Merge branch 'dev' into feat/redirect-tables

server/auth/actions.ts

@@ -61,6 +61,9 @@ export enum ActionsEnum {
     addUserRole = "addUserRole",
     removeUserRole = "removeUserRole",
     setUserOrgRoles = "setUserOrgRoles",
+    addClientRole = "addClientRole",
+    removeClientRole = "removeClientRole",
+    setClientRoles = "setClientRoles",
     // addUserSite = "addUserSite",
     // addUserAction = "addUserAction",
     // removeUserAction = "removeUserAction",
@@ -81,6 +84,9 @@ export enum ActionsEnum {
     deleteResourceRule = "deleteResourceRule",
     listResourceRules = "listResourceRules",
     updateResourceRule = "updateResourceRule",
+    createResourceMtlsCertificate = "createResourceMtlsCertificate",
+    deleteResourceMtlsCertificate = "deleteResourceMtlsCertificate",
+    listResourceMtlsCertificates = "listResourceMtlsCertificates",
     createSiteResource = "createSiteResource",
     deleteSiteResource = "deleteSiteResource",
     getSiteResource = "getSiteResource",

server/db/mac_models.json

@@ -38,6 +38,9 @@
   "Mac16,7": "MacBook Pro",
   "Mac16,8": "MacBook Pro",
   "Mac16,9": "Mac Studio",
+  "Mac17,14": "Mac Studio",
+  "Mac17,15": "Mac Studio",
+  "Mac17,16": "Mac mini",
   "Mac17,2": "MacBook Pro",
   "Mac17,3": "MacBook Air",
   "Mac17,4": "MacBook Air",
@@ -46,6 +49,7 @@
   "Mac17,7": "MacBook Pro",
   "Mac17,8": "MacBook Pro",
   "Mac17,9": "MacBook Pro",
+  "Mac18,5": "Mac mini",
   "MacBook1,1": "MacBook",
   "MacBook10,1": "MacBook",
   "MacBook2,1": "MacBook",
@@ -173,7 +177,7 @@
   "PowerMac12,1": "iMac",
   "PowerMac2,1": "iMac",
   "PowerMac2,2": "iMac",
-  "PowerMac3,1": "Mac Server",
+  "PowerMac3,1": "Power Macintosh",
   "PowerMac3,3": "Power Macintosh",
   "PowerMac3,4": "Power Macintosh",
   "PowerMac3,5": "Power Macintosh",
@@ -232,4 +236,4 @@
   "iMac8,1": "iMac",
   "iMac9,1": "iMac",
   "iMacPro1,1": "iMac Pro"
-}
+}

server/db/pg/schema/schema.ts

@@ -78,7 +78,8 @@ export const orgs = pgTable("orgs", {
         "settingsEnableGlobalNewtAutoUpdate"
     )
         .notNull()
-        .default(false)
+        .default(false),
+    settingsJitModeLimit: integer("settingsJitModeLimit").notNull().default(250)
 });
 
 export const orgDomains = pgTable("orgDomains", {
@@ -180,6 +181,10 @@ export const resources = pgTable(
         applyRules: boolean("applyRules"),
         enabled: boolean("enabled").notNull().default(true),
         stickySession: boolean("stickySession").notNull().default(false),
+        loadBalancingStrategy: varchar("loadBalancingStrategy", { length: 32 })
+            .$type<"wrr" | "p2c" | "hrw" | "leasttime">()
+            .notNull()
+            .default("wrr"), // traefik http loadBalancer.strategy
         tlsServerName: varchar("tlsServerName"),
         setHostHeader: varchar("setHostHeader"),
         enableProxy: boolean("enableProxy").default(true),
@@ -199,6 +204,7 @@ export const resources = pgTable(
         maintenanceTitle: text("maintenanceTitle"),
         maintenanceMessage: text("maintenanceMessage"),
         maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+        mtlsEnabled: boolean("mtlsEnabled").notNull().default(false),
         postAuthPath: text("postAuthPath"),
         health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
         wildcard: boolean("wildcard").notNull().default(false),
@@ -494,6 +500,7 @@ export const exitNodes = pgTable("exitNodes", {
     endpoint: varchar("endpoint").notNull(),
     publicKey: varchar("publicKey").notNull(),
     listenPort: integer("listenPort").notNull(),
+    relayPort: integer("relayPort").notNull(),
     reachableAt: varchar("reachableAt"),
     maxConnections: integer("maxConnections"),
     online: boolean("online").notNull().default(false),
@@ -526,8 +533,8 @@ export const siteResources = pgTable(
         name: varchar("name").notNull(),
         ssl: boolean("ssl").notNull().default(false),
         mode: varchar("mode")
-            .$type<"host" | "cidr" | "http" | "ssh" | "inference">()
-            .notNull(), // "host" | "cidr" | "http"
+            .$type<"host" | "cidr" | "http" | "ssh" | "inference" | "gateway">()
+            .notNull(),
         scheme: varchar("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
         proxyPort: integer("proxyPort"), // only for port mode
         destinationPort: integer("destinationPort"), // only for port mode
@@ -841,6 +848,27 @@ export const userOrgRoles = pgTable(
     (t) => [unique().on(t.userId, t.orgId, t.roleId)]
 );
 
+// roles assigned to machine clients (clients with no userId) so they can be
+// granted access to site resources through roleSiteResources like users are
+export const clientOrgRoles = pgTable(
+    "clientOrgRoles",
+    {
+        clientId: integer("clientId")
+            .notNull()
+            .references(() => clients.clientId, { onDelete: "cascade" }),
+        orgId: varchar("orgId")
+            .notNull()
+            .references(() => orgs.orgId, { onDelete: "cascade" }),
+        roleId: integer("roleId")
+            .notNull()
+            .references(() => roles.roleId, { onDelete: "cascade" })
+    },
+    (t) => [
+        unique().on(t.clientId, t.orgId, t.roleId),
+        index("idx_clientorgroles_roleid").on(t.roleId)
+    ]
+);
+
 export const roleActions = pgTable(
     "roleActions",
     {
@@ -1141,6 +1169,22 @@ export const resourceWhitelist = pgTable("resourceWhitelist", {
         .references(() => resources.resourceId, { onDelete: "cascade" })
 });
 
+export const resourceMtlsCertificates = pgTable("resourceMtlsCertificates", {
+    mtlsCertificateId: serial("mtlsCertificateId").primaryKey(),
+    resourceId: integer("resourceId")
+        .notNull()
+        .references(() => resources.resourceId, { onDelete: "cascade" }),
+    name: varchar("name"),
+    certificate: text("certificate").notNull(),
+    subject: varchar("subject"),
+    issuer: varchar("issuer"),
+    serialNumber: varchar("serialNumber"),
+    fingerprint: varchar("fingerprint"),
+    notBefore: bigint("notBefore", { mode: "number" }),
+    notAfter: bigint("notAfter", { mode: "number" }),
+    createdAt: bigint("createdAt", { mode: "number" }).notNull()
+});
+
 export const resourceOtp = pgTable("resourceOtp", {
     otpId: serial("otpId").primaryKey(),
     resourceId: integer("resourceId")
@@ -2043,6 +2087,7 @@ export type UserInvite = InferSelectModel<typeof userInvites>;
 export type UserInviteRole = InferSelectModel<typeof userInviteRoles>;
 export type UserOrg = InferSelectModel<typeof userOrgs>;
 export type UserOrgRole = InferSelectModel<typeof userOrgRoles>;
+export type ClientOrgRole = InferSelectModel<typeof clientOrgRoles>;
 export type ResourceSession = InferSelectModel<typeof resourceSessions>;
 export type ResourcePincode = InferSelectModel<typeof resourcePincode>;
 export type ResourcePassword = InferSelectModel<typeof resourcePassword>;
@@ -2053,6 +2098,9 @@ export type ResourceHeaderAuthExtendedCompatibility = InferSelectModel<
 export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
 export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
 export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
+export type ResourceMtlsCertificate = InferSelectModel<
+    typeof resourceMtlsCertificates
+>;
 export type ResourcePolicyPincode = InferSelectModel<
     typeof resourcePolicyPincode
 >;

server/db/sqlite/schema/schema.ts

@@ -78,7 +78,8 @@ export const orgs = sqliteTable("orgs", {
         { mode: "boolean" }
     )
         .notNull()
-        .default(false)
+        .default(false),
+    settingsJitModeLimit: integer("settingsJitModeLimit").notNull().default(250)
 });
 
 export const userDomains = sqliteTable("userDomains", {
@@ -129,7 +130,7 @@ export const sites = sqliteTable(
         address: text("address"), // this is the address of the wireguard interface in newt
         endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
         localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
-        publicKey: text("publicKey"), // TODO: Fix typo in publicKey
+        publicKey: text("publicKey"),
         lastHolePunch: integer("lastHolePunch"),
         listenPort: integer("listenPort"),
         dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
@@ -196,6 +197,10 @@ export const resources = sqliteTable(
         stickySession: integer("stickySession", { mode: "boolean" })
             .notNull()
             .default(false),
+        loadBalancingStrategy: text("loadBalancingStrategy")
+            .$type<"wrr" | "p2c" | "hrw" | "leasttime">()
+            .notNull()
+            .default("wrr"), // traefik http loadBalancer.strategy
         tlsServerName: text("tlsServerName"),
         setHostHeader: text("setHostHeader"),
         enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
@@ -219,6 +224,9 @@ export const resources = sqliteTable(
         maintenanceTitle: text("maintenanceTitle"),
         maintenanceMessage: text("maintenanceMessage"),
         maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+        mtlsEnabled: integer("mtlsEnabled", { mode: "boolean" })
+            .notNull()
+            .default(false),
         postAuthPath: text("postAuthPath"),
         health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
         wildcard: integer("wildcard", { mode: "boolean" })
@@ -517,6 +525,7 @@ export const exitNodes = sqliteTable("exitNodes", {
     endpoint: text("endpoint").notNull(), // this is how to reach gerbil externally - gets put into the wireguard config
     publicKey: text("publicKey").notNull(),
     listenPort: integer("listenPort").notNull(),
+    relayPort: integer("relayPort").notNull(),
     reachableAt: text("reachableAt"), // this is the internal address of the gerbil http server for command control
     maxConnections: integer("maxConnections"),
     online: integer("online", { mode: "boolean" }).notNull().default(false),
@@ -549,8 +558,8 @@ export const siteResources = sqliteTable("siteResources", {
     name: text("name").notNull(),
     ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
     mode: text("mode")
-        .$type<"host" | "cidr" | "http" | "ssh" | "inference">()
-        .notNull(), // "host" | "cidr" | "http"
+        .$type<"host" | "cidr" | "http" | "ssh" | "inference" | "gateway">()
+        .notNull(),
     scheme: text("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
     proxyPort: integer("proxyPort"), // only for port mode
     destinationPort: integer("destinationPort"), // only for port mode
@@ -1130,6 +1139,27 @@ export const userOrgRoles = sqliteTable(
     (t) => [unique().on(t.userId, t.orgId, t.roleId)]
 );
 
+// roles assigned to machine clients (clients with no userId) so they can be
+// granted access to site resources through roleSiteResources like users are
+export const clientOrgRoles = sqliteTable(
+    "clientOrgRoles",
+    {
+        clientId: integer("clientId")
+            .notNull()
+            .references(() => clients.clientId, { onDelete: "cascade" }),
+        orgId: text("orgId")
+            .notNull()
+            .references(() => orgs.orgId, { onDelete: "cascade" }),
+        roleId: integer("roleId")
+            .notNull()
+            .references(() => roles.roleId, { onDelete: "cascade" })
+    },
+    (t) => [
+        unique().on(t.clientId, t.orgId, t.roleId),
+        index("idx_clientOrgRoles_roleId").on(t.roleId)
+    ]
+);
+
 export const roleActions = sqliteTable("roleActions", {
     roleId: integer("roleId")
         .notNull()
@@ -1413,6 +1443,27 @@ export const resourceWhitelist = sqliteTable("resourceWhitelist", {
         .references(() => resources.resourceId, { onDelete: "cascade" })
 });
 
