diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000..4a4726a
--- /dev/null
+++ b/.envrc
@@ -0,0 +1 @@
+use_nix
diff --git a/.gitignore b/.gitignore
index 7672b7d..07180cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,22 +1,15 @@
 /reaction
-/ip46tables
-/nft46
-reaction*.db
-reaction*.db.old
+reaction.db
+reaction.db.old
 /data
-/lmdb
-reaction*.export.json
 /reaction*.sock
 /result
 /wiki
-/deb
 *.deb
 *.minisig
 *.qcow2
-debian-packaging/*
 *.swp
-export-go-db/export-go-db
-import-rust-db/target
 /target
 /local
 .ccls-cache
+.direnv
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
deleted file mode 100644
index 78d7601..0000000
--- a/.gitlab-ci.yml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-image: golang:1.20-bookworm
-stages:
-  - build
-
-variables:
-  DEBIAN_FRONTEND: noninteractive
-
-test_building:
-  stage: build
-  before_script:
-    - apt-get -qq -y update
-    - apt-get -qq -y install build-essential devscripts debhelper quilt wget
-  script:
-    - make reaction ip46tables nft46
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index f43d2ad..4289e65 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -6,6 +6,7 @@ Here is a high-level overview of the codebase.
 
 ## Build
 
+- `bench/`: Configuration that spawns a very high load on reaction. Useful to test performance improvements and regressions.
 - `build.rs`: permits to create shell completions and man pages on build.
 - `Cargo.toml`, `Cargo.lock`: manifest and dependencies.
 - `config/`: example / test configuration files. Look at its git history to discover more.
@@ -15,8 +16,7 @@ Here is a high-level overview of the codebase.
 
 ## Main source code
 
-- `helpers_c/`: C helpers. I wish to have special IP support in reaction and get rid of them. See #79 and #116.
-- `tests/`: Integration tests. For now they test basic reaction runtime behavior, persistance, and client-daemon communication.
+- `tests/`: Integration tests. They test reaction runtime behavior, persistance, client-daemon communication, plugin integrations.
 - `src/`: The source code, here we go!
 
 ### Top-level files
@@ -25,18 +25,13 @@ Here is a high-level overview of the codebase.
 - `src/lib.rs`: Second main entrypoint
 - `src/cli.rs`: Command-line arguments
 - `src/tests.rs`: Test utilities
+- `src/protocol.rs`: de/serialization and client/daemon protocol messages.
 
 ### `src/concepts/`
 
 reaction really is about its configuration, which is at the center of the code.
 
-There is one file for each of its concepts: configuration, streams, filters, actions, patterns.
-
-### `src/protocol/`
-
-Low-level serialization/deserialization and client-daemon protocol messages.
-
-Shared by the client and daemon's socket. Also used by daemon's database.
+There is one file for each of its concepts: configuration, streams, filters, actions, patterns, plugins.
 
 ### `src/client/`
 
@@ -58,9 +53,9 @@ This code has async code, to handle input streams and communication with clients
     - `mod.rs`: High-level logic
     - `state.rs`: Inner state operations
 - `socket.rs`: The socket task, responsible for communication with clients.
-- `shutdown.rs`: Logic for passing shutdown signal across all tasks
+- `plugin.rs`: Plugin startup, configuration loading and cleanup.
 
-### `src/tree`
+### `crates/treedb`
 
 Persistence layer.
 
@@ -68,5 +63,19 @@ This is a database highly adapted to reaction workload, making reaction faster t
 (heed, sled and fjall crates have been tested).
 Its design is explained in the comments of its files:
 
-- `mod.rs`: main database code, with its two API structs: Tree and Database.
-- `raw.rs` low-level part, directly interacting with de/serializisation and files.
+- `lib.rs`: main database code, with its two API structs: Tree and Database.
+- `raw.rs`: low-level part, directly interacting with de/serializisation and files.
+- `time.rs`: time definitions shared with reaction.
+- `helpers.rs`: utilities to ease db deserialization from disk.
+
+### `plugins/reaction-plugin`
+
+Shared plugin interface between reaction daemon and its plugins.
+
+Also defines some shared logic between them:
+- `shutdown.rs`: Logic for passing shutdown signal across all tasks
+- `parse_duration.rs` Duration parsing
+
+### `plugins/reaction-plugin-*`
+
+All core plugins.
diff --git a/Cargo.lock b/Cargo.lock
index d899028..c9a7b56 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3,34 +3,30 @@
 version = 4
 
 [[package]]
-name = "addr2line"
-version = "0.24.2"
+name = "aead"
+version = "0.6.0-rc.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+checksum = "ac8202ab55fcbf46ca829833f347a82a2a4ce0596f0304ac322c2d100030cd56"
 dependencies = [
- "gimli",
+ "bytes",
+ "crypto-common",
+ "inout",
 ]
 
-[[package]]
-name = "adler2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
-
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
-name = "android-tzdata"
-version = "0.1.1"
+name = "allocator-api2"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "android_system_properties"
@@ -53,9 +49,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.18"
+version = "0.6.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -68,48 +64,59 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.10"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.2"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.8"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6680de5231bd6ee4c6191b8a1325daa282b415391ec9d3a37bd34f2060dc73fa"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "assert_cmd"
-version = "2.0.17"
+name = "arrayref"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bd389a4b2970a01282ee455294913c0a43724daedcd1a24c3eb0ec1c1320b66"
+checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+
+[[package]]
+name = "assert_cmd"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c5bcfa8749ac45dd12cb11055aeeb6b27a3895560d60d71e3c23bf979e60514"
 dependencies = [
  "anstyle",
  "bstr",
- "doc-comment",
  "libc",
  "predicates",
  "predicates-core",
@@ -133,32 +140,114 @@ dependencies = [
 ]
 
 [[package]]
-name = "autocfg"
-version = "1.4.0"
+name = "async-compat"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+checksum = "a1ba85bc55464dcbf728b56d97e119d673f4cf9062be330a9a26f3acf504a590"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "once_cell",
+ "pin-project-lite",
+ "tokio",
+]
 
 [[package]]
-name = "backtrace"
-version = "0.3.75"
+name = "async-trait"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
 ]
 
+[[package]]
+name = "async_io_stream"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d7b9decdf35d8908a7e3ef02f64c5e9b1695e230154c0e8de3969142d9b94c"
+dependencies = [
+ "futures",
+ "pharos",
+ "rustc_version",
+]
+
+[[package]]
+name = "atomic-polyfill"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
+dependencies = [
+ "critical-section",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "attohttpc"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16e2cdb6d5ed835199484bb92bb8b3edd526effe995c61732580439c1a67e2e9"
+dependencies = [
+ "base64 0.22.1",
+ "http",
+ "log",
+ "url",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "backon"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
+dependencies = [
+ "fastrand",
+ "gloo-timers",
+ "tokio",
+]
+
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
+[[package]]
+name = "base32"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022dfe9eb35f19ebbcb51e0b40a5ab759f46ad60cadf7297e0bd085afb50e076"
+
 [[package]]
 name = "base64"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bincode"
 version = "1.3.3"
@@ -169,16 +258,60 @@ dependencies = [
 ]
 
 [[package]]
-name = "bitflags"
-version = "2.9.1"
+name = "bindgen"
+version = "0.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "itertools",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash 1.1.0",
+ "shlex",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+
+[[package]]
+name = "blake3"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2468ef7d57b3fb7e16b576e8377cdbde2320c60e1491e961d11da40fc4f02a2d"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+ "cpufeatures",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96eb4cdd6cf1b31d671e9efe75c5d1ec614776856cefbe109ca373554a6d514f"
+dependencies = [
+ "hybrid-array",
+ "zeroize",
+]
 
 [[package]]
 name = "bstr"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
+checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
 dependencies = [
  "memchr",
  "regex-automata",
@@ -187,30 +320,52 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.17.0"
+version = "3.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
+checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
 
 [[package]]
 name = "cc"
-version = "1.2.24"
+version = "1.2.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16595d3be041c03b09d08d0858631facccee9221e579704070e6e9e4915d3bc7"
+checksum = "755d2fce177175ffca841e9a06afdb2c4ab0f593d53b4dee48147dfaade85932"
 dependencies = [
+ "find-msvc-tools",
  "shlex",
 ]
 
 [[package]]
-name = "cfg-if"
-version = "1.0.0"
+name = "cesu8"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
@@ -219,12 +374,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
-name = "chrono"
-version = "0.4.41"
+name = "chacha20"
+version = "0.10.0-rc.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c469d952047f47f91b68d1cba3f10d63c11d73e4636f24f08daf0278abf01c4d"
+checksum = "9bd162f2b8af3e0639d83f28a637e4e55657b7a74508dba5a9bf4da523d5c9e9"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+ "zeroize",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fac4744fb15ae8337dc853fee7fb3f4e48c0fbaa23d0afe49c447b4fab126118"
 dependencies = [
- "android-tzdata",
  "iana-time-zone",
  "js-sys",
  "num-traits",
@@ -234,10 +400,33 @@ dependencies = [
 ]
 
 [[package]]
-name = "clap"
-version = "4.5.38"
+name = "cipher"
+version = "0.5.0-rc.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed93b9805f8ba930df42c2590f05453d5ec36cbb85d018868a5b24d31f6ac000"
+checksum = "1e12a13eb01ded5d32ee9658d94f553a19e804204f2dc811df69ab4d9e0cb8c7"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6e6ff9dcd79cff5cd969a17a545d79e84ab086e444102a591e288a8aa3ce394"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -245,9 +434,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.38"
+version = "4.5.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "379026ff283facf611b0ea629334361c4211d1b12ee01024eec1591133b04120"
+checksum = "fa42cf4d2b7a41bc8f663a7cab4031ebafa1bf3875705bfaf8466dc60ab52c00"
 dependencies = [
  "anstream",
  "anstyle",
@@ -257,46 +446,116 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.50"
+version = "4.5.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91d3baa3bcd889d60e6ef28874126a0b384fd225ab83aa6d8a801c519194ce1"
+checksum = "430b4dc2b5e3861848de79627b2bedc9f3342c7da5173a14eaa5d0f8dc18ae5d"
 dependencies = [
  "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.32"
+version = "4.5.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7"
+checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.4"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
+checksum = "c3e64b0cc0439b12df2fa678eae89a1c56a529fd067a9115f7827f1fffd22b32"
 
 [[package]]
 name = "clap_mangen"
-version = "0.2.26"
+version = "0.2.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "724842fa9b144f9b89b3f3d371a89f3455eea660361d13a554f68f8ae5d6c13a"
+checksum = "439ea63a92086df93893164221ad4f24142086d535b3a0957b9b9bea2dc86301"
 dependencies = [
  "clap",
  "roff",
 ]
 
 [[package]]
-name = "colorchoice"
-version = "1.0.3"
+name = "cobs"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "cordyceps"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "688d7fbb8092b8de775ef2536f36c8c31f2bc4006ece2e8d8ad2d17d00ce0a2a"
+dependencies = [
+ "loom",
+ "tracing",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
 
 [[package]]
 name = "core-foundation-sys"
@@ -304,6 +563,30 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.6"
@@ -329,6 +612,153 @@ version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
+[[package]]
+name = "crypto-common"
+version = "0.2.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8235645834fbc6832939736ce2f2d08192652269e11010a6240f61b908a1c6"
+dependencies = [
+ "hybrid-array",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "crypto_box"
+version = "0.10.0-pre.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bda4de3e070830cf3a27a394de135b6709aefcc54d1e16f2f029271254a6ed9"
+dependencies = [
+ "aead",
+ "chacha20",
+ "crypto_secretbox",
+ "curve25519-dalek",
+ "salsa20",
+ "serdect",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto_secretbox"
+version = "0.2.0-pre.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54532aae6546084a52cef855593daf9555945719eeeda9974150e0def854873e"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "hybrid-array",
+ "poly1305",
+ "salsa20",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "5.0.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f9200d1d13637f15a6acb71e758f64624048d85b31a5fdbfd8eca1e2687d0b7"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rand_core 0.9.5",
+ "rustc_version",
+ "serde",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+
+[[package]]
+name = "der"
+version = "0.8.0-rc.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02c1d73e9668ea6b6a28172aa55f3ebec38507131ce179051c8033b5c6037653"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "derive_more"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
+dependencies = [
+ "derive_more-impl 1.0.0",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl 2.1.1",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+ "unicode-xid",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.114",
+ "unicode-xid",
+]
+
+[[package]]
+name = "diatomic-waker"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab03c107fafeb3ee9f5925686dbb7a73bc76e3932abb0d2b365cb64b169cf04c"
+
 [[package]]
 name = "difflib"
 version = "0.4.0"
@@ -336,10 +766,115 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
 
 [[package]]
-name = "doc-comment"
-version = "0.3.3"
+name = "digest"
+version = "0.11.0-rc.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+checksum = "dac89f8a64533a9b0eaa73a68e424db0fb1fd6271c74cc0125336a05f090568d"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "dlopen2"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09b4f5f101177ff01b8ec4ecc81eead416a8aa42819a2869311b3420fa114ffa"
+dependencies = [
+ "libc",
+ "once_cell",
+ "winapi",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "780955b8b195a21ab8e4ac6b60dd1dbdcec1dc6c51c0617964b08c81785e12c9"
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "ed25519"
+version = "3.0.0-rc.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "594435fe09e345ee388e4e8422072ff7dfeca8729389fbd997b3f5504c44cd47"
+dependencies = [
+ "pkcs8",
+ "serde",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "3.0.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad207ed88a133091f83224265eac21109930db09bedcad05d5252f2af2de20a1"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.9.5",
+ "serde",
+ "sha2",
+ "signature",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+
+[[package]]
+name = "enum-as-inner"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
 
 [[package]]
 name = "equivalent"
@@ -349,12 +884,12 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
-version = "0.3.12"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -363,6 +898,18 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
+[[package]]
+name = "fiat-crypto"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8591b0bcc8a98a64310a2fae1bb3e9b8564dd10e381e6e28010fde8e8e8568db"
+
 [[package]]
 name = "float-cmp"
 version = "0.10.0"
@@ -372,6 +919,27 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
 [[package]]
 name = "futures"
 version = "0.3.31"
@@ -387,6 +955,19 @@ dependencies = [
  "futures-util",
 ]
 
+[[package]]
+name = "futures-buffered"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8e0e1f38ec07ba4abbde21eed377082f17ccb988be9d988a5adbf4bafc118fd"
+dependencies = [
+ "cordyceps",
+ "diatomic-waker",
+ "futures-core",
+ "pin-project-lite",
+ "spin 0.10.0",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.31"
@@ -420,6 +1001,19 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
 
+[[package]]
+name = "futures-lite"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "futures-macro"
 version = "0.3.31"
@@ -428,7 +1022,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
 ]
 
 [[package]]
@@ -462,39 +1056,58 @@ dependencies = [
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.2.16"
+name = "generator"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "52f04ae4152da20c76fe800fa48659201d5cf627c5149ca0b707b69d7eef6cf9"
 dependencies = [
+ "cc",
  "cfg-if",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "log",
+ "rustversion",
+ "windows-link",
+ "windows-result",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.3.3"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
  "libc",
  "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
+ "wasip2",
+ "wasm-bindgen",
 ]
 
 [[package]]
-name = "gimli"
-version = "0.31.1"
+name = "glob"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "globset"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a1028dfc5f5df5da8a56a73e6c153c9a9708ec57232470703592a3f18e49f5"
+checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -515,10 +1128,69 @@ dependencies = [
 ]
 
 [[package]]
-name = "hashbrown"
-version = "0.15.3"
+name = "gloo-timers"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "heapless"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
+dependencies = [
+ "atomic-polyfill",
+ "hash32",
+ "rustc_version",
+ "serde",
+ "spin 0.9.8",
+ "stable_deref_trait",
+]
 
 [[package]]
 name = "heck"
@@ -528,15 +1200,187 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.9"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hickory-proto"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "cfg-if",
+ "data-encoding",
+ "enum-as-inner",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "h2",
+ "http",
+ "idna",
+ "ipnet",
+ "once_cell",
+ "rand 0.9.2",
+ "ring",
+ "rustls",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-resolver"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-proto",
+ "ipconfig",
+ "moka",
+ "once_cell",
+ "parking_lot",
+ "rand 0.9.2",
+ "resolv-conf",
+ "rustls",
+ "smallvec",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f471e0a81b2f90ffc0cb2f951ae04da57de8baa46fa99112b062a5173a5088d0"
+dependencies = [
+ "typenum",
+ "zeroize",
+]
+
+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2 0.6.1",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.63"
+version = "0.1.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
+checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -557,10 +1401,133 @@ dependencies = [
 ]
 
 [[package]]
-name = "ignore"
-version = "0.4.23"
+name = "icu_collections"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d89fd380afde86567dfba715db065673989d6253f42b88179abd3eae47bda4b"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+
+[[package]]
+name = "icu_provider"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "igd-next"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "516893339c97f6011282d5825ac94fc1c7aad5cad26bdc2d0cee068c0bf97f97"
+dependencies = [
+ "async-trait",
+ "attohttpc",
+ "bytes",
+ "futures",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "log",
+ "rand 0.9.2",
+ "tokio",
+ "url",
+ "xmltree",
+]
+
+[[package]]
+name = "ignore"
+version = "0.4.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3d782a365a015e0f5c04902246139249abf769125006fbe7649e2ee88169b4a"
 dependencies = [
  "crossbeam-deque",
  "globset",
@@ -574,25 +1541,329 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.9.0"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
 dependencies = [
  "equivalent",
  "hashbrown",
 ]
 
 [[package]]
-name = "is_terminal_polyfill"
-version = "1.70.1"
+name = "inout"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "ipconfig"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
+dependencies = [
+ "socket2 0.5.10",
+ "widestring",
+ "windows-sys 0.48.0",
+ "winreg",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+
+[[package]]
+name = "ipset"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3f6539e7df6df265a48ac3bfa1cc1b9fb37b604c92e9ab01521865e2323787f"
+dependencies = [
+ "bindgen",
+ "cc",
+ "derive_more 1.0.0",
+ "ipset_derive",
+ "libc",
+]
+
+[[package]]
+name = "ipset_derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db6d64e879badf39e93df3831cb2902d290a2db61f8a46f299a681a2a601e0"
+dependencies = [
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "iri-string"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "iroh"
+version = "0.95.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2374ba3cdaac152dc6ada92d971f7328e6408286faab3b7350842b2ebbed4789"
+dependencies = [
+ "aead",
+ "backon",
+ "bytes",
+ "cfg_aliases",
+ "crypto_box",
+ "data-encoding",
+ "derive_more 2.1.1",
+ "ed25519-dalek",
+ "futures-util",
+ "getrandom 0.3.4",
+ "hickory-resolver",
+ "http",
+ "igd-next",
+ "instant",
+ "iroh-base",
+ "iroh-metrics",
+ "iroh-quinn",
+ "iroh-quinn-proto",
+ "iroh-quinn-udp",
+ "iroh-relay",
+ "n0-error",
+ "n0-future",
+ "n0-watcher",
+ "netdev",
+ "netwatch",
+ "pin-project",
+ "pkarr",
+ "pkcs8",
+ "portmapper",
+ "rand 0.9.2",
+ "reqwest",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "rustls-webpki",
+ "serde",
+ "smallvec",
+ "strum",
+ "time",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tracing",
+ "url",
+ "wasm-bindgen-futures",
+ "webpki-roots",
+ "z32",
+]
+
+[[package]]
+name = "iroh-base"
+version = "0.95.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25a8c5fb1cc65589f0d7ab44269a76f615a8c4458356952c9b0ef1c93ea45ff8"
+dependencies = [
+ "curve25519-dalek",
+ "data-encoding",
+ "derive_more 2.1.1",
+ "ed25519-dalek",
+ "n0-error",
+ "rand_core 0.9.5",
+ "serde",
+ "url",
+ "zeroize",
+ "zeroize_derive",
+]
+
+[[package]]
+name = "iroh-metrics"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79e3381da7c93c12d353230c74bba26131d1c8bf3a4d8af0fec041546454582e"
+dependencies = [
+ "iroh-metrics-derive",
+ "itoa",
+ "n0-error",
+ "postcard",
+ "ryu",
+ "serde",
+ "tracing",
+]
+
+[[package]]
+name = "iroh-metrics-derive"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e12bd0763fd16062f5cc5e8db15dd52d26e75a8af4c7fb57ccee3589b344b8"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "iroh-quinn"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde160ebee7aabede6ae887460cd303c8b809054224815addf1469d54a6fcf7"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "iroh-quinn-proto",
+ "iroh-quinn-udp",
+ "pin-project-lite",
+ "rustc-hash 2.1.1",
+ "rustls",
+ "socket2 0.5.10",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "iroh-quinn-proto"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "929d5d8fa77d5c304d3ee7cae9aede31f13908bd049f9de8c7c0094ad6f7c535"
+dependencies = [
+ "bytes",
+ "getrandom 0.2.17",
+ "rand 0.8.5",
+ "ring",
+ "rustc-hash 2.1.1",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "iroh-quinn-udp"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c53afaa1049f7c83ea1331f5ebb9e6ebc5fdd69c468b7a22dd598b02c9bcc973"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.5.10",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "iroh-relay"
+version = "0.95.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43fbdf2aeffa7d6ede1a31f6570866c2199b1cee96a0b563994623795d1bac2c"
+dependencies = [
+ "blake3",
+ "bytes",
+ "cfg_aliases",
+ "data-encoding",
+ "derive_more 2.1.1",
+ "getrandom 0.3.4",
+ "hickory-resolver",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "iroh-base",
+ "iroh-metrics",
+ "iroh-quinn",
+ "iroh-quinn-proto",
+ "lru",
+ "n0-error",
+ "n0-future",
+ "num_enum",
+ "pin-project",
+ "pkarr",
+ "postcard",
+ "rand 0.9.2",
+ "reqwest",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_bytes",
+ "sha1",
+ "strum",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tokio-websockets",
+ "tracing",
+ "url",
+ "webpki-roots",
+ "ws_stream_wasm",
+ "z32",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
 [[package]]
 name = "jrsonnet-evaluator"
@@ -601,7 +1872,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fee60406dac44a01b37e120b43adb062047251e195db15392b825f6bdc948712"
 dependencies = [
  "annotate-snippets",
- "base64",
+ "base64 0.13.1",
  "bincode",
  "jrsonnet-gc",
  "jrsonnet-interner",
@@ -610,10 +1881,10 @@ dependencies = [
  "jrsonnet-types",
  "md5",
  "pathdiff",
- "rustc-hash",
+ "rustc-hash 1.1.0",
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -634,7 +1905,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 1.0.109",
- "synstructure",
+ "synstructure 0.12.6",
 ]
 
 [[package]]
@@ -644,7 +1915,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5ff75843e778244f3476800e6f492950a6ecee1d9308019764983d311620bf9"
 dependencies = [
  "jrsonnet-gc",
- "rustc-hash",
+ "rustc-hash 1.1.0",
  "serde",
 ]
 
@@ -679,9 +1950,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.77"
+version = "0.3.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
+checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -695,31 +1966,98 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.172"
+version = "0.2.180"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
+[[package]]
+name = "libnftables1-sys"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b290d0d41f0ad578660aeed371bcae4cf85f129a6fe31350dbd2e097518cd7f"
+dependencies = [
+ "bindgen",
+]
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.9.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
+[[package]]
+name = "litemap"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
 
 [[package]]
 name = "lock_api"
-version = "0.4.12"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
 dependencies = [
- "autocfg",
  "scopeguard",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.27"
+version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "loom"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
+dependencies = [
+ "cfg-if",
+ "generator",
+ "scoped-tls",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "lru"
+version = "0.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
 
 [[package]]
 name = "md5"
@@ -729,30 +2067,212 @@ checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
 
 [[package]]
-name = "miniz_oxide"
-version = "0.8.8"
+name = "minimal-lexical"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
-dependencies = [
- "adler2",
-]
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "mio"
-version = "1.0.4"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "moka"
+version = "0.12.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3dec6bd31b08944e08b58fd99373893a6c17054d6f3ea5006cc894f4f4eee2a"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "parking_lot",
+ "portable-atomic",
+ "smallvec",
+ "tagptr",
+ "uuid",
+]
+
+[[package]]
+name = "n0-error"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af4782b4baf92d686d161c15460c83d16ebcfd215918763903e9619842665cae"
+dependencies = [
+ "n0-error-macros",
+ "spez",
+]
+
+[[package]]
+name = "n0-error-macros"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03755949235714b2b307e5ae89dd8c1c2531fb127d9b8b7b4adf9c876cd3ed18"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "n0-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2ab99dfb861450e68853d34ae665243a88b8c493d01ba957321a1e9b2312bbe"
+dependencies = [
+ "cfg_aliases",
+ "derive_more 2.1.1",
+ "futures-buffered",
+ "futures-lite",
+ "futures-util",
+ "js-sys",
+ "pin-project",
+ "send_wrapper",
+ "tokio",
+ "tokio-util",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-time",
+]
+
+[[package]]
+name = "n0-watcher"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38acf13c1ddafc60eb7316d52213467f8ccb70b6f02b65e7d97f7799b1f50be4"
+dependencies = [
+ "derive_more 2.1.1",
+ "n0-error",
+ "n0-future",
+]
+
+[[package]]
+name = "netdev"
+version = "0.38.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67ab878b4c90faf36dab10ea51d48c69ae9019bcca47c048a7c9b273d5d7a823"
+dependencies = [
+ "dlopen2",
+ "ipnet",
+ "libc",
+ "netlink-packet-core",
+ "netlink-packet-route",
+ "netlink-sys",
+ "once_cell",
+ "system-configuration",
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "netlink-packet-core"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3463cbb78394cb0141e2c926b93fc2197e473394b761986eca3b9da2c63ae0f4"
+dependencies = [
+ "paste",
+]
+
+[[package]]
+name = "netlink-packet-route"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ec2f5b6839be2a19d7fa5aab5bc444380f6311c2b693551cb80f45caaa7b5ef"
+dependencies = [
+ "bitflags",
+ "libc",
+ "log",
+ "netlink-packet-core",
+]
+
+[[package]]
+name = "netlink-proto"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b65d130ee111430e47eed7896ea43ca693c387f097dd97376bffafbf25812128"
+dependencies = [
+ "bytes",
+ "futures",
+ "log",
+ "netlink-packet-core",
+ "netlink-sys",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "netlink-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16c903aa70590cb93691bf97a767c8d1d6122d2cc9070433deb3bbf36ce8bd23"
+dependencies = [
+ "bytes",
+ "futures",
+ "libc",
+ "log",
+ "tokio",
+]
+
+[[package]]
+name = "netwatch"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26f2acd376ef48b6c326abf3ba23c449e0cb8aa5c2511d189dd8a8a3bfac889b"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "cfg_aliases",
+ "derive_more 2.1.1",
+ "iroh-quinn-udp",
+ "js-sys",
+ "libc",
+ "n0-error",
+ "n0-future",
+ "n0-watcher",
+ "netdev",
+ "netlink-packet-core",
+ "netlink-packet-route",
+ "netlink-proto",
+ "netlink-sys",
+ "pin-project-lite",
+ "serde",
+ "socket2 0.6.1",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "web-sys",
+ "windows",
+ "windows-result",
+ "wmi",
+]
+
+[[package]]
+name = "nftables"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c57e7343eed9e9330e084eef12651b15be3c8ed7825915a0ffa33736b852bed"
+dependencies = [
+ "schemars",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "strum",
+ "strum_macros",
+ "thiserror 2.0.18",
+ "tokio",
+]
+
 [[package]]
 name = "nix"
 version = "0.29.0"
@@ -765,6 +2285,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "normalize-line-endings"
 version = "0.3.0"
@@ -772,15 +2302,35 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
 
 [[package]]
-name = "nu-ansi-term"
-version = "0.46.0"
+name = "ntimestamp"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+checksum = "c50f94c405726d3e0095e89e72f75ce7f6587b94a8bd8dc8054b73f65c0fd68c"
 dependencies = [
- "overload",
- "winapi",
+ "base32",
+ "document-features",
+ "getrandom 0.2.17",
+ "httpdate",
+ "js-sys",
+ "once_cell",
+ "serde",
 ]
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -792,21 +2342,34 @@ dependencies = [
 
 [[package]]
 name = "num_cpus"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
 dependencies = [
  "hermit-abi",
  "libc",
 ]
 
 [[package]]
-name = "object"
-version = "0.36.7"
+name = "num_enum"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "b1207a7e20ad57b847bbddc6776b968420d38292bbfe2089accff5e19e82454c"
 dependencies = [
- "memchr",
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
 ]
 
 [[package]]
@@ -814,24 +2377,34 @@ name = "once_cell"
 version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
 
 [[package]]
 name = "once_cell_polyfill"
-version = "1.70.1"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
-name = "overload"
-version = "0.1.1"
+name = "openssl-probe"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+checksum = "9f50d9b3dabb09ecd771ad0aa242ca6894994c130308ca3d7684634df8037391"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.3"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -839,17 +2412,23 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.10"
+version = "0.9.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-targets",
+ "windows-link",
 ]
 
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
 [[package]]
 name = "pathdiff"
 version = "0.2.3"
@@ -883,6 +2462,51 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c719dcf55f09a3a7e764c6649ab594c18a177e3599c467983cdf644bfc0a4088"
 
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pharos"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9567389417feee6ce15dd6527a8a1ecac205ef62c2932bcf3d9f6fc5b78b414"
+dependencies = [
+ "futures",
+ "rustc_version",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -895,6 +2519,142 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkarr"
+version = "5.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d346b545765a0ef58b6a7e160e17ddaa7427f439b7b9a287df6c88c9e04bf2"
+dependencies = [
+ "async-compat",
+ "base32",
+ "bytes",
+ "cfg_aliases",
+ "document-features",
+ "dyn-clone",
+ "ed25519-dalek",
+ "futures-buffered",
+ "futures-lite",
+ "getrandom 0.3.4",
+ "log",
+ "lru",
+ "ntimestamp",
+ "reqwest",
+ "self_cell",
+ "serde",
+ "sha1_smol",
+ "simple-dns",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "url",
+ "wasm-bindgen-futures",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0-rc.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77089aec8290d0b7bb01b671b091095cf1937670725af4fd73d47249f03b12c0"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "poly1305"
+version = "0.9.0-rc.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb78a635f75d76d856374961deecf61031c0b6f928c83dc9c0924ab6c019c298"
+dependencies = [
+ "cpufeatures",
+ "universal-hash",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f89776e4d69bb58bc6993e99ffa1d11f228b839984854c7daeb5d37f87cbe950"
+
+[[package]]
+name = "portmapper"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b575f975dcf03e258b0c7ab3f81497d7124f508884c37da66a7314aa2a8d467"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "derive_more 2.1.1",
+ "futures-lite",
+ "futures-util",
+ "hyper-util",
+ "igd-next",
+ "iroh-metrics",
+ "libc",
+ "n0-error",
+ "netwatch",
+ "num_enum",
+ "rand 0.9.2",
+ "serde",
+ "smallvec",
+ "socket2 0.6.1",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "postbag"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02aa900208f326b4fa5d7943ede192c1265a1519e7132aa6760e3440a1f4ceb0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "heapless",
+ "postcard-derive",
+ "serde",
+]
+
+[[package]]
+name = "postcard-derive"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0232bd009a197ceec9cc881ba46f727fcd8060a2d8d6a9dde7a69030a6fe2bb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -935,28 +2695,102 @@ dependencies = [
 ]
 
 [[package]]
-name = "proc-macro2"
-version = "1.0.95"
+name = "prettyplease"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.105"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "535d180e0ecab6268a3e718bb9fd44db66bbbc256257165fc699dadf70d16fe7"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
-name = "quote"
-version = "1.0.40"
+name = "quinn"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash 2.1.1",
+ "rustls",
+ "socket2 0.6.1",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash 2.1.1",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.6.1",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc74d9a594b72ae6656596548f56f667211f8a97b3d4c3d467150794690dc40a"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "r-efi"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "rand"
@@ -965,8 +2799,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -976,7 +2820,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -985,12 +2839,21 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
 ]
 
 [[package]]
 name = "reaction"
-version = "2.2.1"
+version = "2.3.0"
 dependencies = [
  "assert_cmd",
  "assert_fs",
@@ -1003,34 +2866,121 @@ dependencies = [
  "nix",
  "num_cpus",
  "predicates",
- "rand",
+ "rand 0.8.5",
+ "reaction-plugin",
  "regex",
+ "remoc",
  "serde",
  "serde_json",
  "serde_yaml",
  "tempfile",
- "thiserror",
- "timer",
+ "thiserror 1.0.69",
  "tokio",
  "tokio-util",
  "tracing",
  "tracing-subscriber",
+ "treedb",
+]
+
+[[package]]
+name = "reaction-plugin"
+version = "1.0.0"
+dependencies = [
+ "remoc",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "reaction-plugin-cluster"
+version = "0.1.0"
+dependencies = [
+ "assert_fs",
+ "chrono",
+ "data-encoding",
+ "futures",
+ "iroh",
+ "rand 0.9.2",
+ "reaction-plugin",
+ "remoc",
+ "serde",
+ "serde_json",
+ "tokio",
+ "treedb",
+]
+
+[[package]]
+name = "reaction-plugin-ipset"
+version = "1.0.0"
+dependencies = [
+ "ipset",
+ "reaction-plugin",
+ "remoc",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "reaction-plugin-nftables"
+version = "0.1.0"
+dependencies = [
+ "libnftables1-sys",
+ "nftables",
+ "reaction-plugin",
+ "remoc",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "reaction-plugin-virtual"
+version = "1.0.0"
+dependencies = [
+ "reaction-plugin",
+ "remoc",
+ "serde",
+ "serde_json",
+ "tokio",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.12"
+version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "928fca9cf2aa042393a8325b9ead81d2f0df4cb12e1e24cef072922ccd99c5af"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
  "bitflags",
 ]
 
 [[package]]
-name = "regex"
-version = "1.11.1"
+name = "ref-cast"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1040,9 +2990,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1051,9 +3001,100 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+
+[[package]]
+name = "remoc"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0491961ac4bc1ac4191743aa58a2ce778f4725693d29743fae957b2cf45f77f0"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "futures",
+ "postbag",
+ "rand 0.9.2",
+ "remoc_macro",
+ "serde",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "remoc_macro"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89479d9d87f65ef573faf0167dd0a9f40d3a63fd95e7a2935d662fa57dbc30d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "resolv-conf"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
 
 [[package]]
 name = "roff"
@@ -1061,12 +3102,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88f8660c1ff60292143c98d08fc6e2f654d722db50410e3f3797d40baaf9d8f3"
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -1074,29 +3109,129 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
-name = "rustix"
-version = "1.0.7"
+name = "rustc-hash"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
  "bitflags",
  "errno",
  "libc",
  "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19787cda76408ec5404443dc8b31795c87cd8fec49762dc75fa727740d34acc1"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs 0.26.11",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
-name = "rustversion"
-version = "1.0.21"
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+
+[[package]]
+name = "salsa20"
+version = "0.11.0-rc.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3ff3b81c8a6e381bc1673768141383f9328048a60edddcfc752a8291a138443"
+dependencies = [
+ "cfg-if",
+ "cipher",
+]
 
 [[package]]
 name = "same-file"
@@ -1107,6 +3242,46 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -1114,33 +3289,129 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
-name = "serde"
-version = "1.0.219"
+name = "security-framework"
+version = "3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "self_cell"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b12e76d157a900eb52e81bc6e9f3069344290341720e9178cde2407113ac8d89"
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.140"
+version = "1.0.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
 dependencies = [
  "itoa",
  "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
  "ryu",
  "serde",
 ]
@@ -1158,6 +3429,44 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
+[[package]]
+name = "serdect"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9af4a3e75ebd5599b30d4de5768e00b5095d518a79fefc3ecbaf77e665d1ec06"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0-rc.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e046edf639aa2e7afb285589e5405de2ef7e61d4b0ac1e30256e3eab911af9"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
+[[package]]
+name = "sha2"
+version = "0.11.0-rc.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1e3878ab0f98e35b2df35fe53201d088299b41a6bb63e3e34dada2ac4abd924"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -1175,27 +3484,46 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.5"
+version = "1.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
 dependencies = [
+ "errno",
  "libc",
 ]
 
 [[package]]
-name = "slab"
-version = "0.4.9"
+name = "signature"
+version = "3.0.0-rc.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+checksum = "597a96996ccff7dfa16f052bd995b4cecc72af22c35138738dc029f0ead6608d"
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "simple-dns"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dee851d0e5e7af3721faea1843e8015e820a234f81fda3dea9247e15bac9a86a"
 dependencies = [
- "autocfg",
+ "bitflags",
 ]
 
 [[package]]
-name = "smallvec"
-version = "1.15.0"
+name = "slab"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
+checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
@@ -1207,12 +3535,91 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "spez"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c87e960f4dca2788eeb86bbdde8dd246be8948790b7618d656e68f9b720a86e8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spin"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
+[[package]]
+name = "spki"
+version = "0.8.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8baeff88f34ed0691978ec34440140e1572b68c7dd4a495fd14a3dc1944daa80"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -1226,15 +3633,24 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.101"
+version = "2.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
+checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
 dependencies = [
  "proc-macro2",
  "quote",
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.12.6"
@@ -1248,16 +3664,54 @@ dependencies = [
 ]
 
 [[package]]
-name = "tempfile"
-version = "3.20.0"
+name = "synstructure"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
+[[package]]
+name = "tempfile"
+version = "3.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
 dependencies = [
  "fastrand",
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1272,7 +3726,16 @@ version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
 ]
 
 [[package]]
@@ -1283,77 +3746,243 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.8"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
 dependencies = [
  "cfg-if",
- "once_cell",
 ]
 
 [[package]]
-name = "timer"
-version = "0.2.0"
+name = "time"
+version = "0.3.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31d42176308937165701f50638db1c31586f183f1aab416268216577aec7306b"
+checksum = "f9e442fc33d7fdb45aa9bfeb312c095964abdf596f7567261062b2a7107aaabd"
 dependencies = [
- "chrono",
+ "deranged",
+ "js-sys",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
 ]
 
+[[package]]
+name = "time-core"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b36ee98fd31ec7426d599183e8fe26932a8dc1fb76ddb6214d05493377d34ca"
+
+[[package]]
+name = "tinystr"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
-version = "1.45.1"
+version = "1.49.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
+checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
 dependencies = [
- "backtrace",
  "bytes",
  "libc",
  "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.1",
  "tokio-macros",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
 ]
 
 [[package]]
 name = "tokio-util"
-version = "0.7.15"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66a539a9ad6d5d281510d5bd368c973d636c02dbf8a67300bfb6b950696ad7df"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
+ "futures-util",
  "pin-project-lite",
  "tokio",
 ]
 
 [[package]]
-name = "tracing"
-version = "0.1.41"
+name = "tokio-websockets"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "b1b6348ebfaaecd771cecb69e832961d277f59845d4220a584701f72728152b7"
 dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "getrandom 0.3.4",
+ "http",
+ "httparse",
+ "rand 0.9.2",
+ "ring",
+ "rustls-pki-types",
+ "simdutf8",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.23.10+spec-1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.0.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -1361,20 +3990,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.28"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.33"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
  "valuable",
@@ -1393,18 +4022,49 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.19"
+version = "0.3.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+checksum = "2f30143827ddab0d256fd843b7a66d164e9f271cfa0dde49142c5ca0ca291f1e"
 dependencies = [
+ "matchers",
  "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
  "sharded-slab",
  "smallvec",
  "thread_local",
+ "tracing",
  "tracing-core",
  "tracing-log",
 ]
 
+[[package]]
+name = "treedb"
+version = "1.0.0"
+dependencies = [
+ "chrono",
+ "futures",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
 [[package]]
 name = "unescape"
 version = "0.1.0"
@@ -1413,9 +4073,15 @@ checksum = "ccb97dac3243214f8d8507998906ca3e2e0b900bf9bf4870477f125b82e68f6e"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.18"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 
 [[package]]
 name = "unicode-width"
@@ -1429,18 +4095,65 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "universal-hash"
+version = "0.6.0-rc.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55be643b40a21558f44806b53ee9319595bc7ca6896372e4e08e5d7d83c9cd6"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
 [[package]]
 name = "unsafe-libyaml"
 version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
+[[package]]
+name = "uuid"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
+dependencies = [
+ "getrandom 0.3.4",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -1467,51 +4180,61 @@ dependencies = [
 ]
 
 [[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+name = "want"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
 
 [[package]]
 name = "wasi"
-version = "0.14.2+wasi-0.2.4"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
 dependencies = [
- "wit-bindgen-rt",
+ "wit-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.100"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
+checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
 dependencies = [
  "cfg-if",
  "once_cell",
  "rustversion",
  "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn 2.0.101",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.100"
+name = "wasm-bindgen-futures"
+version = "0.4.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
+checksum = "70a6e77fd0ae8029c9ea0063f87c46fde723e7d887703d74ad2616d792e51e6f"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1519,26 +4242,92 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.100"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
+checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
- "wasm-bindgen-backend",
+ "syn 2.0.114",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.100"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "312e32e551d92129218ea9a2452120f4aabc03529ef03e4d0d82fb2780608598"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
+dependencies = [
+ "webpki-root-certs 1.0.5",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36a29fc0408b113f68cf32637857ab740edfafdf460c326cd2afaa2d84cc05dc"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12bed680863276c63889429bfd6cab3b99943659923822de1c8a39c49e4d722c"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -1557,11 +4346,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1571,10 +4360,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
-name = "windows-core"
-version = "0.61.2"
+name = "windows"
+version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
@@ -1584,58 +4394,97 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows-implement"
-version = "0.60.0"
+name = "windows-future"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
 ]
 
 [[package]]
 name = "windows-interface"
-version = "0.59.1"
+version = "0.59.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
 ]
 
 [[package]]
 name = "windows-link"
-version = "0.1.1"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
 
 [[package]]
 name = "windows-result"
-version = "0.3.4"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
  "windows-link",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.4.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -1644,7 +4493,55 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
 ]
 
 [[package]]
@@ -1653,58 +4550,210 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -1712,12 +4761,89 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
+name = "windows_x86_64_msvc"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winnow"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
 dependencies = [
- "bitflags",
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+
+[[package]]
+name = "wmi"
+version = "0.17.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "120d8c2b6a7c96c27bf4a7947fd7f02d73ca7f5958b8bd72a696e46cb5521ee6"
+dependencies = [
+ "chrono",
+ "futures",
+ "log",
+ "serde",
+ "thiserror 2.0.18",
+ "windows",
+ "windows-core",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+
+[[package]]
+name = "ws_stream_wasm"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c173014acad22e83f16403ee360115b38846fe754e735c5d9d3803fe70c6abc"
+dependencies = [
+ "async_io_stream",
+ "futures",
+ "js-sys",
+ "log",
+ "pharos",
+ "rustc_version",
+ "send_wrapper",
+ "thiserror 2.0.18",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "xml-rs"
+version = "0.8.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
+
+[[package]]
+name = "xmltree"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7d8a75eaf6557bb84a65ace8609883db44a29951042ada9b393151532e41fcb"
+dependencies = [
+ "xml-rs",
 ]
 
 [[package]]
@@ -1730,21 +4856,130 @@ dependencies = [
 ]
 
 [[package]]
-name = "zerocopy"
-version = "0.8.25"
+name = "yoke"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1702d9583232ddb9174e01bb7c15a2ab8fb1bc6f227aa1233858c351a3ba0cb"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+ "synstructure 0.13.2",
+]
+
+[[package]]
+name = "z32"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2164e798d9e3d84ee2c91139ace54638059a3b23e361f5c11781c2c6459bde0f"
+
+[[package]]
+name = "zerocopy"
+version = "0.8.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668f5168d10b9ee831de31933dc111a459c97ec93225beb307aed970d1372dfd"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.25"
+version = "0.8.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28a6e20d751156648aa063f3800b706ee209a32c0b4d9f24be3d980b01be55ef"
+checksum = "2c7962b26b0a8685668b671ee4b54d007a67d4eaf05fda79ac0ecf41e32270f1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.114",
 ]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+ "synstructure 0.13.2",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f63c051f4fe3c1509da62131a678643c5b6fbdc9273b2b79d4378ebda003d2"
diff --git a/Cargo.toml b/Cargo.toml
index 3596016..66e95e3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "reaction"
-version = "2.2.1"
-edition = "2021"
+version = "2.3.0"
+edition = "2024"
 authors = ["ppom <reaction@ppom.me>"]
 license = "AGPL-3.0"
 description = "Scan logs and take action"
@@ -10,6 +10,7 @@ homepage = "https://reaction.ppom.me"
 repository = "https://framagit.org/ppom/reaction"
 keywords = ["security", "sysadmin", "fail2ban", "logs", "monitoring"]
 build = "build.rs"
+default-run = "reaction"
 
 [package.metadata.deb]
 section = "net"
@@ -21,33 +22,46 @@ systemd-units = { enable = false }
 assets = [
 	# Executables
 	[ "target/release/reaction", "/usr/bin/reaction", "755" ],
-	[ "target/release/ip46tables", "/usr/bin/ip46tables", "755" ],
-	[ "target/release/nft46", "/usr/bin/nft46", "755" ],
+	[ "target/release/reaction-plugin-virtual", "/usr/bin/reaction-plugin-virtual", "755" ],
 	# Man pages
 	[ "target/release/reaction*.1", "/usr/share/man/man1/", "644" ],
 	# Shell completions
 	[ "target/release/reaction.bash", "/usr/share/bash-completion/completions/reaction", "644" ],
 	[ "target/release/reaction.fish", "/usr/share/fish/completions/", "644" ],
 	[ "target/release/_reaction", "/usr/share/zsh/vendor-completions/", "644" ],
+	# Slice
+	[ "packaging/system-reaction.slice", "/usr/lib/systemd/system/", "644" ],
 ]
 
 [dependencies]
-chrono = { version = "0.4.38", features = ["std", "clock", "serde"] }
+# Time types
+chrono.workspace = true
+# CLI parsing
 clap = { version = "4.5.4", features = ["derive"] }
-jrsonnet-evaluator = "0.4.2"
+# Unix interfaces
 nix = { version = "0.29.0", features = ["signal"] }
 num_cpus = "1.16.0"
+# Regex matching
 regex = "1.10.4"
-serde = { version = "1.0.203", features = ["derive"] }
-serde_json = "1.0.117"
+# Configuration languages, ser/deserialisation
+serde.workspace = true
+serde_json.workspace = true
 serde_yaml = "0.9.34"
-thiserror = "1.0.63"
-timer = "0.2.0"
-futures = "0.3.30"
-tokio = { version = "1.40.0", features = ["full", "tracing"] }
-tokio-util = { version = "0.7.12", features = ["codec"] }
-tracing = "0.1.40"
+jrsonnet-evaluator = "0.4.2"
+# Error macro
+thiserror.workspace = true
+# Async runtime & helpers
+futures = { workspace = true }
+tokio = { workspace = true, features = ["full", "tracing"] }
+tokio-util = { workspace = true, features = ["codec"] }
+# Async logging
+tracing.workspace = true
 tracing-subscriber = "0.3.18"
+# Database
+treedb.workspace = true
+# Reaction plugin system
+remoc.workspace = true
+reaction-plugin.workspace = true
 
 [build-dependencies]
 clap = { version = "4.5.4", features = ["derive"] }
@@ -58,7 +72,34 @@ tracing = "0.1.40"
 
 [dev-dependencies]
 rand = "0.8.5"
-tempfile = "3.12.0"
-assert_fs = "1.1.3"
+treedb.workspace = true
+treedb.features = ["test"]
+tempfile.workspace = true
+assert_fs.workspace = true
 assert_cmd = "2.0.17"
 predicates = "3.1.3"
+
+[workspace]
+members = [
+	"crates/treedb",
+	"plugins/reaction-plugin",
+	"plugins/reaction-plugin-cluster",
+	"plugins/reaction-plugin-ipset",
+	"plugins/reaction-plugin-nftables",
+	"plugins/reaction-plugin-virtual"
+]
+
+[workspace.dependencies]
+assert_fs = "1.1.3"
+chrono = { version = "0.4.38", features = ["std", "clock", "serde"] }
+futures = "0.3.30"
+remoc = { version = "0.18.3" }
+serde = { version = "1.0.203", features = ["derive"] }
+serde_json = { version = "1.0.117", features = ["arbitrary_precision"] }
+tempfile = "3.12.0"
+thiserror = "1.0.63"
+tokio = { version = "1.40.0" }
+tokio-util = { version = "0.7.12" }
+tracing = "0.1.40"
+reaction-plugin = { path = "plugins/reaction-plugin" }
+treedb = { path = "crates/treedb" }
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..1c5d54e
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,11 @@
+# This Dockerfile permits to build reaction and its plugins
+
+# Use debian old-stable, so that it runs on both old-stable and stable
+FROM rust:bookworm
+
+RUN apt update && apt install -y \
+  clang \
+  libipset-dev \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /reaction
diff --git a/Makefile b/Makefile
index 3efd558..9b31a54 100644
--- a/Makefile
+++ b/Makefile
@@ -14,8 +14,6 @@ reaction:
 
 install: reaction
 	install -m755 target/release/reaction $(DESTDIR)$(BINDIR)
-	install -m755 target/release/ip46tables $(DESTDIR)$(BINDIR)
-	install -m755 target/release/nft46 $(DESTDIR)$(BINDIR)
 
 install_systemd: install
 	install -m644 packaging/reaction.service $(SYSTEMDDIR)/system/reaction.service
diff --git a/README.md b/README.md
index 68ec110..7d33ab5 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ A daemon that scans program outputs for repeated patterns, and takes action.
 
 A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors.
 
-🚧 This program hasn't received external security audit. However, it already works well on my servers 🚧
+🚧 This program hasn't received external security audit yet. However, it already works well on many servers 🚧
 
 ## Rationale
 
@@ -67,8 +67,8 @@ streams:
         regex:
           - 'authentication failure;.*rhost=<ip>'
           - 'Failed password for .* from <ip>'
-          - 'Invalid user .* from <ip>',
-          - 'banner exchange: Connection from <ip> port [0-9]*: invalid format',
+          - 'Invalid user .* from <ip>'
+          - 'banner exchange: Connection from <ip> port [0-9]*: invalid format'
         retry: 3
         retryperiod: '6h'
         actions:
@@ -136,6 +136,9 @@ local banFor(time) = {
 
 </details>
 
+> It is recommended to setup reaction with [`nftables`](https://reaction.ppom.me/actions/nftables.html)
+> or [`ipset` + `iptables`](https://reaction.ppom.me/actions/ipset.html), which are much more performant
+> solutions than `iptables` alone.
 
 ### Database
 
@@ -152,19 +155,10 @@ If you don't know where to start reaction, `/var/lib/reaction` should be a sane
 - `reaction test-config` shows loaded configuration
 - `reaction help` for full usage.
 
-### `ip46tables` and `nft46`
+### old binaries
 
-> ⚠️Deprecated since v2.2.0:
-> reaction now provides builtin support for executing different actions on ipv4 and ipv6.
-> They will be removed in a future version.
-
-`ip46tables` and `nft46` are two minimal c programs present in the `helpers_c` directory with only standard posix dependencies.
-
-`ip46tables` permits to configure `iptables` and `ip6tables` at the same time.
-It will execute `iptables` when detecting ipv4, `ip6tables` when detecting ipv6 and both if no ip address is present on the command line.
-
-`nft46` works slightly differently: it will replace the `X` in its argument by 4 or 6 depending on the ip address on the command line.
-This permits to have 2 IP sets, one of type `ipv4_addr` and one of type `ipv6_addr`.
+`ip46tables` and `nft46` binaries are no longer part of reaction. If you really need them, see
+[the last commit that included them](https://framagit.org/ppom/reaction/-/tree/b7d997ca5e9a69c8572bb2ec9d27d0eb03b3cb9f/helpers_c).
 
 ## Wiki
 
@@ -245,6 +239,7 @@ French version: [#reaction-dev-fr:club1.fr](https://matrix.to/#/#reaction-dev-fr
 
 You can ask for help in the issues or in this Matrix room: [#reaction-users-en:club1.fr](https://matrix.to/#/#reaction-users-en:club1.fr).
 French version: [#reaction-users-fr:club1.fr](https://matrix.to/#/#reaction-users-fr:club1.fr).
+You can alternatively send a mail: `reaction` on domain `ppom.me`.
 
