diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index cc36a3b6..6679b149 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -19,12 +19,17 @@ jobs:
       - ${{ matrix.runner }}
     strategy:
       matrix:
-        cpu: [arm64, amd64]
+        cpu: [arm64, amd64, arm/v7]
         include:
           - cpu: arm64
             runner: ARM64
+            tag: arm64
           - cpu: amd64
             runner: X64
+            tag: amd64
+          - cpu: arm/v7
+            runner: ARM
+            tag: armv7
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -49,7 +54,7 @@ jobs:
           platforms: linux/${{ matrix.cpu }}
           provenance: false
           push: true
-          tags: ${{ env.GHCR_REPO }}:${{ github.sha }}-${{ matrix.cpu }}
+          tags: "${{ env.GHCR_REPO }}:${{ github.sha }}-${{ matrix.tag }}"
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -75,6 +80,7 @@ jobs:
           tags='${{ env.GHCR_REPO }}:${{ github.sha }} ${{ steps.meta.outputs.tags }}'
           for tag in ${tags}
           do
-            docker manifest create --amend ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64
+            docker manifest rm ${tag} || true
+            docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 ${{ env.GHCR_REPO }}:${{ github.sha }}-armv7
             docker manifest push ${tag}
           done
diff --git a/Cargo.lock b/Cargo.lock
index 7822b410..9870b857 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,18 +4,18 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.22.0"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
+checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
 dependencies = [
  "gimli",
 ]
 
 [[package]]
-name = "adler"
-version = "1.0.2"
+name = "adler2"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
 
 [[package]]
 name = "aho-corasick"
@@ -92,15 +92,15 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.86"
+version = "1.0.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
+checksum = "37bf3594c4c988a53154954629820791dde498571819ae4ca50ca811e060cc95"
 
 [[package]]
 name = "async-stream"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd56dd203fef61ac097dd65721a419ddccb106b2d2b70ba60a6b529f03961a51"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
 dependencies = [
  "async-stream-impl",
  "futures-core",
@@ -109,9 +109,9 @@ dependencies = [
 
 [[package]]
 name = "async-stream-impl"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -120,9 +120,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.81"
+version = "0.1.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e0c28dcc82d7c8ead5cb13beb15405b57b8546e93215673ff8ca0349a028107"
+checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -137,15 +137,15 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "axum"
-version = "0.7.5"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a6c9af12842a67734c9a2e355436e5d03b22383ed60cf13cd0c18fbfe3dcbcf"
+checksum = "504e3947307ac8326a5437504c517c4b56716c9d98fac0028c2acc7ca47d70ae"
 dependencies = [
  "async-trait",
  "axum-core",
@@ -170,7 +170,7 @@ dependencies = [
  "serde_urlencoded",
  "sync_wrapper 1.0.1",
  "tokio",
- "tower",
+ "tower 0.5.1",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -178,9 +178,9 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.4.3"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a15c63fd72d41492dc4f497196f5da1fb04fb7529e631d73630d1b491e47a2e3"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
 dependencies = [
  "async-trait",
  "bytes",
@@ -191,7 +191,7 @@ dependencies = [
  "mime",
  "pin-project-lite",
  "rustversion",
- "sync_wrapper 0.1.2",
+ "sync_wrapper 1.0.1",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -199,11 +199,10 @@ dependencies = [
 
 [[package]]
 name = "axum-macros"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00c055ee2d014ae5981ce1016374e8213682aa14d9bf40e48ab48b5f3ef20eaa"
+checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
 dependencies = [
- "heck 0.4.1",
  "proc-macro2",
  "quote",
  "syn",
@@ -211,17 +210,17 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.73"
+version = "0.3.74"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
+checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
 dependencies = [
  "addr2line",
- "cc",
  "cfg-if",
  "libc",
  "miniz_oxide",
  "object",
  "rustc-demangle",
+ "windows-targets",
 ]
 
 [[package]]
@@ -250,16 +249,18 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.7.1"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8318a53db07bb3f8dca91a600466bdb3f2eaadeedfdbcf02e1accbad9271ba50"
+checksum = "9ac0150caa2ae65ca5bd83f25c7de183dea78d4d366469f148435e2acfbad0da"
 
 [[package]]
 name = "cc"
-version = "1.1.11"
+version = "1.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fb8dd288a69fc53a1996d7ecfbf4a20d59065bff137ce7e56bbd620de191189"
+checksum = "c2e7962b54006dcfcc61cb72735f4d89bb97061dd6a7ed882ec6b8ee53714c6f"
 dependencies = [
+ "jobserver",
+ "libc",
  "shlex",
 ]
 
@@ -289,9 +290,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.15"
+version = "4.5.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11d8838454fda655dafd3accb2b6e2bea645b9e4078abe84a22ceb947235c5cc"
+checksum = "b97f376d85a664d5837dbae44bf546e6477a679ff6610010f17276f686d867e8"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -299,9 +300,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.15"
+version = "4.5.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216aec2b177652e3846684cbfe25c9964d18ec45234f0f5da5157b207ed1aab6"
+checksum = "19bc80abd44e4bed93ca373a0704ccbd1b710dc5749406201bb018272808dc54"
 dependencies = [
  "anstream",
  "anstyle",
@@ -311,11 +312,11 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.13"
+version = "4.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "501d359d5f3dcaf6ecdeee48833ae73ec6e42723a1e52419c79abf9507eec0a0"
+checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn",
@@ -351,9 +352,9 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51e852e6dc9a5bed1fae92dd2375037bf2b768725bf3be87811edee3249d09ad"
+checksum = "608697df725056feaccfa42cffdaeeec3fccc4ffc38358ecd19b243e716a78e0"
 dependencies = [
  "libc",
 ]
@@ -393,11 +394,45 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "darling"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "defguard-gateway"
-version = "0.7.2"
+version = "1.0.0"
 dependencies = [
- "async-stream",
  "axum",
  "base64",
  "chrono",
@@ -416,13 +451,14 @@ dependencies = [
  "toml",
  "tonic",
  "tonic-build",
+ "vergen-git2",
  "x25519-dalek",
 ]
 
 [[package]]
 name = "defguard_wireguard_rs"
-version = "0.4.7"
-source = "git+https://github.com/DefGuard/wireguard-rs.git?rev=v0.4.7#ef1cf3714629bf5016fb38cbb7320451dc69fb09"
+version = "0.5.0"
+source = "git+https://github.com/DefGuard/wireguard-rs.git?rev=v0.5.0#1bd58e2c4edd7ef2ad088211624b7f92a38317a9"
 dependencies = [
  "base64",
  "libc",
@@ -447,6 +483,37 @@ dependencies = [
  "powerfmt",
 ]
 
+[[package]]
+name = "derive_builder"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+dependencies = [
+ "derive_builder_macro",
+]
+
+[[package]]
+name = "derive_builder_core"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "derive_builder_macro"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+dependencies = [
+ "derive_builder_core",
+ "syn",
+]
+
 [[package]]
 name = "either"
 version = "1.13.0"
@@ -494,9 +561,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.1.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
+checksum = "e8c02a5121d4ea3eb16a80748c74f5549a5665e4c21333c6098f283870fbdea6"
 
 [[package]]
 name = "fiat-crypto"
@@ -512,9 +579,9 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
 [[package]]
 name = "flate2"
-version = "1.0.31"
+version = "1.0.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f211bbe8e69bbd0cfdea405084f128ae8b4aaa6b0b522fc8f2b009084797920"
+checksum = "a1b589b4dc103969ad3cf85c950899926ec64300a1a46d76c03a6072957036f0"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -537,36 +604,36 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
  "futures-core",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
 
 [[package]]
 name = "futures-sink"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
 
 [[package]]
 name = "futures-task"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
 
 [[package]]
 name = "futures-util"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -597,15 +664,28 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.29.0"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
+checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+
+[[package]]
+name = "git2"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b903b73e45dc0c6c596f2d37eccece7c1c8bb6e4407b001096387c63d0d93724"
+dependencies = [
+ "bitflags",
+ "libc",
+ "libgit2-sys",
+ "log",
+ "url",
+]
 
 [[package]]
 name = "h2"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa82e28a107a8cc405f0839610bdc9b15f1e25ec7d696aa5cf173edbcb1486ab"
+checksum = "524e8ac6999421f49a846c2d4411f337e53497d8ec55d67753beffa43c5d9205"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -613,7 +693,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http",
- "indexmap 2.4.0",
+ "indexmap 2.6.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -628,15 +708,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
-[[package]]
-name = "heck"
-version = "0.4.1"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "1e087f84d4f86bf4b218b927129862374b72199ae7d8657835f1e89000eea4fb"
 
 [[package]]
 name = "heck"
@@ -697,9 +771,9 @@ dependencies = [
 
 [[package]]
 name = "httparse"
-version = "1.9.4"
+version = "1.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fcc0b4a115bf80b728eb8ea024ad5bd707b615bfed49e0665b6e0f86fd082d9"
+checksum = "7d71d3574edd2771538b901e6549113b4006ece66150fb69c0fb6d9a2adae946"
 
 [[package]]
 name = "httpdate"
@@ -715,9 +789,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+checksum = "bbbff0a806a4728c99295b254c8838933b5b082d75e3cb70c8dab21fdfbcfa9a"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -749,9 +823,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.7"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cde7055719c54e36e95e8719f95883f22072a48ede39db7fc17a4e1d5281e9b9"
+checksum = "41296eb09f183ac68eec06e03cdbea2e759633d4067b2f6552fc2e009bcad08b"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -762,16 +836,15 @@ dependencies = [
  "pin-project-lite",
  "socket2",
  "tokio",
- "tower",
  "tower-service",
  "tracing",
 ]
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.60"
+version = "0.1.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
+checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -790,6 +863,22 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -802,12 +891,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.4.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93ead53efc7ea8ed3cfb0c79fc8023fbb782a5432b52830b6518941cebe6505c"
+checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.5",
+ "hashbrown 0.15.0",
 ]
 
 [[package]]
@@ -831,20 +920,53 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
-version = "0.3.70"
+version = "0.3.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1868808506b929d7b0cfa8f75951347aa71bb21144b7791bae35d9bccfcfe37a"
+checksum = "6a88f1bda2bd75b0452a14784937d796722fdebfe50df998aeb3f0b7603019a9"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.161"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "8e9489c2807c139ffd9c1794f4af0ebe86a828db53ecdc7fea2111d0fed085d1"
+
+[[package]]
+name = "libgit2-sys"
+version = "0.17.0+1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10472326a8a6477c3c20a64547b0059e4b0d086869eee31e6d7da728a8eb7224"
+dependencies = [
+ "cc",
+ "libc",
+ "libz-sys",
+ "pkg-config",
+]
+
+[[package]]
+name = "libz-sys"
+version = "1.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2d16453e800a8cf6dd2fc3eb4bc99b786a9b90c663b8559a5b1a041bf89e472"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
 
 [[package]]
 name = "linux-raw-sys"
@@ -887,11 +1009,11 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.4"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
+checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
 dependencies = [
- "adler",
+ "adler2",
 ]
 
 [[package]]
@@ -1026,18 +1148,18 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.3"
+version = "0.36.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b64972346851a39438c60b341ebc01bba47464ae329e55cf343eb93964efd9"
+checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
 
 [[package]]
 name = "openssl-probe"
@@ -1064,23 +1186,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
 dependencies = [
  "fixedbitset",
- "indexmap 2.4.0",
+ "indexmap 2.6.0",
 ]
 
