diff --git a/.gitignore b/.gitignore
index aa80a37..804fcb3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,20 +1,31 @@
 .env
 .env.*
+*.bak
 certs
 acme.d
 xversion.go
+assets_vfsdata.go
+
+mgmt-server-linux
+mgmt-server-macos
+mgmt-server-windows-debug.exe
+mgmt-server-windows.exe
+
+telebit-client-linux
+telebit-client-macos
+telebit-client-windows-debug.exe
+telebit-client-windows.exe
 
 /mplexer/cmd/dnsclient/dnsclient
-/mplexer/cmd/mgmt/mgmt
+/mplexer/cmd/sqlstore/sqlstore
+/mplexer/mgmt/cmd/mgmt/mgmt
 /mplexer/cmd/signjwt/signjwt
 /mplexer/cmd/telebit/telebit
+
 /telebit
 /cmd/telebit/telebit
-/telebitd
-/cmd/telebitd/telebitd
 /telebit-relay
 /cmd/telebit-relay/telebit-relay
-*.exe
 
 .*.sw*
 log.txt
diff --git a/mplexer/cmd/sqlstore/sqlstore.go b/mplexer/cmd/sqlstore/sqlstore.go
index f8697ed..d5653e1 100644
--- a/mplexer/cmd/sqlstore/sqlstore.go
+++ b/mplexer/cmd/sqlstore/sqlstore.go
@@ -3,12 +3,21 @@ package main
 import (
 	"fmt"
 	"log"
+	"strings"
 
 	"git.coolaj86.com/coolaj86/go-telebitd/mplexer/mgmt/authstore"
 )
 
 func main() {
-	store, err := authstore.NewStore(nil)
+	connStr := "postgres://postgres:postgres@localhost:5432/postgres"
+	if strings.Contains(connStr, "@localhost/") || strings.Contains(connStr, "@localhost:") {
+		connStr += "?sslmode=disable"
+	} else {
+		connStr += "?sslmode=required"
+	}
+	initSQL := "./init.sql"
+
+	store, err := authstore.NewStore(connStr, initSQL)
 	if nil != err {
 		log.Fatal("connection error", err)
 		return
diff --git a/mplexer/cmd/telebit/telebit.go b/mplexer/cmd/telebit/telebit.go
index 7d1287e..6b1bccf 100644
--- a/mplexer/cmd/telebit/telebit.go
+++ b/mplexer/cmd/telebit/telebit.go
@@ -69,7 +69,7 @@ func main() {
 