+export const resourceMtlsCertificates = sqliteTable(
+    "resourceMtlsCertificates",
+    {
+        mtlsCertificateId: integer("mtlsCertificateId").primaryKey({
+            autoIncrement: true
+        }),
+        resourceId: integer("resourceId")
+            .notNull()
+            .references(() => resources.resourceId, { onDelete: "cascade" }),
+        name: text("name"),
+        certificate: text("certificate").notNull(),
+        subject: text("subject"),
+        issuer: text("issuer"),
+        serialNumber: text("serialNumber"),
+        fingerprint: text("fingerprint"),
+        notBefore: integer("notBefore"),
+        notAfter: integer("notAfter"),
+        createdAt: integer("createdAt").notNull()
+    }
+);
+
 export const resourceOtp = sqliteTable("resourceOtp", {
     otpId: integer("otpId").primaryKey({
         autoIncrement: true
@@ -2088,6 +2139,7 @@ export type UserInvite = InferSelectModel<typeof userInvites>;
 export type UserInviteRole = InferSelectModel<typeof userInviteRoles>;
 export type UserOrg = InferSelectModel<typeof userOrgs>;
 export type UserOrgRole = InferSelectModel<typeof userOrgRoles>;
+export type ClientOrgRole = InferSelectModel<typeof clientOrgRoles>;
 export type ResourceSession = InferSelectModel<typeof resourceSessions>;
 export type ResourcePincode = InferSelectModel<typeof resourcePincode>;
 export type ResourcePassword = InferSelectModel<typeof resourcePassword>;
@@ -2098,6 +2150,9 @@ export type ResourceHeaderAuthExtendedCompatibility = InferSelectModel<
 export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
 export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
 export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
+export type ResourceMtlsCertificate = InferSelectModel<
+    typeof resourceMtlsCertificates
+>;
 export type VersionMigration = InferSelectModel<typeof versionMigrations>;
 export type ResourceRule = InferSelectModel<typeof resourceRules>;
 export type Domain = InferSelectModel<typeof domains>;

server/lib/billing/tierMatrix.ts

@@ -26,7 +26,8 @@ export enum TierFeature {
     WildcardSubdomain = "wildcardSubdomain",
     NewtAutoUpdate = "newtAutoUpdate",
     ResourcePolicies = "resourcePolicies",
-    RoleBasedSSHControls = "roleBasedSSHControls"
+    RoleBasedSSHControls = "roleBasedSSHControls",
+    Mtls = "mtls" // handle downgrade by disabling mTLS on resources
 }
 
 export const tierMatrix: Record<TierFeature, Tier[]> = {
@@ -70,5 +71,6 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
     [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.NewtAutoUpdate]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.ResourcePolicies]: ["tier3", "enterprise"],
-    [TierFeature.RoleBasedSSHControls]: ["tier3", "enterprise"]
+    [TierFeature.RoleBasedSSHControls]: ["tier3", "enterprise"],
+    [TierFeature.Mtls]: ["tier1", "tier2", "tier3", "enterprise"]
 };

server/lib/blueprints/MtlsSchema.ts

@@ -0,0 +1,3 @@
+import { z } from "zod";
+
+export const MtlsSchema = z.object({});

server/lib/blueprints/exportResourceBlueprint.ts

@@ -0,0 +1,689 @@
+import { stringify as stringifyYaml } from "yaml";
+import { and, asc, eq, isNull, not, or } from "drizzle-orm";
+import {
+    aiBudgets,
+    aiModels,
+    clients,
+    clientSiteResources,
+    db,
+    labels,
+    resourceAiModels,
+    resourceHeaderAuth,
+    resourceLabels,
+    resourcePassword,
+    resourcePincode,
+    resourcePolicies,
+    resourceRules,
+    resources,
+    resourceWhitelist,
+    roles,
+    roleResources,
+    roleSiteResources,
+    siteNetworks,
+    siteResourceAiModels,
+    siteResourceLabels,
+    siteResources,
+    sites,
+    targetHealthCheck,
+    targets,
+    userResources,
+    userSiteResources,
+    users
+} from "@server/db";
+import { queryResourcePolicy } from "@server/routers/policy/getResourcePolicy";
+import {
+    listPublicResourceAiProviders,
+    listSiteResourceAiProviders
+} from "@server/lib/aiInferenceResource";
+
+const HTTP_LIKE_PUBLIC_MODES = ["http", "ssh", "rdp", "vnc", "inference"];
+
+function reverseRuleAction(action: string): "allow" | "deny" | "pass" {
+    if (action === "ACCEPT") return "allow";
+    if (action === "PASS") return "pass";
+    return "deny";
+}
+
+function reverseRuleMatch(match: string): string {
+    return match.toLowerCase();
+}
+
+function stripUndefined<T extends Record<string, any>>(obj: T): T {
+    for (const key of Object.keys(obj)) {
+        if (obj[key] === undefined) {
+            delete obj[key];
+        }
+    }
+    return obj;
+}
+
+function buildHealthcheck(row: {
+    hcHostname: string | null;
+    hcPort: number | null;
+    hcEnabled: boolean | null;
+    hcPath: string | null;
+    hcScheme: string | null;
+    hcMode: string | null;
+    hcInterval: number | null;
+    hcUnhealthyInterval: number | null;
+    hcTimeout: number | null;
+    hcHeaders: string | null;
+    hcFollowRedirects: boolean | null;
+    hcMethod: string | null;
+    hcStatus: number | null;
+    hcHealthyThreshold: number | null;
+    hcUnhealthyThreshold: number | null;
+}) {
+    if (!row.hcHostname) {
+        return undefined;
+    }
+
+    let headers: { name: string; value: string }[] | undefined;
+    if (row.hcHeaders) {
+        try {
+            headers = JSON.parse(row.hcHeaders);
+        } catch {
+            headers = undefined;
+        }
+    }
+
+    return stripUndefined({
+        hostname: row.hcHostname,
+        port: row.hcPort ?? undefined,
+        enabled: row.hcEnabled ?? undefined,
+        path: row.hcPath ?? undefined,
+        scheme: row.hcScheme ?? undefined,
+        mode: row.hcMode ?? undefined,
+        interval: row.hcInterval ?? undefined,
+        "unhealthy-interval": row.hcUnhealthyInterval ?? undefined,
+        timeout: row.hcTimeout ?? undefined,
+        headers,
+        "follow-redirects": row.hcFollowRedirects ?? undefined,
+        method: row.hcMethod ?? undefined,
+        status: row.hcStatus ?? undefined,
+        "healthy-threshold": row.hcHealthyThreshold ?? undefined,
+        "unhealthy-threshold": row.hcUnhealthyThreshold ?? undefined
+    });
+}
+
+async function buildPublicAuthAndRules(resource: {
+    resourceId: number;
+    resourcePolicyId: number | null;
+    defaultResourcePolicyId: number | null;
+    sso: boolean | null;
+    skipToIdpId: number | null;
+}): Promise<{
+    policy: string | undefined;
+    auth: Record<string, any> | undefined;
+    rules: Record<string, any>[];
+    notes: string[];
+}> {
+    const notes: string[] = [];
+
+    if (resource.resourcePolicyId) {
+        // Shared policy attached: the policy's own auth config lives on the
+        // policy entity itself (edited separately). The resource only carries
+        // its own overrides in the legacy resource-level tables.
+        const [policyRow] = await db
+            .select({ niceId: resourcePolicies.niceId })
+            .from(resourcePolicies)
+            .where(eq(resourcePolicies.resourcePolicyId, resource.resourcePolicyId))
+            .limit(1);
+
+        const [roleRows, userRows, whitelistRows, ruleRows, passwordRow, pincodeRow, headerAuthRow] =
+            await Promise.all([
+                db
+                    .select({ name: roles.name })
+                    .from(roleResources)
+                    .innerJoin(
+                        roles,
+                        and(
+                            eq(roleResources.roleId, roles.roleId),
+                            or(isNull(roles.isAdmin), not(roles.isAdmin))
+                        )
+                    )
+                    .where(eq(roleResources.resourceId, resource.resourceId)),
+                db
+                    .select({ username: users.username })
+                    .from(userResources)
+                    .innerJoin(users, eq(userResources.userId, users.userId))
+                    .where(eq(userResources.resourceId, resource.resourceId)),
+                db
+                    .select({ email: resourceWhitelist.email })
+                    .from(resourceWhitelist)
+                    .where(eq(resourceWhitelist.resourceId, resource.resourceId)),
+                db
+                    .select({
+                        enabled: resourceRules.enabled,
+                        priority: resourceRules.priority,
+                        action: resourceRules.action,
+                        match: resourceRules.match,
+                        value: resourceRules.value
+                    })
+                    .from(resourceRules)
+                    .where(eq(resourceRules.resourceId, resource.resourceId)),
+                db
+                    .select({ passwordId: resourcePassword.passwordId })
+                    .from(resourcePassword)
+                    .where(eq(resourcePassword.resourceId, resource.resourceId))
+                    .limit(1),
+                db
+                    .select({ pincodeId: resourcePincode.pincodeId })
+                    .from(resourcePincode)
+                    .where(eq(resourcePincode.resourceId, resource.resourceId))
+                    .limit(1),
+                db
+                    .select({ headerAuthId: resourceHeaderAuth.headerAuthId })
+                    .from(resourceHeaderAuth)
+                    .where(eq(resourceHeaderAuth.resourceId, resource.resourceId))
+                    .limit(1)
+            ]);
+
+        if (passwordRow.length > 0) {
+            notes.push(
+                "A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
+            );
+        }
+        if (pincodeRow.length > 0) {
+            notes.push(
+                "A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
+            );
+        }
+        if (headerAuthRow.length > 0) {
+            notes.push(
+                "Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
+            );
+        }
+
+        const auth = stripUndefined({
+            "sso-enabled": resource.sso ?? undefined,
+            "sso-roles": roleRows.length ? roleRows.map((r) => r.name) : undefined,
+            "sso-users": userRows.length
+                ? userRows.map((u) => u.username)
+                : undefined,
+            "whitelist-users": whitelistRows.length
+                ? whitelistRows.map((w) => w.email)
+                : undefined,
+            "auto-login-idp": resource.skipToIdpId ?? undefined
+        });
+
+        return {
+            policy: policyRow?.niceId,
+            auth: Object.keys(auth).length > 0 ? auth : undefined,
+            rules: ruleRows.map((r) =>
+                stripUndefined({
+                    action: reverseRuleAction(r.action),
+                    match: reverseRuleMatch(r.match),
+                    value: r.value,
+                    priority: r.priority,
+                    enabled: r.enabled
+                })
+            ),
+            notes
+        };
+    }
+
+    if (!resource.defaultResourcePolicyId) {
+        return { policy: undefined, auth: undefined, rules: [], notes };
+    }
+
+    // Inline policy: the resource's own default (non-shared) policy carries
+    // all of its auth config.
+    const policy = await queryResourcePolicy({
+        resourcePolicyId: resource.defaultResourcePolicyId
+    });
+
+    if (!policy) {
+        return { policy: undefined, auth: undefined, rules: [], notes };
+    }
+
+    if (policy.passwordId) {
+        notes.push(
+            "A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
+        );
+    }
+    if (policy.pincodeId) {
+        notes.push(
+            "A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
+        );
+    }
+    if (policy.headerAuth?.id) {
+        notes.push(
+            "Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
+        );
+    }
+
+    const auth = stripUndefined({
+        "sso-enabled": policy.sso ?? undefined,
+        "sso-roles": policy.roles.length
+            ? policy.roles.map((r) => r.name)
+            : undefined,
+        "sso-users": policy.users.length
+            ? policy.users.map((u) => u.username)
+            : undefined,
+        "whitelist-users": policy.emailWhiteList.length
+            ? policy.emailWhiteList.map((w) => w.email)
+            : undefined,
+        "auto-login-idp": policy.idpId ?? undefined
+    });
+
+    return {
+        policy: undefined,
+        auth: Object.keys(auth).length > 0 ? auth : undefined,
+        rules: policy.rules.map((r) =>
+            stripUndefined({
+                action: reverseRuleAction(r.action),
+                match: reverseRuleMatch(r.match),
+                value: r.value,
+                priority: r.priority,
+                enabled: r.enabled
+            })
+        ),
+        notes
+    };
+}
+
+async function buildAiProvidersAndBudget(input:
+    | { scope: "public"; resourceId: number }
+    | { scope: "site"; siteResourceId: number }
+) {
+    const providers =
+        input.scope === "public"
+            ? await listPublicResourceAiProviders(input.resourceId)
+            : await listSiteResourceAiProviders(input.siteResourceId);
+
+    const aiProvidersConfig = await Promise.all(
+        providers.map(async (p) => {
+            const entry: Record<string, any> = {
+                provider: p.niceId,
+                "access-mode": p.accessMode,
+                enabled: p.enabled
+            };
+
+            if (p.accessMode === "select") {
+                const modelRows =
+                    input.scope === "public"
+                        ? await db
+                              .select({ modelKey: aiModels.modelKey })
+                              .from(resourceAiModels)
+                              .innerJoin(
+                                  aiModels,
+                                  eq(resourceAiModels.modelId, aiModels.modelId)
+                              )
+                              .where(
+                                  and(
+                                      eq(
+                                          resourceAiModels.resourceId,
+                                          input.resourceId
+                                      ),
+                                      eq(aiModels.providerId, p.providerId)
+                                  )
+                              )
+                        : await db
+                              .select({ modelKey: aiModels.modelKey })
+                              .from(siteResourceAiModels)
+                              .innerJoin(
+                                  aiModels,
+                                  eq(siteResourceAiModels.modelId, aiModels.modelId)
+                              )
+                              .where(
+                                  and(
+                                      eq(
+                                          siteResourceAiModels.siteResourceId,
+                                          input.siteResourceId
+                                      ),
+                                      eq(aiModels.providerId, p.providerId)
+                                  )
+                              );
+
+                if (modelRows.length > 0) {
+                    entry.models = modelRows.map((m) => m.modelKey);
+                }
+            }
+
+            return entry;
+        })
+    );
+
+    const budgetRows = await db
+        .select()
+        .from(aiBudgets)
+        .where(
+            input.scope === "public"
+                ? eq(aiBudgets.resourceId, input.resourceId)
+                : eq(aiBudgets.siteResourceId, input.siteResourceId)
+        );
+
+    const aiBudgetConfig = budgetRows.map((b) => ({
+        amount: b.amount,
+        unit: b.unit,
+        period: b.period,
+        enforcement: b.enforcement,
+        enabled: b.enabled
+    }));
+
+    return { aiProvidersConfig, aiBudgetConfig };
+}
+
+export async function generatePublicResourceBlueprintYaml(
+    resourceId: number
+): Promise<{ niceId: string; contents: string }> {
+    const [resource] = await db
+        .select()
+        .from(resources)
+        .where(eq(resources.resourceId, resourceId))
+        .limit(1);
+
+    if (!resource) {
+        throw new Error(`Resource ${resourceId} not found`);
+    }
+
+    const mode = resource.mode;
+    const isHttpLike = HTTP_LIKE_PUBLIC_MODES.includes(mode);
+    const isInference = mode === "inference";
+
+    const resourceConfig: Record<string, any> = {
+        name: resource.name,
+        mode,
+        enabled: resource.enabled
+    };
+
+    if (isHttpLike) {
+        if (resource.fullDomain) {
+            resourceConfig["full-domain"] = resource.fullDomain;
+        }
+        resourceConfig.ssl = resource.ssl;
+    } else {
+        if (resource.proxyPort) {
+            resourceConfig["proxy-port"] = resource.proxyPort;
+        }
+        if (mode === "tcp") {
+            resourceConfig["proxy-protocol"] = resource.proxyProtocol;
+            resourceConfig["proxy-protocol-version"] =
+                resource.proxyProtocolVersion ?? undefined;
+        }
+    }
+
+    if (resource.setHostHeader) {
+        resourceConfig["host-header"] = resource.setHostHeader;
+    }
+    if (resource.tlsServerName) {
+        resourceConfig["tls-server-name"] = resource.tlsServerName;
+    }
+    if (
+        resource.loadBalancingStrategy &&
+        resource.loadBalancingStrategy !== "wrr"
+    ) {
+        resourceConfig["load-balancing-strategy"] =
+            resource.loadBalancingStrategy;
+    }
+    if (resource.requestHeaders) {
+        try {
+            resourceConfig.requestHeaders = JSON.parse(resource.requestHeaders);
+        } catch {
+            // ignore malformed stored headers
+        }
+    }
+    if (resource.responseHeaders) {
+        try {
+            resourceConfig.responseHeaders = JSON.parse(resource.responseHeaders);
+        } catch {
+            // ignore malformed stored headers
+        }
+    }
+
+    if (mode === "ssh") {
+        resourceConfig["auth-daemon"] = stripUndefined({
+            pam: resource.pamMode ?? undefined,
+            mode: resource.authDaemonMode ?? undefined,
+            port: resource.authDaemonPort ?? undefined
+        });
+    }
+
+    if (resource.maintenanceModeEnabled) {
+        resourceConfig.maintenance = stripUndefined({
+            enabled: resource.maintenanceModeEnabled,
+            type: resource.maintenanceModeType ?? undefined,
+            title: resource.maintenanceTitle ?? undefined,
+            message: resource.maintenanceMessage ?? undefined,
+            "estimated-time": resource.maintenanceEstimatedTime ?? undefined
+        });
+    }
+
+    // Labels
+    const labelRows = await db
+        .select({ name: labels.name })
+        .from(resourceLabels)
+        .innerJoin(labels, eq(resourceLabels.labelId, labels.labelId))
+        .where(eq(resourceLabels.resourceId, resourceId));
+    if (labelRows.length > 0) {
+        resourceConfig.labels = labelRows.map((l) => l.name);
+    }
+
+    // Auth / rules / shared policy
+    const { policy, auth, rules, notes } = await buildPublicAuthAndRules(
+        resource
+    );
+    if (policy) {
+        resourceConfig.policy = policy;
+    }
+    if (auth) {
+        resourceConfig.auth = auth;
+    }
+    if (rules.length > 0) {
+        resourceConfig.rules = rules;
+    }
+
+    // Targets (all modes except inference use targets)
+    if (!isInference) {
+        const targetRows = await db
+            .select({
+                ip: targets.ip,
+                method: targets.method,
+                port: targets.port,
+                enabled: targets.enabled,
+                internalPort: targets.internalPort,
+                path: targets.path,
+                pathMatchType: targets.pathMatchType,
+                rewritePath: targets.rewritePath,
+                rewritePathType: targets.rewritePathType,
+                priority: targets.priority,
+                siteNiceId: sites.niceId,
+                hcEnabled: targetHealthCheck.hcEnabled,
+                hcPath: targetHealthCheck.hcPath,
+                hcScheme: targetHealthCheck.hcScheme,
+                hcMode: targetHealthCheck.hcMode,
+                hcHostname: targetHealthCheck.hcHostname,
+                hcPort: targetHealthCheck.hcPort,
+                hcInterval: targetHealthCheck.hcInterval,
+                hcUnhealthyInterval: targetHealthCheck.hcUnhealthyInterval,
+                hcTimeout: targetHealthCheck.hcTimeout,
+                hcHeaders: targetHealthCheck.hcHeaders,
+                hcFollowRedirects: targetHealthCheck.hcFollowRedirects,
+                hcMethod: targetHealthCheck.hcMethod,
+                hcStatus: targetHealthCheck.hcStatus,
+                hcHealthyThreshold: targetHealthCheck.hcHealthyThreshold,
+                hcUnhealthyThreshold: targetHealthCheck.hcUnhealthyThreshold
+            })
+            .from(targets)
+            .leftJoin(sites, eq(sites.siteId, targets.siteId))
+            .leftJoin(
+                targetHealthCheck,
+                eq(targetHealthCheck.targetId, targets.targetId)
+            )
+            .where(eq(targets.resourceId, resourceId))
+            .orderBy(asc(targets.targetId));
+
+        resourceConfig.targets = targetRows.map((row) =>
+            stripUndefined({
+                site: row.siteNiceId ?? undefined,
+                method: mode === "http" ? row.method ?? undefined : undefined,
+                hostname: row.ip,
+                port: row.port,
+                enabled: row.enabled,
+                "internal-port": row.internalPort ?? undefined,
+                path: row.path ?? undefined,
+                "path-match": row.pathMatchType ?? undefined,
+                "rewrite-path": row.rewritePath ?? undefined,
+                "rewrite-match": row.rewritePathType ?? undefined,
+                priority: row.priority,
+                healthcheck: buildHealthcheck(row)
+            })
+        );
+    } else {
+        const { aiProvidersConfig, aiBudgetConfig } =
+            await buildAiProvidersAndBudget({ scope: "public", resourceId });
+        resourceConfig["ai-providers"] = aiProvidersConfig;
+        if (aiBudgetConfig.length > 0) {
+            resourceConfig["ai-budget"] = aiBudgetConfig;
+        }
+    }
+
+    const config = {
+        "proxy-resources": {
+            [resource.niceId]: resourceConfig
+        }
+    };
+
+    const notesPrefix =
+        notes.length > 0
+            ? notes.map((n) => `# ${n}`).join("\n") + "\n\n"
+            : "";
+
+    return {
+        niceId: resource.niceId,
+        contents: notesPrefix + stringifyYaml(config)
+    };
+}
+
+export async function generatePrivateResourceBlueprintYaml(
+    siteResourceId: number
+): Promise<{ niceId: string; contents: string }> {
+    const [siteResource] = await db
+        .select()
+        .from(siteResources)
+        .where(eq(siteResources.siteResourceId, siteResourceId))
+        .limit(1);
+
+    if (!siteResource) {
+        throw new Error(`Site resource ${siteResourceId} not found`);
+    }
+
+    const mode = siteResource.mode;
+    const isInference = mode === "inference";
+    const isHttpLike = mode === "http" || isInference;
+
+    const resourceConfig: Record<string, any> = {
+        name: siteResource.name,
+        mode,
+        enabled: siteResource.enabled
+    };
+
+    if (!isInference && siteResource.networkId) {
+        const siteRows = await db
+            .select({ niceId: sites.niceId })
+            .from(siteNetworks)
+            .innerJoin(sites, eq(siteNetworks.siteId, sites.siteId))
+            .where(eq(siteNetworks.networkId, siteResource.networkId));
+        if (siteRows.length > 0) {
+            resourceConfig.sites = siteRows.map((s) => s.niceId);
+        }
+    }
+
+    if (siteResource.destination) {
+        resourceConfig.destination = siteResource.destination;
+    }
+    if (siteResource.destinationPort) {
+        resourceConfig["destination-port"] = siteResource.destinationPort;
+    }
+
+    if (!isHttpLike) {
+        resourceConfig["tcp-ports"] = siteResource.tcpPortRangeString;
+        resourceConfig["udp-ports"] = siteResource.udpPortRangeString;
+        resourceConfig["disable-icmp"] = siteResource.disableIcmp;
+    }
+
+    if (isHttpLike) {
+        if (siteResource.fullDomain) {
+            resourceConfig["full-domain"] = siteResource.fullDomain;
+        }
+        resourceConfig.ssl = siteResource.ssl;
+        if (siteResource.scheme) {
+            resourceConfig.scheme = siteResource.scheme;
+        }
+    }
+
+    if (siteResource.alias) {
+        resourceConfig.alias = siteResource.alias;
+    }
+
+    if (mode === "ssh") {
+        resourceConfig["auth-daemon"] = stripUndefined({
+            pam: siteResource.pamMode ?? undefined,
+            mode: siteResource.authDaemonMode ?? undefined,
+            port: siteResource.authDaemonPort ?? undefined
+        });
+    }
+
+    const [roleRows, userRows, clientRows, labelRows] = await Promise.all([
+        db
+            .select({ name: roles.name })
+            .from(roleSiteResources)
+            .innerJoin(
+                roles,
+                and(
+                    eq(roleSiteResources.roleId, roles.roleId),
+                    or(isNull(roles.isAdmin), not(roles.isAdmin))
+                )
+            )
+            .where(eq(roleSiteResources.siteResourceId, siteResourceId)),
+        db
+            .select({ username: users.username })
+            .from(userSiteResources)
+            .innerJoin(users, eq(userSiteResources.userId, users.userId))
+            .where(eq(userSiteResources.siteResourceId, siteResourceId)),
+        db
+            .select({ niceId: clients.niceId })
+            .from(clientSiteResources)
+            .innerJoin(clients, eq(clientSiteResources.clientId, clients.clientId))
+            .where(eq(clientSiteResources.siteResourceId, siteResourceId)),
+        db
+            .select({ name: labels.name })
+            .from(siteResourceLabels)
+            .innerJoin(labels, eq(siteResourceLabels.labelId, labels.labelId))
+            .where(eq(siteResourceLabels.siteResourceId, siteResourceId))
+    ]);
+
+    if (roleRows.length > 0) {
+        resourceConfig.roles = roleRows.map((r) => r.name);
+    }
+    if (userRows.length > 0) {
+        resourceConfig.users = userRows.map((u) => u.username);
+    }
+    if (clientRows.length > 0) {
+        resourceConfig.machines = clientRows.map((c) => c.niceId);
+    }
+    if (labelRows.length > 0) {
+        resourceConfig.labels = labelRows.map((l) => l.name);
+    }
+
+    if (isInference) {
+        const { aiProvidersConfig, aiBudgetConfig } =
+            await buildAiProvidersAndBudget({ scope: "site", siteResourceId });
+        resourceConfig["ai-providers"] = aiProvidersConfig;
+        if (aiBudgetConfig.length > 0) {
+            resourceConfig["ai-budget"] = aiBudgetConfig;
+        }
+    }
+
+    const config = {
+        "client-resources": {
+            [siteResource.niceId]: resourceConfig
+        }
+    };
+
+    return {
+        niceId: siteResource.niceId,
+        contents: stringifyYaml(config)
+    };
+}