 [[package]]
 name = "pin-project"
-version = "1.1.5"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+checksum = "baf123a161dde1e524adf36f90bc5d8d3462824a9c43553ad07a8183161189ec"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.5"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+checksum = "a4502d8515ca9f32f1fb543d987f63d95a14934883db45bdb48060b6b69257f8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1099,6 +1221,12 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkg-config"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
+
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -1116,9 +1244,9 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.20"
+version = "0.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f12335488a2f3b0a83b14edad48dca9879ce89b2edd10e80237e4e852dd645e"
+checksum = "910d41a655dac3b764f1ade94821093d3610248694320cd072303a8eedcf221d"
 dependencies = [
  "proc-macro2",
  "syn",
@@ -1126,18 +1254,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.86"
+version = "1.0.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+checksum = "7c3a7fc5db1e57d5a779a352c8cdb57b29aa4c40cc69c3a68a7fedc815fbf2f9"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "prost"
-version = "0.13.1"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13db3d3fde688c61e2446b4d843bc27a7e8af269a69440c0308021dc92333cc"
+checksum = "7b0487d90e047de87f984913713b85c601c05609aad5b0df4b4573fbf69aa13f"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -1145,12 +1273,12 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.13.1"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bb182580f71dd070f88d01ce3de9f4da5021db7115d2e1c3605a754153b77c1"
+checksum = "0c1318b19085f08681016926435853bbf7858f9c082d0999b80550ff5d9abe15"
 dependencies = [
  "bytes",
- "heck 0.5.0",
+ "heck",
  "itertools",
  "log",
  "multimap",
@@ -1166,9 +1294,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.13.1"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18bec9b0adc4eba778b33684b7ba3e7137789434769ee3ce3930463ef904cfca"
+checksum = "e9552f850d5f0964a4e4d0bf306459ac29323ddfbae05e35a7c0d35cb0803cc5"
 dependencies = [
  "anyhow",
  "itertools",
@@ -1179,18 +1307,18 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.13.1"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cee5168b05f49d4b0ca581206eb14a7b22fafd963efe729ac48eb03266e25cc2"
+checksum = "4759aa0d3a6232fb8dbdb97b61de2c20047c68aca932c7ed76da9d788508d670"
 dependencies = [
  "prost",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.36"
+version = "1.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
 dependencies = [
  "proc-macro2",
 ]
@@ -1227,9 +1355,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.10.6"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4219d74c6b67a3654a9fbebc4b419e22126d13d2f3c4a07ee0cb61ff79a79619"
+checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1239,9 +1367,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.7"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1250,9 +1378,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "ring"
@@ -1277,18 +1405,18 @@ checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
 name = "rustc_version"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
  "semver",
 ]
 
 [[package]]
 name = "rustix"
-version = "0.38.34"
+version = "0.38.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
+checksum = "8acb788b847c24f28525660c4d7758620a7210875711f79e7f663cc152726811"
 dependencies = [
  "bitflags",
  "errno",
@@ -1299,9 +1427,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.12"
+version = "0.23.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c58f8c84392efc0a126acce10fa59ff7b3d2ac06ab451a33f2741989b806b044"
+checksum = "5fbb44d7acc4e873d613422379f69f237a1b141928c02f6bc6ccfddddc2d7993"
 dependencies = [
  "log",
  "once_cell",
@@ -1314,9 +1442,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.7.1"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88d6d420651b496bdd98684116959239430022a115c1240e6c3993be0b15fba"
+checksum = "fcaf18a4f2be7326cd874a5fa579fae794320a0f388d365dca7e480e55f83f8a"
 dependencies = [
  "openssl-probe",
  "rustls-pemfile",
@@ -1327,25 +1455,24 @@ dependencies = [
 
 [[package]]
 name = "rustls-pemfile"
-version = "2.1.3"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "196fe16b00e106300d3e45ecfcb764fa292a535d7326a29a5875c579c7417425"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
 dependencies = [
- "base64",
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.8.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0a2ce646f8655401bb81e7927b812614bd5d91dbc968696be50603510fcaf0"
+checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.102.6"
+version = "0.102.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e6b52d4fda176fd835fdc55a835d4a89b8499cad995885a21149d5ad62f852e"
+checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1354,9 +1481,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6"
+checksum = "0e819f2bc632f285be6d7cd36e25940d45b2391dd6d9b939e79de557f7014248"
 
 [[package]]
 name = "ryu"
@@ -1366,11 +1493,11 @@ checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
 [[package]]
 name = "schannel"
-version = "0.1.23"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
+checksum = "01227be5826fa0690321a2ba6c5cd57a19cf3f6a09e76973b58e61de6ab9d1c1"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1388,9 +1515,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.11.1"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75da29fe9b9b08fe9d6b22b5b4bcbc75d8db3aa31e639aa56bb62e9d46bfceaf"
+checksum = "ea4a292869320c0272d7bc55a5a6aafaff59b4f63404a003887b679a2e05b4b6"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1404,18 +1531,18 @@ checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
 
 [[package]]
 name = "serde"
-version = "1.0.207"
+version = "1.0.211"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5665e14a49a4ea1b91029ba7d3bca9f299e1f7cfa194388ccc20f14743e784f2"
+checksum = "1ac55e59090389fb9f0dd9e0f3c09615afed1d19094284d0b200441f13550793"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.207"
+version = "1.0.211"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aea2634c86b0e8ef2cfdc0c340baede54ec27b1e46febd7f80dffb2aa44a00e"
+checksum = "54be4f245ce16bc58d57ef2716271d0d4519e0f6defa147f6e081005bcb278ff"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1424,9 +1551,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.124"
+version = "1.0.132"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66ad62847a56b3dba58cc891acd13884b9c61138d330c0d7b6181713d4fce38d"
+checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
 dependencies = [
  "itoa",
  "memchr",
@@ -1446,9 +1573,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.7"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb5b1b31579f3811bf615c144393417496f152e12ac8b7663bf664f4a815306d"
+checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
 dependencies = [
  "serde",
 ]
@@ -1516,9 +1643,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.74"
+version = "2.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fceb41e3d546d0bd83421d3409b1460cc7444cd389341a4c880fe7a042cb3d7"
+checksum = "83540f837a8afc019423a8edb95b52a8effe46957ee402287f4292fae35be021"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1551,9 +1678,9 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.12.0"
+version = "3.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbcdd0c794ebb0d4cf35e88edd2f7d2c4c3e9a5a6dab322839b321c6a87a64"
+checksum = "f0f2c9fc62d0beef6951ccffd757e241266a2c833136efbe35af6cd2567dca5b"
 dependencies = [
  "cfg-if",
  "fastrand",
@@ -1564,18 +1691,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.63"
+version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.63"
+version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1615,11 +1742,26 @@ dependencies = [
  "time-core",
 ]
 
+[[package]]
+name = "tinyvec"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
-version = "1.39.2"
+version = "1.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daa4fb1bc778bd6f04cbfc4bb2d06a7396a8f299dc33ea1900cedaa316f467b1"
+checksum = "145f3413504347a2be84393cc8a7d2fb4d863b375909ea59f2158261aa258bbb"
 dependencies = [
  "backtrace",
  "bytes",
@@ -1655,9 +1797,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.15"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "267ac89e0bec6e691e5813911606935d77c476ff49024f98abcea3e7b15e37af"
+checksum = "4f4e6ce100d0eb49a2734f8c0812bcd324cf357d21810932c5df6b96ef2b86f1"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -1666,9 +1808,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.11"
+version = "0.7.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
+checksum = "61e7c3654c13bcd040d4a03abee2c75b1d14a37b423cf5a813ceae1cc903ec6a"
 dependencies = [
  "bytes",
  "futures-core",
@@ -1700,11 +1842,11 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.20"
+version = "0.22.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "583c44c02ad26b0c3f3066fe629275e50627026c51ac2e595cca4c230ce1ce1d"
+checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
 dependencies = [
- "indexmap 2.4.0",
+ "indexmap 2.6.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -1713,9 +1855,9 @@ dependencies = [
 
 [[package]]
 name = "tonic"
-version = "0.12.2"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6f6ba989e4b2c58ae83d862d3a3e27690b6e3ae630d0deb59f3697f32aa88ad"
+checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -1739,7 +1881,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tokio-stream",
- "tower",
+ "tower 0.4.13",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -1747,13 +1889,14 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "568392c5a2bd0020723e3f387891176aabafe36fd9fcd074ad309dfa0c8eb964"
+checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11"
 dependencies = [
  "prettyplease",
  "proc-macro2",
  "prost-build",
+ "prost-types",
  "quote",
  "syn",
 ]
@@ -1778,6 +1921,22 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tower"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2873938d487c3cfb9aed7546dc9f2711d867c9f90c46b889989a2cb84eba6b4f"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper 0.1.2",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -1828,11 +1987,26 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "unicode-bidi"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ab17db44d7388991a428b2ee655ce0c212e862eff1768a455c58f9aad6e7893"
+
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
 
 [[package]]
 name = "untrusted"
@@ -1840,12 +2014,68 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
+[[package]]
+name = "url"
+version = "2.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "vergen"
+version = "9.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349ed9e45296a581f455bc18039878f409992999bc1d5da12a6800eb18c8752f"
+dependencies = [
+ "anyhow",
+ "derive_builder",
+ "rustversion",
+ "time",
+ "vergen-lib",
+]
+
+[[package]]
+name = "vergen-git2"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e771aff771c0d7c2f42e434e2766d304d917e29b40f0424e8faaaa936bbc3f29"
+dependencies = [
+ "anyhow",
+ "derive_builder",
+ "git2",
+ "rustversion",
+ "time",
+ "vergen",
+ "vergen-lib",
+]
+
+[[package]]
+name = "vergen-lib"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "229eaddb0050920816cf051e619affaf18caa3dd512de8de5839ccbc8e53abb0"
+dependencies = [
+ "anyhow",
+ "derive_builder",
+ "rustversion",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -1863,9 +2093,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a82edfc16a6c469f5f44dc7b571814045d60404b55a0ee849f9bcfa2e63dd9b5"
+checksum = "128d1e363af62632b8eb57219c8fd7877144af57558fb2ef0368d0087bddeb2e"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -1874,9 +2104,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9de396da306523044d3302746f1208fa71d7532227f15e347e2d93e4145dd77b"
+checksum = "cb6dd4d3ca0ddffd1dd1c9c04f94b868c37ff5fac97c30b97cff2d74fce3a358"
 dependencies = [
  "bumpalo",
  "log",
@@ -1889,9 +2119,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585c4c91a46b072c92e908d99cb1dcdf95c5218eeb6f3bf1efa991ee7a68cccf"
+checksum = "e79384be7f8f5a9dd5d7167216f022090cf1f9ec128e6e6a482a2cb5c5422c56"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1899,9 +2129,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afc340c74d9005395cf9dd098506f7f44e38f2b4a21c6aaacf9a105ea5e1e836"
+checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1912,9 +2142,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62a0a307cb4a311d3a07867860911ca130c3494e8c2719593806c08bc5d0484"
+checksum = "65fc09f10666a9f147042251e0dda9c18f166ff7de300607007e96bdebc1068d"
 
 [[package]]
 name = "windows"
@@ -2019,9 +2249,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.6.18"
+version = "0.6.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68a9bda4691f099d435ad181000724da8e5899daa10713c2d432552b9ccd3a6f"
+checksum = "36c1fec1a2bb5866f07c25f68c26e565c4c200aebb96d7e55710c19d3e8ac49b"
 dependencies = [
  "memchr",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index bc8a0276..23d9d054 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,10 +1,9 @@
 [package]
 name = "defguard-gateway"
-version = "0.7.2"
+version = "1.0.0"
 edition = "2021"
 
 [dependencies]
-async-stream = "0.3"
 axum = { version = "0.7", features = ["macros"] }
 base64 = "0.22"
 chrono = { version = "0.4", default-features = false, features = [
@@ -12,7 +11,7 @@ chrono = { version = "0.4", default-features = false, features = [
     "std",
 ] }
 clap = { version = "4.5", features = ["derive", "env"] }
-defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
+defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.5.0" }
 env_logger = "0.11"
 gethostname = "0.5"
 log = "0.4"
@@ -32,6 +31,7 @@ x25519-dalek = { version = "2.0", features = ["getrandom", "static_secrets"] }
 [build-dependencies]
 prost-build = { version = "0.13" }
 tonic-build = { version = "0.12" }
+vergen-git2 = { version = "1.0", features = ["build"] }
 
