Merge pull request #3 from razvandimescu/feat/async-tokio

Async architecture, local service proxy, TLS, blocking panel
2026-03-21 01:38:29 +02:00
parent c74afe9450 cfd9a562af
commit e65f5a36fc
27 changed files with 3108 additions and 130 deletions
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -0,0 +1,78 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-apple-darwin
+            os: macos-latest
+            name: numa-macos-x86_64
+          - target: aarch64-apple-darwin
+            os: macos-latest
+            name: numa-macos-aarch64
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+            name: numa-linux-x86_64
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-latest
+            name: numa-linux-aarch64
+
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross-compilation tools
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+
+      - name: Build
+        run: cargo build --release --target ${{ matrix.target }}
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+
+      - name: Package
+        run: |
+          cd target/${{ matrix.target }}/release
+          tar czf ../../../${{ matrix.name }}.tar.gz numa
+          cd ../../..
+          sha256sum ${{ matrix.name }}.tar.gz > ${{ matrix.name }}.tar.gz.sha256
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.name }}
+          path: |
+            ${{ matrix.name }}.tar.gz
+            ${{ matrix.name }}.tar.gz.sha256
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          merge-multiple: true
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: |
+            *.tar.gz
+            *.sha256
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -0,0 +1,113 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+**Numa** — a portable DNS resolver with ad blocking, developer overrides, and a live dashboard. Built from scratch in Rust. Named after Numa Pompilius, the Roman king who established lasting institutions.
+
+Today: DNS forwarding/caching proxy with ad blocking, ephemeral overrides, live dashboard, and system DNS integration.
+Next: Self-sovereign DNS via pkarr/Mainline DHT.
+Vision: Incentivized resolver network with staking, challenge-based auditing, and token economics.
+
+## Build & Run
+
+```bash
+cargo build                         # compile
+sudo cargo run                      # run with default config (numa.toml)
+sudo cargo run -- path/to/config    # run with custom config path
+RUST_LOG=debug sudo cargo run       # verbose logging
+make lint                           # clippy + rustfmt check
+```
+
+Test with: `dig @127.0.0.1 google.com`
+
+CLI commands:
+```bash
+numa help                           # show all commands
+numa install                        # set system DNS to 127.0.0.1
+numa uninstall                      # restore original DNS
+numa service start                  # install as persistent service (launchd/systemd)
+numa service stop                   # uninstall service + restore DNS
+numa service status                 # check service status
+```
+
+Dashboard: http://numa.numa (or http://localhost:5380)
+
+## Architecture
+
+```
+UDP :53 ──▶ handle_query()
+              │
+              ├─ 1. Override Store (ephemeral, auto-expiry)
+              ├─ 2. .numa TLD (local service domains → 127.0.0.1)
+              ├─ 3. Blocklist (385K+ domains, subdomain matching)
+              ├─ 4. Local Zones (TOML config)
+              ├─ 5. Cache (TTL-aware, lazy eviction)
+              └─ 6. Upstream Forward (auto-detected from OS, conditional forwarding)
+
+HTTP :80   ──▶ Reverse proxy for .numa domains (WebSocket support)
+HTTPS :443 ──▶ TLS reverse proxy (auto-generated local CA + wildcard *.numa cert)
+HTTP :5380 ──▶ Axum REST API (22+ endpoints) + Dashboard
+```
+
+### Source Files
+
+```
+src/
+  main.rs           # startup: load config, bind UDP, spawn API + proxy, blocklist download, per-query task loop
+  lib.rs            # module declarations, Error/Result type aliases
+  ctx.rs            # ServerCtx shared state + handle_query() pipeline
+  api.rs            # Axum REST server (22 endpoints, port 5380) + embedded dashboard
+  config.rs         # TOML config loading with defaults (server, upstream, cache, blocking, proxy, zones)
+  proxy.rs          # HTTP/HTTPS reverse proxy for .numa domains (port 80 + 443, WebSocket upgrade)
+  tls.rs            # Local CA + wildcard cert generation (rcgen), rustls ServerConfig builder
+  service_store.rs  # ServiceStore — name-to-port mappings, persisted to ~/.config/numa/services.json
+  blocklist.rs      # BlocklistStore — HashSet<String>, download, parse, subdomain matching, check
+  override_store.rs # OverrideStore — ephemeral domain overrides with auto-expiry
+  query_log.rs      # ring buffer (VecDeque, 1000 entries) for recent queries
+  cache.rs          # DnsCache — TTL-aware, lazy eviction every 1000 lookups
+  forward.rs        # async UDP forwarding to upstream resolver
+  stats.rs          # ServerStats counters + QueryPath enum (6 categories)
+  system_dns.rs     # OS DNS discovery (scutil/resolv.conf), install/uninstall, service management
+  buffer.rs         # BytePacketBuffer — 4096-byte DNS wire format I/O
+  header.rs         # DnsHeader — 12-byte bitfield parsing/serialization
+  question.rs       # DnsQuestion + QueryType enum (A, NS, CNAME, SOA, PTR, MX, TXT, AAAA, SRV, HTTPS)
+  record.rs         # DnsRecord enum — wire format read/write per record type (filters UNKNOWN on write)
+  packet.rs         # DnsPacket — header + questions + answers + authorities + resources
+site/
+  dashboard.html    # live dashboard (embedded at compile time via include_str!)
+  index.html        # landing page (Roman Stone theme)
+```
+
+## Config
+
+`numa.toml` at project root. Sections: `[server]`, `[upstream]`, `[cache]`, `[blocking]`, `[proxy]`, `[[services]]`, `[[zones]]`. Falls back to sensible defaults if file is missing. Upstream auto-detected from system resolver if not set.
+
+## REST API
+
+Dashboard: GET `/` (embedded HTML)
+Override management: POST/GET/DELETE `/overrides`, POST `/overrides/environment`
+Services: GET/POST `/services`, DELETE `/services/{name}`
+Blocking: GET `/blocking/stats`, PUT `/blocking/toggle`, POST `/blocking/pause`, POST `/blocking/unpause`, GET/POST `/blocking/allowlist`, GET `/blocking/check/{domain}`
+Diagnostics: GET `/diagnose/{domain}`, `/query-log`, `/stats`, `/cache`, `/health`
+Cache: DELETE `/cache`, `/cache/{domain}`
+
+## Key Details
+
+- Rust 2021 edition, async via `tokio` (rt-multi-thread)
+- Deps: tokio, axum, hyper, hyper-util, serde, serde_json, toml, log, env_logger, reqwest, futures, rcgen, rustls, tokio-rustls, time (zero DNS libraries)
+- Shared config dir: `~/.config/numa/` via `config_dir()` in `lib.rs` (handles sudo correctly)
+- TLS: auto-generated local CA + wildcard `*.numa` cert at `~/.config/numa/`. `numa install` trusts CA in OS keychain.
+- Service persistence: user-added services saved to `~/.config/numa/services.json`, survives restarts
+- Deploy workflow: `make deploy` (build release → copy → codesign → kill → launchd respawns)
+- DNS buffer size: 4096 bytes (EDNS-compatible). UNKNOWN record types (e.g. OPT) filtered on serialization.
+- `BytePacketBuffer::read_qname` handles label compression (pointer jumps)
+- `type Error = Box<dyn std::error::Error + Send + Sync>` / `type Result<T>` aliased in `lib.rs`
+- Shared state via `Arc<ServerCtx>` with `std::sync::Mutex` (sub-microsecond holds, never across `.await`)
+- Cache: TTL clamped between `min_ttl` and `max_ttl`, lazy eviction every 1000 queries
+- Blocklist: parsed outside lock, swapped atomically. `is_blocked()` takes `&self` (read-only).
+- Upstream: auto-detected from `scutil --dns` (macOS) or `/etc/resolv.conf` (Linux). Falls back to Quad9.
+- Conditional forwarding: Tailscale/VPN domains auto-routed to correct upstream.
+- macOS service: launchd plist with KeepAlive + RunAtLoad. Use `launchctl bootstrap/bootout` (not load/unload).
+- Logging controlled via `RUST_LOG` env var. Default: `info`
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4

+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -61,12 +67,91 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-compression"
+version = "0.4.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0f9ee0f6e02ffd7ad5816e9464499fba7b3effd01123b515c41d1697c43dad1"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"

+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa7e52a4c5c547c741610a2c6f123f3881e409b714cd27e6798ef020c514f0a"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
 [[package]]
 name = "axum"
 version = "0.8.8"
@@ -150,6 +235,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a0dd1ca384932ff3641c8718a02769f1698e7563dc6974ffd03346116310423"
 dependencies = [
 "find-msvc-tools",
+ "jobserver",
+ "libc",
 "shlex",
 ]

@@ -165,12 +252,76 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"

+[[package]]
+name = "cmake"
+version = "0.1.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75443c44cd6b379beb8c5b45d85d0773baf31cce901fe7bb252f4eff3008ef7d"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "colorchoice"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"

+[[package]]
+name = "compression-codecs"
+version = "0.4.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb7b51a7d9c967fc26773061ba86150f19c50c0d65c887cb1fbe295fd16619b7"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d"
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -182,6 +333,12 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "env_filter"
 version = "1.0.0"
@@ -217,6 +374,16 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"

+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -226,6 +393,27 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.32"
@@ -233,6 +421,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
 "futures-core",
+ "futures-sink",
 ]

 [[package]]
@@ -241,6 +430,40 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"

+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
 [[package]]
 name = "futures-task"
 version = "0.3.32"
@@ -253,8 +476,13 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
+ "futures-channel",
 "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
 "futures-task",
+ "memchr",
 "pin-project-lite",
 "slab",
 ]
@@ -563,6 +791,16 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.91"
@@ -573,6 +811,12 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
 [[package]]
 name = "libc"
 version = "0.2.183"
@@ -615,6 +859,22 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"

+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "mio"
 version = "1.1.1"
@@ -626,20 +886,82 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "numa"
 version = "0.1.0"
 dependencies = [
 "axum",
 "env_logger",
+ "futures",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
 "log",
+ "rcgen",
 "reqwest",
+ "rustls",
+ "rustls-pemfile",
 "serde",
 "serde_json",
+ "time",
 "tokio",
+ "tokio-rustls",
 "toml",
 ]

+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -652,6 +974,16 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"

+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64",
+ "serde_core",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -694,6 +1026,12 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -726,7 +1064,7 @@ dependencies = [
 "rustc-hash",
 "rustls",
 "socket2",
- "thiserror",
+ "thiserror 2.0.18",
 "tokio",
 "tracing",
 "web-time",
@@ -747,7 +1085,7 @@ dependencies = [
 "rustls",
 "rustls-pki-types",
 "slab",
- "thiserror",
+ "thiserror 2.0.18",
 "tinyvec",
 "tracing",
 "web-time",
@@ -811,6 +1149,20 @@ dependencies = [
 "getrandom 0.3.4",
 ]

+[[package]]
+name = "rcgen"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
 [[package]]
 name = "regex"
 version = "1.12.3"
@@ -898,12 +1250,23 @@ version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"

+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
 dependencies = [
+ "aws-lc-rs",
+ "log",
 "once_cell",
 "ring",
 "rustls-pki-types",
@@ -912,6 +1275,15 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.14.0"
@@ -928,6 +1300,7 @@ version = "0.103.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
 dependencies = [
+ "aws-lc-rs",
 "ring",
 "rustls-pki-types",
 "untrusted",
@@ -1026,6 +1399,12 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"

+[[package]]
+name = "simd-adler32"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -1091,13 +1470,33 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]

 [[package]]
@@ -1111,6 +1510,37 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.2"
@@ -1172,6 +1602,19 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "toml"
 version = "0.8.23"
@@ -1235,13 +1678,18 @@ version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
+ "async-compression",
 "bitflags",
 "bytes",
+ "futures-core",
 "futures-util",
 "http",
 "http-body",
+ "http-body-util",
 "iri-string",
 "pin-project-lite",
+ "tokio",
+ "tokio-util",
 "tower",
 "tower-layer",
 "tower-service",
@@ -1616,6 +2064,33 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"

+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.1"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,4 +17,13 @@ serde_json = "1"
 toml = "0.8"
 log = "0.4"
 env_logger = "0.11"
-reqwest = { version = "0.12", features = ["rustls-tls"], default-features = false }
+reqwest = { version = "0.12", features = ["rustls-tls", "gzip"], default-features = false }
+hyper = { version = "1", features = ["client", "http1", "server"] }
+hyper-util = { version = "0.1", features = ["client-legacy", "http1", "tokio"] }
+http-body-util = "0.1"
+futures = "0.3"
+rcgen = { version = "0.13", features = ["pem", "x509-parser"] }
+time = "0.3"
+rustls = "0.23"
+tokio-rustls = "0.26"
+rustls-pemfile = "2"
--- a/10
+++ b/10
@@ -1,4 +1,4 @@
-.PHONY: all build lint fmt check test clean
+.PHONY: all build lint fmt check test clean deploy

 all: lint build

@@ -18,3 +18,11 @@ test:

 clean:
 	cargo clean
+
+deploy:
+	cargo build --release
+	sudo cp target/release/numa /usr/local/bin/numa
+	sudo codesign -f -s - /usr/local/bin/numa
+	sudo kill $$(pgrep -f /usr/local/bin/numa) 2>/dev/null || true
+	@sleep 1
+	@dig @127.0.0.1 google.com +short +time=3 > /dev/null && echo "Service restarted successfully" || echo "Warning: DNS not responding yet"
--- a/README.md
+++ b/README.md
@@ -2,14 +2,15 @@

 **DNS you own. Everywhere you go.**

-Block ads and trackers. Override DNS for development. Cache for speed. A single portable binary built from scratch in Rust — no Raspberry Pi, no cloud, no account.
+Block ads and trackers. Override DNS for development. Name your local services. Cache for speed. A single portable binary built from scratch in Rust — no Raspberry Pi, no cloud, no account.

 ## Why

 - **Ad blocking that travels with you** — 385K+ domains blocked out of the box. Works on any network: coffee shops, hotels, airports.
 - **Developer overrides** — point any hostname to any IP with auto-revert. No more editing `/etc/hosts`.
+- **Local service proxy** — access `https://frontend.numa` instead of `localhost:5173`. Auto-generated TLS certs, WebSocket support for HMR.
 - **Sub-millisecond caching** — cached lookups in 0ms. Faster than any public resolver.
- **Live dashboard** — real-time query stats, blocking controls, override management at `http://localhost:5380`.
+- **Live dashboard** — real-time query stats, blocking controls, override management, local services at `http://numa.numa` (or `localhost:5380`).
 - **Single binary, zero config** — just run it.

 ## Quick Start
@@ -32,7 +33,7 @@ docker run -p 53:53/udp -p 5380:5380 numa

 ### Try it

-Open the dashboard: **http://localhost:5380**
+Open the dashboard: **http://numa.numa** (or `http://localhost:5380`)

 ```bash
 dig @127.0.0.1 google.com           # ✓ resolves normally
@@ -59,18 +60,51 @@ curl -X POST http://localhost:5380/overrides \
 dig @127.0.0.1 api.dev              # → 127.0.0.1 (auto-reverts in 5 min)
 ```

+## Local Service Proxy
+
+Name your local dev services with `.numa` domains instead of remembering port numbers:
+
+```bash
+# Register a service via API
+curl -X POST http://localhost:5380/services \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"frontend","target_port":5173}'
+
+# Now access it by name
+open http://frontend.numa            # → proxied to localhost:5173
+```
+
+Or configure in `numa.toml`:
+```toml
+[[services]]
+name = "frontend"
+target_port = 5173
+
+[[services]]
+name = "api"
+target_port = 8000
+```
+
+- `numa.numa` is pre-configured — the dashboard itself, accessible without remembering the port
+- **HTTPS with green lock** — auto-generated local CA + per-service TLS certs. `sudo numa install` trusts the CA in your system keychain.
+- WebSocket support — Vite/webpack HMR works through the proxy
+- Health checks — dashboard shows green/red status for each service
+- Services persist across restarts (`~/.config/numa/services.json`)
+- Manage via dashboard UI or REST API
+
 ## Resolution Pipeline

 ```
-Query → Overrides → Blocklist → Local Zones → Cache → Upstream → Respond
+Query → Overrides → .numa TLD → Blocklist → Local Zones → Cache → Upstream → Respond
 ```

 1. **Overrides** — ephemeral, time-scoped redirects (highest priority)
-2. **Blocklist** — 385K+ ad/tracker domains → returns `0.0.0.0` / `::`
-3. **Local zones** — records defined in `[[zones]]` config
-4. **Cache** — TTL-adjusted cached upstream responses (sub-ms)
-5. **Forward** — query upstream resolver, cache the result
-6. **SERVFAIL** — returned on upstream failure
+2. **`.numa` TLD** — synthetic domains for local services → returns `127.0.0.1`
+3. **Blocklist** — 385K+ ad/tracker domains → returns `0.0.0.0` / `::`
+4. **Local zones** — records defined in `[[zones]]` config
+5. **Cache** — TTL-adjusted cached upstream responses (sub-ms)
+6. **Forward** — query upstream resolver, cache the result
+7. **SERVFAIL** — returned on upstream failure

 ## Dashboard

@@ -80,6 +114,7 @@ Live at `http://localhost:5380` when Numa is running:
 - Resolution path breakdown (forward / cached / local / override / blocked)
 - Scrolling query log with colored path tags
 - Active overrides with create/edit/delete
+- Local services with health status and add/remove
 - Blocking controls: toggle on/off, pause 5 minutes, one-click allowlist
 - Cached domains list

@@ -110,6 +145,15 @@ lists = [
 refresh_hours = 24
 allowlist = []

