
-                return;
-            };
-
-            let changed = c.pos != pos;
-            if changed {
-                log::info!("update pos {handle} {} -> {}", c.pos, pos);
-            }
-            c.pos = pos;
-            (changed, s.active)
-        };
-
-        // update state in event input emulator & input capture
-        if changed {
-            self.deactivate_client(capture, emulate, handle);
-            if active {
-                self.activate_client(capture, emulate, handle);
-            }
-        }
-    }
-
-    fn broadcast_client(&self, handle: ClientHandle) {
-        let client = self.client_manager.borrow().get(handle).cloned();
-        let event = if let Some((config, state)) = client {
-            FrontendEvent::State(handle, config, state)
-        } else {
-            FrontendEvent::NoSuchClient(handle)
-        };
-        self.notify_frontend(event);
-    }
-
-    fn set_emulation_status(&self, status: Status) {
-        self.emulation_status.replace(status);
-        let status = FrontendEvent::EmulationStatus(status);
-        self.notify_frontend(status);
-    }
-
-    fn set_capture_status(&self, status: Status) {
-        self.capture_status.replace(status);
-        let status = FrontendEvent::CaptureStatus(status);
-        self.notify_frontend(status);
-    }
-
-    pub(crate) fn set_resolving(&self, handle: ClientHandle, status: bool) {
-        if let Some((_, s)) = self.client_manager.borrow_mut().get_mut(handle) {
-            s.resolving = status;
-        }
-        self.client_updated(handle);
-    }
-
-    pub(crate) fn get_hostname(&self, handle: ClientHandle) -> Option<String> {
-        self.client_manager
-            .borrow_mut()
-            .get_mut(handle)
-            .and_then(|(c, _)| c.hostname.clone())
-    }
-
-    fn get_state(&self) -> State {
-        self.state.get()
-    }
-
-    fn set_state(&self, state: State) {
-        log::debug!("state => {state:?}");
-        self.state.replace(state);
-    }
-
-    fn set_active(&self, handle: Option<ClientHandle>) {
-        log::debug!("active client => {handle:?}");
-        self.active_client.replace(handle);
-    }
-
-    fn active_addr(&self, handle: ClientHandle) -> Option<SocketAddr> {
-        self.client_manager
-            .borrow()
-            .get(handle)
-            .and_then(|(_, s)| s.active_addr)
-    }
-}
-
-fn to_capture_pos(pos: Position) -> input_capture::Position {
-    match pos {
-        Position::Left => input_capture::Position::Left,
-        Position::Right => input_capture::Position::Right,
-        Position::Top => input_capture::Position::Top,
-        Position::Bottom => input_capture::Position::Bottom,
-    }
-}
diff --git a/src/server/capture_task.rs b/src/server/capture_task.rs
deleted file mode 100644
index 7b4a2360..00000000
--- a/src/server/capture_task.rs
+++ /dev/null
@@ -1,206 +0,0 @@
-use futures::StreamExt;
-use lan_mouse_proto::ProtoEvent;
-use local_channel::mpsc::{Receiver, Sender};
-use std::net::SocketAddr;
-
-use tokio::{process::Command, task::JoinHandle};
-
-use input_capture::{
-    self, CaptureError, CaptureEvent, CaptureHandle, InputCapture, InputCaptureError, Position,
-};
-
-use crate::server::State;
-use lan_mouse_ipc::{ClientHandle, Status};
-
-use super::Server;
-
-#[derive(Clone, Copy, Debug)]
-pub(crate) enum CaptureRequest {
-    /// capture must release the mouse
-    Release,
-    /// add a capture client
-    Create(CaptureHandle, Position),
-    /// destory a capture client
-    Destroy(CaptureHandle),
-}
-
-pub(crate) fn new(
-    server: Server,
-    capture_rx: Receiver<CaptureRequest>,
-    udp_send: Sender<(ProtoEvent, SocketAddr)>,
-) -> JoinHandle<()> {
-    let backend = server.config.capture_backend.map(|b| b.into());
-    tokio::task::spawn_local(capture_task(server, backend, udp_send, capture_rx))
-}
-
-async fn capture_task(
-    server: Server,
-    backend: Option<input_capture::Backend>,
-    sender_tx: Sender<(ProtoEvent, SocketAddr)>,
-    mut notify_rx: Receiver<CaptureRequest>,
-) {
-    loop {
-        if let Err(e) = do_capture(backend, &server, &sender_tx, &mut notify_rx).await {
-            log::warn!("input capture exited: {e}");
-        }
-        server.set_capture_status(Status::Disabled);
-        if server.is_cancelled() {
-            break;
-        }
-
-        // allow cancellation
-        loop {
-            tokio::select! {
-                _ = notify_rx.recv() => continue, /* need to ignore requests here! */
-                _ = server.capture_enabled() => break,
-                _ = server.cancelled() => return,
-            }
-        }
-    }
-}
-
-async fn do_capture(
-    backend: Option<input_capture::Backend>,
-    server: &Server,
-    sender_tx: &Sender<(ProtoEvent, SocketAddr)>,
-    notify_rx: &mut Receiver<CaptureRequest>,
-) -> Result<(), InputCaptureError> {
-    /* allow cancelling capture request */
-    let mut capture = tokio::select! {
