Hidden interfaces, last-seen pings, activity by subnet

- interfaces.exclude in steward.yaml (names or shell patterns) leaves
  interfaces out of GET /interfaces, the web UI's picker and
  'steward interface list'. Subnets on them are still served.
- With the ping check on, active leases are pinged every minute; a
  client that answers gets a last-seen time (leases.last_seen,
  migration 4). Not answering never takes a client offline.
- The activity log filters by subnet (--subnet, the Activity page,
  GET /events?subnet=).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_config.go

@@ -572,6 +572,9 @@ func (s *Server) interfaces(w http.ResponseWriter, r *http.Request, p *auth.Prin
 	st := s.eng.State()
 	out := []api.HostInterface{}
 	for name, ps := range all {
+		if s.excludedInterface(name) {
+			continue
+		}
 		hi := api.HostInterface{Name: name, Addresses: []string{}, Subnets: []int64{}}
 		for _, a := range ps {
 			hi.Addresses = append(hi.Addresses, a.String())
@@ -585,7 +588,7 @@ func (s *Server) interfaces(w http.ResponseWriter, r *http.Request, p *auth.Prin
 	}
 	// Subnets may name interfaces that don't exist (yet).
 	for _, sn := range st.Subnets {
-		if _, ok := all[sn.Interface]; !ok && sn.Interface != "" {
+		if _, ok := all[sn.Interface]; !ok && sn.Interface != "" && !s.excludedInterface(sn.Interface) {
 			found := false
 			for i := range out {
 				if out[i].Name == sn.Interface {

internal/server/h_leases.go

@@ -153,7 +153,30 @@ func (s *Server) listEvents(w http.ResponseWriter, r *http.Request, p *auth.Prin
 	if err := require(p, auth.ResLeases, false); err != nil {
 		return err
 	}
-	evs := s.dhcp.Events(queryInt(r, "limit", 200), r.URL.Query().Get("mac"), r.URL.Query().Get("interface"))
+	q := r.URL.Query()
+	var only *model.Subnet
+	if ref := q.Get("subnet"); ref != "" {
+		var err error
+		if only, err = subnetRef(s.eng.State(), ref); err != nil {
+			return err
+		}
+	}
+	mac, iface := q.Get("mac"), q.Get("interface")
+	evs := s.dhcp.Events(queryInt(r, "limit", 200), func(e dhcpd.Event) bool {
+		if mac != "" && !strings.EqualFold(e.MAC, mac) || iface != "" && e.Interface != iface {
+			return false
+		}
+		if only != nil {
+			// A message with an address belongs to the subnet that has
+			// it; one without (a DISCOVER) to every subnet on its
+			// interface.
+			if ip, err := netip.ParseAddr(e.IP); err == nil {
+				return only.Prefix.Contains(ip)
+			}
+			return e.Interface == only.Interface
+		}
+		return true
+	})
 	out := make([]api.Event, len(evs))
 	for i, e := range evs {
 		out[i] = api.Event(e)

internal/server/server.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/netip"
 	"os"
+	"path"
 	"strconv"
 	"strings"
 	"sync"
@@ -44,6 +45,20 @@ type Config struct {
 	// ACME keeps the certificate stewardd obtains itself (tls.acme; nil
 	// when off).
 	ACME *certs.Manager
+	// ExcludeInterfaces are interface names or path.Match patterns left
+	// out of GET /interfaces (interfaces.exclude).
+	ExcludeInterfaces []string
+}
+
+// excludedInterface reports whether interfaces.exclude hides the
+// interface name.
+func (s *Server) excludedInterface(name string) bool {
+	for _, p := range s.cfg.ExcludeInterfaces {
+		if ok, _ := path.Match(p, name); ok {
+			return true
+		}
+	}
+	return false
 }
 
 // Interfaces lists the host's interfaces.

internal/server/server_test.go

@@ -11,6 +11,7 @@ import (
 	"net/http/cookiejar"
 	"net/http/httptest"
 	"net/netip"
+	"net/url"
 	"strings"
 	"testing"
 
@@ -246,6 +247,16 @@ func TestLeasesThroughDHCP(t *testing.T) {
 	if len(evs) != 4 || evs[0].Type != "DHCPACK" {
 		t.Errorf("events %+v", evs)
 	}
+	// By subnet: its addresses, and DISCOVERs on its interface.
+	e.call(e.token, "POST", "/subnets", api.SubnetInput{Name: ptr("office"), Prefix: ptr("10.0.10.0/24"), Interface: ptr("eth0")}, nil)
+	for ref, want := range map[string]int{"iot": 4, "10.0.20.0/24": 4, "office": 0} {
+		if code := e.call(e.token, "GET", "/events?subnet="+url.QueryEscape(ref), nil, &evs); code != 200 || len(evs) != want {
+			t.Errorf("events of subnet %s: %d %+v", ref, code, evs)
+		}
+	}
+	if code := e.call(e.token, "GET", "/events?subnet=nope", nil, nil); code != 404 && code != 400 {
+		t.Errorf("unknown subnet: %d", code)
+	}
 	if code := e.call(e.token, "DELETE", "/leases/"+ip, nil, nil); code != 204 {
 		t.Errorf("delete lease: %d", code)
 	}
@@ -380,3 +391,17 @@ func TestTokenRotation(t *testing.T) {
 		t.Errorf("a token rotating itself: %d", code)
 	}
 }
+
+func TestInterfacesExclude(t *testing.T) {
+	e := newEnv(t)
+	e.srv.cfg.ExcludeInterfaces = []string{"eth0.*", "docker*"}
+	// A subnet on an excluded interface the host doesn't have.
+	if c := e.call(e.token, "POST", "/subnets", api.SubnetInput{Prefix: ptr("172.17.0.0/16"), Interface: ptr("docker0")}, nil); c != 201 {
+		t.Fatalf("create: %d", c)
+	}
+	var ifs []api.HostInterface
+	e.call(e.token, "GET", "/interfaces", nil, &ifs)
+	if len(ifs) != 1 || ifs[0].Name != "eth0" {
+		t.Errorf("interfaces: %+v", ifs)
+	}
+}