+[proxy]
+enabled = true
+port = 80
+tld = "numa"
+
+[[services]]
+name = "frontend"
+target_port = 5173
+
 [[zones]]
 domain = "mysite.local"
 record_type = "A"
@@ -119,7 +163,7 @@ ttl = 60

 ## HTTP API

-REST API on port 5380 (18 endpoints):
+REST API on port 5380 (22 endpoints):

 | Endpoint | Method | Description |
 |----------|--------|-------------|
@@ -130,12 +174,16 @@ REST API on port 5380 (18 endpoints):
 | `/overrides/environment` | POST | Batch load overrides |
 | `/overrides/{domain}` | GET | Get specific override |
 | `/overrides/{domain}` | DELETE | Remove specific override |
+| `/services` | GET | List local services (with health status) |
+| `/services` | POST | Register a local service |
+| `/services/{name}` | DELETE | Remove a local service |
 | `/blocking/stats` | GET | Blocklist stats (domains loaded, sources, enabled) |
 | `/blocking/toggle` | PUT | Enable/disable blocking |
 | `/blocking/pause` | POST | Pause blocking for N minutes |
 | `/blocking/allowlist` | GET | List allowlisted domains |
 | `/blocking/allowlist` | POST | Add domain to allowlist |
 | `/blocking/allowlist/{domain}` | DELETE | Remove from allowlist |
+| `/blocking/check/{domain}` | GET | Check if domain is blocked |
 | `/diagnose/{domain}` | GET | Trace resolution path |
 | `/query-log` | GET | Recent queries (filterable) |
 | `/stats` | GET | Server statistics |
@@ -151,6 +199,7 @@ REST API on port 5380 (18 endpoints):
 | Ad blocking | Yes | Yes | Limited | 385K+ domains |
 | Portable | No (Raspberry Pi) | Cloud only | Cloud only | Single binary |
 | Developer overrides | No | No | No | REST API + auto-expiry |
+| Local service proxy | No | No | No | `.numa` domains + HTTPS + WebSocket |
 | Data stays local | Yes | Cloud | Cloud | 100% local |
 | Zero config | Complex setup | Yes | Yes | Works out of the box |
 | Self-sovereign DNS | No | No | No | pkarr/DHT roadmap |
@@ -159,6 +208,8 @@ REST API on port 5380 (18 endpoints):

 **Block ads everywhere** — Run Numa on your laptop. Your ad blocker works on any network.

+**Name your local services** — `frontend.numa` instead of `localhost:5173`. CORS-friendly, HMR-compatible.
+
 **Mock external services** — `Point api.stripe.com to localhost:8080 for 30 minutes`

 **Provision dev environments** — Create overrides for `db.dev`, `api.dev`, `cache.dev`
@@ -176,6 +227,7 @@ Zero external DNS libraries. RFC 1035 wire protocol parsed by hand. Dependencies
 - [x] Ad blocking — 385K+ domains, dashboard, allowlist
 - [x] System DNS auto-discovery — Tailscale, VPN split-DNS
 - [x] System DNS auto-configuration — `numa install` / `numa uninstall`
+- [x] Local service proxy — `.numa` domains with HTTP/HTTPS reverse proxy, auto TLS, WebSocket
 - [ ] pkarr integration — self-sovereign DNS via Mainline DHT
 - [ ] Decentralized resolver network — staking, auditing, token economics

--- a/com.numa.dns.plist
+++ b/com.numa.dns.plist
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.numa.dns</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/local/bin/numa</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>/usr/local/var/log/numa.log</string>
+    <key>StandardErrorPath</key>
+    <string>/usr/local/var/log/numa.log</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>RUST_LOG</key>
+        <string>info</string>
+    </dict>
+</dict>
+</plist>
--- a/install.sh
+++ b/install.sh
@@ -0,0 +1,71 @@
+#!/bin/sh
+# Numa installer — detects OS/arch and downloads the latest release
+# Usage: curl -sSL https://raw.githubusercontent.com/razvandimescu/numa/main/install.sh | sh
+set -e
+
+REPO="razvandimescu/numa"
+INSTALL_DIR="/usr/local/bin"
+
+# Detect OS
+OS="$(uname -s)"
+case "$OS" in
+  Darwin) OS_NAME="macos" ;;
+  Linux)  OS_NAME="linux" ;;
+  *)      echo "Unsupported OS: $OS"; exit 1 ;;
+esac
+
+# Detect architecture
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64|amd64)  ARCH_NAME="x86_64" ;;
+  arm64|aarch64) ARCH_NAME="aarch64" ;;
+  *)             echo "Unsupported architecture: $ARCH"; exit 1 ;;
+esac
+
+ASSET="numa-${OS_NAME}-${ARCH_NAME}.tar.gz"
+
+echo ""
+echo "  \033[1;38;2;192;98;58mNuma\033[0m installer"
+echo ""
+echo "  OS:   $OS_NAME"
+echo "  Arch: $ARCH_NAME"
+echo ""
+
+# Get latest release tag
+echo "  Fetching latest release..."
+TAG=$(curl -sSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
+
+if [ -z "$TAG" ]; then
+  echo "  Error: could not find latest release."
+  echo "  Check https://github.com/${REPO}/releases"
+  exit 1
+fi
+
+URL="https://github.com/${REPO}/releases/download/${TAG}/${ASSET}"
+echo "  Downloading ${TAG}..."
+
+# Download and extract
+TMP=$(mktemp -d)
+curl -sSL "$URL" -o "$TMP/$ASSET"
+tar xzf "$TMP/$ASSET" -C "$TMP"
+
+# Install
+if [ -w "$INSTALL_DIR" ]; then
+  mv "$TMP/numa" "$INSTALL_DIR/numa"
+else
+  echo "  Installing to $INSTALL_DIR (requires sudo)..."
+  sudo mv "$TMP/numa" "$INSTALL_DIR/numa"
+fi
+
+chmod +x "$INSTALL_DIR/numa"
+rm -rf "$TMP"
+
+echo ""
+echo "  \033[38;2;107;124;78mInstalled:\033[0m $INSTALL_DIR/numa ($TAG)"
+echo ""
+echo "  Get started:"
+echo "    sudo numa                    # start the DNS server"
+echo "    sudo numa install            # set as system DNS"
+echo "    sudo numa service start      # run as persistent service"
+echo "    open http://localhost:5380    # dashboard"
+echo ""
--- a/numa.service
+++ b/numa.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Numa DNS — DNS you own, everywhere you go
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/numa
+Restart=always
+RestartSec=2
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=numa
+
+[Install]
+WantedBy=multi-user.target
--- a/numa.toml
+++ b/numa.toml
@@ -2,16 +2,32 @@
 bind_addr = "0.0.0.0:53"
 api_port = 5380

-[upstream]
-address = "8.8.8.8"
-port = 53
-timeout_ms = 3000
+# [upstream]
+# address = ""       # auto-detect from system resolver (default)
+# address = "9.9.9.9"  # or set explicitly
+# port = 53
+# timeout_ms = 3000

 [cache]
 max_entries = 10000
 min_ttl = 60
 max_ttl = 86400

+[proxy]
+enabled = true
+port = 80
+tls_port = 443
+tld = "numa"
+
+# Pre-configured services (numa.numa is always added automatically)
+# [[services]]
+# name = "frontend"
+# target_port = 5173
+#
+# [[services]]
+# name = "api"
+# target_port = 8000
+
 # Example zone records:
 # [[zones]]
 # domain = "dimescu.ro"
--- a/scripts/record-demo.sh
+++ b/scripts/record-demo.sh
@@ -0,0 +1,334 @@
+#!/bin/bash
+# record-demo.sh — Records a hero GIF of the Numa dashboard.
+#
+# Prerequisites: ffmpeg, gifsicle (optional), numa running, python3
+# Usage: ./scripts/record-demo.sh [output.gif]
+#
+# The script:
+#   1. Opens the dashboard in Chrome --app mode (clean, no address bar)
+#   2. Generates DNS traffic (forward, cache hit, blocked)
+#   3. Types "peekm" / "6419" into the Local Services form on camera
+#   4. Opens peekm.numa to show the proxy working
+#   5. Records via ffmpeg and converts to optimized GIF
+
+set -euo pipefail
+
+# --------------- Configuration ---------------
+OUTPUT="${1:-assets/hero-demo.gif}"
+PORT=5380
+RECORD_SECONDS=20
+VIEWPORT_W=1800
+VIEWPORT_H=1100
+FPS=12
+GIF_WIDTH=800
+MAX_GIF_SIZE_MB=5
+CDP_PORT=9223
+
+# --------------- State ---------------
+FFMPEG_PID=""
+CHROME_PID=""
+MOV_FILE=""
+CHROME_DATA_DIR=""
+CDP_HELPER=""
+
+# --------------- Helpers ---------------
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+RED='\033[0;31m'
+NC='\033[0m'
+log()  { echo -e "${GREEN}[demo]${NC} $1"; }
+warn() { echo -e "${YELLOW}[demo]${NC} $1"; }
+err()  { echo -e "${RED}[demo]${NC} $1" >&2; }
+
+cleanup() {
+    log "Cleaning up..."
+    [ -n "$FFMPEG_PID" ] && kill "$FFMPEG_PID" 2>/dev/null || true
+    [ -n "$CHROME_PID" ] && kill "$CHROME_PID" 2>/dev/null && wait "$CHROME_PID" 2>/dev/null || true
+    [ -n "$MOV_FILE" ] && [ -f "$MOV_FILE" ] && rm -f "$MOV_FILE"
+    [ -n "$CDP_HELPER" ] && rm -f "$CDP_HELPER"
+    [ -n "$CHROME_DATA_DIR" ] && sleep 0.5 && rm -rf "$CHROME_DATA_DIR"
+    log "Done."
+}
+trap cleanup EXIT
+
+# --------------- CDP helper (Chrome DevTools Protocol) ---------------
+CDP_HELPER=$(mktemp /tmp/numa-cdp-XXXXXX.py)
+cat > "$CDP_HELPER" << 'PYTHON'
+import json, socket, struct, os, sys, http.client, urllib.parse
+
+def cdp_eval(port, js):
+    conn = http.client.HTTPConnection('localhost', port, timeout=2)
+    conn.request('GET', '/json')
+    targets = json.loads(conn.getresponse().read())
+    conn.close()
+    page = next((t for t in targets if t.get('type') == 'page'), None)
+    if not page:
+        return
+    ws_url = page.get('webSocketDebuggerUrl')
+    if not ws_url:
+        return
+    parsed = urllib.parse.urlparse(ws_url)
+    sock = socket.create_connection((parsed.hostname, parsed.port), timeout=5)
+    key = 'dGhlIHNhbXBsZSBub25jZQ=='
+    handshake = (
+        f"GET {parsed.path} HTTP/1.1\r\n"
+        f"Host: {parsed.hostname}:{parsed.port}\r\n"
+        f"Upgrade: websocket\r\nConnection: Upgrade\r\n"
+        f"Sec-WebSocket-Key: {key}\r\n"
+        f"Sec-WebSocket-Version: 13\r\n\r\n"
+    )
+    sock.sendall(handshake.encode())
+    sock.recv(4096)
+    msg = json.dumps({"id": 1, "method": "Runtime.evaluate",
+                       "params": {"expression": js}}).encode()
+    mask = os.urandom(4)
+    frame = bytearray([0x81])
+    if len(msg) < 126:
+        frame.append(0x80 | len(msg))
+    elif len(msg) < 65536:
+        frame.append(0x80 | 126)
+        frame.extend(struct.pack('>H', len(msg)))
+    else:
+        frame.append(0x80 | 127)
+        frame.extend(struct.pack('>Q', len(msg)))
+    frame.extend(mask)
+    frame.extend(bytes(b ^ mask[i % 4] for i, b in enumerate(msg)))
+    sock.sendall(bytes(frame))
+    sock.recv(4096)
+    sock.close()
+
+if __name__ == '__main__':
+    try:
+        cdp_eval(int(sys.argv[1]), sys.argv[2])
+    except Exception:
+        pass
+PYTHON
+
+run_js() {
+    python3 "$CDP_HELPER" "$CDP_PORT" "$1" 2>/dev/null || true
+}
+
+# Simulate typing into an input field character by character
+type_into() {
+    local selector="$1"
+    local text="$2"
+    local delay="${3:-0.08}"
+
+    # Focus the field
+    run_js "document.querySelector('$selector').focus();"
+    sleep 0.2
+
+    # Type each character
+    for (( i=0; i<${#text}; i++ )); do
+        local char="${text:$i:1}"
+        run_js "
+            var el = document.querySelector('$selector');
+            el.value += '$char';
+            el.dispatchEvent(new Event('input', {bubbles: true}));
+        "
+        sleep "$delay"
+    done
+}
+
+# --------------- Dependency checks ---------------
+for cmd in ffmpeg dig curl python3; do
+    if ! command -v "$cmd" &>/dev/null; then
+        err "$cmd is required but not found"
+        exit 1
+    fi
+done
+
+# Check numa is running
+if ! dig @127.0.0.1 google.com +short +time=1 > /dev/null 2>&1; then
+    err "Numa is not running. Start it with: sudo numa"
+    exit 1
+fi
+log "Numa is running."
+
+# Clean slate: remove peekm service if it exists from a previous run
+curl -s -X DELETE "http://localhost:$PORT/services/peekm" > /dev/null 2>&1 || true
+
+# Pre-populate traffic so dashboard looks alive from frame 1
+log "Pre-populating DNS traffic..."
+for domain in github.com google.com stackoverflow.com reddit.com cloudflare.com \
+    fonts.googleapis.com api.github.com www.google.com cdn.jsdelivr.net; do
+    dig @127.0.0.1 "$domain" +short > /dev/null 2>&1
+done
+# Blocked traffic
+for domain in ads.doubleclick.net tracking.google.com ad.doubleclick.net \
+    pixel.facebook.com analytics.google.com; do
+    dig @127.0.0.1 "$domain" +short > /dev/null 2>&1
+done
+# Cache hits
+for domain in github.com google.com stackoverflow.com; do
+    dig @127.0.0.1 "$domain" +short > /dev/null 2>&1
+done
+
+# --------------- Step 1: Open Chrome in --app mode ---------------
+log "Opening dashboard in Chrome app mode (${VIEWPORT_W}x${VIEWPORT_H})..."
+CHROME="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+CHROME_DATA_DIR=$(mktemp -d /tmp/numa-demo-chrome-XXXXXX)
+
+"$CHROME" \
+    --app="http://localhost:$PORT" \
+    --window-size=${VIEWPORT_W},${VIEWPORT_H} \
+    --window-position=100,100 \
+    --user-data-dir="$CHROME_DATA_DIR" \
+    --remote-debugging-port=${CDP_PORT} \
+    --no-first-run \
+    --disable-extensions \
+    --disable-infobars 2>/dev/null &
+CHROME_PID=$!
+
+log "Waiting for page load..."
+sleep 3
+
+# Bring Chrome to front
+osascript -e "tell application \"System Events\" to set frontmost of (first process whose unix id is $CHROME_PID) to true" 2>/dev/null || true
+sleep 0.5
+
+# --------------- Step 2: Start screen recording ---------------
+MOV_FILE=$(mktemp /tmp/numa-demo-XXXXXX.mov)
+
+SCREEN_LOGICAL_W=$(osascript -l JavaScript -e 'ObjC.import("AppKit"); $.NSScreen.mainScreen.frame.size.width')
+SCREEN_LOGICAL_H=$(osascript -l JavaScript -e 'ObjC.import("AppKit"); $.NSScreen.mainScreen.frame.size.height')
+log "Screen: ${SCREEN_LOGICAL_W}x${SCREEN_LOGICAL_H}"
+
+SCREEN_INDEX=$(ffmpeg -f avfoundation -list_devices true -i "" 2>&1 \
+    | grep "Capture screen" | head -1 | sed 's/.*\[\([0-9]*\)\].*/\1/' || true)
+
+if [ -z "$SCREEN_INDEX" ]; then
+    err "No screen capture device found."
+    exit 1
+fi
+
+log "Recording ${RECORD_SECONDS}s..."
+ffmpeg -y -loglevel warning \
+    -f avfoundation -framerate 24 -capture_cursor 0 \
+    -pixel_format uyvy422 \
+    -probesize 50M \
+    -i "${SCREEN_INDEX}:none" \
+    -t "$RECORD_SECONDS" \
+    -r 24 \
+    -c:v libx264 -preset ultrafast -crf 18 \
+    "$MOV_FILE" &
+FFMPEG_PID=$!
+
+sleep 1
+
+# Bring Chrome to front again
+osascript -e "tell application \"System Events\" to set frontmost of (first process whose unix id is $CHROME_PID) to true" 2>/dev/null || true
+sleep 0.5
+
+# --------------- Scene 1: Dashboard alive (0-3s) ---------------
+# Dashboard is already showing pre-populated traffic from frame 1
+log "Scene 1: Dashboard with live traffic (3s)..."
+# Trickle a few more queries for movement
+dig @127.0.0.1 github.com +short > /dev/null 2>&1
+dig @127.0.0.1 ad.doubleclick.net +short > /dev/null 2>&1
+sleep 3
+
+# --------------- Scene 2: Check Domain blocker (3-6s) ---------------
+log "Scene 2: Check Domain — blocked tracker..."
+type_into "#checkDomainInput" "ads.doubleclick.net" 0.04
+sleep 0.3
+# Click Check button
+run_js "document.querySelector('#checkDomainInput').closest('form').querySelector('.btn').click();"
+sleep 2
+
+# --------------- Scene 3: Add peekm service via UI (6-10s) ---------------
+log "Scene 3: Adding peekm.numa service..."
+
+# Scroll to Local Services form
+run_js "
+    var svcPanel = document.getElementById('serviceForm');
+    if (svcPanel) svcPanel.scrollIntoView({behavior: 'smooth', block: 'center'});
+"
+sleep 0.5
+
+type_into "#svcName" "peekm" 0.06
+sleep 0.2
+type_into "#svcPort" "6419" 0.1
+sleep 0.3
+
+# Click "Add Service"
+run_js "document.querySelector('#serviceForm .btn-add').click();"
+sleep 1.5
+
+# --------------- Scene 4: Open peekm.numa (10-14s) ---------------
+log "Scene 4: Opening peekm.numa in browser..."
+open "http://peekm.numa/view/peekm/README.md" 2>/dev/null || true
+sleep 4
+
+# --------------- Scene 5: Back to dashboard (14-17s) ---------------
+log "Scene 5: Back to dashboard — LOCAL queries visible..."
+osascript -e "tell application \"System Events\" to set frontmost of (first process whose unix id is $CHROME_PID) to true" 2>/dev/null || true
+sleep 3
+
+# --------------- Scene 6: Terminal-style dig overlay (17-20s) ---------------
+log "Scene 6: dig proof overlay..."
+DIG_RESULT=$(dig @127.0.0.1 peekm.numa +short 2>/dev/null | head -1)
+run_js "
+    var overlay = document.createElement('div');
+    overlay.style.cssText = 'position:fixed;bottom:32px;left:50%;transform:translateX(-50%);background:#1a1814;color:#e8e0d4;padding:16px 28px;border-radius:10px;font-family:var(--font-mono);font-size:14px;z-index:99999;box-shadow:0 8px 32px rgba(0,0,0,0.3);border:1px solid rgba(192,98,58,0.3);white-space:pre;line-height:1.6;';
+    overlay.innerHTML = '<span style=\"color:#8baa6e\">\$</span> <span style=\"color:#d48a5a\">dig</span> <span style=\"color:#8b9fbb\">@127.0.0.1</span> peekm.numa +short\n<span style=\"color:#8baa6e\">${DIG_RESULT}</span>';
+    document.body.appendChild(overlay);
+"
+sleep 3
+
+# --------------- Step 6: Stop recording and convert ---------------
+log "Stopping recording..."
+kill "$FFMPEG_PID" 2>/dev/null || true
+wait "$FFMPEG_PID" 2>/dev/null || true
+FFMPEG_PID=""
+
+if [ ! -f "$MOV_FILE" ] || [ ! -s "$MOV_FILE" ]; then
+    err "Recording failed — no video captured."
+    err "Tip: grant Screen Recording permission to Terminal in System Settings > Privacy & Security"
+    exit 1
+fi
+
+# Compute crop region
+CAPTURE_W=$(ffprobe -v error -select_streams v:0 -show_entries stream=width -of csv=p=0 "$MOV_FILE")
+CAPTURE_H=$(ffprobe -v error -select_streams v:0 -show_entries stream=height -of csv=p=0 "$MOV_FILE")
+
+read -r CROP_W CROP_H CROP_X CROP_Y <<< "$(awk -v cw="$CAPTURE_W" -v ch="$CAPTURE_H" \
+    -v sw="$SCREEN_LOGICAL_W" -v sh="$SCREEN_LOGICAL_H" \
+    -v ww="$VIEWPORT_W" -v wh="$VIEWPORT_H" \
+    'BEGIN {
+        sx = cw / sw; sy = ch / sh
+        printf "%d %d %d %d", int(ww*sx), int(wh*sy), int(100*sx), int(100*sy)
+    }')"
+
+log "Capture: ${CAPTURE_W}x${CAPTURE_H}, crop: ${CROP_W}x${CROP_H}+${CROP_X}+${CROP_Y}"
+
+mkdir -p "$(dirname "$OUTPUT")"
+
+log "Converting to GIF (${GIF_WIDTH}px, ${FPS}fps)..."
+ffmpeg -y -loglevel error \
+    -i "$MOV_FILE" \
+    -vf "crop=${CROP_W}:${CROP_H}:${CROP_X}:${CROP_Y},fps=${FPS},scale=${GIF_WIDTH}:-1:flags=lanczos,split[s0][s1];[s0]palettegen=max_colors=128:stats_mode=diff[p];[s1][p]paletteuse=dither=bayer:bayer_scale=5:diff_mode=rectangle" \
+    -loop 0 \
+    "$OUTPUT"
+
+# Optimize with gifsicle if available
+if command -v gifsicle &>/dev/null; then
+    log "Optimizing with gifsicle..."
+    gifsicle -O3 --lossy=60 --colors 128 "$OUTPUT" -o "$OUTPUT"
+fi
+
+SIZE_BYTES=$(stat -f%z "$OUTPUT")
+SIZE_MB=$(awk "BEGIN { printf \"%.1f\", $SIZE_BYTES / 1048576 }")
+log "Hero GIF saved to $OUTPUT (${SIZE_MB}MB)"
+
+if awk "BEGIN { exit ($SIZE_MB > $MAX_GIF_SIZE_MB) ? 0 : 1 }"; then
+    warn "GIF is over ${MAX_GIF_SIZE_MB}MB. Consider reducing RECORD_SECONDS, FPS, or GIF_WIDTH."
+fi
+
+# Clean up demo data
+log "Cleaning up demo services..."
+curl -s -X DELETE "http://localhost:$PORT/services/peekm" > /dev/null 2>&1 || true
+
+log ""
+log "Add to README.md:"
+log '  ![Numa dashboard](assets/hero-demo.gif)'
--- a/site/dashboard.html
+++ b/site/dashboard.html
@@ -232,7 +232,7 @@ body {

