client: add onchain reconciler to daemon

CHANGELOG.md

@@ -47,6 +47,8 @@ All notable changes to this project will be documented in this file.
   - Fix BGP `OnClose` deleting routes from all peers instead of only the closing peer, preventing multicast teardown from nuking unicast routes
   - Skip route deletion on `OnClose` for `NoInstall` peers (multicast) since they never install kernel routes
   - Reject BGP martian addresses (CGNAT, multicast, reserved, benchmarking, etc.) as client IP during `connect`
+  - Add onchain reconciler to daemon — automatically provisions/removes tunnels by polling onchain User state, replacing CLI-driven provisioning and the `doublezerod.json` state file ([RFC-17](rfcs/rfc17-client-onchain-reconciler.md))
+  - Add `doublezero enable` / `doublezero disable` CLI commands to toggle the reconciler at runtime
 - Controller
   - detect duplicate (UnderlaySrcIP, UnderlayDstIP) pairs for tunnels and only render the first to the device config and write a log error for the second
 - Onchain Programs
@@ -83,7 +85,6 @@ All notable changes to this project will be documented in this file.
 - N/A
 
 ### Changes
-
 - Activator
   - removes accesspass monitor task (that expires access passes)
 - Monitor

DEVELOPMENT.md

@@ -113,14 +113,12 @@ docker exec -it dz-local-manager doublezero access-pass set \
   --user-payer 6gRC1rfTDJP2KzKnBjbcG3LijaVs56fSAsCLyZBU6qa5
 
 # Connect to DoubleZero from the clients
-# NOTE:
-#  - These are example pubkeys in the container names, yours will be different
-#  - The `--client-ip` refers to the containers own IP
+# NOTE: These are example pubkeys in the container names, yours will be different
 docker exec -it dz-local-client-FposHWrkvPP3VErBAWCd4ELWGuh2mgx2Wx6cuNEA4X2S \
-  doublezero connect ibrl --client-ip 10.169.90.100 --device dz1
+  doublezero connect ibrl --device dz1
 
 docker exec -it dz-local-client-6gRC1rfTDJP2KzKnBjbcG3LijaVs56fSAsCLyZBU6qa5 \
-  doublezero connect ibrl --client-ip 10.169.90.110 --device dz2
+  doublezero connect ibrl --device dz2
 
 # List running containers
 docker ps

client/doublezero/src/cli/command.rs

@@ -7,7 +7,8 @@ use crate::{
         resource::ResourceCliCommand, tenant::TenantCliCommand, user::UserCliCommand,
     },
     command::{
-        connect::ProvisioningCliCommand, disconnect::DecommissioningCliCommand,
+        connect::ProvisioningCliCommand, disable::DisableCliCommand,
+        disconnect::DecommissioningCliCommand, enable::EnableCliCommand,
         latency::LatencyCliCommand, routes::RoutesCliCommand, status::StatusCliCommand,
     },
 };
@@ -28,6 +29,12 @@ pub enum Command {
     /// Connect your server to a doublezero device
     #[command()]
     Connect(ProvisioningCliCommand),
+    /// Enable the reconciler (start managing tunnels)
+    #[command()]
+    Enable(EnableCliCommand),
+    /// Disable the reconciler (tear down tunnels and stop managing them)
+    #[command()]
+    Disable(DisableCliCommand),
     /// Get the status of your service
     #[command()]
     Status(StatusCliCommand),