-        r = InputCapture::new(backend) => r?,
-        _ = server.cancelled() => return Ok(()),
-    };
-
-    server.set_capture_status(Status::Enabled);
-
-    let clients = server.active_clients();
-    let clients = clients.iter().copied().map(|handle| {
-        (
-            handle,
-            server
-                .client_manager
-                .borrow()
-                .get(handle)
-                .map(|(c, _)| c.pos)
-                .expect("no such client"),
-        )
-    });
-    for (handle, pos) in clients {
-        capture.create(handle, to_capture_pos(pos)).await?;
-    }
-
-    loop {
-        tokio::select! {
-            event = capture.next() => match event {
-                Some(event) => handle_capture_event(server, &mut capture, sender_tx, event?).await?,
-                None => return Ok(()),
-            },
-            e = notify_rx.recv() => {
-                log::debug!("input capture notify rx: {e:?}");
-                match e {
-                    Some(e) => match e {
-                        CaptureRequest::Release => {
-                            capture.release().await?;
-                            server.state.replace(State::Receiving);
-                        }
-                        CaptureRequest::Create(h, p) => capture.create(h, p).await?,
-                        CaptureRequest::Destroy(h) => capture.destroy(h).await?,
-                    },
-                    None => break,
-                }
-            }
-            _ = server.cancelled() => break,
-        }
-    }
-    capture.terminate().await?;
-    Ok(())
-}
-
-async fn handle_capture_event(
-    server: &Server,
-    capture: &mut InputCapture,
-    sender_tx: &Sender<(ProtoEvent, SocketAddr)>,
-    event: (CaptureHandle, CaptureEvent),
-) -> Result<(), CaptureError> {
-    let (handle, event) = event;
-    log::trace!("({handle}) {event:?}");
-
-    // capture started
-    if event == CaptureEvent::Begin {
-        // wait for remote to acknowlegde enter
-        server.set_state(State::AwaitAck);
-        server.set_active(Some(handle));
-        // restart ping timer to release capture if unreachable
-        server.restart_ping_timer();
-        // spawn enter hook cmd
-        spawn_hook_command(server, handle);
-    }
-
-    // release capture if emulation set state to Receiveing
-    if server.get_state() == State::Receiving {
-        capture.release().await?;
-        return Ok(());
-    }
-
-    // check release bind
-    if capture.keys_pressed(&server.release_bind) {
-        capture.release().await?;
-        server.set_state(State::Receiving);
-    }
-
-    if let Some(addr) = server.active_addr(handle) {
-        let event = match server.get_state() {
-            State::Sending => match event {
-                CaptureEvent::Begin => ProtoEvent::Enter(0),
-                CaptureEvent::Input(e) => ProtoEvent::Input(e),
-            },
-            /* send additional enter events until acknowleged */
-            State::AwaitAck => ProtoEvent::Enter(0),
-            /* released capture */
-            State::Receiving => ProtoEvent::Leave(0),
-        };
-        sender_tx.send((event, addr)).expect("sender closed");
-    };
-
-    Ok(())
-}
-
-fn spawn_hook_command(server: &Server, handle: ClientHandle) {
-    let Some(cmd) = server
-        .client_manager
-        .borrow()
-        .get(handle)
-        .and_then(|(c, _)| c.cmd.clone())
-    else {
-        return;
-    };
-    tokio::task::spawn_local(async move {
-        log::info!("spawning command!");
-        let mut child = match Command::new("sh").arg("-c").arg(cmd.as_str()).spawn() {
-            Ok(c) => c,
-            Err(e) => {
-                log::warn!("could not execute cmd: {e}");
-                return;
-            }
-        };
-        match child.wait().await {
-            Ok(s) => {
-                if s.success() {
-                    log::info!("{cmd} exited successfully");
-                } else {
-                    log::warn!("{cmd} exited with {s}");
-                }
-            }
-            Err(e) => log::warn!("{cmd}: {e}"),
-        }
-    });
-}
-
-fn to_capture_pos(pos: lan_mouse_ipc::Position) -> input_capture::Position {
-    match pos {
-        lan_mouse_ipc::Position::Left => input_capture::Position::Left,
-        lan_mouse_ipc::Position::Right => input_capture::Position::Right,
-        lan_mouse_ipc::Position::Top => input_capture::Position::Top,
-        lan_mouse_ipc::Position::Bottom => input_capture::Position::Bottom,
-    }
-}
diff --git a/src/server/emulation_task.rs b/src/server/emulation_task.rs
deleted file mode 100644
index 1c71f082..00000000
--- a/src/server/emulation_task.rs
+++ /dev/null
@@ -1,188 +0,0 @@
-use local_channel::mpsc::{Receiver, Sender};
-use std::net::SocketAddr;
-
-use lan_mouse_proto::ProtoEvent;
-use tokio::task::JoinHandle;
-
-use lan_mouse_ipc::ClientHandle;
-
-use crate::{client::ClientManager, server::State};