 /* Query log table */
 .query-log {
-  max-height: 380px;
+  max-height: 600px;
  overflow-y: auto;
  scrollbar-width: thin;
  scrollbar-color: var(--bg-elevated) transparent;
@@ -348,6 +348,41 @@ body {
  flex-shrink: 0;
 }

+/* Service items */
+.service-item {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.5rem 0;
+  border-bottom: 1px solid var(--border);
+}
+.service-item:last-child { border-bottom: none; }
+.service-info { flex: 1; min-width: 0; }
+.service-name {
+  font-family: var(--font-mono);
+  font-size: 0.8rem;
+  font-weight: 500;
+  color: var(--cyan);
+}
+.service-name a {
+  color: inherit;
+  text-decoration: none;
+}
+.service-name a:hover { text-decoration: underline; }
+.service-port {
+  font-family: var(--font-mono);
+  font-size: 0.68rem;
+  color: var(--text-dim);
+}
+.health-dot {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  flex-shrink: 0;
+}
+.health-dot.up { background: var(--emerald); }
+.health-dot.down { background: var(--rose); }
+
 /* Override form */
 .override-form {
  display: flex;
@@ -442,7 +477,7 @@ body {
    <div class="tagline">DNS that governs itself</div>
  </div>
  <div style="display:flex;align-items:center;gap:1.2rem;">
-    <button class="btn" id="pauseBtn" onclick="pauseBlocking()" style="background:var(--amber);color:white;font-family:var(--font-mono);font-size:0.7rem;display:none;">Pause 5m</button>
+    <button class="btn" id="pauseBtn" style="background:var(--amber);color:white;font-family:var(--font-mono);font-size:0.7rem;display:none;">Pause 5m</button>
    <button class="btn" id="toggleBtn" onclick="toggleBlocking()" style="background:var(--rose);color:white;font-family:var(--font-mono);font-size:0.7rem;display:none;"></button>
    <div class="status-badge">
      <span class="status-dot" id="statusDot"></span>
@@ -497,7 +532,21 @@ body {
    <div class="panel">
      <div class="panel-header">
        <span class="panel-title">Recent Queries</span>
-        <span class="panel-title" id="queryCount" style="color: var(--text-dim)"></span>
+        <div style="display:flex;align-items:center;gap:0.5rem;">
+          <input type="text" id="logFilterDomain" placeholder="filter domain..." oninput="applyLogFilter()"
+            style="font-family:var(--font-mono);font-size:0.7rem;padding:0.25rem 0.5rem;border:1px solid var(--border);border-radius:4px;background:var(--bg-surface);color:var(--text-primary);outline:none;width:150px;">
+          <select id="logFilterPath" onchange="applyLogFilter()"
+            style="font-family:var(--font-mono);font-size:0.7rem;padding:0.25rem 0.4rem;border:1px solid var(--border);border-radius:4px;background:var(--bg-surface);color:var(--text-secondary);outline:none;">
+            <option value="">all paths</option>
+            <option value="FORWARD">forward</option>
+            <option value="CACHED">cached</option>
+            <option value="BLOCKED">blocked</option>
+            <option value="OVERRIDE">override</option>
+            <option value="LOCAL">local</option>
+            <option value="SERVFAIL">error</option>
+          </select>
+          <span class="panel-title" id="queryCount" style="color: var(--text-dim)"></span>
+        </div>
      </div>
      <div class="query-log" id="queryLog">
        <table>
@@ -519,18 +568,40 @@ body {

    <!-- Sidebar -->
    <div class="sidebar">
+      <!-- Blocking -->
+      <div class="panel" id="blockingPanel">
+        <div class="panel-header">
+          <span class="panel-title">Blocking</span>
+          <span class="panel-title" id="blockingRefresh" style="color:var(--text-dim);font-weight:400;"></span>
+        </div>
+        <div class="panel-body">
+          <form class="override-form" onsubmit="return checkDomain(event)" style="margin-bottom:0;border-bottom:none;padding-bottom:0;">
+            <div class="override-form-row">
+              <input type="text" id="checkDomainInput" placeholder="Is this domain blocked?" required style="flex:3">
+              <button type="submit" class="btn" style="background:var(--violet);color:white;flex-shrink:0;">Check</button>
+            </div>
+          </form>
+          <div id="checkResult" style="display:none;margin-top:0.6rem;padding:0.5rem 0.6rem;border-radius:5px;font-family:var(--font-mono);font-size:0.72rem;"></div>
+          <div id="blockingSources" style="margin-top:0.8rem;padding-top:0.6rem;border-top:1px solid var(--border);"></div>
+          <div id="blockingAllowlist" style="margin-top:0.8rem;padding-top:0.6rem;border-top:1px solid var(--border);"></div>
+        </div>
+      </div>
+
      <!-- Active overrides -->
      <div class="panel">
        <div class="panel-header">
-          <span class="panel-title">Active Overrides</span>
+          <div>
+            <span class="panel-title">Active Overrides</span>
+            <div style="font-size:0.68rem;color:var(--text-dim);margin-top:0.15rem;">Redirect any domain to any IP. Temporary, DNS-only.</div>
+          </div>
        </div>
        <div class="panel-body">
          <form class="override-form" id="overrideForm" onsubmit="return addOverride(event)">
-            <input type="text" id="ovDomain" placeholder="domain (e.g. api.dev)" required>
-            <input type="text" id="ovTarget" placeholder="target IP (e.g. 127.0.0.1)" required>
+            <input type="text" id="ovDomain" placeholder="domain (e.g. api.stripe.com)" required>
+            <input type="text" id="ovTarget" placeholder="target (e.g. 10.0.0.5 or 127.0.0.1)" required>
            <div class="override-form-row">
-              <input type="number" id="ovTTL" placeholder="TTL" value="60" min="1">
-              <input type="number" id="ovDuration" placeholder="Duration (s)" value="300" min="1">
+              <input type="number" id="ovTTL" placeholder="DNS TTL" value="60" min="1" title="How long clients may cache this DNS response">
+              <input type="number" id="ovDuration" placeholder="Expires in (s)" value="300" min="1">
            </div>
            <button type="submit" class="btn btn-add">Add Override</button>
            <div class="override-error" id="overrideError"></div>
@@ -541,6 +612,29 @@ body {
        </div>
      </div>

+      <!-- Local services -->
+      <div class="panel">
+        <div class="panel-header">
+          <div>
+            <span class="panel-title">Local Services</span>
+            <div style="font-size:0.68rem;color:var(--text-dim);margin-top:0.15rem;">Give localhost apps clean .numa URLs. Persistent, with HTTP proxy.</div>
+          </div>
+        </div>
+        <div class="panel-body">
+          <form class="override-form" id="serviceForm" onsubmit="return addService(event)">
+            <div class="override-form-row">
+              <input type="text" id="svcName" placeholder="name (becomes name.numa)" required style="flex:2">
+              <input type="number" id="svcPort" placeholder="port (e.g. 3000)" required min="1" max="65535" style="flex:1">
+            </div>
+            <button type="submit" class="btn btn-add">Add Service</button>
+            <div class="override-error" id="serviceError"></div>
+          </form>
+          <div id="servicesList">
+            <div class="empty-state">No services configured</div>
+          </div>
+        </div>
+      </div>
+
      <!-- Cache entries -->
      <div class="panel">
        <div class="panel-header">
@@ -558,6 +652,7 @@ body {
 <script>
 const API = '';
 let prevTotal = null;
+let lastLogEntries = [];
 let prevTime = null;

 async function fetchJSON(path) {
@@ -630,9 +725,29 @@ function renderPaths(queries) {
 }

 function renderQueryLog(entries) {
+  lastLogEntries = entries;
+  applyLogFilter();
+}
+
+function applyLogFilter() {
+  const domainFilter = document.getElementById('logFilterDomain').value.trim().toLowerCase();
+  const pathFilter = document.getElementById('logFilterPath').value;
+
+  let filtered = lastLogEntries;
+  if (domainFilter) {
+    filtered = filtered.filter(e => e.domain.toLowerCase().includes(domainFilter));
+  }
+  if (pathFilter) {
+    filtered = filtered.filter(e => e.path === pathFilter);
+  }
+
  const tbody = document.getElementById('queryLogBody');
-  document.getElementById('queryCount').textContent = `last ${entries.length}`;
-  tbody.innerHTML = entries.map(e => {
+  document.getElementById('queryCount').textContent =
+    filtered.length < lastLogEntries.length
+      ? `${filtered.length} / ${lastLogEntries.length}`
+      : `last ${filtered.length}`;
+
+  tbody.innerHTML = filtered.map(e => {
    const allowBtn = e.path === 'BLOCKED'
      ? ` <button class="btn-delete" onclick="allowDomain('${e.domain}')" title="Allow this domain" style="color:var(--emerald);font-size:0.65rem;">allow</button>`
      : '';
@@ -730,11 +845,14 @@ function renderCache(entries) {

 async function refresh() {
  try {
-    const [stats, logs, overrides, cache] = await Promise.all([
+    const [stats, logs, overrides, cache, services, blockingInfo, allowlist] = await Promise.all([
      fetchJSON('/stats'),
-      fetchJSON('/query-log?limit=100'),
+      fetchJSON('/query-log?limit=200'),
      fetchJSON('/overrides'),
      fetchJSON('/cache'),
+      fetchJSON('/services'),
+      fetchJSON('/blocking/stats'),
+      fetchJSON('/blocking/allowlist'),
    ]);

    // Connection status
@@ -750,16 +868,22 @@ async function refresh() {
    document.getElementById('blockedCount').textContent = formatNumber(q.blocked);
    const bl = stats.blocking;
    document.getElementById('blockedSub').textContent =
+      bl.paused ? 'paused' :
+      !bl.enabled ? 'disabled' :
      bl.domains_loaded > 0 ? `${formatNumber(bl.domains_loaded)} in blocklist` : 'loading...';

-    // Blocking controls
+    // Blocking controls — single primary button + secondary toggle
    const toggleBtn = document.getElementById('toggleBtn');
    const pauseBtn = document.getElementById('pauseBtn');
    toggleBtn.style.display = 'inline-block';
-    pauseBtn.style.display = bl.enabled && !bl.paused ? 'inline-block' : 'none';
    if (bl.paused) {
+      // Primary action: unpause. Hide toggle to prevent accidental disable.
+      pauseBtn.style.display = 'inline-block';
+      pauseBtn.textContent = 'Unpause';
+      pauseBtn.onclick = unpauseBlocking;
      toggleBtn.textContent = 'Paused';
      toggleBtn.style.background = 'var(--amber)';
+      toggleBtn.onclick = unpauseBlocking; // clicking "Paused" unpauses, not disables
    } else if (bl.enabled) {
      toggleBtn.textContent = 'Blocking On';
      toggleBtn.style.background = 'var(--emerald)';
@@ -792,6 +916,9 @@ async function refresh() {
    renderQueryLog(logs);
    renderOverrides(overrides);
    renderCache(cache);
+    renderServices(services);
+    renderBlockingInfo(blockingInfo);
+    renderAllowlist(allowlist);

  } catch (err) {
    document.getElementById('statusDot').className = 'status-dot error';
@@ -823,6 +950,13 @@ async function pauseBlocking() {
  } catch (err) {}
 }

+async function unpauseBlocking() {
+  try {
+    await fetch(API + '/blocking/unpause', { method: 'POST' });
+    refresh();
+  } catch (err) {}
+}
+
 async function allowDomain(domain) {
  try {
    await fetch(API + '/blocking/allowlist', {
@@ -834,9 +968,176 @@ async function allowDomain(domain) {
  } catch (err) {}
 }