 [profile.release]
 lto = "thin"
diff --git a/build.rs b/build.rs
index f71152da..2c920323 100644
--- a/build.rs
+++ b/build.rs
@@ -1,9 +1,15 @@
+use vergen_git2::{Emitter, Git2Builder};
+
 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // set VERGEN_GIT_SHA env variable based on git commit hash
+    let git2 = Git2Builder::default().branch(true).sha(true).build()?;
+    Emitter::default().add_instructions(&git2)?.emit()?;
+
     // compiling protos using path on build time
     let mut config = prost_build::Config::new();
     // enable optional fields
     config.protoc_arg("--experimental_allow_proto3_optional");
-    tonic_build::configure().compile_with_config(
+    tonic_build::configure().compile_protos_with_config(
         config,
         &["proto/wireguard/gateway.proto"],
         &["proto/wireguard"],
diff --git a/examples/client.rs b/examples/client.rs
new file mode 100644
index 00000000..260b072d
--- /dev/null
+++ b/examples/client.rs
@@ -0,0 +1,286 @@
+use std::{
+    io::{stdout, Write},
+    sync::{
+        atomic::{AtomicU64, Ordering},
+        Mutex,
+    },
+    time::Duration,
+};
+
+use defguard_gateway::proto;
+use defguard_wireguard_rs::{
+    host::{Host, Peer},
+    key::Key,
+    net::IpAddrMask,
+};
+use tokio::{
+    io::{AsyncBufReadExt, BufReader},
+    sync::{
+        mpsc::{self, UnboundedSender},
+        watch::{self, Receiver, Sender},
+    },
+    time::sleep,
+};
+use tokio_stream::wrappers::UnboundedReceiverStream;
+use tonic::transport::Endpoint;
+
+struct HostConfig {
+    name: String,
+    address: IpAddrMask,
+    host: Host,
+}
+
+/// Shared trasmission channel for both CLI and gRPC client to communicate with gateway.
+static STREAM_TX: Mutex<Option<UnboundedSender<proto::CoreResponse>>> = Mutex::new(None);
+static MESSAGE_ID: AtomicU64 = AtomicU64::new(0);
+
+/// Watcher for config changes, which sends changes over gRPC.
+async fn handle_changes(mut config_rx: Receiver<HostConfig>) {
+    while config_rx.changed().await.is_ok() {
+        eprintln!("Sending changes");
+        if let Some(tx) = &*STREAM_TX.lock().unwrap() {
+            let config = (&*config_rx.borrow()).into();
+            let update = proto::Update {
+                update_type: proto::UpdateType::Modify as i32,
+                update: Some(proto::update::Update::Network(config)),
+            };
+
+            let payload = Some(proto::core_response::Payload::Update(update));
+            let id = MESSAGE_ID.fetch_add(1, Ordering::Relaxed);
+            let req = proto::CoreResponse { id, payload };
+            tx.send(req).unwrap();
+        } else {
+            eprintln!("Failed to obtain a lock for mutex/sender");
+        }
+    }
+}
+
+impl From<&HostConfig> for proto::Configuration {
+    fn from(host_config: &HostConfig) -> Self {
+        Self {
+            name: host_config.name.clone(),
+            prvkey: host_config
+                .host
+                .private_key
+                .as_ref()
+                .map(ToString::to_string)
+                .unwrap_or_default(),
+            address: host_config.address.to_string(),
+            port: u32::from(host_config.host.listen_port),
+            peers: host_config.host.peers.values().map(Into::into).collect(),
+        }
+    }
+}
+
+fn print_help() {
+    println!(
+        "?|help - print this help\n\
+        a|addr address - set host address\n\
+        c|peer key - create peer with public key\n\
+        d|del key - delete peer with public key\n\
+        k|key key - set private key\n\
+        p|port port - set listening port\n\
+        q|quit - quit\n\
+        "
+    );
+}
+
+/// Command line command handler.
+async fn cli(config_tx: Sender<HostConfig>) {
+    let mut stdin = BufReader::new(tokio::io::stdin());
+    print_help();
+    loop {
+        print!("> ");
+        stdout().flush().unwrap();
+        let mut line = String::new();
+        let _count = stdin.read_line(&mut line).await.unwrap();
+        let mut token_iter = line.split_whitespace();
+        if let Some(keyword) = token_iter.next() {
+            match keyword {
+                "?" | "help" => print_help(),
+                "a" | "addr" => {
+                    let Some(arg) = token_iter.next() else {
+                        eprintln!("missing argument");
+                        continue;
+                    };
+                    if let Ok(ipaddr) = arg.parse() {
+                        config_tx.send_modify(|config| config.address = ipaddr);
+                    } else {
+                        eprintln!("Parse error");
+                    }
+                }
+                "c" | "peer" => {
+                    let Some(arg) = token_iter.next() else {
+                        eprintln!("missing argument");
+                        continue;
+                    };
+                    if let Ok(key) = Key::try_from(arg) {
+                        let peer = Peer::new(key.clone());
+                        // Try to send
+                        if let Some(tx) = &*STREAM_TX.lock().unwrap() {
+                            let update = proto::Update {
+                                update_type: proto::UpdateType::Create as i32,
+                                update: Some(proto::update::Update::Peer((&peer).into())),
+                            };
+                            let payload = Some(proto::core_response::Payload::Update(update));
+                            let id = MESSAGE_ID.fetch_add(1, Ordering::Relaxed);
+                            let req = proto::CoreResponse { id, payload };
+                            tx.send(req).unwrap();
+                        }
+                        // modify HostConfig, but do not notify the receiver
+                        config_tx.send_if_modified(|config| {
+                            config.host.peers.insert(key, peer);
+                            false
+                        });
+                    } else {
+                        eprintln!("Parse error");
+                    }
+                }
+                "d" | "del" => {
+                    let Some(arg) = token_iter.next() else {
+                        eprintln!("missing argument");
+                        continue;
+                    };
+                    if let Ok(key) = Key::try_from(arg) {
+                        let peer = Peer::new(key);
+                        // Try to send
+                        if let Some(tx) = &*STREAM_TX.lock().unwrap() {
+                            let update = proto::Update {
+                                update_type: proto::UpdateType::Delete as i32,
+                                update: Some(proto::update::Update::Peer((&peer).into())),
+                            };
+                            let payload = Some(proto::core_response::Payload::Update(update));
+                            let id = MESSAGE_ID.fetch_add(1, Ordering::Relaxed);
+                            let req = proto::CoreResponse { id, payload };
+                            tx.send(req).unwrap();
+                        }
+                        // modify HostConfig, but do not notify the receiver
+                        config_tx.send_if_modified(|config| {
+                            config
+                                .host
+                                .peers
+                                .retain(|public_key, _| public_key != &peer.public_key);
+                            false
+                        });
+                    } else {
+                        eprintln!("Parse error");
+                    }
+                }
+                "k" | "key" => {
+                    let Some(arg) = token_iter.next() else {
+                        eprintln!("missing argument");
+                        continue;
+                    };
+                    if let Ok(key) = Key::try_from(arg) {
+                        config_tx.send_modify(|config| config.host.private_key = Some(key));
+                    } else {
+                        eprintln!("Parse error");
+                    }
+                }
+                "p" | "port" => {
+                    let Some(arg) = token_iter.next() else {
+                        eprintln!("missing argument");
+                        continue;
+                    };
+                    if let Ok(port) = arg.parse() {
+                        config_tx.send_modify(|config| config.host.listen_port = port);
+                    } else {
+                        eprintln!("Parse error");
+                    }
+                }
+                "q" | "quit" => break,
+                _ => eprintln!("Unknown command"),
+            }
+        }
+    }
+}
+
+const TEN_SECS: Duration = Duration::from_secs(10);
+
+/// Client side for gRPC communication.
+async fn grpc_client(config_rx: Receiver<HostConfig>) -> Result<(), tonic::transport::Error> {
+    let endpoint = Endpoint::from_static("http://localhost:50066");
+    let endpoint = endpoint
+        .http2_keep_alive_interval(TEN_SECS)
+        .tcp_keepalive(Some(TEN_SECS))
+        .keep_alive_while_idle(true);
+    let uri = endpoint.uri();
+    loop {
+        *STREAM_TX.lock().unwrap() = None;
+        let mut client = proto::gateway_client::GatewayClient::new(endpoint.connect_lazy());
+        let (tx, rx) = mpsc::unbounded_channel();
+        *STREAM_TX.lock().unwrap() = Some(tx.clone());
+
+        let Ok(response) = client.bidi(UnboundedReceiverStream::new(rx)).await else {
+            eprintln!("Failed to connect to gateway, retrying in 10s",);
+            sleep(TEN_SECS).await;
+            continue;
+        };
+        eprintln!("Connected to gateway at {uri}");
+        let mut resp_stream = response.into_inner();
+
+        eprintln!("Sending configuration");
+        let config = (&*config_rx.borrow()).into();
+        let payload = Some(proto::core_response::Payload::Config(config));
+        let id = MESSAGE_ID.fetch_add(1, Ordering::Relaxed);
+        let req = proto::CoreResponse { id, payload };
+        tx.send(req).unwrap();
+
+        'message: loop {
+            match resp_stream.message().await {
+                Ok(None) => {
+                    eprintln!("stream was closed by the sender");
+                    break 'message;
+                }
+                Ok(Some(received)) => {
+                    eprintln!("Received message from gateway: {received:?}");
+                    let payload = match received.payload {
+                        Some(proto::core_request::Payload::ConfigRequest(config_request)) => {
+                            eprintln!("*** ConfigurationRequest {config_request:?}");
+                            let config = (&*config_rx.borrow()).into();
+                            Some(proto::core_response::Payload::Config(config))
+                        }
+                        Some(proto::core_request::Payload::PeerStats(peer_stats)) => {
+                            eprintln!("*** PeerStats {peer_stats:?}");
+                            None
+                        }
+                        // Reply without payload.
+                        None => None,
+                    };
+                    let req = proto::CoreResponse {
+                        id: received.id,
+                        payload,
+                    };
+                    tx.send(req).unwrap();
+                }
+                Err(err) => {
+                    eprintln!("Disconnected from gateway at {uri}");
+                    eprintln!("stream error: {err}");
+                    eprintln!("waiting 10s to re-establish the connection");
+                    sleep(TEN_SECS).await;
+                    break 'message;
+                }
+            }
+        }
+    }
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let configuration = HostConfig {
+        name: "demo".into(),
+        host: Host::new(
+            50505,
+            Key::try_from("JPcD7xOfOAULx+cTdgzB3dIv6nvqqbmlACYzxrfJ4Dw=").unwrap(),
+        ),
+        address: "192.168.68.68".parse().unwrap(),
+    };
+    let (config_tx, config_rx) = watch::channel(configuration);
+    tokio::select! {
+        _ = grpc_client(config_rx.clone()) => eprintln!("gRPC client completed"),
+        () = cli(config_tx) => eprintln!("CLI completed"),
+        () = handle_changes(config_rx) => eprintln!("Changes handler completed"),
+    };
+
+    Ok(())
+}
diff --git a/examples/server.rs b/examples/server.rs
deleted file mode 100644
index 60d24862..00000000
--- a/examples/server.rs
+++ /dev/null
@@ -1,258 +0,0 @@
-use std::{
-    collections::HashMap,
-    io::{stdout, Write},
-    net::{IpAddr, Ipv4Addr, SocketAddr},
-    sync::{Arc, Mutex},
-};
-
-use defguard_gateway::proto;
-use defguard_wireguard_rs::{
-    host::{Host, Peer},
-    key::Key,
-    net::IpAddrMask,
-};
-use tokio::{
-    io::{AsyncBufReadExt, BufReader},
-    sync::{
-        mpsc::{self, UnboundedSender},
-        watch::{self, Receiver, Sender},
-    },
-};
-use tokio_stream::wrappers::UnboundedReceiverStream;
-use tonic::{transport::Server, Request, Response, Status, Streaming};
-
-pub struct HostConfig {
-    name: String,
-    address: IpAddrMask,
-    host: Host,
-}
-
-type ClientMap = HashMap<SocketAddr, UnboundedSender<Result<proto::Update, Status>>>;
-
-struct GatewayServer {
-    config_rx: Receiver<HostConfig>,
-    clients: Arc<Mutex<ClientMap>>,
-}
-
-impl GatewayServer {
-    pub fn new(config_rx: Receiver<HostConfig>, clients: Arc<Mutex<ClientMap>>) -> Self {
-        // watch for changes in host configuration
-        let task_clients = clients.clone();
-        let mut task_config_rx = config_rx.clone();
-        tokio::spawn(async move {
-            while task_config_rx.changed().await.is_ok() {
-                let config = (&*task_config_rx.borrow()).into();
-                let update = proto::Update {
-                    update_type: proto::UpdateType::Modify as i32,
-                    update: Some(proto::update::Update::Network(config)),
-                };
-                task_clients.lock().unwrap().retain(
-                    move |_addr, tx: &mut UnboundedSender<Result<proto::Update, Status>>| {
-                        tx.send(Ok(update.clone())).is_ok()
-                    },
-                );
-            }
-        });
-
-        Self { config_rx, clients }
-    }
-}
-
-impl From<&HostConfig> for proto::Configuration {
-    fn from(host_config: &HostConfig) -> Self {
-        Self {
-            name: host_config.name.clone(),
-            prvkey: host_config
-                .host
-                .private_key
-                .as_ref()
-                .map(|key| key.to_string())
-                .unwrap_or_default(),
-            address: host_config.address.to_string(),
-            port: host_config.host.listen_port as u32,
-            peers: host_config
-                .host
-                .peers
-                .values()
-                .map(|peer| peer.into())
-                .collect(),
-        }
-    }
-}
-
-#[tonic::async_trait]
-impl proto::gateway_service_server::GatewayService for GatewayServer {
-    type UpdatesStream = UnboundedReceiverStream<Result<proto::Update, Status>>;
-
-    async fn config(
-        &self,
-        request: Request<proto::ConfigurationRequest>,
-    ) -> Result<Response<proto::Configuration>, Status> {
-        let address = request.remote_addr().unwrap();
-        eprintln!("CONFIG connected from: {address}");
-        Ok(Response::new((&*self.config_rx.borrow()).into()))
-    }
-
-    async fn stats(
-        &self,
-        request: Request<Streaming<proto::StatsUpdate>>,
-    ) -> Result<Response<()>, Status> {
-        let address = request.remote_addr().unwrap();
-        eprintln!("STATS connected from: {address}");
-
-        let mut stream = request.into_inner();
-        while let Some(peer_stats) = stream.message().await? {
-            eprintln!("STATS {:?}", peer_stats);
-        }
-        Ok(Response::new(()))
-    }
-
-    async fn updates(&self, request: Request<()>) -> Result<Response<Self::UpdatesStream>, Status> {
-        let address = request.remote_addr().unwrap();
-        eprintln!("UPDATES connected from: {address}");
-
-        let (tx, rx) = mpsc::unbounded_channel();
-        self.clients.lock().unwrap().insert(address, tx);
-
-        Ok(Response::new(UnboundedReceiverStream::new(rx)))
-    }
-}
-
-pub async fn cli(tx: Sender<HostConfig>, clients: Arc<Mutex<ClientMap>>) {
-    let mut stdin = BufReader::new(tokio::io::stdin());
-    println!(
-        "a|addr address - set host address\n\
-        c|peer key - create peer with public key\n\
-        d|del key - delete peer with public key\n\
-        k|key key - set private key\n\
-        p|port port - set listening port\n\
-        q|quit - quit\n\
-        "
-    );
-    loop {
-        print!("> ");
-        stdout().flush().unwrap();
-        let mut line = String::new();
-        let _count = stdin.read_line(&mut line).await.unwrap();
-        let mut token_iter = line.split_whitespace();
-        if let Some(keyword) = token_iter.next() {
-            match keyword {
-                "a" | "addr" => {
-                    if let Some(address) = token_iter.next() {
-                        if let Ok(ipaddr) = address.parse() {
-                            tx.send_modify(|config| config.address = ipaddr);
-                        } else {
-                            eprintln!("Parse error");
-                        }
-                    }
-                }
-                "c" | "peer" => {
-                    if let Some(key) = token_iter.next() {
-                        if let Ok(key) = Key::try_from(key) {
-                            let peer = Peer::new(key.clone());
-
-                            let update = proto::Update {
-                                update_type: proto::UpdateType::Create as i32,
-                                update: Some(proto::update::Update::Peer((&peer).into())),
-                            };
-                            clients.lock().unwrap().retain(
-                                move |addr, tx: &mut UnboundedSender<Result<proto::Update, Status>>| {
-                                    eprintln!("Sending peer update to {addr}");
-                                    tx.send(Ok(update.clone())).is_ok()
-                                },
-                            );
-
-                            // modify HostConfig, but do not notify the receiver
-                            tx.send_if_modified(|config| {
-                                config.host.peers.insert(key, peer);
-                                false
-                            });
-                        } else {
-                            eprintln!("Parse error");
-                        }
-                    }
-                }
-                "d" | "del" => {
-                    if let Some(key) = token_iter.next() {
-                        if let Ok(key) = Key::try_from(key) {
-                            let peer = Peer::new(key);
-
-                            let update = proto::Update {
-                                update_type: proto::UpdateType::Delete as i32,
-                                update: Some(proto::update::Update::Peer((&peer).into())),
-                            };
-                            clients.lock().unwrap().retain(
-                                move |addr, tx: &mut UnboundedSender<Result<proto::Update, Status>>| {
-                                    eprintln!("Sending peer update to {addr}");
-                                    tx.send(Ok(update.clone())).is_ok()
-                                },
-                            );
-
-                            // modify HostConfig, but do not notify the receiver
-                            // tx.send_if_modified(|config| {
-                            //     config.host.peers.retain(|entry| entry.public_key != peer.public_key);
-                            //     false
-                            // });
-                        } else {
-                            eprintln!("Parse error");
-                        }
-                    }
-                }
-                "k" | "key" => {
-                    if let Some(key) = token_iter.next() {
-                        if let Ok(key) = Key::try_from(key) {
-                            tx.send_modify(|config| config.host.private_key = Some(key));
-                        } else {
-                            eprintln!("Parse error");
-                        }
-                    }
-                }
-                "p" | "port" => {
-                    if let Some(port) = token_iter.next() {
-                        if let Ok(port) = port.parse() {
-                            tx.send_modify(|config| config.host.listen_port = port);
-                        } else {
-                            eprintln!("Parse error");
-                        }
-                    }
-                }
-                "q" | "quit" => break,
-                _ => eprintln!("Unknown command"),
-            }
-        }
-    }
-}
-
-pub async fn grpc(
-    config_rx: Receiver<HostConfig>,
-    clients: Arc<Mutex<ClientMap>>,
-) -> Result<(), tonic::transport::Error> {
-    let gateway_service = proto::gateway_service_server::GatewayServiceServer::new(
-        GatewayServer::new(config_rx, clients),
-    );
-    let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 50055); // TODO: port as an option
-    Server::builder()
-        .add_service(gateway_service)
-        .serve(addr)
-        .await
-}
-
-#[tokio::main]
-async fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let configuration = HostConfig {
-        name: "demo".into(),
-        host: Host::new(
-            50505,
-            Key::try_from("JPcD7xOfOAULx+cTdgzB3dIv6nvqqbmlACYzxrfJ4Dw=").unwrap(),
-        ),
-        address: "192.168.68.68".parse().unwrap(),
-    };
-    let (config_tx, config_rx) = watch::channel(configuration);
-    let clients = Arc::new(Mutex::new(HashMap::new()));
-    tokio::select! {
-        _ = grpc(config_rx, clients.clone()) => eprintln!("grpc completed"),
-        _ = cli(config_tx, clients) => eprintln!("cli completed")
-    };
-
-    Ok(())
-}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 00000000..bad9762a
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1728018373,
+        "narHash": "sha256-NOiTvBbRLIOe5F6RbHaAh6++BNjsb149fGZd1T4+KBg=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "bc947f541ae55e999ffdb4013441347d83b00feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "utils": "utils"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 00000000..5cc26fee
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,26 @@
+{
+  description = "Rust development flake";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { nixpkgs, utils, ... }:
+    utils.lib.eachDefaultSystem (system: let
+      pkgs = import nixpkgs {inherit system;};
+    in {
+      devShells.default = pkgs.mkShell {
+        packages = with pkgs; [
+          pkg-config
+          openssl
+          protobuf
+          sqlx-cli
+          cargo
+          rustc
+          rust-analyzer
+          clippy
+        ];
+      };
+    });
+}
diff --git a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/ServiceController.php b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/ServiceController.php
index 088a7b82..40fc2b90 100644
--- a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/ServiceController.php
+++ b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/ServiceController.php
@@ -19,17 +19,19 @@ public function reloadAction()
         $status = "failed";
         if ($this->request->isPost()) {
             $backend = new Backend();
-            $bckresult = trim($backend->configdRun('template reload OPNsense/DefguardGateway'));
+            $bckresult = trim(
+                $backend->configdRun("template reload OPNsense/DefguardGateway")
+            );
             if ($bckresult == "OK") {
-		$status = "Configuration saved to /etc/defguard/gateway.toml ";
+                $status = "Configuration saved to /etc/defguard/gateway.toml";
             }
         }
-        return array("status" => $status);
+        return ["status" => $status];
     }
     public function resetAction()
     {
-    	$backend = new Backend();
-    	$result = trim($backend->configdRun('defguardgateway restart'));
-        return array("status" => $result);
+        $backend = new Backend();
+        $result = trim($backend->configdRun("defguardgateway restart"));
+        return ["status" => $result];
     }
 }
diff --git a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/SettingsController.php b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/SettingsController.php
index 4e311539..0b03f789 100644
--- a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/SettingsController.php
+++ b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/SettingsController.php
@@ -1,9 +1,9 @@
 <?php
 namespace OPNsense\DefguardGateway\Api;
 