-use input_emulation::{self, EmulationError, EmulationHandle, InputEmulation, InputEmulationError};
-use lan_mouse_ipc::Status;
-
-use super::{network_task::NetworkError, Server};
-
-#[derive(Clone, Debug)]
-pub(crate) enum EmulationRequest {
-    /// create a new client
-    Create(EmulationHandle),
-    /// destroy a client
-    Destroy(EmulationHandle),
-    /// input emulation must release keys for client
-    ReleaseKeys(ClientHandle),
-}
-
-pub(crate) fn new(
-    server: Server,
-    emulation_rx: Receiver<EmulationRequest>,
-    udp_rx: Receiver<Result<(ProtoEvent, SocketAddr), NetworkError>>,
-    sender_tx: Sender<(ProtoEvent, SocketAddr)>,
-) -> JoinHandle<()> {
-    let emulation_task = emulation_task(server, emulation_rx, udp_rx, sender_tx);
-    tokio::task::spawn_local(emulation_task)
-}
-
-async fn emulation_task(
-    server: Server,
-    mut rx: Receiver<EmulationRequest>,
-    mut udp_rx: Receiver<Result<(ProtoEvent, SocketAddr), NetworkError>>,
-    sender_tx: Sender<(ProtoEvent, SocketAddr)>,
-) {
-    loop {
-        if let Err(e) = do_emulation(&server, &mut rx, &mut udp_rx, &sender_tx).await {
-            log::warn!("input emulation exited: {e}");
-        }
-        server.set_emulation_status(Status::Disabled);
-        if server.is_cancelled() {
-            break;
-        }
-
-        // allow cancellation
-        loop {
-            tokio::select! {
-                _ = rx.recv() => continue, /* need to ignore requests here! */
-                _ = server.emulation_notified() => break,
-                _ = server.cancelled() => return,
-            }
-        }
-    }
-}
-
-async fn do_emulation(
-    server: &Server,
-    rx: &mut Receiver<EmulationRequest>,
-    udp_rx: &mut Receiver<Result<(ProtoEvent, SocketAddr), NetworkError>>,
-    sender_tx: &Sender<(ProtoEvent, SocketAddr)>,
-) -> Result<(), InputEmulationError> {
-    let backend = server.config.emulation_backend.map(|b| b.into());
-    log::info!("creating input emulation...");
-    let mut emulation = tokio::select! {
-        r = InputEmulation::new(backend) => r?,
-        _ = server.cancelled() => return Ok(()),
-    };
-
-    server.set_emulation_status(Status::Enabled);
-
-    // add clients
-    for handle in server.active_clients() {
-        emulation.create(handle).await;
-    }
-
-    let res = do_emulation_session(server, &mut emulation, rx, udp_rx, sender_tx).await;
-    emulation.terminate().await; // manual drop
-    res
-}
-
-async fn do_emulation_session(
-    server: &Server,
-    emulation: &mut InputEmulation,
-    rx: &mut Receiver<EmulationRequest>,
-    udp_rx: &mut Receiver<Result<(ProtoEvent, SocketAddr), NetworkError>>,
-    sender_tx: &Sender<(ProtoEvent, SocketAddr)>,
-) -> Result<(), InputEmulationError> {
-    let mut last_ignored = None;
-
-    loop {
-        tokio::select! {
-            udp_event = udp_rx.recv() => {
-                let udp_event = match udp_event.expect("channel closed") {
-                    Ok(e) => e,
-                    Err(e) => {
-                        log::warn!("network error: {e}");
-                        continue;
-                    }
-                };
-                handle_incoming_event(server, emulation, sender_tx, &mut last_ignored, udp_event).await?;
-            }
-            emulate_event = rx.recv() => {
-                match emulate_event.expect("channel closed") {
-                    EmulationRequest::Create(h) => { let _ = emulation.create(h).await; },
-                    EmulationRequest::Destroy(h) => emulation.destroy(h).await,
-                    EmulationRequest::ReleaseKeys(c) => emulation.release_keys(c).await?,
-                }
-            }
-            _ = server.notifies.cancel.cancelled() => break Ok(()),
-        }
-    }
-}
-
-async fn handle_incoming_event(
-    server: &Server,
-    emulate: &mut InputEmulation,
-    sender_tx: &Sender<(ProtoEvent, SocketAddr)>,
-    last_ignored: &mut Option<SocketAddr>,
-    event: (ProtoEvent, SocketAddr),
-) -> Result<(), EmulationError> {
-    let (event, addr) = event;
-
-    log::trace!("{:20} <-<-<-<------ {addr}", event.to_string());
-
-    // get client handle for addr
-    let Some(handle) =
-        activate_client_if_exists(&mut server.client_manager.borrow_mut(), addr, last_ignored)
-    else {
-        return Ok(());
-    };
-
-    match (event, addr) {
-        (ProtoEvent::Pong, _) => { /* ignore pong events */ }
-        (ProtoEvent::Ping, addr) => {
-            let _ = sender_tx.send((ProtoEvent::Pong, addr));
-        }
-        (ProtoEvent::Leave(_), _) => emulate.release_keys(handle).await?,
-        (ProtoEvent::Ack(_), _) => server.set_state(State::Sending),
-        (ProtoEvent::Enter(_), _) => {
-            server.set_state(State::Receiving);
-            sender_tx
-                .send((ProtoEvent::Ack(0), addr))
-                .expect("no channel")
-        }
-        (ProtoEvent::Input(e), _) => {
-            if let State::Receiving = server.get_state() {