+async function checkDomain(event) {
+  event.preventDefault();
+  const domain = document.getElementById('checkDomainInput').value.trim();
+  const el = document.getElementById('checkResult');
+  if (!domain) return false;
+  try {
+    const result = await fetchJSON('/blocking/check/' + encodeURIComponent(domain));
+    el.style.display = 'block';
+    if (result.blocked) {
+      el.style.background = 'rgba(181, 68, 58, 0.1)';
+      el.style.color = 'var(--rose)';
+      el.innerHTML = `<strong>Blocked</strong> — ${result.reason}` +
+        (result.matched_rule ? `<br>Rule: <code>${result.matched_rule}</code>` : '') +
+        ` <button class="btn-delete" onclick="allowDomain('${domain}')" style="color:var(--emerald);font-size:0.7rem;margin-left:0.4rem;">allow</button>`;
+    } else {
+      el.style.background = 'rgba(82, 122, 82, 0.1)';
+      el.style.color = 'var(--emerald)';
+      el.innerHTML = `<strong>Allowed</strong> — ${result.reason}` +
+        (result.matched_rule ? `<br>Rule: <code>${result.matched_rule}</code>` : '');
+    }
+  } catch (err) {
+    el.style.display = 'block';
+    el.style.background = 'rgba(181, 68, 58, 0.1)';
+    el.style.color = 'var(--rose)';
+    el.textContent = 'Error: ' + err.message;
+  }
+  return false;
+}
+
+function shortenUrl(url) {
+  try {
+    const u = new URL(url);
+    const parts = u.pathname.split('/').filter(Boolean);
+    // For GitHub CDN URLs, show "owner/repo/.../filename"
+    if (u.hostname.includes('jsdelivr') || u.hostname.includes('github')) {
+      const owner = parts[1] || '';
+      const file = parts[parts.length - 1] || '';
+      return owner ? `${owner} / ${file}` : file;
+    }
+    // For other URLs, show hostname + filename
+    const file = parts[parts.length - 1] || '';
+    return `${u.hostname} / ${file}`;
+  } catch { return url; }
+}
+
+function renderBlockingInfo(info) {
+  const el = document.getElementById('blockingSources');
+  const refreshEl = document.getElementById('blockingRefresh');
+  if (info.last_refresh_secs_ago != null) {
+    refreshEl.textContent = `refreshed ${formatUptime(info.last_refresh_secs_ago)} ago`;
+  }
+  const sources = info.list_sources || [];
+  if (!sources.length) {
+    el.innerHTML = '';
+    return;
+  }
+  el.innerHTML = `
+    <div style="font-size:0.65rem;font-weight:600;text-transform:uppercase;letter-spacing:0.08em;color:var(--text-dim);margin-bottom:0.4rem;">Sources &middot; ${formatNumber(info.domains_loaded)} domains</div>
+    ${sources.map(s => `
+      <div style="padding:0.3rem 0;font-family:var(--font-mono);font-size:0.72rem;">
+        <a href="${s}" target="_blank" rel="noopener" style="color:var(--text-secondary);text-decoration:none;" title="${s}">${shortenUrl(s)}</a>
+      </div>
+    `).join('')}
+  `;
+}
+
+function renderAllowlist(entries) {
+  const el = document.getElementById('blockingAllowlist');
+  const count = entries.length;
+  el.innerHTML = `
+    <div style="font-size:0.65rem;font-weight:600;text-transform:uppercase;letter-spacing:0.08em;color:var(--text-dim);margin-bottom:0.4rem;">Allowlist${count ? ` (${count})` : ''}</div>
+    ${count ? entries.map(d => `
+      <div style="display:flex;justify-content:space-between;align-items:center;padding:0.25rem 0;border-bottom:1px solid var(--border);">
+        <span style="font-family:var(--font-mono);font-size:0.75rem;color:var(--emerald);">${d}</span>
+        <button class="btn-delete" onclick="removeAllowlistDomain('${d}')">&times;</button>
+      </div>
+    `).join('') : '<div class="empty-state">No exceptions</div>'}
+    <form onsubmit="return addAllowlistDomain(event)" style="display:flex;gap:0.4rem;margin-top:0.4rem;">
+      <input type="text" id="allowDomainInput" placeholder="domain to allow" required style="flex:1;font-family:var(--font-mono);font-size:0.75rem;padding:0.35rem 0.5rem;border:1px solid var(--border);border-radius:4px;background:var(--bg-surface);color:var(--text-primary);outline:none;">
+      <button type="submit" class="btn" style="background:var(--emerald);color:white;flex-shrink:0;">Allow</button>
+    </form>
+  `;
+}
+
+async function addAllowlistDomain(event) {
+  event.preventDefault();
+  const input = document.getElementById('allowDomainInput');
+  const domain = input.value.trim();
+  if (!domain) return false;
+  try {
+    await fetch(API + '/blocking/allowlist', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ domain }),
+    });
+    input.value = '';
+    refresh();
+  } catch (err) {}
+  return false;
+}
+
+async function removeAllowlistDomain(domain) {
+  try {
+    await fetch(API + '/blocking/allowlist/' + encodeURIComponent(domain), { method: 'DELETE' });
+    refresh();
+  } catch (err) {}
+}
+
+function renderServices(entries) {
+  const el = document.getElementById('servicesList');
+  if (!entries.length) {
+    el.innerHTML = '<div class="empty-state">No services configured</div>';
+    return;
+  }
+  el.innerHTML = entries.map(e => `
+    <div class="service-item">
+      <span class="health-dot ${e.healthy ? 'up' : 'down'}" title="${e.healthy ? 'running' : 'not reachable'}"></span>
+      <div class="service-info">
+        <div class="service-name"><a href="${e.url}" target="_blank">${e.name}.numa</a></div>
+        <div class="service-port">localhost:${e.target_port} &rarr; proxied</div>
+      </div>
+      ${e.name === 'numa' ? '' : `<button class="btn-delete" onclick="deleteService('${e.name}')" title="Remove service">&times;</button>`}
+    </div>
+  `).join('');
+}
+
+async function addService(event) {
+  event.preventDefault();
+  const errEl = document.getElementById('serviceError');
+  errEl.style.display = 'none';
+  try {
+    const body = {
+      name: document.getElementById('svcName').value.trim(),
+      target_port: parseInt(document.getElementById('svcPort').value) || 0,
+    };
+    const res = await fetch(API + '/services', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(text);
+    }
+    document.getElementById('svcName').value = '';
+    document.getElementById('svcPort').value = '';
+    refresh();
+  } catch (err) {
+    errEl.textContent = err.message;
+    errEl.style.display = 'block';
+  }
+  return false;
+}
+
+async function deleteService(name) {
+  try {
+    await fetch(API + '/services/' + encodeURIComponent(name), { method: 'DELETE' });
+    refresh();
+  } catch (err) { /* next refresh will update */ }
+}
+
 // Initial load + polling
 refresh();
 setInterval(refresh, 2000);
 </script>
+
+<div style="text-align:center;padding:0.8rem;font-family:var(--font-mono);font-size:0.68rem;color:var(--text-dim);">
+  Logs: <span id="logPath" style="user-select:all;">macOS: /usr/local/var/log/numa.log · Linux: journalctl -u numa -f</span>
+  · <a href="https://github.com/razvandimescu/numa" target="_blank" rel="noopener" style="color:var(--amber);text-decoration:none;">GitHub</a>
+</div>
+
 </body>
 </html>
--- a/site/index.html
+++ b/site/index.html
@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Numa — DNS that governs itself</title>
-<meta name="description" content="DNS you own. Block ads, override DNS for development, cache for speed. A single portable binary built from scratch in Rust. No Raspberry Pi, no cloud, no account.">
+<meta name="description" content="DNS you own. Block ads, override DNS for development, name your local services with .numa domains, cache for speed. A single portable binary built from scratch in Rust.">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=DM+Sans:ital,opsz,wght@0,9..40,400;0,9..40,500;0,9..40,600;1,9..40,400&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
@@ -612,6 +612,12 @@ p.lead {
  color: var(--emerald);
 }
 .pipeline-box.hl-emerald:hover { border-color: var(--emerald); color: var(--emerald); }
+.pipeline-box.hl-cyan {
+  border-color: rgba(74, 124, 138, 0.35);
+  background: rgba(74, 124, 138, 0.06);
+  color: var(--cyan);
+}
+.pipeline-box.hl-cyan:hover { border-color: var(--cyan); color: var(--cyan); }

 .pipeline-arrow {
  font-family: var(--font-mono);
@@ -1004,7 +1010,7 @@ footer .closing {
    <div class="tagline">DNS you own. Everywhere you go.</div>
    <p class="epigraph">After Numa Pompilius, who built institutions that outlasted kings.</p>
    <p class="description">
-      Block ads and trackers. Override DNS for development. Cache for speed. A single portable binary built from scratch in Rust &mdash; no Raspberry Pi, no cloud, no account. Your DNS travels with you.
+      Block ads and trackers. Override DNS for development. Name your local services with <code style="font-size:0.9em;color:var(--cyan)">.numa</code> domains. A single portable binary built from scratch in Rust &mdash; no Raspberry Pi, no cloud, no account.
    </p>
    <div class="hero-actions">
      <a href="#technical" class="btn btn-primary">Get Started</a>
@@ -1066,8 +1072,9 @@ footer .closing {
        <ul>
          <li>Ad &amp; tracker blocking &mdash; 385K+ domains, zero config</li>
          <li>Ephemeral DNS overrides with auto-revert</li>
+          <li>Local service proxy &mdash; <code>frontend.numa</code> instead of <code>localhost:5173</code></li>
          <li>Live dashboard with real-time stats and controls</li>
-          <li>REST API &mdash; 18 endpoints for programmatic control</li>
+          <li>REST API &mdash; 22 endpoints for programmatic control</li>
          <li>TTL-aware caching (sub-ms lookups)</li>
          <li>Single binary, portable &mdash; your ad blocker travels with you</li>
        </ul>
@@ -1116,6 +1123,10 @@ footer .closing {
        <span class="pipeline-arrow">&rarr;</span>
        <div class="pipeline-node"><div class="pipeline-box highlight">Overrides</div></div>
        <span class="pipeline-arrow">&rarr;</span>
+        <div class="pipeline-node"><div class="pipeline-box hl-cyan">.numa TLD</div></div>
+        <span class="pipeline-arrow">&rarr;</span>
+        <div class="pipeline-node"><div class="pipeline-box">Blocklist</div></div>
+        <span class="pipeline-arrow">&rarr;</span>
        <div class="pipeline-node"><div class="pipeline-box">Local Zones</div></div>
        <span class="pipeline-arrow">&rarr;</span>
        <div class="pipeline-node"><div class="pipeline-box">Cache</div></div>
@@ -1230,6 +1241,14 @@ footer .closing {
            <td class="cross">No</td>
            <td class="check">REST API + auto-expiry</td>
          </tr>
+          <tr>
+            <td>Local service proxy</td>
+            <td class="cross">No</td>
+            <td class="cross">No</td>
+            <td class="cross">No</td>
+            <td class="cross">No</td>
+            <td class="check">.numa domains + WebSocket</td>
+          </tr>
          <tr>
            <td>Data stays local</td>
            <td class="check">Yes</td>
@@ -1286,10 +1305,10 @@ footer .closing {
        <dd>Zero &mdash; wire protocol parsed from scratch</dd>

        <dt>Dependencies</dt>
-        <dd>6 runtime crates (tokio, axum, serde, serde_json, toml, log)</dd>
+        <dd>8 runtime crates (tokio, axum, hyper, serde, serde_json, toml, log, futures)</dd>

        <dt>Packet Format</dt>
-        <dd>RFC 1035 compliant, 512-byte UDP</dd>
+        <dd>RFC 1035 compliant, 4096-byte UDP (EDNS)</dd>

        <dt>Concurrency</dt>
        <dd>Arc&lt;ServerCtx&gt; + std::sync::Mutex (sub-&micro;s holds, never across .await)</dd>
@@ -1299,13 +1318,12 @@ footer .closing {
      </dl>
      <div class="code-block reveal reveal-delay-2">
 <span class="prompt">$</span> <span class="cmd">cargo install</span> numa
-<span class="prompt">$</span> <span class="cmd">sudo numa</span>                          <span class="comment"># bind to :53</span>
+<span class="prompt">$</span> <span class="cmd">sudo numa</span>                          <span class="comment"># bind to :53, :80, :5380</span>
 <span class="prompt">$</span> <span class="cmd">dig</span> <span class="flag">@127.0.0.1</span> google.com         <span class="comment"># test resolution</span>
-<span class="prompt">$</span> <span class="cmd">curl</span> localhost:5380/overrides      <span class="comment"># REST API</span>
-<span class="prompt">$</span> <span class="cmd">curl</span> <span class="flag">-X POST</span> localhost:5380/overrides \
-    <span class="flag">-d</span> <span class="str">'{"domain":"api.stripe.com",
-         "target":"127.0.0.1",
-         "duration_secs":1800}'</span>        <span class="comment"># 30-min override</span>
+<span class="prompt">$</span> <span class="cmd">open</span> http://numa.numa              <span class="comment"># dashboard</span>
+<span class="prompt">$</span> <span class="cmd">curl</span> <span class="flag">-X POST</span> localhost:5380/services \
+    <span class="flag">-d</span> <span class="str">'{"name":"frontend",
+         "target_port":5173}'</span>          <span class="comment"># http://frontend.numa</span>
      </div>
    </div>
  </div>
@@ -1333,28 +1351,32 @@ footer .closing {
        <span class="phase">Phase 2</span>
        <span class="phase-desc">Ad &amp; tracker blocking &mdash; 385K+ domains, live dashboard, one-click allowlist</span>
      </div>
-      <div class="roadmap-item phase-teal">
+      <div class="roadmap-item done">
        <span class="phase">Phase 3</span>
        <span class="phase-desc">System integration &mdash; auto-discovery of OS DNS routing, one-command install</span>
      </div>
-      <div class="roadmap-item phase-teal">
+      <div class="roadmap-item done">
        <span class="phase">Phase 4</span>
+        <span class="phase-desc">Local service proxy &mdash; .numa domains, HTTP reverse proxy, WebSocket support</span>
+      </div>
+      <div class="roadmap-item phase-teal">
+        <span class="phase">Phase 5</span>
        <span class="phase-desc">pkarr spike &mdash; DHT resolution and publish endpoint</span>
      </div>
      <div class="roadmap-item phase-teal">
-        <span class="phase">Phase 5</span>
+        <span class="phase">Phase 6</span>
        <span class="phase-desc">pkarr product &mdash; human-readable aliases, re-publish daemon, key management</span>
      </div>
      <div class="roadmap-item phase-amber">
-        <span class="phase">Phase 4</span>
+        <span class="phase">Phase 7</span>
        <span class="phase-desc">Challenge and audit protocol for verifiable resolver behavior</span>
      </div>
      <div class="roadmap-item phase-violet">
-        <span class="phase">Phase 5</span>
+        <span class="phase">Phase 8</span>
        <span class="phase-desc">Token economics, staking, and slashing mechanism</span>
      </div>
      <div class="roadmap-item phase-violet">
-        <span class="phase">Phase 6</span>
+        <span class="phase">Phase 9</span>
        <span class="phase-desc">Decentralized resolver marketplace</span>
      </div>
    </div>
--- a/src/api.rs
+++ b/src/api.rs
@@ -35,12 +35,17 @@ pub fn router(ctx: Arc<ServerCtx>) -> Router {
        .route("/blocking/stats", get(blocking_stats))
        .route("/blocking/toggle", put(blocking_toggle))
        .route("/blocking/pause", post(blocking_pause))
+        .route("/blocking/unpause", post(blocking_unpause))
        .route("/blocking/allowlist", get(blocking_allowlist))
        .route("/blocking/allowlist", post(blocking_allowlist_add))
+        .route("/blocking/check/{domain}", get(blocking_check))
        .route(
            "/blocking/allowlist/{domain}",
            delete(blocking_allowlist_remove),
        )
+        .route("/services", get(list_services))
+        .route("/services", post(create_service))
+        .route("/services/{name}", delete(remove_service))
        .with_state(ctx)
 }

@@ -532,6 +537,19 @@ async fn blocking_pause(
    Json(serde_json::json!({ "paused_minutes": req.minutes }))
 }