-use \OPNsense\Base\ApiControllerBase;
-use \OPNsense\DefguardGateway\DefguardGateway;
-use \OPNsense\Core\Config;
+use OPNsense\Base\ApiControllerBase;
+use OPNsense\DefguardGateway\DefguardGateway;
+use OPNsense\Core\Config;
 /**
  * Class SettingsController Handles settings related API actions for the DefguardGateway module
  * @package OPNsense\DefguardGateway
@@ -11,40 +11,45 @@
 
 class SettingsController extends ApiControllerBase
 {
-	public function getAction()
-	{
-	    // define list of configurable settings
-	    $result = array();
-	    if ($this->request->isGet()) {
-		$mdlDefguardGateway = new DefguardGateway();
-		$result['defguardgateway'] = $mdlDefguardGateway->getNodes();
-	    }
-	    return $result;
-	}
-	public function setAction()
-	{
-	    $result = array("result"=>"failed");
-	    if ($this->request->isPost()) {
-		// load model and update with provided data
-		$mdlDefguardGateway = new DefguardGateway();
-		$mdlDefguardGateway->setNodes($this->request->getPost("defguardgateway"));
+    public function getAction()
+    {
+        // define list of configurable settings
+        $result = [];
+        if ($this->request->isGet()) {
+            $mdlDefguardGateway = new DefguardGateway();
+            $result["defguardgateway"] = $mdlDefguardGateway->getNodes();
+        }
+        return $result;
+    }
 
-		// perform validation
-		$valMsgs = $mdlDefguardGateway->performValidation();
-		foreach ($valMsgs as $field => $msg) {
-		    if (!array_key_exists("validations", $result)) {
-			$result["validations"] = array();
-		    }
-		    $result["validations"]["defguardgateway.".$msg->getField()] = $msg->getMessage();
-		}
+    public function setAction()
+    {
+        $result = ["result" => "failed"];
+        if ($this->request->isPost()) {
+            // load model and update with provided data
+            $mdlDefguardGateway = new DefguardGateway();
+            $mdlDefguardGateway->setNodes(
+                $this->request->getPost("defguardgateway")
+            );
 
-		// serialize model to config and save
-		if ($valMsgs->count() == 0) {
-		    $mdlDefguardGateway->serializeToConfig();
-		    Config::getInstance()->save();
-		    $result["result"] = "saved";
-		}
-	    }
-	    return $result;
-	}
+            // perform validation
+            $valMsgs = $mdlDefguardGateway->performValidation();
+            foreach ($valMsgs as $field => $msg) {
+                if (!array_key_exists("validations", $result)) {
+                    $result["validations"] = [];
+                }
+                $result["validations"][
+                    "defguardgateway." . $msg->getField()
+                ] = $msg->getMessage();
+            }
+
+            // serialize model to config and save
+            if ($valMsgs->count() == 0) {
+                $mdlDefguardGateway->serializeToConfig();
+                Config::getInstance()->save();
+                $result["result"] = "saved";
+            }
+        }
+        return $result;
+    }
 }
diff --git a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/IndexController.php b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/IndexController.php
index 8eb03b17..aeb1fcaf 100644
--- a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/IndexController.php
+++ b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/IndexController.php
@@ -5,8 +5,8 @@ class IndexController extends \OPNsense\Base\IndexController
     public function indexAction()
     {
         // pick the template to serve to our users.
-        $this->view->pick('OPNsense/DefguardGateway/index');
-	// fetch form data "general"
-	$this->view->generalForm = $this->getForm("general");
+        $this->view->pick("OPNsense/DefguardGateway/index");
+        // fetch form data "general"
+        $this->view->generalForm = $this->getForm("general");
     }
 }
diff --git a/opnsense/src/opnsense/mvc/app/views/OPNsense/DefguardGateway/index.volt b/opnsense/src/opnsense/mvc/app/views/OPNsense/DefguardGateway/index.volt
index 5d17f141..c110cfe0 100644
--- a/opnsense/src/opnsense/mvc/app/views/OPNsense/DefguardGateway/index.volt
+++ b/opnsense/src/opnsense/mvc/app/views/OPNsense/DefguardGateway/index.volt
@@ -1,4 +1,4 @@
-<h2> Configuration</h2>
+<h2>Configuration</h2>
 <script type="text/javascript">
     $( document ).ready(function() {
         var data_get_map = {'frm_GeneralSettings':"/api/defguardgateway/settings/get"};
@@ -44,16 +44,16 @@
 