-                log::trace!("{event} => emulate");
-                emulate.consume(e, handle).await?;
-                let has_pressed_keys = emulate.has_pressed_keys(handle);
-                server.update_pressed_keys(handle, has_pressed_keys);
-                if has_pressed_keys {
-                    server.restart_ping_timer();
-                }
-            }
-        }
-    }
-    Ok(())
-}
-
-fn activate_client_if_exists(
-    client_manager: &mut ClientManager,
-    addr: SocketAddr,
-    last_ignored: &mut Option<SocketAddr>,
-) -> Option<ClientHandle> {
-    let Some(handle) = client_manager.get_client(addr) else {
-        // log ignored if it is the first event from the client in a series
-        if last_ignored.is_none() || last_ignored.is_some() && last_ignored.unwrap() != addr {
-            log::warn!("ignoring events from client {addr}");
-            last_ignored.replace(addr);
-        }
-        return None;
-    };
-    // next event can be logged as ignored again
-    last_ignored.take();
-
-    let (_, client_state) = client_manager.get_mut(handle)?;
-
-    // reset ttl for client
-    client_state.alive = true;
-    // set addr as new default for this client
-    client_state.active_addr = Some(addr);
-    Some(handle)
-}
diff --git a/src/server/network_task.rs b/src/server/network_task.rs
deleted file mode 100644
index a90794a7..00000000
--- a/src/server/network_task.rs
+++ /dev/null
@@ -1,99 +0,0 @@
-use local_channel::mpsc::{Receiver, Sender};
-use std::{io, net::SocketAddr};
-
-use thiserror::Error;
-use tokio::{net::UdpSocket, task::JoinHandle};
-
-use super::Server;
-use lan_mouse_proto::{ProtoEvent, ProtocolError};
-
-pub(crate) async fn new(
-    server: Server,
-    udp_recv_tx: Sender<Result<(ProtoEvent, SocketAddr), NetworkError>>,
-    udp_send_rx: Receiver<(ProtoEvent, SocketAddr)>,
-) -> io::Result<JoinHandle<()>> {
-    // bind the udp socket
-    let listen_addr = SocketAddr::new("0.0.0.0".parse().unwrap(), server.port.get());
-    let mut socket = UdpSocket::bind(listen_addr).await?;
-
-    Ok(tokio::task::spawn_local(async move {
-        let mut sender_rx = udp_send_rx;
-        loop {
-            let udp_receiver = udp_receiver(&socket, &udp_recv_tx);
-            let udp_sender = udp_sender(&socket, &mut sender_rx);
-            tokio::select! {
-                _ = udp_receiver => break, /* channel closed */
-                _ = udp_sender => break, /* channel closed */
-                _ = server.notifies.port_changed.notified() => update_port(&server, &mut socket).await,
-                _ = server.cancelled() => break, /* cancellation requested */
-            }
-        }
-    }))
-}
-
-async fn update_port(server: &Server, socket: &mut UdpSocket) {
-    let new_port = server.port.get();
-    let current_port = socket.local_addr().expect("socket not bound").port();
-
-    // if port is the same, we dont need to change it
-    if current_port == new_port {
-        return;
-    }
-
-    // bind new socket
-    let listen_addr = SocketAddr::new("0.0.0.0".parse().unwrap(), new_port);
-    let new_socket = UdpSocket::bind(listen_addr).await;
-    let err = match new_socket {
-        Ok(new_socket) => {
-            *socket = new_socket;
-            None
-        }
-        Err(e) => Some(e.to_string()),
-    };
-
-    // notify frontend of the actual port
-    let port = socket.local_addr().expect("socket not bound").port();
-    server.notify_port_changed(port, err);
-}
-
-async fn udp_receiver(
-    socket: &UdpSocket,
-    receiver_tx: &Sender<Result<(ProtoEvent, SocketAddr), NetworkError>>,
-) {
-    loop {
-        let event = receive_event(socket).await;
-        receiver_tx.send(event).expect("channel closed");
-    }
-}
-
-async fn udp_sender(socket: &UdpSocket, rx: &mut Receiver<(ProtoEvent, SocketAddr)>) {
-    loop {
-        let (event, addr) = rx.recv().await.expect("channel closed");
-        if let Err(e) = send_event(socket, event, addr) {
-            log::warn!("udp send failed: {e}");
-        };
-    }
-}
-
-#[derive(Debug, Error)]
-pub(crate) enum NetworkError {
-    #[error(transparent)]
-    Protocol(#[from] ProtocolError),
-    #[error("network error: `{0}`")]
-    Io(#[from] io::Error),
-}
-
-async fn receive_event(socket: &UdpSocket) -> Result<(ProtoEvent, SocketAddr), NetworkError> {
-    let mut buf = [0u8; lan_mouse_proto::MAX_EVENT_SIZE];
-    let (_len, src) = socket.recv_from(&mut buf).await?;
-    let event = ProtoEvent::try_from(buf)?;
-    Ok((event, src))
-}
-
-fn send_event(sock: &UdpSocket, e: ProtoEvent, addr: SocketAddr) -> Result<usize, NetworkError> {
-    log::trace!("{:20} ------>->->-> {addr}", e.to_string());
-    let (data, len): ([u8; lan_mouse_proto::MAX_EVENT_SIZE], usize) = e.into();
-    // When udp blocks, we dont want to block the event loop.
-    // Dropping events is better than potentially crashing the input capture.
-    Ok(sock.try_send_to(&data[..len], addr)?)