+async fn blocking_unpause(State(ctx): State<Arc<ServerCtx>>) -> Json<serde_json::Value> {
+    ctx.blocklist.lock().unwrap().unpause();
+    Json(serde_json::json!({ "paused": false }))
+}
+
+async fn blocking_check(
+    State(ctx): State<Arc<ServerCtx>>,
+    Path(domain): Path<String>,
+) -> Json<crate::blocklist::BlockCheckResult> {
+    let result = ctx.blocklist.lock().unwrap().check(&domain);
+    Json(result)
+}
+
 async fn blocking_allowlist(State(ctx): State<Arc<ServerCtx>>) -> Json<Vec<String>> {
    let list = ctx.blocklist.lock().unwrap().allowlist();
    Json(list)
@@ -563,3 +581,110 @@ async fn blocking_allowlist_remove(
        StatusCode::NOT_FOUND
    }
 }
+
+// --- Service proxy handlers ---
+
+#[derive(Serialize)]
+struct ServiceResponse {
+    name: String,
+    target_port: u16,
+    url: String,
+    healthy: bool,
+}
+
+#[derive(Deserialize)]
+struct CreateServiceRequest {
+    name: String,
+    target_port: u16,
+}
+
+async fn list_services(State(ctx): State<Arc<ServerCtx>>) -> Json<Vec<ServiceResponse>> {
+    let entries: Vec<_> = {
+        let store = ctx.services.lock().unwrap();
+        store
+            .list()
+            .into_iter()
+            .map(|e| (e.name.clone(), e.target_port))
+            .collect()
+    };
+    let tld = &ctx.proxy_tld;
+
+    // Run all health checks concurrently
+    let health_futures: Vec<_> = entries
+        .iter()
+        .map(|(_, port)| check_health(*port))
+        .collect();
+    let health_results = futures::future::join_all(health_futures).await;
+
+    let results: Vec<_> = entries
+        .into_iter()
+        .zip(health_results)
+        .map(|((name, port), healthy)| ServiceResponse {
+            url: format!("http://{}.{}", name, tld),
+            name,
+            target_port: port,
+            healthy,
+        })
+        .collect();
+    Json(results)
+}
+
+async fn create_service(
+    State(ctx): State<Arc<ServerCtx>>,
+    Json(req): Json<CreateServiceRequest>,
+) -> Result<(StatusCode, Json<ServiceResponse>), (StatusCode, String)> {
+    let name = req.name.to_lowercase();
+
+    // Validate name: alphanumeric + hyphens only, 1-63 chars
+    if name.is_empty() || name.len() > 63 {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "name must be 1-63 characters".into(),
+        ));
+    }
+    if !name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-') {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "name must contain only alphanumeric characters and hyphens".into(),
+        ));
+    }
+    if req.target_port == 0 {
+        return Err((StatusCode::BAD_REQUEST, "target_port must be > 0".into()));
+    }
+
+    let tld = &ctx.proxy_tld;
+    ctx.services.lock().unwrap().insert(&name, req.target_port);
+
+    let healthy = check_health(req.target_port).await;
+    Ok((
+        StatusCode::CREATED,
+        Json(ServiceResponse {
+            url: format!("http://{}.{}", name, tld),
+            name,
+            target_port: req.target_port,
+            healthy,
+        }),
+    ))
+}
+
+async fn remove_service(State(ctx): State<Arc<ServerCtx>>, Path(name): Path<String>) -> StatusCode {
+    if name.eq_ignore_ascii_case("numa") {
+        return StatusCode::FORBIDDEN;
+    }
+    let mut store = ctx.services.lock().unwrap();
+    if store.remove(&name) {
+        StatusCode::NO_CONTENT
+    } else {
+        StatusCode::NOT_FOUND
+    }
+}
+
+async fn check_health(port: u16) -> bool {
+    tokio::time::timeout(
+        std::time::Duration::from_millis(100),
+        tokio::net::TcpStream::connect(format!("127.0.0.1:{}", port)),
+    )
+    .await
+    .map(|r| r.is_ok())
+    .unwrap_or(false)
+}
--- a/src/blocklist.rs
+++ b/src/blocklist.rs
@@ -12,6 +12,44 @@ pub struct BlocklistStore {
    last_refresh: Option<Instant>,
 }

+#[derive(serde::Serialize)]
+pub struct BlockCheckResult {
+    pub blocked: bool,
+    pub reason: String,
+    pub matched_rule: Option<String>,
+}
+
+impl BlockCheckResult {
+    fn blocked(rule: &str, reason: &str) -> Self {
+        Self {
+            blocked: true,
+            reason: reason.to_string(),
+            matched_rule: Some(rule.to_string()),
+        }
+    }
+    fn allowed(rule: &str, reason: &str) -> Self {
+        Self {
+            blocked: false,
+            reason: reason.to_string(),
+            matched_rule: Some(rule.to_string()),
+        }
+    }
+    fn not_blocked() -> Self {
+        Self {
+            blocked: false,
+            reason: "not in blocklist".to_string(),
+            matched_rule: None,
+        }
+    }
+    fn disabled() -> Self {
+        Self {
+            blocked: false,
+            reason: "blocking is disabled".to_string(),
+            matched_rule: None,
+        }
+    }
+}
+
 pub struct BlocklistStats {
    pub enabled: bool,
    pub paused: bool,
@@ -73,6 +111,36 @@ impl BlocklistStore {
        false
    }

+    /// Check if a domain is blocked and return the reason.
+    pub fn check(&self, domain: &str) -> BlockCheckResult {
+        let domain = domain.to_lowercase();
+
+        if !self.enabled {
+            return BlockCheckResult::disabled();
+        }
+
+        if self.allowlist.contains(&domain) {
+            return BlockCheckResult::allowed(&domain, "exact match in allowlist");
+        }
+
+        if self.domains.contains(&domain) {
+            return BlockCheckResult::blocked(&domain, "exact match in blocklist");
+        }
+
+        let mut d = domain.as_str();
+        while let Some(dot) = d.find('.') {
+            d = &d[dot + 1..];
+            if self.allowlist.contains(d) {
+                return BlockCheckResult::allowed(d, "parent domain in allowlist");
+            }
+            if self.domains.contains(d) {
+                return BlockCheckResult::blocked(d, "parent domain in blocklist");
+            }
+        }
+
+        BlockCheckResult::not_blocked()
+    }
+
    /// Atomically swap in a new domain set. Build the set outside the lock,
    /// then call this to swap — keeps lock hold time sub-microsecond.
    pub fn swap_domains(&mut self, domains: HashSet<String>, sources: Vec<String>) {
@@ -93,6 +161,10 @@ impl BlocklistStore {
        self.paused_until = Some(Instant::now() + std::time::Duration::from_secs(seconds));
    }

+    pub fn unpause(&mut self) {
+        self.paused_until = None;
+    }
+
    pub fn is_paused(&self) -> bool {
        self.paused_until
            .map(|until| Instant::now() < until)
@@ -165,6 +237,7 @@ pub fn parse_blocklist(text: &str) -> HashSet<String> {
 pub async fn download_blocklists(lists: &[String]) -> Vec<(String, String)> {
    let client = reqwest::Client::builder()
        .timeout(std::time::Duration::from_secs(30))
+        .gzip(true)
        .build()
        .unwrap_or_default();

--- a/src/buffer.rs
+++ b/src/buffer.rs
@@ -1,7 +1,9 @@
 use crate::Result;

+const BUF_SIZE: usize = 4096;
+
 pub struct BytePacketBuffer {
-    pub buf: [u8; 512],
+    pub buf: [u8; BUF_SIZE],
    pub pos: usize,
 }

@@ -14,7 +16,7 @@ impl Default for BytePacketBuffer {
 impl BytePacketBuffer {
    pub fn new() -> BytePacketBuffer {
        BytePacketBuffer {
-            buf: [0; 512],
+            buf: [0; BUF_SIZE],
            pos: 0,
        }
    }
@@ -38,7 +40,7 @@ impl BytePacketBuffer {
    }

    pub fn read(&mut self) -> Result<u8> {
-        if self.pos >= 512 {
+        if self.pos >= BUF_SIZE {
            return Err("End of buffer".into());
        }
        let res = self.buf[self.pos];
@@ -47,14 +49,14 @@ impl BytePacketBuffer {
    }

    pub fn get(&self, pos: usize) -> Result<u8> {
-        if pos >= 512 {
+        if pos >= BUF_SIZE {
            return Err("End of buffer".into());
        }
        Ok(self.buf[pos])
    }

    pub fn get_range(&self, start: usize, len: usize) -> Result<&[u8]> {
-        if start + len > 512 {
+        if start + len > BUF_SIZE {
            return Err("End of buffer".into());
        }
        Ok(&self.buf[start..start + len])
@@ -128,7 +130,7 @@ impl BytePacketBuffer {
    }

    pub fn write(&mut self, val: u8) -> Result<()> {
-        if self.pos >= 512 {
+        if self.pos >= BUF_SIZE {
            return Err("End of buffer".into());
        }
        self.buf[self.pos] = val;
@@ -172,7 +174,7 @@ impl BytePacketBuffer {
    }

    pub fn set(&mut self, pos: usize, val: u8) -> Result<()> {
-        if pos >= 512 {
+        if pos >= BUF_SIZE {
            return Err("End of buffer".into());
        }
        self.buf[pos] = val;
--- a/src/config.rs
+++ b/src/config.rs
@@ -9,7 +9,7 @@ use crate::question::QueryType;
 use crate::record::DnsRecord;
 use crate::Result;

-#[derive(Deserialize)]
+#[derive(Deserialize, Default)]
 pub struct Config {
    #[serde(default)]
    pub server: ServerConfig,
@@ -21,6 +21,10 @@ pub struct Config {
    pub blocking: BlockingConfig,
    #[serde(default)]
    pub zones: Vec<ZoneRecord>,
+    #[serde(default)]
+    pub proxy: ProxyConfig,
+    #[serde(default)]
+    pub services: Vec<ServiceConfig>,
 }

 #[derive(Deserialize)]
@@ -69,7 +73,7 @@ impl Default for UpstreamConfig {
 }

 fn default_upstream_addr() -> String {
-    "8.8.8.8".to_string()
+    String::new() // empty = auto-detect from system resolver
 }
 fn default_upstream_port() -> u16 {
    53
@@ -156,15 +160,51 @@ fn default_zone_ttl() -> u32 {
    300
 }

+#[derive(Deserialize, Clone)]
+pub struct ProxyConfig {
+    #[serde(default = "default_proxy_enabled")]
+    pub enabled: bool,
+    #[serde(default = "default_proxy_port")]
+    pub port: u16,
+    #[serde(default = "default_proxy_tls_port")]
+    pub tls_port: u16,
+    #[serde(default = "default_proxy_tld")]
+    pub tld: String,
+}
+
+impl Default for ProxyConfig {
+    fn default() -> Self {
+        ProxyConfig {
+            enabled: default_proxy_enabled(),
+            port: default_proxy_port(),
+            tls_port: default_proxy_tls_port(),
+            tld: default_proxy_tld(),
+        }
+    }
+}
+
+fn default_proxy_enabled() -> bool {
+    true
+}
+fn default_proxy_port() -> u16 {
+    80
+}
+fn default_proxy_tls_port() -> u16 {
+    443
+}
+fn default_proxy_tld() -> String {
+    "numa".to_string()
+}
+
+#[derive(Deserialize, Clone)]
+pub struct ServiceConfig {
+    pub name: String,
+    pub target_port: u16,
+}
+
 pub fn load_config(path: &str) -> Result<Config> {
    if !Path::new(path).exists() {
-        return Ok(Config {
-            server: ServerConfig::default(),
-            upstream: UpstreamConfig::default(),
-            cache: CacheConfig::default(),
-            blocking: BlockingConfig::default(),
-            zones: Vec::new(),
-        });
+        return Ok(Config::default());
    }
    let contents = std::fs::read_to_string(path)?;
    let config: Config = toml::from_str(&contents)?;
--- a/src/ctx.rs
+++ b/src/ctx.rs
@@ -14,7 +14,9 @@ use crate::header::ResultCode;
 use crate::override_store::OverrideStore;
 use crate::packet::DnsPacket;
 use crate::query_log::{QueryLog, QueryLogEntry};
+use crate::question::QueryType;
 use crate::record::DnsRecord;
+use crate::service_store::ServiceStore;
 use crate::stats::{QueryPath, ServerStats};
 use crate::system_dns::ForwardingRule;

@@ -26,9 +28,12 @@ pub struct ServerCtx {
    pub overrides: Mutex<OverrideStore>,
    pub blocklist: Mutex<BlocklistStore>,
    pub query_log: Mutex<QueryLog>,
+    pub services: Mutex<ServiceStore>,
    pub forwarding_rules: Vec<ForwardingRule>,
    pub upstream: SocketAddr,
    pub timeout: Duration,
+    pub proxy_tld: String,
+    pub proxy_tld_suffix: String, // pre-computed ".{tld}" to avoid per-query allocation
 }

 pub async fn handle_query(
@@ -51,7 +56,7 @@ pub async fn handle_query(
        None => return Ok(()),
    };

-    // Pipeline: overrides -> blocklist -> local zones -> cache -> upstream
+    // Pipeline: overrides -> .tld interception -> blocklist -> local zones -> cache -> upstream
    // Each lock is scoped to avoid holding MutexGuard across await points.
    let (response, path) = {
        let override_record = ctx.overrides.lock().unwrap().lookup(&qname);
@@ -59,8 +64,24 @@ pub async fn handle_query(
            let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
            resp.answers.push(record);
            (resp, QueryPath::Overridden)
+        } else if !ctx.proxy_tld_suffix.is_empty()
+            && (qname.ends_with(&ctx.proxy_tld_suffix) || qname == ctx.proxy_tld)
+        {
+            let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
+            match qtype {
+                QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
+                    domain: qname.clone(),
+                    addr: std::net::Ipv6Addr::LOCALHOST,
+                    ttl: 300,
+                }),
+                _ => resp.answers.push(DnsRecord::A {
+                    domain: qname.clone(),
+                    addr: std::net::Ipv4Addr::LOCALHOST,
+                    ttl: 300,
+                }),
+            }
+            (resp, QueryPath::Local)
        } else if ctx.blocklist.lock().unwrap().is_blocked(&qname) {
-            use crate::question::QueryType;
            let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
            match qtype {
                QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -8,11 +8,40 @@ pub mod forward;
 pub mod header;
 pub mod override_store;
 pub mod packet;
+pub mod proxy;
 pub mod query_log;
 pub mod question;
 pub mod record;
+pub mod service_store;
 pub mod stats;
 pub mod system_dns;
+pub mod tls;

 pub type Error = Box<dyn std::error::Error + Send + Sync>;
 pub type Result<T> = std::result::Result<T, Error>;
+
+/// Shared config directory: ~/.config/numa/
+/// Handles sudo (uses SUDO_USER) and launchd (falls back to /usr/local/var/numa/).
+pub fn config_dir() -> std::path::PathBuf {
+    // When run via sudo, SUDO_USER has the real user
+    if let Ok(user) = std::env::var("SUDO_USER") {
+        let home = if cfg!(target_os = "macos") {
+            format!("/Users/{}", user)
+        } else {
+            format!("/home/{}", user)
+        };
+        return std::path::PathBuf::from(home).join(".config").join("numa");
+    }
+
+    // Normal user (not root)
+    if let Ok(home) = std::env::var("HOME") {
+        let path = std::path::PathBuf::from(&home);
+        // /var/root on macOS is read-only (SIP), use /usr/local/var/numa instead
+        if !home.starts_with("/var/root") && !home.starts_with("/root") {
+            return path.join(".config").join("numa");
+        }
+    }
+
+    // Running as root daemon (launchd/systemd) — use system-wide path
+    std::path::PathBuf::from("/usr/local/var/numa")
+}
--- a/src/main.rs
+++ b/src/main.rs
@@ -12,8 +12,12 @@ use numa::config::{build_zone_map, load_config};
 use numa::ctx::{handle_query, ServerCtx};
 use numa::override_store::OverrideStore;
 use numa::query_log::QueryLog;
+use numa::service_store::ServiceStore;
 use numa::stats::ServerStats;
-use numa::system_dns::{discover_forwarding_rules, install_system_dns, uninstall_system_dns};
+use numa::system_dns::{
+    discover_system_dns, install_service, install_system_dns, restart_service, service_status,
+    uninstall_service, uninstall_system_dns,
+};

 #[tokio::main]
 async fn main() -> numa::Result<()> {
@@ -32,14 +36,36 @@ async fn main() -> numa::Result<()> {
            eprintln!("\x1b[1;38;2;192;98;58mNuma\x1b[0m — restoring system DNS\n");
            return uninstall_system_dns().map_err(|e| e.into());
        }
+        "service" => {
+            let sub = std::env::args().nth(2).unwrap_or_default();
+            eprintln!("\x1b[1;38;2;192;98;58mNuma\x1b[0m — service management\n");
+            return match sub.as_str() {
+                "start" => install_service().map_err(|e| e.into()),
+                "stop" => uninstall_service().map_err(|e| e.into()),
+                "restart" => restart_service().map_err(|e| e.into()),
+                "status" => service_status().map_err(|e| e.into()),
+                _ => {
+                    eprintln!("Usage: numa service <start|stop|restart|status>");
+                    Ok(())
+                }
+            };
+        }
+        "version" | "--version" | "-V" => {
+            eprintln!("numa {}", env!("CARGO_PKG_VERSION"));
+            return Ok(());
+        }
        "help" | "--help" | "-h" => {
            eprintln!("Usage: numa [command] [config-path]");
            eprintln!();
            eprintln!("Commands:");
-            eprintln!("  (none)       Start the DNS server (default)");
-            eprintln!("  install      Set system DNS to 127.0.0.1 (requires sudo)");
-            eprintln!("  uninstall    Restore original system DNS settings");
-            eprintln!("  help         Show this help");
+            eprintln!("  (none)          Start the DNS server (default)");
+            eprintln!("  install         Set system DNS to 127.0.0.1 (requires sudo)");
+            eprintln!("  uninstall       Restore original system DNS settings");
+            eprintln!("  service start   Install as system service (auto-start on boot)");
+            eprintln!("  service stop    Uninstall the system service");
+            eprintln!("  service restart Restart the service with updated binary");
+            eprintln!("  service status  Check if the service is running");
+            eprintln!("  help            Show this help");
            eprintln!();
            eprintln!("Config path defaults to numa.toml");
            return Ok(());
@@ -56,8 +82,18 @@ async fn main() -> numa::Result<()> {
    };
    let config = load_config(&config_path)?;

-    let upstream: SocketAddr =
-        format!("{}:{}", config.upstream.address, config.upstream.port).parse()?;
+    // Discover system DNS in a single pass (upstream + forwarding rules)
+    let system_dns = discover_system_dns();
+
+    let upstream_addr = if config.upstream.address.is_empty() {
+        system_dns.default_upstream.unwrap_or_else(|| {
+            info!("could not detect system DNS, falling back to 9.9.9.9 (Quad9)");
+            "9.9.9.9".to_string()
+        })
+    } else {
+        config.upstream.address.clone()
+    };
+    let upstream: SocketAddr = format!("{}:{}", upstream_addr, config.upstream.port).parse()?;
    let api_port = config.server.api_port;

    let mut blocklist = BlocklistStore::new();
@@ -68,8 +104,15 @@ async fn main() -> numa::Result<()> {
        blocklist.set_enabled(false);
    }