server/lib/blueprints/privateResources.ts

@@ -259,6 +259,11 @@ export async function updatePrivateResources(
             }
 
             const isInference = resourceData.mode === "inference";
+            const isGateway = resourceData.mode === "gateway";
+            // gateway resources always route the whole subnet with everything open
+            const effectiveDestination = isGateway
+                ? "0.0.0.0/0"
+                : resourceData.destination;
 
             // Update existing resource
             const [updatedResource] = await trx
@@ -268,23 +273,28 @@ export async function updatePrivateResources(
                     mode: resourceData.mode,
                     ssl: resourceSsl,
                     scheme: resourceData.scheme,
-                    destination: resourceData.destination,
+                    destination: effectiveDestination,
                     destinationPort: resourceData["destination-port"],
                     enabled: resourceEnabled,
                     alias: resourceData.alias || null,
-                    disableIcmp:
-                        resourceData["disable-icmp"] ||
-                        (resourceData.mode == "http" || isInference
-                            ? true
-                            : false), // default to true for http/inference resources, otherwise false
+                    disableIcmp: isGateway
+                        ? false // gateway always allows icmp
+                        : resourceData["disable-icmp"] ||
+                          (resourceData.mode == "http" || isInference
+                              ? true
+                              : false), // default to true for http/inference resources, otherwise false
                     tcpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? "443,80"
-                            : resourceData["tcp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["tcp-ports"],
                     udpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? ""
-                            : resourceData["udp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["udp-ports"],
                     fullDomain: resourceData["full-domain"] || null,
                     subdomain: domainInfo ? domainInfo.subdomain : null,
                     domainId: domainInfo ? domainInfo.domainId : null,
@@ -529,6 +539,11 @@ export async function updatePrivateResources(
             }
 
             const isInference = resourceData.mode === "inference";
+            const isGateway = resourceData.mode === "gateway";
+            // gateway resources always route the whole subnet with everything open
+            const effectiveDestination = isGateway
+                ? "0.0.0.0/0"
+                : resourceData.destination;
 
             let domainInfo:
                 | { subdomain: string | null; domainId: string }
@@ -590,24 +605,29 @@ export async function updatePrivateResources(
                     mode: resourceData.mode,
                     ssl: resourceSsl,
                     scheme: resourceData.scheme,
-                    destination: resourceData.destination,
+                    destination: effectiveDestination,
                     destinationPort: resourceData["destination-port"],
                     enabled: resourceEnabled,
                     alias: resourceData.alias || null,
                     aliasAddress: aliasAddress,
-                    disableIcmp:
-                        resourceData["disable-icmp"] ||
-                        (resourceData.mode == "http" || isInference
-                            ? true
-                            : false), // default to true for http/inference resources, otherwise false
+                    disableIcmp: isGateway
+                        ? false // gateway always allows icmp
+                        : resourceData["disable-icmp"] ||
+                          (resourceData.mode == "http" || isInference
+                              ? true
+                              : false), // default to true for http/inference resources, otherwise false
                     tcpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? "443,80"
-                            : resourceData["tcp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["tcp-ports"],
                     udpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? ""
-                            : resourceData["udp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["udp-ports"],
                     fullDomain: resourceData["full-domain"] || null,
                     subdomain: domainInfo ? domainInfo.subdomain : null,
                     domainId: domainInfo ? domainInfo.domainId : null,

server/lib/blueprints/publicResources.ts

@@ -10,6 +10,7 @@ import {
     Resource,
     resourceHeaderAuth,
     resourceHeaderAuthExtendedCompatibility,
+    resourceMtlsCertificates,
     resourcePassword,
     resourcePincode,
     resourcePolicies,
@@ -62,6 +63,10 @@ import { LimitId } from "../billing";
 import { usageService } from "../billing/usageService";
 import { syncInferenceAiConfig } from "./aiProviders";
 import { syncAiBudgets } from "./aiBudgets";
+import {
+    MAX_MTLS_CERTIFICATES_PER_RESOURCE,
+    parseCaCertificates
+} from "../mtlsCertificate";
 
 export type PublicResourcesResults = {
     proxyResource: Resource;
@@ -274,6 +279,20 @@ export async function updatePublicResources(
             ? JSON.stringify(resourceData.responseHeaders)
             : null;
 
