This does not yet include persistence of inbound requests in the config, and it's mostly untested, but it's more or less complete.