 ## Funding
 
diff --git a/TODO b/TODO
index 9d5462a..2b6071f 100644
--- a/TODO
+++ b/TODO
@@ -1,3 +1,3 @@
 Test what happens when a Filter's pattern Set changes (I think it's shitty)
-stream: test regex ending with $
 DB: add tests on stress testing (lines should always be in order)
+conf: merge filters
diff --git a/bench/bench.sh b/bench/bench.sh
index 59d4894..9f42ec2 100755
--- a/bench/bench.sh
+++ b/bench/bench.sh
@@ -14,7 +14,7 @@ then
 fi
 
 rm -f reaction.db 
-cargo build --release 
+cargo build --release --bins
 sudo systemd-run --wait \
 	-p User="$(id -nu)" \
 	-p MemoryAccounting=yes \
diff --git a/bench/small-heavy-load-virtual.yml b/bench/small-heavy-load-virtual.yml
new file mode 100644
index 0000000..0f074b9
--- /dev/null
+++ b/bench/small-heavy-load-virtual.yml
@@ -0,0 +1,86 @@
+---
+# This configuration permits to test reaction's performance
+# under a very high load
+#
+# It keeps regexes super simple, to avoid benchmarking the `regex` crate,
+# and benchmark reaction's internals instead.
+concurrency: 32
+
+plugins:
+  - path: "/home/ppom/prg/reaction/target/release/reaction-plugin-virtual"
+
+patterns:
+  num:
+    regex: '[0-9]{3}'
+  ip:
+    regex: '(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3})|(?:[0-9a-fA-F:]{2,90})'
+    ignore:
+      - 1.0.0.1
+
+streams:
+  virtual:
+    type: virtual
+    filters:
+      find0:
+        regex:
+          - '^<num>$'
+        actions:
+          damn:
+            cmd: [ 'sleep', '0.0<num>' ]
+          undamn:
+            cmd: [ 'sleep', '0.0<num>' ]
+            after: 1m
+            onexit: false
+  tailDown1:
+    cmd: [ 'sh', '-c', 'sleep 2; seq 1001 | while read i; do echo found $i; done' ]
+    filters:
+      find1:
+        regex:
+          - '^found <num>'
+        retry: 9
+        retryperiod: 6m
+        actions:
+          virtual:
+            type: virtual
+            options:
+              send: '<num>'
+              to: virtual
+  tailDown2:
+    cmd: [ 'sh', '-c', 'sleep 2; seq 100100 | while read i; do echo found $i; echo trouvé $i; done' ]
+    filters:
+      find2:
+        regex:
+          - '^found <num>'
+        retry: 480
+        retryperiod: 6m
+        actions:
+          virtual:
+            type: virtual
+            options:
+              send: '<num>'
+              to: virtual
+  tailDown3:
+    cmd: [ 'sh', '-c', 'sleep 2; seq 100100 | while read i; do echo found $i; echo trouvé $i; done' ]
+    filters:
+      find3:
+        regex:
+          - '^found <num>'
+        retry: 480
+        retryperiod: 6m
+        actions:
+          virtual:
+            type: virtual
+            options:
+              send: '<num>'
+              to: virtual
+      find4:
+        regex:
+          - '^trouvé <num>'
+        retry: 480
+        retryperiod: 6m
+        actions:
+          virtual:
+            type: virtual
+            options:
+              send: '<num>'
+              to: virtual
diff --git a/build.rs b/build.rs
index 97c433e..ff070e0 100644
--- a/build.rs
+++ b/build.rs
@@ -1,8 +1,6 @@
 use std::{
-    env::{var, var_os},
+    env::var_os,
     io::{self, ErrorKind},
-    path::Path,
-    process,
 };
 
 use clap_complete::shells;
@@ -10,54 +8,10 @@ use clap_complete::shells;
 // SubCommand defined here
 include!("src/cli.rs");
 
-fn cc() -> String {
-    // TARGET looks like aarch64-unknown-linux-musl
-    let cc = match var("TARGET") {
-        Ok(target) => {
-            // We're looking for an environment variable looking like
-            // CC_aarch64_unknown_linux_musl
-            let target = target.replace("-", "_");
-            var(format!("CC_{}", target.replace("-", "_"))).ok()
-        }
-        Err(_) => None,
-    };
-    match cc {
-        Some(cc) => Some(cc),
-        // Else we're looking for CC environment variable
-        None => var("CC").ok(),
-    }
-    // Else we use `cc`
-    .unwrap_or("cc".into())
-}
-
-fn compile_helper(cc: &str, name: &str, out_dir: &Path) -> io::Result<()> {
-    let mut args = vec![
-        format!("helpers_c/{name}.c"),
-        "-o".into(),
-        out_dir
-            .join(name)
-            .to_str()
-            .expect("could not join path")
-            .to_owned(),
-    ];
-    // We can build static executables in cross environment
-    if cc.ends_with("-gcc") {
-        args.push("-static".into());
-    }
-    process::Command::new(cc).args(args).spawn()?;
-    Ok(())
-}
-
 fn main() -> io::Result<()> {
     if var_os("PROFILE").ok_or(ErrorKind::NotFound)? == "release" {
         let out_dir = PathBuf::from(var_os("OUT_DIR").ok_or(ErrorKind::NotFound)?).join("../../..");
 
-        // Compile C helpers
-        let cc = cc();
-        println!("CC is: {}", cc);
-        compile_helper(&cc, "ip46tables", &out_dir)?;
-        compile_helper(&cc, "nft46", &out_dir)?;
-
         // Build CLI
         let cli = clap::Command::new("reaction");
         let cli = SubCommand::augment_subcommands(cli);
@@ -80,8 +34,6 @@ See usage examples, service configurations and good practices on the wiki: https
 
     println!("cargo::rerun-if-changed=build.rs");
     println!("cargo::rerun-if-changed=src/cli.rs");
-    println!("cargo::rerun-if-changed=helpers_c/ip46tables.c");
-    println!("cargo::rerun-if-changed=helpers_c/nft46.c");
 
     Ok(())
 }
diff --git a/config/reaction.service b/config/reaction.service
index 9265118..897e869 100644
--- a/config/reaction.service
+++ b/config/reaction.service
@@ -7,7 +7,7 @@ Documentation=https://reaction.ppom.me
 
 # See `man systemd.exec` and `man systemd.service` for most options below
 [Service]
-ExecStart=/usr/local/bin/reaction start -c /etc/reaction.jsonnet
+ExecStart=/usr/local/bin/reaction start -c /etc/reaction/
 
 # Ask systemd to create /var/lib/reaction (/var/lib/ is implicit)
 StateDirectory=reaction
@@ -15,6 +15,8 @@ StateDirectory=reaction
 RuntimeDirectory=reaction
 # Start reaction in its state directory
 WorkingDirectory=/var/lib/reaction
+# Let reaction kill its child processes first
+KillMode=mixed
 
 [Install]
 WantedBy=multi-user.target
diff --git a/crates/treedb/Cargo.toml b/crates/treedb/Cargo.toml
new file mode 100644
index 0000000..9f2c4d3
--- /dev/null
+++ b/crates/treedb/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "treedb"
+version = "1.0.0"
+edition = "2024"
+
+[features]
+test = []
+
+[dependencies]
+chrono.workspace = true
+futures.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tokio.workspace = true
+tokio.features = ["rt-multi-thread", "macros", "io-util", "time", "fs", "tracing"]
+tokio-util.workspace = true
+tokio-util.features = ["rt"]
+tracing.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+
diff --git a/src/treedb/helpers.rs b/crates/treedb/src/helpers.rs
similarity index 51%
rename from src/treedb/helpers.rs
rename to crates/treedb/src/helpers.rs
index 73dccd7..9e4c3b0 100644
--- a/src/treedb/helpers.rs
+++ b/crates/treedb/src/helpers.rs
@@ -1,9 +1,12 @@
-use std::collections::{BTreeMap, BTreeSet};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    time::Duration,
+};
 
-use chrono::{DateTime, Local};
+use chrono::DateTime;
 use serde_json::Value;
 
-use crate::concepts::{Match, MatchTime, Time};
+use crate::time::Time;
 
 /// Tries to convert a [`Value`] into a [`String`]
 pub fn to_string(val: &Value) -> Result<String, String> {
@@ -15,19 +18,40 @@ pub fn to_u64(val: &Value) -> Result<u64, String> {
     val.as_u64().ok_or("not a u64".into())
 }
 
+/// Old way of converting time: with chrono's serialization
+fn old_string_to_time(val: &str) -> Result<Time, String> {
+    let time = DateTime::parse_from_rfc3339(val).map_err(|err| err.to_string())?;
+    Ok(Duration::new(time.timestamp() as u64, time.timestamp_subsec_nanos()).into())
+}
+
+/// New way of converting time: with our own implem
+fn new_string_to_time(val: &str) -> Result<Time, String> {
+    let nanos: u128 = val.parse().map_err(|_| "not a number")?;
+    Ok(Duration::new(
+        (nanos / 1_000_000_000) as u64,
+        (nanos % 1_000_000_000) as u32,
+    )
+    .into())
+}
+
+/// Tries to convert a [`&str`] into a [`Time`]
 fn string_to_time(val: &str) -> Result<Time, String> {
-    Ok(DateTime::parse_from_rfc3339(val)
-        .map_err(|err| err.to_string())?
-        .with_timezone(&Local))
+    match new_string_to_time(val) {
+        Err(err) => match old_string_to_time(val) {
+            Err(_) => Err(err),
+            ok => ok,
+        },
+        ok => ok,
+    }
 }
 
 /// Tries to convert a [`Value`] into a [`Time`]
 pub fn to_time(val: &Value) -> Result<Time, String> {
-    string_to_time(val.as_str().ok_or("not a datetime")?)
+    string_to_time(val.as_str().ok_or("not a string number")?)
 }
 
-/// Tries to convert a [`Value`] into a [`Match`]
-pub fn to_match(val: &Value) -> Result<Match, String> {
+/// Tries to convert a [`Value`] into a [`Vec<String>`]
+pub fn to_match(val: &Value) -> Result<Vec<String>, String> {
     val.as_array()
         .ok_or("not an array")?
         .iter()
@@ -35,15 +59,6 @@ pub fn to_match(val: &Value) -> Result<Match, String> {
         .collect()
 }
 
-/// Tries to convert a [`Value`] into a [`MatchTime`]
-pub fn to_matchtime(val: &Value) -> Result<MatchTime, String> {
-    let map = val.as_object().ok_or("not an object")?;
-    Ok(MatchTime {
-        m: to_match(map.get("m").ok_or("no m in object")?)?,
-        t: to_time(map.get("t").ok_or("no t in object")?)?,
-    })
-}
-
 /// Tries to convert a [`Value`] into a [`BTreeSet<Time>`]
 pub fn to_timeset(val: &Value) -> Result<BTreeSet<Time>, String> {
     val.as_array()
@@ -66,9 +81,6 @@ pub fn to_timemap(val: &Value) -> Result<BTreeMap<Time, u64>, String> {
 mod tests {
     use std::collections::BTreeMap;
 
-    use chrono::TimeZone;
-    use serde_json::Map;
-
     use super::*;
 
     #[test]
@@ -96,15 +108,12 @@ mod tests {
 
     #[test]
     fn test_to_time() {
-        assert_eq!(
-            to_time(&"1970-01-01T01:02:03.456+01:00".into()).unwrap(),
-            Local.timestamp_millis_opt(123456).unwrap(),
-        );
+        assert_eq!(to_time(&"123456".into()).unwrap(), Time::from_nanos(123456),);
         assert!(to_time(&(u64::MAX.into())).is_err());
 
         assert!(to_time(&(["ploup"].into())).is_err());
         assert!(to_time(&(true.into())).is_err());
-        assert!(to_time(&(12345.into())).is_err());
+        // assert!(to_time(&(12345.into())).is_err());
         assert!(to_time(&(None::<String>.into())).is_err());
     }
 
@@ -126,22 +135,14 @@ mod tests {
     #[test]
     fn test_to_timeset() {
         assert_eq!(
-            to_timeset(&(["1970-01-01T01:20:34.567+01:00"].into())),
-            Ok(BTreeSet::from([Local
-                .timestamp_millis_opt(1234567)
-                .unwrap()]))
+            to_timeset(&Value::from([Value::from("123456789")])),
+            Ok(BTreeSet::from([Time::from_nanos(123456789)]))
         );
         assert_eq!(
-            to_timeset(
-                &([
-                    "1970-01-01T01:00:00.008+01:00",
-                    "1970-01-01T01:02:03.456+01:00"
-                ]
-                .into())
-            ),
+            to_timeset(&Value::from([Value::from("8"), Value::from("123456")])),
             Ok(BTreeSet::from([
-                Local.timestamp_millis_opt(8).unwrap(),
-                Local.timestamp_millis_opt(123456).unwrap()
+                Time::from_nanos(8),
+                Time::from_nanos(123456),
             ]))
         );
         assert!(to_timeset(&[Value::from("plip"), Value::from(10)].into()).is_err());
@@ -153,76 +154,27 @@ mod tests {
         assert!(to_timeset(&(None::<String>.into())).is_err());
     }
 
-    #[test]
-    fn test_to_matchtime() {
-        assert_eq!(
-            to_matchtime(&Value::Object(Map::from_iter(
-                BTreeMap::from([
-                    ("m".into(), ["plip", "ploup"].into()),
-                    ("t".into(), "1970-01-01T04:25:45.678+01:00".into()),
-                ])
-                .into_iter()
-            ))),
-            Ok(MatchTime {
-                m: vec!["plip".into(), "ploup".into()],
-                t: Local.timestamp_millis_opt(12345678).unwrap(),
-            })
-        );
-
-        assert!(to_matchtime(&Value::Object(Map::from_iter(
-            BTreeMap::from([("m".into(), ["plip", "ploup"].into()),]).into_iter()
-        )))
-        .is_err());
-
-        assert!(to_matchtime(&Value::Object(Map::from_iter(
-            BTreeMap::from([("t".into(), 12345678.into()),]).into_iter()
-        )))
-        .is_err());
-
-        assert!(to_matchtime(&Value::Object(Map::from_iter(
-            BTreeMap::from([("m".into(), "ploup".into()), ("t".into(), 12345678.into()),])
-                .into_iter()
-        )))
-        .is_err());
-
-        assert!(to_matchtime(&Value::Object(Map::from_iter(
-            BTreeMap::from([
-                ("m".into(), ["plip", "ploup"].into()),
-                ("t".into(), [1234567].into()),
-            ])
-            .into_iter()
-        )))
-        .is_err());
-
-        assert!(to_timeset(&([""].into())).is_err());
-        assert!(to_timeset(&(["ploup"].into())).is_err());
-        assert!(to_timeset(&(true.into())).is_err());
-        assert!(to_timeset(&(8.into())).is_err());
-        assert!(to_timeset(&(None::<String>.into())).is_err());
-    }
-
     #[test]
     fn test_to_timemap() {
-        let time1 = "2025-07-10T12:35:00.000+02:00";
-        let time1_t = DateTime::parse_from_rfc3339(time1)
-            .unwrap()
-            .with_timezone(&Local);
-        let time2 = "2026-08-11T12:36:01.000+02:00";
-        let time2_t = DateTime::parse_from_rfc3339(time2)
-            .unwrap()
-            .with_timezone(&Local);
+        let time1 = 1234567;
+        let time1_t = Time::from_nanos(time1);
+        let time2 = 123456789;
+        let time2_t = Time::from_nanos(time2);
 
         assert_eq!(
-            to_timemap(&Value::from_iter([(time2, 1)])),
+            to_timemap(&Value::from_iter([(time2.to_string(), 1)])),
             Ok(BTreeMap::from([(time2_t, 1)]))
         );
         assert_eq!(
-            to_timemap(&Value::from_iter([(time1, 4), (time2, 0)])),
-            Ok(BTreeMap::from([(time1_t, 4), (time2_t, 0)]))
+            to_timemap(&Value::from_iter([
+                (time1.to_string(), 4),
+                (time2.to_string(), 0)
+            ])),
+            Ok(BTreeMap::from([(time1_t.into(), 4), (time2_t.into(), 0)]))
         );
 
-        assert!(to_timemap(&Value::from_iter([("1", time2)])).is_err());
-        assert!(to_timemap(&Value::from_iter([(time2, time2)])).is_err());
+        assert!(to_timemap(&Value::from_iter([("1-1", time2)])).is_err());
+        // assert!(to_timemap(&Value::from_iter([(time2.to_string(), time2)])).is_err());
         assert!(to_timemap(&Value::from_iter([(time2)])).is_err());
         assert!(to_timemap(&Value::from_iter([(1)])).is_err());
 
diff --git a/src/treedb/mod.rs b/crates/treedb/src/lib.rs
similarity index 83%
rename from src/treedb/mod.rs
rename to crates/treedb/src/lib.rs
index ed54a7a..e7e8a27 100644
--- a/src/treedb/mod.rs
+++ b/crates/treedb/src/lib.rs
@@ -17,27 +17,23 @@ use std::{
     time::Duration,
 };
 
-use chrono::{Local, TimeDelta};
-use serde::{de::DeserializeOwned, Deserialize, Serialize};
+use serde::{Deserialize, Serialize, de::DeserializeOwned};
 use serde_json::Value;
 use tokio::{
-    fs::{rename, File},
+    fs::{File, rename},
     sync::{mpsc, oneshot},
-    time::{interval, MissedTickBehavior},
+    time::{MissedTickBehavior, interval},
 };
-
-use crate::{
-    concepts::{Config, Time},
-    daemon::ShutdownToken,
-};
-
-pub mod helpers;
+use tokio_util::{sync::CancellationToken, task::task_tracker::TaskTrackerToken};
 
 // Database
 
 use raw::{ReadDB, WriteDB};
+use time::{Time, now};
 
+pub mod helpers;
 mod raw;
+pub mod time;
 
 /// Any order the Database can receive
 enum Order {
@@ -66,20 +62,20 @@ pub type LoadedDB = HashMap<String, LoadedTree>;
 const DB_NAME: &str = "reaction.db";
 const DB_NEW_NAME: &str = "reaction.new.db";
 
-impl Config {
-    fn path_of(&self, name: &str) -> PathBuf {
-        if self.state_directory.is_empty() {
-            name.into()
-        } else {
-            PathBuf::from(&self.state_directory).join(name)
-        }
+fn path_of(state_directory: &Path, name: &str) -> PathBuf {
+    if state_directory.as_os_str().is_empty() {
+        name.into()
+    } else {
+        PathBuf::from(state_directory).join(name)
     }
 }
 
+pub type DatabaseErrorReceiver = oneshot::Receiver<Result<(), String>>;
+
 /// Public-facing API for a treedb Database
 pub struct Database {
     entry_tx: Option<mpsc::Sender<Order>>,
-    error_rx: oneshot::Receiver<Result<(), String>>,
+    error_rx: DatabaseErrorReceiver,
 }
 
 impl Database {
@@ -87,12 +83,17 @@ impl Database {
     /// You'll have to:
     /// - drop all [`Tree`]s,
     /// - call [`Self::quit`],
+    ///
     /// to have the Database properly quit.
     ///
     /// You can wait for [`Self::quit`] returned channel to know how it went.
-    pub async fn open(config: &Config, shutdown: ShutdownToken) -> Result<Database, IoError> {
-        let (manager, entry_tx) = DatabaseManager::open(config).await?;
-        let error_rx = manager.manager(shutdown);
+    pub async fn open(
+        path_directory: &Path,
+        cancellation_token: CancellationToken,
+        task_tracker_token: TaskTrackerToken,
+    ) -> Result<Database, IoError> {
+        let (manager, entry_tx) = DatabaseManager::open(path_directory).await?;
+        let error_rx = manager.manager(cancellation_token, task_tracker_token);
         Ok(Self {
             entry_tx: Some(entry_tx),
             error_rx,
@@ -101,7 +102,7 @@ impl Database {
 
     /// Permit to close DB's channel.
     /// Without this function manually called, the DB can't close.
-    pub fn quit(self) -> oneshot::Receiver<Result<(), String>> {
+    pub fn quit(self) -> DatabaseErrorReceiver {
         self.error_rx
     }
 }
@@ -133,9 +134,11 @@ struct DatabaseManager {
 }
 
 impl DatabaseManager {
-    pub async fn open(config: &Config) -> Result<(DatabaseManager, mpsc::Sender<Order>), IoError> {
-        let path = config.path_of(DB_NAME);
-        let new_path = config.path_of(DB_NEW_NAME);
+    pub async fn open(
+        path_directory: &Path,
+    ) -> Result<(DatabaseManager, mpsc::Sender<Order>), IoError> {
+        let path = path_of(path_directory, DB_NAME);
+        let new_path = path_of(path_directory, DB_NEW_NAME);
 
         let (write_db, loaded_db) = rotate_db(&path, &new_path, true).await?;
 
@@ -156,7 +159,11 @@ impl DatabaseManager {
         ))
     }
 
-    pub fn manager(mut self, shutdown: ShutdownToken) -> oneshot::Receiver<Result<(), String>> {
+    pub fn manager(
+        mut self,
+        cancellation_token: CancellationToken,
+        _task_tracker_token: TaskTrackerToken,
+    ) -> oneshot::Receiver<Result<(), String>> {
         let (error_tx, error_rx) = oneshot::channel();
         tokio::spawn(async move {
             let mut interval = interval(self.flush_every);
@@ -168,17 +175,17 @@ impl DatabaseManager {
                 tokio::select! {
                     order = self.entry_rx.recv() => {
                         if let Err(err) = self.handle_order(order).await {
-                            shutdown.ask_shutdown();
+                            cancellation_token.cancel();
                             break err;
                         }
                     }
                     _ = interval.tick() => {
                         if let Err(err) = self.flush().await {
-                            shutdown.ask_shutdown();
+                            cancellation_token.cancel();
                             break Some(err);
                         }
                     }
-                    _ = shutdown.wait() => break None
+                    _ = cancellation_token.cancelled() => break None
                 };
             };
 
@@ -279,7 +286,7 @@ async fn rotate_db(
             // No need to rotate the database when it is new,
             // we return here
             (true, ErrorKind::NotFound) => {
-                return Ok((WriteDB::new(File::create(path).await?), HashMap::default()))
+                return Ok((WriteDB::new(File::create(path).await?), HashMap::default()));
             }
             (_, _) => return Err(err),
         },
@@ -319,7 +326,7 @@ pub struct Tree<K: KeyType, V: ValueType> {
     /// This property permits the database rotation to be `O(n)` in time and `O(1)` in RAM space,
     /// `n` being the number of write operations from the last rotation plus the number of new
     /// operations.
-    entry_timeout: TimeDelta,
+    entry_timeout: Duration,
     /// The inner BTreeMap
     tree: BTreeMap<K, V>,
     /// The sender that permits to asynchronously send write operations to database
@@ -334,7 +341,7 @@ impl Database {
     pub async fn open_tree<K: KeyType, V: ValueType, F>(
         &mut self,
         name: String,
-        entry_timeout: TimeDelta,
+        entry_timeout: Duration,
         map_f: F,
     ) -> Result<Tree<K, V>, String>
     where
@@ -403,11 +410,12 @@ impl<K: KeyType, V: ValueType> Deref for Tree<K, V> {
 impl<K: KeyType, V: ValueType> Tree<K, V> {
     /// Log an [`Entry`] to the [`Database`]
     async fn log(&mut self, k: &K, v: Option<&V>) {
+        let now = now();
         let e = Entry {
             tree: self.id.clone(),
             key: serde_json::to_value(k).expect("could not serialize key"),
             value: v.map(|v| serde_json::to_value(v).expect("could not serialize value")),
-            expiry: Local::now() + self.entry_timeout,
+            expiry: now + self.entry_timeout,
         };
         let tx = self.tx.clone();
         // FIXME what if send fails?
@@ -466,6 +474,35 @@ impl<K: KeyType, V: ValueType> Tree<K, V> {
             self.tree.remove(&key)
         }
     }
+
+    #[cfg(any(test, feature = "test"))]
+    pub fn tree(&self) -> &BTreeMap<K, V> {
+        &self.tree
+    }
+}
+
+#[cfg(any(test, feature = "test"))]
+impl DatabaseManager {
+    pub fn set_loaded_db(&mut self, loaded_db: LoadedDB) {
+        self.loaded_db = loaded_db;
+    }
+}
+
+#[cfg(any(test, feature = "test"))]
+impl Database {
+    pub async fn from_dir(dir_path: &Path, loaded_db: Option<LoadedDB>) -> Result<Self, IoError> {
+        use tokio_util::task::TaskTracker;
+
+        let (mut manager, entry_tx) = DatabaseManager::open(dir_path).await?;
+        if let Some(loaded_db) = loaded_db {
+            manager.set_loaded_db(loaded_db)
+        }
+        let error_rx = manager.manager(CancellationToken::new(), TaskTracker::new().token());
+        Ok(Self {
+            entry_tx: Some(entry_tx),
+            error_rx,
+        })
+    }
 }
 
 #[cfg(test)]
@@ -473,78 +510,21 @@ mod tests {
 
     use std::{
         collections::{BTreeMap, BTreeSet, HashMap},
-        io::Error as IoError,
-        path::Path,
+        time::Duration,
     };
 
-    use chrono::{Local, TimeDelta};
     use serde_json::Value;
     use tempfile::{NamedTempFile, TempDir};
-    use tokio::fs::{write, File};
+    use tokio::fs::File;
 
-    use crate::{concepts::Config, daemon::ShutdownController};
-
-    use super::{
-        helpers::*, raw::WriteDB, rotate_db, Database, DatabaseManager, Entry, KeyType, LoadedDB,
-        Tree, ValueType, DB_NAME,
-    };
-
-    impl DatabaseManager {
-        pub fn set_loaded_db(&mut self, loaded_db: LoadedDB) {
-            self.loaded_db = loaded_db;
-        }
-    }
-
-    impl Database {
-        pub async fn from_dir(
-            dir_path: &Path,
-            loaded_db: Option<LoadedDB>,
-        ) -> Result<Self, IoError> {
-            let config_path = dir_path.join("reaction.jsonnet");
-            write(
-                &config_path,
-                format!(
-                    "
-        {{
-            state_directory: {dir_path:?},
-            patterns: {{ pattern: {{ regex: \"prout\" }} }},
-            streams: {{ dummy: {{
-                    cmd: [\"dummy\"],
-                    filters: {{ dummy: {{
-                            regex: [\"dummy\"],
-                            actions: {{ dummy: {{
-                                cmd: [\"dummy\"]
-                            }} }}
-                    }} }}
-            }} }}
-        }}
-        "
-                ),
-            )
-            .await?;
-
-            let config = Config::from_path(&config_path).unwrap();
-            let (mut manager, entry_tx) = DatabaseManager::open(&config).await?;
-            if let Some(loaded_db) = loaded_db {
-                manager.set_loaded_db(loaded_db)
-            }
-            let error_rx = manager.manager(ShutdownController::new().token());
-            Ok(Self { entry_tx: Some(entry_tx), error_rx })
-        }
-    }
-
-    impl<K: KeyType, V: ValueType> Tree<K, V> {
-        pub fn tree(&self) -> &BTreeMap<K, V> {
-            &self.tree
-        }
-    }
+    use super::{DB_NAME, Database, Entry, Time, helpers::*, now, raw::WriteDB, rotate_db};
 
     #[tokio::test]
     async fn test_rotate_db() {
-        let now = Local::now();
+        let now = now();
 
-        let expired = now - TimeDelta::seconds(2);
-        let valid = now + TimeDelta::seconds(2);
+        let expired = now - Time::from_secs(2);
+        let valid = now + Time::from_secs(2);
 
         let entries = [
             Entry {
@@ -642,15 +622,16 @@ mod tests {
 
     #[tokio::test]
     async fn test_open_tree() {
-        let now = Local::now();
-        let now2 = now + TimeDelta::milliseconds(2);
-        let now3 = now + TimeDelta::milliseconds(3);
+        let now = now();
 
-        let now_ms = now.to_rfc3339();
-        let now2_ms = now2.to_rfc3339();
-        let now3_ms = now3.to_rfc3339();
+        let now2 = now + Time::from_millis(2);
+        let now3 = now + Time::from_millis(3);
 
-        let valid = now + TimeDelta::seconds(2);
+        // let now_ms = now.as_nanos().to_string();
+        // let now2_ms = now2.as_nanos().to_string();
+        // let now3_ms = now3.as_nanos().to_string();
+
+        let valid = now + Time::from_secs(2);
 
         let ip127 = vec!["127.0.0.1".to_string()];
         let ip1 = vec!["1.1.1.1".to_string()];
@@ -658,44 +639,50 @@ mod tests {
         let entries = [
             Entry {
                 tree: "time-match".into(),
-                key: now_ms.clone().into(),
+                key: now.as_nanos().to_string().into(),
                 value: Some(ip127.clone().into()),
                 expiry: valid,
             },
             Entry {
                 tree: "time-match".into(),
-                key: now2_ms.clone().into(),
+                key: now2.as_nanos().to_string().into(),
                 value: Some(ip127.clone().into()),
                 expiry: valid,
             },
             Entry {
                 tree: "time-match".into(),
-                key: now3_ms.clone().into(),
+                key: now3.as_nanos().to_string().into(),
                 value: Some(ip127.clone().into()),
                 expiry: valid,
             },
             Entry {
                 tree: "time-match".into(),
-                key: now2_ms.clone().into(),
+                key: now2.as_nanos().to_string().into(),
                 value: Some(ip127.clone().into()),
                 expiry: valid,
             },
             Entry {
                 tree: "match-timeset".into(),
                 key: ip127.clone().into(),
-                value: Some([Value::String(now_ms)].into()),
+                value: Some([Value::String(now.as_nanos().to_string())].into()),
                 expiry: valid,
             },
             Entry {
                 tree: "match-timeset".into(),
                 key: ip1.clone().into(),
-                value: Some([Value::String(now2_ms.clone())].into()),
+                value: Some([Value::String(now2.as_nanos().to_string())].into()),
                 expiry: valid,
             },
             Entry {
                 tree: "match-timeset".into(),
                 key: ip1.clone().into(),
-                value: Some([Value::String(now2_ms.clone()), now3_ms.into()].into()),
+                value: Some(
+                    [
+                        Value::String(now2.as_nanos().to_string()),
+                        Value::String(now3.as_nanos().to_string()),
+                    ]
+                    .into(),
+                ),
                 expiry: valid,
             },
         ];
@@ -716,7 +703,7 @@ mod tests {
         let time_match = database
             .open_tree(
                 "time-match".into(),
-                TimeDelta::seconds(2),
+                Duration::from_secs(2),
                 |(key, value)| Ok((to_time(&key)?, to_match(&value)?)),
             )
             .await
@@ -733,7 +720,7 @@ mod tests {
         let match_timeset = database
             .open_tree(
                 "match-timeset".into(),
-                TimeDelta::hours(2),
+                Duration::from_hours(2),
                 |(key, value)| Ok((to_match(&key)?, to_timeset(&value)?)),
             )
             .await
@@ -749,7 +736,7 @@ mod tests {
         let unknown_tree = database
             .open_tree(
                 "unknown_tree".into(),
-                TimeDelta::hours(2),
+                Duration::from_hours(2),
                 |(key, value)| Ok((to_match(&key)?, to_timeset(&value)?)),
             )
             .await
diff --git a/src/treedb/raw.rs b/crates/treedb/src/raw.rs
similarity index 88%
rename from src/treedb/raw.rs
rename to crates/treedb/src/raw.rs
index ded00b2..c169539 100644
--- a/src/treedb/raw.rs
+++ b/crates/treedb/src/raw.rs
@@ -1,6 +1,9 @@
-use std::{collections::HashMap, io::Error as IoError};
+use std::{
+    collections::HashMap,
+    io::Error as IoError,
+    time::{SystemTime, UNIX_EPOCH},
+};
 
-use chrono::{Local, TimeZone};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use thiserror::Error;
@@ -10,6 +13,8 @@ use tokio::{
 };
 use tracing::error;
 
+use crate::time::Time;
+
 use super::{Entry, LoadedDB};
 
 const DB_TREE_ID: u64 = 0;
@@ -43,7 +48,7 @@ struct WriteEntry<'a> {
     #[serde(rename = "v")]
     pub value: &'a Option<Value>,
     #[serde(rename = "e")]
-    pub expiry: i64,
+    pub expiry: u64,
 }
 
 /// Entry in custom database format, just read from database
@@ -56,7 +61,7 @@ struct ReadEntry {
     #[serde(rename = "v")]
     pub value: Option<Value>,
     #[serde(rename = "e")]
-    pub expiry: i64,
+    pub expiry: u64,
 }
 
 /// Permits to write entries in a database.
@@ -109,7 +114,7 @@ impl WriteDB {
             tree: tree_id,
             key: &entry.key,
             value: &entry.value,
-            expiry: entry.expiry.timestamp_millis(),
+            expiry: entry.expiry.as_millis() as u64,
         })
         .await
         .map(|bytes_written| bytes_written + written)
@@ -176,12 +181,14 @@ impl ReadDB {
                 Ok(Some(entry)) => {
                     // Add back in new DB
                     match write_db.write_entry(&entry).await {
-                            Ok(_) => (),
-                            Err(err) => match err {
-                                SerdeOrIoError::IO(err) => return Err(err),
-                                SerdeOrIoError::Serde(err) => error!("serde should be able to serialize an entry just deserialized: {err}"),
-                            }
-                        }
+                        Ok(_) => (),
+                        Err(err) => match err {
+                            SerdeOrIoError::IO(err) => return Err(err),
+                            SerdeOrIoError::Serde(err) => error!(
+                                "serde should be able to serialize an entry just deserialized: {err}"
+                            ),
+                        },
+                    }
                     // Insert data in RAM
                     if load_db {
                         let map: &mut HashMap<Value, Value> =
@@ -199,7 +206,10 @@ impl ReadDB {
     }
 
     async fn next(&mut self) -> Result<Option<Entry>, DatabaseError> {
-        let now = Local::now().timestamp_millis();
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_millis() as u64;
         // Loop until we get a non-special value
         let raw_entry = loop {
             self.buffer.clear();
@@ -239,7 +249,7 @@ impl ReadDB {
                 tree: tree.to_owned(),
                 key: raw_entry.key,
                 value: raw_entry.value,
-                expiry: Local.timestamp_millis_opt(raw_entry.expiry).unwrap(),
+                expiry: Time::from_millis(raw_entry.expiry),
             })),
             None => Err(DatabaseError::MissingKeyId(raw_entry.tree)),
         }
@@ -250,22 +260,22 @@ impl ReadDB {
 mod tests {
     use std::collections::HashMap;
 
-    use chrono::{Local, TimeDelta, TimeZone};
     use serde_json::Value;
     use tempfile::NamedTempFile;
-    use tokio::fs::{read, write, File};
+    use tokio::fs::{File, read, write};
 
-    use crate::treedb::{
-        raw::{DatabaseError, ReadDB, WriteDB, DB_TREE_ID},
+    use crate::{
         Entry,
+        raw::{DB_TREE_ID, DatabaseError, ReadDB, WriteDB},
+        time::{Time, now},
     };
 
     #[tokio::test]
     async fn write_db_write_entry() {
-        let now = Local::now();
-        let expired = now - TimeDelta::seconds(2);
-        let expired_ts = expired.timestamp_millis();
-        // let valid = now + TimeDelta::seconds(2);
+        let now = now();
+        let expired = now - Time::from_secs(2);
+        let expired_ts = expired.as_millis();
+        // let valid = now + Time::from_secs(2);
         // let valid_ts = valid.timestamp_millis();
 
         let path = NamedTempFile::new().unwrap().into_temp_path();
@@ -289,21 +299,23 @@ mod tests {
 
         assert_eq!(
             contents,
-            format!("{{\"t\":0,\"k\":1,\"v\":\"yooo\",\"e\":0}}\n{{\"t\":1,\"k\":\"key1\",\"v\":\"value1\",\"e\":{expired_ts}}}\n")
+            format!(
+                "{{\"t\":0,\"k\":1,\"v\":\"yooo\",\"e\":0}}\n{{\"t\":1,\"k\":\"key1\",\"v\":\"value1\",\"e\":{expired_ts}}}\n"
+            )
         );
     }
 
     #[tokio::test]
     async fn read_db_next() {
-        let now = Local::now();
+        let now = now();
 
-        let expired = now - TimeDelta::seconds(2);
-        let expired_ts = expired.timestamp_millis();
+        let expired = now - Time::from_secs(2);
+        let expired_ts = expired.as_millis();
 
-        let valid = now + TimeDelta::seconds(2);
-        let valid_ts = valid.timestamp_millis();
+        let valid = now + Time::from_secs(2);
+        let valid_ts = valid.as_millis();
         // Truncate to millisecond precision
-        let valid = Local.timestamp_millis_opt(valid_ts).unwrap();
+        let valid = Time::new(valid.as_secs(), valid.subsec_millis() * 1_000_000);
 
         let path = NamedTempFile::new().unwrap().into_temp_path();
 
@@ -343,13 +355,13 @@ mod tests {
 
     #[tokio::test]
     async fn read_db_read() {
-        let now = Local::now();
+        let now = now();
 
-        let expired = now - TimeDelta::seconds(2);
-        let expired_ts = expired.timestamp_millis();
+        let expired = now - Time::from_secs(2);
+        let expired_ts = expired.as_millis();
 
-        let valid = now + TimeDelta::seconds(2);
-        let valid_ts = valid.timestamp_millis();
+        let valid = now + Time::from_secs(2);
+        let valid_ts = valid.as_millis();
 
         let read_path = NamedTempFile::new().unwrap().into_temp_path();
         let write_path = NamedTempFile::new().unwrap().into_temp_path();
@@ -422,13 +434,13 @@ mod tests {
     #[tokio::test]
     async fn write_then_read_1000() {
         // Generate entries
-        let now = Local::now();
+        let now = now();
         let entries: Vec<_> = (0..1000)
             .map(|i| Entry {
                 tree: format!("tree{}", i % 4),
                 key: format!("key{}", i % 10).into(),
                 value: Some(format!("value{}", i % 10).into()),
-                expiry: now + TimeDelta::seconds((i % 4) - 1),
+                expiry: now + Time::from_secs(i % 4) - Time::from_secs(1),
             })
             .collect();
 
@@ -438,7 +450,7 @@ mod tests {
                 tree: format!("tree{}", i % 4),
                 key: format!("key{}", i % 10).into(),
                 value: None,
-                expiry: now + TimeDelta::seconds(i % 4),
+                expiry: now + Time::from_secs(i % 4),
             })
             .collect();
 
diff --git a/crates/treedb/src/time.rs b/crates/treedb/src/time.rs
new file mode 100644
index 0000000..9e50ee2
--- /dev/null
+++ b/crates/treedb/src/time.rs
@@ -0,0 +1,117 @@
+use std::{
+    fmt,
+    ops::{Add, Deref, Sub},
+    time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+use serde::{Deserialize, Serialize};
+
+/// [`std::time::Duration`] since [`std::time::UNIX_EPOCH`]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct Time(Duration);
+impl Deref for Time {
+    type Target = Duration;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+impl From<Duration> for Time {
+    fn from(value: Duration) -> Self {
+        Time(value)
+    }
+}
+impl Into<Duration> for Time {
+    fn into(self) -> Duration {
+        self.0
+    }
+}
+impl Add<Duration> for Time {
+    type Output = Time;
+    fn add(self, rhs: Duration) -> Self::Output {
+        Time(self.0 + rhs)
+    }
+}
+impl Add<Time> for Time {
+    type Output = Time;
+    fn add(self, rhs: Time) -> Self::Output {
+        Time(self.0 + rhs.0)
+    }
+}
+impl Sub<Duration> for Time {
+    type Output = Time;
+    fn sub(self, rhs: Duration) -> Self::Output {
+        Time(self.0 - rhs)
+    }
+}
+impl Sub<Time> for Time {
+    type Output = Time;
+    fn sub(self, rhs: Time) -> Self::Output {
+        Time(self.0 - rhs.0)
+    }
+}
+
+impl Serialize for Time {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        self.as_nanos().to_string().serialize(serializer)
+    }
+}
+struct TimeVisitor;
+impl<'de> serde::de::Visitor<'de> for TimeVisitor {
+    type Value = Time;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        write!(formatter, "a string representing nanoseconds")
+    }
+
+    fn visit_str<E>(self, s: &str) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        match s.parse::<u128>() {
+            Ok(nanos) => Ok(Time(Duration::new(
+                (nanos / 1_000_000_000) as u64,
+                (nanos % 1_000_000_000) as u32,
+            ))),
+            Err(_) => Err(serde::de::Error::invalid_value(
+                serde::de::Unexpected::Str(s),
+                &self,
+            )),
+        }
+    }
+}
+impl<'de> Deserialize<'de> for Time {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_str(TimeVisitor)
+    }
+}
+
+impl Time {
+    pub fn new(secs: u64, nanos: u32) -> Time {
+        Time(Duration::new(secs, nanos))
+    }
+    pub fn from_hours(hours: u64) -> Time {
+        Time(Duration::from_hours(hours))
+    }
+    pub fn from_mins(mins: u64) -> Time {
+        Time(Duration::from_mins(mins))
+    }
+    pub fn from_secs(secs: u64) -> Time {
+        Time(Duration::from_secs(secs))
+    }
+    pub fn from_millis(millis: u64) -> Time {
+        Time(Duration::from_millis(millis))
+    }
+    pub fn from_nanos(nanos: u64) -> Time {
+        Time(Duration::from_nanos(nanos))
+    }
+}
+
+pub fn now() -> Time {
+    Time(SystemTime::now().duration_since(UNIX_EPOCH).unwrap())
+}
diff --git a/helpers_c/README.md b/helpers_c/README.md
deleted file mode 100644
index 2407f19..0000000
--- a/helpers_c/README.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# C helpers
-
-Those helpers permit to handle IPv4 & IPv6 at the same time, waiting for [#79](https://framagit.org/ppom/reaction/-/issues/79) to be addressed.
-
-Compilation:
-
-```bash
-# Produces nft46 binary
-gcc -o nft46 nft46.c
-# Produces ip46tables binary
-gcc -o ip46tables ip46tables.c
-```
diff --git a/helpers_c/ip46tables.c b/helpers_c/ip46tables.c
deleted file mode 100644
index 02ce85a..0000000
--- a/helpers_c/ip46tables.c
+++ /dev/null
@@ -1,91 +0,0 @@
-#include<ctype.h>
-#include<errno.h>
-#include<stdio.h>
-#include<stdlib.h>
-#include<string.h>
-#include<unistd.h>
-
-// If this programs
-// - receives an ipv4 address in its arguments:
-//   → it will executes iptables  with the same arguments in place.
-//
-// - receives an ipv6 address in its arguments:
-//   → it will executes ip6tables with the same arguments in place.
-//
-// - doesn't receive an ipv4 or ipv6 address in its arguments:
-//   → it will executes both, with the same arguments in place.
-
-int isIPv4(char *tab) {
-	int i,len;
-	// IPv4 addresses are at least 7 chars long
-	len = strlen(tab);
-	if (len < 7 || !isdigit(tab[0]) || !isdigit(tab[len-1])) {
-			return 0;
-	}
-	// Each char must be a digit or a dot between 2 digits
-	for (i=1; i<len-1; i++) {
-		if (!isdigit(tab[i]) && !(tab[i] == '.' && isdigit(tab[i-1]) && isdigit(tab[i+1]))) {
-			return 0;
-		}
-	}
-	return 1;
-}
-
-int isIPv6(char *tab) {
-	int i,len, twodots = 0;
-	// IPv6 addresses are at least 3 chars long
-	len = strlen(tab);
-	if (len < 3) {
-			return 0;
-	}
-	// Each char must be a digit, :, a-f, or A-F
-	for (i=0; i<len; i++) {
-		if (!isdigit(tab[i]) && tab[i] != ':' && !(tab[i] >= 'a' && tab[i] <= 'f') && !(tab[i] >= 'A' && tab[i] <= 'F')) {
-			return 0;
-		}
-	}
-	return 1;
-}
-
-int guess_type(int len, char *tab[]) {
-	int i;
-	for (i=0; i<len; i++) {
-		if (isIPv4(tab[i])) {
-			return 4;
-		} else if (isIPv6(tab[i])) {
-			return 6;
-		}
-	}
-	return 0;
-}
-
-void exec(char *str, char **argv) {
-	argv[0] = str;
-	execvp(str, argv);
-	// returns only if fails
-	printf("ip46tables: exec failed %d\n", errno);
-}
-
-int main(int argc, char **argv) {
-	if (argc < 2) {
-		printf("ip46tables: At least one argument has to be given\n");
-		exit(1);
-	}
-	int type;
-	type = guess_type(argc, argv);
-	if (type == 4) {
-		exec("iptables", argv);
-	} else if (type == 6) {
-		exec("ip6tables", argv);
-	} else {
-		pid_t pid = fork();
-		if (pid == -1) {
-			printf("ip46tables: fork failed\n");
-			exit(1);
-		} else if (pid) {
-			exec("iptables", argv);
-		} else {
-			exec("ip6tables", argv);
-		}
-	}
-}
diff --git a/helpers_c/nft46.c b/helpers_c/nft46.c
deleted file mode 100644
index cb0f419..0000000
--- a/helpers_c/nft46.c
+++ /dev/null
@@ -1,97 +0,0 @@
-#include<ctype.h>
-#include<errno.h>
-#include<stdio.h>
-#include<stdlib.h>
-#include<string.h>
-#include<unistd.h>
-
-// nft46 'add element inet reaction ipvXbans { 1.2.3.4 }' → nft 'add element inet reaction ipv4bans { 1.2.3.4 }'
-// nft46 'add element inet reaction ipvXbans { a:b::c:d }' → nft 'add element inet reaction ipv6bans { a:b::c:d }'
-//
-// the character X is replaced by 4 or 6 depending on the address family of the specified IP
-//
-// Limitations:
-// - nft46 must receive exactly one argument
-// - only one IP must be given per command
-// - the IP must be between { braces }
-
-int isIPv4(char *tab, int len) {
-	int i;
-	// IPv4 addresses are at least 7 chars long
-	if (len < 7 || !isdigit(tab[0]) || !isdigit(tab[len-1])) {
-			return 0;
-	}
-	// Each char must be a digit or a dot between 2 digits
-	for (i=1; i<len-1; i++) {
-		if (!isdigit(tab[i]) && !(tab[i] == '.' && isdigit(tab[i-1]) && isdigit(tab[i+1]))) {
-			return 0;
-		}
-	}
-	return 1;
-}
-
-int isIPv6(char *tab, int len) {
-	int i;
-	// IPv6 addresses are at least 3 chars long
-	if (len < 3) {
-		return 0;
-	}
-	// Each char must be a digit, :, a-f, or A-F
-	for (i=0; i<len; i++) {
-		if (!isdigit(tab[i]) && tab[i] != ':' && tab[i] != '.' && !(tab[i] >= 'a' && tab[i] <= 'f') && !(tab[i] >= 'A' && tab[i] <= 'F')) {
-			return 0;
-		}
-	}
-	return 1;
-}
-
-int findchar(char *tab, char c, int i, int len) {
-	while (i < len && tab[i] != c) i++;
-	if (i == len) {
-		printf("nft46: one %c must be present", c);
-		exit(1);
-	}
-	return i;
-}
-
-void adapt_args(char *tab) {
-	int i, len, X, startIP, endIP, startedIP;
-	X = startIP = endIP = -1;
-	startedIP = 0;
-	len = strlen(tab);
-	i = 0;
-	X = i = findchar(tab, 'X', i, len);
-	startIP = i = findchar(tab, '{', i, len);
-	while (startIP + 1 <= (i = findchar(tab, ' ', i, len))) startIP = i + 1;
-	i = startIP;
-	endIP = i = findchar(tab, ' ', i, len) - 1;
-
-	if (isIPv4(tab+startIP, endIP-startIP+1)) {
-		tab[X] = '4';
-		return;
-	}
-
-	if (isIPv6(tab+startIP, endIP-startIP+1)) {
-		tab[X] = '6';
-		return;
-	}
-
-	printf("nft46: no IP address found\n");
-	exit(1);
-}
-
-void exec(char *str, char **argv) {
-	argv[0] = str;
-	execvp(str, argv);
-	// returns only if fails
-	printf("nft46: exec failed %d\n", errno);
-}
-
-int main(int argc, char **argv) {
-	if (argc != 2) {
-		printf("nft46: Exactly one argument must be given\n");
-		exit(1);
-	}
-	adapt_args(argv[1]);
-	exec("nft", argv);
-}
diff --git a/packaging/Makefile b/packaging/Makefile
index 4727ac8..ac1a064 100644
--- a/packaging/Makefile
+++ b/packaging/Makefile
@@ -4,17 +4,21 @@ MANDIR = $(PREFIX)/share/man/man1
 SYSTEMDDIR ?= /etc/systemd
 
 install:
-	install -Dm755 reaction nft46 ip46tables $(DESTDIR)$(BINDIR)
+	install -Dm755 reaction                $(DESTDIR)$(BINDIR)
+	install -Dm755 reaction-plugin-virtual $(DESTDIR)$(BINDIR)
 	install -Dm644 reaction*.1 -t $(DESTDIR)$(MANDIR)/
 	install -Dm644 reaction.bash  $(DESTDIR)$(PREFIX)/share/bash-completion/completions/reaction
 	install -Dm644 reaction.fish  $(DESTDIR)$(PREFIX)/share/fish/vendor_completions.d/reaction.fish
 	install -Dm644 _reaction      $(DESTDIR)$(PREFIX)/share/zsh/vendor-completions/_reaction
 	install -Dm644 reaction.service $(SYSTEMDDIR)/system/reaction.service
 
+install-ipset:
+	install -Dm755 reaction-plugin-ipset $(DESTDIR)$(BINDIR)
+
 remove:
 	rm -f $(DESTDIR)$(BINDIR)/bin/reaction
-	rm -f $(DESTDIR)$(BINDIR)/bin/nft46
-	rm -f $(DESTDIR)$(BINDIR)/bin/ip46tables
+	rm -f $(DESTDIR)$(BINDIR)/bin/reaction-plugin-virtual
+	rm -f $(DESTDIR)$(BINDIR)/bin/reaction-plugin-ipset
 	rm -f $(DESTDIR)$(MANDIR)/reaction*.1
 	rm -f $(DESTDIR)$(PREFIX)/share/bash-completion/completions/reaction
 	rm -f $(DESTDIR)$(PREFIX)/share/fish/vendor_completions.d/reaction.fish
diff --git a/packaging/reaction@.service b/packaging/reaction.service
similarity index 71%
rename from packaging/reaction@.service
rename to packaging/reaction.service
index 729b95b..343015d 100644
--- a/packaging/reaction@.service
+++ b/packaging/reaction.service
@@ -1,13 +1,13 @@
 # vim: ft=systemd
 [Unit]
-Description=A daemon that scans program outputs for repeated patterns, and takes action.
+Description=reaction daemon
 Documentation=https://reaction.ppom.me
 # Ensure reaction will insert its chain after docker has inserted theirs. Only useful when iptables & docker are used
 # After=docker.service
 
 # See `man systemd.exec` and `man systemd.service` for most options below
 [Service]
-ExecStart=/usr/bin/reaction start -c /etc/%i
+ExecStart=/usr/bin/reaction start -c /etc/reaction/
 
 # Ask systemd to create /var/lib/reaction (/var/lib/ is implicit)
 StateDirectory=reaction
@@ -15,6 +15,10 @@ StateDirectory=reaction
 RuntimeDirectory=reaction
 # Start reaction in its state directory
 WorkingDirectory=/var/lib/reaction
+# Let reaction kill its child processes first
+KillMode=mixed
+# Put reaction in its own slice so that plugins can be grouped within.
+Slice=system-reaction.slice
 