+        // mTLS is a security control: refuse (rather than silently drop) a
+        // blueprint that asks for it on a plan that doesn't include it.
+        if (resourceData.mtls?.enabled) {
+            const mtlsLicensed = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.mtls
+            );
+            if (!mtlsLicensed) {
+                throw new Error(
+                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
+                );
+            }
+        }
+
         if (resourceData.policy) {
             const isLicensed = await isLicensedOrSubscribed(
                 orgId,
@@ -405,6 +424,9 @@ export async function updatePublicResources(
                             setHostHeader: resourceData["host-header"] || null,
                             tlsServerName:
                                 resourceData["tls-server-name"] || null,
+                            loadBalancingStrategy:
+                                resourceData["load-balancing-strategy"] ??
+                                "wrr",
                             emailWhitelistEnabled: resourceData.auth?.[
                                 "whitelist-users"
                             ]
@@ -431,6 +453,7 @@ export async function updatePublicResources(
                                 resourceData.maintenance?.message,
                             maintenanceEstimatedTime:
                                 resourceData.maintenance?.["estimated-time"],
+                            mtlsEnabled: resourceData.mtls?.enabled,
                             proxyProtocol:
                                 resourceData.mode === "tcp"
                                     ? (resourceData["proxy-protocol"] ?? false)
@@ -608,6 +631,9 @@ export async function updatePublicResources(
                             setHostHeader: resourceData["host-header"] || null,
                             tlsServerName:
                                 resourceData["tls-server-name"] || null,
+                            loadBalancingStrategy:
+                                resourceData["load-balancing-strategy"] ??
+                                "wrr",
                             requestHeaders,
                             responseHeaders,
                             maintenanceModeEnabled:
@@ -618,6 +644,7 @@ export async function updatePublicResources(
                                 resourceData.maintenance?.message,
                             maintenanceEstimatedTime:
                                 resourceData.maintenance?.["estimated-time"],
+                            mtlsEnabled: resourceData.mtls?.enabled,
                             proxyProtocol:
                                 resourceData.mode === "tcp"
                                     ? (resourceData["proxy-protocol"] ?? false)
@@ -722,6 +749,14 @@ export async function updatePublicResources(
                     resourceId: existingResource.resourceId,
                     budgets: resourceData["ai-budget"] || []
                 });
+
+                if (resourceData.mtls?.["ca-certificates"]) {
+                    await syncResourceMtlsCertificates(
+                        existingResource.resourceId,
+                        resourceData.mtls["ca-certificates"],
+                        trx
+                    );
+                }
             }
 
             const existingResourceTargets = await trx
@@ -1231,6 +1266,8 @@ export async function updatePublicResources(
                     enabled: resourceEnabled,
                     setHostHeader: resourceData["host-header"] || null,
                     tlsServerName: resourceData["tls-server-name"] || null,
+                    loadBalancingStrategy:
+                        resourceData["load-balancing-strategy"] ?? "wrr",
                     ssl: resourceSsl,
                     requestHeaders,
                     responseHeaders,
@@ -1246,6 +1283,7 @@ export async function updatePublicResources(
                     maintenanceMessage: resourceData.maintenance?.message,
                     maintenanceEstimatedTime:
                         resourceData.maintenance?.["estimated-time"],
+                    mtlsEnabled: resourceData.mtls?.enabled,
                     proxyProtocol:
                         resourceData.mode === "tcp"
                             ? (resourceData["proxy-protocol"] ?? false)
@@ -1300,6 +1338,14 @@ export async function updatePublicResources(
                 budgets: resourceData["ai-budget"] || []
             });
 
+            if (resourceData.mtls?.["ca-certificates"]) {
+                await syncResourceMtlsCertificates(
+                    newResource.resourceId,
+                    resourceData.mtls["ca-certificates"],
+                    trx
+                );
+            }
+
             await trx.insert(roleResources).values({
                 roleId: adminRole.roleId,
                 resourceId: newResource.resourceId
@@ -1643,6 +1689,63 @@ async function syncUserResources(
     }
 }
 
+async function syncResourceMtlsCertificates(
+    resourceId: number,
+    caCertificates: string[],
+    trx: Transaction
+) {
+    // A PEM entry may itself be a bundle; flatten and dedupe by fingerprint.
+    const desired = new Map<string, ReturnType<typeof parseCaCertificates>[0]>();
+    for (const pem of caCertificates) {
+        for (const cert of parseCaCertificates(pem)) {
+            desired.set(cert.fingerprint, cert);
+        }
+    }
+
+    if (desired.size > MAX_MTLS_CERTIFICATES_PER_RESOURCE) {
+        throw new Error(
+            `A resource can have at most ${MAX_MTLS_CERTIFICATES_PER_RESOURCE} trusted CA certificates`
+        );
+    }
+
+    const existing = await trx
+        .select()
+        .from(resourceMtlsCertificates)
+        .where(eq(resourceMtlsCertificates.resourceId, resourceId));
+
+    const existingFingerprints = new Set(existing.map((c) => c.fingerprint));
+
+    for (const cert of desired.values()) {
+        if (existingFingerprints.has(cert.fingerprint)) {
+            continue;
+        }
+        await trx.insert(resourceMtlsCertificates).values({
+            resourceId,
+            certificate: cert.certificate,
+            subject: cert.subject,
+            issuer: cert.issuer,
+            serialNumber: cert.serialNumber,
+            fingerprint: cert.fingerprint,
+            notBefore: cert.notBefore,
+            notAfter: cert.notAfter,
+            createdAt: Date.now()
+        });
+    }
+
+    for (const row of existing) {
+        if (!row.fingerprint || !desired.has(row.fingerprint)) {
+            await trx
+                .delete(resourceMtlsCertificates)
+                .where(
+                    eq(
+                        resourceMtlsCertificates.mtlsCertificateId,
+                        row.mtlsCertificateId
+                    )
+                );
+        }
+    }
+}
+
 async function syncWhitelistUsers(
     resourceId: number,
     whitelistUsers: string[],

server/lib/blueprints/types.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { existsSync } from "node:fs";
 import { portRangeStringSchema } from "@server/lib/ip";
 import { MaintenanceSchema } from "#dynamic/lib/blueprints/MaintenanceSchema";
+import { MtlsSchema } from "#dynamic/lib/blueprints/MtlsSchema";
 import { isValidRegionId } from "@server/db/regions";
 import { isValidHttpMethodList } from "@server/lib/validators";
 import { wildcardSubdomainSchema } from "@server/lib/schemas";
@@ -47,7 +48,7 @@ const healthCheckHostnameSchema = z
                 return true;
             }
             const hostnameRegex =
-                /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)*[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+                /^(?:[a-zA-Z0-9_](?:[a-zA-Z0-9_-]{0,61}[a-zA-Z0-9_])?\.)*[a-zA-Z0-9_](?:[a-zA-Z0-9_-]{0,61}[a-zA-Z0-9_])?$/;
             return hostnameRegex.test(val);
         },
         {
@@ -326,11 +327,15 @@ export const PublicResourceSchema = z
         auth: AuthSchema.optional(),
         "host-header": z.string().optional(),
         "tls-server-name": z.string().optional(),
+        "load-balancing-strategy": z
+            .enum(["wrr", "p2c", "hrw", "leasttime"])
+            .optional(),
         headers: z.array(HeaderSchema).optional(), // deprecated alias for requestHeaders
         requestHeaders: z.array(HeaderSchema).optional(),
         responseHeaders: z.array(HeaderSchema).optional(),
         rules: z.array(RuleSchema).optional(),
         maintenance: MaintenanceSchema.optional(),
+        mtls: MtlsSchema.optional(),
         "auth-daemon": AuthDaemonSchema.optional(),
         "proxy-protocol": z.boolean().optional(),
         "proxy-protocol-version": z.int().min(1).optional(),
@@ -445,6 +450,48 @@ export const PublicResourceSchema = z
             error: "When protocol is 'http', 'ssh', 'rdp', 'vnc', or 'inference', a 'full-domain' must be provided"
         }
     )
+    .refine(
+        (resource) => {
+            if (isTargetsOnlyResource(resource) || !resource.mtls?.enabled) {
+                return true;
+            }
+
+            return (resource.mode ?? resource.protocol) === "http";
+        },
+        {
+            path: ["mtls"],
+            error: "mTLS is only supported when mode is 'http'"
+        }
+    )
+    .refine(
+        (resource) => {
+            if (isTargetsOnlyResource(resource) || !resource.mtls?.enabled) {
+                return true;
+            }
+
+            return resource.ssl !== false;
+        },
+        {
+            path: ["mtls"],
+            error: "mTLS requires 'ssl' to be enabled"
+        }
+    )
+    .refine(
+        (resource) => {
+            if (isTargetsOnlyResource(resource) || !resource.mtls?.enabled) {
+                return true;
+            }
+
+            const caCertificates = (
+                resource.mtls as { "ca-certificates"?: string[] }
+            )["ca-certificates"];
+            return (caCertificates?.length ?? 0) > 0;
+        },
+        {
+            path: ["mtls", "ca-certificates"],
+            error: "mTLS requires at least one entry in 'ca-certificates'"
+        }
+    )
     .refine(
         (resource) => {
             if (isTargetsOnlyResource(resource)) {
@@ -612,7 +659,18 @@ export function isTargetsOnlyResource(resource: any): boolean {
 export const PrivateResourceSchema = z
     .object({
         name: z.string().min(1).max(255),
-        mode: z.enum(["host", "cidr", "http", "ssh", "inference"]),
+        // "exit-node" is accepted as an alias for "gateway" (matches the UI naming)
+        mode: z
+            .enum([
+                "host",
+                "cidr",
+                "http",
+                "ssh",
+                "inference",
+                "gateway",
+                "exit-node"
+            ])
+            .transform((mode) => (mode === "exit-node" ? "gateway" : mode)),
         site: z.string().optional(), // DEPRECATED IN FAVOR OF sites
         sites: z.array(z.string()).optional().default([]),
         // protocol: z.enum(["tcp", "udp"]).optional(),
@@ -652,13 +710,15 @@ export const PrivateResourceSchema = z
     })
     .refine(
         (data) => {
-            // destination is optional only for ssh+native or inference; required for everything else
+            // destination is optional only for ssh+native, inference, or gateway
+            // (gateway always routes the whole subnet, so destination is ignored); required for everything else
             const isNativeSSH =
                 data.mode === "ssh" &&
                 (data["auth-daemon"] === undefined ||
                     data["auth-daemon"].mode === "native");
             if (
                 data.mode !== "inference" &&
+                data.mode !== "gateway" &&
                 !isNativeSSH &&
                 !data.destination
             ) {
@@ -669,7 +729,7 @@ export const PrivateResourceSchema = z
         {
             path: ["destination"],
             message:
-                "destination is required unless mode is 'ssh' with auth-daemon mode 'native', or mode is 'inference'"
+                "destination is required unless mode is 'ssh' with auth-daemon mode 'native', 'inference', or 'gateway'"
         }
     )
     .refine(
@@ -816,25 +876,20 @@ export const ConfigSchema = z
     .object({
         "proxy-resources": z
             .record(z.string(), PublicResourceSchema)
-            .optional()
             .prefault({}),
         "public-resources": z
             .record(z.string(), PublicResourceSchema)
-            .optional()
             .prefault({}),
         "client-resources": z
             .record(z.string(), PrivateResourceSchema)
-            .optional()
             .prefault({}),
         "private-resources": z
             .record(z.string(), PrivateResourceSchema)
-            .optional()
             .prefault({}),
         "public-policies": z
             .record(z.string(), ResourcePolicySchema)
-            .optional()
             .prefault({}),
-        sites: z.record(z.string(), SiteSchema).optional().prefault({})
+        sites: z.record(z.string(), SiteSchema).prefault({})
     })
     .transform((data) => {
         // Merge public-resources into proxy-resources