-    // Auto-discover conditional forwarding rules from OS (Tailscale, VPN, etc.)
-    let forwarding_rules = discover_forwarding_rules();
+    // Build service store: config services + persisted user services
+    let mut service_store = ServiceStore::new();
+    service_store.insert_from_config("numa", config.server.api_port);
+    for svc in &config.services {
+        service_store.insert_from_config(&svc.name, svc.target_port);
+    }
+    service_store.load_persisted();
+
+    let forwarding_rules = system_dns.forwarding_rules;

    let ctx = Arc::new(ServerCtx {
        socket: UdpSocket::bind(&config.server.bind_addr).await?,
@@ -83,14 +126,21 @@ async fn main() -> numa::Result<()> {
        overrides: Mutex::new(OverrideStore::new()),
        blocklist: Mutex::new(blocklist),
        query_log: Mutex::new(QueryLog::new(1000)),
+        services: Mutex::new(service_store),
        forwarding_rules,
        upstream,
        timeout: Duration::from_millis(config.upstream.timeout_ms),
+        proxy_tld_suffix: if config.proxy.tld.is_empty() {
+            String::new()
+        } else {
+            format!(".{}", config.proxy.tld)
+        },
+        proxy_tld: config.proxy.tld.clone(),
    });

    let zone_count: usize = ctx.zone_map.values().map(|m| m.len()).sum();
    eprintln!("\n\x1b[38;2;192;98;58m  ╔══════════════════════════════════════════╗\x1b[0m");
-    eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[1;38;2;192;98;58mNUMA\x1b[0m  \x1b[3;38;2;163;152;136mDNS that governs itself\x1b[0m       \x1b[38;2;192;98;58m║\x1b[0m");
+    eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[1;38;2;192;98;58mNUMA\x1b[0m  \x1b[3;38;2;163;152;136mDNS that governs itself\x1b[0m  \x1b[38;2;163;152;136mv{}\x1b[0m \x1b[38;2;192;98;58m║\x1b[0m", env!("CARGO_PKG_VERSION"));
    eprintln!("\x1b[38;2;192;98;58m  ╠══════════════════════════════════════════╣\x1b[0m");
    eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[38;2;107;124;78mDNS\x1b[0m       {:<30}\x1b[38;2;192;98;58m║\x1b[0m", config.server.bind_addr);
    eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[38;2;107;124;78mAPI\x1b[0m       http://localhost:{:<16}\x1b[38;2;192;98;58m║\x1b[0m", api_port);
@@ -100,6 +150,17 @@ async fn main() -> numa::Result<()> {
    eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[38;2;107;124;78mCache\x1b[0m     {:<30}\x1b[38;2;192;98;58m║\x1b[0m", format!("max {} entries", config.cache.max_entries));
    eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[38;2;107;124;78mBlocking\x1b[0m  {:<30}\x1b[38;2;192;98;58m║\x1b[0m",
        if config.blocking.enabled { format!("{} lists", config.blocking.lists.len()) } else { "disabled".to_string() });
+    if config.proxy.enabled {
+        let schemes = if config.proxy.tls_port > 0 {
+            format!(
+                "http://:{} https://:{}",
+                config.proxy.port, config.proxy.tls_port
+            )
+        } else {
+            format!("http://*.{} on :{}", config.proxy.tld, config.proxy.port)
+        };
+        eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[38;2;107;124;78mProxy\x1b[0m     {:<30}\x1b[38;2;192;98;58m║\x1b[0m", schemes);
+    }
    if !ctx.forwarding_rules.is_empty() {
        eprintln!("\x1b[38;2;192;98;58m  ║\x1b[0m  \x1b[38;2;107;124;78mRouting\x1b[0m   {:<30}\x1b[38;2;192;98;58m║\x1b[0m",
            format!("{} conditional rules", ctx.forwarding_rules.len()));
@@ -141,6 +202,39 @@ async fn main() -> numa::Result<()> {
        axum::serve(listener, app).await.unwrap();
    });

+    // Spawn HTTP reverse proxy for .numa domains
+    if config.proxy.enabled {
+        let proxy_ctx = Arc::clone(&ctx);
+        let proxy_port = config.proxy.port;
+        tokio::spawn(async move {
+            numa::proxy::start_proxy(proxy_ctx, proxy_port).await;
+        });
+    }
+
+    // Spawn HTTPS reverse proxy with TLS termination
+    if config.proxy.enabled && config.proxy.tls_port > 0 {
+        let service_names: Vec<String> = ctx
+            .services
+            .lock()
+            .unwrap()
+            .list()
+            .iter()
+            .map(|e| e.name.clone())
+            .collect();
+        match numa::tls::build_tls_config(&config.proxy.tld, &service_names) {
+            Ok(tls_config) => {
+                let proxy_ctx = Arc::clone(&ctx);
+                let tls_port = config.proxy.tls_port;
+                tokio::spawn(async move {
+                    numa::proxy::start_proxy_tls(proxy_ctx, tls_port, tls_config).await;
+                });
+            }
+            Err(e) => {
+                log::warn!("TLS setup failed, HTTPS proxy disabled: {}", e);
+            }
+        }
+    }
+
    // UDP DNS listener
    #[allow(clippy::infinite_loop)]
    loop {
--- a/src/packet.rs
+++ b/src/packet.rs
@@ -68,24 +68,33 @@ impl DnsPacket {
    }

    pub fn write(&self, buffer: &mut BytePacketBuffer) -> Result<()> {
+        // Filter out UNKNOWN records (e.g. EDNS OPT) that we can't re-serialize
+        let answers: Vec<_> = self.answers.iter().filter(|r| !r.is_unknown()).collect();
+        let authorities: Vec<_> = self
+            .authorities
+            .iter()
+            .filter(|r| !r.is_unknown())
+            .collect();
+        let resources: Vec<_> = self.resources.iter().filter(|r| !r.is_unknown()).collect();
+
        let mut header = self.header.clone();
        header.questions = self.questions.len() as u16;
-        header.answers = self.answers.len() as u16;
-        header.authoritative_entries = self.authorities.len() as u16;
-        header.resource_entries = self.resources.len() as u16;
+        header.answers = answers.len() as u16;
+        header.authoritative_entries = authorities.len() as u16;
+        header.resource_entries = resources.len() as u16;

        header.write(buffer)?;

        for question in &self.questions {
            question.write(buffer)?;
        }
-        for rec in &self.answers {
+        for rec in answers {
            rec.write(buffer)?;
        }
-        for rec in &self.authorities {
+        for rec in authorities {
            rec.write(buffer)?;
        }
-        for rec in &self.resources {
+        for rec in resources {
            rec.write(buffer)?;
        }

--- a/src/proxy.rs
+++ b/src/proxy.rs
@@ -0,0 +1,241 @@
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use axum::body::Body;
+use axum::extract::{Request, State};
+use axum::response::IntoResponse;
+use axum::routing::any;
+use axum::Router;
+use http_body_util::BodyExt;
+use hyper::StatusCode;
+use hyper_util::client::legacy::Client;
+use hyper_util::rt::TokioExecutor;
+use log::{debug, error, info, warn};
+use rustls::ServerConfig;
+use tokio::io::copy_bidirectional;
+use tokio_rustls::TlsAcceptor;
+
+use crate::ctx::ServerCtx;
+
+type HttpClient = Client<hyper_util::client::legacy::connect::HttpConnector, Body>;
+
+#[derive(Clone)]
+struct ProxyState {
+    ctx: Arc<ServerCtx>,
+    client: HttpClient,
+}
+
+pub async fn start_proxy(ctx: Arc<ServerCtx>, port: u16) {
+    let addr: SocketAddr = ([0, 0, 0, 0], port).into();
+    let listener = match tokio::net::TcpListener::bind(addr).await {
+        Ok(l) => l,
+        Err(e) => {
+            warn!(
+                "proxy: could not bind port {} ({}) — proxy disabled",
+                port, e
+            );
+            return;
+        }
+    };
+    info!("HTTP proxy listening on {}", addr);
+
+    let client: HttpClient = Client::builder(TokioExecutor::new())
+        .http1_preserve_header_case(true)
+        .build_http();
+
+    let state = ProxyState { ctx, client };
+
+    let app = Router::new().fallback(any(proxy_handler)).with_state(state);
+
+    axum::serve(listener, app).await.unwrap();
+}
+
+pub async fn start_proxy_tls(ctx: Arc<ServerCtx>, port: u16, tls_config: Arc<ServerConfig>) {
+    let addr: SocketAddr = ([0, 0, 0, 0], port).into();
+    let listener = match tokio::net::TcpListener::bind(addr).await {
+        Ok(l) => l,
+        Err(e) => {
+            warn!(
+                "proxy: could not bind TLS port {} ({}) — HTTPS proxy disabled",
+                port, e
+            );
+            return;
+        }
+    };
+    info!("HTTPS proxy listening on {}", addr);
+
+    let acceptor = TlsAcceptor::from(tls_config);
+    let client: HttpClient = Client::builder(TokioExecutor::new())
+        .http1_preserve_header_case(true)
+        .build_http();
+
+    let state = ProxyState { ctx, client };
+
+    let app = Router::new().fallback(any(proxy_handler)).with_state(state);
+
+    loop {
+        let (tcp_stream, remote_addr) = match listener.accept().await {
+            Ok(conn) => conn,
+            Err(e) => {
+                error!("TLS accept error: {}", e);
+                continue;
+            }
+        };
+
+        let acceptor = acceptor.clone();
+        let app = app.clone();
+
+        tokio::spawn(async move {
+            let tls_stream = match acceptor.accept(tcp_stream).await {
+                Ok(s) => s,
+                Err(e) => {
+                    debug!("TLS handshake failed from {}: {}", remote_addr, e);
+                    return;
+                }
+            };
+
+            let io = hyper_util::rt::TokioIo::new(tls_stream);
+            let svc = hyper_util::service::TowerToHyperService::new(app.into_service());
+
+            if let Err(e) = hyper::server::conn::http1::Builder::new()
+                .preserve_header_case(true)
+                .serve_connection(io, svc)
+                .with_upgrades()
+                .await
+            {
+                debug!("TLS connection error from {}: {}", remote_addr, e);
+            }
+        });
+    }
+}
+
+fn extract_host(req: &Request) -> Option<String> {
+    req.headers()
+        .get(hyper::header::HOST)
+        .and_then(|v| v.to_str().ok())
+        .map(|h| h.split(':').next().unwrap_or(h).to_lowercase())
+}
+
+async fn proxy_handler(State(state): State<ProxyState>, req: Request) -> axum::response::Response {
+    let hostname = match extract_host(&req) {
+        Some(h) => h,
+        None => {
+            return (StatusCode::BAD_REQUEST, "missing Host header").into_response();
+        }
+    };
+
+    let service_name = match hostname.strip_suffix(state.ctx.proxy_tld_suffix.as_str()) {
+        Some(name) => name.to_string(),
+        None => {
+            return (
+                StatusCode::BAD_GATEWAY,
+                format!("not a {} domain: {}", state.ctx.proxy_tld_suffix, hostname),
+            )
+                .into_response()
+        }
+    };
+
+    let target_port = {
+        let store = state.ctx.services.lock().unwrap();
+        match store.lookup(&service_name) {
+            Some(entry) => entry.target_port,
+            None => {
+                return (
+                    StatusCode::BAD_GATEWAY,
+                    format!(
+                        "unknown service: {}{}",
+                        service_name, state.ctx.proxy_tld_suffix
+                    ),
+                )
+                    .into_response()
+            }
+        }
+    };
+
+    let path_and_query = req
+        .uri()
+        .path_and_query()
+        .map(|pq| pq.as_str())
+        .unwrap_or("/");
+    let target_uri: hyper::Uri = format!("http://localhost:{}{}", target_port, path_and_query)
+        .parse()
+        .unwrap();
+
+    // Check for upgrade request (WebSocket, etc.)
+    let is_upgrade = req.headers().get(hyper::header::UPGRADE).is_some();
+
+    if is_upgrade {
+        return handle_upgrade(req, target_uri, state.client.clone()).await;
+    }
+
+    // Regular HTTP proxy
+    let (mut parts, body) = req.into_parts();
+    parts.uri = target_uri;
+    let proxied_req = Request::from_parts(parts, body);
+
+    match state.client.request(proxied_req).await {
+        Ok(resp) => {
+            let (parts, body) = resp.into_parts();
+            let body = Body::new(body.map_err(axum::Error::new));
+            axum::response::Response::from_parts(parts, body)
+        }
+        Err(e) => (StatusCode::BAD_GATEWAY, format!("proxy error: {}", e)).into_response(),
+    }
+}
+
+async fn handle_upgrade(
+    mut req: Request,
+    target_uri: hyper::Uri,
+    client: HttpClient,
+) -> axum::response::Response {
+    // Save the client-side upgrade future before forwarding
+    let client_upgrade = hyper::upgrade::on(&mut req);
+
+    // Forward the request to backend
+    let (mut parts, body) = req.into_parts();
+    parts.uri = target_uri;
+    let backend_req = Request::from_parts(parts, body);
+
+    let mut backend_resp = match client.request(backend_req).await {
+        Ok(r) => r,
+        Err(e) => {
+            return (StatusCode::BAD_GATEWAY, format!("upgrade error: {}", e)).into_response()
+        }
+    };
+
+    if backend_resp.status() != StatusCode::SWITCHING_PROTOCOLS {
+        let (parts, body) = backend_resp.into_parts();
+        let body = Body::new(body.map_err(axum::Error::new));
+        return axum::response::Response::from_parts(parts, body);
+    }
+
+    // Save response headers before consuming for upgrade
+    let resp_headers = backend_resp.headers().clone();
+    let backend_upgrade = hyper::upgrade::on(&mut backend_resp);
+
+    // Spawn bidirectional pipe once both sides are upgraded
+    tokio::spawn(async move {
+        let (client_io, backend_io) = match tokio::try_join!(client_upgrade, backend_upgrade) {
+            Ok((c, b)) => (c, b),
+            Err(e) => {
+                error!("proxy upgrade failed: {}", e);
+                return;
+            }
+        };
+
+        let mut client_rw = hyper_util::rt::TokioIo::new(client_io);
+        let mut backend_rw = hyper_util::rt::TokioIo::new(backend_io);
+
+        match copy_bidirectional(&mut client_rw, &mut backend_rw).await {
+            Ok((up, down)) => debug!("ws proxy closed: {} up, {} down bytes", up, down),
+            Err(e) => debug!("ws proxy error: {}", e),
+        }
+    });
+
+    // Return 101 to client with the backend's upgrade headers
+    let mut resp = axum::response::Response::builder().status(StatusCode::SWITCHING_PROTOCOLS);
+    for (key, value) in &resp_headers {
+        resp = resp.header(key, value);
+    }
+    resp.body(Body::empty()).unwrap()
+}
--- a/src/question.rs
+++ b/src/question.rs
@@ -7,8 +7,13 @@ pub enum QueryType {
    A,     // 1
    NS,    // 2
    CNAME, // 5
+    SOA,   // 6
+    PTR,   // 12
    MX,    // 15
+    TXT,   // 16
    AAAA,  // 28
+    SRV,   // 33
+    HTTPS, // 65
 }

 impl QueryType {
@@ -18,8 +23,13 @@ impl QueryType {
            QueryType::A => 1,
            QueryType::NS => 2,
            QueryType::CNAME => 5,
+            QueryType::SOA => 6,
+            QueryType::PTR => 12,
            QueryType::MX => 15,
+            QueryType::TXT => 16,
            QueryType::AAAA => 28,
+            QueryType::SRV => 33,
+            QueryType::HTTPS => 65,
        }
    }

@@ -28,8 +38,13 @@ impl QueryType {
            1 => QueryType::A,
            2 => QueryType::NS,
            5 => QueryType::CNAME,
+            6 => QueryType::SOA,
+            12 => QueryType::PTR,
            15 => QueryType::MX,
+            16 => QueryType::TXT,
            28 => QueryType::AAAA,
+            33 => QueryType::SRV,
+            65 => QueryType::HTTPS,
            _ => QueryType::UNKNOWN(num),
        }
    }
@@ -39,25 +54,30 @@ impl QueryType {
            QueryType::A => "A",
            QueryType::NS => "NS",
            QueryType::CNAME => "CNAME",
+            QueryType::SOA => "SOA",
+            QueryType::PTR => "PTR",
            QueryType::MX => "MX",
+            QueryType::TXT => "TXT",
            QueryType::AAAA => "AAAA",
+            QueryType::SRV => "SRV",
+            QueryType::HTTPS => "HTTPS",
            QueryType::UNKNOWN(_) => "UNKNOWN",
        }
    }

    pub fn parse_str(s: &str) -> Option<QueryType> {
-        if s.eq_ignore_ascii_case("A") {
-            Some(QueryType::A)
-        } else if s.eq_ignore_ascii_case("NS") {
-            Some(QueryType::NS)
-        } else if s.eq_ignore_ascii_case("CNAME") {
-            Some(QueryType::CNAME)
-        } else if s.eq_ignore_ascii_case("MX") {
-            Some(QueryType::MX)
-        } else if s.eq_ignore_ascii_case("AAAA") {
-            Some(QueryType::AAAA)
-        } else {
-            None
+        match s.to_ascii_uppercase().as_str() {
+            "A" => Some(QueryType::A),
+            "NS" => Some(QueryType::NS),
+            "CNAME" => Some(QueryType::CNAME),
+            "SOA" => Some(QueryType::SOA),
+            "PTR" => Some(QueryType::PTR),
+            "MX" => Some(QueryType::MX),
+            "TXT" => Some(QueryType::TXT),
+            "AAAA" => Some(QueryType::AAAA),
+            "SRV" => Some(QueryType::SRV),
+            "HTTPS" => Some(QueryType::HTTPS),
+            _ => None,
        }
    }
 }
--- a/src/record.rs
+++ b/src/record.rs
@@ -43,6 +43,10 @@ pub enum DnsRecord {
 }

 impl DnsRecord {
+    pub fn is_unknown(&self) -> bool {
+        matches!(self, DnsRecord::UNKNOWN { .. })
+    }
+
    pub fn ttl(&self) -> u32 {
        match self {
            DnsRecord::A { ttl, .. }
@@ -137,7 +141,7 @@ impl DnsRecord {
                    ttl,
                })
            }
-            QueryType::UNKNOWN(_) => {
+            _ => {
                buffer.step(data_len as usize)?;