-}
diff --git a/src/server/ping_task.rs b/src/server/ping_task.rs
deleted file mode 100644
index 14069483..00000000
--- a/src/server/ping_task.rs
+++ /dev/null
@@ -1,138 +0,0 @@
-use std::{net::SocketAddr, time::Duration};
-
-use lan_mouse_proto::ProtoEvent;
-use local_channel::mpsc::Sender;
-use tokio::task::JoinHandle;
-
-use lan_mouse_ipc::ClientHandle;
-
-use super::{capture_task::CaptureRequest, emulation_task::EmulationRequest, Server, State};
-
-const MAX_RESPONSE_TIME: Duration = Duration::from_millis(500);
-
-pub(crate) fn new(
-    server: Server,
-    sender_ch: Sender<(ProtoEvent, SocketAddr)>,
-    emulate_notify: Sender<EmulationRequest>,
-    capture_notify: Sender<CaptureRequest>,
-) -> JoinHandle<()> {
-    // timer task
-    tokio::task::spawn_local(async move {
-        tokio::select! {
-            _ = server.notifies.cancel.cancelled() => {}
-            _ = ping_task(&server, sender_ch, emulate_notify, capture_notify) => {}
-        }
-    })
-}
-
-async fn ping_task(
-    server: &Server,
-    sender_ch: Sender<(ProtoEvent, SocketAddr)>,
-    emulate_notify: Sender<EmulationRequest>,
-    capture_notify: Sender<CaptureRequest>,
-) {
-    loop {
-        // wait for wake up signal
-        server.ping_timer_notified().await;
-        loop {
-            let receiving = server.state.get() == State::Receiving;
-            let (ping_clients, ping_addrs) = {
-                let mut client_manager = server.client_manager.borrow_mut();
-
-                let ping_clients: Vec<ClientHandle> = if receiving {
-                    // if receiving we care about clients with pressed keys
-                    client_manager
-                        .get_client_states()
-                        .filter(|(_, (_, s))| s.has_pressed_keys)
-                        .map(|(h, _)| h)
-                        .collect()
-                } else {
-                    // if sending we care about the active client
-                    server.active_client.get().iter().cloned().collect()
-                };
-
-                // get relevant socket addrs for clients
-                let ping_addrs: Vec<SocketAddr> = {
-                    ping_clients
-                        .iter()
-                        .flat_map(|&h| client_manager.get(h))
-                        .flat_map(|(c, s)| {
-                            if s.alive && s.active_addr.is_some() {
-                                vec![s.active_addr.unwrap()]
-                            } else {
-                                s.ips
-                                    .iter()
-                                    .cloned()
-                                    .map(|ip| SocketAddr::new(ip, c.port))
-                                    .collect()
-                            }
-                        })
-                        .collect()
-                };
-
-                // reset alive
-                for (_, (_, s)) in client_manager.get_client_states_mut() {
-                    s.alive = false;
-                }
-
-                (ping_clients, ping_addrs)
-            };
-
-            if receiving && ping_clients.is_empty() {
-                // receiving and no client has pressed keys
-                // -> no need to keep pinging
-                break;
-            }
-
-            // ping clients
-            for addr in ping_addrs {
-                if sender_ch.send((ProtoEvent::Ping, addr)).is_err() {
-                    break;
-                }
-            }
-
-            // give clients time to resond
-            if receiving {
-                log::trace!(
-                    "waiting {MAX_RESPONSE_TIME:?} for response from client with pressed keys ..."
-                );
-            } else {
-                log::trace!(
-                    "state: {:?} => waiting {MAX_RESPONSE_TIME:?} for client to respond ...",
-                    server.state.get()
-                );
-            }
-
-            tokio::time::sleep(MAX_RESPONSE_TIME).await;
-
-            // when anything is received from a client,
-            // the alive flag gets set
-            let unresponsive_clients: Vec<_> = {
-                let client_manager = server.client_manager.borrow();
-                ping_clients
-                    .iter()
-                    .filter_map(|&h| match client_manager.get(h) {
-                        Some((_, s)) if !s.alive => Some(h),
-                        _ => None,
-                    })
-                    .collect()
-            };
-
-            // we may not be receiving anymore but we should respond
-            // to the original state and not the "new" one
-            if receiving {
-                for h in unresponsive_clients {
-                    log::warn!("device not responding, releasing keys!");
-                    let _ = emulate_notify.send(EmulationRequest::ReleaseKeys(h));
-                }
-            } else {
-                // release pointer if the active client has not responded
-                if !unresponsive_clients.is_empty() {
-                    log::warn!("client not responding, releasing pointer!");
-                    server.state.replace(State::Receiving);
-                    let _ = capture_notify.send(CaptureRequest::Release);
-                }
-            }
-        }
-    }
-}
diff --git a/src/service.rs b/src/service.rs
new file mode 100644
index 00000000..27176496
--- /dev/null
+++ b/src/service.rs
@@ -0,0 +1,513 @@
+use crate::{
+    capture::{Capture, CaptureType, ICaptureEvent},
+    client::ClientManager,
+    config::Config,
+    connect::LanMouseConnection,
+    crypto,
+    dns::{DnsEvent, DnsResolver},
+    emulation::{Emulation, EmulationEvent},
+    listen::{LanMouseListener, ListenerCreationError},
+};
+use futures::StreamExt;
+use hickory_resolver::error::ResolveError;
+use lan_mouse_ipc::{
+    AsyncFrontendListener, ClientConfig, ClientHandle, ClientState, FrontendEvent, FrontendRequest,
+    IpcError, IpcListenerCreationError, Position, Status,
+};
+use log;
+use std::{
+    collections::{HashMap, HashSet, VecDeque},
+    io,
+    net::{IpAddr, SocketAddr},
+    sync::{Arc, RwLock},
+};
+use thiserror::Error;
+use tokio::{process::Command, signal, sync::Notify};
+
+#[derive(Debug, Error)]
+pub enum ServiceError {
+    #[error(transparent)]
+    Dns(#[from] ResolveError),
+    #[error(transparent)]