 [Install]
 WantedBy=multi-user.target
diff --git a/packaging/system-reaction.slice b/packaging/system-reaction.slice
new file mode 100644
index 0000000..732f276
--- /dev/null
+++ b/packaging/system-reaction.slice
@@ -0,0 +1 @@
+[Slice]
diff --git a/plugins/reaction-plugin-cluster/Cargo.toml b/plugins/reaction-plugin-cluster/Cargo.toml
new file mode 100644
index 0000000..a187544
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "reaction-plugin-cluster"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+reaction-plugin.workspace = true
+
+chrono.workspace = true
+futures.workspace = true
+remoc.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+tokio.features = ["rt-multi-thread"]
+treedb.workspace = true
+
+data-encoding = "2.9.0"
+iroh = { version = "0.95.1", default-features = false }
+rand = "0.9.2"
+
+[dev-dependencies]
+assert_fs.workspace = true
diff --git a/plugins/reaction-plugin-cluster/src/cluster.rs b/plugins/reaction-plugin-cluster/src/cluster.rs
new file mode 100644
index 0000000..8729d62
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/cluster.rs
@@ -0,0 +1,165 @@
+use std::{
+    collections::BTreeMap,
+    net::{SocketAddrV4, SocketAddrV6},
+    sync::Arc,
+    time::Duration,
+};
+
+use futures::future::join_all;
+use iroh::{
+    Endpoint,
+    endpoint::{ConnectOptions, TransportConfig},
+};
+use reaction_plugin::{Line, shutdown::ShutdownController};
+use remoc::rch::mpsc as remocMpsc;
+use tokio::sync::mpsc as tokioMpsc;
+use treedb::{Database, time::Time};
+
+use crate::{ActionInit, StreamInit, connection::ConnectionManager, endpoint::EndpointManager};
+
+pub const ALPN: [&[u8]; 1] = ["reaction_cluster_1".as_bytes()];
+
+pub type UtcLine = (Arc<String>, Time);
+
+pub fn transport_config() -> TransportConfig {
+    // FIXME higher timeouts and keep alive
+    let mut transport = TransportConfig::default();
+    transport
+        .max_idle_timeout(Some(Duration::from_millis(2000).try_into().unwrap()))
+        .keep_alive_interval(Some(Duration::from_millis(200)));
+    transport
+}
+
+pub fn connect_config() -> ConnectOptions {
+    ConnectOptions::new().with_transport_config(transport_config().into())
+}
+
+pub async fn bind(stream: &StreamInit) -> Result<Endpoint, String> {
+    let mut builder = Endpoint::builder()
+        .secret_key(stream.secret_key.clone())
+        .alpns(ALPN.iter().map(|slice| slice.to_vec()).collect())
+        .relay_mode(iroh::RelayMode::Disabled)
+        .clear_discovery()
+        .transport_config(transport_config());
+
+    if let Some(ip) = stream.bind_ipv4 {
+        builder = builder.bind_addr_v4(SocketAddrV4::new(ip, stream.listen_port));
+    }
+    if let Some(ip) = stream.bind_ipv6 {
+        builder = builder.bind_addr_v6(SocketAddrV6::new(ip, stream.listen_port, 0, 0));
+    }
+
+    builder.bind().await.map_err(|err| {
+        format!(
+            "Could not create socket address for cluster {}: {err}",
+            stream.name
+        )
+    })
+}
+
+pub async fn cluster_tasks(
+    endpoint: Endpoint,
+    mut stream: StreamInit,
+    mut actions: Vec<ActionInit>,
+    db: &mut Database,
+    shutdown: ShutdownController,
+) -> Result<(), String> {
+    eprintln!("DEBUG cluster tasks starts running");
+
+    let (message_action2connection_txs, mut message_action2connection_rxs): (
+        Vec<tokioMpsc::Sender<UtcLine>>,
+        Vec<tokioMpsc::Receiver<UtcLine>>,
+    ) = (0..stream.nodes.len())
+        .map(|_| tokioMpsc::channel(1))
+        .unzip();
+
+    // Spawn action tasks
+    while let Some(mut action) = actions.pop() {
+        let message_action2connection_txs = message_action2connection_txs.clone();
+        let own_cluster_tx = stream.tx.clone();
+        tokio::spawn(async move {
+            action
+                .serve(message_action2connection_txs, own_cluster_tx)
+                .await
+        });
+    }
+
+    let endpoint = Arc::new(endpoint);
+
+    let mut connection_endpoint2connection_txs = BTreeMap::new();
+
+    // Spawn connection managers
+    while let Some((pk, endpoint_addr)) = stream.nodes.pop_first() {
+        let cluster_name = stream.name.clone();
+        let endpoint = endpoint.clone();
+        let message_action2connection_rx = message_action2connection_rxs.pop().unwrap();
+        let stream_tx = stream.tx.clone();
+        let shutdown = shutdown.clone();
+        let (connection_manager, connection_endpoint2connection_tx) = ConnectionManager::new(
+            cluster_name,
+            endpoint_addr,
+            endpoint,
+            stream.message_timeout,
+            message_action2connection_rx,
+            stream_tx,
+            db,
+            shutdown,
+        )
+        .await?;
+        tokio::spawn(async move { connection_manager.task().await });
+        connection_endpoint2connection_txs.insert(pk, connection_endpoint2connection_tx);
+    }
+
+    // Spawn connection accepter
+    EndpointManager::new(
+        endpoint.clone(),
+        stream.name.clone(),
+        connection_endpoint2connection_txs,
+        shutdown.clone(),
+    );
+
+    eprintln!("DEBUG cluster tasks finished running");
+    Ok(())
+}
+
+impl ActionInit {
+    // Receive messages from its reaction action and dispatch them to all connections and to the reaction stream
+    async fn serve(
+        &mut self,
+        nodes_tx: Vec<tokioMpsc::Sender<UtcLine>>,
+        own_stream_tx: remocMpsc::Sender<Line>,
+    ) {
+        while let Ok(Some(m)) = self.rx.recv().await {
+            eprintln!("DEBUG action: received a message to send to connections");
+            let line = self.send.line(m.match_);
+            if self.self_
+                && let Err(err) = own_stream_tx.send((line.clone(), m.time)).await
+            {
+                eprintln!("ERROR while queueing message to be sent to own cluster stream: {err}");
+            }
+
+            let line = (Arc::new(line), m.time.into());
+            for result in join_all(nodes_tx.iter().map(|tx| tx.send(line.clone()))).await {
+                if let Err(err) = result {
+                    eprintln!("ERROR while queueing message to be sent to cluster nodes: {err}");
+                };
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::{DateTime, Local};
+
+    // As long as nodes communicate with UTC datetimes, them having different local timezones is not an issue!
+    #[test]
+    fn different_local_tz_is_ok() {
+        let dates: Vec<DateTime<Local>> = serde_json::from_str(
+            "[\"2025-11-02T17:47:21.716229569+01:00\",\"2025-11-02T18:47:21.716229569+02:00\"]",
+        )
+        .unwrap();
+
+        assert_eq!(dates[0].to_utc(), dates[1].to_utc());
+    }
+}
diff --git a/plugins/reaction-plugin-cluster/src/connection.rs b/plugins/reaction-plugin-cluster/src/connection.rs
new file mode 100644
index 0000000..cdf584f
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/connection.rs
@@ -0,0 +1,668 @@
+use std::{cmp::max, io::Error as IoError, sync::Arc, time::Duration};
+
+use futures::FutureExt;
+use iroh::{
+    Endpoint, EndpointAddr,
+    endpoint::{Connection, RecvStream, SendStream, VarInt},
+};
+use rand::random_range;
+use reaction_plugin::{Line, shutdown::ShutdownController};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt, BufReader, BufWriter},
+    sync::mpsc,
+    time::sleep,
+};
+use treedb::{
+    Database, Tree,
+    helpers::{to_string, to_time},
+    time::{Time, now},
+};
+
+use crate::{
+    cluster::{ALPN, UtcLine, connect_config},
+    key::Show,
+};
+
+const PROTOCOL_VERSION: u32 = 1;
+
+const CLOSE_RECV: (u32, &[u8]) = (1, b"error receiving from your stream");
+const CLOSE_CLOSED: (u32, &[u8]) = (2, b"you closed your stream");
+const CLOSE_SEND: (u32, &[u8]) = (3, b"could not send a message to your channel so I quit");
+
+type MaybeRemoteLine = Result<Option<(String, Time)>, IoError>;
+
+enum Event {
+    LocalMessageReceived(Option<UtcLine>),
+    RemoteMessageReceived(MaybeRemoteLine),
+    ConnectionReceived(Option<ConnOrConn>),
+}
+
+pub struct OwnConnection {
+    connection: Connection,
+    id: u64,
+
+    line_tx: BufWriter<SendStream>,
+    line_rx: BufReader<RecvStream>,
+
+    next_time_secs: Option<u64>,
+    next_time_nanos: Option<u32>,
+    next_len: Option<usize>,
+    next_line: Option<Vec<u8>>,
+}
+
+impl OwnConnection {
+    fn new(
+        connection: Connection,
+        id: u64,
+        line_tx: BufWriter<SendStream>,
+        line_rx: BufReader<RecvStream>,
+    ) -> Self {
+        Self {
+            connection,
+            id,
+            line_tx,
+            line_rx,
+            next_time_secs: None,
+            next_time_nanos: None,
+            next_len: None,
+            next_line: None,
+        }
+    }
+
+    /// Send a line to peer.
+    ///
+    /// Time is a std::time::Duration since UNIX_EPOCH, which is defined as UTC
+    /// So it's safe to use between nodes using different timezones
+    async fn send_line(&mut self, line: &String, time: &Time) -> Result<(), std::io::Error> {
+        self.line_tx.write_u64(time.as_secs()).await?;
+        self.line_tx.write_u32(time.subsec_nanos()).await?;
+        self.line_tx.write_u32(line.len() as u32).await?;
+        self.line_tx.write_all(line.as_bytes()).await?;
+        self.line_tx.flush().await?;
+        Ok(())
+    }
+
+    /// Cancel-safe function that returns next line from peer
+    /// Returns None if we don't have all data yet.
+    async fn recv_line(&mut self) -> MaybeRemoteLine {
+        if self.next_time_secs.is_none() {
+            self.next_time_secs = Some(self.line_rx.read_u64().await?);
+        }
+        if self.next_time_nanos.is_none() {
+            self.next_time_nanos = Some(self.line_rx.read_u32().await?);
+        }
+        if self.next_len.is_none() {
+            self.next_len = Some(self.line_rx.read_u32().await? as usize);
+        }
+        // Ok we have next_len.is_some()
+        let next_len = self.next_len.clone().unwrap();
+
+        if self.next_line.is_none() {
+            self.next_line = Some(Vec::with_capacity(next_len));
+        }
+        // Ok we have next_line.is_some()
+        let next_line = self.next_line.as_mut().unwrap();
+
+        let actual_len = next_line.len();
+        // Resize to wanted length
+        next_line.resize(next_len, 0);
+
+        // Read bytes
+        let bytes_read = self
+            .line_rx
+            .read(&mut next_line[actual_len..next_len])
+            .await?;
+        // Truncate possibly unread bytes
+        next_line.truncate(actual_len + bytes_read);
+
+        // Let's test if we read all bytes
+        if next_line.len() == next_len {
+            // Ok we have a full line
+            self.next_len.take();
+            let line = String::try_from(self.next_line.take().unwrap()).map_err(|err| {
+                std::io::Error::new(std::io::ErrorKind::InvalidData, err.to_string())
+            })?;
+            let time = Time::new(
+                self.next_time_secs.take().unwrap(),
+                self.next_time_nanos.take().unwrap(),
+            );
+            Ok(Some((line, time)))
+        } else {
+            // Ok we don't have a full line, will be next time!
+            Ok(None)
+        }
+    }
+}
+
+pub enum ConnOrConn {
+    Connection(Connection),
+    OwnConnection(OwnConnection),
+}
+
+/// Handle a remote node.
+/// Manage reception and sending of messages to this node.
+/// Retry failed connections.
+pub struct ConnectionManager {
+    /// Cluster's name (for logging)
+    cluster_name: String,
+    /// The remote node we're communicating with (for logging)
+    node_id: String,
+    /// Remote
+    remote: EndpointAddr,
+    /// Endpoint
+    endpoint: Arc<Endpoint>,
+
+    /// Cancel asking for a connection
+    cancel_ask_connection: Option<mpsc::Sender<()>>,
+    /// Create a delegated task to send ourselves a connection
+    connection_tx: mpsc::Sender<ConnOrConn>,
+    /// The EndpointManager or our delegated task sending us a connection (whether we asked for it or not)
+    connection_rx: mpsc::Receiver<ConnOrConn>,
+    /// Our own connection (when we have one)
+    connection: Option<OwnConnection>,
+    /// Last connexion ID, used to have a determinist way to choose between conflicting connections
+    last_connection_id: u64,
+
+    /// Max duration before we drop pending messages to a node we can't connect to.
+    message_timeout: Duration,
+    /// Message we receive from actions
+    message_rx: mpsc::Receiver<UtcLine>,
+    /// Our queue of messages to send
+    message_queue: Tree<Time, Arc<String>>,
+
+    /// Messages we send from remote nodes to our own stream
+    own_cluster_tx: remoc::rch::mpsc::Sender<Line>,
+
+    /// shutdown
+    shutdown: ShutdownController,
+}
+
+impl ConnectionManager {
+    pub async fn new(
+        cluster_name: String,
+        remote: EndpointAddr,
+        endpoint: Arc<Endpoint>,
+        message_timeout: Duration,
+        message_rx: mpsc::Receiver<UtcLine>,
+        own_cluster_tx: remoc::rch::mpsc::Sender<Line>,
+        db: &mut Database,
+        shutdown: ShutdownController,
+    ) -> Result<(Self, mpsc::Sender<ConnOrConn>), String> {
+        let node_id = remote.id.show();
+
+        let message_queue = db
+            .open_tree(
+                format!("message_queue_{}_{}", endpoint.id().show(), node_id),
+                message_timeout,
+                |(key, value)| Ok((to_time(&key)?, Arc::new(to_string(&value)?))),
+            )
+            .await?;
+
+        let (connection_tx, connection_rx) = mpsc::channel(1);
+        Ok((
+            Self {
+                cluster_name,
+                node_id,
+                remote,
+                endpoint,
+                connection: None,
+                cancel_ask_connection: None,
+                connection_tx: connection_tx.clone(),
+                connection_rx,
+                last_connection_id: 0,
+                message_timeout,
+                message_rx,
+                message_queue,
+                own_cluster_tx,
+                shutdown,
+            },
+            connection_tx,
+        ))
+    }
+
+    /// Main loop
+    pub async fn task(mut self) {
+        self.ask_connection();
+        loop {
+            let have_connection = self.connection.is_some();
+            let maybe_conn_rx = self
+                .connection
+                .as_mut()
+                .map(|conn| conn.recv_line().boxed())
+                // This Future will never be polled because of the if in select!
+                // It still needs to be present because the branch will be evaluated
+                // so we can't unwrap
+                .unwrap_or(false_recv().boxed());
+
+            let event = tokio::select! {
+                biased;
+                // Quitting
+                _ = self.shutdown.wait() => None,
+                // Receive a connection from EndpointManager
+                conn = self.connection_rx.recv() => Some(Event::ConnectionReceived(conn)),
+                // Receive remote message when we have a connection
+                msg = maybe_conn_rx, if have_connection => Some(Event::RemoteMessageReceived(msg)),
+                // Receive a message from local Actions
+                msg = self.message_rx.recv() => Some(Event::LocalMessageReceived(msg)),
+            };
+
+            match event {
+                Some(event) => {
+                    self.handle_event(event).await;
+                    self.send_queue_messages().await;
+                    self.drop_timeout_messages().await;
+                }
+                None => break,
+            }
+        }
+    }
+
+    async fn handle_event(&mut self, event: Event) {
+        match event {
+            Event::ConnectionReceived(connection) => {
+                self.handle_connection(connection).await;
+            }
+            Event::LocalMessageReceived(utc_line) => {
+                self.handle_local_message(utc_line).await;
+            }
+            Event::RemoteMessageReceived(message) => {
+                self.handle_remote_message(message).await;
+            }
+        }
+    }
+
+    async fn send_queue_messages(&mut self) {
+        while let Some(connection) = &mut self.connection
+            && let Some((time, line)) = self
+                .message_queue
+                .first_key_value()
+                .map(|(k, v)| (k.clone(), v.clone()))
+        {
+            if let Err(err) = connection.send_line(&line, &time).await {
+                eprintln!(
+                    "INFO cluster {}: connection with node {} failed: {err}",
+                    self.cluster_name, self.node_id,
+                );
+                self.close_connection(CLOSE_SEND).await;
+            } else {
+                self.message_queue.remove(&time).await;
+                eprintln!(
+                    "DEBUG cluster {}: node {}: sent a local message to remote: {}",
+                    self.cluster_name, self.node_id, line
+                );
+            }
+        }
+    }
+
+    async fn drop_timeout_messages(&mut self) {
+        let now = now();
+        let mut count = 0;
+        loop {
+            // We have a next key and it reached timeout
+            if let Some(next_key) = self.message_queue.first_key_value().map(|kv| kv.0.clone())
+                && next_key + self.message_timeout < now
+            {
+                self.message_queue.remove(&next_key).await;
+                count += 1;
+            } else {
+                break;
+            }
+        }
+        if count > 0 {
+            eprintln!(
+                "DEBUG cluster {}: node {}: dropping {count} messages that reached timeout",
+                self.cluster_name, self.node_id,
+            )
+        }
+    }
+
+    /// Bootstrap a new Connection
+    /// Returns true if we have a valid connection now
+    async fn handle_connection(&mut self, connection: Option<ConnOrConn>) {
+        match connection {
+            None => {
+                eprintln!(
+                    "DEBUG cluster {}: ConnectionManager {}: quitting because EndpointManager has quit",
+                    self.cluster_name, self.node_id,
+                );
+                self.quit();
+            }
+            Some(connection) => {
+                if let Some(cancel) = self.cancel_ask_connection.take() {
+                    let _ = cancel.send(()).await;
+                }
+
+                let last_connection_id = self.last_connection_id;
+                let mut insert_connection = |own_connection: OwnConnection| {
+                    if self
+                        .connection
+                        .as_ref()
+                        .is_none_or(|old_own| old_own.id < own_connection.id)
+                    {
+                        self.last_connection_id = own_connection.id;
+                        self.connection = Some(own_connection);
+                    } else {
+                        eprintln!(
+                            "WARN cluster {}: node {}: ignoring incoming connection, as we already have a valid connection with it and our connection id is greater",
+                            self.cluster_name, self.node_id,
+                        );
+                    }
+                };
+
+                match connection {
+                    ConnOrConn::Connection(connection) => {
+                        match open_channels(
+                            connection,
+                            last_connection_id,
+                            &self.cluster_name,
+                            &self.node_id,
+                        )
+                        .await
+                        {
+                            Ok(own_connection) => insert_connection(own_connection),
+                            Err(err) => {
+                                eprintln!(
+                                    "ERROR cluster {}: trying to initialize connection to node {}: {err}",
+                                    self.cluster_name, self.node_id,
+                                );
+                                if self.connection.is_none() {
+                                    self.ask_connection();
+                                }
+                            }
+                        }
+                    }
+                    ConnOrConn::OwnConnection(own_connection) => insert_connection(own_connection),
+                }
+            }
+        }
+    }
+
+    async fn handle_remote_message(&mut self, message: MaybeRemoteLine) {
+        match message {
+            Err(err) => {
+                eprintln!(
+                    "WARN cluster {}: node {}: connection {}: error receiving remote message: {err}",
+                    self.cluster_name, self.node_id, self.last_connection_id
+                );
+                self.close_connection(CLOSE_RECV).await;
+            }
+            Ok(None) => {
+                eprintln!(
+                    "WARN cluster {}: node {} closed its stream",
+                    self.cluster_name, self.node_id,
+                );
+                self.close_connection(CLOSE_CLOSED).await;
+            }
+            Ok(Some(line)) => {
+                if let Err(err) = self
+                    .own_cluster_tx
+                    .send((line.0.clone(), line.1.into()))
+                    .await
+                {
+                    eprintln!(
+                        "ERROR cluster {}: could not send message to reaction stream: {err}",
+                        self.cluster_name
+                    );
+                    eprintln!(
+                        "INFO cluster {}: line that can't be sent: {}",
+                        self.cluster_name, line.0
+                    );
+                    self.quit();
+                } else {
+                    eprintln!(
+                        "DEBUG cluster {}: node {}: sent a remote message to local stream: {}",
+                        self.cluster_name, self.node_id, line.0
+                    );
+                }
+            }
+        }
+    }
+
+    async fn handle_local_message(&mut self, message: Option<UtcLine>) {
+        eprintln!(
+            "DEBUG cluster {}: node {}: received a local message",
+            self.cluster_name, self.node_id,
+        );
+        match message {
+            None => {
+                eprintln!(
+                    "INFO cluster {}: no action remaining, quitting",
+                    self.cluster_name
+                );
+                self.quit();
+            }
+            Some(message) => match &mut self.connection {
+                Some(connection) => {
+                    if let Err(err) = connection.send_line(&message.0, &message.1).await {
+                        eprintln!(
+                            "INFO cluster {}: connection with node {} failed: {err}",
+                            self.cluster_name, self.node_id,
+                        );
+                        self.message_queue.insert(message.1, message.0).await;
+                        self.close_connection(CLOSE_SEND).await;
+                    } else {
+                        eprintln!(
+                            "DEBUG cluster {}: node {}: sent a local message to remote: {}",
+                            self.cluster_name, self.node_id, message.0
+                        );
+                    }
+                }
+                None => {
+                    eprintln!(
+                        "DEBUG cluster {}: node {}: no connection, saving local message to send later: {}",
+                        self.cluster_name, self.node_id, message.0
+                    );
+                    self.message_queue.insert(message.1, message.0).await;
+                }
+            },
+        }
+    }
+
+    async fn close_connection(&mut self, code: (u32, &[u8])) {
+        if let Some(connection) = self.connection.take() {
+            connection
+                .connection
+                .close(VarInt::from_u32(code.0), code.1);
+        }
+        self.ask_connection();
+    }
+
+    fn ask_connection(&mut self) {
+        // if self.node_id.starts_with('H') {
+        let (tx, rx) = mpsc::channel(1);
+        self.cancel_ask_connection = Some(tx);
+        try_connect(
+            self.cluster_name.clone(),
+            self.remote.clone(),
+            self.endpoint.clone(),
+            self.last_connection_id,
+            self.connection_tx.clone(),
+            rx,
+        );
+    }
+
+    fn quit(&mut self) {
+        self.shutdown.ask_shutdown();
+    }
+}
+
+/// Open accept one stream and create one stream.
+/// This way, there is no need to know if we created or accepted the connection.
+async fn open_channels(
+    connection: Connection,
+    last_connexion_id: u64,
+    cluster_name: &str,
+    node_id: &str,
+) -> Result<OwnConnection, IoError> {
+    eprintln!(
+        "DEBUG cluster {}: node {}: opening uni channel",
+        cluster_name, node_id
+    );
+    let mut output = BufWriter::new(connection.open_uni().await?);
+
+    let our_id = random_range(last_connexion_id + 1..last_connexion_id + 1_000_000);
+
+    eprintln!(
+        "DEBUG cluster {}: node {}: sending handshake in uni channel",
+        cluster_name, node_id
+    );
+    output.write_u32(PROTOCOL_VERSION).await?;
+    output.write_u64(our_id).await?;
+    output.flush().await?;
+
+    eprintln!(
+        "DEBUG cluster {}: node {}: accepting uni channel",
+        cluster_name, node_id
+    );
+    let mut input = BufReader::new(connection.accept_uni().await?);
+
+    eprintln!(
+        "DEBUG cluster {}: node {}: reading handshake from uni channel",
+        cluster_name, node_id
+    );
+    let their_version = input.read_u32().await?;
+
+    if their_version != PROTOCOL_VERSION {
+        return Err(IoError::new(
+            std::io::ErrorKind::InvalidData,
+            format!(
+                "incompatible version: {their_version}. We use {PROTOCOL_VERSION}. Consider upgrading the node with the older version."
+            ),
+        ));
+    }
+
+    let their_id = input.read_u64().await?;
+    // FIXME Do we need to test this? If so, this function should return their_id even when error in order to retry better next time
+    // if their_id < last_connexion_id
+    // ERROR
+    // else
+    let chosen_id = max(our_id, their_id);
+    eprintln!(
+        "DEBUG cluster {}: node {}: version handshake complete: last id: {last_connexion_id}, our id: {our_id}, their id: {their_id}: chosen id: {chosen_id}",
+        cluster_name, node_id
+    );
+    Ok(OwnConnection::new(connection, chosen_id, output, input))
+}
+
+async fn false_recv() -> MaybeRemoteLine {
+    Ok(None)
+}
+
+const START_TIMEOUT: Duration = Duration::from_millis(500);
+const MAX_TIMEOUT: Duration = Duration::from_hours(1);
+const TIMEOUT_FACTOR: f64 = 1.5;
+
+fn with_random(d: Duration) -> Duration {
+    let max_delta = d.as_micros() as f32 * 0.2;
+    d + Duration::from_micros(rand::random_range(0.0..max_delta) as u64)
+}
+
+// Compute the next wait Duration.
+// We're multiplying the Duration by [`TIMEOUT_FACTOR`] and cap it to [`MAX_TIMEOUT`].
+fn next_delta(delta: Option<Duration>) -> Duration {
+    with_random(match delta {
+        None => START_TIMEOUT,
+        Some(delta) => {
+            // Multiply timeout by TIMEOUT_FACTOR
+            let delta = Duration::from_millis(((delta.as_millis() as f64) * TIMEOUT_FACTOR) as u64);
+            // Cap to MAX_TIMEOUT
+            if delta > MAX_TIMEOUT {
+                MAX_TIMEOUT
+            } else {
+                delta
+            }
+        }
+    })
+}
+
+#[cfg(test)]
+#[test]
+fn test_with_random() {
+    for d in [
+        123, 1234, 12345, 123456, 1234567, 12345678, 123456789, 1234567890,
+    ] {
+        let rd = with_random(Duration::from_micros(d)).as_micros();
+        assert!(rd as f32 >= d as f32, "{rd} < {d}");
+        assert!(rd as f32 <= (d + 1) as f32 * 1.2, "{rd} > {d} * 1.2");
+    }
+}
+
+fn try_connect(
+    cluster_name: String,
+    remote: EndpointAddr,
+    endpoint: Arc<Endpoint>,
+    last_connection_id: u64,
+    connection_tx: mpsc::Sender<ConnOrConn>,
+    mut order_stop: mpsc::Receiver<()>,
+) {
+    tokio::spawn(async move {
+        let node_id = remote.id.show();
+        // Until we have a connection or we're requested to stop
+        let mut keep_trying = true;
+        let mut delta = None;
+
+        while keep_trying {
+            delta = Some(next_delta(delta));
+
+            keep_trying = tokio::select! {
+                _ = sleep(delta.unwrap_or_default()) => true,
+                _ = order_stop.recv() => false,
+            };
+            if keep_trying {
+                eprintln!("DEBUG cluster {cluster_name}: node {node_id}: trying to connect...");
+                let connect = tokio::select! {
+                    // conn = endpoint.connect(remote.clone(), ALPN[0]) => Some(conn),
+                    conn = endpoint.connect_with_opts(remote.clone(), ALPN[0], connect_config()) => Some(conn),
+                    _ = order_stop.recv() => None,
+                };
+                if let Some(connect) = connect {
+                    let res = match connect {
+                        Ok(connecting) => match connecting.await {
+                            Ok(connection) => {
+                                eprintln!(
+                                    "DEBUG cluster {cluster_name}: node {node_id}: created connection"
+                                );
+                                match open_channels(
+                                    connection,
+                                    last_connection_id,
+                                    &cluster_name,
+                                    &node_id,
+                                )
+                                .await
+                                {
+                                    Ok(own_connection) => {
+                                        if let Err(err) = connection_tx
+                                            .send(ConnOrConn::OwnConnection(own_connection))
+                                            .await
+                                        {
+                                            eprintln!(
+                                                "DEBUG cluster {cluster_name}: node {node_id}: quitting because ConnectionManager has quit: {err}"
+                                            );
+                                        }
+                                        // successfully opened connection
+                                        keep_trying = false;
+                                        Ok(())
+                                    }
+                                    Err(err) => Err(err.to_string()),
+                                }
+                            }
+                            Err(err) => Err(err.to_string()),
+                        },
+                        Err(err) => Err(err.to_string()),
+                    };
+                    if let Err(err) = res {
+                        eprintln!(
+                            "WARN cluster {cluster_name}: node {node_id}: while trying to connect: {err}"
+                        );
+                    }
+                } else {
+                    // received stop order
+                    eprintln!(
+                        "DEBUG cluster {cluster_name}: node {node_id}: stop to try connecting to node be cause we received a connection from it"
+                    );
+                    keep_trying = false;
+                }
+            }
+        }
+    });
+}
diff --git a/plugins/reaction-plugin-cluster/src/endpoint.rs b/plugins/reaction-plugin-cluster/src/endpoint.rs
new file mode 100644
index 0000000..b90c6b3
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/endpoint.rs
@@ -0,0 +1,128 @@
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+use iroh::{Endpoint, PublicKey, endpoint::Incoming};
+use reaction_plugin::shutdown::ShutdownController;
+use tokio::sync::mpsc;
+
+use crate::{connection::ConnOrConn, key::Show};
+
+enum Break {
+    Yes,
+    No,
+}
+
+pub struct EndpointManager {
+    /// The [`iroh::Endpoint`] to manage
+    endpoint: Arc<Endpoint>,
+    /// Cluster's name (for logging)
+    cluster_name: String,
+    /// Connection sender to the Connection Managers
+    connections_tx: BTreeMap<PublicKey, mpsc::Sender<ConnOrConn>>,
+    /// shutdown
+    shutdown: ShutdownController,
+}
+
+impl EndpointManager {
+    pub fn new(
+        endpoint: Arc<Endpoint>,
+        cluster_name: String,
+        connections_tx: BTreeMap<PublicKey, mpsc::Sender<ConnOrConn>>,
+        shutdown: ShutdownController,
+    ) {
+        tokio::spawn(async move {
+            Self {
+                endpoint,
+                cluster_name,
+                connections_tx,
+                shutdown,
+            }
+            .task()
+            .await
+        });
+    }
+
+    async fn task(&mut self) {
+        loop {
+            // Uncomment this line and comment the select! for faster development in this function
+            // let event = Event::TryConnect(self.endpoint_addr_rx.recv().await);
+            let incoming = tokio::select! {
+                incoming = self.endpoint.accept() => incoming,
+                _ = self.shutdown.wait() => None,
+            };
+
+            match incoming {
+                Some(incoming) => {
+                    if let Break::Yes = self.handle_incoming(incoming).await {
+                        break;
+                    }
+                }
+                None => break,
+            }
+        }
+
+        self.endpoint.close().await
+    }
+
+    async fn handle_incoming(&mut self, incoming: Incoming) -> Break {
+        eprintln!(
+            "DEBUG cluster {}: EndpointManager: receiving connection",
+            self.cluster_name,
+        );
+        // FIXME a malicious actor could maybe prevent a node from connecting to
+        // its cluster by sending lots of invalid slow connection requests?
+        // This function could be moved to a new 'oneshot' task instead
+        let remote_address = incoming.remote_address();
+        let remote_address_validated = incoming.remote_address_validated();
+        let connection = match incoming.await {
+            Ok(connection) => connection,
+            Err(err) => {
+                if remote_address_validated {
+                    eprintln!("INFO refused connection from {}: {err}", remote_address)
+                } else {
+                    eprintln!("INFO refused connection: {err}")
+                }
+                return Break::No;
+            }
+        };
+
+        let remote_id = connection.remote_id();
+
+        match self.connections_tx.get(&remote_id) {
+            None => {
+                eprintln!(
+                    "WARN cluster {}: incoming connection from node '{}', ip: {} is not in our list, refusing incoming connection.",
+                    self.cluster_name,
+                    remote_id.show(),
+                    remote_address
+                );
+                eprintln!(
+                    "INFO cluster {}: {}, {}",
+                    self.cluster_name,
+                    "maybe it's not from our cluster,",
+                    "maybe this node's configuration has not yet been updated to add this new node."
+                );
+                return Break::No;
+            }
+            Some(tx) => {
+                if let Err(_) = tx.send(ConnOrConn::Connection(connection)).await {
+                    eprintln!(
+                        "DEBUG cluster {}: EndpointManager: quitting because ConnectionManager has quit",
+                        self.cluster_name,
+                    );
+                    self.shutdown.ask_shutdown();
+                    return Break::Yes;
+                }
+                eprintln!(
+                    "DEBUG cluster {}: EndpointManager: receiving connection from {}",
+                    self.cluster_name,
+                    remote_id.show(),
+                );
+            }
+        }
+
+        // TODO persist the incoming address, so that we don't forget this address
+
+        Break::No
+    }
+}
diff --git a/plugins/reaction-plugin-cluster/src/key.rs b/plugins/reaction-plugin-cluster/src/key.rs
new file mode 100644
index 0000000..41b8c11
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/key.rs
@@ -0,0 +1,188 @@
+use std::io;
+
+use data_encoding::DecodeError;
+use iroh::{PublicKey, SecretKey};
+use tokio::{
+    fs::{self, File},
+    io::AsyncWriteExt,
+};
+
+pub fn secret_key_path(dir: &str, cluster_name: &str) -> String {
+    format!("{dir}/secret_key_{cluster_name}.txt")
+}
+
+pub async fn secret_key(dir: &str, cluster_name: &str) -> Result<SecretKey, String> {
+    let path = secret_key_path(dir, cluster_name);
+    if let Some(key) = get_secret_key(&path).await? {
+        Ok(key)
+    } else {
+        let key = SecretKey::generate(&mut rand::rng());
+        set_secret_key(&path, &key).await?;
+        Ok(key)
+    }
+}
+
+async fn get_secret_key(path: &str) -> Result<Option<SecretKey>, String> {
+    let key = match fs::read_to_string(path).await {
+        Ok(key) => Ok(key),
+        Err(err) => match err.kind() {
+            io::ErrorKind::NotFound => return Ok(None),
+            _ => Err(format!("can't read secret key file: {err}")),
+        },
+    }?;
+    let bytes = match key_b64_to_bytes(&key) {
+        Ok(key) => Ok(key),
+        Err(err) => Err(format!(
+            "invalid secret key read from file: {err}. Please remove the `{path}` file from plugin directory.",
+        )),
+    }?;
+    Ok(Some(SecretKey::from_bytes(&bytes)))
+}
+
+async fn set_secret_key(path: &str, key: &SecretKey) -> Result<(), String> {
+    let secret_key = key.show();
+    File::options()
+        .mode(0o600)
+        .write(true)
+        .create(true)
+        .open(path)
+        .await
+        .map_err(|err| format!("can't open `{path}` in plugin directory: {err}"))?
+        .write_all(secret_key.as_bytes())
+        .await
+        .map_err(|err| format!("can't write to `{path}` in plugin directory: {err}"))
+}
+
+pub fn key_b64_to_bytes(key: &str) -> Result<[u8; 32], DecodeError> {
+    let vec = data_encoding::BASE64URL.decode(key.as_bytes())?;
+    if vec.len() != 32 {
+        return Err(DecodeError {
+            position: vec.len(),
+            kind: data_encoding::DecodeKind::Length,
+        });
+    }
+    let mut bytes = [0u8; 32];
+    for i in 0..32 {
+        bytes[i] = vec[i];
+    }
+    Ok(bytes)
+}
+
+pub fn key_bytes_to_b64(key: &[u8; 32]) -> String {
+    data_encoding::BASE64URL.encode(key)
+}
+
+/// Implemented by PublicKey & SecretKey to display keys as base64 instead of hexadecimal.
+/// Similar to Display/ToString
+pub trait Show {
+    fn show(&self) -> String;
+}
+
+impl Show for PublicKey {
+    fn show(&self) -> String {
+        key_bytes_to_b64(self.as_bytes())
+    }
+}
+
+impl Show for SecretKey {
+    fn show(&self) -> String {
+        key_bytes_to_b64(&self.to_bytes())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use assert_fs::{
+        TempDir,
+        prelude::{FileWriteStr, PathChild},
+    };
+    use iroh::{PublicKey, SecretKey};
+    use tokio::fs::read_to_string;
+
+    use crate::key::{
+        get_secret_key, key_b64_to_bytes, key_bytes_to_b64, secret_key_path, set_secret_key,
+    };
+
+    #[test]
+    fn secret_key_encode_decode() {
+        for (secret_key, public_key) in [
+            (
+                "g7U1LPq2cgGSyk6CH_v1QpoXowSFKVQ8IcFljd_ZKGw=",
+                "HhVh7ghqpXM9375HZ82OOeB504HBSS25wgug-1vUggY=",
+            ),
+            (
+                "5EgRjwIpqd60IXWCGg5dFTtxkI-0fS1PlhoIhUjh1eY=",
+                "LPSQ9pS7m_5vvNC-fhoBNeL2-eS2Fd6aO4ImSnXp3lc=",
+            ),
+        ] {
+            assert_eq!(
+                secret_key,
+                &key_bytes_to_b64(&key_b64_to_bytes(secret_key).unwrap())
+            );
+            assert_eq!(
+                public_key,
+                &key_bytes_to_b64(&key_b64_to_bytes(public_key).unwrap())
+            );
+
+            let secret_key_parsed = SecretKey::from_bytes(&key_b64_to_bytes(secret_key).unwrap());
+            let public_key_parsed =
+                PublicKey::from_bytes(&key_b64_to_bytes(public_key).unwrap()).unwrap();
+
+            assert_eq!(secret_key_parsed.public(), public_key_parsed);
+        }
+    }
+
+    #[tokio::test]
+    async fn secret_key_get() {
+        let tmp_dir = TempDir::new().unwrap();
+        let tmp_dir_str = tmp_dir.to_str().unwrap();
+        for (secret_key, cluster_name) in [
+            ("g7U1LPq2cgGSyk6CH_v1QpoXowSFKVQ8IcFljd_ZKGw=", "my_cluster"),
+            ("5EgRjwIpqd60IXWCGg5dFTtxkI-0fS1PlhoIhUjh1eY=", "name"),
+        ] {
+            tmp_dir
+                .child(&format!("secret_key_{cluster_name}.txt"))
+                .write_str(secret_key)
+                .unwrap();
+
+            let secret_key_parsed = SecretKey::from_bytes(&key_b64_to_bytes(secret_key).unwrap());
+
+            let path = secret_key_path(tmp_dir_str, cluster_name);
+            let secret_key_from_file = get_secret_key(&path).await.unwrap();
+
+            assert_eq!(
+                secret_key_parsed.to_bytes(),
+                secret_key_from_file.unwrap().to_bytes()
+            )
+        }
+
+        assert_eq!(
+            Ok(None),
+            get_secret_key(&format!("{tmp_dir_str}/non_existent"))
+                .await
+                // Can't compare secret keys so we map to bytes
+                // even if we don't want one
+                .map(|opt| opt.map(|pk| pk.to_bytes()))
+        );
+        // Will fail if we're root, but who runs this as root??
+        assert!(
+            get_secret_key(&format!("/root/non_existent"))
+                .await
+                .is_err()
+        );
+    }
+
+    #[tokio::test]
+    async fn secret_key_set() {
+        let tmp_dir = TempDir::new().unwrap();
+        let tmp_dir_str = tmp_dir.to_str().unwrap();
+
+        let path = format!("{tmp_dir_str}/secret");
+        let key = SecretKey::generate(&mut rand::rng());
+
+        assert!(set_secret_key(&path, &key).await.is_ok());
+        let read_file = read_to_string(&path).await;
+        assert!(read_file.is_ok());
+        assert_eq!(read_file.unwrap(), key_bytes_to_b64(&key.to_bytes()));
+    }
+}
diff --git a/plugins/reaction-plugin-cluster/src/main.rs b/plugins/reaction-plugin-cluster/src/main.rs
new file mode 100644
index 0000000..d0269e5
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/main.rs
@@ -0,0 +1,273 @@
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    net::{Ipv4Addr, Ipv6Addr, SocketAddr},
+    path::PathBuf,
+    time::Duration,
+};
+
+use iroh::{EndpointAddr, PublicKey, SecretKey, TransportAddr};
+use reaction_plugin::{
+    ActionConfig, ActionImpl, Exec, Hello, Line, Manifest, PluginInfo, RemoteResult, StreamConfig,
+    StreamImpl, line::PatternLine, main_loop, shutdown::ShutdownController, time::parse_duration,
+};
+use remoc::{rch::mpsc, rtc};
+use serde::{Deserialize, Serialize};
+use treedb::Database;
+
+use crate::key::Show;
+
+mod cluster;
+mod connection;
+mod endpoint;
+mod key;
+
+#[cfg(test)]
+mod tests;
+
+#[tokio::main]
+async fn main() {
+    let plugin = Plugin::default();
+    main_loop(plugin).await;
+}
+
+#[derive(Default)]
+struct Plugin {
+    init: BTreeMap<String, (StreamInit, Vec<ActionInit>)>,
+    cluster_shutdown: ShutdownController,
+}
+
+/// Stream options as defined by the user
+#[derive(Serialize, Deserialize)]
+struct StreamOptions {
+    /// The UDP port to open
+    listen_port: u16,
+    /// The IPv4 to bind to. Defaults to 0.0.0.0.
+    /// Set to `null` to use IPv6 only.
+    #[serde(default = "ipv4_unspecified")]
+    bind_ipv4: Option<Ipv4Addr>,
+    /// The IPv6 to bind to. Defaults to 0.0.0.0.
+    /// Set to `null` to use IPv4 only.
+    #[serde(default = "ipv6_unspecified")]
+    bind_ipv6: Option<Ipv6Addr>,
+    /// Other nodes which are part of the cluster.
+    nodes: Vec<NodeOption>,
+    /// Max duration before we drop pending messages to a node we can't connect to.
+    message_timeout: String,
+}
+
+fn ipv4_unspecified() -> Option<Ipv4Addr> {
+    Some(Ipv4Addr::UNSPECIFIED)
+}
+fn ipv6_unspecified() -> Option<Ipv6Addr> {
+    Some(Ipv6Addr::UNSPECIFIED)
+}
+
+#[derive(Serialize, Deserialize)]
+struct NodeOption {
+    public_key: String,
+    #[serde(default)]
+    addresses: Vec<SocketAddr>,
+}
+
+/// Stream information before start
+struct StreamInit {
+    name: String,
+    listen_port: u16,
+    bind_ipv4: Option<Ipv4Addr>,
+    bind_ipv6: Option<Ipv6Addr>,
+    secret_key: SecretKey,
+    message_timeout: Duration,
+    nodes: BTreeMap<PublicKey, EndpointAddr>,
+    tx: mpsc::Sender<Line>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct ActionOptions {
+    /// The line to send to the corresponding cluster, example: "ban \<ip\>"
+    send: String,
+    /// The name of the corresponding cluster, example: "my_cluster_stream"
+    to: String,
+    /// Whether the stream of this node also receives the line
+    #[serde(default, rename = "self")]
+    self_: bool,
+}
+
+struct ActionInit {
+    name: String,
+    send: PatternLine,
+    self_: bool,
+    rx: mpsc::Receiver<Exec>,
+}
+
+impl PluginInfo for Plugin {
+    async fn manifest(&mut self) -> Result<Manifest, rtc::CallError> {
+        Ok(Manifest {
+            hello: Hello::new(),
+            streams: BTreeSet::from(["cluster".into()]),
+            actions: BTreeSet::from(["cluster_send".into()]),
+        })
+    }
+    async fn load_config(
+        &mut self,
+        streams: Vec<StreamConfig>,
+        actions: Vec<ActionConfig>,
+    ) -> RemoteResult<(Vec<StreamImpl>, Vec<ActionImpl>)> {
+        let mut ret_streams = Vec::with_capacity(streams.len());
+        let mut ret_actions = Vec::with_capacity(actions.len());
+
+        for StreamConfig {
+            stream_name,
+            stream_type,
+            config,
+        } in streams
+        {
+            if &stream_type != "cluster" {
+                return Err("This plugin can't handle other stream types than cluster".into());
+            }
+
+            let options: StreamOptions = serde_json::from_value(config.into())
+                .map_err(|err| format!("invalid options: {err}"))?;
+
+            let mut nodes = BTreeMap::default();
+
+            let message_timeout = parse_duration(&options.message_timeout)
+                .map_err(|err| format!("invalid message_timeout: {err}"))?;
+
+            if options.bind_ipv4.is_none() && options.bind_ipv6.is_none() {
+                Err(
+                    "At least one of bind_ipv4 and bind_ipv6 must be enabled. Unset at least one of them or set at least one of them to an IP.",
+                )?;
+            }
+
+            if options.nodes.is_empty() {
+                Err("At least one remote node has to be configured for a cluster")?;
+            }
+
+            for node in options.nodes.into_iter() {
+                let bytes = key::key_b64_to_bytes(&node.public_key)
+                    .map_err(|err| format!("invalid public key {}: {err}", node.public_key))?;
+
+                let public_key = PublicKey::from_bytes(&bytes)
+                    .map_err(|err| format!("invalid public key {}: {err}", node.public_key))?;
+
+                nodes.insert(
+                    public_key,
+                    EndpointAddr {
+                        id: public_key,
+                        addrs: node
+                            .addresses
+                            .into_iter()
+                            .map(|addr| TransportAddr::Ip(addr))
+                            .collect(),
+                    },
+                );
+            }
+
+            let secret_key = key::secret_key(".", &stream_name).await?;
+            eprintln!(
+                "INFO public key of this node for cluster {stream_name}: {}",
+                secret_key.public().show()
+            );
+
+            let (tx, rx) = mpsc::channel(1);
+
+            let stream = StreamInit {
+                name: stream_name.clone(),
+                listen_port: options.listen_port,
+                bind_ipv4: options.bind_ipv4,
+                bind_ipv6: options.bind_ipv6,
+                secret_key,
+                message_timeout,
+                nodes,
+                tx,
+            };
+
+            if let Some(_) = self.init.insert(stream_name, (stream, vec![])) {
+                return Err("this virtual stream has already been initialized".into());
+            }
+
+            ret_streams.push(StreamImpl {
+                stream: rx,
+                standalone: true,
+            })
+        }
+
+        for ActionConfig {
+            stream_name,
+            filter_name,
+            action_name,
+            action_type,
+            config,
+            patterns,
+        } in actions
+        {
+            if &action_type != "cluster_send" {
+                return Err(
+                    "This plugin can't handle other action types than 'cluster_send'".into(),
+                );
+            }
+
+            let options: ActionOptions = serde_json::from_value(config.into())
+                .map_err(|err| format!("invalid options: {err}"))?;
+
+            let (tx, rx) = mpsc::channel(1);
+
+            let init_action = ActionInit {
+                name: format!("{}.{}.{}", stream_name, filter_name, action_name),
+                send: PatternLine::new(options.send, patterns),
+                self_: options.self_,
+                rx,
+            };
+
+            match self.init.get_mut(&options.to) {
+                Some((_, actions)) => actions.push(init_action),
+                None => {
+                    return Err(format!(
+                        "ERROR action '{}' sends 'to' unknown stream '{}'",
+                        init_action.name, options.to
+                    )
+                    .into());
+                }
+            }
+
+            ret_actions.push(ActionImpl { tx })
+        }
+
+        Ok((ret_streams, ret_actions))
+    }
+
+    async fn start(&mut self) -> RemoteResult<()> {
+        self.cluster_shutdown.delegate().handle_quit_signals()?;
+
+        let mut db = {
+            let path = PathBuf::from(".");
+            let (cancellation_token, task_tracker_token) = self.cluster_shutdown.token().split();
+            Database::open(&path, cancellation_token, task_tracker_token)
+                .await
+                .map_err(|err| format!("Can't open database: {err}"))?
+        };
+
+        while let Some((_, (stream, actions))) = self.init.pop_first() {
+            let endpoint = cluster::bind(&stream).await?;
+            cluster::cluster_tasks(
+                endpoint,
+                stream,
+                actions,
+                &mut db,
+                self.cluster_shutdown.clone(),
+            )
+            .await?;
+        }
+        // Free containers
+        self.init = Default::default();
+        eprintln!("DEBUG started");
+
+        Ok(())
+    }
+
+    async fn close(self) -> RemoteResult<()> {
+        self.cluster_shutdown.ask_shutdown();
+        self.cluster_shutdown.wait_all_task_shutdown().await;
+        Ok(())
+    }
+}
diff --git a/plugins/reaction-plugin-cluster/src/tests/conf.rs b/plugins/reaction-plugin-cluster/src/tests/conf.rs
new file mode 100644
index 0000000..2da4974
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/tests/conf.rs
@@ -0,0 +1,293 @@
+use std::env::set_current_dir;
+
+use assert_fs::TempDir;
+use reaction_plugin::{ActionConfig, PluginInfo, StreamConfig};
+use serde_json::json;
+
+use crate::{Plugin, tests::insert_secret_key};
+
+use super::{PUBLIC_KEY_A, TEST_MUTEX, stream_ok};
+
+#[tokio::test]
+async fn conf_stream() {
+    // Minimal node configuration
+    let nodes = json!([{
+        "public_key": PUBLIC_KEY_A,
+    }]);
+
+    // Invalid type
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "clust".into(),
+                    config: stream_ok().into(),
+                }],
+                vec![]
+            )
+            .await
+            .is_err()
+    );
+
+    for (json, is_ok) in [
+        (
+            json!({
+               "listen_port": 2048,
+               "nodes": nodes,
+               "message_timeout": "30m",
+            }),
+            Result::is_ok as fn(&_) -> bool,
+        ),
+        (
+            // invalid time
+            json!({
+               "listen_port": 2048,
+               "nodes": nodes,
+               "message_timeout": "30pv",
+            }),
+            Result::is_err,
+        ),
+        (
+            json!({
+               "listen_port": 2048,
+               "bind_ipv4": "0.0.0.0",
+               "nodes": nodes,
+               "message_timeout": "30m",
+            }),
+            Result::is_ok,
+        ),
+        (
+            json!({
+                   "listen_port": 2048,
+                   "bind_ipv6": "::",
+                   "nodes": nodes,
+                   "message_timeout": "30m",
+            }),
+            Result::is_ok,
+        ),
+        (
+            json!({
+                   "listen_port": 2048,
+                   "bind_ipv4": "0.0.0.0",
+                   "bind_ipv6": "::",
+                   "nodes": nodes,
+                   "message_timeout": "30m",
+            }),
+            Result::is_ok,
+        ),
+        (
+            json!({
+                   "listen_port": 2048,
+                   "bind_ipv4": null,
+                   "nodes": nodes,
+                   "message_timeout": "30m",
+            }),
+            Result::is_ok,
+        ),
+        (
+            json!({
+                   "listen_port": 2048,
+                   "bind_ipv6": null,
+                   "nodes": nodes,
+                   "message_timeout": "30m",
+            }),
+            Result::is_ok,
+        ),
+        (
+            // No bind
+            json!({
+                   "listen_port": 2048,
+                   "bind_ipv4": null,
+                   "bind_ipv6": null,
+                   "nodes": nodes,
+                   "message_timeout": "30m",
+            }),
+            Result::is_err,
+        ),
+        (json!({}), Result::is_err),
+    ] {
+        assert!(is_ok(
+            &Plugin::default()
+                .load_config(
+                    vec![StreamConfig {
+                        stream_name: "stream".into(),
+                        stream_type: "cluster".into(),
+                        config: json.into(),
+                    }],
+                    vec![]
+                )
+                .await
+        ));
+    }
+}
+
+#[tokio::test]
+async fn conf_action() {
+    let patterns = vec!["p1".into(), "p2".into()];
+
+    // Invalid type
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "cluster".into(),
+                    config: stream_ok().into(),
+                }],
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "cluster_sen".into(),
+                    config: json!({
+                        "send": "<p1>",
+                        "to": "stream",
+                    })
+                    .into(),
+                    patterns: patterns.clone(),
+                }]
+            )
+            .await
+            .is_err()
+    );
+
+    for (json, is_ok) in [
+        (
+            json!({
+                "send": "<p1>",
+                "to": "stream",
+            }),
+            true,
+        ),
+        (
+            json!({
+                "send": "<p1>",
+                "to": "stream",
+                "self": true,
+            }),
+            true,
+        ),
+        (
+            json!({
+                "send": "<p1>",
+                "to": "stream",
+                "self": false,
+            }),
+            true,
+        ),
+        (
+            // missing to
+            json!({
+                "send": "<p1>",
+            }),
+            false,
+        ),
+        (
+            // missing send
+            json!({
+                "to": "stream",
+            }),
+            false,
+        ),
+        (
+            // invalid self
+            json!({
+                "send": "<p1>",
+                "to": "stream",
+                "self": "true",
+            }),
+            false,
+        ),
+        (
+            // missing conf
+            json!({}),
+            false,
+        ),
+    ] {
+        let ret = Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "cluster".into(),
+                    config: stream_ok().into(),
+                }],
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "cluster_send".into(),
+                    config: json.clone().into(),
+                    patterns: patterns.clone(),
+                }],
+            )
+            .await;
+
+        assert!(
+            ret.is_ok() == is_ok,
+            "is_ok: {is_ok}, ret: {:?}, action conf: {json:?}",
+            ret.map(|_| ())
+        );
+    }
+}
+
+#[tokio::test]
+async fn conf_send() {
+    let _lock = TEST_MUTEX.lock();
+    let dir = TempDir::new().unwrap();
+    set_current_dir(&dir).unwrap();
+    insert_secret_key().await;
+
+    // No action is ok
+    let res = Plugin::default()
+        .load_config(
+            vec![StreamConfig {
+                stream_name: "stream".into(),
+                stream_type: "cluster".into(),
+                config: stream_ok().into(),
+            }],
+            vec![],
+        )
+        .await;
+    assert!(res.is_ok(), "{:?}", res.map(|_| ()));
+
+    // An action is ok
+    let res = Plugin::default()
+        .load_config(
+            vec![StreamConfig {
+                stream_name: "stream".into(),
+                stream_type: "cluster".into(),
+                config: stream_ok().into(),
+            }],
+            vec![ActionConfig {
+                stream_name: "stream".into(),
+                filter_name: "filter".into(),
+                action_name: "action".into(),
+                action_type: "cluster_send".into(),
+                config: json!({ "send": "message", "to": "stream" }).into(),
+                patterns: vec![],
+            }],
+        )
+        .await;
+    assert!(res.is_ok(), "{:?}", res.map(|_| ()));
+
+    // Invalid to: option
+    let res = Plugin::default()
+        .load_config(
+            vec![StreamConfig {
+                stream_name: "stream".into(),
+                stream_type: "cluster".into(),
+                config: stream_ok().into(),
+            }],
+            vec![ActionConfig {
+                stream_name: "stream".into(),
+                filter_name: "filter".into(),
+                action_name: "action".into(),
+                action_type: "cluster_send".into(),
+                config: json!({ "send": "message", "to": "stream1" }).into(),
+                patterns: vec![],
+            }],
+        )
+        .await;
+    assert!(res.is_err(), "{:?}", res.map(|_| ()));
+}
diff --git a/plugins/reaction-plugin-cluster/src/tests/e2e.rs b/plugins/reaction-plugin-cluster/src/tests/e2e.rs
new file mode 100644
index 0000000..fbf3a28
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/tests/e2e.rs
@@ -0,0 +1,319 @@
+use std::{env::set_current_dir, time::Duration};
+
+use assert_fs::TempDir;
+use reaction_plugin::{ActionConfig, Exec, PluginInfo, StreamConfig};
+use serde_json::json;
+use tokio::{fs, time::timeout};
+use treedb::time::now;
+
+use crate::{
+    Plugin,
+    key::secret_key_path,
+    tests::{PUBLIC_KEY_A, PUBLIC_KEY_B, SECRET_KEY_A, SECRET_KEY_B, TEST_MUTEX},
+};
+
+#[derive(Clone)]
+struct TestNode {
+    public_key: &'static str,
+    private_key: &'static str,
+    port: u16,
+}
+
+const POOL: [TestNode; 15] = [
+    TestNode {
+        public_key: PUBLIC_KEY_A,
+        private_key: SECRET_KEY_A,
+        port: 2055,
+    },
+    TestNode {
+        public_key: PUBLIC_KEY_B,
+        private_key: SECRET_KEY_B,
+        port: 2056,
+    },
+    TestNode {
+        public_key: "ZjEPlIdGikV_sPIAUzO3RFUidlERJUhJ9XwNAlieuvU=",
+        private_key: "SCbd8Ids3Dg9MwzyMNV1KFcUtsyRbeCp7GDmu-xXBSs=",
+        port: 2057,
+    },
+    TestNode {
+        public_key: "2FUpABLl9I6bU9a2XtWKMLDzwHfrVcNEG6K8Ix6sxWQ=",
+        private_key: "F0W8nIlVmuFVpelwYH4PDaBDM0COYOyXDmBEmnHyo5s=",
+        port: 2058,
+    },
+    TestNode {
+        public_key: "qR4JDI_yyPWUBrmBbQjqfFbGP14v9dEaQVPHPOjId1o=",
+        private_key: "S5pxTafNXPd_9TMT4_ERuPXlZ882UmggAHrf8Yntfqg=",
+        port: 2059,
+    },
+    TestNode {
+        public_key: "NjkPBwDO4IEOBjkcxufYtVXspJNQZ0qF6GamRq2TOB4=",
+        private_key: "zM_lXiFuwTkmPuuXqIghW_J0uwq0a53L_yhM57uy_R8=",
+        port: 2060,
+    },
+    TestNode {
+        public_key: "_mgTzrlE8b_zvka3LgfD5qH2h_d3S0hcDU1WzIL6C74=",
+        private_key: "6Obq7fxOXK-u-P3QB5FJvNnwXdKwP1FsVJ0555o7DXs=",
+        port: 2061,
+    },
+    TestNode {
+        public_key: "FLKxCSSjjzxH0ZWTpQ8xXcSIRutXUhIDhZimjamxO2s=",
+        private_key: "pBPcJ32bt4xGZIGZDLDtj0eedg7p5DENjAwA-wM-1vk=",
+        port: 2062,
+    },
+    TestNode {
+        public_key: "yYBWzhzXO4isdPW2SzI-Sv3mcy3dUl6Kl0oFN6YpuzE=",
+        private_key: "nC8F6prLAY9-86EZlfXwpOjQeghlPKf3PtT-zXsJZsA=",
+        port: 2063,
+    },
+    TestNode {
+        public_key: "QLbNxlLEUt0tieD9BX9of663gCm9WjKeqch0BIFJ3CE=",
+        private_key: "JL4bKNHJMaMX_ElnaDHc6Ql74HZbovcswNOrY6fN1sU=",
+        port: 2064,
+    },
+    TestNode {
+        public_key: "2cmAmcaEFW-9val6WMoHSfTW25IxiQHes7Jwy6NqLLc=",
+        private_key: "TCvfDLHLQ5RxfAs7_2Th2u1XF48ygxTLAAsUzVPBn_o=",
+        port: 2065,
+    },
+    TestNode {
+        public_key: "PfKYILyGmu0C6GFUOLw4MSLxN6gtkj0XUdvQW50A2xA=",
+        private_key: "LaQgDWsXpwSQlZZXd8UEllrgpeXw9biSye4zcjLclU0=",
+        port: 2066,
+    },
+    TestNode {
+        public_key: "OQMXwPl90gr-2y-f5qZIZuVG4WEae5cc8JOB39LTNYE=",
+        private_key: "blcigXzk0oeQ8J1jwYFiYHJ-pMiUqbUM4SJBlxA0MiI=",
+        port: 2067,
+    },
+    TestNode {
+        public_key: "DHpkBgnQUfpC7s4-mTfpn1_PN4dzj7hCCMF6GwO3Bus=",
+        private_key: "sw7-2gPOswznF2OJHJdbfyJxdjS-P5O0lie6SdOL_08=",
+        port: 2068,
+    },
+    TestNode {
+        public_key: "odjjaYd6lL1DG8N9AXHW9LGsrKIb5IlW0KZz-rgxfXA=",
+        private_key: "6JU6YHRBM_rJkuQmMaGaio_PZiyzZlTIU0qE8AHPGSE=",
+        port: 2069,
+    },
+];
+
+async fn stream_action(
+    name: &str,
+    index: usize,
+    nodes: &[TestNode],
+) -> (StreamConfig, ActionConfig) {
+    let stream_name = format!("stream_{name}");
+    let this_node = &nodes[index];
+    let other_nodes: Vec<_> = nodes
+        .iter()
+        .filter(|node| node.public_key != this_node.public_key)
+        .map(|node| {
+            json!({
+                "public_key": node.public_key,
+                "addresses": [format!("[::1]:{}", node.port)]
+            })
+        })
+        .collect();
+
+    fs::write(secret_key_path(".", &stream_name), this_node.private_key)
+        .await
+        .unwrap();
+
+    (
+        StreamConfig {
+            stream_name: stream_name.clone(),
+            stream_type: "cluster".into(),
+            config: json!({
+                "message_timeout": "30s",
+                "listen_port": this_node.port,
+                "nodes": other_nodes,
+            })
+            .into(),
+        },
+        ActionConfig {
+            stream_name: "stream".into(),
+            filter_name: "filter".into(),
+            action_name: "action".into(),
+            action_type: "cluster_send".into(),
+            config: json!({
+                "send": format!("from {name}: <test>"),
+                "to": stream_name,
+            })
+            .into(),
+            patterns: vec!["test".into()],
+        },
+    )
+}
+
+#[tokio::test]
+async fn two_nodes_simultaneous_startup() {
+    for separate_plugin in [true /*, false */] {
+        let _lock = TEST_MUTEX.lock();
+        let dir = TempDir::new().unwrap();
+        set_current_dir(&dir).unwrap();
+
+        let ((mut stream_a, action_a), (mut stream_b, action_b)) = if separate_plugin {
+            let mut plugin_a = Plugin::default();
+            let (sa, aa) = stream_action("a", 0, &POOL[0..2]).await;
+            let (mut streams_a, mut actions_a) =
+                plugin_a.load_config(vec![sa], vec![aa]).await.unwrap();
+            plugin_a.start().await.unwrap();
+
+            let mut plugin_b = Plugin::default();
+            let (sb, ab) = stream_action("b", 1, &POOL[0..2]).await;
+            let (mut streams_b, mut actions_b) =
+                plugin_b.load_config(vec![sb], vec![ab]).await.unwrap();
+            plugin_b.start().await.unwrap();
+            (
+                (streams_a.remove(0), actions_a.remove(0)),
+                (streams_b.remove(0), actions_b.remove(0)),
+            )
+        } else {
+            let mut plugin = Plugin::default();
+            let a = stream_action("a", 0, &POOL[0..2]).await;
+            let b = stream_action("b", 1, &POOL[0..2]).await;
+            let (mut streams, mut actions) = plugin
+                .load_config(vec![a.0, b.0], vec![a.1, b.1])
+                .await
+                .unwrap();
+            plugin.start().await.unwrap();
+            (
+                (streams.remove(0), actions.remove(0)),
+                (streams.remove(1), actions.remove(1)),
+            )
+        };
+
+        for m in ["test1", "test2", "test3"] {
+            let time = now().into();
+            for (stream, action, from) in [
+                (&mut stream_b, &action_a, "a"),
+                (&mut stream_a, &action_b, "b"),
+            ] {
+                assert!(
+                    action
+                        .tx
+                        .send(Exec {
+                            match_: vec![m.into()],
+                            time,
+                        })
+                        .await
+                        .is_ok(),
+                    "separate_plugin: {separate_plugin}, message: {m}, from: {from}"
+                );
+
+                let received = timeout(Duration::from_millis(5000), stream.stream.recv()).await;
+
+                assert!(
+                    received.is_ok(),
+                    "separate_plugin: {separate_plugin}, message: {m}, from: {from}, did timeout"
+                );
+                let received = received.unwrap();
+                assert!(
+                    received.is_ok(),
+                    "separate_plugin: {separate_plugin}, message: {m}, from: {from}, remoc receive error"
+                );
+                let received = received.unwrap();
+                assert_eq!(
+                    received,
+                    Some((format!("from {from}: {m}"), time)),
+                    "separate_plugin: {separate_plugin}, message: {m}, from: {from}"
+                );
+            }
+        }
+    }
+}
+
+#[tokio::test]
+async fn n_nodes_simultaneous_startup() {
+    let _lock = TEST_MUTEX.lock();
+
+    // Ports can take some time to be really closed
+    let mut port_delta = 0;
+
+    for n in 3..=POOL.len() {
+        println!("\nNODES: {n}\n");
+        port_delta += n;
+        // for n in 3..=3 {
+        let dir = TempDir::new().unwrap();
+        set_current_dir(&dir).unwrap();
+
+        let mut plugins = Vec::with_capacity(n);
+        let mut streams = Vec::with_capacity(n);
+        let mut actions = Vec::with_capacity(n);
+        for i in 0..n {
+            let mut plugin = Plugin::default();
+            let name = format!("n{i}");
+            let (stream, action) = stream_action(
+                &name,
+                i,
+                &POOL[0..n]
+                    .iter()
+                    .map(|node| node.clone())
+                    .map(|node| TestNode {
+                        port: node.port + port_delta as u16,
+                        ..node
+                    })
+                    .collect::<Vec<_>>()
+                    .as_slice(),
+            )
+            .await;
+            let (mut stream, mut action) = plugin
+                .load_config(vec![stream], vec![action])
+                .await
+                .unwrap();
+            plugin.start().await.unwrap();
+            plugins.push(plugin);
+            streams.push(stream.pop().unwrap());
+            actions.push((action.pop().unwrap(), name));
+        }
+
+        for m in ["test1", "test2", "test3", "test4", "test5"] {
+            let time = now().into();
+            for (i, (action, from)) in actions.iter().enumerate() {
+                assert!(
+                    action
+                        .tx
+                        .send(Exec {
+                            match_: vec![m.into()],
+                            time,
+                        })
+                        .await
+                        .is_ok(),
+                    "n nodes: {n}, n°action{i}, message: {m}, from: {from}"
+                );
+
+                for (j, stream) in streams.iter_mut().enumerate().filter(|(j, _)| *j != i) {
+                    let received = timeout(Duration::from_millis(5000), stream.stream.recv()).await;
+
+                    assert!(
+                        received.is_ok(),
+                        "n nodes: {n}, n°action: {i}, n°stream: {j}, message: {m}, from: {from}, did timeout"
+                    );
+                    let received = received.unwrap();
+                    assert!(
+                        received.is_ok(),
+                        "n nodes: {n}, n°action: {i}, n°stream: {j}, message: {m}, from: {from}, remoc receive error"
+                    );
+                    let received = received.unwrap();
+                    assert_eq!(
+                        received,
+                        Some((format!("from {from}: {m}"), time)),
+                        "n nodes: {n}, n°action: {i}, n°stream: {j}, message: {m}, from: {from}"
+                    );
+                    println!(
+                        "n nodes: {n}, n°action: {i}, n°stream: {j}, message: {m}, from: {from}"
+                    );
+                }
+            }
+        }
+
+        for plugin in plugins {
+            plugin.close().await.unwrap();
+        }
+    }
+}
+
+// TODO test:
+// with inexisting nodes
+// different startup times
+// stopping & restarting a node mid exchange
diff --git a/plugins/reaction-plugin-cluster/src/tests/mod.rs b/plugins/reaction-plugin-cluster/src/tests/mod.rs
new file mode 100644
index 0000000..daa6095
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/tests/mod.rs
@@ -0,0 +1,40 @@
+use std::sync::{LazyLock, Mutex};
+
+use serde_json::json;
+use tokio::fs::write;
+
+mod conf;
+mod e2e;
+mod self_;
+
+const SECRET_KEY_A: &str = "g7U1LPq2cgGSyk6CH_v1QpoXowSFKVQ8IcFljd_ZKGw=";
+const PUBLIC_KEY_A: &str = "HhVh7ghqpXM9375HZ82OOeB504HBSS25wgug-1vUggY=";
+
+const SECRET_KEY_B: &str = "5EgRjwIpqd60IXWCGg5dFTtxkI-0fS1PlhoIhUjh1eY=";
+const PUBLIC_KEY_B: &str = "LPSQ9pS7m_5vvNC-fhoBNeL2-eS2Fd6aO4ImSnXp3lc=";
+
+// Tests that spawn a database in current directory must be run one at a time
+static TEST_MUTEX: LazyLock<Mutex<()>> = LazyLock::new(|| Mutex::new(()));
+
+fn stream_ok_port(port: u16) -> serde_json::Value {
+    json!({
+       "listen_port": port,
+       "nodes": [{
+        "public_key": PUBLIC_KEY_A,
+       }],
+       "message_timeout": "30m",
+    })
+}
+
+fn stream_ok() -> serde_json::Value {
+    stream_ok_port(2048)
+}
+
+async fn insert_secret_key() {
+    write(
+        "./secret_key_stream.txt",
+        b"pBPcJ32bt4xGZIGZDLDtj0eedg7p5DENjAwA-wM-1vk=",
+    )
+    .await
+    .unwrap();
+}
diff --git a/plugins/reaction-plugin-cluster/src/tests/self_.rs b/plugins/reaction-plugin-cluster/src/tests/self_.rs
new file mode 100644
index 0000000..c06d55b
--- /dev/null
+++ b/plugins/reaction-plugin-cluster/src/tests/self_.rs
@@ -0,0 +1,78 @@
+use std::{env::set_current_dir, time::Duration};
+
+use assert_fs::TempDir;
+use reaction_plugin::{ActionConfig, Exec, PluginInfo, StreamConfig};
+use serde_json::json;
+use tokio::time::timeout;
+use treedb::time::now;
+
+use crate::{Plugin, tests::insert_secret_key};
+
+use super::{TEST_MUTEX, stream_ok_port};
+
+#[tokio::test]
+async fn run_with_self() {
+    let _lock = TEST_MUTEX.lock();
+    let dir = TempDir::new().unwrap();
+    set_current_dir(&dir).unwrap();
+    insert_secret_key().await;
+
+    for self_ in [true, false] {
+        let mut plugin = Plugin::default();
+        let (mut streams, mut actions) = plugin
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "cluster".into(),
+                    config: stream_ok_port(2052).into(),
+                }],
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "cluster_send".into(),
+                    config: json!({
+                        "send": "message <test>",
+                        "to": "stream",
+                        "self": self_,
+                    })
+                    .into(),
+                    patterns: vec!["test".into()],
+                }],
+            )
+            .await
+            .unwrap();
+
+        let mut stream = streams.pop().unwrap();
+        let action = actions.pop().unwrap();
+        assert!(stream.standalone);
+        assert!(plugin.start().await.is_ok());
+
+        for m in ["test1", "test2", "test3", "  a   a a aa a a"] {
+            let time = now().into();
+            assert!(
+                action
+                    .tx
+                    .send(Exec {
+                        match_: vec![m.into()],
+                        time,
+                    })
+                    .await
+                    .is_ok()
+            );
+            if self_ {
+                assert_eq!(
+                    stream.stream.recv().await.unwrap().unwrap(),
+                    (format!("message {m}"), time),
+                );
+            } else {
+                // Don't receive anything
+                assert!(
+                    timeout(Duration::from_millis(100), stream.stream.recv())
+                        .await
+                        .is_err()
+                );
+            }
+        }
+    }
+}
diff --git a/plugins/reaction-plugin-ipset/Cargo.toml b/plugins/reaction-plugin-ipset/Cargo.toml
new file mode 100644
index 0000000..b709176
--- /dev/null
+++ b/plugins/reaction-plugin-ipset/Cargo.toml
@@ -0,0 +1,26 @@
+[package]
+name = "reaction-plugin-ipset"
+description = "ipset plugin for reaction"
+version = "1.0.0"
+edition = "2024"
+authors = ["ppom <reaction@ppom.me>"]
+license = "AGPL-3.0"
+homepage = "https://reaction.ppom.me"
+repository = "https://framagit.org/ppom/reaction"
+keywords = ["security", "sysadmin", "fail2ban", "logs", "monitoring"]
+default-run = "reaction-plugin-ipset"
+
+[dependencies]
+tokio = { workspace = true, features = ["rt-multi-thread"] }
+remoc.workspace = true
+reaction-plugin.path = "../reaction-plugin"
+serde.workspace = true
+serde_json.workspace = true
+ipset = "0.9.0"
+
+[package.metadata.deb]
+section = "net"
+assets = [
+	[ "target/release/reaction-plugin-ipset", "/usr/bin/reaction-plugin-ipset", "755" ],
+]
+depends = ["libipset-dev", "reaction"]
diff --git a/plugins/reaction-plugin-ipset/src/action.rs b/plugins/reaction-plugin-ipset/src/action.rs
new file mode 100644
index 0000000..c820e28
--- /dev/null
+++ b/plugins/reaction-plugin-ipset/src/action.rs
@@ -0,0 +1,419 @@
+use std::{fmt::Debug, u32, usize};
+
+use reaction_plugin::{Exec, shutdown::ShutdownToken, time::parse_duration};
+use remoc::rch::mpsc as remocMpsc;
+use serde::{Deserialize, Serialize};
+
+use crate::ipset::{CreateSet, IpSet, Order, SetChain, Version};
+
+#[derive(Default, Serialize, Deserialize, PartialEq, Eq, Clone, Copy)]
+pub enum IpVersion {
+    #[default]
+    #[serde(rename = "ip")]
+    Ip,
+    #[serde(rename = "ipv4")]
+    Ipv4,
+    #[serde(rename = "ipv6")]
+    Ipv6,
+}
+impl Debug for IpVersion {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                IpVersion::Ipv4 => "ipv4",
+                IpVersion::Ipv6 => "ipv6",
+                IpVersion::Ip => "ip",
+            }
+        )
+    }
+}
+
+#[derive(Default, Serialize, Deserialize)]
+pub enum AddDel {
+    #[default]
+    #[serde(alias = "add")]
+    Add,
+    #[serde(alias = "del")]
+    Del,
+}
+
+/// User-facing action options
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ActionOptions {
+    /// The set that should be used by this action
+    pub set: String,
+    /// The pattern name of the IP.
+    /// Defaults to "ip"
+    #[serde(default = "serde_ip")]
+    pub pattern: String,
+    #[serde(skip)]
+    ip_index: usize,
+    // Whether the action is to "add" or "del" the ip from the set
+    #[serde(default)]
+    action: AddDel,
+
+    #[serde(flatten)]
+    pub set_options: SetOptions,
+}
+
+fn serde_ip() -> String {
+    "ip".into()
+}
+
+impl ActionOptions {
+    pub fn set_ip_index(&mut self, patterns: Vec<String>) -> Result<(), ()> {
+        self.ip_index = patterns
+            .into_iter()
+            .enumerate()
+            .filter(|(_, name)| name == &self.pattern)
+            .next()
+            .ok_or(())?
+            .0;
+        Ok(())
+    }
+}
+
+/// Merged set options
+#[derive(Default, Clone, Deserialize, Serialize, Debug, PartialEq, Eq)]
+pub struct SetOptions {
+    /// The IP type.
+    /// Defaults to `46`.
+    /// If `ipv4`: creates an IPv4 set with this name
+    /// If `ipv6`: creates an IPv6 set with this name
+    /// If `ip`: creates an IPv4 set with its name suffixed by 'v4' AND an IPv6 set with its name suffixed by 'v6'
+    /// *Merged set-wise*.
+    #[serde(default)]
+    version: Option<IpVersion>,
+    /// Chains where the IP set should be inserted.
+    /// Defaults to `["INPUT", "FORWARD"]`
+    /// *Merged set-wise*.
+    #[serde(default)]
+    chains: Option<Vec<String>>,
+    // Optional timeout, letting linux/netfilter handle set removal instead of reaction
+    // Note that `reaction show` and `reaction flush` won't work if set instead of an `after` action
+    // Same syntax as after and retryperiod in reaction.
+    /// *Merged set-wise*.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    timeout: Option<String>,
+    #[serde(skip)]
+    timeout_u32: Option<u32>,
+    // Target that iptables should use when the IP is encountered.
+    // Defaults to DROP, but can also be ACCEPT, RETURN or any user-defined chain
+    /// *Merged set-wise*.
+    #[serde(default)]
+    target: Option<String>,
+}
+
+impl SetOptions {
+    pub fn merge(&mut self, options: &SetOptions) -> Result<(), String> {
+        // merge two Option<T> and fail if there is conflict
+        fn inner_merge<T: Eq + Clone + std::fmt::Debug>(
+            a: &mut Option<T>,
+            b: &Option<T>,
+            name: &str,
+        ) -> Result<(), String> {
+            match (&a, &b) {
+                (Some(aa), Some(bb)) => {
+                    if aa != bb {
+                        return Err(format!(
+                            "Conflicting options for {name}: `{aa:?}` and `{bb:?}`"
+                        ));
+                    }
+                }
+                (None, Some(_)) => {
+                    *a = b.clone();
+                }
+                _ => (),
+            };
+            Ok(())
+        }
+
+        inner_merge(&mut self.version, &options.version, "version")?;
+        inner_merge(&mut self.timeout, &options.timeout, "timeout")?;
+        inner_merge(&mut self.chains, &options.chains, "chains")?;
+        inner_merge(&mut self.target, &options.target, "target")?;
+
+        if let Some(timeout) = &self.timeout {
+            let duration = parse_duration(timeout)
+                .map_err(|err| format!("failed to parse timeout: {}", err))?
+                .as_secs();
+            if duration > u32::MAX as u64 {
+                return Err(format!(
+                    "timeout is limited to {} seconds (approx {} days)",
+                    u32::MAX,
+                    49_000
+                ));
+            }
+            self.timeout_u32 = Some(duration as u32);
+        }
+
+        Ok(())
+    }
+}
+
+pub struct Set {
+    sets: SetNames,
+    chains: Vec<String>,
+    timeout: Option<u32>,
+    target: String,
+}
+
+impl Set {
+    pub fn from(name: String, options: SetOptions) -> Self {
+        Self {
+            sets: SetNames::new(name, options.version),
+            timeout: options.timeout_u32,
+            target: options.target.unwrap_or("DROP".into()),
+            chains: options
+                .chains
+                .unwrap_or(vec!["INPUT".into(), "FORWARD".into()]),
+        }
+    }
+
+    pub async fn init(&self, ipset: &mut IpSet) -> Result<(), (usize, String)> {
+        for (set, version) in [
+            (&self.sets.ipv4, Version::IPv4),
+            (&self.sets.ipv6, Version::IPv6),
+        ] {
+            if let Some(set) = set {
+                // create set
+                ipset
+                    .order(Order::CreateSet(CreateSet {
+                        name: set.clone(),
+                        version,
+                        timeout: self.timeout,
+                    }))
+                    .await
+                    .map_err(|err| (0, err.to_string()))?;
+                // insert set in chains
+                for (i, chain) in self.chains.iter().enumerate() {
+                    ipset
+                        .order(Order::InsertSet(SetChain {
+                            set: set.clone(),
+                            chain: chain.clone(),
+                            target: self.target.clone(),
+                        }))
+                        .await
+                        .map_err(|err| (i + 1, err.to_string()))?;
+                }
+            }
+        }
+        Ok(())
+    }
+
+    pub async fn destroy(&self, ipset: &mut IpSet, until: Option<usize>) {
+        for set in [&self.sets.ipv4, &self.sets.ipv6] {
+            if let Some(set) = set {
+                for chain in self
+                    .chains
+                    .iter()
+                    .take(until.map(|until| until - 1).unwrap_or(usize::MAX))
+                {
+                    let _ = ipset
+                        .order(Order::RemoveSet(SetChain {
+                            set: set.clone(),
+                            chain: chain.clone(),
+                            target: self.target.clone(),
+                        }))
+                        .await;
+                }
+                if until.is_none_or(|until| until != 0) {
+                    let _ = ipset.order(Order::DestroySet(set.clone())).await;
+                }
+            }
+        }
+    }
+}
+
+pub struct SetNames {
+    pub ipv4: Option<String>,
+    pub ipv6: Option<String>,
+}
+
+impl SetNames {
+    pub fn new(name: String, version: Option<IpVersion>) -> Self {
+        Self {
+            ipv4: match version {
+                Some(IpVersion::Ipv4) => Some(name.clone()),
+                Some(IpVersion::Ipv6) => None,
+                None | Some(IpVersion::Ip) => Some(format!("{}v4", name)),
+            },
+            ipv6: match version {
+                Some(IpVersion::Ipv4) => None,
+                Some(IpVersion::Ipv6) => Some(name),
+                None | Some(IpVersion::Ip) => Some(format!("{}v6", name)),
+            },
+        }
+    }
+}
+
+pub struct Action {
+    ipset: IpSet,
+    rx: remocMpsc::Receiver<Exec>,
+    shutdown: ShutdownToken,
+    sets: SetNames,
+    // index of pattern ip in match vec
+    ip_index: usize,
+    action: AddDel,
+}
+
+impl Action {
+    pub fn new(
+        ipset: IpSet,
+        shutdown: ShutdownToken,
+        rx: remocMpsc::Receiver<Exec>,
+        options: ActionOptions,
+    ) -> Result<Self, String> {
+        Ok(Action {
+            ipset,
+            rx,
+            shutdown,
+            sets: SetNames::new(options.set, options.set_options.version),
+            ip_index: options.ip_index,
+            action: options.action,
+        })
+    }
+
+    pub async fn serve(mut self) {
+        loop {
+            let event = tokio::select! {
+                exec = self.rx.recv() => Some(exec),
+                _ = self.shutdown.wait() => None,
+            };
+            match event {
+                // shutdown asked
+                None => break,
+                // channel closed
+                Some(Ok(None)) => break,
+                // error from channel
+                Some(Err(err)) => {
+                    eprintln!("ERROR {err}");
+                    break;
+                }
+                // ok
+                Some(Ok(Some(exec))) => {
+                    if let Err(err) = self.handle_exec(exec).await {
+                        eprintln!("ERROR {err}");
+                        break;
+                    }
+                }
+            }
+        }
+        // eprintln!("DEBUG Asking for shutdown");
+        // self.shutdown.ask_shutdown();
+    }
+
+    async fn handle_exec(&mut self, mut exec: Exec) -> Result<(), String> {
+        // safeguard against Vec::remove's panic
+        if exec.match_.len() <= self.ip_index {
+            return Err(format!(
+                "match received from reaction is smaller than expected. looking for index {} but size is {}. this is a bug!",
+                self.ip_index,
+                exec.match_.len()
+            ));
+        }
+        let ip = exec.match_.remove(self.ip_index);
+        // select set
+        let set = match (&self.sets.ipv4, &self.sets.ipv6) {
+            (None, None) => return Err(format!("action is neither IPv4 nor IPv6, this is a bug!")),
+            (None, Some(set)) => set,
+            (Some(set), None) => set,
+            (Some(set4), Some(set6)) => {
+                if ip.contains(':') {
+                    set6
+                } else {
+                    set4
+                }
+            }
+        };
+        // add/remove ip to set
+        self.ipset
+            .order(match self.action {
+                AddDel::Add => Order::Add(set.clone(), ip),
+                AddDel::Del => Order::Del(set.clone(), ip),
+            })
+            .await?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::action::{IpVersion, SetOptions};
+
+    #[tokio::test]
+    async fn set_options_merge() {
+        let s1 = SetOptions {
+            version: None,
+            chains: None,
+            timeout: None,
+            timeout_u32: None,
+            target: None,
+        };
+        let s2 = SetOptions {
+            version: Some(IpVersion::Ipv4),
+            chains: Some(vec!["INPUT".into()]),
+            timeout: Some("3h".into()),
+            timeout_u32: Some(3 * 3600),
+            target: Some("DROP".into()),
+        };
+        assert_ne!(s1, s2);
+        assert_eq!(s1, SetOptions::default());
+
+        {
+            // s2 can be merged in s1
+            let mut s1 = s1.clone();
+            assert!(s1.merge(&s2).is_ok());
+            assert_eq!(s1, s2);
+        }
+
+        {
+            // s1 can be merged in s2
+            let mut s2 = s2.clone();
+            assert!(s2.merge(&s1).is_ok());
+        }
+
+        {
+            // s1 can be merged in itself
+            let mut s3 = s1.clone();
+            assert!(s3.merge(&s1).is_ok());
+            assert_eq!(s1, s3);
+        }
+
+        {
+            // s2 can be merged in itself
+            let mut s3 = s2.clone();
+            assert!(s3.merge(&s2).is_ok());
+            assert_eq!(s2, s3);
+        }
+
+        for s3 in [
+            SetOptions {
+                version: Some(IpVersion::Ipv6),
+                ..Default::default()
+            },
+            SetOptions {
+                chains: Some(vec!["damn".into()]),
+                ..Default::default()
+            },
+            SetOptions {
+                timeout: Some("30min".into()),
+                ..Default::default()
+            },
+            SetOptions {
+                target: Some("log-refuse".into()),
+                ..Default::default()
+            },
+        ] {
+            // none with some is ok
+            assert!(s3.clone().merge(&s1).is_ok(), "s3: {s3:?}");
+            assert!(s1.clone().merge(&s3).is_ok(), "s3: {s3:?}");
+            // different some is ko
+            assert!(s3.clone().merge(&s2).is_err(), "s3: {s3:?}");
+            assert!(s2.clone().merge(&s3).is_err(), "s3: {s3:?}");
+        }
+    }
+}
diff --git a/plugins/reaction-plugin-ipset/src/ipset.rs b/plugins/reaction-plugin-ipset/src/ipset.rs
new file mode 100644
index 0000000..81b1061
--- /dev/null
+++ b/plugins/reaction-plugin-ipset/src/ipset.rs
@@ -0,0 +1,248 @@
+use std::{collections::BTreeMap, fmt::Display, net::Ipv4Addr, process::Command, thread};
+
+use ipset::{
+    Session,
+    types::{HashNet, NetDataType, Parse},
+};
+use tokio::sync::{mpsc, oneshot};
+
+#[derive(PartialEq, Eq, PartialOrd, Ord, Copy, Clone)]
+pub enum Version {
+    IPv4,
+    IPv6,
+}
+impl Display for Version {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            Version::IPv4 => "IPv4",
+            Version::IPv6 => "IPv6",
+        })
+    }
+}
+
+#[derive(PartialEq, Eq, PartialOrd, Ord, Clone)]
+pub struct CreateSet {
+    pub name: String,
+    pub version: Version,
+    pub timeout: Option<u32>,
+}
+
+#[derive(PartialEq, Eq, PartialOrd, Ord, Clone)]
+pub struct SetChain {
+    pub set: String,
+    pub chain: String,
+    pub target: String,
+}
+
+#[derive(PartialEq, Eq, PartialOrd, Ord, Clone)]
+pub enum Order {
+    CreateSet(CreateSet),
+    DestroySet(String),
+    InsertSet(SetChain),
+    RemoveSet(SetChain),
+    Add(String, String),
+    Del(String, String),
+}
+
+#[derive(Clone)]
+pub struct IpSet {
+    tx: mpsc::Sender<OrderType>,
+}
+
+impl Default for IpSet {
+    fn default() -> Self {
+        let (tx, rx) = mpsc::channel(1);
+        thread::spawn(move || IPsetManager::default().serve(rx));
+        Self { tx }
+    }
+}
+
+impl IpSet {
+    pub async fn order(&mut self, order: Order) -> Result<(), IpSetError> {
+        let (tx, rx) = oneshot::channel();
+        self.tx
+            .send((order, tx))
+            .await
+            .map_err(|err| IpSetError::Thread(format!("ipset thread has quit: {err}")))?;
+        rx.await
+            .map_err(|err| IpSetError::Thread(format!("ipset thread didn't respond: {err}")))?
+            .map_err(IpSetError::IpSet)
+    }
+}
+
+pub enum IpSetError {
+    Thread(String),
+    IpSet(()),
+}
+impl Display for IpSetError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                IpSetError::Thread(err) => err,
+                IpSetError::IpSet(()) => "ipset error",
+            }
+        )
+    }
+}
+impl From<IpSetError> for String {
+    fn from(value: IpSetError) -> Self {
+        match value {
+            IpSetError::Thread(err) => err,
+            IpSetError::IpSet(()) => "ipset error".to_string(),
+        }
+    }
+}
+
+pub type OrderType = (Order, oneshot::Sender<Result<(), ()>>);
+
+struct Set {
+    session: Session<HashNet>,
+    version: Version,
+}
+
+#[derive(Default)]
+struct IPsetManager {
+    // IPset sessions
+    sessions: BTreeMap<String, Set>,
+}
+
+impl IPsetManager {
+    fn serve(mut self, mut rx: mpsc::Receiver<OrderType>) {
+        loop {
+            match rx.blocking_recv() {
+                None => break,
+                Some((order, response)) => {
+                    let result = self.handle_order(order);
+                    let _ = response.send(result);
+                }
+            }
+        }
+    }
+
+    fn handle_order(&mut self, order: Order) -> Result<(), ()> {
+        match order {
+            Order::CreateSet(CreateSet {
+                name,
+                version,
+                timeout,
+            }) => {
+                eprintln!("INFO creating  {version} set {name}");
+                let mut session: Session<HashNet> = Session::new(name.clone());
+                session
+                    .create(|builder| {
+                        let builder = if let Some(timeout) = timeout {
+                            builder.with_timeout(timeout)?
+                        } else {
+                            builder
+                        };
+                        builder.with_ipv6(version == Version::IPv6)?.build()
+                    })
+                    .map_err(|err| eprintln!("ERROR Could not create set {name}: {err}"))?;
+
+                self.sessions.insert(name, Set { session, version });
+            }
+            Order::DestroySet(set) => {
+                if let Some(mut session) = self.sessions.remove(&set) {
+                    eprintln!("INFO destroying {} set {set}", session.version);
+                    session
+                        .session
+                        .destroy()
+                        .map_err(|err| eprintln!("ERROR Could not destroy set {set}: {err}"))?;
+                }
+            }
+
+            Order::InsertSet(options) => self.insert_remove_set(options, true)?,
+            Order::RemoveSet(options) => self.insert_remove_set(options, false)?,
+
+            Order::Add(set, ip) => self.insert_remove_ip(set, ip, true)?,
+            Order::Del(set, ip) => self.insert_remove_ip(set, ip, false)?,
+        };
+        Ok(())
+    }
+
+    fn insert_remove_ip(&mut self, set: String, ip: String, insert: bool) -> Result<(), ()> {
+        self._insert_remove_ip(set, ip, insert)
+            .map_err(|err| eprintln!("ERROR {err}"))
+    }
+    fn _insert_remove_ip(&mut self, set: String, ip: String, insert: bool) -> Result<(), String> {
+        let session = self.sessions.get_mut(&set).ok_or(format!(
+            "No set handled by this plugin with this name: {set}. This likely is a bug."
+        ))?;
+
+        let mut net_data = NetDataType::new(Ipv4Addr::LOCALHOST, 0);
+        net_data
+            .parse(&ip)
+            .map_err(|err| format!("`{ip}` is not recognized as an IP: {err}"))?;
+
+        if insert {
+            session.session.add(net_data, &[])
+        } else {
+            session.session.del(net_data)
+        }
+        .map_err(|err| format!("Could not add `{ip}` to set {set}: {err}"))?;
+
+        Ok(())
+    }
+
+    fn insert_remove_set(&self, options: SetChain, insert: bool) -> Result<(), ()> {
+        self._insert_remove_set(options, insert)
+            .map_err(|err| eprintln!("ERROR {err}"))
+    }
+    fn _insert_remove_set(&self, options: SetChain, insert: bool) -> Result<(), String> {
+        let SetChain { set, chain, target } = options;
+
+        let version = self
+            .sessions
+            .get(&set)
+            .ok_or(format!(
+                "No set managed by this plugin with this name: {set}"
+            ))?
+            .version;
+
+        let (verb, verbing, from) = if insert {
+            ("insert", "inserting", "in")
+        } else {
+            ("remove", "removing", "from")
+        };
+
+        eprintln!("INFO {verbing} {version} set {set} {from} chain {chain}");
+
+        let command = match version {
+            Version::IPv4 => "iptables",
+            Version::IPv6 => "ip6tables",
+        };
+
+        let mut child = Command::new(command)
+            .args([
+                "-w",
+                if insert { "-I" } else { "-D" },
+                &chain,
+                "-m",
+                "set",
+                "--match-set",
+                &set,
+                "src",
+                "-j",
+                &target,
+            ])
+            .spawn()
+            .map_err(|err| format!("Could not {verb} ipset {set} {from} chain {chain}: Could not execute {command}: {err}"))?;
+
+        let exit = child
+            .wait()
+            .map_err(|err| format!("Could not {verb} ipset {set} {from} chain {chain}: {err}"))?;
+
+        if exit.success() {
+            Ok(())
+        } else {
+            Err(format!(
+                "Could not {verb} ipset: exit code {}",
+                exit.code()
+                    .map(|c| c.to_string())
+                    .unwrap_or_else(|| "<unknown>".to_string())
+            ))
+        }
+    }
+}
diff --git a/plugins/reaction-plugin-ipset/src/main.rs b/plugins/reaction-plugin-ipset/src/main.rs
new file mode 100644
index 0000000..828c3a8
--- /dev/null
+++ b/plugins/reaction-plugin-ipset/src/main.rs
@@ -0,0 +1,159 @@
+use std::collections::{BTreeMap, BTreeSet};
+
+use reaction_plugin::{
+    ActionConfig, ActionImpl, Hello, Manifest, PluginInfo, RemoteError, RemoteResult, StreamConfig,
+    StreamImpl,
+    shutdown::{ShutdownController, ShutdownToken},
+};
+use remoc::rtc;
+
+use crate::{
+    action::{Action, ActionOptions, Set, SetOptions},
+    ipset::IpSet,
+};
+
+#[cfg(test)]
+mod tests;
+
+mod action;
+mod ipset;
+
+#[tokio::main]
+async fn main() {
+    let plugin = Plugin::default();