 </div>
 
-<div  class="col-md-12">
+<div class="col-md-12">
     {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_GeneralSettings'])}}
 </div>
 
 <div class="row">
 	<div class="col-md-1">
-			<button class="btn btn-primary"  id="saveAct" type="button"><b>{{ lang._('Save') }}</b></button>
+		<button class="btn btn-primary" id="saveAct" type="button"><b>{{ lang._('Save') }}</b></button>
 	</div>
 
 	<div class="col-md-1">
-			<button class="btn btn-primary"  id="startAct" type="button"><b>{{ lang._('Start/Restart') }}</b></button>
+		<button class="btn btn-primary" id="startAct" type="button"><b>{{ lang._('Start/Restart') }}</b></button>
 	</div>
 </div>
diff --git a/proto b/proto
index c71f3784..19814363 160000
--- a/proto
+++ b/proto
@@ -1 +1 @@
-Subproject commit c71f37847279ee23220fcf9e0e45d2c365b3b8ee
+Subproject commit 1981436375b14606aa304ffc1b7b517a11f00eef
diff --git a/src/bin/defguard-gateway.rs b/src/bin/defguard-gateway.rs
new file mode 100644
index 00000000..d6cd61af
--- /dev/null
+++ b/src/bin/defguard-gateway.rs
@@ -0,0 +1,96 @@
+use std::{
+    fs::File,
+    io::Write,
+    process,
+    sync::{Arc, Mutex},
+};
+
+#[cfg(not(target_os = "macos"))]
+use defguard_wireguard_rs::Kernel;
+use defguard_wireguard_rs::{Userspace, WGApi};
+use env_logger::{init_from_env, Env, DEFAULT_FILTER_ENV};
+use tokio::task::JoinSet;
+
+use defguard_gateway::{
+    config::get_config,
+    error::GatewayError,
+    execute_command,
+    gateway::{run_stats, Gateway, GatewayServer},
+    init_syslog,
+    server::run_server,
+};
+
+#[tokio::main]
+async fn main() -> Result<(), GatewayError> {
+    // Parse configuration.
+    let config = get_config()?;
+
+    // Get process ID.
+    let pid = process::id();
+
+    if let Some(pidfile) = &config.pidfile {
+        let mut file = File::create(pidfile)?;
+        file.write_all(pid.to_string().as_bytes())?;
+    }
+
+    // Setup logging.
+    if config.use_syslog {
+        if let Err(error) = init_syslog(&config, pid) {
+            log::error!("Unable to initialize syslog. Is the syslog daemon running?");
+            return Err(error);
+        }
+    } else {
+        init_from_env(Env::default().filter_or(DEFAULT_FILTER_ENV, "info"));
+    }
+
+    if let Some(pre_up) = &config.pre_up {
+        log::info!("Executing specified pre-up command: {pre_up}");
+        execute_command(pre_up)?;
+    }
+
+    let ifname = config.ifname.clone();
+    let gateway = if config.userspace {
+        let wgapi = WGApi::<Userspace>::new(ifname)?;
+        Gateway::new(wgapi)?
+    } else {
+        #[cfg(not(target_os = "macos"))]
+        {
+            let wgapi = WGApi::<Kernel>::new(ifname)?;
+            Gateway::new(wgapi)?
+        }
+        #[cfg(target_os = "macos")]
+        {
+            eprintln!("On macOS, gateway only supports userspace WireGuard");
+            return Ok(());
+        }
+    };
+
+    // Keep track of spawned tasks.
+    let mut tasks = JoinSet::new();
+
+    // Optionally, launch HTTP server to report gateway's health.
+    if let Some(health_port) = config.health_port {
+        tasks.spawn(run_server(health_port, Arc::clone(&gateway.connected)));
+    }
+
+    // Launch statistics gathering task.
+    let gateway = Arc::new(Mutex::new(gateway));
+    tasks.spawn(run_stats(Arc::clone(&gateway), config.stats_period()));
+
+    // Launch gRPC server.
+    let gateway_server = GatewayServer::new(config.token.clone(), gateway);
+    tasks.spawn(gateway_server.start(config.clone()));
+
+    // Await the tasks.
+    while let Some(Ok(result)) = tasks.join_next().await {
+        result?;
+        log::debug!("Task ended");
+    }
+
+    if let Some(post_down) = &config.post_down {
+        log::info!("Executing specified post-down command: {post_down}");
+        execute_command(post_down)?;
+    }
+
+    Ok(())
+}
diff --git a/src/config.rs b/src/config.rs
index 4d2c2810..de9449a7 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,4 +1,4 @@
-use std::fs;
+use std::{fs::read_to_string, path::PathBuf, time::Duration};
 
 use clap::Parser;
 use serde::Deserialize;
@@ -7,10 +7,10 @@ use toml;
 use crate::error::GatewayError;
 
 #[derive(Debug, Parser, Clone, Deserialize)]
-#[clap(about = "defguard VPN gateway service")]
+#[clap(about = "Defguard VPN gateway service")]
 #[command(version)]
 pub struct Config {
-    /// Token received from defguard after completing the network wizard
+    /// Token received from Defguard after completing the network wizard
     #[arg(
         long,
         short = 't',
@@ -21,28 +21,25 @@ pub struct Config {
     pub token: String,
 
     #[arg(long, env = "DEFGUARD_GATEWAY_NAME")]
-    pub name: Option<String>,
+    pub(crate) name: Option<String>,
 
     /// defguard server gRPC endpoint URL
-    #[arg(
-        long,
-        short = 'g',
-        required_unless_present = "config_path",
-        env = "DEFGUARD_GRPC_URL",
-        default_value = ""
-    )]
-    pub grpc_url: String,
+    #[arg(long, env = "DEFGUARD_GRPC_PORT", default_value = "50066")]
+    pub(crate) grpc_port: u16,
+
+    #[arg(long, env = "DEFGUARD_GATEWAY_GRPC_CERT")]
+    pub(crate) grpc_cert: Option<String>,
+
+    #[arg(long, env = "DEFGUARD_GATEWAY_GRPC_KEY")]
+    pub(crate) grpc_key: Option<String>,
 
     /// Use userspace WireGuard implementation e.g. wireguard-go
     #[arg(long, short = 'u', env = "DEFGUARD_USERSPACE")]
     pub userspace: bool,
 
-    #[arg(long, env = "DEFGUARD_GRPC_CA")]
-    pub grpc_ca: Option<String>,
-
-    /// Defines how often (in seconds) interface statistics are sent to defguard server
+    /// Defines how often (in seconds) interface statistics are sent to Defguard server
     #[arg(long, short = 'p', env = "DEFGUARD_STATS_PERIOD", default_value = "30")]
-    pub stats_period: u64,
+    pub(crate) stats_period: u64,
 
     /// Network interface name (e.g. wg0)
     #[arg(long, short = 'i', env = "DEFGUARD_IFNAME", default_value = "wg0")]
@@ -67,7 +64,7 @@ pub struct Config {
     /// Configuration file path
     #[arg(long = "config", short)]
     #[serde(skip)]
-    config_path: Option<std::path::PathBuf>,
+    config_path: Option<PathBuf>,
 
     /// Command to run before bringing up the interface.
     #[arg(long, env = "PRE_UP")]
@@ -84,21 +81,32 @@ pub struct Config {
     /// Command to run after bringing down the interface.
     #[arg(long, env = "POST_DOWN")]
     pub post_down: Option<String>,
-    /// A HTTP port that will expose the REST HTTP gateway health status
-    /// 200 Gateway is working and is connected to CORE
-    /// 503 - gateway works but is not connected to CORE
+
+    /// HTTP port that will expose the REST HTTP gateway health status
+    /// Return codes:
+    /// * 200: gateway is working and is connected to core
+    /// * 503: gateway is working, but is not connected to core
     #[arg(long, env = "HEALTH_PORT")]
     pub health_port: Option<u16>,
 }
 
+impl Config {
+    #[must_use]
+    pub fn stats_period(&self) -> Duration {
+        Duration::from_secs(self.stats_period)
+    }
+}
+
+#[cfg(test)]
 impl Default for Config {
     fn default() -> Self {
         Self {
             token: "TOKEN".into(),
             name: None,
-            grpc_url: "http://localhost:50051".into(),
+            grpc_port: 50066,
             userspace: false,
-            grpc_ca: None,
+            grpc_cert: None,
+            grpc_key: None,
             stats_period: 15,
             ifname: "wg0".into(),
             pidfile: None,
@@ -121,7 +129,7 @@ pub fn get_config() -> Result<Config, GatewayError> {
 
     // load config from file if one was specified
     if let Some(config_path) = cli_config.config_path {
-        let config_toml = fs::read_to_string(config_path)
+        let config_toml = read_to_string(config_path)
             .map_err(|err| GatewayError::InvalidConfigFile(err.to_string()))?;
         let file_config: Config = toml::from_str(&config_toml)
             .map_err(|err| GatewayError::InvalidConfigFile(err.message().to_string()))?;
@@ -134,5 +142,5 @@ pub fn get_config() -> Result<Config, GatewayError> {
 #[test]
 fn verify_cli() {
     use clap::CommandFactory;
-    Config::command().debug_assert()
+    Config::command().debug_assert();
 }
diff --git a/src/gateway.rs b/src/gateway.rs
index 7665f617..48945e24 100644
--- a/src/gateway.rs
+++ b/src/gateway.rs
@@ -1,22 +1,20 @@
 use std::{
     collections::HashMap,
+    fs::read_to_string,
+    net::{IpAddr, Ipv4Addr, SocketAddr},
     sync::{
-        atomic::{AtomicBool, Ordering},
-        Arc,
+        atomic::{AtomicBool, AtomicU64, Ordering},
+        Arc, Mutex,
     },
     time::{Duration, SystemTime},
 };
 
 use gethostname::gethostname;
-use tokio::{
-    task::{spawn, JoinHandle},
-    time::{interval, sleep},
-};
+use tokio::{sync::mpsc, time::interval};
+use tokio_stream::wrappers::UnboundedReceiverStream;
 use tonic::{
-    codegen::InterceptedService,
-    metadata::MetadataValue,
-    transport::{Certificate, Channel, ClientTlsConfig, Endpoint},
-    Request, Status, Streaming,
+    transport::{Identity, Server, ServerTlsConfig},
+    Request, Response, Status, Streaming,
 };
 
 use crate::{
@@ -24,195 +22,40 @@ use crate::{
     error::GatewayError,
     execute_command, mask,
     proto::{
-        gateway_service_client::GatewayServiceClient, stats_update::Payload, update, Configuration,
-        ConfigurationRequest, Peer, StatsUpdate, Update,
+        core_request, core_response, gateway_server, update, Configuration, ConfigurationRequest,
+        CoreRequest, CoreResponse, Update, UpdateType,
     },
+    state::InterfaceConfiguration,
     VERSION,
 };
-use defguard_wireguard_rs::{WGApi, WireguardInterfaceApi};
-
-const TEN_SECS: Duration = Duration::from_secs(10);
-
-// helper struct which stores just the interface config without peers
-#[derive(Clone, PartialEq)]
-struct InterfaceConfiguration {
-    name: String,
-    prvkey: String,
-    address: String,
-    port: u32,
-}
-
-impl From<Configuration> for InterfaceConfiguration {
-    fn from(config: Configuration) -> Self {
-        Self {
-            name: config.name,
-            prvkey: config.prvkey,
-            address: config.address,
-            port: config.port,
-        }
-    }
-}
+use defguard_wireguard_rs::WireguardInterfaceApi;
 