server/lib/clientIdentities.ts

@@ -0,0 +1,357 @@
+import {
+    clientOrgRoles,
+    clients,
+    clientSiteResourcesAssociationsCache,
+    db,
+    newts,
+    roles,
+    siteNetworks,
+    siteResources,
+    Transaction,
+    userOrgRoles,
+    users
+} from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import { sendToClientsBatch } from "#dynamic/routers/ws";
+import {
+    canCompress,
+    supportsClientIdentities
+} from "@server/lib/clientVersionChecks";
+import logger from "@server/logger";
+
+// Keeps IN (...) lists well under the bound-parameter limits of both
+// Postgres and SQLite when an org has thousands of clients.
+const ID_CHUNK_SIZE = 1000;
+
+function chunk<T>(items: T[]): T[][] {
+    const chunks: T[][] = [];
+    for (let i = 0; i < items.length; i += ID_CHUNK_SIZE) {
+        chunks.push(items.slice(i, i + ID_CHUNK_SIZE));
+    }
+    return chunks;
+}
+
+/**
+ * Identity of a client as seen by newt's HTTP proxy, which turns it into the
+ * same Remote-* headers that Badger sets for public resources. Keyed by the
+ * client's tunnel IP since that is the source address newt sees on requests.
+ * User clients carry the owning user's details; machine clients (no user)
+ * carry the client's name and its machine roles.
+ */
+export type ClientIdentity = {
+    ip: string;
+    userId?: string;
+    username?: string;
+    email?: string;
+    name?: string;
+    role?: string;
+};
+
+/**
+ * Builds the identity for each of the given clients, keyed by clientId.
+ * Clients without a subnet are omitted since newt could never match them.
+ */
+export async function getClientIdentities(
+    clientIds: Iterable<number>,
+    trx: Transaction | typeof db = db
+): Promise<Map<number, ClientIdentity>> {
+    const identities = new Map<number, ClientIdentity>();
+    const uniqueClientIds = Array.from(new Set(clientIds));
+    if (uniqueClientIds.length === 0) {
+        return identities;
+    }
+
+    const clientRows = (
+        await Promise.all(
+            chunk(uniqueClientIds).map((ids) =>
+                trx
+                    .select({
+                        clientId: clients.clientId,
+                        orgId: clients.orgId,
+                        subnet: clients.subnet,
+                        clientName: clients.name,
+                        userId: users.userId,
+                        username: users.username,
+                        email: users.email,
+                        userName: users.name
+                    })
+                    .from(clients)
+                    .leftJoin(users, eq(clients.userId, users.userId))
+                    .where(inArray(clients.clientId, ids))
+            )
+        )
+    ).flat();
+
+    // Roles only matter in the client's own org, so restrict the role
+    // lookups to those orgs rather than every org the users belong to.
+    const orgIds = Array.from(new Set(clientRows.map((c) => c.orgId)));
+    const userIds = Array.from(
+        new Set(
+            clientRows
+                .map((c) => c.userId)
+                .filter((id): id is string => id !== null)
+        )
+    );
+    const machineClientIds = clientRows
+        .filter((c) => c.userId === null)
+        .map((c) => c.clientId);
+
+    const [userRoleRows, clientRoleRows] = await Promise.all([
+        Promise.all(
+            chunk(userIds).map((ids) =>
+                trx
+                    .select({
+                        userId: userOrgRoles.userId,
+                        orgId: userOrgRoles.orgId,
+                        roleName: roles.name
+                    })
+                    .from(userOrgRoles)
+                    .innerJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
+                    .where(
+                        and(
+                            inArray(userOrgRoles.userId, ids),
+                            inArray(userOrgRoles.orgId, orgIds)
+                        )
+                    )
+            )
+        ).then((rows) => rows.flat()),
+        Promise.all(
+            chunk(machineClientIds).map((ids) =>
+                trx
+                    .select({
+                        clientId: clientOrgRoles.clientId,
+                        orgId: clientOrgRoles.orgId,
+                        roleName: roles.name
+                    })
+                    .from(clientOrgRoles)
+                    .innerJoin(roles, eq(clientOrgRoles.roleId, roles.roleId))
+                    .where(inArray(clientOrgRoles.clientId, ids))
+            )
+        ).then((rows) => rows.flat())
+    ]);
+
+    const rolesByUserOrg = new Map<string, string[]>();
+    for (const row of userRoleRows) {
+        const key = `${row.userId}:${row.orgId}`;
+        const list = rolesByUserOrg.get(key) ?? [];
+        list.push(row.roleName);
+        rolesByUserOrg.set(key, list);
+    }
+    const rolesByClientOrg = new Map<string, string[]>();
+    for (const row of clientRoleRows) {
+        const key = `${row.clientId}:${row.orgId}`;
+        const list = rolesByClientOrg.get(key) ?? [];
+        list.push(row.roleName);
+        rolesByClientOrg.set(key, list);
+    }
+
+    for (const row of clientRows) {
+        if (!row.subnet) {
+            continue;
+        }
+        const ip = row.subnet.split("/")[0];
+
+        if (row.userId) {
+            const roleNames = rolesByUserOrg.get(`${row.userId}:${row.orgId}`);
+            identities.set(row.clientId, {
+                ip,
+                userId: row.userId,
+                username: row.username ?? undefined,
+                email: row.email ?? undefined,
+                name: row.userName ?? undefined,
+                role: roleNames?.length ? roleNames.join(", ") : undefined
+            });
+        } else {
+            const roleNames = rolesByClientOrg.get(
+                `${row.clientId}:${row.orgId}`
+            );
+            identities.set(row.clientId, {
+                ip,
+                name: row.clientName,
+                role: roleNames?.length ? roleNames.join(", ") : undefined
+            });
+        }
+    }
+
+    return identities;
+}
+
+/**
+ * Upserts the identities of the given clients on each newt, outside of a full
+ * newt/sync or newt/wg/receive-config. Send this before (or alongside) any
+ * HTTP subnet proxy targets that reference the clients so that the first
+ * proxied request already carries the Remote-* headers.
+ */
+export async function sendClientIdentitiesAdd(
+    entries: {
+        newtId: string;
+        version?: string | null;
+        clientIds: number[];
+    }[],
+    trx: Transaction | typeof db = db
+) {
+    const supported = entries.filter(
+        (e) => e.clientIds.length > 0 && supportsClientIdentities(e.version)
+    );
+    if (supported.length === 0) {
+        return;
+    }
+
+    // Fetched once for all newts; the same clients usually span many sites.
+    const identities = await getClientIdentities(
+        supported.flatMap((e) => e.clientIds),
+        trx
+    );
+
+    const messages = supported
+        .map((entry) => ({
+            entry,
+            data: Array.from(new Set(entry.clientIds))
+                .map((id) => identities.get(id))
+                .filter((i): i is ClientIdentity => i !== undefined)
+        }))
+        .filter(({ data }) => data.length > 0)
+        .map(({ entry, data }) => ({
+            clientId: entry.newtId,
+            message: {
+                type: "newt/wg/client-identities/add",
+                data
+            },
+            options: {
+                incrementConfigVersion: true,
+                compress: canCompress(entry.version, "newt")
+            }
+        }));
+
+    if (messages.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(messages).catch((error) => {
+        logger.warn(`Error sending client identities to newts:`, error);
+    });
+}
+
+/**
+ * Re-pushes the identities of the given clients to the newt of every site
+ * where they can reach an enabled HTTP resource, e.g. after the owning user's
+ * name, email or roles change. Sites where a client only has non-HTTP access
+ * never see its traffic in the HTTP proxy, so they are skipped. Relies on
+ * clientSiteResourcesAssociationsCache being current.
+ */
+export async function pushClientIdentitiesToSites(
+    clientIds: number[],
+    trx: Transaction | typeof db = db
+) {
+    const uniqueClientIds = Array.from(new Set(clientIds));
+    if (uniqueClientIds.length === 0) {
+        return;
+    }
+
+    const rows = (
+        await Promise.all(
+            chunk(uniqueClientIds).map((ids) =>
+                trx
+                    .selectDistinct({
+                        clientId: clientSiteResourcesAssociationsCache.clientId,
+                        newtId: newts.newtId,
+                        version: newts.version
+                    })
+                    .from(clientSiteResourcesAssociationsCache)
+                    .innerJoin(
+                        siteResources,
+                        eq(
+                            siteResources.siteResourceId,
+                            clientSiteResourcesAssociationsCache.siteResourceId
+                        )
+                    )
+                    .innerJoin(
+                        siteNetworks,
+                        eq(siteNetworks.networkId, siteResources.networkId)
+                    )
+                    .innerJoin(newts, eq(newts.siteId, siteNetworks.siteId))
+                    .where(
+                        and(
+                            inArray(
+                                clientSiteResourcesAssociationsCache.clientId,
+                                ids
+                            ),
+                            eq(siteResources.mode, "http"),
+                            eq(siteResources.enabled, true)
+                        )
+                    )
+            )
+        )
+    ).flat();
+
+    const byNewt = new Map<
+        string,
+        { newtId: string; version: string | null; clientIds: number[] }
+    >();
+    for (const row of rows) {
+        let entry = byNewt.get(row.newtId);
+        if (!entry) {
+            entry = { newtId: row.newtId, version: row.version, clientIds: [] };
+            byNewt.set(row.newtId, entry);
+        }
+        entry.clientIds.push(row.clientId);
+    }
+
+    await sendClientIdentitiesAdd(Array.from(byNewt.values()), trx);
+}
+
+/**
+ * Re-pushes the identities of every client owned by the user, e.g. after an
+ * IdP login updates their name or email.
+ */
+export async function pushClientIdentitiesForUser(
+    userId: string,
+    trx: Transaction | typeof db = db
+) {
+    const userClients = await trx
+        .select({ clientId: clients.clientId })
+        .from(clients)
+        .where(eq(clients.userId, userId));
+
+    await pushClientIdentitiesToSites(
+        userClients.map((c) => c.clientId),
+        trx
+    );
+}
+
+/**
+ * Re-pushes the identities of every client holding the role, either through
+ * the owning user or directly as a machine client, e.g. after a role rename.
+ */
+export async function pushClientIdentitiesForRole(
+    roleId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+) {
+    const [userClients, machineClients] = await Promise.all([
+        // Driven from the org's clients so the join can use userOrgRoles'
+        // (userId, orgId, roleId) unique index; userOrgRoles has no index on
+        // roleId alone.
+        trx
+            .select({ clientId: clients.clientId })
+            .from(clients)
+            .innerJoin(
+                userOrgRoles,
+                and(
+                    eq(userOrgRoles.userId, clients.userId),
+                    eq(userOrgRoles.orgId, clients.orgId),
+                    eq(userOrgRoles.roleId, roleId)
+                )
+            )
+            .where(eq(clients.orgId, orgId)),
+        trx
+            .select({ clientId: clientOrgRoles.clientId })
+            .from(clientOrgRoles)
+            .where(eq(clientOrgRoles.roleId, roleId))
+    ]);
+
+    await pushClientIdentitiesToSites(
+        [...userClients, ...machineClients].map((c) => c.clientId),
+        trx
+    );
+}

server/lib/clientVersionChecks.ts

@@ -34,3 +34,18 @@ export function supportsCertReferences(
         return false;
     }
 }
+
+// Whether this newt client understands newt/wg/client-identities/add, used to
+// set Remote-* headers on requests through its HTTP proxy. Bump the version
+// floor here to match whatever release first ships the newt-side support.
+export function supportsClientIdentities(
+    clientVersion: string | null | undefined
+): boolean {
+    try {
+        if (!clientVersion) return false;
+        if (!semver.valid(clientVersion)) return false;
+        return semver.gte(clientVersion, "1.19.0");
+    } catch {
+        return false;
+    }
+}

server/lib/consts.ts

@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.23.0";
+export const APP_VERSION = "1.24.0";
 
 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);

server/lib/deleteSiteAssociatedResources.ts

@@ -17,7 +17,6 @@ import {
     performDeleteSiteResources,
     runSiteResourceDeleteSideEffects
 } from "@server/lib/deleteSiteResource";
-import logger from "@server/logger";
 
 export const MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE = 250;
 

server/lib/exitNodes/exitNodes.ts

@@ -36,6 +36,7 @@ export async function listExitNodes(
             endpoint: exitNodes.endpoint,
             publicKey: exitNodes.publicKey,
             listenPort: exitNodes.listenPort,
+            relayPort: exitNodes.relayPort,
             reachableAt: exitNodes.reachableAt,
             maxConnections: exitNodes.maxConnections,
             online: exitNodes.online,

server/lib/ip.ts

@@ -500,6 +500,7 @@ export function generateRemoteSubnets(
             if (!sr.enabled) return false;
             if (!sr.destination) return false;
 