+    reaction_plugin::main_loop(plugin).await;
+}
+
+#[derive(Default)]
+struct Plugin {
+    ipset: IpSet,
+    sets: Vec<Set>,
+    actions: Vec<Action>,
+    shutdown: ShutdownController,
+}
+
+impl PluginInfo for Plugin {
+    async fn manifest(&mut self) -> Result<Manifest, rtc::CallError> {
+        Ok(Manifest {
+            hello: Hello::new(),
+            streams: BTreeSet::default(),
+            actions: BTreeSet::from(["ipset".into()]),
+        })
+    }
+
+    async fn load_config(
+        &mut self,
+        streams: Vec<StreamConfig>,
+        actions: Vec<ActionConfig>,
+    ) -> RemoteResult<(Vec<StreamImpl>, Vec<ActionImpl>)> {
+        if !streams.is_empty() {
+            return Err("This plugin can't handle any stream type".into());
+        }
+
+        let mut ret_actions = Vec::with_capacity(actions.len());
+        let mut set_options: BTreeMap<String, SetOptions> = BTreeMap::new();
+
+        for ActionConfig {
+            stream_name,
+            filter_name,
+            action_name,
+            action_type,
+            config,
+            patterns,
+        } in actions
+        {
+            if &action_type != "ipset" {
+                return Err("This plugin can't handle other action types than ipset".into());
+            }
+
+            let mut options: ActionOptions = serde_json::from_value(config.into()).map_err(|err| {
+            format!("invalid options for action {stream_name}.{filter_name}.{action_name}: {err}")
+        })?;
+
+            options.set_ip_index(patterns).map_err(|_|
+                format!(
+                    "No pattern with name {} in filter {stream_name}.{filter_name}. Try setting the option `pattern` to your pattern name of type 'ip'",
+                    &options.pattern
+                )
+        )?;
+
+            // Merge option
+            set_options
+                .entry(options.set.clone())
+                .or_default()
+                .merge(&options.set_options)
+                .map_err(|err| format!("ipset {}: {err}", options.set))?;
+
+            let (tx, rx) = remoc::rch::mpsc::channel(1);
+            self.actions.push(Action::new(
+                self.ipset.clone(),
+                self.shutdown.token(),
+                rx,
+                options,
+            )?);
+
+            ret_actions.push(ActionImpl { tx });
+        }
+
+        // Init all sets
+        while let Some((name, options)) = set_options.pop_first() {
+            self.sets.push(Set::from(name, options));
+        }
+
+        Ok((vec![], ret_actions))
+    }
+
+    async fn start(&mut self) -> RemoteResult<()> {
+        self.shutdown.delegate().handle_quit_signals()?;
+
+        let mut first_error = None;
+        for (i, set) in self.sets.iter().enumerate() {
+            // Retain if error
+            if let Err((failed_step, err)) = set.init(&mut self.ipset).await {
+                first_error = Some((i, failed_step, RemoteError::Plugin(err)));
+                break;
+            }
+        }
+        // Destroy initialized sets if error
+        if let Some((last_set, failed_step, err)) = first_error {
+            eprintln!("DEBUG last_set: {last_set} failed_step: {failed_step} err: {err}");
+            for (curr_set, set) in self.sets.iter().enumerate().take(last_set + 1) {
+                let until = if last_set == curr_set {
+                    Some(failed_step)
+                } else {
+                    None
+                };
+                let _ = set.destroy(&mut self.ipset, until).await;
+            }
+            return Err(err);
+        }
+
+        // Launch a task that will destroy the sets on shutdown
+        tokio::spawn(destroy_sets_at_shutdown(
+            self.ipset.clone(),
+            std::mem::take(&mut self.sets),
+            self.shutdown.token(),
+        ));
+
+        // Launch all actions
+        while let Some(action) = self.actions.pop() {
+            tokio::spawn(async move { action.serve().await });
+        }
+        self.actions = Default::default();
+
+        Ok(())
+    }
+
+    async fn close(self) -> RemoteResult<()> {
+        self.shutdown.ask_shutdown();
+        self.shutdown.wait_all_task_shutdown().await;
+        Ok(())
+    }
+}
+
+async fn destroy_sets_at_shutdown(mut ipset: IpSet, sets: Vec<Set>, shutdown: ShutdownToken) {
+    shutdown.wait().await;
+    for set in sets {
+        set.destroy(&mut ipset, None).await;
+    }
+}
diff --git a/plugins/reaction-plugin-ipset/src/tests.rs b/plugins/reaction-plugin-ipset/src/tests.rs
new file mode 100644
index 0000000..09ce6cf
--- /dev/null
+++ b/plugins/reaction-plugin-ipset/src/tests.rs
@@ -0,0 +1,253 @@
+use reaction_plugin::{ActionConfig, PluginInfo, StreamConfig, Value};
+use serde_json::json;
+
+use crate::Plugin;
+
+#[tokio::test]
+async fn conf_stream() {
+    // No stream is supported by ipset
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "ipset".into(),
+                    config: Value::Null
+                }],
+                vec![]
+            )
+            .await
+            .is_err()
+    );
+
+    // Nothing is ok
+    assert!(Plugin::default().load_config(vec![], vec![]).await.is_ok());
+}
+
+#[tokio::test]
+async fn conf_action_standalone() {
+    let p = vec!["name".into(), "ip".into(), "ip2".into()];
+    let p_noip = vec!["name".into(), "ip2".into()];
+
+    for (is_ok, conf, patterns) in [
+        // minimal set
+        (true, json!({ "set": "test" }), &p),
+        // missing set key
+        (false, json!({}), &p),
+        (false, json!({ "version": "ipv4" }), &p),
+        // unknown key
+        (false, json!({ "set": "test", "unknown": "yes" }), &p),
+        (false, json!({ "set": "test", "ip_index": 1 }), &p),
+        (false, json!({ "set": "test", "timeout_u32": 1 }), &p),
+        // pattern //
+        (true, json!({ "set": "test" }), &p),
+        (true, json!({ "set": "test", "pattern": "ip" }), &p),
+        (true, json!({ "set": "test", "pattern": "ip2" }), &p),
+        (true, json!({ "set": "test", "pattern": "ip2" }), &p_noip),
+        // unknown pattern "ip"
+        (false, json!({ "set": "test" }), &p_noip),
+        (false, json!({ "set": "test", "pattern": "ip" }), &p_noip),
+        // unknown pattern
+        (false, json!({ "set": "test", "pattern": "unknown" }), &p),
+        (false, json!({ "set": "test", "pattern": "uwu" }), &p_noip),
+        // bad type
+        (false, json!({ "set": "test", "pattern": 0 }), &p_noip),
+        (false, json!({ "set": "test", "pattern": true }), &p_noip),
+        // action //
+        (true, json!({ "set": "test", "action": "add" }), &p),
+        (true, json!({ "set": "test", "action": "del" }), &p),
+        // unknown action
+        (false, json!({ "set": "test", "action": "create" }), &p),
+        (false, json!({ "set": "test", "action": "insert" }), &p),
+        (false, json!({ "set": "test", "action": "delete" }), &p),
+        (false, json!({ "set": "test", "action": "destroy" }), &p),
+        // bad type
+        (false, json!({ "set": "test", "action": true }), &p),
+        (false, json!({ "set": "test", "action": 1 }), &p),
+        // ip version //
+        // ok
+        (true, json!({ "set": "test", "version": "ipv4" }), &p),
+        (true, json!({ "set": "test", "version": "ipv6" }), &p),
+        (true, json!({ "set": "test", "version": "ip" }), &p),
+        // unknown version
+        (false, json!({ "set": "test", "version": 4 }), &p),
+        (false, json!({ "set": "test", "version": 6 }), &p),
+        (false, json!({ "set": "test", "version": 46 }), &p),
+        (false, json!({ "set": "test", "version": "5" }), &p),
+        (false, json!({ "set": "test", "version": "ipv5" }), &p),
+        (false, json!({ "set": "test", "version": "4" }), &p),
+        (false, json!({ "set": "test", "version": "6" }), &p),
+        (false, json!({ "set": "test", "version": "46" }), &p),
+        // bad type
+        (false, json!({ "set": "test", "version": true }), &p),
+        // chains //
+        // everything is fine really
+        (true, json!({ "set": "test", "chains": [] }), &p),
+        (true, json!({ "set": "test", "chains": ["INPUT"] }), &p),
+        (true, json!({ "set": "test", "chains": ["FORWARD"] }), &p),
+        (
+            true,
+            json!({ "set": "test", "chains": ["custom_chain"] }),
+            &p,
+        ),
+        (
+            true,
+            json!({ "set": "test", "chains": ["INPUT", "FORWARD"] }),
+            &p,
+        ),
+        (
+            true,
+            json!({
+                "set": "test",
+                "chains": ["INPUT", "FORWARD", "my_iptables_chain"]
+            }),
+            &p,
+        ),
+        // timeout //
+        (true, json!({ "set": "test", "timeout": "1m" }), &p),
+        (true, json!({ "set": "test", "timeout": "3 days" }), &p),
+        // bad
+        (false, json!({ "set": "test", "timeout": "3 dayz"}), &p),
+        (false, json!({ "set": "test", "timeout": 12 }), &p),
+        // target //
+        // anything is fine too
+        (true, json!({ "set": "test", "target": "DROP" }), &p),
+        (true, json!({ "set": "test", "target": "ACCEPT" }), &p),
+        (true, json!({ "set": "test", "target": "RETURN" }), &p),
+        (true, json!({ "set": "test", "target": "custom_chain" }), &p),
+        // bad
+        (false, json!({ "set": "test", "target": 11 }), &p),
+        (false, json!({ "set": "test", "target": ["DROP"] }), &p),
+    ] {
+        let res = Plugin::default()
+            .load_config(
+                vec![],
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "ipset".into(),
+                    config: conf.clone().into(),
+                    patterns: patterns.clone(),
+                }],
+            )
+            .await;
+
+        assert!(
+            res.is_ok() == is_ok,
+            "conf: {:?}, must be ok: {is_ok}, result: {:?}",
+            conf,
+            // empty Result::Ok because ActionImpl is not Debug
+            res.map(|_| ())
+        );
+    }
+}
+
+// TODO
+#[tokio::test]
+async fn conf_action_merge() {
+    let mut plugin = Plugin::default();
+
+    let set1 = ActionConfig {
+        stream_name: "stream".into(),
+        filter_name: "filter".into(),
+        action_name: "action1".into(),
+        action_type: "ipset".into(),
+        config: json!({
+            "set": "test",
+            "target": "DROP",
+            "chains": ["INPUT"],
+            "action": "add",
+        })
+        .into(),
+        patterns: vec!["ip".into()],
+    };
+
+    let set2 = ActionConfig {
+        stream_name: "stream".into(),
+        filter_name: "filter".into(),
+        action_name: "action2".into(),
+        action_type: "ipset".into(),
+        config: json!({
+            "set": "test",
+            "target": "DROP",
+            "version": "ip",
+            "action": "add",
+        })
+        .into(),
+        patterns: vec!["ip".into()],
+    };
+
+    let set3 = ActionConfig {
+        stream_name: "stream".into(),
+        filter_name: "filter".into(),
+        action_name: "action2".into(),
+        action_type: "ipset".into(),
+        config: json!({
+            "set": "test",
+            "action": "del",
+        })
+        .into(),
+        patterns: vec!["ip".into()],
+    };
+
+    let res = plugin
+        .load_config(
+            vec![],
+            vec![
+                // First set
+                set1.clone(),
+                // Same set, adding options, no conflict
+                set2.clone(),
+                // Same set, no new options, no conflict
+                set3.clone(),
+                // Unrelated set, so no conflict
+                ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action3".into(),
+                    action_type: "ipset".into(),
+                    config: json!({
+                        "set": "test2",
+                        "target": "target1",
+                        "version": "ipv6",
+                    })
+                    .into(),
+                    patterns: vec!["ip".into()],
+                },
+            ],
+        )
+        .await;
+
+    assert!(res.is_ok(), "res: {:?}", res.map(|_| ()));
+
+    // Another set with conflict is not ok
+    let res = plugin
+        .load_config(
+            vec![],
+            vec![
+                // First set
+                set1,
+                // Same set, adding options, no conflict
+                set2,
+                // Same set, no new options, no conflict
+                set3,
+                // Another set with conflict
+                ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action3".into(),
+                    action_type: "ipset".into(),
+                    config: json!({
+                        "set": "test",
+                        "target": "target2",
+                        "action": "del",
+                    })
+                    .into(),
+                    patterns: vec!["ip".into()],
+                },
+            ],
+        )
+        .await;
+    assert!(res.is_err(), "res: {:?}", res.map(|_| ()));
+}
diff --git a/plugins/reaction-plugin-nftables/Cargo.toml b/plugins/reaction-plugin-nftables/Cargo.toml
new file mode 100644
index 0000000..1de8e6b
--- /dev/null
+++ b/plugins/reaction-plugin-nftables/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "reaction-plugin-nftables"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+tokio = { workspace = true, features = ["rt-multi-thread"] }
+remoc.workspace = true
+reaction-plugin.path = "../reaction-plugin"
+serde.workspace = true
+serde_json.workspace = true
+nftables = { version = "0.6.3", features = ["tokio"] }
+libnftables1-sys = { version = "0.1.1" }
diff --git a/plugins/reaction-plugin-nftables/src/action.rs b/plugins/reaction-plugin-nftables/src/action.rs
new file mode 100644
index 0000000..3898ab5
--- /dev/null
+++ b/plugins/reaction-plugin-nftables/src/action.rs
@@ -0,0 +1,493 @@
+use std::{
+    borrow::Cow,
+    collections::HashSet,
+    fmt::{Debug, Display},
+    u32,
+};
+
+use nftables::{
+    batch::Batch,
+    expr::Expression,
+    schema::{Element, NfListObject, Rule, SetFlag, SetType, SetTypeValue},
+    stmt::Statement,
+    types::{NfFamily, NfHook},
+};
+use reaction_plugin::{Exec, shutdown::ShutdownToken, time::parse_duration};
+use remoc::rch::mpsc as remocMpsc;
+use serde::{Deserialize, Serialize};
+
+use crate::{helpers::Version, nft::NftClient};
+
+#[derive(Default, Serialize, Deserialize, PartialEq, Eq, Clone, Copy)]
+pub enum IpVersion {
+    #[default]
+    #[serde(rename = "ip")]
+    Ip,
+    #[serde(rename = "ipv4")]
+    Ipv4,
+    #[serde(rename = "ipv6")]
+    Ipv6,
+}
+impl Debug for IpVersion {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                IpVersion::Ipv4 => "ipv4",
+                IpVersion::Ipv6 => "ipv6",
+                IpVersion::Ip => "ip",
+            }
+        )
+    }
+}
+
+#[derive(Default, Debug, Serialize, Deserialize)]
+pub enum AddDel {
+    #[default]
+    #[serde(alias = "add")]
+    Add,
+    #[serde(alias = "delete")]
+    Delete,
+}
+
+/// User-facing action options
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ActionOptions {
+    /// The set that should be used by this action
+    pub set: String,
+    /// The pattern name of the IP.
+    /// Defaults to "ip"
+    #[serde(default = "serde_ip")]
+    pub pattern: String,
+    #[serde(skip)]
+    ip_index: usize,
+    // Whether the action is to "add" or "del" the ip from the set
+    #[serde(default)]
+    action: AddDel,
+
+    #[serde(flatten)]
+    pub set_options: SetOptions,
+}
+
+fn serde_ip() -> String {
+    "ip".into()
+}
+
+impl ActionOptions {
+    pub fn set_ip_index(&mut self, patterns: Vec<String>) -> Result<(), ()> {
+        self.ip_index = patterns
+            .into_iter()
+            .enumerate()
+            .filter(|(_, name)| name == &self.pattern)
+            .next()
+            .ok_or(())?
+            .0;
+        Ok(())
+    }
+}
+
+/// Merged set options
+#[derive(Default, Clone, Deserialize, Serialize, Debug, PartialEq, Eq)]
+pub struct SetOptions {
+    /// The IP type.
+    /// Defaults to `46`.
+    /// If `ipv4`: creates an IPv4 set with this name
+    /// If `ipv6`: creates an IPv6 set with this name
+    /// If `ip`: creates an IPv4 set with its name suffixed by 'v4' AND an IPv6 set with its name suffixed by 'v6'
+    /// *Merged set-wise*.
+    #[serde(default)]
+    version: Option<IpVersion>,
+    /// Chains where the IP set should be inserted.
+    /// Defaults to `["input", "forward"]`
+    /// *Merged set-wise*.
+    #[serde(default)]
+    hooks: Option<Vec<RHook>>,
+    // Optional timeout, letting linux/netfilter handle set removal instead of reaction
+    // Note that `reaction show` and `reaction flush` won't work if set instead of an `after` action
+    // Same syntax as after and retryperiod in reaction.
+    /// *Merged set-wise*.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    timeout: Option<String>,
+    #[serde(skip)]
+    timeout_u32: Option<u32>,
+    // Target that iptables should use when the IP is encountered.
+    // Defaults to DROP, but can also be ACCEPT, RETURN or any user-defined chain
+    /// *Merged set-wise*.
+    #[serde(default)]
+    target: Option<RStatement>,
+}
+
+impl SetOptions {
+    pub fn merge(&mut self, options: &SetOptions) -> Result<(), String> {
+        // merge two Option<T> and fail if there is conflict
+        fn inner_merge<T: Eq + Clone + std::fmt::Debug>(
+            a: &mut Option<T>,
+            b: &Option<T>,
+            name: &str,
+        ) -> Result<(), String> {
+            match (&a, &b) {
+                (Some(aa), Some(bb)) => {
+                    if aa != bb {
+                        return Err(format!(
+                            "Conflicting options for {name}: `{aa:?}` and `{bb:?}`"
+                        ));
+                    }
+                }
+                (None, Some(_)) => {
+                    *a = b.clone();
+                }
+                _ => (),
+            };
+            Ok(())
+        }
+
+        inner_merge(&mut self.version, &options.version, "version")?;
+        inner_merge(&mut self.timeout, &options.timeout, "timeout")?;
+        inner_merge(&mut self.hooks, &options.hooks, "chains")?;
+        inner_merge(&mut self.target, &options.target, "target")?;
+
+        if let Some(timeout) = &self.timeout {
+            let duration = parse_duration(timeout)
+                .map_err(|err| format!("failed to parse timeout: {}", err))?
+                .as_secs();
+            if duration > u32::MAX as u64 {
+                return Err(format!(
+                    "timeout is limited to {} seconds (approx {} days)",
+                    u32::MAX,
+                    49_000
+                ));
+            }
+            self.timeout_u32 = Some(duration as u32);
+        }
+
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, PartialOrd, Eq, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum RHook {
+    Ingress,
+    Prerouting,
+    Forward,
+    Input,
+    Output,
+    Postrouting,
+    Egress,
+}
+
+impl RHook {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            RHook::Ingress => "ingress",
+            RHook::Prerouting => "prerouting",
+            RHook::Forward => "forward",
+            RHook::Input => "input",
+            RHook::Output => "output",
+            RHook::Postrouting => "postrouting",
+            RHook::Egress => "egress",
+        }
+    }
+}
+
+impl Display for RHook {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+impl From<&RHook> for NfHook {
+    fn from(value: &RHook) -> Self {
+        match value {
+            RHook::Ingress => Self::Ingress,
+            RHook::Prerouting => Self::Prerouting,
+            RHook::Forward => Self::Forward,
+            RHook::Input => Self::Input,
+            RHook::Output => Self::Output,
+            RHook::Postrouting => Self::Postrouting,
+            RHook::Egress => Self::Egress,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, PartialOrd, Eq, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum RStatement {
+    Accept,
+    Drop,
+    Continue,
+    Return,
+}
+
+pub struct Set {
+    pub sets: SetNames,
+    pub hooks: Vec<RHook>,
+    pub timeout: Option<u32>,
+    pub target: RStatement,
+}
+
+impl Set {
+    pub fn from(name: String, options: SetOptions) -> Self {
+        Self {
+            sets: SetNames::new(name, options.version),
+            timeout: options.timeout_u32,
+            target: options.target.unwrap_or(RStatement::Drop),
+            hooks: options.hooks.unwrap_or(vec![RHook::Input, RHook::Forward]),
+        }
+    }
+
+    pub fn init<'a>(&self, batch: &mut Batch<'a>) -> Result<(), String> {
+        for (set, version) in [
+            (&self.sets.ipv4, Version::IPv4),
+            (&self.sets.ipv6, Version::IPv6),
+        ] {
+            if let Some(set) = set {
+                let family = NfFamily::INet;
+                let table = Cow::from("reaction");
+
+                // create set
+                batch.add(NfListObject::<'a>::Set(Box::new(nftables::schema::Set::<
+                    'a,
+                > {
+                    family,
+                    table: table.to_owned(),
+                    name: Cow::Owned(set.to_owned()),
+                    // TODO Try a set which is both ipv4 and ipv6?
+                    set_type: SetTypeValue::Single(match version {
+                        Version::IPv4 => SetType::Ipv4Addr,
+                        Version::IPv6 => SetType::Ipv6Addr,
+                    }),
+                    flags: Some({
+                        let mut flags = HashSet::from([SetFlag::Interval]);
+                        if self.timeout.is_some() {
+                            flags.insert(SetFlag::Timeout);
+                        }
+                        flags
+                    }),
+                    timeout: self.timeout.clone(),
+                    ..Default::default()
+                })));
+                // insert set in chains
+                let expr = vec![match self.target {
+                    RStatement::Accept => Statement::Accept(None),
+                    RStatement::Drop => Statement::Drop(None),
+                    RStatement::Continue => Statement::Continue(None),
+                    RStatement::Return => Statement::Return(None),
+                }];
+                for hook in &self.hooks {
+                    batch.add(NfListObject::Rule(Rule {
+                        family,
+                        table: table.to_owned(),
+                        chain: Cow::from(hook.to_string()),
+                        expr: Cow::Owned(expr.clone()),
+                        ..Default::default()
+                    }));
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+pub struct SetNames {
+    pub ipv4: Option<String>,
+    pub ipv6: Option<String>,
+}
+
+impl SetNames {
+    pub fn new(name: String, version: Option<IpVersion>) -> Self {
+        Self {
+            ipv4: match version {
+                Some(IpVersion::Ipv4) => Some(name.clone()),
+                Some(IpVersion::Ipv6) => None,
+                None | Some(IpVersion::Ip) => Some(format!("{}v4", name)),
+            },
+            ipv6: match version {
+                Some(IpVersion::Ipv4) => None,
+                Some(IpVersion::Ipv6) => Some(name),
+                None | Some(IpVersion::Ip) => Some(format!("{}v6", name)),
+            },
+        }
+    }
+}
+
+pub struct Action {
+    nft: NftClient,
+    rx: remocMpsc::Receiver<Exec>,
+    shutdown: ShutdownToken,
+    sets: SetNames,
+    // index of pattern ip in match vec
+    ip_index: usize,
+    action: AddDel,
+}
+
+impl Action {
+    pub fn new(
+        nft: NftClient,
+        shutdown: ShutdownToken,
+        rx: remocMpsc::Receiver<Exec>,
+        options: ActionOptions,
+    ) -> Result<Self, String> {
+        Ok(Action {
+            nft,
+            rx,
+            shutdown,
+            sets: SetNames::new(options.set, options.set_options.version),
+            ip_index: options.ip_index,
+            action: options.action,
+        })
+    }
+
+    pub async fn serve(mut self) {
+        loop {
+            let event = tokio::select! {
+                exec = self.rx.recv() => Some(exec),
+                _ = self.shutdown.wait() => None,
+            };
+            match event {
+                // shutdown asked
+                None => break,
+                // channel closed
+                Some(Ok(None)) => break,
+                // error from channel
+                Some(Err(err)) => {
+                    eprintln!("ERROR {err}");
+                    break;
+                }
+                // ok
+                Some(Ok(Some(exec))) => {
+                    if let Err(err) = self.handle_exec(exec).await {
+                        eprintln!("ERROR {err}");
+                        break;
+                    }
+                }
+            }
+        }
+        // eprintln!("DEBUG Asking for shutdown");
+        // self.shutdown.ask_shutdown();
+    }
+
+    async fn handle_exec(&mut self, mut exec: Exec) -> Result<(), String> {
+        // safeguard against Vec::remove's panic
+        if exec.match_.len() <= self.ip_index {
+            return Err(format!(
+                "match received from reaction is smaller than expected. looking for index {} but size is {}. this is a bug!",
+                self.ip_index,
+                exec.match_.len()
+            ));
+        }
+        let ip = exec.match_.remove(self.ip_index);
+        // select set
+        let set = match (&self.sets.ipv4, &self.sets.ipv6) {
+            (None, None) => return Err(format!("action is neither IPv4 nor IPv6, this is a bug!")),
+            (None, Some(set)) => set,
+            (Some(set), None) => set,
+            (Some(set4), Some(set6)) => {
+                if ip.contains(':') {
+                    set6
+                } else {
+                    set4
+                }
+            }
+        };
+        // add/remove ip to set
+        let element = NfListObject::Element(Element {
+            family: NfFamily::INet,
+            table: Cow::from("reaction"),
+            name: Cow::from(set),
+            elem: Cow::from(vec![Expression::String(Cow::from(ip.clone()))]),
+        });
+        let mut batch = Batch::new();
+        match self.action {
+            AddDel::Add => batch.add(element),
+            AddDel::Delete => batch.delete(element),
+        };
+        match self.nft.send(batch).await {
+            Ok(ok) => {
+                eprintln!("DEBUG action ok {:?} {ip}: {ok}", self.action);
+                Ok(())
+            }
+            Err(err) => Err(format!("action ko {:?} {ip}: {err}", self.action)),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::action::{IpVersion, RHook, RStatement, SetOptions};
+
+    #[tokio::test]
+    async fn set_options_merge() {
+        let s1 = SetOptions {
+            version: None,
+            hooks: None,
+            timeout: None,
+            timeout_u32: None,
+            target: None,
+        };
+        let s2 = SetOptions {
+            version: Some(IpVersion::Ipv4),
+            hooks: Some(vec![RHook::Input]),
+            timeout: Some("3h".into()),
+            timeout_u32: Some(3 * 3600),
+            target: Some(RStatement::Drop),
+        };
+        assert_ne!(s1, s2);
+        assert_eq!(s1, SetOptions::default());
+
+        {
+            // s2 can be merged in s1
+            let mut s1 = s1.clone();
+            assert!(s1.merge(&s2).is_ok());
+            assert_eq!(s1, s2);
+        }
+
+        {
+            // s1 can be merged in s2
+            let mut s2 = s2.clone();
+            assert!(s2.merge(&s1).is_ok());
+        }
+
+        {
+            // s1 can be merged in itself
+            let mut s3 = s1.clone();
+            assert!(s3.merge(&s1).is_ok());
+            assert_eq!(s1, s3);
+        }
+
+        {
+            // s2 can be merged in itself
+            let mut s3 = s2.clone();
+            assert!(s3.merge(&s2).is_ok());
+            assert_eq!(s2, s3);
+        }
+
+        for s3 in [
+            SetOptions {
+                version: Some(IpVersion::Ipv6),
+                ..Default::default()
+            },
+            SetOptions {
+                hooks: Some(vec![RHook::Output]),
+                ..Default::default()
+            },
+            SetOptions {
+                timeout: Some("30min".into()),
+                ..Default::default()
+            },
+            SetOptions {
+                target: Some(RStatement::Continue),
+                ..Default::default()
+            },
+        ] {
+            // none with some is ok
+            assert!(s3.clone().merge(&s1).is_ok(), "s3: {s3:?}");
+            assert!(s1.clone().merge(&s3).is_ok(), "s3: {s3:?}");
+            // different some is ko
+            assert!(s3.clone().merge(&s2).is_err(), "s3: {s3:?}");
+            assert!(s2.clone().merge(&s3).is_err(), "s3: {s3:?}");
+        }
+    }
+}
diff --git a/plugins/reaction-plugin-nftables/src/helpers.rs b/plugins/reaction-plugin-nftables/src/helpers.rs
new file mode 100644
index 0000000..b8b97b2
--- /dev/null
+++ b/plugins/reaction-plugin-nftables/src/helpers.rs
@@ -0,0 +1,15 @@
+use std::fmt::Display;
+
+#[derive(PartialEq, Eq, PartialOrd, Ord, Copy, Clone)]
+pub enum Version {
+    IPv4,
+    IPv6,
+}
+impl Display for Version {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            Version::IPv4 => "IPv4",
+            Version::IPv6 => "IPv6",
+        })
+    }
+}
diff --git a/plugins/reaction-plugin-nftables/src/main.rs b/plugins/reaction-plugin-nftables/src/main.rs
new file mode 100644
index 0000000..6a7f067
--- /dev/null
+++ b/plugins/reaction-plugin-nftables/src/main.rs
@@ -0,0 +1,176 @@
+use std::{
+    borrow::Cow,
+    collections::{BTreeMap, BTreeSet},
+};
+
+use nftables::{
+    batch::Batch,
+    schema::{Chain, NfListObject, Table},
+    types::{NfChainType, NfFamily},
+};
+use reaction_plugin::{
+    ActionConfig, ActionImpl, Hello, Manifest, PluginInfo, RemoteResult, StreamConfig, StreamImpl,
+    shutdown::ShutdownController,
+};
+use remoc::rtc;
+
+use crate::{
+    action::{Action, ActionOptions, Set, SetOptions},
+    nft::NftClient,
+};
+
+#[cfg(test)]
+mod tests;
+
+mod action;
+pub mod helpers;
+mod nft;
+
+#[tokio::main]
+async fn main() {
+    let plugin = Plugin::default();
+    reaction_plugin::main_loop(plugin).await;
+}
+
+#[derive(Default)]
+struct Plugin {
+    nft: NftClient,
+    sets: Vec<Set>,
+    actions: Vec<Action>,
+    shutdown: ShutdownController,
+}
+
+impl PluginInfo for Plugin {
+    async fn manifest(&mut self) -> Result<Manifest, rtc::CallError> {
+        Ok(Manifest {
+            hello: Hello::new(),
+            streams: BTreeSet::default(),
+            actions: BTreeSet::from(["nftables".into()]),
+        })
+    }
+
+    async fn load_config(
+        &mut self,
+        streams: Vec<StreamConfig>,
+        actions: Vec<ActionConfig>,
+    ) -> RemoteResult<(Vec<StreamImpl>, Vec<ActionImpl>)> {
+        if !streams.is_empty() {
+            return Err("This plugin can't handle any stream type".into());
+        }
+
+        let mut ret_actions = Vec::with_capacity(actions.len());
+        let mut set_options: BTreeMap<String, SetOptions> = BTreeMap::new();
+
+        for ActionConfig {
+            stream_name,
+            filter_name,
+            action_name,
+            action_type,
+            config,
+            patterns,
+        } in actions
+        {
+            if &action_type != "nftables" {
+                return Err("This plugin can't handle other action types than nftables".into());
+            }
+
+            let mut options: ActionOptions = serde_json::from_value(config.into()).map_err(|err| {
+            format!("invalid options for action {stream_name}.{filter_name}.{action_name}: {err}")
+        })?;
+
+            options.set_ip_index(patterns).map_err(|_|
+                format!(
+                    "No pattern with name {} in filter {stream_name}.{filter_name}. Try setting the option `pattern` to your pattern name of type 'ip'",
+                    &options.pattern
+                )
+        )?;
+
+            // Merge option
+            set_options
+                .entry(options.set.clone())
+                .or_default()
+                .merge(&options.set_options)
+                .map_err(|err| format!("set {}: {err}", options.set))?;
+
+            let (tx, rx) = remoc::rch::mpsc::channel(1);
+            self.actions.push(Action::new(
+                self.nft.clone(),
+                self.shutdown.token(),
+                rx,
+                options,
+            )?);
+
+            ret_actions.push(ActionImpl { tx });
+        }
+
+        // Init all sets
+        while let Some((name, options)) = set_options.pop_first() {
+            self.sets.push(Set::from(name, options));
+        }
+
+        Ok((vec![], ret_actions))
+    }
+
+    async fn start(&mut self) -> RemoteResult<()> {
+        self.shutdown.delegate().handle_quit_signals()?;
+
+        let mut batch = Batch::new();
+        batch.add(reaction_table());
+
+        // Create a chain for each registered netfilter hook
+        for hook in self
+            .sets
+            .iter()
+            .flat_map(|set| &set.hooks)
+            .collect::<BTreeSet<_>>()
+        {
+            batch.add(NfListObject::Chain(Chain {
+                family: NfFamily::INet,
+                table: Cow::Borrowed("reaction"),
+                name: Cow::from(hook.as_str()),
+                _type: Some(NfChainType::Filter),
+                hook: Some(hook.into()),
+                prio: Some(0),
+                ..Default::default()
+            }));
+        }
+
+        for set in &self.sets {
+            set.init(&mut batch)?;
+        }
+
+        // TODO apply batch
+        self.nft.send(batch).await?;
+
+        // Launch a task that will destroy the table on shutdown
+        {
+            let token = self.shutdown.token();
+            tokio::spawn(async move {
+                token.wait().await;
+                Batch::new().delete(reaction_table());
+            });
+        }
+
+        // Launch all actions
+        while let Some(action) = self.actions.pop() {
+            tokio::spawn(async move { action.serve().await });
+        }
+        self.actions = Default::default();
+
+        Ok(())
+    }
+
+    async fn close(self) -> RemoteResult<()> {
+        self.shutdown.ask_shutdown();
+        self.shutdown.wait_all_task_shutdown().await;
+        Ok(())
+    }
+}
+
+fn reaction_table() -> NfListObject<'static> {
+    NfListObject::Table(Table {
+        family: NfFamily::INet,
+        name: Cow::Borrowed("reaction"),
+        handle: None,
+    })
+}
diff --git a/plugins/reaction-plugin-nftables/src/nft.rs b/plugins/reaction-plugin-nftables/src/nft.rs
new file mode 100644
index 0000000..a1641d2
--- /dev/null
+++ b/plugins/reaction-plugin-nftables/src/nft.rs
@@ -0,0 +1,81 @@
+use std::{
+    ffi::{CStr, CString},
+    thread,
+};
+
+use libnftables1_sys::Nftables;
+use nftables::batch::Batch;
+use tokio::sync::{mpsc, oneshot};
+
+/// A client with a dedicated server thread to libnftables.
+/// Calling [`Default::default()`] spawns a new server thread.
+/// Cloning just creates a new client to the same server thread.
+#[derive(Clone)]
+pub struct NftClient {
+    tx: mpsc::Sender<NftCommand>,
+}
+
+impl Default for NftClient {
+    fn default() -> Self {
+        let (tx, mut rx) = mpsc::channel(10);
+
+        thread::spawn(move || {
+            let mut conn = Nftables::new();
+
+            while let Some(NftCommand { json, ret }) = rx.blocking_recv() {
+                let (rc, output, error) = conn.run_cmd(json.as_ptr());
+                let res = match rc {
+                    0 => to_rust_string(output)
+                        .ok_or_else(|| "unknown ok (rc = 0 but no output buffer)".into()),
+                    _ => to_rust_string(error)
+                        .map(|err| format!("error (rc = {rc}: {err})"))
+                        .ok_or_else(|| format!("unknown error (rc = {rc} but no error buffer)")),
+                };
+                let _ = ret.send(res);
+            }
+        });
+
+        NftClient { tx }
+    }
+}
+
+impl NftClient {
+    /// Send a batch to nftables.
+    pub async fn send(&self, batch: Batch<'_>) -> Result<String, String> {
+        // convert JSON to CString
+        let mut json = serde_json::to_vec(&batch.to_nftables())
+            .map_err(|err| format!("couldn't build json to send to nftables: {err}"))?;
+        json.push('\0' as u8);
+        let json = CString::from_vec_with_nul(json)
+            .map_err(|err| format!("invalid json with null char: {err}"))?;
+
+        // Send command
+        let (tx, rx) = oneshot::channel();
+        let command = NftCommand { json, ret: tx };
+        self.tx
+            .send(command)
+            .await
+            .map_err(|err| format!("nftables thread has quit, can't send command: {err}"))?;
+
+        // Wait for result
+        rx.await
+            .map_err(|_| format!("nftables thread has quit, no response for command"))?
+    }
+}
+
+struct NftCommand {
+    json: CString,
+    ret: oneshot::Sender<Result<String, String>>,
+}
+
+fn to_rust_string(c_ptr: *const i8) -> Option<String> {
+    if c_ptr.is_null() {
+        None
+    } else {
+        Some(
+            unsafe { CStr::from_ptr(c_ptr) }
+                .to_string_lossy()
+                .into_owned(),
+        )
+    }
+}
diff --git a/plugins/reaction-plugin-nftables/src/tests.rs b/plugins/reaction-plugin-nftables/src/tests.rs
new file mode 100644
index 0000000..7c2de26
--- /dev/null
+++ b/plugins/reaction-plugin-nftables/src/tests.rs
@@ -0,0 +1,247 @@
+use reaction_plugin::{ActionConfig, PluginInfo, StreamConfig, Value};
+use serde_json::json;
+
+use crate::Plugin;
+
+#[tokio::test]
+async fn conf_stream() {
+    // No stream is supported by nftables
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "nftables".into(),
+                    config: Value::Null
+                }],
+                vec![]
+            )
+            .await
+            .is_err()
+    );
+
+    // Empty config is ok
+    assert!(Plugin::default().load_config(vec![], vec![]).await.is_ok());
+}
+
+#[tokio::test]
+async fn conf_action_standalone() {
+    let p = vec!["name".into(), "ip".into(), "ip2".into()];
+    let p_noip = vec!["name".into(), "ip2".into()];
+
+    for (is_ok, conf, patterns) in [
+        // minimal set
+        (true, json!({ "set": "test" }), &p),
+        // missing set key
+        (false, json!({}), &p),
+        (false, json!({ "version": "ipv4" }), &p),
+        // unknown key
+        (false, json!({ "set": "test", "unknown": "yes" }), &p),
+        (false, json!({ "set": "test", "ip_index": 1 }), &p),
+        (false, json!({ "set": "test", "timeout_u32": 1 }), &p),
+        // pattern //
+        (true, json!({ "set": "test" }), &p),
+        (true, json!({ "set": "test", "pattern": "ip" }), &p),
+        (true, json!({ "set": "test", "pattern": "ip2" }), &p),
+        (true, json!({ "set": "test", "pattern": "ip2" }), &p_noip),
+        // unknown pattern "ip"
+        (false, json!({ "set": "test" }), &p_noip),
+        (false, json!({ "set": "test", "pattern": "ip" }), &p_noip),
+        // unknown pattern
+        (false, json!({ "set": "test", "pattern": "unknown" }), &p),
+        (false, json!({ "set": "test", "pattern": "uwu" }), &p_noip),
+        // bad type
+        (false, json!({ "set": "test", "pattern": 0 }), &p_noip),
+        (false, json!({ "set": "test", "pattern": true }), &p_noip),
+        // action //
+        (true, json!({ "set": "test", "action": "add" }), &p),
+        (true, json!({ "set": "test", "action": "delete" }), &p),
+        // unknown action
+        (false, json!({ "set": "test", "action": "create" }), &p),
+        (false, json!({ "set": "test", "action": "insert" }), &p),
+        (false, json!({ "set": "test", "action": "del" }), &p),
+        (false, json!({ "set": "test", "action": "destroy" }), &p),
+        // bad type
+        (false, json!({ "set": "test", "action": true }), &p),
+        (false, json!({ "set": "test", "action": 1 }), &p),
+        // ip version //
+        // ok
+        (true, json!({ "set": "test", "version": "ipv4" }), &p),
+        (true, json!({ "set": "test", "version": "ipv6" }), &p),
+        (true, json!({ "set": "test", "version": "ip" }), &p),
+        // unknown version
+        (false, json!({ "set": "test", "version": 4 }), &p),
+        (false, json!({ "set": "test", "version": 6 }), &p),
+        (false, json!({ "set": "test", "version": 46 }), &p),
+        (false, json!({ "set": "test", "version": "5" }), &p),
+        (false, json!({ "set": "test", "version": "ipv5" }), &p),
+        (false, json!({ "set": "test", "version": "4" }), &p),
+        (false, json!({ "set": "test", "version": "6" }), &p),
+        (false, json!({ "set": "test", "version": "46" }), &p),
+        // bad type
+        (false, json!({ "set": "test", "version": true }), &p),
+        // hooks //
+        // everything is fine really
+        (true, json!({ "set": "test", "hooks": [] }), &p),
+        (
+            true,
+            json!({ "set": "test", "hooks": ["input", "forward", "ingress", "prerouting", "output", "postrouting", "egress"] }),
+            &p,
+        ),
+        (false, json!({ "set": "test", "hooks": ["INPUT"] }), &p),
+        (false, json!({ "set": "test", "hooks": ["FORWARD"] }), &p),
+        (
+            false,
+            json!({ "set": "test", "hooks": ["unknown_hook"] }),
+            &p,
+        ),
+        // timeout //
+        (true, json!({ "set": "test", "timeout": "1m" }), &p),
+        (true, json!({ "set": "test", "timeout": "3 days" }), &p),
+        // bad
+        (false, json!({ "set": "test", "timeout": "3 dayz"}), &p),
+        (false, json!({ "set": "test", "timeout": 12 }), &p),
+        // target //
+        // anything is fine too
+        (true, json!({ "set": "test", "target": "drop" }), &p),
+        (true, json!({ "set": "test", "target": "accept" }), &p),
+        (true, json!({ "set": "test", "target": "return" }), &p),
+        (true, json!({ "set": "test", "target": "continue" }), &p),
+        // bad
+        (false, json!({ "set": "test", "target": "custom" }), &p),
+        (false, json!({ "set": "test", "target": "DROP" }), &p),
+        (false, json!({ "set": "test", "target": 11 }), &p),
+        (false, json!({ "set": "test", "target": ["DROP"] }), &p),
+    ] {
+        let res = Plugin::default()
+            .load_config(
+                vec![],
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "nftables".into(),
+                    config: conf.clone().into(),
+                    patterns: patterns.clone(),
+                }],
+            )
+            .await;
+
+        assert!(
+            res.is_ok() == is_ok,
+            "conf: {:?}, must be ok: {is_ok}, result: {:?}",
+            conf,
+            // empty Result::Ok because ActionImpl is not Debug
+            res.map(|_| ())
+        );
+    }
+}
+
+// TODO
+#[tokio::test]
+async fn conf_action_merge() {
+    let mut plugin = Plugin::default();
+
+    let set1 = ActionConfig {
+        stream_name: "stream".into(),
+        filter_name: "filter".into(),
+        action_name: "action1".into(),
+        action_type: "nftables".into(),
+        config: json!({
+            "set": "test",
+            "target": "drop",
+            "hooks": ["input"],
+            "action": "add",
+        })
+        .into(),
+        patterns: vec!["ip".into()],
+    };
+
+    let set2 = ActionConfig {
+        stream_name: "stream".into(),
+        filter_name: "filter".into(),
+        action_name: "action2".into(),
+        action_type: "nftables".into(),
+        config: json!({
+            "set": "test",
+            "target": "drop",
+            "version": "ip",
+            "action": "add",
+        })
+        .into(),
+        patterns: vec!["ip".into()],
+    };
+
+    let set3 = ActionConfig {
+        stream_name: "stream".into(),
+        filter_name: "filter".into(),
+        action_name: "action2".into(),
+        action_type: "nftables".into(),
+        config: json!({
+            "set": "test",
+            "action": "delete",
+        })
+        .into(),
+        patterns: vec!["ip".into()],
+    };
+
+    let res = plugin
+        .load_config(
+            vec![],
+            vec![
+                // First set
+                set1.clone(),
+                // Same set, adding options, no conflict
+                set2.clone(),
+                // Same set, no new options, no conflict
+                set3.clone(),
+                // Unrelated set, so no conflict
+                ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action3".into(),
+                    action_type: "nftables".into(),
+                    config: json!({
+                        "set": "test2",
+                        "target": "return",
+                        "version": "ipv6",
+                    })
+                    .into(),
+                    patterns: vec!["ip".into()],
+                },
+            ],
+        )
+        .await;
+
+    assert!(res.is_ok(), "res: {:?}", res.map(|_| ()));
+
+    // Another set with conflict is not ok
+    let res = plugin
+        .load_config(
+            vec![],
+            vec![
+                // First set
+                set1,
+                // Same set, adding options, no conflict
+                set2,
+                // Same set, no new options, no conflict
+                set3,
+                // Another set with conflict
+                ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action3".into(),
+                    action_type: "nftables".into(),
+                    config: json!({
+                        "set": "test",
+                        "target": "target2",
+                        "action": "del",
+                    })
+                    .into(),
+                    patterns: vec!["ip".into()],
+                },
+            ],
+        )
+        .await;
+    assert!(res.is_err(), "res: {:?}", res.map(|_| ()));
+}
diff --git a/plugins/reaction-plugin-virtual/Cargo.toml b/plugins/reaction-plugin-virtual/Cargo.toml
new file mode 100644
index 0000000..f6a1fca
--- /dev/null
+++ b/plugins/reaction-plugin-virtual/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "reaction-plugin-virtual"
+version = "1.0.0"
+edition = "2024"
+
+[dependencies]
+tokio = { workspace = true, features = ["rt-multi-thread"] }
+remoc.workspace = true
+reaction-plugin.path = "../reaction-plugin"
+serde.workspace = true
+serde_json.workspace = true
diff --git a/plugins/reaction-plugin-virtual/src/main.rs b/plugins/reaction-plugin-virtual/src/main.rs
new file mode 100644
index 0000000..aa20f26
--- /dev/null
+++ b/plugins/reaction-plugin-virtual/src/main.rs
@@ -0,0 +1,179 @@
+use std::collections::{BTreeMap, BTreeSet};
+
+use reaction_plugin::{
+    ActionConfig, ActionImpl, Exec, Hello, Line, Manifest, PluginInfo, RemoteResult, StreamConfig,
+    StreamImpl, Value, line::PatternLine,
+};
+use remoc::{rch::mpsc, rtc};
+use serde::{Deserialize, Serialize};
+
+#[cfg(test)]
+mod tests;
+
+#[tokio::main]
+async fn main() {
+    let plugin = Plugin::default();
+    reaction_plugin::main_loop(plugin).await;
+}
+
+#[derive(Default)]
+struct Plugin {}
+
+impl PluginInfo for Plugin {
+    async fn manifest(&mut self) -> Result<Manifest, rtc::CallError> {
+        Ok(Manifest {
+            hello: Hello::new(),
+            streams: BTreeSet::from(["virtual".into()]),
+            actions: BTreeSet::from(["virtual".into()]),
+        })
+    }
+
+    async fn load_config(
+        &mut self,
+        streams: Vec<StreamConfig>,
+        actions: Vec<ActionConfig>,
+    ) -> RemoteResult<(Vec<StreamImpl>, Vec<ActionImpl>)> {
+        let mut ret_streams = Vec::with_capacity(streams.len());
+        let mut ret_actions = Vec::with_capacity(actions.len());
+
+        let mut local_streams = BTreeMap::new();
+
+        for StreamConfig {
+            stream_name,
+            stream_type,
+            config,
+        } in streams
+        {
+            if stream_type != "virtual" {
+                return Err("This plugin can't handle other stream types than virtual".into());
+            }
+
+            let (virtual_stream, receiver) = VirtualStream::new(config)?;
+
+            if let Some(_) = local_streams.insert(stream_name, virtual_stream) {
+                return Err("this virtual stream has already been initialized".into());
+            }
+
+            ret_streams.push(StreamImpl {
+                stream: receiver,
+                standalone: false,
+            });
+        }
+
+        for ActionConfig {
+            stream_name,
+            filter_name,
+            action_name,
+            action_type,
+            config,
+            patterns,
+        } in actions
+        {
+            if &action_type != "virtual" {
+                return Err("This plugin can't handle other action types than virtual".into());
+            }
+
+            let (mut virtual_action, tx) = VirtualAction::new(
+                stream_name,
+                filter_name,
+                action_name,
+                config,
+                patterns,
+                &local_streams,
+            )?;
+
+            tokio::spawn(async move { virtual_action.serve().await });
+
+            ret_actions.push(ActionImpl { tx });
+        }
+
+        Ok((ret_streams, ret_actions))
+    }
+
+    async fn start(&mut self) -> RemoteResult<()> {
+        Ok(())
+    }
+
+    async fn close(self) -> RemoteResult<()> {
+        Ok(())
+    }
+}
+
+#[derive(Clone)]
+struct VirtualStream {
+    tx: mpsc::Sender<Line>,
+}
+
+impl VirtualStream {
+    fn new(config: Value) -> Result<(Self, mpsc::Receiver<Line>), String> {
+        const CONFIG_ERROR: &'static str = "streams of type virtual take no options";
+        match config {
+            Value::Null => (),
+            Value::Object(map) => {
+                if map.len() != 0 {
+                    return Err(CONFIG_ERROR.into());
+                }
+            }
+            _ => return Err(CONFIG_ERROR.into()),
+        }
+
+        let (tx, rx) = mpsc::channel(1);
+        Ok((Self { tx }, rx))
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ActionOptions {
+    /// The line to send to the corresponding virtual stream, example: "ban \<ip\>"
+    send: String,
+    /// The name of the corresponding virtual stream, example: "my_stream"
+    to: String,
+}
+
+struct VirtualAction {
+    rx: mpsc::Receiver<Exec>,
+    send: PatternLine,
+    to: VirtualStream,
+}
+
+impl VirtualAction {
+    fn new(
+        stream_name: String,
+        filter_name: String,
+        action_name: String,
+        config: Value,
+        patterns: Vec<String>,
+        streams: &BTreeMap<String, VirtualStream>,
+    ) -> Result<(Self, mpsc::Sender<Exec>), String> {
+        let options: ActionOptions = serde_json::from_value(config.into()).map_err(|err| {
+            format!("invalid options for action {stream_name}.{filter_name}.{action_name}: {err}")
+        })?;
+
+        let send = PatternLine::new(options.send, patterns);
+
+        let stream = streams.get(&options.to).ok_or_else(|| {
+            format!(
+                "action {}.{}.{}: send \"{}\" matches no stream name",
+                stream_name, filter_name, action_name, options.to
+            )
+        })?;
+
+        let (tx, rx) = mpsc::channel(1);
+        Ok((
+            Self {
+                rx,
+                send: send,
+                to: stream.clone(),
+            },
+            tx,
+        ))
+    }
+
+    async fn serve(&mut self) {
+        while let Ok(Some(exec)) = self.rx.recv().await {
+            let line = self.send.line(exec.match_);
+            self.to.tx.send((line, exec.time)).await.unwrap();
+        }
+    }
+}
diff --git a/plugins/reaction-plugin-virtual/src/tests.rs b/plugins/reaction-plugin-virtual/src/tests.rs
new file mode 100644
index 0000000..32df952
--- /dev/null
+++ b/plugins/reaction-plugin-virtual/src/tests.rs
@@ -0,0 +1,322 @@
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use reaction_plugin::{ActionConfig, Exec, PluginInfo, StreamConfig, Value};
+use serde_json::json;
+
+use crate::Plugin;
+
+#[tokio::test]
+async fn conf_stream() {
+    // Invalid type
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "virtu".into(),
+                    config: Value::Null
+                }],
+                vec![]
+            )
+            .await
+            .is_err()
+    );
+
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "virtual".into(),
+                    config: Value::Null
+                }],
+                vec![]
+            )
+            .await
+            .is_ok()
+    );
+
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "virtual".into(),
+                    config: json!({}).into(),
+                }],
+                vec![]
+            )
+            .await
+            .is_ok()
+    );
+
+    // Invalid conf: must be empty
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "virtual".into(),
+                    config: json!({"key": "value" }).into(),
+                }],
+                vec![]
+            )
+            .await
+            .is_err()
+    );
+}
+
+#[tokio::test]
+async fn conf_action() {
+    let streams = vec![StreamConfig {
+        stream_name: "stream".into(),
+        stream_type: "virtual".into(),
+        config: Value::Null,
+    }];
+
+    let valid_conf = json!({ "send": "message", "to": "stream" });
+
+    let missing_send_conf = json!({ "to": "stream" });
+    let missing_to_conf = json!({ "send": "stream" });
+    let extra_attr_conf = json!({ "send": "message", "send2": "message", "to": "stream" });
+
+    let patterns = Vec::default();
+
+    // Invalid type
+    assert!(
+        Plugin::default()
+            .load_config(
+                streams.clone(),
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "virtu".into(),
+                    config: Value::Null,
+                    patterns: patterns.clone(),
+                }]
+            )
+            .await
+            .is_err()
+    );
+    assert!(
+        Plugin::default()
+            .load_config(
+                streams.clone(),
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "virtual".into(),
+                    config: valid_conf.into(),
+                    patterns: patterns.clone()
+                }]
+            )
+            .await
+            .is_ok()
+    );
+
+    for conf in [missing_send_conf, missing_to_conf, extra_attr_conf] {
+        assert!(
+            Plugin::default()
+                .load_config(
+                    streams.clone(),
+                    vec![ActionConfig {
+                        stream_name: "stream".into(),
+                        filter_name: "filter".into(),
+                        action_name: "action".into(),
+                        action_type: "virtual".into(),
+                        config: conf.clone().into(),
+                        patterns: patterns.clone()
+                    }]
+                )
+                .await
+                .is_err(),
+            "conf: {:?}",
+            conf
+        );
+    }
+}
+
+#[tokio::test]
+async fn conf_send() {
+    // Valid to: option
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "virtual".into(),
+                    config: Value::Null,
+                }],
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "virtual".into(),
+                    config: json!({ "send": "message", "to": "stream" }).into(),
+                    patterns: vec![],
+                }]
+            )
+            .await
+            .is_ok(),
+    );
+
+    // Invalid to: option
+    assert!(
+        Plugin::default()
+            .load_config(
+                vec![StreamConfig {
+                    stream_name: "stream".into(),
+                    stream_type: "virtual".into(),
+                    config: Value::Null,
+                }],
+                vec![ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "virtual".into(),
+                    config: json!({ "send": "message", "to": "stream1" }).into(),
+                    patterns: vec![],
+                }]
+            )
+            .await
+            .is_err(),
+    );
+}
+
+// Let's allow empty streams for now.
+// I guess it can be useful to have manual only actions.
+//
+// #[tokio::test]
+// async fn conf_empty_stream() {
+//     assert!(
+//         Plugin::default()
+//             .load_config(
+//                 vec![StreamConfig {
+//                     stream_name: "stream".into(),
+//                     stream_type: "virtual".into(),
+//                     config: Value::Null,
+//                 }],
+//                 vec![],
+//             )
+//             .await
+//             .is_err(),
+//     );
+// }
+
+#[tokio::test]
+async fn run_simple() {
+    let mut plugin = Plugin::default();
+    let (mut streams, mut actions) = plugin
+        .load_config(
+            vec![StreamConfig {
+                stream_name: "stream".into(),
+                stream_type: "virtual".into(),
+                config: Value::Null,
+            }],
+            vec![ActionConfig {
+                stream_name: "stream".into(),
+                filter_name: "filter".into(),
+                action_name: "action".into(),
+                action_type: "virtual".into(),
+                config: json!({ "send": "message <test>", "to": "stream" }).into(),
+                patterns: vec!["test".into()],
+            }],
+        )
+        .await
+        .unwrap();
+
+    let mut stream = streams.pop().unwrap();
+    let action = actions.pop().unwrap();
+    assert!(!stream.standalone);
+
+    for m in ["test1", "test2", "test3", "  a   a a aa a a"] {
+        let time = SystemTime::now().duration_since(UNIX_EPOCH).unwrap();
+        assert!(
+            action
+                .tx
+                .send(Exec {
+                    match_: vec![m.into()],
+                    time,
+                })
+                .await
+                .is_ok()
+        );
+        assert_eq!(
+            stream.stream.recv().await.unwrap().unwrap(),
+            (format!("message {m}"), time),
+        );
+    }
+}
+
+#[tokio::test]
+async fn run_two_actions() {
+    let mut plugin = Plugin::default();
+    let (mut streams, mut actions) = plugin
+        .load_config(
+            vec![StreamConfig {
+                stream_name: "stream".into(),
+                stream_type: "virtual".into(),
+                config: Value::Null,
+            }],
+            vec![
+                ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "virtual".into(),
+                    config: json!({ "send": "send <a>", "to": "stream" }).into(),
+                    patterns: vec!["a".into(), "b".into()],
+                },
+                ActionConfig {
+                    stream_name: "stream".into(),
+                    filter_name: "filter".into(),
+                    action_name: "action".into(),
+                    action_type: "virtual".into(),
+                    config: json!({ "send": "<b> send", "to": "stream" }).into(),
+                    patterns: vec!["a".into(), "b".into()],
+                },
+            ],
+        )
+        .await
+        .unwrap();
+
+    let mut stream = streams.pop().unwrap();
+    assert!(!stream.standalone);
+
+    let action2 = actions.pop().unwrap();
+    let action1 = actions.pop().unwrap();
+
+    let time = SystemTime::now().duration_since(UNIX_EPOCH).unwrap();
+
+    assert!(
+        action1
+            .tx
+            .send(Exec {
+                match_: vec!["aa".into(), "bb".into()],
+                time,
+            })
+            .await
+            .is_ok(),
+    );
+    assert_eq!(
+        stream.stream.recv().await.unwrap().unwrap(),
+        ("send aa".into(), time),
+    );
+
+    assert!(
+        action2
+            .tx
+            .send(Exec {
+                match_: vec!["aa".into(), "bb".into()],
+                time,
+            })
+            .await
+            .is_ok(),
+    );
+    assert_eq!(
+        stream.stream.recv().await.unwrap().unwrap(),
+        ("bb send".into(), time),
+    );
+}
diff --git a/plugins/reaction-plugin/Cargo.toml b/plugins/reaction-plugin/Cargo.toml
new file mode 100644
index 0000000..0fa3a38
--- /dev/null
+++ b/plugins/reaction-plugin/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "reaction-plugin"
+version = "1.0.0"
+edition = "2024"
+authors = ["ppom <reaction@ppom.me>"]
+license = "AGPL-3.0"
+homepage = "https://reaction.ppom.me"
+repository = "https://framagit.org/ppom/reaction"
+keywords = ["security", "sysadmin", "logs", "monitoring", "plugin"]
+categories = ["security"]
+description = "Plugin interface for reaction, a daemon that scans logs and takes action (alternative to fail2ban)"
+
+[dependencies]
+remoc.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+tokio.features = ["io-std", "signal"]
+tokio-util.workspace = true
+tokio-util.features = ["rt"]
diff --git a/plugins/reaction-plugin/src/lib.rs b/plugins/reaction-plugin/src/lib.rs
new file mode 100644
index 0000000..113494a
--- /dev/null
+++ b/plugins/reaction-plugin/src/lib.rs
@@ -0,0 +1,599 @@
+//! This crate defines the API between reaction's core and plugins.
+//!
+//! Plugins must be written in Rust, for now.
+//!
+//! This documentation assumes the reader has some knowledge of Rust.
+//! However, if you find that something is unclear, don't hesitate to
+//! [ask for help](https://framagit.org/ppom/reaction/#help), even if you're new to Rust.
+//!
+//! To implement a plugin, one has to provide an implementation of [`PluginInfo`], that provides
+//! the entrypoint for a plugin.
+//! It permits to define `0` to `n` custom stream and action types.
+//!
+//! ## Note on reaction-plugin API stability
+//!
+//! This is the v1 of reaction's plugin interface.
+//! It's quite efficient and complete, but it has the big drawback of being Rust-only and [`tokio`]-only.
+//!
+//! In the future, I'd like to define a language-agnostic interface, which will be a major breaking change in the API.
+//! However, I'll try my best to reduce the necessary code changes for plugins that use this v1.
+//!
+//! ## Naming & calling conventions
+//!
+//! Your plugin should be named `reaction-plugin-$NAME`, eg. `reaction-plugin-postgresql`.
+//! It will be invoked with one positional argument "serve".
+//! ```bash
+//! reaction-plugin-$NAME serve
+//! ```
+//! This can be useful if you want to provide CLI functionnality to your users,
+//! so you can distinguish between a human user and reaction.
+//!
+//! ### State directory
+//!
+//! It will be executed in its own directory, in which it should have write access.
+//! The directory is `$reaction_state_directory/plugin_data/$NAME`.
+//! reaction's [state_directory](https://reaction.ppom.me/reference.html#state_directory)
+//! defaults to its working directory, which is `/var/lib/reaction` in most setups.
+//!
+//! So your plugin directory should most often be `/var/lib/reaction/plugin_data/$NAME`,
+//! but the plugin shouldn't expect that and use the current working directory instead.
+//!
+//! ## Communication
+//!
+//! Communication between the plugin and reaction is based on [`remoc`], which permits to multiplex channels and remote objects/functions/trait
+//! calls over a single transport channel.
+//! The channels read and write channels are stdin and stdout, so you shouldn't use them for something else.
+//!
+//! [`remoc`] builds upon [`tokio`], so you'll need to use tokio too.
+//!
+//! ### Errors
+//!
+//! Errors during:
+//! - config loading in [`PluginInfo::load_config`]
+//! - startup in [`PluginInfo::start`]
+//!
+//! should be returned to reaction by the function's return value, permitting reaction to abort startup.
+//!
+//! During normal runtime, after the plugin has loaded its config and started, and before reaction is quitting, there is no *rusty* way to send errors to reaction.
+//! Then errors can be printed to stderr.
+//! They'll be captured line by line and re-printed by reaction, with the plugin name prepended.
+//!
+//! A line can start with `DEBUG `, `INFO `, `WARN `, `ERROR `.
+//! If it starts with none of the above, the line is assumed to be an error.
+//!
+//! Example:
+//! Those lines:
+//! ```log
+//! WARN This is an official warning from the plugin
+//! Freeeee errrooooorrr
+//! ```
+//! Will become:
+//! ```log
+//! WARN plugin test: This is an official warning from the plugin
+//! ERROR plugin test: Freeeee errrooooorrr
+//! ```
+//!
+//! Plugins should not exit when there is an error: reaction quits only when told to do so,
+//! or if all its streams exit, and won't retry starting a failing plugin or stream.
+//! Please only exit if you're in a 100% failing state.
+//! It's considered better to continue operating in a degraded state than exiting.
+//!
+//! ## Getting started
+//!
+//! If you don't have Rust already installed, follow their [*Getting Started* documentation](https://rust-lang.org/learn/get-started/)
+//! to get rust build tools and learn about editor support.
+//!
+//! Then create a new repository with cargo:
+//!
+//! ```bash
+//! cargo new reaction-plugin-$NAME
+//! cd reaction-plugin-$NAME
+//! ```
+//!
+//! Add required dependencies:
+//!
+//! ```bash
+//! cargo add reaction-plugin tokio
+//! ```
+//!
+//! Replace `src/main.rs` with those contents:
+//!
+//! ```ignore
+//! use reaction_plugin::PluginInfo;
+//!
+//! #[tokio::main]
+//! async fn main() {
+//!     let plugin = MyPlugin::default();
+//!     reaction_plugin::main_loop(plugin).await;
+//! }
+//!
+//! #[derive(Default)]
+//! struct MyPlugin {}
+//!
+//! impl PluginInfo for MyPlugin {
+//!   // ...
+//! }
+//! ```
+//!
+//! Your IDE should now propose to implement missing members of the [`PluginInfo`] trait.
+//! Your journey starts!
+//!
+//! ## Examples
+//!
+//! Core plugins can be found here: <https://framagit.org/ppom/reaction/-/tree/main/plugins>.
+//!
+//! - The "virtual" plugin is the simplest and can serve as a good complete example that links custom stream types and custom action types.
+//! - The "ipset" plugin is a good example of an action-only plugin.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    env::args,
+    error::Error,
+    fmt::Display,
+    process::exit,
+    time::Duration,
+};
+
+use remoc::{
+    Connect, rch,
+    rtc::{self, Server},
+};
+use serde::{Deserialize, Serialize};
+use serde_json::{Number, Value as JValue};
+use tokio::io::{stdin, stdout};
+
+pub mod line;
+pub mod shutdown;
+pub mod time;
+
+/// The only trait that **must** be implemented by a plugin.
+/// It provides lists of stream, filter and action types implemented by a dynamic plugin.
+#[rtc::remote]
+pub trait PluginInfo {
+    /// Return the manifest of the plugin.
+    /// This should not be dynamic, and return always the same manifest.
+    ///
+    /// Example implementation:
+    /// ```
+    /// Ok(Manifest {
+    ///     hello: Hello::new(),
+    ///     streams: BTreeSet::from(["mystreamtype".into()]),
+    ///     actions: BTreeSet::from(["myactiontype".into()]),
+    /// })
+    /// ```
+    ///
+    /// First function called.
+    async fn manifest(&mut self) -> Result<Manifest, rtc::CallError>;
+
+    /// Load all plugin stream and action configurations.
+    /// Must error if config is invalid.
+    ///
+    /// The plugin should not start running mutable commands here:
+    /// It should be ok to quit without cleanup for now.
+    ///
+    /// Each [`StreamConfig`] from the `streams` arg should result in a corresponding [`StreamImpl`] returned, in the same order.
+    /// Each [`ActionConfig`] from the `actions` arg should result in a corresponding [`ActionImpl`] returned, in the same order.
+    ///
+    /// Function called after [`PluginInfo::manifest`].
+    async fn load_config(
+        &mut self,
+        streams: Vec<StreamConfig>,
+        actions: Vec<ActionConfig>,
+    ) -> RemoteResult<(Vec<StreamImpl>, Vec<ActionImpl>)>;
+
+    /// Notify the plugin that setup is finished, permitting a last occasion to report an error that'll make reaction exit.
+    /// All initialization (opening remote connections, starting streams, etc) should happen here.
+    ///
+    /// Function called after [`PluginInfo::load_config`].
+    async fn start(&mut self) -> RemoteResult<()>;
+
+    /// Notify the plugin that reaction is quitting and that the plugin should quit too.
+    /// A few seconds later, the plugin will receive SIGTERM.
+    /// A few seconds later, the plugin will receive SIGKILL.
+    ///
+    /// Function called after [`PluginInfo::start`], when reaction is quitting.
+    async fn close(mut self) -> RemoteResult<()>;
+}
+
+/// The config for one Stream of a type advertised by this plugin.
+///
+/// For example this user config:
+/// ```jsonnet
+/// {
+///   streams: {
+///     mystream: {
+///       type: "mystreamtype",
+///       options: {
+///         key: "value",
+///         num: 3,
+///       },
+///       // filters: ...
+///     },
+///   },
+/// }
+/// ```
+///
+/// would result in the following `StreamConfig`:
+///
+/// ```
+/// StreamConfig {
+///   stream_name: "mystream",
+///   stream_type: "mystreamtype",
+///   config: Value::Object(BTreeMap::from([
+///     ("key", Value::String("value")),
+///     ("num", Value::Integer(3)),
+///   ])),
+/// }
+/// ```
+///
+/// Don't hesitate to take advantage of [`serde_json::from_value`], to deserialize the [`Value`] into a Rust struct:
+///
+/// ```
+/// #[derive(Deserialize)]
+/// struct MyStreamOptions {
+///   key: String,
+///   num: i64,
+/// }
+///
+/// fn validate_config(stream_config: Value) -> Result<MyStreamOptions, serde_json::Error> {
+///   serde_json::from_value(stream_config.into())
+/// }
+/// ```
+#[derive(Serialize, Deserialize, Clone)]
+pub struct StreamConfig {
+    pub stream_name: String,
+    pub stream_type: String,
+    pub config: Value,
+}
+
+/// The config for one Stream of a type advertised by this plugin.
+///
+/// For example this user config:
+/// ```jsonnet
+/// {
+///   streams: {
+///     mystream: {
+///       // ...
+///       filters: {
+///         myfilter: {
+///           // ...
+///           actions: {
+///             myaction: {
+///               type: "myactiontype",
+///               options: {
+///                 boolean: true,
+///                 array: ["item"],
+///               },
+///             },
+///           },
+///         },
+///       },
+///     },
+///   },
+/// }
+/// ```
+///
+/// would result in the following `ActionConfig`:
+///
+/// ```rust
+/// ActionConfig {
+///   action_name: "myaction",
+///   action_type: "myactiontype",
+///   config: Value::Object(BTreeMap::from([
+///     ("boolean", Value::Boolean(true)),
+///     ("array", Value::Array([Value::String("item")])),
+///   ])),
+/// }
+/// ```
+///
+/// Don't hesitate to take advantage of [`serde_json::from_value`], to deserialize the [`Value`] into a Rust struct:
+///
+/// ```rust
+/// #[derive(Deserialize)]
+/// struct MyActionOptions {
+///   boolean: bool,
+///   array: Vec<String>,
+/// }
+///
+/// fn validate_config(action_config: Value) -> Result<MyActionOptions, serde_json::Error> {
+///   serde_json::from_value(action_config.into())
+/// }
+/// ```
+#[derive(Serialize, Deserialize, Clone)]
+pub struct ActionConfig {
+    pub stream_name: String,
+    pub filter_name: String,
+    pub action_name: String,
+    pub action_type: String,
+    pub config: Value,
+    pub patterns: Vec<String>,
+}
+
+/// Mandatory announcement of a plugin's protocol version, stream and action types.
+#[derive(Serialize, Deserialize)]
+pub struct Manifest {
+    // Protocol version.
+    // Just use the [`Hello::new`] constructor that uses this crate's current version.
+    pub hello: Hello,
+    /// Stream types that should be made available to reaction users
+    ///
+    /// ```jsonnet
+    /// {
+    ///   streams: {
+    ///     my_stream: {
+    ///       type: "..."
+    ///       # ↑ all those exposed types
+    ///     }
+    ///   }
+    /// }
+    /// ```
+    pub streams: BTreeSet<String>,
+    /// Action types that should be made available to reaction users
+    ///
+    /// ```jsonnet
+    /// {
+    ///   streams: {
+    ///     mystream: {
+    ///       filters: {
+    ///         myfilter: {
+    ///           actions: {
+    ///             myaction: {
+    ///               type: "myactiontype",
+    ///                # ↑ all those exposed types
+    ///             },
+    ///           },
+    ///         },
+    ///       },
+    ///     },
+    ///   },
+    /// }
+    /// ```
+    pub actions: BTreeSet<String>,
+}
+
+#[derive(Default, Serialize, Deserialize, PartialEq, Eq, PartialOrd, Ord)]
+pub struct Hello {
+    /// Major version of the protocol
+    /// Increment means breaking change
+    pub version_major: u32,
+    /// Minor version of the protocol
+    /// Increment means reaction core can handle older version plugins
+    pub version_minor: u32,
+}
+
+impl Hello {
+    /// Constructor that fills a [`Hello`] struct with [`crate`]'s version.
+    /// You should use this in your plugin [`Manifest`].
+    pub fn new() -> Hello {
+        Hello {
+            version_major: env!("CARGO_PKG_VERSION_MAJOR").parse().unwrap(),
+            version_minor: env!("CARGO_PKG_VERSION_MINOR").parse().unwrap(),
+        }
+    }
+
+    /// Used by the reaction daemon. Permits to check compatibility between two versions.
+    /// Major versions must be the same between the daemon and plugin.
+    /// Minor version of the daemon must be greater than or equal minor version of the plugin.
+    pub fn is_compatible(server: &Hello, plugin: &Hello) -> std::result::Result<(), String> {
+        if server.version_major == plugin.version_major
+            && server.version_minor >= plugin.version_minor
+        {
+            Ok(())
+        } else if plugin.version_major > server.version_major
+            || (plugin.version_major == server.version_major
+                && plugin.version_minor > server.version_minor)
+        {
+            Err("consider upgrading reaction".into())
+        } else {
+            Err("consider upgrading the plugin".into())
+        }
+    }
+}
+
+/// A clone of [`serde_json::Value`].
+/// Implements From & Into [`serde_json::Value`].
+#[derive(Serialize, Deserialize, Clone)]
+pub enum Value {
+    Null,
+    Bool(bool),
+    Integer(i64),
+    Float(f64),
+    String(String),
+    Array(Vec<Value>),
+    Object(BTreeMap<String, Value>),
+}
+
+impl From<JValue> for Value {
+    fn from(value: serde_json::Value) -> Self {
+        match value {
+            JValue::Null => Value::Null,
+            JValue::Bool(b) => Value::Bool(b),
+            JValue::Number(number) => {
+                if let Some(number) = number.as_i64() {
+                    Value::Integer(number)
+                } else if let Some(number) = number.as_f64() {
+                    Value::Float(number)
+                } else {
+                    Value::Null
+                }
+            }
+            JValue::String(s) => Value::String(s.into()),
+            JValue::Array(v) => Value::Array(v.into_iter().map(|e| e.into()).collect()),
+            JValue::Object(m) => Value::Object(m.into_iter().map(|(k, v)| (k, v.into())).collect()),
+        }
+    }
+}
+
+impl Into<JValue> for Value {
+    fn into(self) -> JValue {
+        match self {
+            Value::Null => JValue::Null,
+            Value::Bool(v) => JValue::Bool(v),
+            Value::Integer(v) => JValue::Number(v.into()),
+            Value::Float(v) => JValue::Number(Number::from_f64(v).unwrap()),
+            Value::String(v) => JValue::String(v),
+            Value::Array(v) => JValue::Array(v.into_iter().map(|e| e.into()).collect()),
+            Value::Object(m) => JValue::Object(m.into_iter().map(|(k, v)| (k, v.into())).collect()),
+        }
+    }
+}
+
+/// Represents a Stream handled by a plugin on reaction core's side.
+///
+/// During [`PluginInfo::load_config`], the plugin should create a [`remoc::rch::mpsc::channel`] of [`Line`].
+/// It will keep the sending side for itself and put the receiving side in a [`StreamImpl`].
+///
+/// The plugin should start sending [`Line`]s in the channel only after [`PluginInfo::start`] has been called by reaction core.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct StreamImpl {
+    pub stream: rch::mpsc::Receiver<Line>,
+    /// Whether this stream works standalone, or if it needs other streams or actions to be fed.
+    /// Defaults to true.
+    /// When `false`, reaction will exit if it's the last one standing.
+    #[serde(default = "_true")]
+    pub standalone: bool,
+}
+
+fn _true() -> bool {
+    true
+}
+
+/// Messages passed from the [`StreamImpl`] of a plugin to reaction core
+pub type Line = (String, Duration);
+
+// // Filters
+// // For now, plugins can't handle custom filter implementations.
+// #[derive(Serialize, Deserialize)]
+// pub struct FilterImpl {
+//     pub stream: rch::lr::Sender<Exec>,
+// }
+// #[derive(Serialize, Deserialize)]
+// pub struct Match {
+//     pub match_: String,
+//     pub result: rch::oneshot::Sender<bool>,
+// }
+
+/// Represents an Action handled by a plugin on reaction core's side.
+///
+/// During [`PluginInfo::load_config`], the plugin should create a [`remoc::rch::mpsc::channel`] of [`Exec`].
+/// It will keep the receiving side for itself and put the sending side in a [`ActionImpl`].
+///
+/// The plugin will start receiving [`Exec`]s in the channel from reaction only after [`PluginInfo::start`] has been called by reaction core.
+#[derive(Clone, Serialize, Deserialize)]
+pub struct ActionImpl {
+    pub tx: rch::mpsc::Sender<Exec>,
+}
+
+/// A [trigger](https://reaction.ppom.me/reference.html#trigger) of the Action, sent by reaction core to the plugin.
+///
+/// The plugin should perform the configured action for each received [`Exec`].
+///
+/// Any error during its execution should be logged to stderr, see [`crate#Errors`] for error handling recommandations.
+#[derive(Serialize, Deserialize)]
+pub struct Exec {
+    pub match_: Vec<String>,
+    pub time: Duration,
+}
+
+/// The main loop for a plugin.
+///
+/// Bootstraps the communication with reaction core on the process' stdin and stdout,
+/// then holds the connection and maintains the plugin in a server state.
+///
+/// Your main function should only create a struct that implements [`PluginInfo`]
+/// and then call [`main_loop`]:
+/// ```ignore
+/// #[tokio::main]
+/// async fn main() {
+///     let plugin = MyPlugin::default();
+///     reaction_plugin::main_loop(plugin).await;
+/// }
+/// ```
+pub async fn main_loop<T: PluginInfo + Send + Sync + 'static>(plugin_info: T) {
+    // First check that we're called by reaction
+    let mut args = args();
+    // skip 0th argument
+    let _skip = args.next();
+    if args.next().is_none_or(|arg| arg != "serve") {
+        eprintln!("This plugin is not meant to be called as-is.");
+        eprintln!(
+            "reaction daemon starts plugins itself and communicates with them on stdin, stdout and stderr."
+        );
+        eprintln!("See the doc on plugin configuration: https://reaction.ppom.me/plugins/");
+        exit(1);
+    } else {
+        let (conn, mut tx, _rx): (
+            _,
+            remoc::rch::base::Sender<PluginInfoClient>,
+            remoc::rch::base::Receiver<()>,
+        ) = Connect::io(remoc::Cfg::default(), stdin(), stdout())
+            .await
+            .unwrap();
+
+        let (server, client) = PluginInfoServer::new(plugin_info, 1);
+
+        let (res1, (_, res2), res3) = tokio::join!(tx.send(client), server.serve(), conn);
+        let mut exit_code = 0;
+        if let Err(err) = res1 {
+            eprintln!("ERROR could not send plugin info to reaction: {err}");
+            exit_code = 1;
+        }
+        if let Err(err) = res2 {
+            eprintln!("ERROR could not launch plugin service for reaction: {err}");
+            exit_code = 2;
+        }
+        if let Err(err) = res3 {
+            eprintln!("ERROR connection error with reaction: {err}");
+            exit_code = 3;
+        }
+        exit(exit_code);
+    }
+}
+
+// Errors
+
+pub type RemoteResult<T> = Result<T, RemoteError>;
+
+/// reaction-plugin's Error type.
+#[derive(Debug, Serialize, Deserialize)]
+pub enum RemoteError {
+    /// A connection error that origins from [`remoc`], the crate used for communication on the plugin's `stdin`/`stdout`.
+    ///
+    /// You should not instantiate this type of error yourself.
+    Remoc(rtc::CallError),
+    /// A free String for application-specific errors.
+    ///
+    /// You should only instantiate this type of error yourself, for any error that you encounter at startup and shutdown.
+    ///
+    /// Otherwise, any error during the plugin's runtime should be logged to stderr, see [`crate#Errors`] for error handling recommandations.
+    Plugin(String),
+}
+
+impl Display for RemoteError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            RemoteError::Remoc(call_error) => write!(f, "communication error: {call_error}"),
+            RemoteError::Plugin(err) => write!(f, "{err}"),
+        }
+    }
+}
+
+impl Error for RemoteError {}
+
+impl From<String> for RemoteError {
+    fn from(value: String) -> Self {
+        Self::Plugin(value)
+    }
+}
+
+impl From<&str> for RemoteError {
+    fn from(value: &str) -> Self {
+        Self::Plugin(value.into())
+    }
+}
+
+impl From<rtc::CallError> for RemoteError {
+    fn from(value: rtc::CallError) -> Self {
+        Self::Remoc(value)
+    }
+}
diff --git a/plugins/reaction-plugin/src/line.rs b/plugins/reaction-plugin/src/line.rs
new file mode 100644
index 0000000..7b315d0
--- /dev/null
+++ b/plugins/reaction-plugin/src/line.rs
@@ -0,0 +1,237 @@
+//! Helper module that permits to use templated lines (ie. `bad password for <ip>`), like in Stream's and Action's `cmd`.
+//!
+//! Corresponding reaction core settings:
+//! - [Stream's `cmd`](https://reaction.ppom.me/reference.html#cmd)
+//! - [Action's `cmd`](https://reaction.ppom.me/reference.html#cmd-1)
+//!
+#[derive(Debug, PartialEq, Eq)]
+enum SendItem {
+    Index(usize),
+    Str(String),
+}
+
+impl SendItem {
+    fn min_size(&self) -> usize {
+        match self {
+            Self::Index(_) => 0,
+            Self::Str(s) => s.len(),
+        }
+    }
+}
+
+/// Helper struct that permits to transform a template line with patterns into an instantiated line from a match.
+///
+/// Useful when you permit the user to reconstruct lines from an action, like in reaction's native actions and in the virtual plugin:
+/// ```yaml
+/// actions:
+///   native:
+///     cmd: ["iptables", "...", "<ip>"]
+///
+///   virtual:
+///     type: virtual
+///     options:
+///       send: "<ip>: bad password on user <user>"
+///       to: "my_virtual_stream"
+/// ```
+///
+/// Usage example:
+/// ```
+/// # use reaction_plugin::line::PatternLine;
+/// #
+/// let template = "<ip>: bad password on user <user>".to_string();
+/// let patterns = vec!["ip".to_string(), "user".to_string()];
+/// let pattern_line = PatternLine::new(template, patterns);
+///
+/// assert_eq!(
+///   pattern_line.line(vec!["1.2.3.4".to_string(), "root".to_string()]),
+///   "1.2.3.4: bad password on user root".to_string(),
+/// );
+/// ```
+///
+/// You can find full examples in those plugins:
+/// `reaction-plugin-virtual`,
+/// `reaction-plugin-cluster`.
+///
+#[derive(Debug)]
+pub struct PatternLine {
+    line: Vec<SendItem>,
+    min_size: usize,
+}
+
+impl PatternLine {
+    /// Construct [`PatternLine`] from a template line and the list of patterns of the underlying [Filter](https://reaction.ppom.me/reference.html#filter).
+    ///
+    /// This list of patterns comes from [`super::ActionConfig`].
+    pub fn new(template: String, patterns: Vec<String>) -> Self {
+        let line = Self::_from(patterns, Vec::from([SendItem::Str(template)]));
+        Self {
+            min_size: line.iter().map(SendItem::min_size).sum(),
+            line,
+        }
+    }
+    fn _from(mut patterns: Vec<String>, acc: Vec<SendItem>) -> Vec<SendItem> {
+        match patterns.pop() {
+            None => acc,
+            Some(pattern) => {
+                let enclosed_pattern = format!("<{pattern}>");
+                let acc = acc
+                    .into_iter()
+                    .flat_map(|item| match &item {
+                        SendItem::Index(_) => vec![item],
+                        SendItem::Str(str) => match str.find(&enclosed_pattern) {
+                            Some(i) => {
+                                let pattern_index = patterns.len();
+                                let mut ret = vec![];
+
+                                let (left, mid) = str.split_at(i);
+                                if !left.is_empty() {
+                                    ret.push(SendItem::Str(left.into()))
+                                }
+
+                                ret.push(SendItem::Index(pattern_index));
+
+                                if mid.len() > enclosed_pattern.len() {
+                                    let (_, right) = mid.split_at(enclosed_pattern.len());
+                                    ret.push(SendItem::Str(right.into()))
+                                }
+
+                                ret
+                            }
+                            None => vec![item],
+                        },
+                    })
+                    .collect();
+                Self::_from(patterns, acc)
+            }
+        }
+    }
+
+    pub fn line(&self, match_: Vec<String>) -> String {
+        let mut res = String::with_capacity(self.min_size);
+        for item in &self.line {
+            match item {
+                SendItem::Index(i) => {
+                    if let Some(element) = match_.get(*i) {
+                        res.push_str(element);
+                    }
+                }
+                SendItem::Str(str) => res.push_str(str),
+            }
+        }
+        res
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::line::{PatternLine, SendItem};
+
+    #[test]
+    fn line_0_pattern() {
+        let msg = "my message".to_string();
+        let line = PatternLine::new(msg.clone(), vec![]);
+        assert_eq!(line.line, vec![SendItem::Str(msg.clone())]);
+        assert_eq!(line.min_size, msg.len());
+        assert_eq!(line.line(vec![]), msg.clone());
+    }
+
+    #[test]
+    fn line_1_pattern() {
+        let patterns = vec![
+            "ignored".into(),
+            "oh".into(),
+            "ignored".into(),
+            "my".into(),
+            "test".into(),
+        ];
+
+        let matches = vec!["yay", "oh", "my", "test", "<oh>", "<my>", "<test>"];
+
+        let tests = [
+            (
+                "<oh> my test",
+                1,
+                vec![SendItem::Index(1), SendItem::Str(" my test".into())],
+                vec![
+                    ("yay", "yay my test"),
+                    ("oh", "oh my test"),
+                    ("my", "my my test"),
+                    ("test", "test my test"),
+                    ("<oh>", "<oh> my test"),
+                    ("<my>", "<my> my test"),
+                    ("<test>", "<test> my test"),
+                ],
+            ),
+            (
+                "oh <my> test",
+                3,
+                vec![
+                    SendItem::Str("oh ".into()),
+                    SendItem::Index(3),
+                    SendItem::Str(" test".into()),
+                ],
+                vec![
+                    ("yay", "oh yay test"),
+                    ("oh", "oh oh test"),
+                    ("my", "oh my test"),
+                    ("test", "oh test test"),
+                    ("<oh>", "oh <oh> test"),
+                    ("<my>", "oh <my> test"),
+                    ("<test>", "oh <test> test"),
+                ],
+            ),
+            (
+                "oh my <test>",
+                4,
+                vec![SendItem::Str("oh my ".into()), SendItem::Index(4)],
+                vec![
+                    ("yay", "oh my yay"),
+                    ("oh", "oh my oh"),
+                    ("my", "oh my my"),
+                    ("test", "oh my test"),
+                    ("<oh>", "oh my <oh>"),
+                    ("<my>", "oh my <my>"),
+                    ("<test>", "oh my <test>"),
+                ],
+            ),
+        ];
+
+        for (msg, index, expected_pl, lines) in tests {
+            let pattern_line = PatternLine::new(msg.to_string(), patterns.clone());
+            assert_eq!(pattern_line.line, expected_pl);
+
+            for (match_element, line) in lines {
+                for match_default in &matches {
+                    let mut match_ = vec![
+                        match_default.to_string(),
+                        match_default.to_string(),
+                        match_default.to_string(),
+                        match_default.to_string(),
+                        match_default.to_string(),
+                    ];
+                    match_[index] = match_element.to_string();
+                    assert_eq!(
+                        pattern_line.line(match_.clone()),
+                        line,
+                        "match: {match_:?}, pattern_line: {pattern_line:?}"
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn line_2_pattern() {
+        let pattern_line = PatternLine::new("<a> ; <b>".into(), vec!["a".into(), "b".into()]);
+
+        let matches = ["a", "b", "ab", "<a>", "<b>"];
+        for a in &matches {
+            for b in &matches {
+                assert_eq!(
+                    pattern_line.line(vec![a.to_string(), b.to_string()]),
+                    format!("{a} ; {b}"),
+                );
+            }
+        }
+    }
+}
diff --git a/plugins/reaction-plugin/src/shutdown.rs b/plugins/reaction-plugin/src/shutdown.rs
new file mode 100644
index 0000000..fb4bb40
--- /dev/null
+++ b/plugins/reaction-plugin/src/shutdown.rs
@@ -0,0 +1,162 @@
+//! Helper module that provides structures to ease the quitting process when having multiple tokio tasks.
+//!
+//! It defines a [`ShutdownController`], that permits to keep track of ongoing tasks, ask them to shutdown and wait for all of them to quit.
+//!
+//! You can have it as an attribute of your plugin struct.
+//! ```
+//! struct MyPlugin {
+//!   shutdown: ShutdownController
+//! }
+//! ```
+//!
+//! You can then give a [`ShutdownToken`] to other tasks when creating them:
+//!
+//! ```
+//! impl PluginInfo for MyPlugin {
+//!     async fn start(&mut self) -> RemoteResult<()> {
+//!         let token = self.shutdown.token();
+//!
+//!         tokio::spawn(async move {
+//!            token.wait().await;
+//!            eprintln!("DEBUG shutdown asked to quit, now quitting")
+//!         })
+//!     }
+//! }
+//! ```
+//!
+//! On closing, calling [`ShutdownController::ask_shutdown`] will inform all tasks waiting on [`ShutdownToken::wait`] that it's time to leave.
+//! Then we can wait for [`ShutdownController::wait_all_task_shutdown`] to complete.
+//!
+//! ```
+//! impl PluginInfo for MyPlugin {
+//!     async fn close(self) -> RemoteResult<()> {
+//!         self.shutdown.ask_shutdown();
+//!         self.shutdown.wait_all_task_shutdown().await;
+//!         Ok(())
+//!     }
+//! }
+//! ```
+//!
+//! [`ShutdownDelegate::handle_quit_signals`] permits to handle SIGHUP, SIGINT and SIGTERM by gracefully shutting down tasks.
+
+use tokio::signal::unix::{SignalKind, signal};
+use tokio_util::{
+    sync::{CancellationToken, WaitForCancellationFuture},
+    task::task_tracker::{TaskTracker, TaskTrackerToken},
+};
+
+/// Permits to keep track of ongoing tasks, ask them to shutdown and wait for all of them to quit.
+/// Stupid wrapper around [`tokio_util::sync::CancellationToken`] and [`tokio_util::task::task_tracker::TaskTracker`].
+#[derive(Default, Clone)]
+pub struct ShutdownController {
+    shutdown_notifyer: CancellationToken,
+    task_tracker: TaskTracker,
+}
+
+impl ShutdownController {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Ask for all tasks to quit
+    pub fn ask_shutdown(&self) {
+        self.shutdown_notifyer.cancel();
+        self.task_tracker.close();
+    }
+
+    /// Wait for all tasks to quit.
+    /// This task may return even without having called [`ShutdownController::ask_shutdown`]
+    /// first, if all tasks quit by themselves.
+    pub async fn wait_all_task_shutdown(self) {
+        self.task_tracker.close();
+        self.task_tracker.wait().await;
+    }
+
+    /// Returns a new shutdown token, to be held by a task.
+    pub fn token(&self) -> ShutdownToken {
+        ShutdownToken::new(self.shutdown_notifyer.clone(), self.task_tracker.token())
+    }
+
+    /// Returns a [`ShutdownDelegate`], which is able to ask for shutdown,
+    /// without counting as a task that needs to be awaited.
+    pub fn delegate(&self) -> ShutdownDelegate {
+        ShutdownDelegate(self.shutdown_notifyer.clone())
+    }
+
+    /// Returns a future that will resolve only when a shutdown request happened.
+    pub fn wait(&self) -> WaitForCancellationFuture<'_> {
+        self.shutdown_notifyer.cancelled()
+    }
+}
+
+/// Permits to ask for shutdown, without counting as a task that needs to be awaited.
+pub struct ShutdownDelegate(CancellationToken);
+
+impl ShutdownDelegate {
+    /// Ask for all tasks to quit
+    pub fn ask_shutdown(&self) {
+        self.0.cancel();
+    }
+
+    /// Ensure [`Self::ask_shutdown`] is called whenever we receive SIGHUP,
+    /// SIGTERM or SIGINT. Spawns a task that consumes self.
+    pub fn handle_quit_signals(self) -> Result<(), String> {
+        let err_str = |err| format!("could not register signal: {err}");
+
+        let mut sighup = signal(SignalKind::hangup()).map_err(err_str)?;
+        let mut sigint = signal(SignalKind::interrupt()).map_err(err_str)?;
+        let mut sigterm = signal(SignalKind::terminate()).map_err(err_str)?;
+
+        tokio::spawn(async move {
+            let signal = tokio::select! {
+                _ = sighup.recv() => "SIGHUP",
+                _ = sigint.recv() => "SIGINT",
+                _ = sigterm.recv() => "SIGTERM",
+            };
+            eprintln!("received {signal}, closing...");
+            self.ask_shutdown();
+        });
+        Ok(())
+    }
+}
+
+/// Created by a [`ShutdownController`].
+/// Serves two purposes:
+///
+/// - Wait for a shutdown request to happen with [`Self::wait`]
+/// - Keep track of the current task. While this token is held,
+///   [`ShutdownController::wait_all_task_shutdown`] will block.
+#[derive(Clone)]
+pub struct ShutdownToken {
+    shutdown_notifyer: CancellationToken,
+    _task_tracker_token: TaskTrackerToken,
+}
+
+impl ShutdownToken {
+    fn new(shutdown_notifyer: CancellationToken, _task_tracker_token: TaskTrackerToken) -> Self {
+        Self {
+            shutdown_notifyer,
+            _task_tracker_token,
+        }
+    }
+
+    /// Returns underlying [`CancellationToken`] and [`TaskTrackerToken`], consuming self.
+    pub fn split(self) -> (CancellationToken, TaskTrackerToken) {
+        (self.shutdown_notifyer, self._task_tracker_token)
+    }
+
+    /// Returns a future that will resolve only when a shutdown request happened.
+    pub fn wait(&self) -> WaitForCancellationFuture<'_> {
+        self.shutdown_notifyer.cancelled()
+    }
+
+    /// Returns true if the shutdown request happened
+    pub fn is_shutdown(&self) -> bool {
+        self.shutdown_notifyer.is_cancelled()
+    }
+
+    /// Ask for all tasks to quit
+    pub fn ask_shutdown(&self) {
+        self.shutdown_notifyer.cancel();
+    }
+}
diff --git a/src/concepts/parse_duration.rs b/plugins/reaction-plugin/src/time.rs
similarity index 52%
rename from src/concepts/parse_duration.rs
rename to plugins/reaction-plugin/src/time.rs
index f42db64..60f5914 100644
--- a/src/concepts/parse_duration.rs
+++ b/plugins/reaction-plugin/src/time.rs
@@ -1,7 +1,13 @@
-use chrono::TimeDelta;
+//! This module provides [`parse_duration`], which parses duration in reaction's format (ie. `6h`, `3 days`)
+//!
+//! Like in those reaction core settings:
+//! - [Filters' `retryperiod`](https://reaction.ppom.me/reference.html#retryperiod)
+//! - [Actions' `after`](https://reaction.ppom.me/reference.html#after).
+
+use std::time::Duration;
 