 	if len(os.Args) >= 2 {
 		if "version" == os.Args[1] {
-			fmt.Printf("telebit %s %s %s %s", GitVersion, GitRev[:7], GitTimestamp)
+			fmt.Printf("telebit %s %s %s", GitVersion, GitRev[:7], GitTimestamp)
 			os.Exit(0)
 		}
 	}
diff --git a/mplexer/files/assets.go b/mplexer/files/assets.go
new file mode 100644
index 0000000..0a9c66b
--- /dev/null
+++ b/mplexer/files/assets.go
@@ -0,0 +1,4 @@
+// +build !dev
+//go:generate go run -mod vendor github.com/shurcooL/vfsgen/cmd/vfsgendev -source="git.coolaj86.com/coolaj86/go-telebitd/mplexer/files".Assets
+
+package files
diff --git a/mplexer/files/assets/init.sql b/mplexer/files/assets/init.sql
new file mode 100644
index 0000000..8c7514e
--- /dev/null
+++ b/mplexer/files/assets/init.sql
@@ -0,0 +1,20 @@
+CREATE extension IF NOT EXISTS pgcrypto;
+SET TIMEZONE='UTC';
+
+--DROP TABLE IF EXISTS authorizations;
+CREATE TABLE IF NOT EXISTS authorizations (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    slug TEXT NOT NULL,
+    shared_key TEXT NOT NULL,
+    public_key TEXT NOT NULL,
+    machine_ppid TEXT NOT NULL DEFAULT '',
+    created_at TIMESTAMP NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    updated_at TIMESTAMP NOT NULL DEFAULT (now() AT TIME ZONE 'UTC'),
+    deleted_at TIMESTAMP NOT NULL DEFAULT ('epoch' AT TIME ZONE 'UTC')
+);
+
+--CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_slug ON authorizations (slug);
+CREATE INDEX IF NOT EXISTS idx_slug ON authorizations (slug);
+CREATE INDEX IF NOT EXISTS idx_machine_ppid ON authorizations (machine_ppid);
+CREATE INDEX IF NOT EXISTS idx_public_key ON authorizations (public_key);
+
diff --git a/mplexer/files/assets_dev.go b/mplexer/files/assets_dev.go
new file mode 100644
index 0000000..328eda2
--- /dev/null
+++ b/mplexer/files/assets_dev.go
@@ -0,0 +1,7 @@
+// +build dev
+
+package files
+
+import "net/http"
+
+var Assets http.FileSystem = http.Dir("assets")
diff --git a/mplexer/files/files.go b/mplexer/files/files.go
new file mode 100644
index 0000000..44dec63
--- /dev/null
+++ b/mplexer/files/files.go
@@ -0,0 +1,17 @@
+package files
+
+import (
+	"net/http"
+	"os"
+)
+
+func Open(pathstr string) (http.File, error) {
+	f, err := Assets.Open(pathstr)
+	if nil != err {
+		f, err = os.Open(pathstr)
+		if nil != err {
+			return nil, err
+		}
+	}
+	return f, nil
+}
diff --git a/mplexer/listener_test.go b/mplexer/listener_test.go
deleted file mode 100644
index 49d1437..0000000
--- a/mplexer/listener_test.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package telebit
-
-import (
-	"errors"
-	"io"
-	"testing"
-)
-
-func TestDialServer(t *testing.T) {
-	// TODO replace the websocket connection with a mock server
-
-	//ctx := context.Background()
-	tun := &WebsocketTunnel{}
-
-	mux := NewRouteMux()
-	t.Fatal(ListenAndServe(tun, mux))
-}
-
-var ErrNoImpl error = errors.New("not implemented")
-
-// RWTest is a fake buffer
-type RWTest struct {
-	closed bool
-	tmpr   []byte
-}
-
-func (rwt *RWTest) Read(dst []byte) (int, error) {
-	if rwt.closed {
-		return 0, io.EOF
-	}
-
-	id := Addr{
-		scheme: "http",
-		addr:   "192.168.1.108",
-		port:   6732,
-	}
-	tun := Addr{
-		scheme:      "http",
-		termination: TLS,
-		addr:        "abc.example.com",
-		port:        443,
-	}
-
-	if 0 == len(rwt.tmpr) {
-		b := []byte("Hello, World!")
-		h, _, _ := Encode(b, id, tun)
-		rwt.tmpr = append(h, b...)
-	}
-
-	n := copy(dst, rwt.tmpr)
-	rwt.tmpr = rwt.tmpr[n:]
-
-	return n, nil
-}
-
-func (rwt *RWTest) Write(int, []byte) error {
-	if rwt.closed {
-		return io.EOF
-	}
-	return nil
-}
-
-func (rwt *RWTest) Close() error {
-	rwt.closed = true
-	return nil
-}
diff --git a/mplexer/mgmt/authstore/authstore_test.go b/mplexer/mgmt/authstore/authstore_test.go
index 339bdf6..d41ac49 100644
--- a/mplexer/mgmt/authstore/authstore_test.go
+++ b/mplexer/mgmt/authstore/authstore_test.go
@@ -10,7 +10,7 @@ func TestStore(t *testing.T) {
 	// Note: test output is cached (running twice will not result in two records)
 
 	connStr := "postgres://postgres:postgres@localhost/postgres"
-	if strings.Contains(connStr, "@localhost/") {
+	if strings.Contains(connStr, "@localhost/") || strings.Contains(connStr, "@localhost:") {
 		connStr += "?sslmode=disable"
 	} else {
 		connStr += "?sslmode=required"
diff --git a/mplexer/mgmt/authstore/postgresql.go b/mplexer/mgmt/authstore/postgresql.go
index de69f1e..bffde4b 100644
--- a/mplexer/mgmt/authstore/postgresql.go
+++ b/mplexer/mgmt/authstore/postgresql.go
@@ -9,15 +9,23 @@ import (
 	"io/ioutil"
 	"time"
 