                Ok(DnsRecord::UNKNOWN {
--- a/src/service_store.rs
+++ b/src/service_store.rs
@@ -0,0 +1,135 @@
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use log::{info, warn};
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct ServiceEntry {
+    pub name: String,
+    pub target_port: u16,
+}
+
+pub struct ServiceStore {
+    entries: HashMap<String, ServiceEntry>,
+    /// Services defined in numa.toml (not persisted to user file)
+    config_services: std::collections::HashSet<String>,
+    persist_path: PathBuf,
+}
+
+impl Default for ServiceStore {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl ServiceStore {
+    pub fn new() -> Self {
+        let persist_path = dirs_path();
+        ServiceStore {
+            entries: HashMap::new(),
+            config_services: std::collections::HashSet::new(),
+            persist_path,
+        }
+    }
+
+    /// Insert a service from numa.toml config (not persisted)
+    pub fn insert_from_config(&mut self, name: &str, target_port: u16) {
+        let key = name.to_lowercase();
+        self.config_services.insert(key.clone());
+        self.entries.insert(
+            key.clone(),
+            ServiceEntry {
+                name: key,
+                target_port,
+            },
+        );
+    }
+
+    /// Insert a user-defined service (persisted to ~/.config/numa/services.json)
+    pub fn insert(&mut self, name: &str, target_port: u16) {
+        let key = name.to_lowercase();
+        self.entries.insert(
+            key.clone(),
+            ServiceEntry {
+                name: key,
+                target_port,
+            },
+        );
+        self.save();
+    }
+
+    pub fn lookup(&self, name: &str) -> Option<&ServiceEntry> {
+        self.entries.get(&name.to_lowercase())
+    }
+
+    pub fn remove(&mut self, name: &str) -> bool {
+        let key = name.to_lowercase();
+        let removed = self.entries.remove(&key).is_some();
+        if removed {
+            self.save();
+        }
+        removed
+    }
+
+    pub fn list(&self) -> Vec<&ServiceEntry> {
+        let mut entries: Vec<_> = self.entries.values().collect();
+        entries.sort_by(|a, b| a.name.cmp(&b.name));
+        entries
+    }
+
+    /// Load user-defined services from ~/.config/numa/services.json
+    pub fn load_persisted(&mut self) {
+        if !self.persist_path.exists() {
+            return;
+        }
+        match std::fs::read_to_string(&self.persist_path) {
+            Ok(contents) => match serde_json::from_str::<Vec<ServiceEntry>>(&contents) {
+                Ok(entries) => {
+                    let count = entries.len();
+                    for entry in entries {
+                        let key = entry.name.to_lowercase();
+                        // Don't overwrite config-defined services
+                        if !self.config_services.contains(&key) {
+                            self.entries.insert(key, entry);
+                        }
+                    }
+                    if count > 0 {
+                        info!(
+                            "loaded {} persisted services from {:?}",
+                            count, self.persist_path
+                        );
+                    }
+                }
+                Err(e) => warn!("failed to parse {:?}: {}", self.persist_path, e),
+            },
+            Err(e) => warn!("failed to read {:?}: {}", self.persist_path, e),
+        }
+    }
+
+    /// Save user-defined services (excluding config and "numa") to disk
+    fn save(&self) {
+        let user_services: Vec<&ServiceEntry> = self
+            .entries
+            .values()
+            .filter(|e| !self.config_services.contains(&e.name))
+            .collect();
+
+        if let Some(parent) = self.persist_path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+
+        match serde_json::to_string_pretty(&user_services) {
+            Ok(json) => {
+                if let Err(e) = std::fs::write(&self.persist_path, json) {
+                    warn!("failed to save services to {:?}: {}", self.persist_path, e);
+                }
+            }
+            Err(e) => warn!("failed to serialize services: {}", e),
+        }
+    }
+}
+
+fn dirs_path() -> PathBuf {
+    crate::config_dir().join("services.json")
+}
--- a/src/system_dns.rs
+++ b/src/system_dns.rs
@@ -10,38 +10,48 @@ pub struct ForwardingRule {
    pub upstream: SocketAddr,
 }

-/// Discover system DNS forwarding rules from the OS.
-/// On macOS, parses `scutil --dns`. Returns rules sorted longest-suffix-first
-/// so more specific matches take priority.
-pub fn discover_forwarding_rules() -> Vec<ForwardingRule> {
+/// Result of system DNS discovery — default upstream + conditional forwarding rules.
+pub struct SystemDnsInfo {
+    pub default_upstream: Option<String>,
+    pub forwarding_rules: Vec<ForwardingRule>,
+}
+
+/// Discover system DNS configuration in a single pass.
+/// On macOS: parses `scutil --dns` once for both the default upstream and forwarding rules.
+/// On Linux: reads `/etc/resolv.conf` for upstream, no forwarding rules yet.
+pub fn discover_system_dns() -> SystemDnsInfo {
    #[cfg(target_os = "macos")]
    {
        discover_macos()
    }
    #[cfg(not(target_os = "macos"))]
    {
-        info!("system DNS auto-discovery not implemented for this OS");
-        Vec::new()
+        SystemDnsInfo {
+            default_upstream: detect_upstream_linux_or_backup(),
+            forwarding_rules: Vec::new(),
+        }
    }
 }

 #[cfg(target_os = "macos")]
-fn discover_macos() -> Vec<ForwardingRule> {
+fn discover_macos() -> SystemDnsInfo {
    use log::{debug, warn};

    let output = match std::process::Command::new("scutil").arg("--dns").output() {
        Ok(o) => o,
        Err(e) => {
            warn!("failed to run scutil --dns: {}", e);
-            return Vec::new();
+            return SystemDnsInfo {
+                default_upstream: None,
+                forwarding_rules: Vec::new(),
+            };
        }
    };

    let text = String::from_utf8_lossy(&output.stdout);
    let mut rules = Vec::new();
+    let mut default_upstream: Option<String> = None;

-    // Parse resolver blocks: look for blocks with both `domain` and `nameserver[0]`
-    // that have the `Supplemental` flag (conditional forwarding, not default)
    let mut current_domain: Option<String> = None;
    let mut current_nameserver: Option<String> = None;
    let mut is_supplemental = false;
@@ -50,7 +60,7 @@ fn discover_macos() -> Vec<ForwardingRule> {
        let line = line.trim();

        if line.starts_with("resolver #") {
-            // Emit previous block if valid
+            // Emit previous supplemental block as forwarding rule
            if let (Some(domain), Some(ns), true) = (
                current_domain.take(),
                current_nameserver.take(),
@@ -64,7 +74,6 @@ fn discover_macos() -> Vec<ForwardingRule> {
            current_nameserver = None;
            is_supplemental = false;
        } else if line.starts_with("domain") && line.contains(':') {
-            // "domain   : tailcee7cc.ts.net."
            if let Some(val) = line.split(':').nth(1) {
                let domain = val.trim().trim_end_matches('.').to_lowercase();
                if !domain.is_empty()
@@ -78,15 +87,21 @@ fn discover_macos() -> Vec<ForwardingRule> {
        } else if line.starts_with("nameserver[0]") && line.contains(':') {
            if let Some(val) = line.split(':').nth(1) {
                let ns = val.trim().to_string();
-                // Only use IPv4 nameservers for now
                if ns.parse::<std::net::Ipv4Addr>().is_ok() {
-                    current_nameserver = Some(ns);
+                    current_nameserver = Some(ns.clone());
+                    // Capture first non-supplemental, non-loopback nameserver as default upstream
+                    if !is_supplemental
+                        && default_upstream.is_none()
+                        && ns != "127.0.0.1"
+                        && ns != "0.0.0.0"
+                    {
+                        default_upstream = Some(ns);
+                    }
                }
            }
        } else if line.starts_with("flags") && line.contains("Supplemental") {
            is_supplemental = true;
        } else if line.starts_with("DNS configuration (for scoped") {
-            // Stop at scoped section — those are interface-specific, not conditional
            if let (Some(domain), Some(ns), true) = (
                current_domain.take(),
                current_nameserver.take(),
@@ -116,12 +131,17 @@ fn discover_macos() -> Vec<ForwardingRule> {
            rule.suffix, rule.upstream
        );
    }
-
    if rules.is_empty() {
-        debug!("no conditional forwarding rules discovered from scutil --dns");
+        debug!("no conditional forwarding rules discovered");
+    }
+    if let Some(ref ns) = default_upstream {
+        info!("detected system upstream: {}", ns);
    }

-    rules
+    SystemDnsInfo {
+        default_upstream,
+        forwarding_rules: rules,
+    }
 }

 #[cfg(target_os = "macos")]
@@ -134,6 +154,45 @@ fn make_rule(domain: &str, nameserver: &str) -> Option<ForwardingRule> {
    })
 }

+/// Detect upstream from /etc/resolv.conf, falling back to backup file if resolv.conf
+/// only has loopback (meaning numa install already ran).
+#[cfg(not(target_os = "macos"))]
+fn detect_upstream_linux_or_backup() -> Option<String> {
+    // Try /etc/resolv.conf first
+    if let Some(ns) = read_upstream_from_file("/etc/resolv.conf") {
+        info!("detected system upstream: {}", ns);
+        return Some(ns);
+    }
+    // If resolv.conf only has loopback, check the backup from `numa install`
+    let backup = {
+        let home = std::env::var("HOME")
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(|_| std::path::PathBuf::from("/root"));
+        home.join(".numa").join("original-resolv.conf")
+    };
+    if let Some(ns) = read_upstream_from_file(backup.to_str().unwrap_or("")) {
+        info!("detected original upstream from backup: {}", ns);
+        return Some(ns);
+    }
+    None
+}
+
+#[cfg(not(target_os = "macos"))]
+fn read_upstream_from_file(path: &str) -> Option<String> {
+    let text = std::fs::read_to_string(path).ok()?;
+    for line in text.lines() {
+        let line = line.trim();
+        if line.starts_with("nameserver") {
+            if let Some(ns) = line.split_whitespace().nth(1) {
+                if ns != "127.0.0.1" && ns != "0.0.0.0" && ns != "::1" {
+                    return Some(ns.to_string());
+                }
+            }
+        }
+    }
+    None
+}
+
 /// Find the upstream for a domain by checking forwarding rules.
 /// Returns None if no rule matches (use default upstream).
 /// Zero-allocation on the hot path — dot_suffix is pre-computed.
@@ -152,21 +211,25 @@ pub fn match_forwarding_rule(domain: &str, rules: &[ForwardingRule]) -> Option<S
 /// Saves the original DNS settings for later restoration.
 pub fn install_system_dns() -> Result<(), String> {
    #[cfg(target_os = "macos")]
-    {
-        install_macos()
-    }
+    let result = install_macos();
    #[cfg(target_os = "linux")]
-    {
-        install_linux()
-    }
+    let result = install_linux();
    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
-    {
-        Err("system DNS configuration not supported on this OS".to_string())
+    let result = Err("system DNS configuration not supported on this OS".to_string());
+
+    if result.is_ok() {
+        if let Err(e) = trust_ca() {
+            eprintln!("  warning: could not trust CA: {}", e);
+            eprintln!("  HTTPS proxy will work but browsers will show certificate warnings.\n");
+        }
    }
+    result
 }

 /// Restore the original system DNS settings saved during install.
 pub fn uninstall_system_dns() -> Result<(), String> {
+    let _ = untrust_ca();
+
    #[cfg(target_os = "macos")]
    {
        uninstall_macos()
@@ -186,8 +249,9 @@ pub fn uninstall_system_dns() -> Result<(), String> {
 #[cfg(target_os = "macos")]
 fn numa_data_dir() -> std::path::PathBuf {
    let home = std::env::var("HOME")
+        .or_else(|_| std::env::var("SUDO_USER").map(|u| format!("/Users/{}", u)))
        .map(std::path::PathBuf::from)
-        .unwrap_or_else(|_| std::path::PathBuf::from("/tmp"));
+        .unwrap_or_else(|_| std::path::PathBuf::from("/var/root"));
    home.join(".numa")
 }

@@ -315,17 +379,489 @@ fn uninstall_macos() -> Result<(), String> {
    Ok(())
 }

-// --- Linux stubs ---
+// --- Service management ---
+
+#[cfg(target_os = "macos")]
+const PLIST_LABEL: &str = "com.numa.dns";
+#[cfg(target_os = "macos")]
+const PLIST_DEST: &str = "/Library/LaunchDaemons/com.numa.dns.plist";
+#[cfg(target_os = "linux")]
+const SYSTEMD_UNIT: &str = "/etc/systemd/system/numa.service";
+
+/// Install Numa as a system service that starts on boot and auto-restarts.
+pub fn install_service() -> Result<(), String> {
+    #[cfg(target_os = "macos")]
+    {
+        install_service_macos()
+    }
+    #[cfg(target_os = "linux")]
+    {
+        install_service_linux()
+    }
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
+    {
+        Err("service installation not supported on this OS".to_string())
+    }
+}
+
+/// Uninstall the Numa system service.
+pub fn uninstall_service() -> Result<(), String> {
+    #[cfg(target_os = "macos")]
+    {
+        uninstall_service_macos()
+    }
+    #[cfg(target_os = "linux")]
+    {
+        uninstall_service_linux()
+    }
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
+    {
+        Err("service uninstallation not supported on this OS".to_string())
+    }
+}
+
+/// Restart the service (kill process, launchd/systemd auto-restarts with new binary).
+pub fn restart_service() -> Result<(), String> {
+    // Show version of the binary that will be running after restart
+    let version = match std::process::Command::new("/usr/local/bin/numa")
+        .arg("--version")
+        .output()
+    {
+        Ok(o) => String::from_utf8_lossy(&o.stderr).trim().to_string(),
+        Err(_) => "unknown".to_string(),
+    };
+
+    #[cfg(target_os = "macos")]
+    {
+        let output = std::process::Command::new("launchctl")
+            .args(["list", PLIST_LABEL])
+            .output();
+        match output {
+            Ok(o) if o.status.success() => {
+                eprintln!("  Tip: use 'make deploy' instead — handles codesign + restart.\n");
+                // Codesign, then kill service. Launchd KeepAlive respawns it.
+                // This will kill us too (we ARE /usr/local/bin/numa), so
+                // codesign and print output first.
+                let _ = std::process::Command::new("codesign")
+                    .args(["-f", "-s", "-", "/usr/local/bin/numa"])
+                    .output(); // use output() to suppress codesign stderr
+                eprintln!("  Service restarting → {}\n", version);
+                let _ = std::process::Command::new("pkill")
+                    .args(["-f", "/usr/local/bin/numa"])
+                    .status();
+                Ok(())
+            }
+            _ => Err("Service is not installed. Run 'sudo numa service start' first.".to_string()),
+        }
+    }
+    #[cfg(target_os = "linux")]
+    {
+        run_systemctl(&["restart", "numa"])?;
+        eprintln!("  Service restarted → {}\n", version);
+        Ok(())
+    }
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
+    {
+        Err("service restart not supported on this OS".to_string())
+    }
+}
+
+/// Show the service status.
+pub fn service_status() -> Result<(), String> {
+    #[cfg(target_os = "macos")]
+    {
+        service_status_macos()
+    }
+    #[cfg(target_os = "linux")]
+    {
+        service_status_linux()
+    }
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
+    {
+        Err("service status not supported on this OS".to_string())
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn install_service_macos() -> Result<(), String> {
+    // Check binary exists
+    if !std::path::Path::new("/usr/local/bin/numa").exists() {
+        return Err("numa binary not found at /usr/local/bin/numa. Run: sudo cp target/release/numa /usr/local/bin/numa".to_string());
+    }
+
+    // Create log directory
+    std::fs::create_dir_all("/usr/local/var/log")
+        .map_err(|e| format!("failed to create log dir: {}", e))?;
+
+    // Write plist
+    let plist = include_str!("../com.numa.dns.plist");
+    std::fs::write(PLIST_DEST, plist)
+        .map_err(|e| format!("failed to write {}: {}", PLIST_DEST, e))?;
+
+    // Load the service
+    let status = std::process::Command::new("launchctl")
+        .args(["load", "-w", PLIST_DEST])
+        .status()
+        .map_err(|e| format!("failed to run launchctl: {}", e))?;
+
+    if !status.success() {
+        return Err("launchctl load failed".to_string());
+    }
+
+    // Set system DNS to 127.0.0.1 now that the service is running
+    eprintln!("  Service installed and started.");
+    if let Err(e) = install_macos() {
+        eprintln!("  warning: failed to configure system DNS: {}", e);
+    }
+    eprintln!("  Numa will auto-start on boot and restart if killed.");
+    eprintln!("  Logs: /usr/local/var/log/numa.log");
+    eprintln!("  Run 'sudo numa service stop' to fully uninstall.\n");
+    Ok(())
+}
+
+#[cfg(target_os = "macos")]
+fn uninstall_service_macos() -> Result<(), String> {
+    // Restore DNS first, while numa is still running to handle any final queries
+    if let Err(e) = uninstall_macos() {
+        eprintln!("  warning: failed to restore system DNS: {}", e);
+    }
+
+    // Remove plist first so service won't restart on boot even if unload fails
+    if let Err(e) = std::fs::remove_file(PLIST_DEST) {
+        if e.kind() != std::io::ErrorKind::NotFound {
+            return Err(format!("failed to remove {}: {}", PLIST_DEST, e));
+        }
+    }
+
+    // Unload the service
+    let status = std::process::Command::new("launchctl")
+        .args(["unload", "-w", PLIST_DEST])
+        .status();
+    if let Ok(s) = status {
+        if !s.success() {
+            eprintln!(
+                "  warning: launchctl unload returned non-zero (service may still be running)"
+            );
+        }
+    }
+
+    eprintln!("  Service uninstalled. Numa will no longer auto-start.\n");
+    Ok(())
+}
+
+#[cfg(target_os = "macos")]
+fn service_status_macos() -> Result<(), String> {
+    let output = std::process::Command::new("launchctl")
+        .args(["list", PLIST_LABEL])
+        .output()
+        .map_err(|e| format!("failed to run launchctl: {}", e))?;
+
+    if output.status.success() {
+        let text = String::from_utf8_lossy(&output.stdout);
+        eprintln!("  Numa service is loaded.\n");
+        for line in text.lines() {
+            eprintln!("  {}", line);
+        }
+        eprintln!();
+    } else {
+        eprintln!("  Numa service is not installed.\n");
+    }
+    Ok(())
+}
+
+// --- Linux implementation ---
+
+#[cfg(target_os = "linux")]
+fn backup_path_linux() -> std::path::PathBuf {
+    let home = std::env::var("HOME")
+        .map(std::path::PathBuf::from)
+        .unwrap_or_else(|_| std::path::PathBuf::from("/root"));
+    home.join(".numa").join("original-resolv.conf")
+}
+
+#[cfg(target_os = "linux")]
+fn is_systemd_resolved_active() -> bool {
+    std::process::Command::new("systemctl")
+        .args(["is-active", "--quiet", "systemd-resolved"])
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}