 /// Parses the &str argument as a Duration
-/// Returns Ok(TimeDelta) if successful, or Err(String).
+/// Returns Ok(Duration) if successful, or Err(String).
 ///
 /// Format is defined as follows: `<integer> <unit>`
 /// - whitespace between the integer and unit is optional
@@ -12,7 +18,7 @@ use chrono::TimeDelta;
 ///   - `m` / `min` / `mins` / `minute` / `minutes`
 ///   - `h` / `hour` / `hours`
 ///   - `d` / `day` / `days`
-pub fn parse_duration(d: &str) -> Result<TimeDelta, String> {
+pub fn parse_duration(d: &str) -> Result<Duration, String> {
     let d_trimmed = d.trim();
     let chars = d_trimmed.as_bytes();
     let mut value = 0;
@@ -24,14 +30,14 @@ pub fn parse_duration(d: &str) -> Result<TimeDelta, String> {
     if i == 0 {
         return Err(format!("duration '{}' doesn't start with digits", d));
     }
-    let ok_as = |func: fn(i64) -> TimeDelta| -> Result<_, String> { Ok(func(value as i64)) };
+    let ok_as = |func: fn(u64) -> Duration| -> Result<_, String> { Ok(func(value as u64)) };
 
     match d_trimmed[i..].trim() {
-        "ms" | "millis" | "millisecond" | "milliseconds" => ok_as(TimeDelta::milliseconds),
-        "s" | "sec" | "secs" | "second" | "seconds" => ok_as(TimeDelta::seconds),
-        "m" | "min" | "mins" | "minute" | "minutes" => ok_as(TimeDelta::minutes),
-        "h" | "hour" | "hours" => ok_as(TimeDelta::hours),
-        "d" | "day" | "days" => ok_as(TimeDelta::days),
+        "ms" | "millis" | "millisecond" | "milliseconds" => ok_as(Duration::from_millis),
+        "s" | "sec" | "secs" | "second" | "seconds" => ok_as(Duration::from_secs),
+        "m" | "min" | "mins" | "minute" | "minutes" => ok_as(Duration::from_mins),
+        "h" | "hour" | "hours" => ok_as(Duration::from_hours),
+        "d" | "day" | "days" => ok_as(|d: u64| Duration::from_hours(d * 24)),
         unit => Err(format!(
             "unit {} not recognised. must be one of s/sec/seconds, m/min/minutes, h/hours, d/days",
             unit
@@ -42,8 +48,6 @@ pub fn parse_duration(d: &str) -> Result<TimeDelta, String> {
 #[cfg(test)]
 mod tests {
 