-type Pubkey = String;
+type ClientMap = HashMap<SocketAddr, mpsc::UnboundedSender<Result<CoreRequest, Status>>>;
 
 pub struct Gateway {
-    config: Config,
     interface_configuration: Option<InterfaceConfiguration>,
-    peers: HashMap<Pubkey, Peer>,
-    wgapi: WGApi,
+    wgapi: Box<dyn WireguardInterfaceApi + Send + Sync + 'static>,
     pub connected: Arc<AtomicBool>,
-    stats_thread_handle: Option<JoinHandle<()>>,
+    // TODO: allow only one client.
+    pub(super) clients: ClientMap,
 }
 
 impl Gateway {
-    pub fn new(config: Config) -> Result<Self, GatewayError> {
-        let wgapi = WGApi::new(config.ifname.clone(), config.userspace)?;
+    pub fn new(
+        wgapi: impl WireguardInterfaceApi + Send + Sync + 'static,
+    ) -> Result<Self, GatewayError> {
         Ok(Self {
-            config,
             interface_configuration: None,
-            peers: HashMap::new(),
-            wgapi,
+            wgapi: Box::new(wgapi),
             connected: Arc::new(AtomicBool::new(false)),
-            stats_thread_handle: None,
+            clients: ClientMap::new(),
         })
     }
 
-    // replace current peer map with a new list of peers
-    fn replace_peers(&mut self, new_peers: Vec<Peer>) {
-        debug!("Replacing stored peers with {} new peers", new_peers.len());
-        let peers = new_peers
-            .into_iter()
-            .map(|peer| (peer.pubkey.clone(), peer))
-            .collect();
-        self.peers = peers;
-    }
-
-    // check if new received configuration is different than current one
-    fn is_config_changed(
-        &self,
-        new_interface_configuration: &InterfaceConfiguration,
-        new_peers: &[Peer],
-    ) -> bool {
-        if let Some(current_configuration) = self.interface_configuration.clone() {
-            return current_configuration != *new_interface_configuration
-                || self.is_peer_list_changed(new_peers);
-        }
-        true
-    }
-
-    // check if new peers are the same as the stored ones
-    fn is_peer_list_changed(&self, new_peers: &[Peer]) -> bool {
-        // check if number of peers is different
-        if self.peers.len() != new_peers.len() {
-            return true;
-        }
-
-        // check if all pubkeys are the same
-        if !new_peers
-            .iter()
-            .map(|peer| &peer.pubkey)
-            .all(|k| self.peers.contains_key(k))
-        {
-            return true;
-        }
-
-        // check if all IPs are the same
-        if !new_peers
-            .iter()
-            .all(|peer| match self.peers.get(&peer.pubkey) {
-                Some(p) => peer.allowed_ips == p.allowed_ips,
-                None => false,
-            })
-        {
-            return true;
-        }
-        false
-    }
-
-    /// Starts tokio thread collecting stats and sending them to backend service via gRPC.
-    fn spawn_stats_thread(
-        &mut self,
-        mut client: GatewayServiceClient<
-            InterceptedService<
-                Channel,
-                impl Fn(Request<()>) -> Result<Request<()>, Status> + Send + Sync + 'static,
-            >,
-        >,
-    ) {
-        // Create an async stream that periodically yields WireGuard interface statistics.
-        let period = Duration::from_secs(self.config.stats_period);
-        let ifname = self.config.ifname.clone();
-        let userspace = self.config.userspace;
-        let stats_stream = async_stream::stream! {
-            let wgapi = WGApi::new(ifname, userspace).expect(
-                "Failed to initialize WireGuard interface API, interface name: {ifname}, userspace: {userspace}"
-            );
-            // helper map to track if peer data is actually changing
-            // and avoid sending duplicate stats
-            let mut peer_map = HashMap::new();
-            let mut interval = interval(period);
-            let mut id = 1;
-            loop {
-                // wait till next iteration
-                interval.tick().await;
-                let mut peer_stats_sent = false;
-
-                debug!("Sending active peer stats update.");
-                match wgapi.read_interface_data() {
-                    Ok(host) => {
-                        let peers = host.peers;
-                        debug!("Found {} peers configured on WireGuard interface", peers.len());
-                        for peer in peers
-                            .into_values()
-                            .filter(|p| p.last_handshake.map_or(
-                                false,
-                                |lhs| lhs != SystemTime::UNIX_EPOCH)
-                            ) {
-                                let has_changed = match peer_map.get(&peer.public_key) {
-                                    Some(last_peer) => *last_peer != peer,
-                                    None => true,
-                                };
-                                if has_changed {
-                                    peer_map.insert(peer.public_key.clone(), peer.clone());
-                                    id += 1;
-                                    yield StatsUpdate {
-                                        id,
-                                        payload: Some(Payload::PeerStats((&peer).into())),
-                                    };
-                                    peer_stats_sent = true;
-                                };
-                                debug!("Stats for peer {} have not changed. Skipping...", peer.public_key);
-                            }
-                    },
-                    Err(err) => error!("Failed to retrieve WireGuard interface stats {err}"),
-                }
-
-                if !peer_stats_sent {
-                    id += 1;
-                    yield StatsUpdate {
-                        id,
-                        payload: Some(Payload::Empty(()))
-                    };
-                    debug!("Sent empty stats message.");
-                }
-            }
-        };
-        debug!("Spawning stats thread");
-        // Spawn the thread
-        self.stats_thread_handle = Some(spawn(async move {
-            let status = client.stats(Request::new(stats_stream)).await;
-            match status {
-                Ok(_) => info!("Stats thread terminated successfully."),
-                Err(err) => error!("Stats thread terminated with error: {err}"),
-            }
-        }));
-        info!("Stats thread spawned.");
-    }
-
-    /// Performs complete interface reconfiguration based on `configuration` object.
-    /// Called when gateway (re)connects to GRPC endpoint and retrieves complete
+    /// Performs complete interface reconfiguration based on `Configuration` object.
+    /// Called when gateway (re)connects to gRPC endpoint and retrieves complete
     /// network and peers data.
-    fn configure(&mut self, new_configuration: Configuration) -> Result<(), GatewayError> {
+    fn configure(&mut self, new_configuration: Configuration) {
         debug!(
             "Received configuration, reconfiguring WireGuard interface {} (address: {})",
             new_configuration.name, new_configuration.address
@@ -223,379 +66,297 @@ impl Gateway {
         );
 
         // check if new configuration is different than current one
-        let new_interface_configuration = new_configuration.clone().into();
-        if !self.is_config_changed(&new_interface_configuration, &new_configuration.peers) {
-            debug!("Received configuration is identical to current one. Skipping interface reconfiguration");
-            return Ok(());
-        };
+        if let Some(if_config) = &self.interface_configuration {
+            if if_config.same_as(&new_configuration) {
+                debug!("Received configuration is identical to current one. Skipping interface reconfiguration.");
+                return;
+            }
+        }
 
-        self.wgapi
-            .configure_interface(&new_configuration.clone().into())?;
-        info!(
-            "Reconfigured WireGuard interface {} (address: {})",
-            new_configuration.name, new_configuration.address
-        );
-        trace!(
-            "Reconfigured WireGuard interface. Configuration: {:?}",
-            mask!(new_configuration, prvkey)
-        );
+        match self
+            .wgapi
+            .configure_interface(&new_configuration.clone().into())
+        {
+            Ok(()) => {
+                info!(
+                    "Reconfigured WireGuard interface {} (address: {})",
+                    new_configuration.name, new_configuration.address
+                );
+                trace!(
+                    "Reconfigured WireGuard interface. Configuration: {:?}",
+                    mask!(new_configuration, prvkey)
+                );
+            }
+            Err(err) => error!("Failed to configure WireGuard interface: {err}"),
+        }
 
-        // store new configuration and peers
-        self.interface_configuration = Some(new_interface_configuration);
-        self.replace_peers(new_configuration.peers);
+        self.interface_configuration = Some(new_configuration.into());
+    }
 
-        Ok(())
+    /// Send message to all connected clients.
+    pub fn broadcast_to_clients(&self, message: &CoreRequest) {
+        for (addr, tx) in &self.clients {
+            if tx.send(Ok(message.clone())).is_err() {
+                debug!("Failed to send message to {addr}");
+            }
+        }
     }
 
-    /// Continuously tries to connect to GRPC endpoint. Once the connection is established
-    /// configures the interface, starts the stats thread, connects and returns the updates stream
-    async fn connect(
-        &mut self,
-        mut client: GatewayServiceClient<
-            InterceptedService<
-                Channel,
-                impl Fn(Request<()>) -> Result<Request<()>, Status> + Clone + Send + Sync + 'static,
-            >,
-        >,
-    ) -> Result<Streaming<Update>, GatewayError> {
-        // set diconnected if we are in this function and drop mutex
-        self.connected.store(false, Ordering::Relaxed);
-        loop {
-            debug!(
-                "Connecting to defguard gRPC endpoint: {}",
-                self.config.grpc_url
-            );
-            let (response, stream) = {
-                let response = client
-                    .config(ConfigurationRequest {
-                        name: self.config.name.clone(),
-                    })
-                    .await;
-                let stream = client.updates(()).await;
-                (response, stream)
-            };
-            match (response, stream) {
-                (Ok(response), Ok(stream)) => {
-                    if let Err(err) = self.configure(response.into_inner()) {
-                        error!("Interface configuration failed: {err}");
-                        continue;
+    fn handle_update(&mut self, update: Update) {
+        debug!("Received update: {update:?}");
+        match update.update {
+            Some(update::Update::Network(configuration)) => {
+                self.configure(configuration);
+            }
+            Some(update::Update::Peer(peer_config)) => {
+                if let Some(if_config) = &mut self.interface_configuration {
+                    debug!("Applying peer configuration: {peer_config:?}");
+
+                    if update.update_type == UpdateType::Delete as i32 {
+                        debug!("Deleting peer {peer_config:?}");
+                        if_config.peers.remove(&peer_config.pubkey);
+                        if let Err(err) = self.wgapi.remove_peer(
+                            &peer_config.pubkey.as_str().try_into().unwrap_or_default(),
+                        ) {
+                            error!("Failed to delete peer: {err}");
+                        }
                     }
-                    if self
-                        .stats_thread_handle
-                        .as_ref()
-                        .is_some_and(|handle| !handle.is_finished())
-                    {
-                        debug!("Stats thread already running. Not starting a new one.");
-                    } else {
-                        self.spawn_stats_thread(client);
+                    // UpdateType::Create, UpdateType::Modify
+                    else {
+                        debug!(
+                            "Updating peer {peer_config:?}, update type: {}",
+                            update.update_type
+                        );
+                        if_config
+                            .peers
+                            .insert(peer_config.pubkey.clone(), peer_config.clone());
+                        if let Err(err) = self.wgapi.configure_peer(&peer_config.into()) {
+                            error!("Failed to update peer: {err}");
+                        }
                     }
-                    info!(
-                        "Connected to defguard gRPC endpoint: {}",
-                        self.config.grpc_url
-                    );
-                    self.connected.store(true, Ordering::Relaxed);
-                    break Ok(stream.into_inner());
-                }
-                (Err(err), _) => {
-                    error!("Couldn't retrieve gateway configuration from the core. Using gRPC url: {}. Retrying in 10s. Error: {err}",
-                    self.config.grpc_url);
-                }
-                (_, Err(err)) => {
-                    error!("Couldn't establish streaming connection to the core. Using gRPC url: {}. Retrying in 10s. Error: {err}",
-                    self.config.grpc_url);
+                } else {
+                    error!("Peer modification request failed: current interface configuration is empty");
                 }
             }
-            sleep(TEN_SECS).await;
+            _ => warn!("Unsupported kind of update: {update:?}"),
         }
     }
+}
 
-    fn setup_client(
-        &self,
-    ) -> Result<
-        GatewayServiceClient<
-            InterceptedService<
-                Channel,
-                impl Fn(Request<()>) -> Result<Request<()>, Status> + Clone + Send + Sync + 'static,
-            >,
-        >,
-        GatewayError,
-    > {
-        debug!("Preparing gRPC client configuration");
-        let endpoint = Endpoint::from_shared(self.config.grpc_url.clone())?;
-        let endpoint = endpoint
-            .http2_keep_alive_interval(TEN_SECS)
-            .tcp_keepalive(Some(TEN_SECS))
-            .keep_alive_while_idle(true);
-        // if CA certificate is provided, use it (and only it)
-        // otherwise load certs from system
-        let endpoint = if let Some(ca) = &self.config.grpc_ca {
-            let ca = std::fs::read_to_string(ca)?;
-            let tls = ClientTlsConfig::new().ca_certificate(Certificate::from_pem(ca));
-            endpoint.tls_config(tls)?
-        } else {
-            endpoint.tls_config(ClientTlsConfig::new().with_native_roots())?
-        };
-        let channel = endpoint.connect_lazy();
+pub struct GatewayServer {
+    auth_token: String,
+    message_id: AtomicU64,
+    gateway: Arc<Mutex<Gateway>>,
+}
 