+    IpcListen(#[from] IpcListenerCreationError),
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error(transparent)]
+    ListenError(#[from] ListenerCreationError),
+    #[error("failed to load certificate: `{0}`")]
+    Certificate(#[from] crypto::Error),
+}
+
+pub struct Service {
+    /// input capture
+    capture: Capture,
+    /// input emulation
+    emulation: Emulation,
+    /// dns resolver
+    resolver: DnsResolver,
+    /// frontend listener
+    frontend_listener: AsyncFrontendListener,
+    /// authorized public key sha256 fingerprints
+    authorized_keys: Arc<RwLock<HashMap<String, String>>>,
+    /// (outgoing) client information
+    client_manager: ClientManager,
+    /// current port
+    port: u16,
+    /// the public key fingerprint for (D)TLS
+    public_key_fingerprint: String,
+    /// notify for pending frontend events
+    frontend_event_pending: Notify,
+    /// frontend events queued for sending
+    pending_frontend_events: VecDeque<FrontendEvent>,
+    /// status of input capture (enabled / disabled)
+    capture_status: Status,
+    /// status of input emulation (enabled / disabled)
+    emulation_status: Status,
+    /// keep track of registered connections to avoid duplicate barriers
+    incoming_conns: HashSet<SocketAddr>,
+    /// map from capture handle to connection info
+    incoming_conn_info: HashMap<ClientHandle, Incoming>,
+    next_trigger_handle: u64,
+}
+
+#[derive(Debug)]
+struct Incoming {
+    fingerprint: String,
+    addr: SocketAddr,
+    pos: Position,
+}
+
+impl Service {
+    pub async fn new(config: Config) -> Result<Self, ServiceError> {
+        let client_manager = ClientManager::default();
+        for client in config.get_clients() {
+            let config = ClientConfig {
+                hostname: client.hostname,
+                fix_ips: client.ips.into_iter().collect(),
+                port: client.port,
+                pos: client.pos,
+                cmd: client.enter_hook,
+            };
+            let state = ClientState {
+                active: client.active,
+                ips: HashSet::from_iter(config.fix_ips.iter().cloned()),
+                ..Default::default()
+            };
+            let handle = client_manager.add_client();
+            client_manager.set_config(handle, config);
+            client_manager.set_state(handle, state);
+        }
+
+        // load certificate
+        let cert = crypto::load_or_generate_key_and_cert(&config.cert_path)?;
+        let public_key_fingerprint = crypto::certificate_fingerprint(&cert);
+
+        // create frontend communication adapter, exit if already running
+        let frontend_listener = AsyncFrontendListener::new().await?;
+
+        let authorized_keys = Arc::new(RwLock::new(config.authorized_fingerprints.clone()));
+        // listener + connection
+        let listener =
+            LanMouseListener::new(config.port, cert.clone(), authorized_keys.clone()).await?;
+        let conn = LanMouseConnection::new(cert.clone(), client_manager.clone());
+
+        // input capture + emulation
+        let capture_backend = config.capture_backend.map(|b| b.into());
+        let capture = Capture::new(capture_backend, conn, config.release_bind.clone());
+        let emulation_backend = config.emulation_backend.map(|b| b.into());
+        let emulation = Emulation::new(emulation_backend, listener);
+
+        // create dns resolver
+        let resolver = DnsResolver::new()?;
+
+        let port = config.port;
+        let service = Self {
+            capture,
+            emulation,
+            frontend_listener,
+            resolver,
+            authorized_keys,
+            public_key_fingerprint,
+            client_manager,
+            frontend_event_pending: Default::default(),
+            port,
+            pending_frontend_events: Default::default(),
+            capture_status: Default::default(),
+            emulation_status: Default::default(),
+            incoming_conn_info: Default::default(),
+            incoming_conns: Default::default(),
+            next_trigger_handle: 0,
+        };
+        Ok(service)
+    }
+
+    pub async fn run(&mut self) -> Result<(), ServiceError> {
+        for handle in self.client_manager.active_clients() {
+            // small hack: `activate_client()` checks, if the client
+            // is already active in client_manager and does not create a
+            // capture barrier in that case so we have to deactivate it first
+            self.client_manager.deactivate_client(handle);
+            self.activate_client(handle);
+        }
+
+        loop {
+            tokio::select! {
+                request = self.frontend_listener.next() => self.handle_frontend_request(request),
+                _ = self.frontend_event_pending.notified() => self.handle_frontend_pending().await,
+                event = self.emulation.event() => self.handle_emulation_event(event),
+                event = self.capture.event() => self.handle_capture_event(event),
+                event = self.resolver.event() => self.handle_resolver_event(event),
+                r = signal::ctrl_c() => break r.expect("failed to wait for CTRL+C"),
+            }
+        }
+
+        log::info!("terminating service ...");
+        log::debug!("terminating capture ...");
+        self.capture.terminate().await;
+        log::debug!("terminating emulation ...");
+        self.emulation.terminate().await;
+        log::debug!("terminating dns resolver ...");
+        self.resolver.terminate().await;
+
+        Ok(())
+    }
+
+    fn handle_frontend_request(&mut self, request: Option<Result<FrontendRequest, IpcError>>) {
+        let request = match request.expect("frontend listener closed") {
+            Ok(r) => r,
+            Err(e) => return log::error!("error receiving request: {e}"),
+        };
+        match request {
+            FrontendRequest::Activate(handle, active) => self.set_client_active(handle, active),
+            FrontendRequest::AuthorizeKey(desc, fp) => self.add_authorized_key(desc, fp),
+            FrontendRequest::ChangePort(port) => self.change_port(port),
+            FrontendRequest::Create => self.add_client(),
+            FrontendRequest::Delete(handle) => self.remove_client(handle),
+            FrontendRequest::EnableCapture => self.capture.reenable(),
+            FrontendRequest::EnableEmulation => self.emulation.reenable(),