-    use chrono::TimeDelta;
-
     use super::*;
 
     #[test]
@@ -53,13 +57,13 @@ mod tests {
 
     #[test]
     fn parse_duration_test() {
-        assert_eq!(parse_duration("1s"), Ok(TimeDelta::seconds(1)));
-        assert_eq!(parse_duration("12s"), Ok(TimeDelta::seconds(12)));
-        assert_eq!(parse_duration("  12  secs  "), Ok(TimeDelta::seconds(12)));
-        assert_eq!(parse_duration("2m"), Ok(TimeDelta::minutes(2)));
-        assert_eq!(parse_duration("6 hours"), Ok(TimeDelta::hours(6)));
-        assert_eq!(parse_duration("1d"), Ok(TimeDelta::days(1)));
-        assert_eq!(parse_duration("365d"), Ok(TimeDelta::days(365)));
+        assert_eq!(parse_duration("1s"), Ok(Duration::from_secs(1)));
+        assert_eq!(parse_duration("12s"), Ok(Duration::from_secs(12)));
+        assert_eq!(parse_duration("  12  secs  "), Ok(Duration::from_secs(12)));
+        assert_eq!(parse_duration("2m"), Ok(Duration::from_mins(2)));
+        assert_eq!(parse_duration("6 hours"), Ok(Duration::from_hours(6)));
+        assert_eq!(parse_duration("1d"), Ok(Duration::from_hours(1 * 24)));
+        assert_eq!(parse_duration("365d"), Ok(Duration::from_hours(365 * 24)));
 
         assert!(parse_duration("d 3").is_err());
         assert!(parse_duration("d3").is_err());
diff --git a/release.py b/release.py
index 8567551..8359c7a 100644
--- a/release.py
+++ b/release.py
@@ -1,11 +1,11 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ requests ])" -p debian-devscripts git minisign cargo-cross rustup cargo-deb
+#!nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ requests ])" -p debian-devscripts git minisign docker cargo-deb
 import argparse
 import http.client
 import json
 import os
-import subprocess
 import shutil
+import subprocess
 import sys
 import tempfile
 
@@ -56,14 +56,14 @@ def main():
         print("exiting.")
         sys.exit(1)
 
+    # Minisign password
+    cmd = subprocess.run(["rbw", "get", "minisign"], capture_output=True, text=True)
+    minisign_password = cmd.stdout
+
     if args.publish:
         # Git push
         run_command(["git", "push", "--tags"])
 
-        # Minisign password
-        cmd = subprocess.run(["rbw", "get", "minisign"], capture_output=True, text=True)
-        minisign_password = cmd.stdout
-
         # Create directory
         run_command(
             [
@@ -86,9 +86,11 @@ def main():
             pass
 
     architectures = {
-        "x86_64-unknown-linux-musl": "amd64",
-        "aarch64-unknown-linux-musl": "arm64",
-        "arm-unknown-linux-gnueabihf": "armhf",
+        "x86_64-unknown-linux-gnu": "amd64",
+        # I would like to build for those targets instead:
+        # "x86_64-unknown-linux-musl": "amd64",
+        # "aarch64-unknown-linux-musl": "arm64",
+        # "arm-unknown-linux-gnueabihf": "armhf",
     }
 
     all_files = []
@@ -100,9 +102,8 @@ def main():
 
 You'll need to install minisign to check the authenticity of the package.
 
-After installing reaction, create your configuration file at
-`/etc/reaction.json`, `/etc/reaction.jsonnet` or `/etc/reaction.yml`.
-You can also provide a directory containing multiple configuration files in the previous formats.
+After installing reaction, create your configuration file(s) in JSON, YAML or JSONnet in the
+`/etc/reaction/` directory.
 See <https://reaction.ppom.me> for documentation.
 
 Reload systemd:
@@ -112,40 +113,63 @@ $ sudo systemctl daemon-reload
 
 Then enable and start reaction with this command
 ```bash
-# replace `reaction.jsonnet` with the name of your configuration file in /etc/
-$ sudo systemctl enable --now reaction@reaction.jsonnet.service
+# write first your configuration file(s) in /etc/reaction/
+$ sudo systemctl enable --now reaction.service
 ```
 """.strip(),
     ]
 
     for architecture_rs, architecture_pretty in architectures.items():
         # Cargo clean
-        run_command(["cargo", "clean"])
+        # run_command(["cargo", "clean"])
 
-        # Install toolchain
+        # Build docker image
+        run_command(["docker", "pull", "rust:bookworm"])
+        run_command(["docker", "build", "-t", "rust:reaction", "."])
+
+        binaries = [
+            # Binaries
+            "reaction",
+            "reaction-plugin-virtual",
+            "reaction-plugin-ipset",
+        ]
+
+        # Build
         run_command(
             [
-                "rustup",
-                "toolchain",
-                "install",
-                f"stable-{architecture_rs}",
-                "--force-non-host",  # I know, I know!
-                "--profile",
-                "minimal",
+                "docker",
+                "run",
+                "--rm",
+                "-u", str(os.getuid()),
+                "-v", ".:/reaction",
+                "rust:reaction",
+                "sh", "-c",
+                " && ".join([
+                    f"cargo build --release --target {architecture_rs} --package {binary}"
+                    for binary in binaries
+                ])
             ]
         )
 
-        # Build
-        run_command(["cross", "build", "--release", "--target", architecture_rs])
-
         # Build .deb
-        cmd = run_command(
-            ["cargo-deb", f"--target={architecture_rs}", "--no-build", "--no-strip"]
-        )
+        debs = [
+            "reaction",
+            "reaction-plugin-ipset",
+        ]
+        for deb in debs:
+            cmd = run_command(
+                [
+                    "cargo-deb",
+                    "--target", architecture_rs,
+                    "--package", deb,
+                    "--no-build",
+                    "--no-strip"
+                ]
+            )
 
         deb_dir = os.path.join("./target", architecture_rs, "debian")
-        deb_name = [f for f in os.listdir(deb_dir) if f.endswith(".deb")][0]
-        deb_path = os.path.join(deb_dir, deb_name)
+        deb_names = [f for f in os.listdir(deb_dir) if f.endswith(".deb")]
+        deb_paths = [os.path.join(deb_dir, deb_name) for deb_name in deb_names]
 
         # Archive
         files_path = os.path.join("./target", architecture_rs, "release")
@@ -159,11 +183,7 @@ $ sudo systemctl enable --now reaction@reaction.jsonnet.service
         except FileExistsError:
             pass
 
-        files = [
-            # Binaries
-            "reaction",
-            "nft46",
-            "ip46tables",
+        files = binaries + [
             # Shell completion
             "reaction.bash",
             "reaction.fish",
@@ -189,16 +209,17 @@ $ sudo systemctl enable --now reaction@reaction.jsonnet.service
 
         os.chdir(root_dir)
 
-        if args.publish:
-            # Sign
-            run_command(
-                ["minisign", "-Sm", deb_path, tar_path],
-                text=True,
-                input=minisign_password,
-            )
-            deb_sig = f"{deb_path}.minisig"
-            tar_sig = f"{tar_path}.minisig"
+        # Sign
+        run_command(
+            ["minisign", "-Sm", tar_path] + deb_paths,
+            text=True,
+            input=minisign_password,
+        )
+        deb_sig_paths = [f"{deb_path}.minisig" for deb_path in deb_paths]
+        deb_sig_names = [f"{deb_name}.minisig" for deb_name in deb_names]
+        tar_sig = f"{tar_path}.minisig"
 
+        if args.publish:
             # Push
             run_command(
                 [
@@ -206,18 +227,25 @@ $ sudo systemctl enable --now reaction@reaction.jsonnet.service
                     "-az",  # "-e", "ssh -J pica01",
                     tar_path,
                     tar_sig,
-                    deb_path,
-                    deb_sig,
+                ]
+                    + deb_paths
+                    + deb_sig_paths
+                    + [
                     f"akesi:/var/www/static/reaction/releases/{tag}/",
                 ]
             )
+        else:
+            # Copy
+            run_command(["cp", tar_path, tar_sig] + deb_paths + deb_sig_paths + [local_dir])
 
-            all_files.extend([tar_path, tar_sig, deb_path, deb_sig])
+        all_files.extend([tar_path, tar_sig])
+        all_files.extend(deb_paths)
+        all_files.extend(deb_sig_paths)
 
-            # Instructions
+        # Instructions
 
-            instructions.append(
-                f"""
+        instructions.append(
+            f"""
 ## Tar installation ({architecture_pretty} linux)
 
 ```bash
@@ -225,32 +253,42 @@ curl -O https://static.ppom.me/reaction/releases/{tag}/{tar_name} \\
      -O https://static.ppom.me/reaction/releases/{tag}/{tar_name}.minisig \\
         && minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m {tar_name} \\
         && rm {tar_name}.minisig \\
-        && cd {tar_name} \\
+        && tar xvf {tar_name} \\
+        && cd {pkg_name} \\
         && sudo make install
 ```
-        """.strip()
-            )
 
-            instructions.append(
-                f"""
+If you want to install the ipset plugin as well:
+```bash
+sudo apt install -y libipset-dev && sudo make install-ipset
+```
+""".strip()
+        )
+
+        instructions.append(
+            f"""
 ## Debian installation ({architecture_pretty} linux)
 
 ```bash
-curl -O https://static.ppom.me/reaction/releases/{tag}/{deb_name} \\
-     -O https://static.ppom.me/reaction/releases/{tag}/{deb_name}.minisig \\
-        && minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m {deb_name} \\
-        && rm {deb_name}.minisig \\
-        && sudo apt install ./{deb_name}
+curl \\
+{"\n".join([
+    f"    -O https://static.ppom.me/reaction/releases/{tag}/{deb_name} \\"
+    for deb_name in deb_names + deb_sig_names
+])}
+{"\n".join([
+    f"        && minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m {deb_name} \\"
+    for deb_name in deb_names
+])}
+        && rm {" ".join(deb_sig_names)} \\
+        && sudo apt install {" ".join([f"./{deb_name}" for deb_name in deb_names])}
 ```
 
 *You can also use [this third-party package repository](https://packages.azlux.fr).*
-        """.strip()
-            )
-        else:
-            # Copy
-            run_command(["cp", tar_path, deb_path, local_dir])
+""".strip()
+        )
 
     if not args.publish:
+        print("\n\n".join(instructions))
         return
 
     # Release
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 0000000..ecb4318
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,14 @@
+# This shell.nix for NixOS users is only needed when building reaction-plugin-ipset
+with import <nixpkgs> {};
+pkgs.mkShell {
+  name = "libipset";
+  buildInputs = [
+    ipset
+    nftables
+    clang
+  ];
+  src = null;
+  shellHook = ''
+    export LIBCLANG_PATH="$(clang -print-file-name=libclang.so)"
+  '';
+}
diff --git a/src/concepts/action.rs b/src/concepts/action.rs
index c63724e..12b0cad 100644
--- a/src/concepts/action.rs
+++ b/src/concepts/action.rs
@@ -1,23 +1,23 @@
-use std::{cmp::Ordering, collections::BTreeSet, fmt::Display, sync::Arc};
-
-use chrono::TimeDelta;
+use std::{cmp::Ordering, collections::BTreeSet, fmt::Display, sync::Arc, time::Duration};
 
+use reaction_plugin::{ActionConfig, time::parse_duration};
 use serde::{Deserialize, Serialize};
+use serde_json::Value;
 use tokio::process::Command;
 
-use super::{parse_duration::*, PatternType};
-use super::{Match, Pattern};
+use super::{Match, Pattern, PatternType};
 
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct Action {
+    #[serde(default)]
     pub cmd: Vec<String>,
 
     // TODO one shot time deserialization
     #[serde(skip_serializing_if = "Option::is_none")]
     pub after: Option<String>,
     #[serde(skip)]
-    pub after_duration: Option<TimeDelta>,
+    pub after_duration: Option<Duration>,
 
     #[serde(
         rename = "onexit",
@@ -41,6 +41,12 @@ pub struct Action {
     pub filter_name: String,
     #[serde(skip)]
     pub stream_name: String,
+
+    // Plugin-specific
+    #[serde(default, rename = "type", skip_serializing_if = "Option::is_none")]
+    pub action_type: Option<String>,
+    #[serde(default, skip_serializing_if = "Value::is_null")]
+    pub options: Value,
 }
 
 fn set_false() -> bool {
@@ -52,6 +58,12 @@ fn is_false(b: &bool) -> bool {
 }
 
 impl Action {
+    pub fn is_plugin(&self) -> bool {
+        self.action_type
+            .as_ref()
+            .is_some_and(|action_type| action_type != "cmd")
+    }
+
     pub fn setup(
         &mut self,
         stream_name: &str,
@@ -82,11 +94,18 @@ impl Action {
             return Err("character '.' is not allowed in filter name".into());
         }
 
-        if self.cmd.is_empty() {
-            return Err("cmd is empty".into());
-        }
-        if self.cmd[0].is_empty() {
-            return Err("cmd's first item is empty".into());
+        if !self.is_plugin() {
+            if self.cmd.is_empty() {
+                return Err("cmd is empty".into());
+            }
+            if self.cmd[0].is_empty() {
+                return Err("cmd's first item is empty".into());
+            }
+            if !self.options.is_null() {
+                return Err("can't define options without a plugin type".into());
+            }
+        } else if !self.cmd.is_empty() {
+            return Err("can't define a cmd and a plugin type".into());
         }
 
         if let Some(after) = &self.after {
@@ -138,6 +157,24 @@ impl Action {
         cmd.args(&computed_command[1..]);
         cmd
     }
+
+    pub fn to_action_config(&self) -> Result<ActionConfig, String> {
+        Ok(ActionConfig {
+            stream_name: self.stream_name.clone(),
+            filter_name: self.filter_name.clone(),
+            action_name: self.name.clone(),
+            action_type: self
+                .action_type
+                .clone()
+                .ok_or_else(|| format!("action {} doesn't load a plugin. this is a bug!", self))?,
+            config: self.options.clone().into(),
+            patterns: self
+                .patterns
+                .iter()
+                .map(|pattern| pattern.name.clone())
+                .collect(),
+        })
+    }
 }
 
 impl PartialEq for Action {
diff --git a/src/concepts/config.rs b/src/concepts/config.rs
index 4bee310..3080a74 100644
--- a/src/concepts/config.rs
+++ b/src/concepts/config.rs
@@ -1,5 +1,5 @@
 use std::{
-    collections::{btree_map::Entry, BTreeMap},
+    collections::{BTreeMap, btree_map::Entry},
     fs::File,
     io,
     path::Path,
@@ -11,7 +11,7 @@ use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use tracing::{debug, error, info, warn};
 
-use super::{Pattern, Stream};
+use super::{Pattern, Plugin, Stream, merge_attrs};
 
 pub type Patterns = BTreeMap<String, Arc<Pattern>>;
 
@@ -24,6 +24,9 @@ pub struct Config {
     #[serde(default = "dot", skip_serializing_if = "String::is_empty")]
     pub state_directory: String,
 
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub plugins: BTreeMap<String, Plugin>,
+
     #[serde(default)]
     pub patterns: Patterns,
 
@@ -46,13 +49,30 @@ fn dot() -> String {
 
 impl Config {
     fn merge(&mut self, mut other: Config) -> Result<(), String> {
+        for (key, plugin) in other.plugins.into_iter() {
+            match self.plugins.entry(key) {
+                Entry::Vacant(e) => {
+                    e.insert(plugin);
+                }
+                Entry::Occupied(e) => {
+                    return Err(format!(
+                        "plugin {} is already defined. plugin definitions can't be spread accross multiple files.",
+                        e.key()
+                    ));
+                }
+            }
+        }
+
         for (key, pattern) in other.patterns.into_iter() {
             match self.patterns.entry(key) {
                 Entry::Vacant(e) => {
                     e.insert(pattern);
                 }
                 Entry::Occupied(e) => {
-                    return Err(format!("pattern {} is already defined. pattern definitions can't be spread accross multiple files.", e.key()));
+                    return Err(format!(
+                        "pattern {} is already defined. pattern definitions can't be spread accross multiple files.",
+                        e.key()
+                    ));
                 }
             }
         }
@@ -73,25 +93,19 @@ impl Config {
         self.start.append(&mut other.start);
         self.stop.append(&mut other.stop);
 
-        if !(self.state_directory == dot()
-            || other.state_directory == dot()
-            || self.state_directory == other.state_directory)
-        {
-            return Err("state_directory have conflicting definitions".into());
-        }
-        if self.state_directory == dot() {
-            self.state_directory = other.state_directory;
-        }
+        self.state_directory = merge_attrs(
+            self.state_directory.clone(),
+            other.state_directory,
+            ".".into(),
+            "state_directory",
+        )?;
 
-        if !(self.concurrency == num_cpus::get()
-            || other.concurrency == num_cpus::get()
-            || self.concurrency == other.concurrency)
-        {
-            return Err("concurrency have conflicting definitions".into());
-        }
-        if self.concurrency == num_cpus::get() {
-            self.concurrency = other.concurrency;
-        }
+        self.concurrency = merge_attrs(
+            self.concurrency,
+            other.concurrency,
+            num_cpus::get(),
+            "concurrency",
+        )?;
 
         Ok(())
     }
@@ -104,6 +118,10 @@ impl Config {
         // Nullify this useless field
         self._definitions = serde_json::Value::Null;
 
+        for (key, value) in &mut self.plugins {
+            value.setup(key)?;
+        }
+
         if self.patterns.is_empty() {
             return Err("no patterns configured".into());
         }
@@ -327,7 +345,7 @@ enum ConfigError {
 mod jsonnet {
     use std::path::Path;
 
-    use jrsonnet_evaluator::{error::LocError, EvaluationState, FileImportResolver};
+    use jrsonnet_evaluator::{EvaluationState, FileImportResolver, error::LocError};
 
     use super::ConfigError;
 
diff --git a/src/concepts/filter.rs b/src/concepts/filter.rs
index fef8391..52fc41f 100644
--- a/src/concepts/filter.rs
+++ b/src/concepts/filter.rs
@@ -4,14 +4,14 @@ use std::{
     fmt::Display,
     hash::Hash,
     sync::Arc,
+    time::Duration,
 };
 
-use chrono::TimeDelta;
+use reaction_plugin::time::parse_duration;
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
-use super::{parse_duration, PatternType};
-use super::{Action, Match, Pattern, Patterns};
+use super::{Action, Match, Pattern, PatternType, Patterns};
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Deserialize, Serialize)]
 pub enum Duplicate {
@@ -30,7 +30,7 @@ pub enum Duplicate {
 #[serde(deny_unknown_fields)]
 pub struct Filter {
     #[serde(skip)]
-    pub longuest_action_duration: TimeDelta,
+    pub longuest_action_duration: Duration,
     #[serde(skip)]
     pub has_ip: bool,
 
@@ -47,7 +47,7 @@ pub struct Filter {
     #[serde(rename = "retryperiod", skip_serializing_if = "Option::is_none")]
     pub retry_period: Option<String>,
     #[serde(skip)]
-    pub retry_duration: Option<TimeDelta>,
+    pub retry_duration: Option<Duration>,
 
     #[serde(default)]
     pub duplicate: Duplicate,
@@ -58,6 +58,11 @@ pub struct Filter {
     pub name: String,
     #[serde(skip)]
     pub stream_name: String,
+    // // Plugin-specific
+    // #[serde(default, rename = "type")]
+    // pub filter_type: Option<String>,
+    // #[serde(default = "null_value")]
+    // pub options: Value,
 }
 
 impl Filter {
@@ -121,7 +126,7 @@ impl Filter {
         if let Some(retry_period) = &self.retry_period {
             self.retry_duration = Some(
                 parse_duration(retry_period)
-                    .map_err(|err| format!("failed to parse retry time: {}", err))?,
+                    .map_err(|err| format!("failed to parse retry period: {}", err))?,
             );
             self.retry_period = None;
         }
@@ -155,9 +160,9 @@ impl Filter {
                     }
                 } else if !first && new_patterns.contains(pattern) {
                     return Err(format!(
-                            "pattern {} is present in the first regex but is not present in a following regex. all regexes should contain the same set of regexes",
-                            &pattern.name_with_braces()
-                        ));
+                        "pattern {} is present in the first regex but is not present in a following regex. all regexes should contain the same set of regexes",
+                        &pattern.name_with_braces()
+                    ));
                 }
                 regex_buf = regex_buf.replacen(pattern.name_with_braces(), &pattern.regex, 1);
             }
@@ -182,10 +187,12 @@ impl Filter {
             .any(|action| action.ipv4only || action.ipv6only);
 
         self.longuest_action_duration =
-            self.actions.values().fold(TimeDelta::seconds(0), |acc, v| {
-                v.after_duration
-                    .map_or(acc, |v| if v > acc { v } else { acc })
-            });
+            self.actions
+                .values()
+                .fold(Duration::from_secs(0), |acc, v| {
+                    v.after_duration
+                        .map_or(acc, |v| if v > acc { v } else { acc })
+                });
 
         Ok(())
     }
@@ -198,12 +205,12 @@ impl Filter {
                     for pattern in self.patterns.as_ref() {
                         // if the pattern is in an optional part of the regex,
                         // there may be no captured group for it.
-                        if let Some(match_) = matches.name(&pattern.name) {
-                            if !pattern.is_ignore(match_.as_str()) {
-                                let mut match_ = match_.as_str().to_string();
-                                pattern.normalize(&mut match_);
-                                result.push(match_);
-                            }
+                        if let Some(match_) = matches.name(&pattern.name)
+                            && !pattern.is_ignore(match_.as_str())
+                        {
+                            let mut match_ = match_.as_str().to_string();
+                            pattern.normalize(&mut match_);
+                            result.push(match_);
                         }
                     }
                     if result.len() == self.patterns.len() {
@@ -404,10 +411,10 @@ impl Filter {
 #[cfg(test)]
 pub mod tests {
     use crate::concepts::action::tests::{ok_action, ok_action_with_after};
+    use crate::concepts::pattern::PatternIp;
     use crate::concepts::pattern::tests::{
         boubou_pattern_with_ignore, default_pattern, number_pattern, ok_pattern_with_ignore,
     };
-    use crate::concepts::pattern::PatternIp;
 
     use super::*;
 
@@ -475,14 +482,14 @@ pub mod tests {
         let name = "name".to_string();
         let empty_patterns = Patterns::new();
         let minute_str = "1m".to_string();
-        let minute = TimeDelta::seconds(60);
-        let two_minutes = TimeDelta::seconds(60 * 2);
+        let minute = Duration::from_secs(60);
+        let two_minutes = Duration::from_secs(60 * 2);
         let two_minutes_str = "2m".to_string();
 
         // duration 0
         filter = ok_filter();
         filter.setup(&name, &name, &empty_patterns).unwrap();
-        assert_eq!(filter.longuest_action_duration, TimeDelta::default());
+        assert_eq!(filter.longuest_action_duration, Duration::default());
 
         let minute_action = ok_action_with_after(minute_str.clone(), &minute_str);
 
@@ -703,24 +710,32 @@ pub mod tests {
             Ok(vec!("b".into()))
         );
         // Doesn't match
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([(pattern.clone(), "abc".into())]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([(pattern.clone(), "abc".into())]))
+                .is_err()
+        );
         // Ignored match
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([(pattern.clone(), "a".into())]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([(pattern.clone(), "a".into())]))
+                .is_err()
+        );
         // Bad pattern
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([(boubou.clone(), "bou".into())]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([(boubou.clone(), "bou".into())]))
+                .is_err()
+        );
         // Bad number of patterns
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([
-                (pattern.clone(), "b".into()),
-                (boubou.clone(), "bou".into()),
-            ]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([
+                    (pattern.clone(), "b".into()),
+                    (boubou.clone(), "bou".into()),
+                ]))
+                .is_err()
+        );
         // Bad number of patterns
         assert!(filter.get_match_from_patterns(BTreeMap::from([])).is_err());
 
@@ -748,34 +763,42 @@ pub mod tests {
             Ok(vec!("bou".into(), "b".into()))
         );
         // Doesn't match
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([
-                (pattern.clone(), "abc".into()),
-                (boubou.clone(), "bou".into()),
-            ]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([
+                    (pattern.clone(), "abc".into()),
+                    (boubou.clone(), "bou".into()),
+                ]))
+                .is_err()
+        );
         // Ignored match
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([
-                (pattern.clone(), "b".into()),
-                (boubou.clone(), "boubou".into()),
-            ]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([
+                    (pattern.clone(), "b".into()),
+                    (boubou.clone(), "boubou".into()),
+                ]))
+                .is_err()
+        );
         // Bad pattern
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([
-                (pattern.clone(), "b".into()),
-                (number_pattern.clone(), "1".into()),
-            ]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([
+                    (pattern.clone(), "b".into()),
+                    (number_pattern.clone(), "1".into()),
+                ]))
+                .is_err()
+        );
         // Bad number of patterns
-        assert!(filter
-            .get_match_from_patterns(BTreeMap::from([
-                (pattern.clone(), "b".into()),
-                (boubou.clone(), "bou".into()),
-                (number_pattern.clone(), "1".into()),
-            ]))
-            .is_err());
+        assert!(
+            filter
+                .get_match_from_patterns(BTreeMap::from([
+                    (pattern.clone(), "b".into()),
+                    (boubou.clone(), "bou".into()),
+                    (number_pattern.clone(), "1".into()),
+                ]))
+                .is_err()
+        );
         // Bad number of patterns
         assert!(filter.get_match_from_patterns(BTreeMap::from([])).is_err());
 
diff --git a/src/concepts/mod.rs b/src/concepts/mod.rs
index 40a624c..1952b1b 100644
--- a/src/concepts/mod.rs
+++ b/src/concepts/mod.rs
@@ -1,21 +1,22 @@
 mod action;
 mod config;
 mod filter;
-mod parse_duration;
 mod pattern;
+mod plugin;
 mod stream;
 
+use std::fmt::Debug;
+
+use serde::{Deserialize, Serialize};
+
 pub use action::Action;
 pub use config::{Config, Patterns};
 pub use filter::{Duplicate, Filter};
-use parse_duration::parse_duration;
 pub use pattern::{Pattern, PatternType};
-use serde::{Deserialize, Serialize};
+pub use plugin::Plugin;
 pub use stream::Stream;
+pub use treedb::time::{Time, now};
 
-use chrono::{DateTime, Local};
-
-pub type Time = DateTime<Local>;
 pub type Match = Vec<String>;
 
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
@@ -24,5 +25,66 @@ pub struct MatchTime {
     pub t: Time,
 }
 