+            // we purposely filter out the gateway resource here because we add it manually on the client
             if (sr.mode === "cidr") {
                 // check if its a valid CIDR using zod
                 const cidrSchema = z.union([z.cidrv4(), z.cidrv6()]);
@@ -808,7 +809,7 @@ export async function generateSubnetProxyTargetV2(
                 resourceId: siteResource.siteResourceId
             });
         }
-    } else if (siteResource.mode == "cidr") {
+    } else if (siteResource.mode == "cidr" || siteResource.mode == "gateway") {
         targets.push({
             sourcePrefixes: [],
             destPrefix: siteResource.destination!,

server/lib/mtlsCertificate.ts

@@ -0,0 +1,61 @@
+import { X509Certificate } from "crypto";
+
+export const MAX_MTLS_CERTIFICATES_PER_RESOURCE = 20;
+
+export type ParsedCaCertificate = {
+    certificate: string;
+    subject: string;
+    issuer: string;
+    serialNumber: string;
+    fingerprint: string;
+    notBefore: number;
+    notAfter: number;
+};
+
+const PEM_CERTIFICATE_REGEX =
+    /-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g;
+
+// Certificate subjects/issuers come back as newline-separated "CN=foo\nO=bar";
+// flatten to a single readable line for storage and display.
+function flattenDn(dn: string): string {
+    return dn.split("\n").join(", ");
+}
+
+/**
+ * Parses one or more PEM-encoded CA certificates (a bundle is split into its
+ * individual certificates). Throws an Error with a user-presentable message
+ * if the input is not a valid certificate or looks like a private key.
+ */
+export function parseCaCertificates(input: string): ParsedCaCertificate[] {
+    if (/PRIVATE KEY/.test(input)) {
+        throw new Error(
+            "This looks like a private key, not a certificate. Upload the CA's public certificate only."
+        );
+    }
+
+    const blocks = input.match(PEM_CERTIFICATE_REGEX);
+    if (!blocks || blocks.length === 0) {
+        throw new Error(
+            "Invalid certificate: no PEM-encoded certificate found. Expected a block starting with -----BEGIN CERTIFICATE-----."
+        );
+    }
+
+    return blocks.map((block) => {
+        let cert: X509Certificate;
+        try {
+            cert = new X509Certificate(block);
+        } catch {
+            throw new Error("Invalid certificate: could not parse PEM.");
+        }
+
+        return {
+            certificate: block.trim() + "\n",
+            subject: flattenDn(cert.subject),
+            issuer: flattenDn(cert.issuer),
+            serialNumber: cert.serialNumber,
+            fingerprint: cert.fingerprint256,
+            notBefore: new Date(cert.validFrom).getTime(),
+            notAfter: new Date(cert.validTo).getTime()
+        };
+    });
+}

server/lib/offlineThresholds.ts

@@ -0,0 +1,26 @@
+export type OfflineThresholds = {
+    // how often the offline checkers run
+    checkIntervalMs: number;
+    // newt sites that stop pinging for this long are marked offline
+    newtMs: number;
+    // wireguard sites with no bandwidth update for this long are marked offline
+    newtWireguardMs: number;
+    // olm clients that stop pinging for this long are marked offline
+    olmMs: number;
+    // remote exit nodes that stop pinging for this long are marked offline
+    remoteExitNodeMs: number;
+};
+
+export const DEFAULT_OFFLINE_THRESHOLDS: OfflineThresholds = {
+    checkIntervalMs: 30 * 1000, // 30 seconds
+    newtMs: 2 * 60 * 1000, // 2 minutes
+    newtWireguardMs: 8 * 60 * 1000, // 8 minutes
+    olmMs: 2 * 60 * 1000, // 2 minutes
+    remoteExitNodeMs: 2 * 60 * 1000 // 2 minutes
+};
+
+// The thresholds are only configurable in the private config file, so the
+// open build always uses the defaults. See server/private/lib/offlineThresholds.ts
+export function getOfflineThresholds(): OfflineThresholds {
+    return DEFAULT_OFFLINE_THRESHOLDS;
+}

server/lib/pathMatch.ts

@@ -1,18 +1,37 @@
-const MAX_RECURSION_DEPTH = 100;
+// Matches a single segment against a glob where `*` matches any run of
+// characters and `?` matches exactly one. Greedy two-pointer matching that
+// only ever backtracks to the most recent `*`, so it runs in
+// O(pattern * text) worst case. Compiling to a `.*` regex instead
+// backtracks catastrophically on patterns like `*a*a*a*a*b`.
+function matchSegmentGlob(pattern: string, text: string): boolean {
+    let p = 0;
+    let t = 0;
+    let starP = -1;
+    let starT = 0;
 
-const segmentRegexCache = new Map<string, RegExp>();
-
-function getSegmentRegex(patternPart: string): RegExp {
-    let regex = segmentRegexCache.get(patternPart);
-    if (!regex) {
-        const regexPattern = patternPart
-            .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-            .replace(/\*/g, ".*")
-            .replace(/\?/g, ".");
-        regex = new RegExp(`^${regexPattern}$`);
-        segmentRegexCache.set(patternPart, regex);
+    while (t < text.length) {
+        if (p < pattern.length && pattern[p] === "*") {
+            starP = p++;
+            starT = t;
+        } else if (
+            p < pattern.length &&
+            (pattern[p] === "?" || pattern[p] === text[t])
+        ) {
+            p++;
+            t++;
+        } else if (starP !== -1) {
+            // let the last `*` swallow one more character and retry
+            p = starP + 1;
+            t = ++starT;
+        } else {
+            return false;
+        }
     }
-    return regex;
+
+    while (p < pattern.length && pattern[p] === "*") {
+        p++;
+    }
+    return p === pattern.length;
 }
 
 // Decodes percent-encoding (so an encoded slash like `%2F` is treated as a
@@ -56,55 +75,40 @@ export function isPathAllowed(pattern: string, path: string): boolean {
     const patternParts = decodeAndResolvePath(pattern);
     const pathParts = decodeAndResolvePath(path);
 
-    function matchSegments(
-        patternIndex: number,
-        pathIndex: number,
-        depth: number = 0
-    ): boolean {
-        if (depth > MAX_RECURSION_DEPTH) {
-            return false;
-        }
+    // Iterative dynamic-programming matcher. The previous recursive
+    // implementation forked on every bare `*`, which backtracked
+    // exponentially and let an unauthenticated path rule pin the event loop.
+    // `dp[i][j]` is true when patternParts[i..] matches pathParts[j..].
+    const m = patternParts.length;
+    const n = pathParts.length;
+    const dp: boolean[][] = Array.from({ length: m + 1 }, () =>
+        new Array<boolean>(n + 1).fill(false)
+    );
 
-        const currentPatternPart = patternParts[patternIndex];
-        const currentPathPart = pathParts[pathIndex];
-
-        if (patternIndex >= patternParts.length) {
-            return pathIndex >= pathParts.length;
-        }
-
-        if (pathIndex >= pathParts.length) {
-            return patternParts.slice(patternIndex).every((p) => p === "*");
-        }
-
-        if (currentPatternPart === "*") {
-            if (matchSegments(patternIndex + 1, pathIndex, depth + 1)) {
-                return true;
-            }
-            if (matchSegments(patternIndex, pathIndex + 1, depth + 1)) {
-                return true;
-            }
-            return false;
-        }
-
-        if (currentPatternPart.includes("*")) {
-            const regex = getSegmentRegex(currentPatternPart);
-
-            if (regex.test(currentPathPart)) {
-                return matchSegments(
-                    patternIndex + 1,
-                    pathIndex + 1,
-                    depth + 1
-                );
-            }
-            return false;
-        }
-
-        if (currentPatternPart !== currentPathPart) {
-            return false;
-        }
-
-        return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
+    dp[m][n] = true;
+    for (let j = 0; j < n; j++) {
+        dp[m][j] = false;
+    }
+    for (let i = m - 1; i >= 0; i--) {
+        dp[i][n] = patternParts.slice(i).every((p) => p === "*");
     }
 
-    return matchSegments(0, 0, 0);
+    for (let i = m - 1; i >= 0; i--) {
+        const currentPatternPart = patternParts[i];
+        for (let j = n - 1; j >= 0; j--) {
+            if (currentPatternPart === "*") {
+                // match zero segments, or consume one path segment
+                dp[i][j] = dp[i + 1][j] || dp[i][j + 1];
+            } else if (currentPatternPart.includes("*")) {
+                dp[i][j] =
+                    dp[i + 1][j + 1] &&
+                    matchSegmentGlob(currentPatternPart, pathParts[j]);
+            } else {
+                dp[i][j] =
+                    currentPatternPart === pathParts[j] && dp[i + 1][j + 1];
+            }
+        }
+    }
+
+    return dp[0][0];
 }

server/lib/readConfigFile.ts

@@ -149,6 +149,8 @@ export const configSchema = z
                     })
                     .optional(),
                 trust_proxy: z.int().gte(0).optional().default(1),
+                trust_ips: z.array(z.string()).optional().default([]),
+                custom_ip_header: z.string().optional().default(""),
                 // Opt-in: have Traefik/Badger stamp the resolved client IP
                 // into a dedicated header (X-Pangolin-Client-Ip) on the
                 // site-resource AI gateway route, so it survives an
@@ -174,36 +176,7 @@ export const configSchema = z
                 maxmind_db_path: z.string().optional(),
                 maxmind_asn_path: z.string().optional()
             })
-            .optional()
-            .default({
-                integration_port: 3003,
-                external_port: 3000,
-                internal_port: 3001,
-                ai_gateway_port: 3005,
-                next_port: 3002,
-                internal_hostname: "pangolin",
-                session_cookie_name: "p_session_token",
-                resource_access_token_param: "p_token",
-                resource_access_token_headers: {
-                    id: "P-Access-Token-Id",
-                    token: "P-Access-Token"
-                },
-                remote_headers: {
-                    user_id: "Remote-User-Id",
-                    virtual_api_key_id: "Remote-Virtual-Api-Key-Id",
-                    user: "Remote-User",
-                    email: "Remote-Email",
-                    name: "Remote-Name",
-                    role: "Remote-Role"
-                },
-                resource_session_request_param:
-                    "resource_session_request_param",
-                dashboard_session_length_hours: 720,
-                resource_session_length_hours: 720,
-                trust_proxy: 1,
-                enable_ai_gateway_client_ip_header: false,
-                secret: undefined
-            }),
+            .prefault({}),
         postgres: z
             .object({
                 connection_string: z.string().optional(),

server/lib/rebuildClientAssociations.ts

@@ -1,5 +1,6 @@
 import {
     Client,
+    clientOrgRoles,
     clients,
     clientSiteResources,
     clientSiteResourcesAssociationsCache,
@@ -17,11 +18,16 @@ import {
     sites,
     Transaction,
     userOrgRoles,
-    userSiteResources
+    userSiteResources,
+    orgs
 } from "@server/db";
 import { and, count, eq, inArray, isNotNull, ne } from "drizzle-orm";
 
 import { deletePeersBatch as newtDeletePeersBatch } from "@server/routers/newt/peers";
+import {
+    sendGatewayDisable,
+    sendGatewaySitesUpdate
+} from "@server/routers/olm/gateway";
 import {
     initPeerAddHandshakeBatch,
     deletePeersBatch as olmDeletePeersBatch
@@ -29,7 +35,6 @@ import {
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import { sendToClientsBatch } from "#dynamic/routers/ws";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import config from "@server/lib/config";
 import logger from "@server/logger";
 import {
     generateAliasConfig,
@@ -46,6 +51,10 @@ import {
     updatePeerDataBatch,
     updateTargets
 } from "@server/routers/client/targets";
+import {
+    pushClientIdentitiesToSites,
+    sendClientIdentitiesAdd
+} from "@server/lib/clientIdentities";
 import { lockManager } from "#dynamic/lib/lock";
 import { rebuildQueue } from "#dynamic/lib/rebuildQueue";
 import { withRetry, isTransientError } from "@server/lib/dbRetry";
@@ -234,7 +243,8 @@ export async function getClientSiteResourceAccess(
         .select({
             clientId: clients.clientId,
             pubKey: clients.pubKey,
-            subnet: clients.subnet
+            subnet: clients.subnet,
+            orgId: clients.orgId
         })
         .from(clients)
         .where(
@@ -251,16 +261,38 @@ export async function getClientSiteResourceAccess(
             eq(clientSiteResources.siteResourceId, siteResource.siteResourceId)
         );
 
-    const directClientIds = allClientSiteResources.map((row) => row.clientId);
+    // clients (machines) that get access through a role assigned directly to
+    // the client instead of through a user
+    const roleClientIds =
+        roleIds.length > 0
+            ? await trx
+                  .select({ clientId: clientOrgRoles.clientId })
+                  .from(clientOrgRoles)
+                  .where(
+                      and(
+                          inArray(clientOrgRoles.roleId, roleIds),
+                          eq(clientOrgRoles.orgId, siteResource.orgId)
+                      )
+                  )
+                  .then((rows) => rows.map((row) => row.clientId))
+            : [];
 
-    // Get full client details for directly associated clients
+    const directClientIds = Array.from(
+        new Set([
+            ...allClientSiteResources.map((row) => row.clientId),
+            ...roleClientIds
+        ])
+    );
+
+    // Get full client details for directly and client-role associated clients
     const directClients =
         directClientIds.length > 0
             ? await trx
                   .select({
                       clientId: clients.clientId,
                       pubKey: clients.pubKey,
-                      subnet: clients.subnet
+                      subnet: clients.subnet,
+                      orgId: clients.orgId
                   })
                   .from(clients)
                   .where(
@@ -279,7 +311,7 @@ export async function getClientSiteResourceAccess(
     const mergedAllClientIds = mergedAllClients.map((c) => c.clientId);
 
     logger.debug(
-        `rebuildClientAssociations: [getClientSiteResourceAccess] siteResourceId=${siteResource.siteResourceId} mergedClientCount=${mergedAllClientIds.length} clientIds=[${mergedAllClientIds.join(", ")}] (userBased=${newAllClients.length} direct=${directClients.length})`
+        `rebuildClientAssociations: [getClientSiteResourceAccess] siteResourceId=${siteResource.siteResourceId} mergedClientCount=${mergedAllClientIds.length} clientIds=[${mergedAllClientIds.join(", ")}] (userBased=${newAllClients.length} direct=${directClients.length} clientRoleBased=${roleClientIds.length})`
     );
 
     return {
@@ -463,7 +495,8 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                   .select({
                       clientId: clients.clientId,
                       pubKey: clients.pubKey,
-                      subnet: clients.subnet
+                      subnet: clients.subnet,
+                      orgId: clients.orgId
                   })
                   .from(clients)
                   .where(
@@ -532,6 +565,19 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
             );
     }
 