 #[cfg(target_os = "linux")]
 fn install_linux() -> Result<(), String> {
-    Err(
-        "Linux auto-configuration not yet implemented. Manually set your DNS to 127.0.0.1"
-            .to_string(),
-    )
+    // Detect systemd-resolved — direct resolv.conf manipulation won't persist
+    if is_systemd_resolved_active() {
+        let resolved_dir = std::path::Path::new("/etc/systemd/resolved.conf.d");
+        std::fs::create_dir_all(resolved_dir)
+            .map_err(|e| format!("failed to create {}: {}", resolved_dir.display(), e))?;
+
+        let drop_in = resolved_dir.join("numa.conf");
+        std::fs::write(&drop_in, "[Resolve]\nDNS=127.0.0.1\nDomains=~.\n")
+            .map_err(|e| format!("failed to write {}: {}", drop_in.display(), e))?;
+
+        let _ = run_systemctl(&["restart", "systemd-resolved"]);
+        eprintln!("  systemd-resolved detected.");
+        eprintln!("  Installed drop-in: {}", drop_in.display());
+        eprintln!("  Run 'sudo numa uninstall' to remove.\n");
+        return Ok(());
+    }
+
+    // Fallback: direct resolv.conf manipulation
+    let resolv = std::path::Path::new("/etc/resolv.conf");
+    let backup = backup_path_linux();
+
+    // Ensure backup directory exists
+    if let Some(parent) = backup.parent() {
+        std::fs::create_dir_all(parent)
+            .map_err(|e| format!("failed to create {}: {}", parent.display(), e))?;
+    }
+
+    // Back up current resolv.conf (ignore NotFound)
+    match std::fs::copy(resolv, &backup) {
+        Ok(_) => eprintln!("  Saved /etc/resolv.conf to {}", backup.display()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => return Err(format!("failed to backup /etc/resolv.conf: {}", e)),
+    }
+
+    if resolv
+        .symlink_metadata()
+        .map(|m| m.file_type().is_symlink())
+        .unwrap_or(false)
+    {
+        eprintln!("  warning: /etc/resolv.conf is a symlink — changes may not persist.");
+        eprintln!("  Consider using systemd-resolved or NetworkManager instead.\n");
+    }
+
+    let content =
+        "# Generated by Numa — run 'sudo numa uninstall' to restore\nnameserver 127.0.0.1\n";
+    std::fs::write(resolv, content)
+        .map_err(|e| format!("failed to write /etc/resolv.conf: {}", e))?;
+
+    eprintln!("  Set /etc/resolv.conf -> nameserver 127.0.0.1");
+    eprintln!("  Run 'sudo numa uninstall' to restore.\n");
+    Ok(())
 }

 #[cfg(target_os = "linux")]
 fn uninstall_linux() -> Result<(), String> {
-    Err("Linux auto-configuration not yet implemented.".to_string())
+    // Check for systemd-resolved drop-in first
+    let drop_in = std::path::Path::new("/etc/systemd/resolved.conf.d/numa.conf");
+    if drop_in.exists() {
+        std::fs::remove_file(drop_in)
+            .map_err(|e| format!("failed to remove {}: {}", drop_in.display(), e))?;
+        let _ = run_systemctl(&["restart", "systemd-resolved"]);
+        eprintln!("  Removed systemd-resolved drop-in. DNS restored.\n");
+        return Ok(());
+    }
+
+    // Fallback: restore resolv.conf from backup
+    let backup = backup_path_linux();
+    let resolv = std::path::Path::new("/etc/resolv.conf");
+
+    match std::fs::copy(&backup, resolv) {
+        Ok(_) => {
+            std::fs::remove_file(&backup).ok();
+            eprintln!("  Restored /etc/resolv.conf from backup. Backup removed.\n");
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+            eprintln!("  No backup found at {}.", backup.display());
+            eprintln!("  Manually edit /etc/resolv.conf to restore your DNS.\n");
+        }
+        Err(e) => return Err(format!("failed to restore /etc/resolv.conf: {}", e)),
+    }
+    Ok(())
+}
+
+#[cfg(target_os = "linux")]
+fn ensure_binary_installed() -> Result<(), String> {
+    if !std::path::Path::new("/usr/local/bin/numa").exists() {
+        return Err("numa binary not found at /usr/local/bin/numa. Run: sudo cp target/release/numa /usr/local/bin/numa".to_string());
+    }
+    Ok(())
+}
+
+#[cfg(target_os = "linux")]
+fn install_service_linux() -> Result<(), String> {
+    ensure_binary_installed()?;
+
+    let unit = include_str!("../numa.service");
+    std::fs::write(SYSTEMD_UNIT, unit)
+        .map_err(|e| format!("failed to write {}: {}", SYSTEMD_UNIT, e))?;
+
+    run_systemctl(&["daemon-reload"])?;
+    run_systemctl(&["enable", "numa"])?;
+    run_systemctl(&["start", "numa"])?;
+
+    eprintln!("  Service installed and started.");
+
+    // Set system DNS now that the service is running
+    if let Err(e) = install_linux() {
+        eprintln!("  warning: failed to configure system DNS: {}", e);
+    }
+    eprintln!("  Numa will auto-start on boot and restart if killed.");
+    eprintln!("  Logs: journalctl -u numa -f");
+    eprintln!("  Run 'sudo numa service stop' to fully uninstall.\n");
+    Ok(())
+}
+
+#[cfg(target_os = "linux")]
+fn uninstall_service_linux() -> Result<(), String> {
+    // Restore DNS first, while numa is still running
+    if let Err(e) = uninstall_linux() {
+        eprintln!("  warning: failed to restore system DNS: {}", e);
+    }
+
+    if let Err(e) = run_systemctl(&["stop", "numa"]) {
+        eprintln!("  warning: {}", e);
+    }
+    if let Err(e) = run_systemctl(&["disable", "numa"]) {
+        eprintln!("  warning: {}", e);
+    }
+
+    if let Err(e) = std::fs::remove_file(SYSTEMD_UNIT) {
+        if e.kind() != std::io::ErrorKind::NotFound {
+            return Err(format!("failed to remove {}: {}", SYSTEMD_UNIT, e));
+        }
+    }
+    let _ = run_systemctl(&["daemon-reload"]);
+
+    eprintln!("  Service uninstalled. Numa will no longer auto-start.\n");
+    Ok(())
+}
+
+#[cfg(target_os = "linux")]
+fn service_status_linux() -> Result<(), String> {
+    let output = std::process::Command::new("systemctl")
+        .args(["status", "numa"])
+        .output()
+        .map_err(|e| format!("failed to run systemctl: {}", e))?;
+
+    let text = String::from_utf8_lossy(&output.stdout);
+    if text.is_empty() {
+        eprintln!("  Numa service is not installed.\n");
+    } else {
+        for line in text.lines() {
+            eprintln!("  {}", line);
+        }
+        eprintln!();
+    }
+    Ok(())
+}
+
+#[cfg(target_os = "linux")]
+fn run_systemctl(args: &[&str]) -> Result<(), String> {
+    let status = std::process::Command::new("systemctl")
+        .args(args)
+        .status()
+        .map_err(|e| format!("systemctl {} failed: {}", args.join(" "), e))?;
+    if status.success() {
+        Ok(())
+    } else {
+        Err(format!(
+            "systemctl {} exited with {}",
+            args.join(" "),
+            status
+        ))
+    }
+}
+
+// --- CA trust management ---
+
+fn trust_ca() -> Result<(), String> {
+    let ca_path = std::path::PathBuf::from("/usr/local/var/numa/ca.pem");
+    if !ca_path.exists() {
+        return Err("CA not generated yet — start numa first to create certificates".into());
+    }
+
+    #[cfg(target_os = "macos")]
+    {
+        let status = std::process::Command::new("security")
+            .args([
+                "add-trusted-cert",
+                "-d",
+                "-r",
+                "trustRoot",
+                "-k",
+                "/Library/Keychains/System.keychain",
+            ])
+            .arg(&ca_path)
+            .status()
+            .map_err(|e| format!("security: {}", e))?;
+        if !status.success() {
+            return Err("security add-trusted-cert failed".into());
+        }
+        eprintln!("  Trusted Numa CA in system keychain");
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        let dest = std::path::Path::new("/usr/local/share/ca-certificates/numa-local-ca.crt");
+        std::fs::copy(&ca_path, dest).map_err(|e| format!("copy CA: {}", e))?;
+        let status = std::process::Command::new("update-ca-certificates")
+            .status()
+            .map_err(|e| format!("update-ca-certificates: {}", e))?;
+        if !status.success() {
+            return Err("update-ca-certificates failed".into());
+        }
+        eprintln!("  Trusted Numa CA system-wide");
+    }
+
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
+    {
+        return Err("CA trust not supported on this OS".into());
+    }
+
+    Ok(())
+}
+
+fn untrust_ca() -> Result<(), String> {
+    let ca_path = std::path::PathBuf::from("/usr/local/var/numa/ca.pem");
+
+    #[cfg(target_os = "macos")]
+    {
+        // Find all Numa CA certs by hash and delete each one
+        if let Ok(out) = std::process::Command::new("security")
+            .args([
+                "find-certificate",
+                "-c",
+                "Numa Local CA",
+                "-a",
+                "-Z",
+                "/Library/Keychains/System.keychain",
+            ])
+            .output()
+        {
+            let stdout = String::from_utf8_lossy(&out.stdout);
+            for line in stdout.lines() {
+                if let Some(hash) = line.strip_prefix("SHA-1 hash: ") {
+                    let hash = hash.trim();
+                    let _ = std::process::Command::new("security")
+                        .args([
+                            "delete-certificate",
+                            "-Z",
+                            hash,
+                            "/Library/Keychains/System.keychain",
+                        ])
+                        .output();
+                }
+            }
+        }
+        eprintln!("  Removed Numa CA from system keychain");
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        let dest = std::path::Path::new("/usr/local/share/ca-certificates/numa-local-ca.crt");
+        if dest.exists() {
+            let _ = std::fs::remove_file(dest);
+            let _ = std::process::Command::new("update-ca-certificates")
+                .arg("--fresh")
+                .status();
+            eprintln!("  Removed Numa CA from system trust store");
+        }
+    }
+
+    let _ = ca_path; // suppress unused warning on other platforms
+    Ok(())
 }
--- a/src/tls.rs
+++ b/src/tls.rs
@@ -0,0 +1,129 @@
+use std::path::Path;
+use std::sync::Arc;
+
+use log::{info, warn};
+use rcgen::{BasicConstraints, CertificateParams, DnType, IsCa, KeyPair, KeyUsagePurpose, SanType};
+use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
+use rustls::ServerConfig;
+use time::{Duration, OffsetDateTime};
+
+const CA_VALIDITY_DAYS: i64 = 3650; // 10 years
+const CERT_VALIDITY_DAYS: i64 = 365; // 1 year
+
+/// TLS certs use a fixed system path — both the daemon and `sudo numa install` must agree.
+pub const TLS_DIR: &str = "/usr/local/var/numa";
+
+/// Build a TLS config with a cert covering all provided service names.
+/// Wildcards under single-label TLDs (*.numa) are rejected by browsers,
+/// so we list each service explicitly as a SAN.
+pub fn build_tls_config(tld: &str, service_names: &[String]) -> crate::Result<Arc<ServerConfig>> {
+    let dir = std::path::PathBuf::from(TLS_DIR);
+    let (ca_cert, ca_key) = ensure_ca(&dir)?;
+    let (cert_chain, key) = generate_service_cert(&ca_cert, &ca_key, tld, service_names)?;
+
+    // Ensure a crypto provider is installed (rustls needs one)
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
+    let config = ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(cert_chain, key)?;
+
+    info!(
+        "TLS configured for {} .{} domains",
+        service_names.len(),
+        tld
+    );
+    Ok(Arc::new(config))
+}
+
+fn ensure_ca(dir: &Path) -> crate::Result<(rcgen::Certificate, KeyPair)> {
+    let ca_key_path = dir.join("ca.key");
+    let ca_cert_path = dir.join("ca.pem");
+
+    if ca_key_path.exists() && ca_cert_path.exists() {
+        let key_pem = std::fs::read_to_string(&ca_key_path)?;
+        let cert_pem = std::fs::read_to_string(&ca_cert_path)?;
+        let key_pair = KeyPair::from_pem(&key_pem)?;
+        let params = CertificateParams::from_ca_cert_pem(&cert_pem)?;
+        let cert = params.self_signed(&key_pair)?;
+        info!("loaded CA from {:?}", ca_cert_path);
+        return Ok((cert, key_pair));
+    }
+
+    // Generate new CA
+    std::fs::create_dir_all(dir)?;
+
+    let key_pair = KeyPair::generate()?;
+    let mut params = CertificateParams::default();
+    params
+        .distinguished_name
+        .push(DnType::CommonName, "Numa Local CA");
+    params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+    params.key_usages = vec![KeyUsagePurpose::KeyCertSign, KeyUsagePurpose::CrlSign];
+    params.not_before = OffsetDateTime::now_utc();
+    params.not_after = OffsetDateTime::now_utc() + Duration::days(CA_VALIDITY_DAYS);
+
+    let cert = params.self_signed(&key_pair)?;
+
+    std::fs::write(&ca_key_path, key_pair.serialize_pem())?;
+    std::fs::write(&ca_cert_path, cert.pem())?;
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&ca_key_path, std::fs::Permissions::from_mode(0o600))?;
+    }
+
+    info!("generated CA at {:?}", ca_cert_path);
+    Ok((cert, key_pair))
+}
+
+/// Generate a cert with explicit SANs for each service name.
+/// Always regenerated at startup (~5ms) — no disk caching needed.
+fn generate_service_cert(
+    ca_cert: &rcgen::Certificate,
+    ca_key: &KeyPair,
+    tld: &str,
+    service_names: &[String],
+) -> crate::Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>)> {
+    let key_pair = KeyPair::generate()?;
+    let mut params = CertificateParams::default();
+    params
+        .distinguished_name
+        .push(DnType::CommonName, format!("Numa .{} services", tld));
+
+    // Add each service as an explicit SAN: numa.numa, peekm.numa, api.numa, etc.
+    let mut sans = Vec::new();
+    for name in service_names {
+        let fqdn = format!("{}.{}", name, tld);
+        match fqdn.clone().try_into() {
+            Ok(ia5) => sans.push(SanType::DnsName(ia5)),
+            Err(e) => warn!("invalid SAN {}: {}", fqdn, e),
+        }
+    }
+
+    if sans.is_empty() {
+        return Err("no valid service names for TLS cert".into());
+    }
+
+    params.subject_alt_names = sans;
+    params.not_before = OffsetDateTime::now_utc();
+    params.not_after = OffsetDateTime::now_utc() + Duration::days(CERT_VALIDITY_DAYS);
+
+    let cert = params.signed_by(&key_pair, ca_cert, ca_key)?;
+
+    info!(
+        "generated TLS cert for: {}",
+        service_names
+            .iter()
+            .map(|n| format!("{}.{}", n, tld))
+            .collect::<Vec<_>>()
+            .join(", ")
+    );
+
+    let cert_der = CertificateDer::from(cert.der().to_vec());
+    let ca_der = CertificateDer::from(ca_cert.der().to_vec());
+    let key_der = PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(key_pair.serialize_der()));
+
+    Ok((vec![cert_der, ca_der], key_der))
+}