+fn merge_attrs<A: Default + Debug + PartialEq + Eq + Clone>(
+    this: A,
+    other: A,
+    default: A,
+    name: &str,
+) -> Result<A, String> {
+    if !(this == default || other == default || this == other) {
+        return Err(format!(
+            "'{name}' has conflicting definitions: '{this:?}', '{other:?}'"
+        ));
+    }
+    if this == default {
+        return Ok(other);
+    }
+    Ok(this)
+}
+
 #[cfg(test)]
 pub use filter::tests as filter_tests;
+
+#[cfg(test)]
+mod tests {
+    use crate::concepts::merge_attrs;
+
+    #[test]
+    fn test_merge_attrs() {
+        assert_eq!(merge_attrs(None::<String>, None, None, "t"), Ok(None));
+        assert_eq!(
+            merge_attrs(Some("coucou"), None, None, "t"),
+            Ok(Some("coucou"))
+        );
+        assert_eq!(
+            merge_attrs(None, Some("coucou"), None, "t"),
+            Ok(Some("coucou"))
+        );
+        assert_eq!(
+            merge_attrs(Some("coucou"), Some("coucou"), None, "t"),
+            Ok(Some("coucou"))
+        );
+        assert_eq!(
+            merge_attrs(Some("coucou"), Some("hello"), None, "t"),
+            Err("'t' has conflicting definitions: 'Some(\"coucou\")', 'Some(\"hello\")'".into())
+        );
+
+        assert_eq!(merge_attrs("", "", "", "t"), Ok(""));
+        assert_eq!(merge_attrs("coucou", "", "", "t"), Ok("coucou"));
+        assert_eq!(merge_attrs("", "coucou", "", "t"), Ok("coucou"));
+        assert_eq!(merge_attrs("coucou", "coucou", "", "t"), Ok("coucou"));
+        assert_eq!(
+            merge_attrs("coucou", "hello", "", "t"),
+            Err("'t' has conflicting definitions: '\"coucou\"', '\"hello\"'".into())
+        );
+
+        assert_eq!(merge_attrs(0, 0, 0, "t"), Ok(0));
+        assert_eq!(merge_attrs(5, 0, 0, "t"), Ok(5));
+        assert_eq!(merge_attrs(0, 5, 0, "t"), Ok(5));
+        assert_eq!(merge_attrs(5, 5, 0, "t"), Ok(5));
+        assert_eq!(
+            merge_attrs(5, 6, 0, "t"),
+            Err("'t' has conflicting definitions: '5', '6'".into())
+        );
+    }
+}
diff --git a/src/concepts/pattern/ip/mod.rs b/src/concepts/pattern/ip/mod.rs
index ba62dd9..1488614 100644
--- a/src/concepts/pattern/ip/mod.rs
+++ b/src/concepts/pattern/ip/mod.rs
@@ -189,7 +189,9 @@ impl PatternIp {
                     let cidr_normalized = Cidr::from_str(cidr)?;
                     let cidr_normalized_string = cidr_normalized.to_string();
                     if &cidr_normalized_string != cidr {
-                        warn!("CIDR {cidr} should be rewritten in its normalized form: {cidr_normalized_string}");
+                        warn!(
+                            "CIDR {cidr} should be rewritten in its normalized form: {cidr_normalized_string}"
+                        );
                     }
                     self.ignore_cidr_normalized.push(cidr_normalized);
                 }
@@ -289,12 +291,11 @@ impl PatternIp {
 mod patternip_tests {
     use std::net::{Ipv4Addr, Ipv6Addr};
 
-    use chrono::Local;
     use tokio::{fs::read_to_string, task::JoinSet};
 
     use crate::{
-        concepts::{Action, Duplicate, Filter, Pattern},
-        daemon::{tests::TestBed, React},
+        concepts::{Action, Duplicate, Filter, Pattern, now},
+        daemon::{React, tests::TestBed},
     };
 
     use super::{Cidr, PatternIp, PatternType};
@@ -708,9 +709,9 @@ mod patternip_tests {
                         Duplicate::Ignore,
                         &bed.ip_patterns,
                     );
-                    let bed = bed.part2(filter, Local::now(), None).await;
+                    let bed = bed.part2(filter, now(), None).await;
                     assert_eq!(
-                        bed.manager.handle_line(&line, Local::now()).await,
+                        bed.manager.handle_line(&line, now()).await,
                         React::Trigger,
                         "line: {line}"
                     );
diff --git a/src/concepts/plugin.rs b/src/concepts/plugin.rs
new file mode 100644
index 0000000..5e22287
--- /dev/null
+++ b/src/concepts/plugin.rs
@@ -0,0 +1,218 @@
+use std::{collections::BTreeMap, io::Error, path, process::Stdio};
+
+#[cfg(target_os = "macos")]
+use std::os::darwin::fs::MetadataExt;
+#[cfg(target_os = "freebsd")]
+use std::os::freebsd::fs::MetadataExt;
+#[cfg(target_os = "illumos")]
+use std::os::illumos::fs::MetadataExt;
+#[cfg(target_os = "linux")]
+use std::os::linux::fs::MetadataExt;
+#[cfg(target_os = "netbsd")]
+use std::os::netbsd::fs::MetadataExt;
+#[cfg(target_os = "openbsd")]
+use std::os::openbsd::fs::MetadataExt;
+#[cfg(target_os = "solaris")]
+use std::os::solaris::fs::MetadataExt;
+
+use serde::{Deserialize, Serialize};
+use tokio::{
+    fs,
+    process::{Child, Command},
+};
+use tracing::{debug, warn};
+
+// TODO commented options block execution of program,
+// while developping in my home directory.
+// Some options may still be useful in production environments.
+fn systemd_default_options(working_directory: &str) -> BTreeMap<String, Vec<String>> {
+    BTreeMap::from(
+        [
+            // reaction slice (does nothing if inexistent)
+            ("Slice", vec!["reaction.slice"]),
+            // Started in its own directory
+            ("WorkingDirectory", vec![working_directory]),
+            // No file access except own directory
+            ("ReadWritePaths", vec![working_directory]),
+            ("ReadOnlyPaths", vec!["/"]),
+            ("InaccessiblePaths", vec!["/boot", "/etc"]),
+            // Protect special filesystems
+            ("PrivateDevices", vec!["true"]),
+            ("PrivateMounts", vec!["true"]),
+            ("PrivateTmp", vec!["true"]),
+            // ("PrivateUsers", vec!["true"]),
+            ("ProcSubset", vec!["pid"]),
+            ("ProtectClock", vec!["true"]),
+            ("ProtectControlGroups", vec!["true"]),
+            #[cfg(not(debug_assertions))]
+            ("ProtectHome", vec!["true"]),
+            ("ProtectHostname", vec!["true"]),
+            ("ProtectKernelLogs", vec!["true"]),
+            ("ProtectKernelModules", vec!["true"]),
+            ("ProtectKernelTunables", vec!["true"]),
+            ("ProtectProc", vec!["invisible"]),
+            ("ProtectSystem", vec!["strict"]),
+            // Various Protections
+            ("LockPersonality", vec!["true"]),
+            ("NoNewPrivileges", vec!["true"]),
+            ("AmbientCapabilities", vec![""]),
+            ("CapabilityBoundingSet", vec![""]),
+            // Isolate File
+            ("RemoveIPC", vec!["true"]),
+            ("RestrictNamespaces", vec!["true"]),
+            ("RestrictSUIDSGID", vec!["true"]),
+            ("SystemCallArchitectures", vec!["native"]),
+            (
+                "SystemCallFilter",
+                vec!["@system-service", "~@privileged", "~@resources", "~@setuid"],
+            ),
+            // User
+            // FIXME Setting another user doesn't work, because of stdio pipe permission errors
+            // ("DynamicUser", vec!["true"]),
+            // ("User", vec!["reaction-plugin-test"]),
+            // Too restrictive
+            // ("NoExecPaths", vec!["/"]),
+            // ("RestrictAddressFamilies", vec![""]),
+        ]
+        .map(|(k, v)| (k.into(), v.into_iter().map(|v| v.into()).collect())),
+    )
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[cfg_attr(test, derive(Default))]
+#[serde(deny_unknown_fields)]
+pub struct Plugin {
+    #[serde(skip)]
+    pub name: String,
+
+    pub path: String,
+    /// Check that plugin file owner is root
+    #[serde(default = "_true")]
+    pub check_root: bool,
+    /// Enable systemd containerization
+    #[serde(default = "_true")]
+    pub systemd: bool,
+    /// Options for `run0`
+    #[serde(default)]
+    pub systemd_options: BTreeMap<String, Vec<String>>,
+}
+
+fn _true() -> bool {
+    true
+}
+
+// NOTE
+// `run0` can be used for security customisation.
+// with the --pipe option, raw stdio fd are transmitted to the underlying command, so there is no overhead.
+
+impl Plugin {
+    pub fn setup(&mut self, name: &str) -> Result<(), String> {
+        self.name = name.to_string();
+
+        if self.path.is_empty() {
+            return Err("can't specify empty plugin path".into());
+        }
+
+        // Only when testing, make relative paths absolute
+        #[cfg(debug_assertions)]
+        if !self.path.starts_with("/") {
+            self.path = format!(
+                "{}/{}",
+                std::env::current_dir()
+                    .map_err(|err| format!("error on working directory: {err}"))?
+                    .to_string_lossy(),
+                self.path
+            );
+        }
+
+        // Disallow relative paths
+        if !self.path.starts_with("/") {
+            return Err(format!("plugin paths must be absolute: {}", self.path));
+        }
+        Ok(())
+    }
+
+    /// Override default options with user-defined options, when defined.
+    pub fn systemd_setup(&self, working_directory: &str) -> BTreeMap<String, Vec<String>> {
+        let mut new_options = systemd_default_options(working_directory);
+        for (option, value) in self.systemd_options.iter() {
+            new_options.insert(option.clone(), value.clone());
+        }
+        new_options
+    }
+
+    pub async fn launch(&self, state_directory: &str) -> Result<Child, std::io::Error> {
+        // owner check
+        if self.check_root {
+            let path = self.path.clone();
+            let stat = fs::metadata(path).await?;
+
+            if stat.st_uid() != 0 {
+                return Err(Error::other("plugin file is not owned by root"));
+            }
+        }
+
+        let self_uid = if self.systemd {
+            Some(
+                // Well well we want to check if we're root
+                #[allow(unsafe_code)]
+                unsafe {
+                    nix::libc::geteuid()
+                },
+            )
+        } else {
+            None
+        };
+
+        // Create plugin working directory (also state directory)
+        let plugin_working_directory = format!("{state_directory}/plugin_data/{}", self.name);
+        fs::create_dir_all(&plugin_working_directory).await?;
+
+        let mut command = if self_uid.is_some_and(|self_uid| self_uid == 0) {
+            let mut command = Command::new("run0");
+            // --pipe gives direct, non-emulated stdio access, for better performance.
+            command.arg("--pipe");
+            // run the command inside the same slice as reaction
+            command.arg("--slice-inherit");
+
+            // Make path absolute for systemd
+            let full_workdir = path::absolute(&plugin_working_directory)?;
+            let full_workdir = full_workdir.to_str().ok_or_else(|| {
+                std::io::Error::new(
+                    std::io::ErrorKind::InvalidFilename,
+                    format!(
+                        "Could not absolutize plugin working directory {plugin_working_directory}"
+                    ),
+                )
+            })?;
+            let merged_systemd_options = self.systemd_setup(full_workdir);
+            // run0 options
+            for (option, values) in merged_systemd_options.iter() {
+                for value in values.iter() {
+                    command.arg("--property").arg(format!("{option}={value}"));
+                }
+            }
+            command.arg(&self.path);
+            command
+        } else {
+            if self.systemd {
+                warn!("Disabling systemd because reaction does not run as root");
+            }
+            let mut command = Command::new(&self.path);
+            command.current_dir(plugin_working_directory);
+            command
+        };
+        command.arg("serve");
+        debug!(
+            "plugin {}: running command: {:?}",
+            self.name,
+            command.as_std()
+        );
+        command
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .env("RUST_BACKTRACE", "1")
+            .spawn()
+    }
+}
diff --git a/src/concepts/stream.rs b/src/concepts/stream.rs
index 011652b..97e6ece 100644
--- a/src/concepts/stream.rs
+++ b/src/concepts/stream.rs
@@ -1,8 +1,11 @@
 use std::{cmp::Ordering, collections::BTreeMap, hash::Hash};
 
+use reaction_plugin::StreamConfig;
+use regex::RegexSet;
 use serde::{Deserialize, Serialize};
+use serde_json::Value;
 
-use super::{Filter, Patterns};
+use super::{Filter, Patterns, merge_attrs};
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[cfg_attr(test, derive(Default))]
@@ -10,11 +13,23 @@ use super::{Filter, Patterns};
 pub struct Stream {
     #[serde(default)]
     pub cmd: Vec<String>,
+
     #[serde(default)]
     pub filters: BTreeMap<String, Filter>,
 
     #[serde(skip)]
     pub name: String,
+
+    #[serde(skip)]
+    pub compiled_regex_set: RegexSet,
+    #[serde(skip)]
+    pub regex_index_to_filter_name: Vec<String>,
+
+    // Plugin-specific
+    #[serde(default, rename = "type", skip_serializing_if = "Option::is_none")]
+    pub stream_type: Option<String>,
+    #[serde(default, skip_serializing_if = "Value::is_null")]
+    pub options: Value,
 }
 
 impl Stream {
@@ -23,23 +38,27 @@ impl Stream {
     }
 
     pub fn merge(&mut self, other: Stream) -> Result<(), String> {
-        if !(self.cmd.is_empty() || other.cmd.is_empty() || self.cmd == other.cmd) {
-            return Err("cmd has conflicting definitions".into());
-        }
-
-        if self.cmd.is_empty() {
-            self.cmd = other.cmd;
-        }
+        self.cmd = merge_attrs(self.cmd.clone(), other.cmd, Vec::default(), "cmd")?;
+        self.stream_type = merge_attrs(self.stream_type.clone(), other.stream_type, None, "type")?;
 
         for (key, filter) in other.filters.into_iter() {
             if self.filters.insert(key.clone(), filter).is_some() {
-                return Err(format!("filter {} is already defined. filter definitions can't be spread accross multiple files.", key));
+                return Err(format!(
+                    "filter {} is already defined. filter definitions can't be spread accross multiple files.",
+                    key
+                ));
             }
         }
 
         Ok(())
     }
 
+    pub fn is_plugin(&self) -> bool {
+        self.stream_type
+            .as_ref()
+            .is_some_and(|stream_type| stream_type != "cmd")
+    }
+
     pub fn setup(&mut self, name: &str, patterns: &Patterns) -> Result<(), String> {
         self._setup(name, patterns)
             .map_err(|msg| format!("stream {}: {}", name, msg))
@@ -55,11 +74,18 @@ impl Stream {
             return Err("character '.' is not allowed in stream name".into());
         }
 
-        if self.cmd.is_empty() {
-            return Err("cmd is empty".into());
-        }
-        if self.cmd[0].is_empty() {
-            return Err("cmd's first item is empty".into());
+        if !self.is_plugin() {
+            if self.cmd.is_empty() {
+                return Err("cmd is empty".into());
+            }
+            if self.cmd[0].is_empty() {
+                return Err("cmd's first item is empty".into());
+            }
+            if !self.options.is_null() {
+                return Err("can't define options without a plugin type".into());
+            }
+        } else if !self.cmd.is_empty() {
+            return Err("can't define cmd and a plugin type".into());
         }
 
         if self.filters.is_empty() {
@@ -70,8 +96,33 @@ impl Stream {
             filter.setup(name, key, patterns)?;
         }
 
+        let all_regexes: BTreeMap<_, _> = self
+            .filters
+            .values()
+            .flat_map(|filter| {
+                filter
+                    .regex
+                    .iter()
+                    .map(|regex| (regex, filter.name.clone()))
+            })
+            .collect();
+
+        self.compiled_regex_set = RegexSet::new(all_regexes.keys())
+            .map_err(|err| format!("too much regexes on the filters of this stream: {err}"))?;
+        self.regex_index_to_filter_name = all_regexes.into_values().collect();
+
         Ok(())
     }
+
+    pub fn to_stream_config(&self) -> Result<StreamConfig, String> {
+        Ok(StreamConfig {
+            stream_name: self.name.clone(),
+            stream_type: self.stream_type.clone().ok_or_else(|| {
+                format!("stream {} doesn't load a plugin. this is a bug!", self.name)
+            })?,
+            config: self.options.clone().into(),
+        })
+    }
 }
 
 impl PartialEq for Stream {
@@ -102,19 +153,12 @@ mod tests {
     use super::*;
     use crate::concepts::filter::tests::ok_filter;
 
-    fn default_stream() -> Stream {
-        Stream {
-            cmd: Vec::new(),
-            name: "".into(),
-            filters: BTreeMap::new(),
-        }
-    }
-
     fn ok_stream() -> Stream {
-        let mut stream = default_stream();
-        stream.cmd = vec!["command".into()];
-        stream.filters.insert("name".into(), ok_filter());
-        stream
+        Stream {
+            cmd: vec!["command".into()],
+            filters: BTreeMap::from([("name".into(), ok_filter())]),
+            ..Default::default()
+        }
     }
 
     #[test]
diff --git a/src/daemon/filter/mod.rs b/src/daemon/filter/mod.rs
index b847586..d0e2104 100644
--- a/src/daemon/filter/mod.rs
+++ b/src/daemon/filter/mod.rs
@@ -5,20 +5,21 @@ mod state;
 
 use std::{collections::BTreeMap, process::Stdio, sync::Arc};
 
+use chrono::TimeZone;
+use reaction_plugin::{ActionImpl, shutdown::ShutdownToken};
 use regex::Regex;
 use tokio::sync::{Mutex, MutexGuard, Semaphore};
 use tracing::{error, info};
 
 use crate::{
     concepts::{Action, Duplicate, Filter, Match, Pattern, Time},
+    daemon::plugin::Plugins,
     protocol::{Order, PatternStatus},
-    treedb::Database,
 };
+use treedb::Database;
 
 use state::State;
 
-use super::shutdown::ShutdownToken;
-
 /// Responsible for handling all runtime logic dedicated to a [`Filter`].
 /// Notably handles incoming lines from [`super::stream::stream_manager`]
 /// and orders from the [`super::socket::socket_manager`]
@@ -30,6 +31,8 @@ pub struct FilterManager {
     exec_limit: Option<Arc<Semaphore>>,
     /// Permits to run pending actions on shutdown
     shutdown: ShutdownToken,
+    /// Action Plugins
+    action_plugins: BTreeMap<&'static String, ActionImpl>,
     /// Inner state.
     /// Protected by a [`Mutex`], permitting FilterManager to be cloned
     /// and concurrently owned by its stream manager, the socket manager,
@@ -55,16 +58,25 @@ impl FilterManager {
         exec_limit: Option<Arc<Semaphore>>,
         shutdown: ShutdownToken,
         db: &mut Database,
+        plugins: &mut Plugins,
         now: Time,
     ) -> Result<Self, String> {
+        let mut action_plugins = BTreeMap::default();
+        for (action_name, action) in filter.actions.iter().filter(|action| action.1.is_plugin()) {
+            action_plugins.insert(
+                action_name,
+                plugins.get_action_impl(action.to_string()).ok_or_else(|| {
+                    format!("action {action} doesn't load a plugin. this is a bug!")
+                })?,
+            );
+        }
         let this = Self {
             filter,
             exec_limit,
             shutdown,
+            action_plugins,
             state: Arc::new(Mutex::new(State::new(filter, db, now).await?)),
         };
-        this.clear_past_triggers_and_schedule_future_actions(now)
-            .await;
         Ok(this)
     }
 
@@ -212,21 +224,27 @@ impl FilterManager {
                     for action in self.filter.filtered_actions_from_match(&m) {
                         let action_time = t + action.after_duration.unwrap_or_default();
                         if action_time > now {
+                            // Pretty print time
+                            let time = chrono::Local
+                                .timestamp_opt(
+                                    action_time.as_secs() as i64,
+                                    action_time.subsec_nanos(),
+                                )
+                                .unwrap()
+                                .to_rfc3339()
+                                .chars()
+                                .take(19)
+                                .collect();
                             // Insert action
                             pattern_status
                                 .actions
                                 .entry(action.name.clone())
                                 .or_default()
-                                .push(action_time.to_rfc3339().chars().take(19).collect());
+                                .push(time);
 
                             // Execute the action early
                             if let Order::Flush = order {
-                                exec_now(
-                                    &self.exec_limit,
-                                    self.shutdown.clone(),
-                                    action,
-                                    m.clone(),
-                                ).await;
+                                self.exec_now(action, m.clone(), t);
                             }
                         }
                     }
@@ -270,20 +288,17 @@ impl FilterManager {
 
             if exec_time <= now {
                 if state.decrement_trigger(&m, t, false).await {
-                    exec_now(&self.exec_limit, self.shutdown.clone(), action, m).await;
+                    self.exec_now(action, m, t);
                 }
             } else {
                 let this = self.clone();
+                let action_impl = self.action_plugins.get(&action.name).cloned();
                 tokio::spawn(async move {
-                    let dur = (exec_time - now)
-                        .to_std()
-                        // Could cause an error if t + after < now
-                        // In this case, 0 is fine
-                        .unwrap_or_default();
+                    let dur = exec_time - now;
                     // Wait either for end of sleep
                     // or reaction exiting
                     let exiting = tokio::select! {
-                        _ = tokio::time::sleep(dur) => false,
+                        _ = tokio::time::sleep(dur.into()) => false,
                         _ = this.shutdown.wait() => true,
                     };
                     // Exec action if triggered hasn't been already flushed
@@ -291,7 +306,7 @@ impl FilterManager {
                         #[allow(clippy::unwrap_used)] // propagating panics is ok
                         let mut state = this.state.lock().await;
                         if state.decrement_trigger(&m, t, exiting).await {
-                            exec_now(&this.exec_limit, this.shutdown, action, m).await;
+                            exec_now(&this.exec_limit, this.shutdown, action, action_impl, m, t);
                         }
                     }
                 });
@@ -299,7 +314,8 @@ impl FilterManager {
         }
     }
 
-    async fn clear_past_triggers_and_schedule_future_actions(&self, now: Time) {
+    /// Clear past triggers and schedule future actions
+    pub async fn start(&self, now: Time) {
         let longuest_action_duration = self.filter.longuest_action_duration;
         let number_of_actions = self
             .filter
@@ -349,37 +365,76 @@ impl FilterManager {
             }
         }
     }
+
+    fn exec_now(&self, action: &'static Action, m: Match, t: Time) {
+        let action_impl = self.action_plugins.get(&action.name).cloned();
+        exec_now(
+            &self.exec_limit,
+            self.shutdown.clone(),
+            action,
+            action_impl,
+            m,
+            t,
+        )
+    }
 }
 
-async fn exec_now(
+fn exec_now(
     exec_limit: &Option<Arc<Semaphore>>,
     shutdown: ShutdownToken,
     action: &'static Action,
+    action_impl: Option<ActionImpl>,
     m: Match,
+    t: Time,
 ) {
     let exec_limit = exec_limit.clone();
     tokio::spawn(async move {
         // Move ShutdownToken in task
         let _shutdown = shutdown;
-        // Wait for semaphore's permission, if it is Some
-        let _permit = match exec_limit {
-            #[allow(clippy::unwrap_used)] // We know the semaphore is not closed
-            Some(semaphore) => Some(semaphore.acquire_owned().await.unwrap()),
-            None => None,
-        };
 
-        // Construct command
-        let mut command = action.exec(&m);
+        match action_impl {
+            Some(action_impl) => {
+                info!(
+                    "{action}: run {} {:?}",
+                    action.action_type.clone().unwrap_or_default(),
+                    &m,
+                );
 
-        info!("{}: run [{:?}]", &action, command.as_std());
-        if let Err(err) = command
-            .stdin(Stdio::null())
-            .stderr(Stdio::null())
-            .stdout(Stdio::piped())
-            .status()
-            .await
-        {
-            error!("{}: run [{:?}], code {}", &action, command.as_std(), err);
+                // Sending action
+                if let Err(err) = action_impl
+                    .tx
+                    .send(reaction_plugin::Exec {
+                        match_: m,
+                        time: t.into(),
+                    })
+                    .await
+                {
+                    error!("{action}: communication with plugin failed: {err}");
+                    return;
+                }
+            }
+            None => {
+                // Wait for semaphore's permission, if it is Some
+                let _permit = match exec_limit {
+                    #[allow(clippy::unwrap_used)] // We know the semaphore is not closed
+                    Some(semaphore) => Some(semaphore.acquire_owned().await.unwrap()),
+                    None => None,
+                };
+
+                // Construct command
+                let mut command = action.exec(&m);
+
+                info!("{action}: run [{:?}]", command.as_std());
+                if let Err(err) = command
+                    .stdin(Stdio::null())
+                    .stderr(Stdio::null())
+                    .stdout(Stdio::piped())
+                    .status()
+                    .await
+                {
+                    error!("{action}: run [{:?}], code {err}", command.as_std());
+                }
+            }
         }
     });
 }
diff --git a/src/daemon/filter/state.rs b/src/daemon/filter/state.rs
index b539780..cad2fbe 100644
--- a/src/daemon/filter/state.rs
+++ b/src/daemon/filter/state.rs
@@ -1,12 +1,9 @@
 use std::collections::{BTreeMap, BTreeSet};
 
-use crate::{
-    concepts::{Filter, Match, MatchTime, Time},
-    treedb::{
-        helpers::{to_match, to_matchtime, to_time, to_timemap, to_u64},
-        Database, Tree,
-    },
-};
+use serde_json::Value;
+use treedb::{Database, Tree, helpers::*};
+
+use crate::concepts::{Filter, Match, MatchTime, Time};
 
 pub fn filter_ordered_times_db_name(filter: &Filter) -> String {
     format!(
@@ -41,12 +38,12 @@ pub struct State {
     /// I'm pretty confident that Time will always be unique, because it has enough precision.
     /// See this code that gives different times, even in a minimal loop:
     /// ```rust
-    /// use chrono::{Local};
+    /// use reaction::concepts::now;
     ///
     /// let mut res = vec![];
     /// for _ in 0..10 {
-    ///     let now = Local::now();
-    ///     res.push(format!("Now: {now}"));
+    ///     let now = now();
+    ///     res.push(format!("Now: {}", now.as_nanos()));
     /// }
     /// for s in res {
     ///     println!("{s}");
@@ -172,11 +169,7 @@ impl State {
                             .fetch_update(mt.m, |map| {
                                 map.and_then(|mut map| {
                                     map.remove(&mt.t);
-                                    if map.is_empty() {
-                                        None
-                                    } else {
-                                        Some(map)
-                                    }
+                                    if map.is_empty() { None } else { Some(map) }
                                 })
                             })
                             .await;
@@ -245,19 +238,30 @@ impl State {
     }
 }
 
+/// Tries to convert a [`Value`] into a [`MatchTime`]
+pub fn to_matchtime(val: &Value) -> Result<MatchTime, String> {
+    let map = val.as_object().ok_or("not an object")?;
+    Ok(MatchTime {
+        m: to_match(map.get("m").ok_or("no m in object")?)?,
+        t: to_time(map.get("t").ok_or("no t in object")?)?,
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use std::collections::{BTreeMap, HashMap};
 
-    use chrono::{DateTime, Local, TimeDelta};
-    use serde_json::json;
+    use serde_json::{Map, Value, json};
 
     use crate::{
-        concepts::{filter_tests::ok_filter, Action, Duplicate, Filter, Pattern},
-        daemon::filter::state::State,
+        concepts::{
+            Action, Duplicate, Filter, MatchTime, Pattern, Time, filter_tests::ok_filter, now,
+        },
         tests::TempDatabase,
     };
 
+    use super::{State, to_matchtime};
+
     // Tests `new`, `clear_past_matches` and `load_matches_from_ordered_times`
     #[tokio::test]
     async fn state_new() {
@@ -285,15 +289,16 @@ mod tests {
             &patterns,
         );
 
-        let now = DateTime::parse_from_rfc3339("2025-07-10T12:35:00.000+00:00")
-            .unwrap()
-            .with_timezone(&Local);
-        let now_plus_1m = now + TimeDelta::minutes(1);
-        let now_plus_1m01 = now_plus_1m + TimeDelta::seconds(1);
-        let now_less_1m = now - TimeDelta::minutes(1);
-        let now_less_1s = now - TimeDelta::seconds(1);
-        let now_less_4s = now - TimeDelta::seconds(4);
-        let now_less_5s = now - TimeDelta::seconds(5);
+        let now = Time::from_secs(1234567);
+        // DateTime::parse_from_rfc3339("2025-07-10T12:35:00.000+00:00")
+        // .unwrap()
+        // .with_timezone(&Local);
+        let now_plus_1m = now + Time::from_mins(1);
+        let now_plus_1m01 = now_plus_1m + Time::from_secs(1);
+        let now_less_1m = now - Time::from_mins(1);
+        let now_less_1s = now - Time::from_secs(1);
+        let now_less_4s = now - Time::from_secs(4);
+        let now_less_5s = now - Time::from_secs(5);
 
         let triggers = [
             // format v1
@@ -332,10 +337,10 @@ mod tests {
                     json!(["one"]),
                     json!({
                         // Will stay
-                        now_plus_1m.to_rfc3339(): 1,
-                        now_less_1s.to_rfc3339(): 1,
+                        now_plus_1m.as_nanos().to_string(): 1,
+                        now_less_1s.as_nanos().to_string(): 1,
                     // Will not get cleaned because it's FilterManager's task
-                        now_less_5s.to_rfc3339(): 1,
+                        now_less_5s.as_nanos().to_string(): 1,
                     }),
                 )]),
             ),
@@ -347,13 +352,13 @@ mod tests {
                     "filter_ordered_times_s1.f1".into(),
                     HashMap::from([
                         // Will stay
-                        (now_plus_1m.to_rfc3339().into(), ["one"].into()),
-                        (now_plus_1m01.to_rfc3339().into(), ["one"].into()),
-                        (now_less_1s.to_rfc3339().into(), ["two"].into()), // stays because retry: 2s
+                        (now_plus_1m.as_nanos().to_string().into(), ["one"].into()),
+                        (now_plus_1m01.as_nanos().to_string().into(), ["one"].into()),
+                        (now_less_1s.as_nanos().to_string().into(), ["two"].into()), // stays because retry: 2s
                         // Will get cleaned
-                        (now_less_4s.to_rfc3339().into(), ["two"].into()),
-                        (now_less_5s.to_rfc3339().into(), ["three"].into()),
-                        (now_less_1m.to_rfc3339().into(), ["two"].into()),
+                        (now_less_4s.as_nanos().to_string().into(), ["two"].into()),
+                        (now_less_5s.as_nanos().to_string().into(), ["three"].into()),
+                        (now_less_1m.as_nanos().to_string().into(), ["two"].into()),
                     ]),
                 ),
                 trigger_db,
@@ -397,11 +402,9 @@ mod tests {
 
         let one = vec!["one".into()];
 
-        let now = DateTime::parse_from_rfc3339("2025-07-10T12:35:00.000+00:00")
-            .unwrap()
-            .with_timezone(&Local);
-        let now_less_1s = now - TimeDelta::seconds(1);
-        let now_less_4s = now - TimeDelta::seconds(4);
+        let now = Time::from_secs(1234567);
+        let now_less_1s = now - Time::from_secs(1);
+        let now_less_4s = now - Time::from_secs(4);
 
         let mut db = TempDatabase::default().await;
         let mut state = State::new(filter, &mut db, now).await.unwrap();
@@ -442,7 +445,7 @@ mod tests {
         let filter = Box::leak(Box::new(ok_filter()));
 
         let one = vec!["one".into()];
-        let now = Local::now();
+        let now = now();
 
         let mut db = TempDatabase::default().await;
         let mut state = State::new(filter, &mut db, now).await.unwrap();
@@ -495,8 +498,8 @@ mod tests {
         );
 
         let one = vec!["one".into()];
-        let now = Local::now();
-        let now_plus_1s = now + TimeDelta::seconds(1);
+        let now = now();
+        let now_plus_1s = now + Time::from_secs(1);
 
         let mut db = TempDatabase::default().await;
         let mut state = State::new(filter, &mut db, now).await.unwrap();
@@ -599,4 +602,54 @@ mod tests {
         state.remove_trigger(&one).await;
         assert!(state.triggers.tree().is_empty());
     }
+
+    #[test]
+    fn test_to_matchtime() {
+        assert_eq!(
+            to_matchtime(&Value::Object(Map::from_iter(
+                BTreeMap::from([
+                    ("m".into(), ["plip", "ploup"].into()),
+                    ("t".into(), "12345678".into()),
+                ])
+                .into_iter()
+            ))),
+            Ok(MatchTime {
+                m: vec!["plip".into(), "ploup".into()],
+                t: Time::from_nanos(12345678),
+            })
+        );
+
+        assert!(
+            to_matchtime(&Value::Object(Map::from_iter(
+                BTreeMap::from([("m".into(), ["plip", "ploup"].into()),]).into_iter()
+            )))
+            .is_err()
+        );
+
+        assert!(
+            to_matchtime(&Value::Object(Map::from_iter(
+                BTreeMap::from([("t".into(), 12345678.into()),]).into_iter()
+            )))
+            .is_err()
+        );
+
+        assert!(
+            to_matchtime(&Value::Object(Map::from_iter(
+                BTreeMap::from([("m".into(), "ploup".into()), ("t".into(), 12345678.into()),])
+                    .into_iter()
+            )))
+            .is_err()
+        );
+
+        assert!(
+            to_matchtime(&Value::Object(Map::from_iter(
+                BTreeMap::from([
+                    ("m".into(), ["plip", "ploup"].into()),
+                    ("t".into(), [1234567].into()),
+                ])
+                .into_iter()
+            )))
+            .is_err()
+        );
+    }
 }
diff --git a/src/daemon/filter/tests.rs b/src/daemon/filter/tests.rs
index baccfd0..5196e42 100644
--- a/src/daemon/filter/tests.rs
+++ b/src/daemon/filter/tests.rs
@@ -5,18 +5,18 @@ use std::{
     time::Duration,
 };
 
-use chrono::{Local, TimeDelta};
+use reaction_plugin::shutdown::ShutdownController;
 use serde_json::json;
 use tempfile::TempPath;
 use tokio::sync::Semaphore;
 
 use super::{
-    state::{filter_ordered_times_db_name, filter_triggers_db_name},
     FilterManager, React,
+    state::{filter_ordered_times_db_name, filter_triggers_db_name},
 };
 use crate::{
-    concepts::{Action, Duplicate, Filter, Pattern, Patterns, Time},
-    daemon::shutdown::ShutdownController,
+    concepts::{Action, Duplicate, Filter, Pattern, Patterns, Time, now},
+    daemon::plugin::Plugins,
     tests::TempDatabase,
 };
 
@@ -89,7 +89,7 @@ impl TestBed {
         };
         let controller = ShutdownController::new();
         let semaphore = Arc::new(Semaphore::new(1));
-        TestBed2 {
+        let test_bed2 = TestBed2 {
             _out_path: self._out_path,
             out_file: self.out_file,
             az_patterns: self.az_patterns,
@@ -100,12 +100,15 @@ impl TestBed {
                 Some(semaphore.clone()),
                 controller.token(),
                 &mut db,
+                &mut Plugins::default(),
                 now,
             )
             .await
             .unwrap(),
             semaphore,
-        }
+        };
+        test_bed2.manager.start(now).await;
+        test_bed2
     }
 }
 
@@ -171,11 +174,12 @@ async fn three_matches_then_action_then_delayed_action() {
             &bed.az_patterns,
         );
 
-        let bed = bed.part2(filter, Local::now(), None).await;
+        let now = now();
+        let bed = bed.part2(filter, now, None).await;
 
         let now = bed.now;
-        let now1s = bed.now + TimeDelta::seconds(1);
-        let now2s = bed.now + TimeDelta::seconds(2);
+        let now1s = bed.now + Time::from_secs(1);
+        let now2s = bed.now + Time::from_secs(2);
 
         // No match
         assert_eq!(
@@ -262,7 +266,7 @@ async fn three_matches_then_action_then_delayed_action() {
         );
 
         // Now the second action executes
-        tokio::time::sleep(Duration::from_millis(100)).await;
+        tokio::time::sleep(Duration::from_millis(140)).await;
         // Check second action
         assert!(
             bed.manager.state.lock().await.triggers.is_empty(),
@@ -302,8 +306,8 @@ async fn one_match_one_action() {
             &bed.az_patterns,
         );
 
-        let bed = bed.part2(filter, Local::now(), None).await;
-        let now = bed.now;
+        let now = now();
+        let bed = bed.part2(filter, now, None).await;
 
         // No match
         assert_eq!(
@@ -355,8 +359,8 @@ async fn one_match_one_delayed_action() {
             &bed.az_patterns,
         );
 
-        let bed = bed.part2(filter, Local::now(), None).await;
-        let now = bed.now;
+        let now = now();
+        let bed = bed.part2(filter, now, None).await;
 
         // No match
         assert_eq!(
@@ -428,14 +432,15 @@ async fn one_db_match_one_runtime_match_one_action() {
         );
 
         // Pre-add match
-        let now = Local::now();
+        let now = now();
         let one = vec!["one".to_string()];
-        let now1s = now - TimeDelta::seconds(1);
+        let now1s = now - Time::from_secs(1);
 
         let db = TempDatabase::from_loaded_db(HashMap::from([(
             filter_ordered_times_db_name(filter),
-            HashMap::from([(now1s.to_rfc3339().into(), one.clone().into())]),
-        )])).await;
+            HashMap::from([(now1s.as_nanos().to_string().into(), one.clone().into())]),
+        )]))
+        .await;
 
         // Finish setup
         let bed = bed.part2(filter, now, Some(db)).await;
@@ -496,14 +501,15 @@ async fn one_outdated_db_match() {
         );
 
         // Pre-add match
-        let now = Local::now();
+        let now = now();
         let one = vec!["one".to_string()];
-        let now1s = now - TimeDelta::milliseconds(1001);
+        let now1s = now - Time::from_millis(1001);
 
         let db = TempDatabase::from_loaded_db(HashMap::from([(
             filter_ordered_times_db_name(filter),
-            HashMap::from([(now1s.to_rfc3339().into(), one.clone().into())]),
-        )])).await;
+            HashMap::from([(now1s.as_nanos().to_string().into(), one.clone().into())]),
+        )]))
+        .await;
 
         // Finish setup
         let bed = bed.part2(filter, now, Some(db)).await;
@@ -552,7 +558,7 @@ async fn trigger_unmatched_pattern() {
             &bed.az_patterns,
         );
 
-        let now = Local::now();
+        let now = now();
         let one = vec!["one".to_string()];
         let bed = bed.part2(filter, now, None).await;
 
@@ -626,14 +632,15 @@ async fn trigger_matched_pattern() {
             &bed.az_patterns,
         );
 
-        let now = Local::now();
-        let now1s = now - TimeDelta::milliseconds(10);
+        let now = now();
+        let now1s = now - Time::from_millis(10);
         let one = vec!["one".to_string()];
 
         let db = TempDatabase::from_loaded_db(HashMap::from([(
             filter_ordered_times_db_name(filter),
-            HashMap::from([(now1s.to_rfc3339().into(), one.clone().into())]),
-        )])).await;
+            HashMap::from([(now1s.as_nanos().to_string().into(), one.clone().into())]),
+        )]))
+        .await;
         let bed = bed.part2(filter, now, Some(db)).await;
 
         bed.manager
@@ -706,9 +713,9 @@ async fn trigger_deduplication_on_start() {
             &bed.az_patterns,
         );
 
-        let now = Local::now();
-        let now1s = now - TimeDelta::milliseconds(1000);
-        let now2s = now - TimeDelta::milliseconds(1030);
+        let now = now();
+        let now1s = now - Time::from_millis(1000);
+        let now2s = now - Time::from_millis(1030);
         let one = vec!["one".to_string()];
 
         let db = TempDatabase::from_loaded_db(HashMap::from([(
@@ -716,11 +723,12 @@ async fn trigger_deduplication_on_start() {
             HashMap::from([(
                 one.clone().into(),
                 json!({
-                    now1s.to_rfc3339(): 1,
-                    now2s.to_rfc3339(): 1,
+                    now1s.as_nanos().to_string(): 1,
+                    now2s.as_nanos().to_string(): 1,
                 }),
             )]),
-        )])).await;
+        )]))
+        .await;
         let bed = bed.part2(filter, now, Some(db)).await;
 
         // the action executes
@@ -791,15 +799,17 @@ async fn multiple_triggers() {
             &bed.az_patterns,
         );
 
-        let bed = bed.part2(filter, Local::now(), None).await;
+        let now = now();
+        let bed = bed.part2(filter, now, None).await;
 
         assert_eq!(
-            bed.manager.handle_line("test one", Local::now()).await,
+            bed.manager.handle_line("test one", now).await,
             React::Match,
             "Duplicate: {dup:?}"
         );
+        let now = crate::concepts::now();
         assert_eq!(
-            bed.manager.handle_line("test one", Local::now()).await,
+            bed.manager.handle_line("test one", now).await,
             React::Trigger,
             "Duplicate: {dup:?}"
         );
@@ -815,8 +825,9 @@ async fn multiple_triggers() {
 
         tokio::time::sleep(Duration::from_millis(50)).await;
 
+        let now = crate::concepts::now();
         assert_eq!(
-            bed.manager.handle_line("test one", Local::now()).await,
+            bed.manager.handle_line("test one", now).await,
             match dup {
                 Duplicate::Ignore => React::Match,
                 _ => React::Match,
@@ -824,8 +835,9 @@ async fn multiple_triggers() {
             "Duplicate: {dup:?}"
         );
 
+        let now = crate::concepts::now();
         assert_eq!(
-            bed.manager.handle_line("test one", Local::now()).await,
+            bed.manager.handle_line("test one", now).await,
             match dup {
                 Duplicate::Ignore => React::Match,
                 _ => React::Trigger,
@@ -956,10 +968,12 @@ async fn extend_trigger_multiple_after_actions() {
             &bed.az_patterns,
         );
 
-        let bed = bed.part2(filter, Local::now(), None).await;
+        let now = now();
+        let bed = bed.part2(filter, now, None).await;
 
+        let now = crate::concepts::now();
         assert_eq!(
-            bed.manager.handle_line("test one", Local::now()).await,
+            bed.manager.handle_line("test one", now).await,
             React::Trigger,
         );
 
@@ -972,8 +986,9 @@ async fn extend_trigger_multiple_after_actions() {
             "Sleep: {second_match_duration:?}"
         );
 
+        let now = crate::concepts::now();
         assert_eq!(
-            bed.manager.handle_line("test one", Local::now()).await,
+            bed.manager.handle_line("test one", now).await,
             React::Trigger,
         );
 
@@ -1037,10 +1052,12 @@ async fn ip_specific() {
         &bed.ip_patterns,
     );
 
-    let bed = bed.part2(filter, Local::now(), None).await;
+    let now = now();
+    let bed = bed.part2(filter, now, None).await;
 
+    let now = crate::concepts::now();
     assert_eq!(
-        bed.manager.handle_line("test 1.2.3.4", Local::now()).await,
+        bed.manager.handle_line("test 1.2.3.4", now).await,
         React::Trigger,
     );
 
@@ -1054,10 +1071,9 @@ async fn ip_specific() {
 
     bed.reset_out_file().await;
 
+    let now = crate::concepts::now();
     assert_eq!(
-        bed.manager
-            .handle_line("test 1:2:3:4:5:6:7:8", Local::now())
-            .await,
+        bed.manager.handle_line("test 1:2:3:4:5:6:7:8", now).await,
         React::Trigger,
     );
 
diff --git a/src/daemon/mod.rs b/src/daemon/mod.rs
index c68f8e2..18fb533 100644
--- a/src/daemon/mod.rs
+++ b/src/daemon/mod.rs
@@ -3,23 +3,25 @@ use std::{
     error::Error,
     path::PathBuf,
     sync::{
-        atomic::{AtomicBool, Ordering},
         Arc,
+        atomic::{AtomicBool, Ordering},
     },
 };
 
-use chrono::Local;
+use futures::future::join_all;
+use reaction_plugin::shutdown::{ShutdownController, ShutdownDelegate, ShutdownToken};
 use tokio::{
     select,
-    signal::unix::{signal, SignalKind},
+    signal::unix::{SignalKind, signal},
     sync::Semaphore,
 };
-use tracing::{debug, info};
+use tracing::{debug, error, info};
+use treedb::Database;
 
-use crate::{concepts::Config, treedb::Database};
+use crate::concepts::{Config, now};
 use filter::FilterManager;
 pub use filter::React;
-pub use shutdown::{ShutdownController, ShutdownDelegate, ShutdownToken};
+use plugin::Plugins;
 use socket::Socket;
 use stream::StreamManager;
 
@@ -27,30 +29,95 @@ use stream::StreamManager;
 pub use filter::tests;
 
 mod filter;
-mod shutdown;
+mod plugin;
 mod socket;
 mod stream;
+mod utils;
 
-pub async fn daemon(
-    config_path: PathBuf,
-    socket: PathBuf,
-) -> Result<(), Box<dyn Error + Send + Sync>> {
-    let config: &'static Config = Box::leak(Box::new(Config::from_path(&config_path)?));
+pub async fn daemon(config_path: PathBuf, socket: PathBuf) -> i32 {
+    // Load config or quit
+    let config: &'static Config = Box::leak(Box::new(match Config::from_path(&config_path) {
+        Ok(config) => config,
+        Err(err) => {
+            error!("{err}");
+            return 1;
+        }
+    }));
 
     // Cancellation Token
     let shutdown = ShutdownController::new();
 
-    // Open Database
-    let mut db = Database::open(config, shutdown.token()).await?;
-
-    // Open Socket
-    let socket = Socket::open(socket).await?;
-
-    // reaction won't abort on startup anymore, we can run start commands
-    if !config.start() {
-        return Err("a start command failed, exiting.".into());
+    // Cancel when we receive a quit signal
+    let signal_received = Arc::new(AtomicBool::new(false));
+    if let Err(err) = handle_signals(shutdown.delegate(), signal_received.clone()) {
+        error!("{err}");
+        return 1;
     }
 
+    let mut db = None;
+    let mut config_started = false;
+    let mut daemon_err = false;
+
+    // Start the real daemon 👹
+    if let Err(err) = daemon_start(
+        config,
+        socket,
+        shutdown.token(),
+        &mut db,
+        &mut config_started,
+    )
+    .await
+    {
+        error!("{err}");
+        daemon_err = true;
+    }
+
+    // Release last db's sender
+    let mut db_status = None;
+    if let Some(db) = db {
+        db_status = Some(db.quit());
+    }
+
+    debug!("Asking for all tasks to quit...");
+    shutdown.ask_shutdown();
+
+    debug!("Waiting for all tasks to quit...");
+    shutdown.wait_all_task_shutdown().await;
+
+    let mut stop_ok = true;
+    if config_started {
+        stop_ok = config.stop();
+    }
+
+    if daemon_err || !stop_ok {
+        return 1;
+    } else if let Some(mut db_status) = db_status
+        && let Ok(Err(err)) = db_status.try_recv()
+    {
+        error!("database error: {}", err);
+        return 1;
+    } else if !signal_received.load(Ordering::SeqCst) {
+        error!("quitting because all streams finished");
+        return 1;
+    } else {
+        return 0;
+    }
+}
+
+async fn daemon_start(
+    config: &'static Config,
+    socket: PathBuf,
+    shutdown: ShutdownToken,
+    db: &mut Option<Database>,
+    config_started: &mut bool,
+) -> Result<(), Box<dyn Error + Send + Sync>> {
+    let mut plugins = Plugins::new(config, shutdown.clone()).await?;
+
+    // Open Database
+    let (cancellation, task_tracker) = shutdown.clone().split();
+    let path = PathBuf::from(config.state_directory.clone());
+    *db = Some(Database::open(&path, cancellation, task_tracker).await?);
+
     let (state, stream_managers) = {
         // Semaphore limiting action execution concurrency
         let exec_limit = match config.concurrency {
@@ -59,65 +126,57 @@ pub async fn daemon(
         };
 
         // Filter managers
-        let now = Local::now();
+        let now = now();
         let mut state = HashMap::new();
         let mut stream_managers = Vec::new();
         for stream in config.streams.values() {
             let mut filter_managers = HashMap::new();
             for filter in stream.filters.values() {
-                let manager =
-                    FilterManager::new(filter, exec_limit.clone(), shutdown.token(), &mut db, now).await?;
+                let manager = FilterManager::new(
+                    filter,
+                    exec_limit.clone(),
+                    shutdown.clone(),
+                    db.as_mut().unwrap(),
+                    &mut plugins,
+                    now,
+                )
+                .await?;
                 filter_managers.insert(filter, manager);
             }
             state.insert(stream, filter_managers.clone());
 
-            stream_managers.push(StreamManager::new(
-                stream,
-                filter_managers,
-                shutdown.token(),
-            )?);
+            stream_managers.push(
+                StreamManager::new(stream, filter_managers, shutdown.clone(), &mut plugins).await?,
+            );
         }
         (state, stream_managers)
     };
 
-    // Run socket task
-    socket.manager(config, state, shutdown.token());
+    // Open socket and run task
+    let socket = Socket::open(socket).await?;
+    socket.manager(config, state, shutdown.clone());
+
+    // all core systems started, we can run start commands
+    *config_started = true;
+    if !config.start() {
+        return Err("a start command failed, exiting.".into());
+    }
+
+    // Finish plugin setup
+    plugins.start().await?;
+    plugins.manager();
 
     // Start Stream managers
-    let mut stream_task_handles = Vec::new();
-    for stream_manager in stream_managers {
-        stream_task_handles.push(tokio::spawn(async move { stream_manager.start().await }));
-    }
-
-    // Close streams when we receive a quit signal
-    let signal_received = Arc::new(AtomicBool::new(false));
-    handle_signals(shutdown.delegate(), signal_received.clone())?;
+    let stream_task_handles = stream_managers.into_iter().filter_map(|stream_manager| {
+        let standalone = stream_manager.is_standalone();
+        let handle = tokio::spawn(async move { stream_manager.start().await });
+        // Only wait for standalone streams
+        if standalone { Some(handle) } else { None }
+    });
 