+    // A client that loses access to a gateway resource (it was deleted, or the
+    // client's roles/users/machines no longer include it) can't keep using it
+    // as its gateway. The olm ignores this unless it selected this resource.
+    if (
+        siteResource.mode === "gateway" &&
+        clientSiteResourcesToRemove.length > 0
+    ) {
+        await sendGatewayDisable(
+            clientSiteResourcesToRemove,
+            siteResource.siteResourceId
+        );
+    }
+
     /////////// process the client-site associations ///////////
 
     logger.debug(
@@ -568,7 +614,8 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                           .select({
                               clientId: clients.clientId,
                               pubKey: clients.pubKey,
-                              subnet: clients.subnet
+                              subnet: clients.subnet,
+                              orgId: clients.orgId
                           })
                           .from(clients)
                           .where(
@@ -720,11 +767,13 @@ async function handleMessagesForSiteClients(
         clientId: number;
         pubKey: string | null;
         subnet: string | null;
+        orgId: string;
     }[],
     existingClients: {
         clientId: number;
         pubKey: string | null;
         subnet: string | null;
+        orgId: string;
     }[],
     clientSitesToAdd: number[],
     clientSitesToRemove: number[],
@@ -792,6 +841,7 @@ async function handleMessagesForSiteClients(
             siteId: number;
             exitNode: {
                 publicKey: string;
+                relayPort: number;
                 endpoint: string;
             };
         };
@@ -805,6 +855,7 @@ async function handleMessagesForSiteClients(
             clientId: number;
             pubKey: string | null;
             subnet: string | null;
+            orgId: string;
         }
     >();
 
@@ -860,6 +911,22 @@ async function handleMessagesForSiteClients(
             .map((r) => [r.clientId as number, r.olmId])
     );
 
+    // Batch-fetch the orgs for all clients we need to process so we don't
+    // issue a redundant query per client in the loop below
+    const orgIdsToProcess = Array.from(
+        new Set(
+            Array.from(clientsToProcess.values()).map((client) => client.orgId)
+        )
+    );
+    const orgRows =
+        orgIdsToProcess.length > 0
+            ? await trx
+                  .select()
+                  .from(orgs)
+                  .where(inArray(orgs.orgId, orgIdsToProcess))
+            : [];
+    const orgByOrgId = new Map(orgRows.map((org) => [org.orgId, org]));
+
     for (const client of clientsToProcess.values()) {
         // UPDATE THE NEWT
         if (!client.subnet || !client.pubKey) {
@@ -899,7 +966,14 @@ async function handleMessagesForSiteClients(
         }
 
         if (isAdd) {
-            if (clientSiteCounts[client.clientId] > 250) {
+            const org = orgByOrgId.get(client.orgId);
+
+            if (!org) {
+                logger.warn(`Client ${client.clientId} org not found`);
+                continue;
+            }
+
+            if (clientSiteCounts[client.clientId] > org.settingsJitModeLimit) {
                 // skip adding the peer if we have more than 250 sites because we are in jit mode anyway
                 logger.info(
                     `rebuildClientAssociations: Client ${client.clientId} has ${clientSiteCounts[client.clientId]} sites so skipping adding peer to newt and olm because it is likely in jit mode`
@@ -913,6 +987,7 @@ async function handleMessagesForSiteClients(
                     siteId,
                     exitNode: {
                         publicKey: exitNode.publicKey,
+                        relayPort: exitNode.relayPort,
                         endpoint: exitNode.endpoint
                     }
                 },
@@ -1190,8 +1265,6 @@ async function syncClientExitNodeConnections(
             .map((r) => [r.clientId as number, r])
     );
 
-    const relayPort = config.getRawConfig().gerbil.clients_start_port;
-
     const connectPayloads: {
         clientId: string;
         message: { type: string; data: any };
@@ -1230,7 +1303,7 @@ async function syncClientExitNodeConnections(
                     data: {
                         connect: true,
                         endpoint: `${exitNode.endpoint}:${exitNode.listenPort}`,
-                        relayPort,
+                        relayPort: exitNode.relayPort,
                         publicKey: exitNode.publicKey,
                         serverIP: exitNode.address.split("/")[0],
                         tunnelIP: client.exitNodeSubnet.split("/")[0],
@@ -1368,6 +1441,8 @@ async function handleSubnetProxyTargetUpdates(
         >;
         version: string | null;
     }[] = [];
+    const identitiesToAddBatch: Parameters<typeof sendClientIdentitiesAdd>[0] =
+        [];
 
     for (const siteData of sitesList) {
         const siteId = siteData.siteId;
@@ -1404,6 +1479,14 @@ async function handleSubnetProxyTargetUpdates(
                         targets: targetsToAdd,
                         version: newt.version
                     });
+
+                    if (siteResource.mode === "http") {
+                        identitiesToAddBatch.push({
+                            newtId: newt.newtId,
+                            version: newt.version,
+                            clientIds: addedClients.map((c) => c.clientId)
+                        });
+                    }
                 }
 
                 olmJobs.push(
@@ -1512,6 +1595,10 @@ async function handleSubnetProxyTargetUpdates(
         }
     }
 
+    // Identities first so the HTTP proxy never serves an added client
+    // without its Remote-* headers.
+    await sendClientIdentitiesAdd(identitiesToAddBatch, trx);
+
     if (targetsToAddBatch.length > 0) {
         proxyJobs.push(addSubnetProxyTargetsBatch(targetsToAddBatch));
     }
@@ -1570,7 +1657,8 @@ export async function handleMessagingForUpdatedSiteResource(
         .select({
             clientId: clientSiteResourcesAssociationsCache.clientId,
             pubKey: clients.pubKey,
-            subnet: clients.subnet
+            subnet: clients.subnet,
+            orgId: clients.orgId
         })
         .from(clientSiteResourcesAssociationsCache)
         .innerJoin(
@@ -1597,6 +1685,28 @@ export async function handleMessagingForUpdatedSiteResource(
         `handleMessagingForUpdatedSiteResource: generated updated targets count=${targets ? targets.length : 0}`
     );
 
+    // Make sure sites newly serving this resource over HTTP know the identity
+    // of each client that can reach it before targets are sent below. Sites
+    // that already served it over HTTP got them when the clients were added,
+    // so plain edits of an HTTP resource send nothing here.
+    if (targets && updatedSiteResource.mode === "http") {
+        const identitySiteIds =
+            existingSiteResource?.mode === "http"
+                ? updatedSiteIds.filter((id) => !existingSiteIds.includes(id))
+                : updatedSiteIds;
+        await sendClientIdentitiesAdd(
+            identitySiteIds
+                .map((siteId) => newtBySiteId.get(siteId))
+                .filter((newt) => newt !== undefined)
+                .map((newt) => ({
+                    newtId: newt.newtId,
+                    version: newt.version,
+                    clientIds: mergedAllClients.map((c) => c.clientId)
+                })),
+            trx
+        );
+    }
+
     const oldDestinationStillInUseClientSitePairs = new Set<string>();
     if (
         existingSiteResource?.destination &&
@@ -2024,6 +2134,29 @@ export async function handleMessagingForUpdatedSiteResource(
         );
     }
 
+    // The olm only knows which gateway resource it selected and the sites it
+    // is currently using for it, so tell the clients that have access to this
+    // one what changed. Clients that lost access are handled by the rebuild.
+    if (existingSiteResource?.mode === "gateway") {
+        const clientIds = mergedAllClients.map((c) => c.clientId);
+        if (
+            updatedSiteResource.mode !== "gateway" ||
+            !updatedSiteResource.enabled
+        ) {
+            await sendGatewayDisable(
+                clientIds,
+                updatedSiteResource.siteResourceId
+            );
+        } else {
+            await sendGatewaySitesUpdate(
+                clientIds,
+                updatedSiteResource.siteResourceId,
+                addedSiteIds,
+                removedSiteIds
+            );
+        }
+    }
+
     logger.debug(
         `handleMessagingForUpdatedSiteResource: DONE siteResourceId=${updatedSiteResource.siteResourceId}`
     );
@@ -2078,11 +2211,16 @@ export async function rebuildClientAssociationsFromClient(
     }
 }
 
-async function rebuildClientAssociationsFromClientImpl(
+// Derives the set of site resources a client should have access to from its
+// permissions: direct client associations, the owning user's direct and
+// role-based associations, and roles assigned directly to the client
+// (machine clients). Shared by the rebuild and the cache verification so they
+// can't drift apart.
+async function getClientSiteResourceIds(
     client: Client,
     trx: Transaction | typeof db = db
-): Promise<void> {
-    let newSiteResourceIds: number[] = [];
+): Promise<number[]> {
+    const newSiteResourceIds: number[] = [];
 
     // 1. Direct client associations
     const directSiteResources = await trx
@@ -2103,7 +2241,20 @@ async function rebuildClientAssociationsFromClientImpl(
         ...directSiteResources.map((r) => r.siteResourceId)
     );
 
-    // 2. User-based and role-based access (if client has a userId)
+    // 2. Roles assigned directly to the client (machine clients). These are
+    // locked onto this org or else cross-org access could happen
+    const roleIds = await trx
+        .select({ roleId: clientOrgRoles.roleId })
+        .from(clientOrgRoles)
+        .where(
+            and(
+                eq(clientOrgRoles.clientId, client.clientId),
+                eq(clientOrgRoles.orgId, client.orgId)
+            )
+        )
+        .then((rows) => rows.map((row) => row.roleId));
+
+    // 3. User-based and user role-based access (if client has a userId)
     if (client.userId) {
         // Direct user associations
         const userSiteResourceIds = await trx
@@ -2127,8 +2278,7 @@ async function rebuildClientAssociationsFromClientImpl(
             ...userSiteResourceIds.map((r) => r.siteResourceId)
         );
 
-        // Role-based access
-        const roleIds = await trx
+        const userRoleIds = await trx
             .select({ roleId: userOrgRoles.roleId })
             .from(userOrgRoles)
             .where(
@@ -2139,32 +2289,45 @@ async function rebuildClientAssociationsFromClientImpl(
             ) // this needs to be locked onto this org or else cross-org access could happen
             .then((rows) => rows.map((row) => row.roleId));
 
-        if (roleIds.length > 0) {
-            const roleSiteResourceIds = await trx
-                .select({ siteResourceId: roleSiteResources.siteResourceId })
-                .from(roleSiteResources)
-                .innerJoin(
-                    siteResources,
-                    eq(
-                        siteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    and(
-                        inArray(roleSiteResources.roleId, roleIds),
-                        eq(siteResources.orgId, client.orgId) // filter by org to prevent cross-org associations
-                    )
-                );
+        roleIds.push(...userRoleIds);
+    }
 
-            newSiteResourceIds.push(
-                ...roleSiteResourceIds.map((r) => r.siteResourceId)
+    // Role-based access (client roles and user roles)
+    if (roleIds.length > 0) {
+        const roleSiteResourceIds = await trx
+            .select({ siteResourceId: roleSiteResources.siteResourceId })
+            .from(roleSiteResources)
+            .innerJoin(
+                siteResources,
+                eq(
+                    siteResources.siteResourceId,
+                    roleSiteResources.siteResourceId
+                )
+            )
+            .where(
+                and(
+                    inArray(
+                        roleSiteResources.roleId,
+                        Array.from(new Set(roleIds))
+                    ),
+                    eq(siteResources.orgId, client.orgId) // filter by org to prevent cross-org associations
+                )
             );
-        }
+
+        newSiteResourceIds.push(
+            ...roleSiteResourceIds.map((r) => r.siteResourceId)
+        );
     }
 
     // Remove duplicates
-    newSiteResourceIds = Array.from(new Set(newSiteResourceIds));
+    return Array.from(new Set(newSiteResourceIds));
+}
+
+async function rebuildClientAssociationsFromClientImpl(
+    client: Client,
+    trx: Transaction | typeof db = db
+): Promise<void> {
+    const newSiteResourceIds = await getClientSiteResourceIds(client, trx);
 
     // Get full siteResource details
     const newSiteResources =
@@ -2294,6 +2457,15 @@ async function rebuildClientAssociationsFromClientImpl(
 
     /////////// Send messages ///////////
 
+    // Push this client's identity to every site where it can reach an HTTP
+    // resource before any targets referencing it, so newt's HTTP proxy can
+    // set Remote-* headers from the first request. Also refreshes it after
+    // role changes, which land here as well. Skipped outright for clients
+    // without HTTP access, which is the common case.
+    if (newSiteResources.some((r) => r.mode === "http" && r.enabled)) {
+        await pushClientIdentitiesToSites([client.clientId], trx);
+    }
+
     // Handle messages for sites being added
     await handleMessagesForClientSites(client, sitesToAdd, sitesToRemove, trx);
 