+	"git.coolaj86.com/coolaj86/go-telebitd/mplexer/files"
+
 	"github.com/jmoiron/sqlx"
+	// pq injects itself into sql as 'postgres'
 	_ "github.com/lib/pq"
 )
 
 func NewStore(pgURL, initSQL string) (Store, error) {
 	// https://godoc.org/github.com/lib/pq
 
+	f, err := files.Open(initSQL)
+	if nil != err {
+		return nil, err
+	}
+
 	dbtype := "postgres"
-	sqlBytes, err := ioutil.ReadFile(initSQL)
+	sqlBytes, err := ioutil.ReadAll(f)
 	if nil != err {
 		return nil, err
 	}
diff --git a/mplexer/mgmt/cmd/mgmt/mgmt.go b/mplexer/mgmt/cmd/mgmt/mgmt.go
index 514280e..50d46b0 100644
--- a/mplexer/mgmt/cmd/mgmt/mgmt.go
+++ b/mplexer/mgmt/cmd/mgmt/mgmt.go
@@ -83,7 +83,7 @@ func main() {
 
 	connStr := *dbURL
 	// TODO url.Parse
-	if strings.Contains(connStr, "@localhost/") {
+	if strings.Contains(connStr, "@localhost/") || strings.Contains(connStr, "@localhost:") {
 		connStr += "?sslmode=disable"
 	} else {
 		connStr += "?sslmode=required"
@@ -100,7 +100,7 @@ func main() {
 
 	bind := *addr + ":" + *port
 	fmt.Println("Listening on", bind)
-	fmt.Fprintf(os.Stderr, "failed:", http.ListenAndServe(bind, routeAll()))
+	fmt.Fprintf(os.Stderr, "failed: %s", http.ListenAndServe(bind, routeAll()))
 }
 
 // newDuckDNSProvider is for the sake of demoing the tunnel
diff --git a/mplexer/telebit.go b/mplexer/telebit.go
index b7ef0e9..18028a1 100644
--- a/mplexer/telebit.go
+++ b/mplexer/telebit.go
@@ -105,6 +105,8 @@ func Forward(client net.Conn, target net.Conn, timeout time.Duration) error {
 
 	fmt.Println("[debug] forwarding tcp connection")
 	var err error = nil
+
+ForwardData:
 	for {
 		select {
 		// TODO do we need a context here?
@@ -115,35 +117,35 @@ func Forward(client net.Conn, target net.Conn, timeout time.Duration) error {
 			_, err = target.Write(b)
 			if nil != err {
 				fmt.Printf("write to target failed: %q\n", err.Error())
-				break
+				break ForwardData
 			}
 		case b := <-dstCh:
 			target.SetDeadline(time.Now().Add(timeout))
 			_, err = client.Write(b)
 			if nil != err {
 				fmt.Printf("write to remote failed: %q\n", err.Error())
-				break
+				break ForwardData
 			}
 		case err = <-srcErrCh:
 			if nil == err {
-				break
+				break ForwardData
 			}
 			if io.EOF != err {
 				fmt.Printf("read from remote client failed: %q\n", err.Error())
 			} else {
 				fmt.Printf("Connection closed (possibly by remote client)\n")
 			}
-			break
+			break ForwardData
 		case err = <-dstErrCh:
 			if nil == err {
-				break
+				break ForwardData
 			}
 			if io.EOF != err {
 				fmt.Printf("read from local target failed: %q\n", err.Error())
 			} else {
 				fmt.Printf("Connection closed (possibly by local target)\n")
 			}
-			break
+			break ForwardData
 
 		}
 	}
diff --git a/tools/tools.go b/tools/tools.go
index f41c4b5..4ebcd31 100644
--- a/tools/tools.go
+++ b/tools/tools.go
@@ -1,6 +1,10 @@
-//+build tools
+// +build tools
 
 // tools is a faux package for tracking dependencies that don't make it into the code
 package tools
 
-import _ "git.rootprojects.org/root/go-gitver"
+import (
+	_ "git.rootprojects.org/root/go-gitver"
+	_ "github.com/shurcooL/vfsgen"
+	_ "github.com/shurcooL/vfsgen/cmd/vfsgendev"
+)