     // Wait for all streams to quit
-    for task_handle in stream_task_handles {
-        let _ = task_handle.await;
-    }
-
-    // Release last db's sender
-    let mut db_status = db.quit();
-
-    debug!("Asking for all tasks to quit...");
-    shutdown.ask_shutdown();
-
-    debug!("Waiting for all tasks to quit...");
-    shutdown.wait_shutdown().await;
-
-    let stop_ok = config.stop();
-
-    if let Ok(Err(err)) = db_status.try_recv() {
-        Err(format!("database error: {}", err).into())
-    } else if !signal_received.load(Ordering::SeqCst) {
-        Err("quitting because all streams finished".into())
-    } else if !stop_ok {
-        Err("while executing stop command".into())
-    } else {
-        Ok(())
-    }
+    join_all(stream_task_handles).await;
+    Ok(())
 }
 
 fn handle_signals(
diff --git a/src/daemon/plugin/mod.rs b/src/daemon/plugin/mod.rs
new file mode 100644
index 0000000..c32e283
--- /dev/null
+++ b/src/daemon/plugin/mod.rs
@@ -0,0 +1,405 @@
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fmt::Display,
+    io,
+    ops::{Deref, DerefMut},
+    process::ExitStatus,
+    time::Duration,
+};
+
+use futures::{StreamExt, future::join_all};
+use reaction_plugin::{
+    ActionConfig, ActionImpl, Hello, PluginInfo, PluginInfoClient, StreamConfig, StreamImpl,
+};
+use remoc::Connect;
+use tokio::{
+    process::{Child, ChildStderr},
+    time::timeout,
+};
+use tracing::{error, info};
+
+use crate::{
+    concepts::{Action, Config, Plugin, Stream},
+    daemon::{ShutdownToken, stream::reader_to_stream, utils::kill_child},
+};
+
+pub struct PluginManager {
+    child: Child,
+    shutdown: ShutdownToken,
+    plugin: &'static Plugin,
+    plugin_info: PluginInfoClient,
+    streams: BTreeSet<String>,
+    actions: BTreeSet<String>,
+}
+
+impl Deref for PluginManager {
+    type Target = PluginInfoClient;
+    fn deref(&self) -> &Self::Target {
+        &self.plugin_info
+    }
+}
+impl DerefMut for PluginManager {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.plugin_info
+    }
+}
+
+impl PluginManager {
+    async fn new(
+        plugin: &'static Plugin,
+        state_directory: &str,
+        shutdown: ShutdownToken,
+    ) -> Result<Self, String> {
+        let mut child = plugin
+            .launch(state_directory)
+            .await
+            .map_err(|err| systemd_error(plugin, "could not launch plugin", err))?;
+
+        {
+            let stderr = child.stderr.take().unwrap();
+            // let shutdown = shutdown.clone();
+            tokio::spawn(async move { handle_stderr(stderr, plugin.name.clone()).await });
+        }
+
+        let stdin = child.stdin.take().unwrap();
+        let stdout = child.stdout.take().unwrap();
+
+        let (conn, _tx, mut rx): (
+            _,
+            remoc::rch::base::Sender<()>,
+            remoc::rch::base::Receiver<PluginInfoClient>,
+        ) = Connect::io(remoc::Cfg::default(), stdout, stdin)
+            .await
+            .map_err(|err| {
+                systemd_error(plugin, "could not init communication with plugin", err)
+            })?;
+
+        tokio::spawn(conn);
+
+        let mut plugin_info = rx
+            .recv()
+            .await
+            .map_err(|err| format!("could not retrieve initial information from plugin: {err}"))?
+            .ok_or("could not retrieve initial information from plugin: no data")?;
+
+        let manifest = plugin_info
+            .manifest()
+            .await
+            .map_err(|err| format!("error while getting plugin {} manifest: {err}", plugin.name))?;
+
+        let my_hello = Hello::new();
+
+        if let Err(hint) = Hello::is_compatible(&my_hello, &manifest.hello) {
+            return Err(format!(
+                "reaction can't handle plugin {} with incompatible version {}.{}: current version: {}.{}. {}",
+                plugin.name,
+                manifest.hello.version_major,
+                manifest.hello.version_minor,
+                my_hello.version_major,
+                my_hello.version_minor,
+                hint
+            ));
+        }
+
+        Ok(Self {
+            child,
+            shutdown,
+            plugin,
+            plugin_info,
+            streams: manifest.streams,
+            actions: manifest.actions,
+        })
+    }
+
+    async fn handle_child(mut self) {
+        const PLUGIN_STOP_GRACE_TIME: u64 = 15;
+
+        // wait either for the child process to exit on its own or for the shutdown signal
+        tokio::select! {
+            status = self.child.wait() => {
+                self.print_exit(status);
+                return;
+            }
+            _ = self.shutdown.wait() => {}
+        }
+
+        match timeout(
+            Duration::from_secs(PLUGIN_STOP_GRACE_TIME),
+            self.plugin_info.close(),
+        )
+        .await
+        {
+            Ok(Ok(())) => (),
+            Ok(Err(err)) => {
+                error!("plugin {}: {err}", self.plugin.name);
+            }
+            // got timeout
+            Err(_) => {
+                error!(
+                    "plugin {} did not respond to close request in time, killing",
+                    self.plugin.name
+                );
+                kill_child(self.child, format!("plugin {}", self.plugin.name), 5).await;
+            }
+        }
+    }
+
+    fn print_exit(&self, status: io::Result<ExitStatus>) {
+        match status {
+            Ok(status) => match status.code() {
+                Some(code) => {
+                    error!(
+                        "plugin {}: process exited. exit code: {}",
+                        self.plugin.name, code
+                    );
+                }
+                None => {
+                    error!("plugin {}: process exited.", self.plugin.name);
+                }
+            },
+            Err(err) => {
+                error!("plugin {}: process exited. {err}", self.plugin.name);
+            }
+        }
+    }
+}
+
+fn systemd_error(plugin: &Plugin, message: &str, err: impl Display) -> String {
+    if plugin.systemd {
+        format!(
+            "{message}: {err}. \
+`plugins.{0}.systemd` is set to true, so this may be an issue with systemd's run0. \
+please make sure `sudo run0 ls /` returns the same thing as `sudo ls /` as a test. \
+if run0 can't be found or doesn't output anything, set `plugins.{0}.systemd` to false.",
+            plugin.name,
+        )
+    } else {
+        format!("{message}: {err}")
+    }
+}
+
+async fn handle_stderr(stderr: ChildStderr, plugin_name: String) {
+    // read lines until shutdown
+    let lines = reader_to_stream(stderr);
+    tokio::pin!(lines);
+    loop {
+        match lines.next().await {
+            Some(Ok(line)) => {
+                // sad: I can't factorize this because the tracing::event! macro
+                // requires its log level to be a constant.
+                if line.starts_with("DEBUG ") {
+                    tracing::debug!("plugin {plugin_name}: {}", line.split_at(6).1)
+                } else if line.starts_with("INFO ") {
+                    tracing::info!("plugin {plugin_name}: {}", line.split_at(5).1)
+                } else if line.starts_with("WARN ") {
+                    tracing::warn!("plugin {plugin_name}: {}", line.split_at(5).1)
+                } else if line.starts_with("ERROR ") {
+                    tracing::error!("plugin {plugin_name}: {}", line.split_at(6).1)
+                } else {
+                    // If there is no log level, we suppose it's an error (may be a panic or something)
+                    tracing::error!("plugin {plugin_name}: {}", line)
+                }
+            }
+            Some(Err(err)) => {
+                tracing::error!("while trying to read plugin {plugin_name} stderr: {err}");
+                break;
+            }
+            None => break,
+        }
+    }
+}
+
+#[derive(Default)]
+pub struct Plugins {
+    /// Loaded plugins
+    plugins: BTreeMap<String, PluginManager>,
+    /// stream_type to plugin name
+    stream_to_plugin: BTreeMap<String, String>,
+    /// action_type to plugin name
+    action_to_plugin: BTreeMap<String, String>,
+    /// plugin name to config list
+    plugin_to_confs: BTreeMap<String, (Vec<&'static Stream>, Vec<&'static Action>)>,
+    /// stream name to impl
+    stream_to_impl: BTreeMap<String, StreamImpl>,
+    /// action name to impl
+    action_to_impl: BTreeMap<String, ActionImpl>,
+}
+
+impl Plugins {
+    pub async fn new(config: &'static Config, shutdown: ShutdownToken) -> Result<Self, String> {
+        let mut this = Self::default();
+
+        for plugin in config.plugins.values() {
+            let name = plugin.name.clone();
+            this.load_plugin(plugin, &config.state_directory, shutdown.clone())
+                .await
+                .map_err(|err| format!("plugin {name}: {err}]"))?;
+        }
+
+        this.aggregate_plugin_configs(config)?;
+
+        this.load_plugin_configs().await?;
+
+        Ok(this)
+    }
+
+    async fn load_plugin(
+        &mut self,
+        plugin: &'static Plugin,
+        state_directory: &str,
+        shutdown: ShutdownToken,
+    ) -> Result<(), String> {
+        let name = plugin.name.clone();
+        let manager = PluginManager::new(plugin, state_directory, shutdown).await?;
+
+        for stream in &manager.streams {
+            if let Some(name) = self.stream_to_plugin.insert(stream.clone(), name.clone()) {
+                return Err(format!(
+                    "plugin {name} already exposed a stream with type name '{stream}'",
+                ));
+            }
+        }
+
+        for action in &manager.actions {
+            if let Some(name) = self.action_to_plugin.insert(action.clone(), name.clone()) {
+                return Err(format!(
+                    "plugin {name} already exposed a action with type name '{action}'",
+                ));
+            }
+        }
+
+        self.plugins.insert(name, manager);
+        Ok(())
+    }
+
+    fn aggregate_plugin_configs(&mut self, config: &'static Config) -> Result<(), String> {
+        for stream in config.streams.values() {
+            if stream.is_plugin()
+                && let Some(stream_type) = &stream.stream_type
+            {
+                let plugin_name = self.stream_to_plugin.get(stream_type).ok_or_else(|| {
+                    display_plugin_exposed_types(&self.stream_to_plugin, "stream", stream_type)
+                })?;
+                let (streams, _) = self
+                    .plugin_to_confs
+                    .entry(plugin_name.to_owned())
+                    .or_default();
+                streams.push(stream);
+            }
+
+            for action in stream
+                .filters
+                .values()
+                .flat_map(|filter| filter.actions.values())
+            {
+                if action.is_plugin()
+                    && let Some(action_type) = &action.action_type
+                {
+                    let plugin_name = self.action_to_plugin.get(action_type).ok_or_else(|| {
+                        display_plugin_exposed_types(&self.action_to_plugin, "action", action_type)
+                    })?;
+                    let (_, actions) = self
+                        .plugin_to_confs
+                        .entry(plugin_name.to_owned())
+                        .or_default();
+                    actions.push(action);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    async fn load_plugin_configs(&mut self) -> Result<(), String> {
+        let plugin_to_confs = std::mem::take(&mut self.plugin_to_confs);
+        for (plugin_name, (streams, actions)) in plugin_to_confs {
+            let plugin = self
+                .plugins
+                .get_mut(&plugin_name)
+                .ok_or_else(|| format!("could not find plugin {plugin_name}. this is a bug!"))?;
+
+            let stream_names: Vec<String> =
+                streams.iter().map(|stream| stream.name.clone()).collect();
+            let action_names: Vec<String> =
+                actions.iter().map(|action| action.to_string()).collect();
+
+            let (stream_impls, action_impls) = plugin
+                .load_config(
+                    streams
+                        .into_iter()
+                        .map(Stream::to_stream_config)
+                        .collect::<Result<Vec<StreamConfig>, String>>()?,
+                    actions
+                        .into_iter()
+                        .map(Action::to_action_config)
+                        .collect::<Result<Vec<ActionConfig>, String>>()?,
+                )
+                .await
+                .map_err(|err| {
+                    format!("plugin {plugin_name} is not happy with your config: {err}")
+                })?;
+
+            self.stream_to_impl
+                .extend(stream_names.into_iter().zip(stream_impls));
+            self.action_to_impl
+                .extend(action_names.into_iter().zip(action_impls));
+        }
+
+        Ok(())
+    }
+
+    pub fn get_stream_impl(&mut self, stream_name: String) -> Option<StreamImpl> {
+        self.stream_to_impl.remove(&stream_name)
+    }
+
+    pub fn get_action_impl(&mut self, action_fullname: String) -> Option<ActionImpl> {
+        self.action_to_impl.remove(&action_fullname)
+    }
+
+    pub async fn start(&mut self) -> Result<(), String> {
+        // Finish setup of all plugins
+        join_all(
+            self.plugins
+                .values_mut()
+                .map(|plugin_manager| plugin_manager.start()),
+        )
+        .await
+        // Convert Vec<Result<Result>> into Result
+        .into_iter()
+        .zip(self.plugins.values())
+        .try_for_each(|(result, plugin_manager)| {
+            result.map_err(|err| {
+                format!(
+                    "plugin {}: {}",
+                    plugin_manager.plugin.name,
+                    err.to_string().replace('\n', " ")
+                )
+            })
+        })
+    }
+
+    pub fn manager(self) {
+        for plugin in self.plugins.into_values() {
+            tokio::spawn(async move {
+                plugin.handle_child().await;
+            });
+        }
+    }
+}
+
+fn display_plugin_exposed_types(
+    type_to_plugin: &BTreeMap<String, String>,
+    name: &str,
+    invalid: &str,
+) -> String {
+    let mut plugin_to_types: BTreeMap<&str, Vec<&str>> = BTreeMap::new();
+    for (type_, plugin) in type_to_plugin {
+        plugin_to_types.entry(plugin).or_default().push(type_);
+    }
+    for (plugin, types) in plugin_to_types {
+        info!(
+            "Plugin {plugin} exposes those {name} types: '{}'",
+            types.join("', '")
+        );
+    }
+    format!("No plugin provides the {name} type: {invalid}")
+}
diff --git a/src/daemon/shutdown.rs b/src/daemon/shutdown.rs
deleted file mode 100644
index a311ad1..0000000
--- a/src/daemon/shutdown.rs
+++ /dev/null
@@ -1,91 +0,0 @@
-use tokio::sync::mpsc;
-use tokio_util::sync::{CancellationToken, WaitForCancellationFuture};
-
-// Thanks to this article for inspiration
-// https://www.wcygan.io/post/tokio-graceful-shutdown/
-// Now TaskTracker exist, but I don't know what I'd gain for using it instead?
-// https://docs.rs/tokio-util/0.7.13/tokio_util/task/task_tracker/struct.TaskTracker.html
-
-/// Permits to keep track of ongoing tasks and ask them to shutdown.
-pub struct ShutdownController {
-    shutdown_notifyer: CancellationToken,
-    task_tracker: mpsc::Sender<()>,
-    task_waiter: mpsc::Receiver<()>,
-}
-
-impl ShutdownController {
-    #[allow(clippy::new_without_default)]
-    pub fn new() -> Self {
-        let (task_tracker, task_waiter) = mpsc::channel(1);
-        Self {
-            shutdown_notifyer: CancellationToken::new(),
-            task_tracker,
-            task_waiter,
-        }
-    }
-
-    /// Ask for all tasks to quit
-    pub fn ask_shutdown(&self) {
-        self.shutdown_notifyer.cancel();
-    }
-
-    /// Wait for all tasks to quit.
-    /// This task may return even without having called [`ShutdownController::ask_shutdown`]
-    /// first, if all tasks quit by themselves.
-    pub async fn wait_shutdown(mut self) {
-        drop(self.task_tracker);
-        self.task_waiter.recv().await;
-    }
-
-    /// Returns a new shutdown token, to be held by a task.
-    pub fn token(&self) -> ShutdownToken {
-        ShutdownToken::new(self.shutdown_notifyer.clone(), self.task_tracker.clone())
-    }
-
-    /// Returns a [`ShutdownDelegate`], which is able to ask for shutdown,
-    /// without counting as a task that needs to be awaited.
-    pub fn delegate(&self) -> ShutdownDelegate {
-        ShutdownDelegate(self.shutdown_notifyer.clone())
-    }
-}
-
-/// Permits to ask for shutdown, without counting as a task that needs to be awaited.
-pub struct ShutdownDelegate(CancellationToken);
-
-impl ShutdownDelegate {
-    /// Ask for all tasks to quit
-    pub fn ask_shutdown(&self) {
-        self.0.cancel();
-    }
-}
-
-/// Created by a [`ShutdownController`].
-/// Serves two purposes:
-///
-/// - Wait for a shutdown request to happen.
-/// - Keep track of the current task. While this token is held,
-///   the [`ShutdownController::wait_shutdown`] will block.
-#[derive(Clone)]
-pub struct ShutdownToken {
-    shutdown_notifyer: CancellationToken,
-    _task_tracker: mpsc::Sender<()>,
-}
-
-impl ShutdownToken {
-    fn new(shutdown_notifyer: CancellationToken, _task_tracker: mpsc::Sender<()>) -> Self {
-        Self {
-            shutdown_notifyer,
-            _task_tracker,
-        }
-    }
-
-    /// Returns a future that will resolve only when a shutdown request happened.
-    pub fn wait(&self) -> WaitForCancellationFuture<'_> {
-        self.shutdown_notifyer.cancelled()
-    }
-
-    /// Ask for all tasks to quit
-    pub fn ask_shutdown(&self) {
-        self.shutdown_notifyer.cancel();
-    }
-}
diff --git a/src/daemon/socket.rs b/src/daemon/socket.rs
index 124b6c5..bdc6fe9 100644
--- a/src/daemon/socket.rs
+++ b/src/daemon/socket.rs
@@ -4,8 +4,8 @@ use std::{
     sync::Arc,
 };
 
-use chrono::Local;
 use futures::{SinkExt, StreamExt};
+use reaction_plugin::shutdown::ShutdownToken;
 use regex::Regex;
 use tokio::{fs, net::UnixListener};
 use tokio_util::{
@@ -15,11 +15,11 @@ use tokio_util::{
 use tracing::{error, warn};
 
 use crate::{
-    concepts::{Config, Filter, Pattern, Stream},
+    concepts::{Config, Filter, Pattern, Stream, now},
     protocol::{ClientRequest, ClientStatus, DaemonResponse, Order},
 };
 
-use super::{filter::FilterManager, shutdown::ShutdownToken};
+use super::filter::FilterManager;
 
 async fn open_socket(path: PathBuf) -> Result<UnixListener, String> {
     macro_rules! err_str {
@@ -99,8 +99,7 @@ async fn handle_trigger_order(
         }
     };
 
-    let now = Local::now();
-    match filter_manager.handle_trigger(patterns, now).await {
+    match filter_manager.handle_trigger(patterns, now()).await {
         Ok(()) => DaemonResponse::Ok(()),
         Err(err) => DaemonResponse::Err(err),
     }
@@ -113,7 +112,7 @@ async fn handle_show_or_flush_order(
     order: Order,
     shared_state: &HashMap<&'static Stream, HashMap<&'static Filter, FilterManager>>,
 ) -> DaemonResponse {
-    let now = Local::now();
+    let now = now();
     let iter = shared_state
         .iter()
         // stream filtering
diff --git a/src/daemon/stream.rs b/src/daemon/stream.rs
index a55d449..3ed0d56 100644
--- a/src/daemon/stream.rs
+++ b/src/daemon/stream.rs
@@ -1,26 +1,21 @@
 use std::{
-    collections::{BTreeMap, BTreeSet, HashMap},
+    collections::{BTreeSet, HashMap},
     process::Stdio,
-    time::Duration,
 };
 
-use chrono::Local;
-use futures::{FutureExt, Stream as AsyncStream, StreamExt};
-use regex::RegexSet;
+use futures::{FutureExt, Stream as AsyncStream, StreamExt, future::join_all};
+use reaction_plugin::{StreamImpl, shutdown::ShutdownToken};
 use tokio::{
     io::{AsyncBufReadExt, BufReader},
     process::{Child, ChildStderr, ChildStdout, Command},
-    time::sleep,
 };
-use tracing::{error, info, warn};
+use tracing::{debug, error, info};
 
 use crate::{
-    concepts::{Filter, Stream},
-    daemon::filter::FilterManager,
+    concepts::{Filter, Stream, Time, now},
+    daemon::{filter::FilterManager, plugin::Plugins, utils::kill_child},
 };
 
-use super::shutdown::ShutdownToken;
-
 /// Converts bytes to line string, discarding invalid utf8 sequences and newlines at the end
 fn to_line(data: &[u8]) -> String {
     String::from_utf8_lossy(data)
@@ -28,7 +23,7 @@ fn to_line(data: &[u8]) -> String {
         .replace(std::char::REPLACEMENT_CHARACTER, "")
 }
 
-fn reader_to_stream(
+pub fn reader_to_stream(
     reader: impl tokio::io::AsyncRead + Unpin,
 ) -> impl AsyncStream<Item = Result<String, std::io::Error>> {
     let buf_reader = BufReader::new(reader);
@@ -49,38 +44,117 @@ fn reader_to_stream(
 }
 
 pub struct StreamManager {
-    compiled_regex_set: RegexSet,
     regex_index_to_filter_manager: Vec<FilterManager>,
     stream: &'static Stream,
+    stream_plugin: Option<StreamImpl>,
     shutdown: ShutdownToken,
 }
 
 impl StreamManager {
-    pub fn new(
+    pub async fn new(
         stream: &'static Stream,
         filter_managers: HashMap<&'static Filter, FilterManager>,
         shutdown: ShutdownToken,
-    ) -> Result<Self, regex::Error> {
-        let all_regexes: BTreeMap<_, _> = filter_managers
+        plugins: &mut Plugins,
+    ) -> Result<Self, String> {
+        let stream_plugin = if stream.is_plugin() {
+            Some(
+                plugins
+                    .get_stream_impl(stream.name.clone())
+                    .ok_or_else(|| {
+                        format!(
+                            "stream {} doesn't load a plugin. this is a bug!",
+                            stream.name
+                        )
+                    })?,
+            )
+        } else {
+            None
+        };
+
+        let regex_index_to_filter_manager = stream
+            .regex_index_to_filter_name
             .iter()
-            .flat_map(|(filter, filter_manager)| {
-                filter
-                    .regex
+            .map(|filter_name| {
+                filter_managers
                     .iter()
-                    .map(|regex| (regex, filter_manager.clone()))
+                    .find(|(filter, _)| filter_name == &filter.name)
+                    .unwrap()
+                    .1
+                    .clone()
             })
             .collect();
 
+        debug!("successfully initialized stream {}", stream.name);
+
         Ok(StreamManager {
-            compiled_regex_set: RegexSet::new(all_regexes.keys())?,
-            regex_index_to_filter_manager: all_regexes.into_values().collect(),
+            regex_index_to_filter_manager,
             stream,
+            stream_plugin,
             shutdown,
         })
     }
 
-    pub async fn start(self) {
+    pub fn is_standalone(&self) -> bool {
+        match &self.stream_plugin {
+            Some(plugin) => plugin.standalone,
+            None => true,
+        }
+    }
+
+    pub async fn start(mut self) {
+        // First start FilterManagers persisted actions
+        let now = now();
+        join_all(
+            self.regex_index_to_filter_manager
+                .iter()
+                .map(|filter_manager| filter_manager.start(now)),
+        )
+        .await;
+
+        // Then start stream
         info!("{}: start {:?}", self.stream.name, self.stream.cmd);
+
+        if self.stream_plugin.is_some() {
+            self.start_plugin().await
+        } else {
+            self.start_cmd().await
+        }
+    }
+
+    async fn start_plugin(&mut self) {
+        let mut plugin = self.stream_plugin.take().unwrap();
+
+        loop {
+            match plugin.stream.recv().await {
+                Ok(Some((line, time))) => {
+                    self.handle_line(line, time.into()).await;
+                }
+                Err(err) => {
+                    if err.is_final() {
+                        error!(
+                            "error reading from plugin stream {}: {}",
+                            self.stream.name, err
+                        );
+                        return;
+                    } else {
+                        error!(
+                            "temporary error reading from plugin stream {}: {}",
+                            self.stream.name, err
+                        );
+                    }
+                }
+                Ok(None) => {
+                    if !self.shutdown.is_shutdown() {
+                        error!("stream {} has exited", self.stream.name);
+                    }
+                    return;
+                }
+            }
+        }
+    }
+
+    async fn start_cmd(&self) {
         let mut child = match Command::new(&self.stream.cmd[0])
             .args(&self.stream.cmd[1..])
             .stdin(Stdio::null())
@@ -110,9 +184,6 @@ impl StreamManager {
     }
 
     async fn handle_child(&self, mut child: Child) {
-        const STREAM_PROCESS_GRACE_TIME_SEC: u64 = 15;
-        const STREAM_PROCESS_KILL_WAIT_TIMEOUT_SEC: u64 = 5;
-
         // wait either for the child process to exit on its own or for the shutdown signal
         futures::select! {
             _ = child.wait().fuse() => {
@@ -122,43 +193,7 @@ impl StreamManager {
             _ = self.shutdown.wait().fuse() => {}
         }
 
-        // first, try to ask nicely the child process to exit
-        if let Some(pid) = child.id() {
-            let pid = nix::unistd::Pid::from_raw(pid as i32);
-
-            // the most likely error is that the process does not exist anymore
-            // but we still need to reclaim it with Child::wait
-            let _ = nix::sys::signal::kill(pid, nix::sys::signal::SIGTERM);
-
-            futures::select! {
-                _ = child.wait().fuse() => {
-                    return;
-                },
-                _ = sleep(Duration::from_secs(STREAM_PROCESS_GRACE_TIME_SEC)).fuse() => {},
-            }
-        } else {
-            warn!(
-                "could not get PID of child process for stream {}",
-                self.stream.name
-            );
-            // still try to use tokio API to kill and reclaim the child process
-        }
-
-        // if that fails, or we cannot get the underlying PID, terminate the process.
-        // NOTE: processes killed with SIGKILL are not guaranteed to exit. They can be locked up in a
-        // syscall to a resource no-longer available (a notorious example is a read on a disconnected
-        // NFS share)
-
-        // as before, the only expected error is that the child process already terminated
-        // but we still need to reclaim it if that's the case.
-        let _ = child.start_kill();
-
-        futures::select! {
-            _ = child.wait().fuse() => {}
-            _ = sleep(Duration::from_secs(STREAM_PROCESS_KILL_WAIT_TIMEOUT_SEC)).fuse() => {
-                error!("child process of stream {} did not terminate", self.stream.name);
-            }
-        }
+        kill_child(child, format!("stream {}", self.stream.name), 15).await;
     }
 
     async fn handle_io(&self, child_stdout: ChildStdout, child_stderr: ChildStderr) {
@@ -171,10 +206,8 @@ impl StreamManager {
         loop {
             match lines.next().await {
                 Some(Ok(line)) => {
-                    let now = Local::now();
-                    for manager in self.matching_filters(&line) {
-                        manager.handle_line(&line, now).await;
-                    }
+                    let now = now();
+                    self.handle_line(line, now).await;
                 }
                 Some(Err(err)) => {
                     error!(
@@ -190,8 +223,14 @@ impl StreamManager {
         }
     }
 
+    async fn handle_line(&self, line: String, time: Time) {
+        for manager in self.matching_filters(&line) {
+            manager.handle_line(&line, time).await;
+        }
+    }
+
     fn matching_filters(&self, line: &str) -> BTreeSet<&FilterManager> {
-        let matches = self.compiled_regex_set.matches(line);
+        let matches = self.stream.compiled_regex_set.matches(line);
         matches
             .into_iter()
             .map(|match_| &self.regex_index_to_filter_manager[match_])
diff --git a/src/daemon/utils.rs b/src/daemon/utils.rs
new file mode 100644
index 0000000..4ec94ae
--- /dev/null
+++ b/src/daemon/utils.rs
@@ -0,0 +1,51 @@
+use std::time::Duration;
+
+use tokio::{process::Child, time::timeout};
+use tracing::{error, warn};
+
+pub async fn kill_child(mut child: Child, context: String, grace_time_sec: u64) {
+    const STREAM_PROCESS_KILL_WAIT_TIMEOUT_SEC: u64 = 5;
+
+    // first, try to ask nicely the child process to exit
+    if let Some(pid) = child.id() {
+        let pid = nix::unistd::Pid::from_raw(pid as i32);
+
+        // the most likely error is that the process does not exist anymore
+        // but we still need to reclaim it with Child::wait
+        let _ = nix::sys::signal::kill(pid, nix::sys::signal::SIGTERM);
+
+        if let Ok(_) = timeout(Duration::from_secs(grace_time_sec), child.wait()).await {
+            return;
+        }
+    } else {
+        warn!("could not get PID of child process for {context}");
+        // still try to use tokio API to kill and reclaim the child process
+    }
+
+    // if that fails, or we cannot get the underlying PID, terminate the process.
+    // NOTE: processes killed with SIGKILL are not guaranteed to exit. They can be locked up in a
+    // syscall to a resource no-longer available (a notorious example is a read on a disconnected
+    // NFS share)
+
+    // as before, the only expected error is that the child process already terminated
+    // but we still need to reclaim it if that's the case.
+    warn!("process for {context} didn't exit {grace_time_sec}s after SIGTERM, sending SIGKILL");
+    let _ = child.start_kill();
+
+    match timeout(
+        Duration::from_secs(STREAM_PROCESS_KILL_WAIT_TIMEOUT_SEC),
+        child.wait(),
+    )
+    .await
+    {
+        Ok(_) => {}
+        Err(_) => match child.id() {
+            Some(id) => {
+                error!("child process of {context} did not terminate. PID: {id}");
+            }
+            None => {
+                error!("child process of {context} did not terminate");
+            }
+        },
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index 3619f1a..3bd0acf 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,10 +1,4 @@
-#![warn(
-    clippy::panic,
-    clippy::todo,
-    clippy::unimplemented,
-    clippy::unwrap_used,
-    unsafe_code
-)]
+#![warn(clippy::panic, clippy::todo, clippy::unimplemented, unsafe_code)]
 #![allow(clippy::upper_case_acronyms, clippy::mutable_key_type)]
 // Allow unwrap in tests
 #![cfg_attr(test, allow(clippy::unwrap_used))]
@@ -15,4 +9,3 @@ pub mod concepts;
 pub mod daemon;
 pub mod protocol;
 pub mod tests;
-pub mod treedb;
diff --git a/src/main.rs b/src/main.rs
index a6e22c6..e1db591 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -7,7 +7,6 @@ use reaction::{
     daemon::daemon,
     protocol::Order,
 };
-use tracing::{error, Level};
 
 #[tokio::main]
 async fn main() {
@@ -28,68 +27,64 @@ async fn main() {
 
     let cli = Cli::parse();
 
-    let (is_daemon, level) = if let SubCommand::Start { loglevel, .. } = cli.command {
-        (true, loglevel)
-    } else {
-        (false, Level::DEBUG)
-    };
-
-    if is_daemon {
-        // Set log level
+    if let SubCommand::Start {
+        loglevel,
+        config,
+        socket,
+    } = cli.command
+    {
         if let Err(err) = tracing_subscriber::fmt::fmt()
             .without_time()
             .with_target(false)
             .with_ansi(std::io::stdout().is_terminal())
-            .with_max_level(level)
+            .with_max_level(loglevel)
             // .with_max_level(Level::TRACE)
             .try_init()
         {
             eprintln!("ERROR could not initialize logging: {err}");
             exit(1);
         }
-    }
-
-    let result = match cli.command {
-        SubCommand::Start { config, socket, .. } => daemon(config, socket).await,
-        SubCommand::Show {
-            socket,
-            format,
-            limit,
-            patterns,
-        } => request(socket, format, limit, patterns, Order::Show).await,
-        SubCommand::Flush {
-            socket,
-            format,
-            limit,
-            patterns,
-        } => request(socket, format, limit, patterns, Order::Flush).await,
-        SubCommand::Trigger {
-            socket,
-            limit,
-            patterns,
-        } => request(socket, Format::JSON, Some(limit), patterns, Order::Trigger).await,
-        SubCommand::TestRegex {
-            config,
-            regex,
-            line,
-        } => test_regex(config, regex, line),
-        SubCommand::TestConfig {
-            config,
-            format,
-            verbose,
-        } => test_config(config, format, verbose),
-    };
-    match result {
-        Ok(()) => {
-            exit(0);
-        }
-        Err(err) => {
-            if is_daemon {
-                error!("{err}");
-            } else {
-                eprintln!("ERROR {err}");
+        exit(daemon(config, socket).await);
+    } else {
+        let result = match cli.command {
+            SubCommand::Show {
+                socket,
+                format,
+                limit,
+                patterns,
+            } => request(socket, format, limit, patterns, Order::Show).await,
+            SubCommand::Flush {
+                socket,
+                format,
+                limit,
+                patterns,
+            } => request(socket, format, limit, patterns, Order::Flush).await,
+            SubCommand::Trigger {
+                socket,
+                limit,
+                patterns,
+            } => request(socket, Format::JSON, Some(limit), patterns, Order::Trigger).await,
+            SubCommand::TestRegex {
+                config,
+                regex,
+                line,
+            } => test_regex(config, regex, line),
+            SubCommand::TestConfig {
+                config,
+                format,
+                verbose,
+            } => test_config(config, format, verbose),
+            // Can't be daemon
+            _ => Ok(()),
+        };
+        match result {
+            Ok(()) => {
+                exit(0);
+            }
+            Err(err) => {
+                eprintln!("ERROR {err}");
+                exit(1);
             }
-            exit(1);
         }
     }
 }
diff --git a/src/tests.rs b/src/tests.rs
index f017f25..9eae17d 100644
--- a/src/tests.rs
+++ b/src/tests.rs
@@ -9,7 +9,7 @@ use std::{
 
 use tempfile::TempDir;
 
-use crate::treedb::{Database, LoadedDB};
+use treedb::{Database, LoadedDB};
 
 pub struct Fixture {
     path: PathBuf,
diff --git a/tests/conf_load.rs b/tests/conf_load.rs
index 048f6ca..4968621 100644
--- a/tests/conf_load.rs
+++ b/tests/conf_load.rs
@@ -1,10 +1,10 @@
 use std::error::Error;
 
-use assert_cmd::Command;
+use assert_cmd::cargo::cargo_bin_cmd;
 
 #[test]
 fn load_conf_directory() -> Result<(), Box<dyn Error>> {
-    let mut cmd = Command::cargo_bin("reaction")?;
+    let mut cmd = cargo_bin_cmd!("reaction");
     cmd.args([
         "test-config",
         "--verbose",
@@ -70,7 +70,7 @@ streams:
 fn example_configs_are_equal() {
     let outputs = ["config/example.yml", "config/example.jsonnet"]
         .map(|config_path| {
-            let mut cmd = Command::cargo_bin("reaction").unwrap();
+            let mut cmd = cargo_bin_cmd!("reaction");
             cmd.args(["test-config", "--config", config_path]);
             cmd.assert().success().get_output().stdout.clone()
         })
diff --git a/tests/end_to_end.rs b/tests/end_to_end.rs
index 7d68890..cfe09d6 100644
--- a/tests/end_to_end.rs
+++ b/tests/end_to_end.rs
@@ -1,6 +1,6 @@
 use std::{error::Error, path::Path, process::Stdio, thread::sleep, time::Duration};
 
-use assert_cmd::Command;
+use assert_cmd::cargo::cargo_bin_cmd;
 use assert_fs::prelude::*;
 use nix::sys::signal;
 use predicates::prelude::predicate;
@@ -14,7 +14,7 @@ fn actions_delayed_and_on_exit() -> Result<(), Box<dyn Error>> {
         .child("config.jsonnet")
         .write_file(Path::new("tests/test-conf/test-after.jsonnet"))?;
 
-    let mut cmd = Command::cargo_bin("reaction")?;
+    let mut cmd = cargo_bin_cmd!("reaction");
     cmd.args(["start", "--socket", "./s", "--config", "./config.jsonnet"]);
     cmd.current_dir(tmp_dir.path());
     cmd.timeout(Duration::from_secs(5));
@@ -46,7 +46,7 @@ fn kill_stream_on_exit() -> Result<(), Box<dyn Error>> {
         .child("config.jsonnet")
         .write_file(Path::new("tests/test-conf/test-shutdown.jsonnet"))?;
 
-    let cmd = Command::cargo_bin("reaction")?;
+    let cmd = cargo_bin_cmd!("reaction");
     let mut cmd = std::process::Command::new(cmd.get_program());
     cmd.args(["start", "--socket", "./s", "--config", "./config.jsonnet"]);
     cmd.current_dir(tmp_dir.path());
@@ -84,7 +84,7 @@ fn kill_stream_on_exit() -> Result<(), Box<dyn Error>> {
             let _ = signal::kill(pid, signal::SIGKILL);
             let _ = child.wait();
 
-            assert!(false, "Test timed out");
+            panic!("Test timed out");
         }
     }
 
@@ -103,7 +103,7 @@ fn non_utf8_is_stripped() -> Result<(), Box<dyn Error>> {
         .child("config.jsonnet")
         .write_file(Path::new("tests/test-conf/test-binary-input.jsonnet"))?;
 
-    let mut cmd = Command::cargo_bin("reaction")?;
+    let mut cmd = cargo_bin_cmd!("reaction");
     cmd.args(["start", "--socket", "./s", "--config", "config.jsonnet"]);
     cmd.current_dir(tmp_dir.path());
     cmd.timeout(std::time::Duration::from_secs(1));
@@ -124,7 +124,7 @@ fn capture_streams_stderr() -> Result<(), Box<dyn Error>> {
         .child("config.jsonnet")
         .write_file(Path::new("tests/test-conf/test-stream-stderr.jsonnet"))?;
 
-    let mut cmd = Command::cargo_bin("reaction")?;
+    let mut cmd = cargo_bin_cmd!("reaction");
     cmd.args(["start", "--socket", "./s", "--config", "config.jsonnet"]);
     cmd.current_dir(tmp_dir.path());
     cmd.timeout(std::time::Duration::from_secs(1));
@@ -149,7 +149,7 @@ fn manualy_trigger_filter() -> Result<(), Box<dyn Error>> {
         .write_file(Path::new("tests/test-conf/test-trigger.jsonnet"))?;
 
     // start daemon
-    let cmd = Command::cargo_bin("reaction")?;
+    let cmd = cargo_bin_cmd!("reaction");
     let program = cmd.get_program();
     let mut cmd = std::process::Command::new(program);
     cmd.args(["start", "--socket", "./s", "--config", "config.jsonnet"]);
@@ -173,7 +173,7 @@ fn manualy_trigger_filter() -> Result<(), Box<dyn Error>> {
         if elapsed > Duration::from_secs(1) {
             let _ = daemon.kill();
             let _ = daemon.wait();
-            assert!(false, "Daemon did not create socket");
+            panic!("Daemon did not create socket");
         }
     }
 
@@ -181,7 +181,7 @@ fn manualy_trigger_filter() -> Result<(), Box<dyn Error>> {
     let socket_path = socket.path().to_str().unwrap();
 
     // trigger event manually
-    let mut cmd_trigger = Command::cargo_bin("reaction")?;
+    let mut cmd_trigger = cargo_bin_cmd!("reaction");
     cmd_trigger.current_dir(tmp_dir.path());
     cmd_trigger.args(["trigger", "--socket", socket_path, "s1.f1", "num=95"]);
     cmd_trigger.timeout(Duration::from_secs(1));
@@ -204,7 +204,7 @@ fn manualy_trigger_filter() -> Result<(), Box<dyn Error>> {
         if elapsed > Duration::from_secs(2) {
             let _ = daemon.kill();
             let _ = daemon.wait();
-            assert!(false, "Daemon did not exit");
+            panic!("Daemon did not exit");
         }
     }
 
@@ -221,7 +221,7 @@ fn filter_regex_match_eol() -> Result<(), Box<dyn Error>> {
         .child("config.jsonnet")
         .write_file(Path::new("tests/test-conf/test-eol-match.jsonnet"))?;
 
-    let mut cmd = Command::cargo_bin("reaction")?;
+    let mut cmd = cargo_bin_cmd!("reaction");
     cmd.args(["start", "--socket", "./s", "--config", "config.jsonnet"]);
     cmd.current_dir(tmp_dir.path());
     cmd.timeout(std::time::Duration::from_secs(1));
diff --git a/tests/notif.jsonnet b/tests/notif.jsonnet
index 2e46471..14d76c0 100644
--- a/tests/notif.jsonnet
+++ b/tests/notif.jsonnet
@@ -41,6 +41,23 @@
             },
           },
         },
+        f2: {
+          regex: [
+            "^can't found <num>$",
+          ],
+          retry: 2,
+          retryperiod: '60s',
+          actions: {
+            damn: {
+              cmd: ['notify-send', 'you should not see that', 'ban <num>'],
+            },
+            undamn: {
+              cmd: ['notify-send', 'you should not see that', 'unban <num>'],
+              after: '3s',
+              onexit: true,
+            },
+          },
+        },
       },
     },
   },
diff --git a/tests/persistence.rs b/tests/persistence.rs
index 3cbfd74..d68db33 100644
--- a/tests/persistence.rs
+++ b/tests/persistence.rs
@@ -1,6 +1,6 @@
 use std::{error::Error, path::Path, time::Duration};
 
-use assert_cmd::Command;
+use assert_cmd::cargo::cargo_bin_cmd;
 use assert_fs::prelude::*;
 use predicates::prelude::predicate;
 
@@ -13,7 +13,7 @@ fn resume_action() -> Result<(), Box<dyn Error>> {
         .write_file(Path::new("tests/test-conf/test-resume-action.jsonnet"))?;
 
     // first run
-    let mut cmd = Command::cargo_bin("reaction")?;
+    let mut cmd = cargo_bin_cmd!("reaction");
     cmd.args(["start", "--socket", "./s", "--config", "./config.jsonnet"]);
     cmd.current_dir(tmp_dir.path());
     cmd.timeout(Duration::from_secs(5));
@@ -25,7 +25,7 @@ fn resume_action() -> Result<(), Box<dyn Error>> {
     tmp_dir.child("log").assert(&expected);
 
     // second run, expect to resume action
-    let mut cmd = Command::cargo_bin("reaction")?;
+    let mut cmd = cargo_bin_cmd!("reaction");
     cmd.args(["start", "--socket", "./s", "--config", "./config.jsonnet"]);
     cmd.current_dir(tmp_dir.path());
     cmd.timeout(Duration::from_secs(5));
diff --git a/tests/plugin_cluster.rs b/tests/plugin_cluster.rs
new file mode 100644
index 0000000..2fc99c2
--- /dev/null
+++ b/tests/plugin_cluster.rs
@@ -0,0 +1,127 @@
+use std::{fs::read_to_string, path::Path, thread, time::Duration};
+
+use assert_cmd::{Command, cargo::cargo_bin_cmd};
+use assert_fs::prelude::*;
+
+const SECRET_KEY_A: &str = "g7U1LPq2cgGSyk6CH_v1QpoXowSFKVQ8IcFljd_ZKGw=";
+const PUBLIC_KEY_A: &str = "HhVh7ghqpXM9375HZ82OOeB504HBSS25wgug-1vUggY=";
+
+const SECRET_KEY_B: &str = "5EgRjwIpqd60IXWCGg5dFTtxkI-0fS1PlhoIhUjh1eY=";
+const PUBLIC_KEY_B: &str = "LPSQ9pS7m_5vvNC-fhoBNeL2-eS2Fd6aO4ImSnXp3lc=";
+
+// require UDP ports 9876-9879 to be free on 127.0.0.1
+
+#[test]
+#[ignore = "failing for now"]
+fn plugin_cluster_same_startup() {
+    // First build reaction-plugin-cluster
+    Command::new("cargo")
+        .args(["build", "-p", "reaction-plugin-cluster"])
+        .unwrap();
+
+    let config = read_to_string("tests/test-conf/test-cluster.jsonnet").unwrap();
+
+    let config_a = config
+        .replace("PUBLIC_KEY", PUBLIC_KEY_B)
+        .replace("NODE", "A")
+        .replace("1234", "9876")
+        .replace("4321", "9877");
+    let config_b = config
+        .replace("PUBLIC_KEY", PUBLIC_KEY_A)
+        .replace("NODE", "B")
+        .replace("1234", "9877")
+        .replace("4321", "9876");
+
+    let output_a = vec![
+        "B a0 1", "B a0 2", "B a0 3", "B a0 4", "B b0 1", "B b0 2", "B b0 3", "B b0 4", "",
+    ];
+    let output_b = vec![
+        "A a0 1", "A a0 2", "A a0 3", "A a0 4", "A b0 1", "A b0 2", "A b0 3", "A b0 4", "",
+    ];
+
+    let a_handle = thread::spawn(|| launch_node(config_a, SECRET_KEY_A, output_a));
+    let b_handle = thread::spawn(|| launch_node(config_b, SECRET_KEY_B, output_b));
+
+    a_handle.join().unwrap();
+    b_handle.join().unwrap();
+}
+
+#[test]
+#[ignore = "failing for now"]
+fn plugin_cluster_different_startup() {
+    // First build reaction-plugin-cluster
+    Command::new("cargo")
+        .args(["build", "-p", "reaction-plugin-cluster"])
+        .unwrap();
+
+    let config = read_to_string("tests/test-conf/test-cluster.jsonnet").unwrap();
+
+    let config_a = config
+        .replace("PUBLIC_KEY", PUBLIC_KEY_B)
+        .replace("NODE", "A")
+        .replace("1234", "9878")
+        .replace("4321", "9879");
+    let config_b = config
+        .replace("PUBLIC_KEY", PUBLIC_KEY_A)
+        .replace("NODE", "B")
+        .replace("1234", "9879")
+        .replace("4321", "9878");
+
+    let output_a = vec![
+        "B a0 1", "B a0 2", "B a0 3", "B a0 4", "B b0 1", "B b0 2", "B b0 3", "B b0 4", "",
+    ];
+    let output_b = vec![
+        "A a0 1", "A a0 2", "A a0 3", "A a0 4", "A b0 1", "A b0 2", "A b0 3", "A b0 4", "",
+    ];
+
+    let a_handle = thread::spawn(|| launch_node(config_a, SECRET_KEY_A, output_a));
+    let b_handle = thread::spawn(|| {
+        thread::sleep(Duration::from_secs(2));
+        launch_node(config_b, SECRET_KEY_B, output_b);
+    });
+
+    // thread::sleep(Duration::from_secs(60));
+
+    a_handle.join().unwrap();
+    b_handle.join().unwrap();
+}
+
+fn launch_node(config: String, my_secret: &'static str, expected_output: Vec<&'static str>) {
+    let tmp_dir = assert_fs::TempDir::new().unwrap();
+
+    // Write node config
+    tmp_dir.child("config.jsonnet").write_str(&config).unwrap();
+    tmp_dir
+        .child("plugin_data/cluster/secret_key_s1.txt")
+        .write_str(my_secret)
+        .unwrap();
+
+    // Copy cluster plugin
+    tmp_dir
+        .child("./target/debug/reaction-plugin-cluster")
+        .write_file(Path::new("./target/debug/reaction-plugin-cluster"))
+        .unwrap();
+
+    let output = cargo_bin_cmd!("reaction")
+        .args([
+            "start",
+            "--socket",
+            "./s",
+            "--config",
+            "./config.jsonnet",
+            "-l",
+            "DEBUG",
+        ])
+        .current_dir(tmp_dir.path())
+        .timeout(Duration::from_secs(5))
+        .output()
+        .unwrap();
+
+    println!(
+        "command output:\n{}",
+        String::from_utf8(output.stdout).unwrap()
+    );
+
+    // Expected output
+    tmp_dir.child("log").assert(expected_output.join("\n"));
+}
diff --git a/tests/plugin_virtual.rs b/tests/plugin_virtual.rs
new file mode 100644
index 0000000..89f37da
--- /dev/null
+++ b/tests/plugin_virtual.rs
@@ -0,0 +1,40 @@
+use std::{path::Path, time::Duration};
+
+use assert_cmd::{Command, cargo::cargo_bin_cmd};
+use assert_fs::prelude::*;
+use predicates::prelude::predicate;
+
+#[test]
+fn plugin_virtual() {
+    // First build reaction-plugin-virtual
+    Command::new("cargo")
+        .args(["build", "-p", "reaction-plugin-virtual"])
+        .unwrap();
+
+    let tmp_dir = assert_fs::TempDir::new().unwrap();
+    tmp_dir
+        .child("config.jsonnet")
+        .write_file(Path::new("tests/test-conf/test-virtual.jsonnet"))
+        .unwrap();
+
+    // Copy virtual plugin
+    tmp_dir
+        .child("./target/debug/reaction-plugin-virtual")
+        .write_file(Path::new("./target/debug/reaction-plugin-virtual"))
+        .unwrap();
+
+    cargo_bin_cmd!("reaction")
+        .args(["start", "--socket", "./s", "--config", "./config.jsonnet"])
+        .current_dir(tmp_dir.path())
+        .timeout(Duration::from_secs(5))
+        // Expected exit 1: all stream exited
+        .assert()
+        .code(predicate::eq(1));
+
+    // Expected output
+    let output = [
+        "a0 1", "a0 2", "a0 3", "a0 4", "b0 1", "b0 2", "b0 3", "b0 4", "",
+    ];
+    tmp_dir.child("log").assert(output.join("\n"));
+    tmp_dir.child("log").write_str("").unwrap();
+}
diff --git a/tests/simple.rs b/tests/simple.rs
index 91830e9..88af416 100644
--- a/tests/simple.rs
+++ b/tests/simple.rs
@@ -129,8 +129,11 @@ async fn simple() {
 
     let (daemon_exit, flush1, flush2) = tokio::join!(handle, handle2, handle3);
     assert!(daemon_exit.is_ok());
+    assert!(daemon_exit.unwrap() == 1);
     assert!(flush1.is_ok());
+    assert!(flush1.unwrap().is_ok());
     assert!(flush2.is_ok());
+    assert!(flush2.unwrap().is_ok());
 
     assert_eq!(
         // 24 is encountered for the second time, then
@@ -153,18 +156,14 @@ async fn simple() {
 
     config_with_cmd(
         config_path,
-        "for i in 12 24 36 56 67; do echo here is $i; sleep 0.01; done",
+        "sleep 0.02; for i in 12 24 36 56 67; do echo here is $i; sleep 0.01; done",
     );
 
     file_with_contents(out_path, "");
     file_with_contents(oneshot_path, "");
 
     let daemon_exit = daemon(config_path.into(), socket_path.into()).await;
-    assert!(daemon_exit.is_err());
-    assert_eq!(
-        daemon_exit.unwrap_err().to_string(),
-        "quitting because all streams finished"
-    );
+    assert!(daemon_exit == 1);
 
     // 36 trigger from DB
     // 12 trigger from DB
diff --git a/tests/start_stop.rs b/tests/start_stop.rs
index 09a459e..949b6b8 100644
--- a/tests/start_stop.rs
+++ b/tests/start_stop.rs
@@ -1,7 +1,7 @@
 use std::{path::Path, time::Duration};
 
-use assert_cmd::Command;
-use assert_fs::{prelude::*, TempDir};
+use assert_cmd::cargo::cargo_bin_cmd;
+use assert_fs::{TempDir, prelude::*};
 use predicates::prelude::predicate;
 
 #[test]
@@ -23,7 +23,7 @@ fn start_stop() {
         "stop 2",
         "",
     ];
-    tmp_dir.child("log").assert(&output.join("\n"));
+    tmp_dir.child("log").assert(output.join("\n"));
     tmp_dir.child("log").write_str("").unwrap();
 
     println!(
@@ -80,8 +80,7 @@ fn run_reaction(tmp_dir: &TempDir) {
         .write_file(Path::new("tests/start_stop.jsonnet"))
         .unwrap();
 
-    Command::cargo_bin("reaction")
-        .unwrap()
+    cargo_bin_cmd!("reaction")
         .args(["start", "--socket", "./s", "--config", "./config.jsonnet"])
         .current_dir(tmp_dir.path())
         .timeout(Duration::from_secs(5))
diff --git a/tests/test-conf/test-cluster.jsonnet b/tests/test-conf/test-cluster.jsonnet
new file mode 100644
index 0000000..36e7d76
--- /dev/null
+++ b/tests/test-conf/test-cluster.jsonnet
@@ -0,0 +1,71 @@
+{
+  patterns: {
+    num: {
+      regex: @"[0-9]+",
+    },
+    all: {
+      regex: @".*",
+    },
+  },
+
+  plugins: {
+    cluster: {
+      path: './target/debug/reaction-plugin-cluster',
+      check_root: false,
+      systemd_options: {
+        DynamicUser: ['false'],
+      },
+    },
+  },
+
+  streams: {
+    s0: {
+      cmd: ['bash', '-c', 'sleep 1; for i in $(seq 4); do echo $i; sleep 0.1; done'],
+      filters: {
+        f0: {
+          regex: ['^<num>$'],
+          actions: {
+            a0: {
+              type: 'cluster_send',
+              options: {
+                send: 'NODE a0 <num>',
+                to: 's1',
+              },
+            },
+            b0: {
+              type: 'cluster_send',
+              options: {
+                send: 'NODE b0 <num>',
+                to: 's1',
+              },
+              after: '1s',
+            },
+          },
+        },
+      },
+    },
+    s1: {
+      type: 'cluster',
+      options: {
+        listen_port: 1234,
+        bind_ipv4: '127.0.0.1',
+        bind_ipv6: null,
+        message_timeout: '30s',
+        nodes: [{
+          public_key: 'PUBLIC_KEY',
+          addresses: ['127.0.0.1:4321'],
+        }],
+      },
+      filters: {
+        f1: {
+          regex: ['^<all>$'],
+          actions: {
+            a1: {
+              cmd: ['sh', '-c', 'echo <all> >>./log'],
+            },
+          },
+        },
+      },
+    },
+  },
+}
diff --git a/tests/test-conf/test-ipset.jsonnet b/tests/test-conf/test-ipset.jsonnet
new file mode 100644
index 0000000..13c4c21
--- /dev/null
+++ b/tests/test-conf/test-ipset.jsonnet
@@ -0,0 +1,52 @@
+{
+  patterns: {
+    ip: {
+      type: 'ip',
+    },
+    all: {
+      regex: @".*",
+    },
+  },
+
+  plugins: {
+    ipset: {
+      path: './target/debug/reaction-plugin-ipset',
+      check_root: false,
+      systemd_options: {
+        CapabilityBoundingSet: ['~CAP_NET_ADMIN', '~CAP_PERFMON'],
+      },
+    },
+  },
+
+  streams: {
+    s0: {
+      cmd: ['bash', '-c', 'sleep 1; for i in $(seq 4); do echo 192.0.2.$i; echo 2001:db8:$i:a31b::$i; sleep 0.1; done; sleep 3'],
+      filters: {
+        f0: {
+          regex: ['^<ip>$'],
+          actions: {
+            a0: {
+              type: 'ipset',
+              options: {
+                set: 'reactiontest',
+                // pattern: 'ip',
+                // version: 'ip',
+                // chains: ['INPUT', 'FORWARD'],
+                // target: 'DROP',
+                // action: 'add',
+              },
+            },
+            a1: {
+              after: '2s',
+              type: 'ipset',
+              options: {
+                set: 'reactiontest',
+                action: 'del',
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+}
diff --git a/tests/test-conf/test-virtual.jsonnet b/tests/test-conf/test-virtual.jsonnet
new file mode 100644
index 0000000..b828b1b
--- /dev/null
+++ b/tests/test-conf/test-virtual.jsonnet
@@ -0,0 +1,61 @@
+{
+  patterns: {
+    num: {
+      regex: @"[0-9]+",
+    },
+    all: {
+      regex: @".*",
+    },
+  },
+
+  plugins: {
+    virtual: {
+      path: './target/debug/reaction-plugin-virtual',
+      check_root: false,
+      systemd_options: {
+      },
+    },
+  },
+
+  streams: {
+    s0: {
+      cmd: ['bash', '-c', 'for i in $(seq 4); do echo $i; sleep 0.1; done; sleep 1.2'],
+      filters: {
+        f0: {
+          regex: ['^<num>$'],
+          actions: {
+            a0: {
+              type: 'virtual',
+              options: {
+                send: 'a0 <num>',
+                to: 's1',
+              },
+            },
+            b0: {
+              type: 'virtual',
+              options: {
+                send: 'b0 <num>',
+                to: 's1',
+              },
+              after: '600ms',
+            },
+          },
+        },
+      },
+    },
+    s1: {
+      type: 'virtual',
+      options: {},
+      filters: {
+        f1: {
+          regex: ['^<all>$'],
+          actions: {
+            a1: {
+              cmd: ['sh', '-c', 'echo <all> >>./log'],
+            },
+          },
+        },
+      },
+    },
+  },
+}