-        let token = MetadataValue::try_from(&self.config.token)?;
-        let hostname = gethostname()
-            .into_string()
-            .expect("Unable to get current hostname during gRPC connection setup.");
-        debug!("Using hostname: {hostname}");
-        let hostname = MetadataValue::try_from(hostname).unwrap();
-        let jwt_auth_interceptor = move |mut req: Request<()>| -> Result<Request<()>, Status> {
-            req.metadata_mut().insert("authorization", token.clone());
-            req.metadata_mut().insert("hostname", hostname.clone());
-            Ok(req)
-        };
-        let client = GatewayServiceClient::with_interceptor(channel, jwt_auth_interceptor);
-        debug!("gRPC client configuration done");
-        Ok(client)
+impl GatewayServer {
+    #[must_use]
+    pub fn new(auth_token: String, gateway: Arc<Mutex<Gateway>>) -> Self {
+        Self {
+            auth_token,
+            message_id: AtomicU64::new(0),
+            gateway,
+        }
     }
 
     /// Starts the gateway process.
-    /// * Retrieves configuration and configuration updates from defguard gRPC server
+    /// * Retrieves configuration and configuration updates from Defguard gRPC server
     /// * Manages the interface according to configuration and updates
-    /// * Sends interface statistics to defguard server periodically
-    pub async fn start(&mut self) -> Result<(), GatewayError> {
+    /// * Sends interface statistics to Defguard server periodically
+    pub async fn start(self, config: Config) -> Result<(), GatewayError> {
         info!(
-            "Starting defguard gateway version {VERSION} with configuration: {:?}",
-            mask!(self.config, token)
+            "Starting Defguard gateway version {VERSION} with configuration: {:?}",
+            mask!(config, token)
         );
 
-        let client = self.setup_client()?;
-
-        let wgapi = WGApi::new(self.config.ifname.clone(), self.config.userspace)?;
-
         // Try to create network interface for WireGuard.
         // FIXME: check if the interface already exists, or somehow be more clever.
-        if let Err(err) = wgapi.create_interface() {
+        if let Err(err) = self.gateway.lock().unwrap().wgapi.create_interface() {
             warn!(
                 "Couldn't create network interface {}: {err}. Proceeding anyway.",
-                self.config.ifname
+                config.ifname
             );
         }
 
-        info!(
-            "Trying to connect to {} and obtain the gateway configuration from defguard...",
-            self.config.grpc_url
-        );
-        let mut updates_stream = self.connect(client.clone()).await?;
-        if let Some(post_up) = &self.config.post_up {
-            debug!("Executing specified POST_UP command: {post_up}");
+        // self.get_config();
+        if let Some(post_up) = &config.post_up {
+            debug!("Executing specified post-up command: {post_up}");
             execute_command(post_up)?;
         }
-        loop {
-            match updates_stream.message().await {
-                Ok(Some(update)) => {
-                    debug!("Received update: {update:?}");
-                    match update.update {
-                        Some(update::Update::Network(configuration)) => {
-                            if let Err(err) = self.configure(configuration) {
-                                error!("Failed to update network configuration: {err}");
-                            }
-                        }
-                        Some(update::Update::Peer(peer_config)) => {
-                            debug!("Applying peer configuration: {peer_config:?}");
-                            // UpdateType::Delete
-                            if update.update_type == 2 {
-                                debug!("Deleting peer {peer_config:?}");
-                                self.peers.remove(&peer_config.pubkey);
-                                if let Err(err) = wgapi.remove_peer(
-                                    &peer_config.pubkey.as_str().try_into().unwrap_or_default(),
-                                ) {
-                                    error!("Failed to delete peer: {err}");
-                                }
-                            }
-                            // UpdateType::Create, UpdateType::Modify
-                            else {
-                                debug!(
-                                    "Updating peer {peer_config:?}, update type: {}",
-                                    update.update_type
-                                );
-                                self.peers
-                                    .insert(peer_config.pubkey.clone(), peer_config.clone());
-                                if let Err(err) = wgapi.configure_peer(&peer_config.into()) {
-                                    error!("Failed to update peer: {err}");
-                                }
-                            };
-                        }
-                        _ => warn!("Unsupported kind of update: {update:?}"),
-                    }
-                }
-                Ok(None) => {
-                    warn!("Received empty message, reconnecting");
-                    updates_stream = self.connect(client.clone()).await?;
-                }
-                Err(err) => {
-                    error!(
-                        "Disconnected from defguard gRPC endoint: {:?}",
-                        self.config.grpc_url
-                    );
-                    error!("Server error {err}, reconnecting");
-                    updates_stream = self.connect(client.clone()).await?;
-                }
-            }
-        }
-    }
-}
 
-#[cfg(test)]
-mod tests {
-    use crate::{
-        config::Config,
-        gateway::{Gateway, InterfaceConfiguration},
-        proto::Peer,
-    };
-    use defguard_wireguard_rs::WGApi;
-    use std::sync::{atomic::AtomicBool, Arc};
-
-    #[test]
-    fn test_configuration_comparison() {
-        let old_config = InterfaceConfiguration {
-            name: "gateway".to_string(),
-            prvkey: "FGqcPuaSlGWC2j50TBA4jHgiefPgQQcgTNLwzKUzBS8=".to_string(),
-            address: "10.6.1.1/24".to_string(),
-            port: 50051,
+        // Optionally, read gRPC TLS certificate and key.
+        debug!("Configuring certificates for gRPC");
+        let grpc_cert = config
+            .grpc_cert
+            .as_ref()
+            .and_then(|path| read_to_string(path).ok());
+        let grpc_key = config
+            .grpc_key
+            .as_ref()
+            .and_then(|path| read_to_string(path).ok());
+        debug!("Configured certificates for gRPC, cert: {grpc_cert:?}");
+
+        // Build gRPC server.
+        let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), config.grpc_port);
+        info!("gRPC server is listening on {addr}");
+        let mut builder = if let (Some(cert), Some(key)) = (grpc_cert, grpc_key) {
+            let identity = Identity::from_pem(cert, key);
+            Server::builder().tls_config(ServerTlsConfig::new().identity(identity))?
+        } else {
+            Server::builder()
         };
 
-        let old_peers = vec![
-            Peer {
-                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
-                allowed_ips: vec!["10.6.1.2/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-            Peer {
-                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
-                allowed_ips: vec!["10.6.1.3/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-        ];
-        let old_peers_map = old_peers
-            .clone()
-            .into_iter()
-            .map(|peer| (peer.pubkey.clone(), peer))
-            .collect();
+        // Start gRPC server. This should run indefinitely.
+        debug!("Serving gRPC");
+        builder
+            .add_service(gateway_server::GatewayServer::new(self))
+            .serve(addr)
+            .await?;
 
-        let gateway = Gateway {
-            config: Config::default(),
-            interface_configuration: Some(old_config.clone()),
-            peers: old_peers_map,
-            wgapi: WGApi::new("wg0".into(), false).unwrap(),
-            connected: Arc::new(AtomicBool::new(false)),
-            stats_thread_handle: None,
-        };
+        Ok(())
+    }
+}
 
-        // new config is the same
-        let new_config = old_config.clone();
-        let new_peers = old_peers.clone();
-        assert!(!gateway.is_config_changed(&new_config, &new_peers));
+#[tonic::async_trait]
+impl gateway_server::Gateway for GatewayServer {
+    type BidiStream = UnboundedReceiverStream<Result<CoreRequest, Status>>;
 
-        // only interface config is different
-        let new_config = InterfaceConfiguration {
-            name: "gateway".to_string(),
-            prvkey: "FGqcPuaSlGWC2j50TBA4jHgiefPgQQcgTNLwzKUzBS8=".to_string(),
-            address: "10.6.1.2/24".to_string(),
-            port: 50051,
+    /// Handle bidirectional communication with Defguard core.
+    async fn bidi(
+        &self,
+        request: Request<Streaming<CoreResponse>>,
+    ) -> Result<Response<Self::BidiStream>, Status> {
+        let Some(address) = request.remote_addr() else {
+            error!("Failed to determine client address for request: {request:?}");
+            return Err(Status::internal("Failed to determine client address"));
         };
-        let new_peers = old_peers.clone();
-        assert!(gateway.is_config_changed(&new_config, &new_peers));
+        info!("Defguard core gRPC client connected from {address}");
+
+        let (tx, rx) = mpsc::unbounded_channel();
+        // First, send configuration request
+        if let Ok(hostname) = gethostname().into_string() {
+            let payload = ConfigurationRequest {
+                auth_token: self.auth_token.clone(),
+                hostname,
+            };
+            let req = CoreRequest {
+                id: self.message_id.fetch_add(1, Ordering::Relaxed),
+                payload: Some(core_request::Payload::ConfigRequest(payload)),
+            };
 
-        // peer was removed
-        let new_config = old_config.clone();
-        let mut new_peers = old_peers.clone();
-        new_peers.pop();
+            match tx.send(Ok(req)) {
+                Ok(()) => info!("Requesting network configuration from {address}"),
+                Err(err) => {
+                    error!("Unable to send network configuration request to {address}: {err}");
+                    return Err(Status::internal("failed to send configuration request"));
+                }
+            }
+        } else {
+            error!("Unable to get hostname");
+            return Err(Status::internal("failed to get hostname"));
+        }
 
-        assert!(gateway.is_config_changed(&new_config, &new_peers));
+        self.gateway.lock().unwrap().clients.insert(address, tx);
 
-        // peer was added
-        let new_config = old_config.clone();
-        let mut new_peers = old_peers.clone();
-        new_peers.push(Peer {
-            pubkey: "VOCXuGWKz3PcdFba8pl7bFO/W4OG8sPet+w9Eb1LECk=".to_string(),
-            allowed_ips: vec!["10.6.1.4/24".to_string()],
-            preshared_key: None,
-            keepalive_interval: None,
+        let gateway = Arc::clone(&self.gateway);
+        let mut stream = request.into_inner();
+        tokio::spawn(async move {
+            loop {
+                match stream.message().await {
+                    Ok(Some(response)) => {
+                        debug!("Received message from Defguard core: {response:?}");
+                        // Discard empty payloads.
+                        if let Some(payload) = response.payload {
+                            match payload {
+                                core_response::Payload::Config(configuration) => {
+                                    match gateway.lock() {
+                                        Ok(mut gw) => {
+                                            gw.connected.store(true, Ordering::Relaxed);
+                                            gw.configure(configuration);
+                                        }
+                                        Err(err) => error!("Lock failed: {err}"),
+                                    }
+                                }
+                                core_response::Payload::Update(update) => match gateway.lock() {
+                                    Ok(mut gw) => {
+                                        gw.handle_update(update);
+                                    }
+                                    Err(err) => error!("Lock failed: {err}"),
+                                },
+                                core_response::Payload::Empty(()) => (),
+                            }
+                        }
+                    }
+                    Ok(None) => {
+                        info!("gRPC stream from Defguard core has been closed");
+                        break;
+                    }
+                    Err(err) => {
+                        error!("gRPC stream from Defguard core failed with error: {err}");
+                        break;
+                    }
+                }
+            }
+            info!("Defguard core gRPC stream has been disconnected: {address}");
+            gateway
+                .lock()
+                .unwrap()
+                .connected
+                .store(false, Ordering::Relaxed);
+            gateway.lock().unwrap().clients.remove(&address);
         });
 
-        assert!(gateway.is_config_changed(&new_config, &new_peers));
-
-        // peer pubkey changed
-        let new_config = old_config.clone();
-        let new_peers = vec![
-            Peer {
-                pubkey: "VOCXuGWKz3PcdFba8pl7bFO/W4OG8sPet+w9Eb1LECk=".to_string(),
-                allowed_ips: vec!["10.6.1.2/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-            Peer {
-                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
-                allowed_ips: vec!["10.6.1.3/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-        ];
-
-        assert!(gateway.is_config_changed(&new_config, &new_peers));
-
-        // peer IP changed
-        let new_config = old_config.clone();
-        let new_peers = vec![
-            Peer {
-                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
-                allowed_ips: vec!["10.6.1.2/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-            Peer {
-                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
-                allowed_ips: vec!["10.6.1.4/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-        ];
-
-        assert!(gateway.is_config_changed(&new_config, &new_peers));
-
-        // peer preshared key changed
-        let new_config = old_config.clone();
-        let new_peers = vec![
-            Peer {
-                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
-                allowed_ips: vec!["10.6.1.2/24".to_string()],
-                preshared_key: Some("VGhpc2lzdGhlcGFzc3dvcmQzMWNoYXJhY3RlcnNsbwo=".into()),
-                keepalive_interval: None,
-            },
-            Peer {
-                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
-                allowed_ips: vec!["10.6.1.4/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-        ];
-
-        assert!(gateway.is_config_changed(&new_config, &new_peers));
-
-        // peer keepalive interval changed
-        let new_config = old_config.clone();
-        let new_peers = vec![
-            Peer {
-                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
-                allowed_ips: vec!["10.6.1.2/24".to_string()],
-                preshared_key: Some("VGhpc2lzdGhlcGFzc3dvcmQzMWNoYXJhY3RlcnNsbwo=".into()),
-                keepalive_interval: Some(15),
-            },
-            Peer {
-                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
-                allowed_ips: vec!["10.6.1.4/24".to_string()],
-                preshared_key: None,
-                keepalive_interval: None,
-            },
-        ];
+        Ok(Response::new(UnboundedReceiverStream::new(rx)))
+    }
+}
 