+            FrontendRequest::Enumerate() => self.enumerate(),
+            FrontendRequest::GetState(handle) => self.broadcast_client(handle),
+            FrontendRequest::UpdateFixIps(handle, fix_ips) => self.update_fix_ips(handle, fix_ips),
+            FrontendRequest::UpdateHostname(handle, host) => self.update_hostname(handle, host),
+            FrontendRequest::UpdatePort(handle, port) => self.update_port(handle, port),
+            FrontendRequest::UpdatePosition(handle, pos) => self.update_pos(handle, pos),
+            FrontendRequest::ResolveDns(handle) => self.resolve(handle),
+            FrontendRequest::Sync => self.sync_frontend(),
+            FrontendRequest::RemoveAuthorizedKey(key) => self.remove_authorized_key(key),
+        }
+    }
+
+    async fn handle_frontend_pending(&mut self) {
+        while let Some(event) = self.pending_frontend_events.pop_front() {
+            self.frontend_listener.broadcast(event).await;
+        }
+    }
+
+    fn handle_emulation_event(&mut self, event: EmulationEvent) {
+        match event {
+            EmulationEvent::Connected {
+                addr,
+                pos,
+                fingerprint,
+            } => {
+                // check if already registered
+                if !self.incoming_conns.contains(&addr) {
+                    self.add_incoming(addr, pos, fingerprint.clone());
+                    self.notify_frontend(FrontendEvent::IncomingConnected(fingerprint, addr, pos));
+                } else {
+                    self.update_incoming(addr, pos, fingerprint);
+                }
+            }
+            EmulationEvent::Disconnected { addr } => {
+                if let Some(addr) = self.remove_incoming(addr) {
+                    self.notify_frontend(FrontendEvent::IncomingDisconnected(addr));
+                }
+            }
+            EmulationEvent::PortChanged(port) => match port {
+                Ok(port) => {
+                    self.port = port;
+                    self.notify_frontend(FrontendEvent::PortChanged(port, None));
+                }
+                Err(e) => self
+                    .notify_frontend(FrontendEvent::PortChanged(self.port, Some(format!("{e}")))),
+            },
+            EmulationEvent::EmulationDisabled => {
+                self.emulation_status = Status::Disabled;
+                self.notify_frontend(FrontendEvent::EmulationStatus(self.emulation_status));
+            }
+            EmulationEvent::EmulationEnabled => {
+                self.emulation_status = Status::Enabled;
+                self.notify_frontend(FrontendEvent::EmulationStatus(self.emulation_status));
+            }
+            EmulationEvent::ReleaseNotify => self.capture.release(),
+        }
+    }
+
+    fn handle_capture_event(&mut self, event: ICaptureEvent) {
+        match event {
+            ICaptureEvent::CaptureBegin(handle) => {
+                // we entered the capture zone for an incoming connection
+                // => notify it that its capture should be released
+                if let Some(incoming) = self.incoming_conn_info.get(&handle) {
+                    self.emulation.send_leave_event(incoming.addr);
+                }
+            }
+            ICaptureEvent::CaptureDisabled => {
+                self.capture_status = Status::Disabled;
+                self.notify_frontend(FrontendEvent::CaptureStatus(self.capture_status));
+            }
+            ICaptureEvent::CaptureEnabled => {
+                self.capture_status = Status::Enabled;
+                self.notify_frontend(FrontendEvent::CaptureStatus(self.capture_status));
+            }
+            ICaptureEvent::ClientEntered(handle) => {
+                log::info!("entering client {handle} ...");
+                self.spawn_hook_command(handle);
+            }
+        }
+    }
+
+    fn handle_resolver_event(&mut self, event: DnsEvent) {
+        let handle = match event {
+            DnsEvent::Resolving(handle) => {
+                self.client_manager.set_resolving(handle, true);
+                handle
+            }
+            DnsEvent::Resolved(handle, hostname, ips) => {
+                self.client_manager.set_resolving(handle, false);
+                if let Err(e) = &ips {
+                    log::warn!("could not resolve {hostname}: {e}");
+                }
+                let ips = ips.unwrap_or_default();
+                self.client_manager.set_dns_ips(handle, ips);
+                handle
+            }
+        };
+        self.notify_frontend(FrontendEvent::Changed(handle));
+    }
+
+    fn resolve(&self, handle: ClientHandle) {
+        if let Some(hostname) = self.client_manager.get_hostname(handle) {
+            self.resolver.resolve(handle, hostname);
+        }
+    }
+
+    fn sync_frontend(&mut self) {
+        self.enumerate();
+        self.notify_frontend(FrontendEvent::EmulationStatus(self.emulation_status));
+        self.notify_frontend(FrontendEvent::CaptureStatus(self.capture_status));
+        self.notify_frontend(FrontendEvent::PortChanged(self.port, None));
+        self.notify_frontend(FrontendEvent::PublicKeyFingerprint(
+            self.public_key_fingerprint.clone(),
+        ));
+        let keys = self.authorized_keys.read().expect("lock").clone();
+        self.notify_frontend(FrontendEvent::AuthorizedUpdated(keys));
+    }
+
+    const ENTER_HANDLE_BEGIN: u64 = u64::MAX / 2 + 1;
+
+    fn add_incoming(&mut self, addr: SocketAddr, pos: Position, fingerprint: String) {
+        let handle = Self::ENTER_HANDLE_BEGIN + self.next_trigger_handle;
+        self.next_trigger_handle += 1;
+        self.capture.create(handle, pos, CaptureType::EnterOnly);
+        self.incoming_conns.insert(addr);
+        self.incoming_conn_info.insert(
+            handle,
+            Incoming {
+                fingerprint,
+                addr,
+                pos,
+            },
+        );
+    }
+
+    fn update_incoming(&mut self, addr: SocketAddr, pos: Position, fingerprint: String) {
+        let incoming = self
+            .incoming_conn_info
+            .iter_mut()
+            .find(|(_, i)| i.addr == addr)
+            .map(|(_, i)| i)
+            .expect("no such client");
+        let mut changed = false;
+        if incoming.fingerprint != fingerprint {
+            incoming.fingerprint = fingerprint.clone();
+            changed = true;