-        assert!(gateway.is_config_changed(&new_config, &new_peers));
+/// Gather WireGuard statistics and send them to core via gRPC.
+pub async fn run_stats(gateway: Arc<Mutex<Gateway>>, period: Duration) -> Result<(), GatewayError> {
+    // Helper map to track if peer data is actually changing to avoid sending duplicate stats.
+    let mut peer_map = HashMap::new();
+    let mut interval = interval(period);
+    let mut id = 1;
+    loop {
+        // Wait until next iteration.
+        interval.tick().await;
+
+        debug!("Obtaining peer statistics from WireGuard");
+        let result = gateway.lock().unwrap().wgapi.read_interface_data();
+        match result {
+            Ok(host) => {
+                let peers = host.peers;
+                debug!(
+                    "Found {} peers configured on WireGuard interface",
+                    peers.len()
+                );
+                // Filter out never connected peers.
+                for peer in peers.into_values().filter(|p| {
+                    p.last_handshake
+                        .map_or(false, |last_hs| last_hs != SystemTime::UNIX_EPOCH)
+                }) {
+                    let has_changed = match peer_map.get(&peer.public_key) {
+                        Some(last_peer) => *last_peer != peer,
+                        None => true,
+                    };
+                    if has_changed {
+                        peer_map.insert(peer.public_key.clone(), peer.clone());
+                        let payload = core_request::Payload::PeerStats((&peer).into());
+                        let message = CoreRequest {
+                            id,
+                            payload: Some(payload),
+                        };
+                        id += 1;
+                        gateway.lock().unwrap().broadcast_to_clients(&message);
+                        debug!("Sent statistics for peer {}", peer.public_key);
+                    } else {
+                        debug!(
+                            "Statistics for peer {} have not changed. Skipping.",
+                            peer.public_key
+                        );
+                    }
+                }
+            }
+            Err(err) => error!("Failed to retrieve WireGuard interface statistics: {err}"),
+        }
     }
 }
diff --git a/src/lib.rs b/src/lib.rs
index 1c9e79cf..6f73cde5 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,11 +1,11 @@
 pub mod config;
 pub mod error;
 pub mod gateway;
-pub mod server;
-
 pub mod proto {
     tonic::include_proto!("gateway");
 }
+pub mod server;
+mod state;
 
 #[macro_use]
 extern crate log;
@@ -17,7 +17,7 @@ use defguard_wireguard_rs::{host::Peer, net::IpAddrMask, InterfaceConfiguration}
 use error::GatewayError;
 use syslog::{BasicLogger, Facility, Formatter3164};
 
-pub static VERSION: &str = env!("CARGO_PKG_VERSION");
+const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), "-", env!("VERGEN_GIT_SHA"));
 
 /// Masks object's field with "***" string.
 /// Used to log sensitive/secret objects.
@@ -53,19 +53,18 @@ pub fn execute_command(command: &str) -> Result<(), GatewayError> {
             .args(command_parts)
             .output()?;
 
+        let stderr = String::from_utf8_lossy(&output.stderr);
         if output.status.success() {
             let stdout = String::from_utf8_lossy(&output.stdout);
-            let stderr = String::from_utf8_lossy(&output.stderr);
 
             info!(
-                "Postup command {} executed successfully. Stdout: {}",
+                "Post-up command {} executed successfully. Stdout: {}",
                 command, stdout
             );
             if !stderr.is_empty() {
                 error!("Stderr:\n{stderr}");
             }
         } else {
-            let stderr = String::from_utf8_lossy(&output.stderr);
             error!("Error executing command. Stderr:\n{stderr}");
         }
     }
diff --git a/src/main.rs b/src/main.rs
deleted file mode 100644
index 7bbf058a..00000000
--- a/src/main.rs
+++ /dev/null
@@ -1,56 +0,0 @@
-use std::{fs::File, io::Write, process, sync::Arc};
-
-use env_logger::{init_from_env, Env, DEFAULT_FILTER_ENV};
-use tokio::task::JoinSet;
-
-use defguard_gateway::{
-    config::get_config, error::GatewayError, execute_command, gateway::Gateway, init_syslog,
-    server::run_server,
-};
-
-#[tokio::main]
-async fn main() -> Result<(), GatewayError> {
-    // parse config
-    let config = get_config()?;
-
-    // setup pidfile
-    let pid = process::id();
-
-    if let Some(pidfile) = &config.pidfile {
-        let mut file = File::create(pidfile)?;
-        file.write_all(pid.to_string().as_bytes())?;
-    }
-
-    // setup logging
-    if config.use_syslog {
-        if let Err(error) = init_syslog(&config, pid) {
-            log::error!("Unable to initialize syslog. Is the syslog daemon running?");
-            return Err(error);
-        }
-    } else {
-        init_from_env(Env::default().filter_or(DEFAULT_FILTER_ENV, "info"));
-    }
-
-    if let Some(pre_up) = &config.pre_up {
-        log::info!("Executing specified PRE_UP command: {pre_up}");
-        execute_command(pre_up)?;
-    }
-
-    let mut gateway = Gateway::new(config.clone())?;
-
-    let mut tasks = JoinSet::new();
-    if let Some(health_port) = config.health_port {
-        tasks.spawn(run_server(health_port, Arc::clone(&gateway.connected)));
-    }
-    tasks.spawn(async move { gateway.start().await });
-    while let Some(Ok(result)) = tasks.join_next().await {
-        result?;
-    }
-
-    if let Some(post_down) = &config.post_down {
-        log::info!("Executing specified POST_DOWN command: {post_down}");
-        execute_command(post_down)?;
-    }
-
-    Ok(())
-}
diff --git a/src/state.rs b/src/state.rs
new file mode 100644
index 00000000..080f2128
--- /dev/null
+++ b/src/state.rs
@@ -0,0 +1,200 @@
+use std::collections::HashMap;
+
+use crate::proto::{Configuration, Peer};
+
+type PubKey = String;
+
+/// Helper struct which stores interface configuration.
+#[cfg_attr(test, derive(Clone))]
+pub(crate) struct InterfaceConfiguration {
+    name: String,
+    prvkey: String,
+    address: String,
+    port: u32,
+    pub(crate) peers: HashMap<PubKey, Peer>,
+}
+
+impl InterfaceConfiguration {
+    /// Check if the configuraion stored in this struct is different from `Configuration` from protos.
+    pub(crate) fn same_as(&self, other: &Configuration) -> bool {
+        self.name == other.name
+            && self.prvkey == other.prvkey
+            && self.address == other.address
+            && self.port == other.port
+            && !self.is_peer_list_changed(&other.peers)
+    }
+
+    /// Check if new peers are the same as the ones stored in this struct.
+    fn is_peer_list_changed(&self, new_peers: &[Peer]) -> bool {
+        // check if number of peers is different
+        // FIXME: this assumes there aren't any duplicates
+        if self.peers.len() != new_peers.len() {
+            return true;
+        }
+
+        // check if all public keys are equal
+        if !new_peers
+            .iter()
+            .map(|peer| &peer.pubkey)
+            .all(|k| self.peers.contains_key(k))
+        {
+            return true;
+        }
+
+        // check if all IP addresses are equal
+        !new_peers
+            .iter()
+            .all(|peer| match self.peers.get(&peer.pubkey) {
+                Some(p) => peer.allowed_ips == p.allowed_ips,
+                None => false,
+            })
+    }
+}
+
+impl From<Configuration> for InterfaceConfiguration {
+    fn from(config: Configuration) -> Self {
+        Self {
+            name: config.name,
+            prvkey: config.prvkey,
+            address: config.address,
+            port: config.port,
+            peers: config
+                .peers
+                .into_iter()
+                .map(|peer| (peer.pubkey.clone(), peer))
+                .collect(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_configuration_comparison() {
+        let peers = vec![
+            Peer {
+                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
+                allowed_ips: vec!["10.6.1.2/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+            Peer {
+                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
+                allowed_ips: vec!["10.6.1.3/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+        ];
+        let config = Configuration {
+            name: "gateway".to_string(),
+            prvkey: "FGqcPuaSlGWC2j50TBA4jHgiefPgQQcgTNLwzKUzBS8=".to_string(),
+            address: "10.6.1.1/24".to_string(),
+            port: 50051,
+            peers: peers.clone(),
+        };
+
+        // new config is the same
+        let old_config: InterfaceConfiguration = config.clone().into();
+        assert!(old_config.same_as(&config));
+
+        // only interface config is different
+        let new_config = Configuration {
+            name: "gateway".to_string(),
+            prvkey: "FGqcPuaSlGWC2j50TBA4jHgiefPgQQcgTNLwzKUzBS8=".to_string(),
+            address: "10.6.1.2/24".to_string(),
+            port: 50051,
+            peers,
+        };
+        assert!(!old_config.same_as(&new_config));
+
+        // remove one peer
+        let mut new_config = config.clone();
+        new_config.peers.pop();
+        assert!(!old_config.same_as(&new_config));
+
+        // peer was added
+        let mut new_config = config.clone();
+        new_config.peers.push(Peer {
+            pubkey: "VOCXuGWKz3PcdFba8pl7bFO/W4OG8sPet+w9Eb1LECk=".to_string(),
+            allowed_ips: vec!["10.6.1.4/24".to_string()],
+            preshared_key: None,
+            keepalive_interval: None,
+        });
+        assert!(!old_config.same_as(&new_config));
+
+        // peer pubkey changed
+        let mut new_config = config.clone();
+        new_config.peers = vec![
+            Peer {
+                pubkey: "VOCXuGWKz3PcdFba8pl7bFO/W4OG8sPet+w9Eb1LECk=".to_string(),
+                allowed_ips: vec!["10.6.1.2/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+            Peer {
+                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
+                allowed_ips: vec!["10.6.1.3/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+        ];
+        assert!(!old_config.same_as(&new_config));
+
+        // peer IP address changed
+        let mut new_config = config.clone();
+        new_config.peers = vec![
+            Peer {
+                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
+                allowed_ips: vec!["10.6.1.2/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+            Peer {
+                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
+                allowed_ips: vec!["10.6.1.4/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+        ];
+        assert!(!old_config.same_as(&new_config));
+
+        // peer preshared key changed
+        let mut new_config = config.clone();
+        new_config.peers = vec![
+            Peer {
+                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
+                allowed_ips: vec!["10.6.1.2/24".to_string()],
+                preshared_key: Some("VGhpc2lzdGhlcGFzc3dvcmQzMWNoYXJhY3RlcnNsbwo=".into()),
+                keepalive_interval: None,
+            },
+            Peer {
+                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
+                allowed_ips: vec!["10.6.1.4/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+        ];
+        assert!(!old_config.same_as(&new_config));
+
+        // peer keepalive interval changed
+        let mut new_config = config.clone();
+        new_config.peers = vec![
+            Peer {
+                pubkey: "+Oj0nZZ3iVH9WvKU9gM2eajJqY0hnzN5PkI4bvblgWo=".to_string(),
+                allowed_ips: vec!["10.6.1.2/24".to_string()],
+                preshared_key: Some("VGhpc2lzdGhlcGFzc3dvcmQzMWNoYXJhY3RlcnNsbwo=".into()),
+                keepalive_interval: Some(15),
+            },
+            Peer {
+                pubkey: "m7ZxDjk4sjpzgowerQqycBvOz2n/nkswCdv24MEYVGA=".to_string(),
+                allowed_ips: vec!["10.6.1.4/24".to_string()],
+                preshared_key: None,
+                keepalive_interval: None,
+            },
+        ];
+
+        assert!(!old_config.same_as(&new_config));
+    }
+}