+        }
+        if incoming.pos != pos {
+            incoming.pos = pos;
+            changed = true;
+        }
+        if changed {
+            self.remove_incoming(addr);
+            self.add_incoming(addr, pos, fingerprint.clone());
+            self.notify_frontend(FrontendEvent::IncomingDisconnected(addr));
+            self.notify_frontend(FrontendEvent::IncomingConnected(fingerprint, addr, pos));
+        }
+    }
+
+    fn remove_incoming(&mut self, addr: SocketAddr) -> Option<SocketAddr> {
+        let handle = self
+            .incoming_conn_info
+            .iter()
+            .find(|(_, incoming)| incoming.addr == addr)
+            .map(|(k, _)| *k)?;
+        self.capture.destroy(handle);
+        self.incoming_conns.remove(&addr);
+        self.incoming_conn_info
+            .remove(&handle)
+            .map(|incoming| incoming.addr)
+    }
+
+    fn notify_frontend(&mut self, event: FrontendEvent) {
+        self.pending_frontend_events.push_back(event);
+        self.frontend_event_pending.notify_one();
+    }
+
+    fn add_authorized_key(&mut self, desc: String, fp: String) {
+        self.authorized_keys.write().expect("lock").insert(fp, desc);
+        let keys = self.authorized_keys.read().expect("lock").clone();
+        self.notify_frontend(FrontendEvent::AuthorizedUpdated(keys));
+    }
+
+    fn remove_authorized_key(&mut self, fp: String) {
+        self.authorized_keys.write().expect("lock").remove(&fp);
+        let keys = self.authorized_keys.read().expect("lock").clone();
+        self.notify_frontend(FrontendEvent::AuthorizedUpdated(keys));
+    }
+
+    fn enumerate(&mut self) {
+        let clients = self.client_manager.get_client_states();
+        self.notify_frontend(FrontendEvent::Enumerate(clients));
+    }
+
+    fn add_client(&mut self) {
+        let handle = self.client_manager.add_client();
+        log::info!("added client {handle}");
+        let (c, s) = self.client_manager.get_state(handle).unwrap();
+        self.notify_frontend(FrontendEvent::Created(handle, c, s));
+    }
+
+    fn set_client_active(&mut self, handle: ClientHandle, active: bool) {
+        if active {
+            self.activate_client(handle);
+        } else {
+            self.deactivate_client(handle);
+        }
+    }
+
+    fn deactivate_client(&mut self, handle: ClientHandle) {
+        log::debug!("deactivating client {handle}");
+        if self.client_manager.deactivate_client(handle) {
+            self.capture.destroy(handle);
+            self.notify_frontend(FrontendEvent::Changed(handle));
+            log::info!("deactivated client {handle}");
+        }
+    }
+
+    fn activate_client(&mut self, handle: ClientHandle) {
+        log::debug!("activating client");
+
+        /* resolve dns on activate */
+        self.resolve(handle);
+
+        /* deactivate potential other client at this position */
+        let Some(pos) = self.client_manager.get_pos(handle) else {
+            return;
+        };
+
+        if let Some(other) = self.client_manager.client_at(pos) {
+            if other != handle {
+                self.deactivate_client(other);
+            }
+        }
+
+        /* activate the client */
+        if self.client_manager.activate_client(handle) {
+            /* notify capture and frontends */
+            self.capture.create(handle, pos, CaptureType::Default);
+            self.notify_frontend(FrontendEvent::Changed(handle));
+            log::info!("activated client {handle} ({pos})");
+        }
+    }
+
+    fn change_port(&mut self, port: u16) {
+        if self.port != port {
+            self.emulation.request_port_change(port);
+        } else {
+            self.notify_frontend(FrontendEvent::PortChanged(self.port, None));
+        }
+    }
+
+    fn remove_client(&mut self, handle: ClientHandle) {
+        if self
+            .client_manager
+            .remove_client(handle)
+            .map(|(_, s)| s.active)
+            .unwrap_or(false)
+        {
+            self.capture.destroy(handle);
+        }
+        self.notify_frontend(FrontendEvent::Deleted(handle));
+    }
+
+    fn update_fix_ips(&mut self, handle: ClientHandle, fix_ips: Vec<IpAddr>) {
+        self.client_manager.set_fix_ips(handle, fix_ips);
+        self.notify_frontend(FrontendEvent::Changed(handle));
+    }
+
+    fn update_hostname(&mut self, handle: ClientHandle, hostname: Option<String>) {
+        if self.client_manager.set_hostname(handle, hostname.clone()) {
+            self.resolve(handle);
+        }
+        self.notify_frontend(FrontendEvent::Changed(handle));
+    }
+
+    fn update_port(&mut self, handle: ClientHandle, port: u16) {
+        self.client_manager.set_port(handle, port);
+        self.notify_frontend(FrontendEvent::Changed(handle));
+    }
+
+    fn update_pos(&mut self, handle: ClientHandle, pos: Position) {
+        // update state in event input emulator & input capture
+        if self.client_manager.set_pos(handle, pos) {
+            self.deactivate_client(handle);
+            self.activate_client(handle);
+        }
+        self.notify_frontend(FrontendEvent::Changed(handle));
+    }
+
+    fn broadcast_client(&mut self, handle: ClientHandle) {
+        let event = self
+            .client_manager
+            .get_state(handle)
+            .map(|(c, s)| FrontendEvent::State(handle, c, s))
+            .unwrap_or(FrontendEvent::NoSuchClient(handle));
+        self.notify_frontend(event);
+    }
+
+    fn spawn_hook_command(&self, handle: ClientHandle) {
+        let Some(cmd) = self.client_manager.get_enter_cmd(handle) else {
+            return;
+        };
+        tokio::task::spawn_local(async move {
+            log::info!("spawning command!");
+            let mut child = match Command::new("sh").arg("-c").arg(cmd.as_str()).spawn() {
+                Ok(c) => c,
+                Err(e) => {
+                    log::warn!("could not execute cmd: {e}");
+                    return;
+                }
+            };
+            match child.wait().await {
+                Ok(s) => {
+                    if s.success() {
+                        log::info!("{cmd} exited successfully");
+                    } else {
+                        log::warn!("{cmd} exited with {s}");
+                    }
+                }
+                Err(e) => log::warn!("{cmd}: {e}"),
+            }
+        });
+    }
+}