@@ -2379,6 +2551,7 @@ async function handleMessagesForClientSites(
             siteId: number;
             exitNode: {
                 publicKey: string;
+                relayPort: number;
                 endpoint: string;
             };
         };
@@ -2391,6 +2564,19 @@ async function handleMessagesForClientSites(
         .where(eq(clientSitesAssociationsCache.clientId, client.clientId))
         .then((rows) => Number(rows[0].count));
 
+    // client.orgId is constant for this call, so fetch the org once
+    // instead of re-querying it for every site in the loop below
+    const [org] = await trx
+        .select()
+        .from(orgs)
+        .where(eq(orgs.orgId, client.orgId))
+        .limit(1);
+
+    if (!org) {
+        logger.warn(`Client ${client.clientId} org not found`);
+        return;
+    }
+
     for (const siteData of sitesData) {
         const site = siteData.sites;
         const exitNode = siteData.exitNodes;
@@ -2451,7 +2637,7 @@ async function handleMessagesForClientSites(
                 continue;
             }
 
-            if (totalSitesOnClient > 250) {
+            if (totalSitesOnClient > org.settingsJitModeLimit) {
                 // skip adding the site if we have more than 250 because we are in jit mode anyway
                 logger.info(
                     `rebuildClientAssociations: Client ${client.clientId} has ${totalSitesOnClient} sites so skipping adding peer to newt and olm because it is likely in jit mode`
@@ -2465,6 +2651,7 @@ async function handleMessagesForClientSites(
                     siteId: site.siteId,
                     exitNode: {
                         publicKey: exitNode.publicKey,
+                        relayPort: exitNode.relayPort,
                         endpoint: exitNode.endpoint
                     }
                 },
@@ -2861,86 +3048,7 @@ export async function verifyClientAssociationsCache(
     client: Client,
     trx: Transaction | typeof db = db
 ): Promise<ClientAssociationsCacheVerification> {
-    let newSiteResourceIds: number[] = [];
-
-    // 1. Direct client associations
-    const directSiteResources = await trx
-        .select({ siteResourceId: clientSiteResources.siteResourceId })
-        .from(clientSiteResources)
-        .innerJoin(
-            siteResources,
-            eq(siteResources.siteResourceId, clientSiteResources.siteResourceId)
-        )
-        .where(
-            and(
-                eq(clientSiteResources.clientId, client.clientId),
-                eq(siteResources.orgId, client.orgId)
-            )
-        );
-
-    newSiteResourceIds.push(
-        ...directSiteResources.map((r) => r.siteResourceId)
-    );
-
-    // 2. User-based and role-based access (if client has a userId)
-    if (client.userId) {
-        const userSiteResourceIds = await trx
-            .select({ siteResourceId: userSiteResources.siteResourceId })
-            .from(userSiteResources)
-            .innerJoin(
-                siteResources,
-                eq(
-                    siteResources.siteResourceId,
-                    userSiteResources.siteResourceId
-                )
-            )
-            .where(
-                and(
-                    eq(userSiteResources.userId, client.userId),
-                    eq(siteResources.orgId, client.orgId)
-                )
-            );
-
-        newSiteResourceIds.push(
-            ...userSiteResourceIds.map((r) => r.siteResourceId)
-        );
-
-        const roleIds = await trx
-            .select({ roleId: userOrgRoles.roleId })
-            .from(userOrgRoles)
-            .where(
-                and(
-                    eq(userOrgRoles.userId, client.userId),
-                    eq(userOrgRoles.orgId, client.orgId)
-                )
-            )
-            .then((rows) => rows.map((row) => row.roleId));
-
-        if (roleIds.length > 0) {
-            const roleSiteResourceIds = await trx
-                .select({ siteResourceId: roleSiteResources.siteResourceId })
-                .from(roleSiteResources)
-                .innerJoin(
-                    siteResources,
-                    eq(
-                        siteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    and(
-                        inArray(roleSiteResources.roleId, roleIds),
-                        eq(siteResources.orgId, client.orgId)
-                    )
-                );
-
-            newSiteResourceIds.push(
-                ...roleSiteResourceIds.map((r) => r.siteResourceId)
-            );
-        }
-    }
-
-    newSiteResourceIds = Array.from(new Set(newSiteResourceIds));
+    const newSiteResourceIds = await getClientSiteResourceIds(client, trx);
 
     const newSiteResources =
         newSiteResourceIds.length > 0
@@ -3061,7 +3169,8 @@ export async function cleanupSiteAssociations(
                   .select({
                       clientId: clients.clientId,
                       pubKey: clients.pubKey,
-                      subnet: clients.subnet
+                      subnet: clients.subnet,
+                      orgId: clients.orgId
                   })
                   .from(clients)
                   .where(inArray(clients.clientId, cachedClientIds))

server/lib/traefik/TraefikConfigManager.ts

@@ -297,7 +297,7 @@ export class TraefikConfigManager {
                     const secondsUntilExpiry =
                         localState.expiresAt - nowInSeconds;
                     const daysUntilExpiry = secondsUntilExpiry / (60 * 60 * 24);
-                    if (daysUntilExpiry < 45) {
+                    if (daysUntilExpiry < 15) {
                         logger.info(
                             `Fetching certificates due to upcoming expiry for ${domain} (${Math.round(daysUntilExpiry)} days remaining)`
                         );
@@ -314,7 +314,7 @@ export class TraefikConfigManager {
                     const nowInSeconds = Math.floor(Date.now() / 1000);
                     const secondsUntilExpiry = state.expiresAt - nowInSeconds;
                     const daysUntilExpiry = secondsUntilExpiry / (60 * 60 * 24);
-                    if (daysUntilExpiry < 45) {
+                    if (daysUntilExpiry < 15) {
                         logger.info(
                             `Fetching certificates due to upcoming expiry for wildcard cert ${certDomain} (${Math.round(daysUntilExpiry)} days remaining)`
                         );

server/lib/traefik/getTraefikConfig.ts

@@ -42,6 +42,7 @@ import { buildWildcardTls } from "./certResolver";
 import { buildCustomHeadersMiddleware } from "./headersMiddleware";
 import {
     buildHttpLoadBalancerServers,
+    buildLoadBalancingStrategy,
     buildStickySessionCookie,
     buildStickySessionIp,
     buildTcpUdpLoadBalancerServers
@@ -95,6 +96,7 @@ export async function getTraefikConfig(
             domainId: resources.domainId,
             enabled: resources.enabled,
             stickySession: resources.stickySession,
+            loadBalancingStrategy: resources.loadBalancingStrategy,
             tlsServerName: resources.tlsServerName,
             setHostHeader: resources.setHostHeader,
             enableProxy: resources.enableProxy,
@@ -225,6 +227,7 @@ export async function getTraefikConfig(
                 domainId: row.domainId,
                 enabled: row.enabled,
                 stickySession: row.stickySession,
+                loadBalancingStrategy: row.loadBalancingStrategy,
                 tlsServerName: row.tlsServerName,
                 setHostHeader: row.setHostHeader,
                 enableProxy: row.enableProxy,
@@ -542,6 +545,9 @@ export async function getTraefikConfig(
             config_output.http.services![serviceName] = {
                 loadBalancer: {
                     servers: buildHttpLoadBalancerServers(targets),
+                    ...buildLoadBalancingStrategy(
+                        resource.loadBalancingStrategy
+                    ),
                     ...(resource.stickySession
                         ? buildStickySessionCookie(resource.ssl)
                         : {})

server/lib/traefik/loadBalancer.test.ts

@@ -0,0 +1,100 @@
+import "@server/extendZod";
+import { assertEqualsObj } from "@test/assert";
+import {
+    buildHttpLoadBalancerServers,
+    buildLoadBalancingStrategy,
+    buildTcpUdpLoadBalancerServers
+} from "./loadBalancer";
+import type { TargetWithSite } from "./types";
+
+function makeTarget(ip: string, siteType: string): TargetWithSite {
+    return {
+        targetId: 1,
+        resourceId: 1,
+        providerId: null,
+        siteId: 1,
+        ip,
+        port: 8080,
+        internalPort: 9000,
+        method: "http",
+        enabled: true,
+        health: "healthy",
+        path: null,
+        pathMatchType: null,
+        rewritePath: null,
+        rewritePathType: null,
+        priority: 100,
+        mode: "http",
+        authToken: null,
+        site: {
+            siteId: 1,
+            type: siteType,
+            subnet: null,
+            exitNodeId: null,
+            online: true
+        }
+    };
+}
+
+function runTests() {
+    const ipCases = [
+        { ip: "2001:db8::1", host: "[2001:db8::1]" },
+        { ip: "192.0.2.1", host: "192.0.2.1" }
+    ];
+    const cases = [
+        ...ipCases,
+        { ip: "backend.example.com", host: "backend.example.com" }
+    ];
+
+    for (const { ip, host } of cases) {
+        const target = makeTarget(ip, "local");
+        assertEqualsObj(
+            buildHttpLoadBalancerServers([target]),
+            [{ url: `http://${host}:8080` }],
+            `Local HTTP target ${ip} should format its endpoint`
+        );
+        assertEqualsObj(
+            buildTcpUdpLoadBalancerServers([target]),
+            [{ address: `${host}:8080` }],
+            `Local TCP/UDP target ${ip} should format its endpoint`
+        );
+    }
+
+    for (const { ip, host } of ipCases) {
+        const target = makeTarget("backend.example.com", "newt");
+        target.site.subnet = `${ip}/${ip.includes(":") ? 128 : 32}`;
+
+        assertEqualsObj(
+            buildHttpLoadBalancerServers([target]),
+            [{ url: `http://${host}:9000` }],
+            "Newt HTTP target should use the subnet endpoint and internal port"
+        );
+        assertEqualsObj(
+            buildTcpUdpLoadBalancerServers([target]),
+            [{ address: `${host}:9000` }],
+            "Newt TCP/UDP target should use the subnet endpoint and internal port"
+        );
+    }
+
+    assertEqualsObj(
+        buildLoadBalancingStrategy("wrr"),
+        {},
+        "Default wrr strategy should be omitted"
+    );
+    assertEqualsObj(
+        buildLoadBalancingStrategy(null),
+        {},
+        "Missing strategy should be omitted"
+    );
+    for (const strategy of ["p2c", "hrw", "leasttime"]) {
+        assertEqualsObj(
+            buildLoadBalancingStrategy(strategy),
+            { strategy },
+            `${strategy} strategy should be emitted`
+        );
+    }
+
+    console.log("All load balancer endpoint tests passed!");
+}
+
+runTests();

server/lib/traefik/loadBalancer.ts

@@ -1,3 +1,4 @@
+import { formatEndpoint } from "@server/lib/ip";
 import { TargetWithSite } from "./types";
 
 /**
@@ -48,12 +49,12 @@ export function buildHttpLoadBalancerServers(targets: TargetWithSite[]) {
                 target.site.type === "wireguard"
             ) {
                 return {
-                    url: `${target.method}://${target.ip}:${target.port}`
+                    url: `${target.method}://${formatEndpoint(target.ip, target.port)}`
                 };
             } else if (target.site.type === "newt") {
                 const ip = target.site.subnet!.split("/")[0];
                 return {
-                    url: `${target.method}://${ip}:${target.internalPort}`
+                    url: `${target.method}://${formatEndpoint(ip, target.internalPort!)}`
                 };
             }
         })
@@ -62,6 +63,18 @@ export function buildHttpLoadBalancerServers(targets: TargetWithSite[]) {
         );
 }
 
+/**
+ * Build the loadBalancer.strategy for an HTTP-mode resource. Traefik defaults
+ * to wrr when strategy is omitted, so only emit it for the non-default
+ * strategies to keep the generated config unchanged for existing resources.
+ */
+export function buildLoadBalancingStrategy(strategy: string | null) {
+    if (!strategy || strategy === "wrr") {
+        return {};
+    }
+    return { strategy };
+}
+
 export function buildStickySessionCookie(ssl: boolean | null) {
     return {
         sticky: {
@@ -111,12 +124,12 @@ export function buildTcpUdpLoadBalancerServers(targets: TargetWithSite[]) {
                 target.site.type === "wireguard"
             ) {
                 return {
-                    address: `${target.ip}:${target.port}`
+                    address: formatEndpoint(target.ip, target.port)
                 };
             } else if (target.site.type === "newt") {
                 const ip = target.site.subnet!.split("/")[0];
                 return {
-                    address: `${ip}:${target.internalPort}`
+                    address: formatEndpoint(ip, target.internalPort!)
                 };
             }
         });

server/nextServer.ts

@@ -1,5 +1,7 @@
 import next from "next";
 import express from "express";
+import fs from "fs";
+import path from "path";
 import { parse } from "url";
 import logger from "@server/logger";
 import config from "@server/lib/config";
@@ -8,9 +10,28 @@ import { stripDuplicateSesions } from "./middlewares/stripDuplicateSessions";
 const nextPort = config.getRawConfig().server.next_port;
 
 export async function createNextServer() {
+    const dev = process.env.ENVIRONMENT !== "prod";
+
+    // The image only ships the files Next traced for its standalone output,
+    // which leaves out what is needed to load next.config at runtime. Hand
+    // Next the config resolved at build time instead, the same way the
+    // generated .next/standalone/server.js does.
+    const requiredServerFilesPath = path.join(
+        process.cwd(),
+        ".next",
+        "required-server-files.json"
+    );
+    if (!dev && fs.existsSync(requiredServerFilesPath)) {
+        const { config: nextConfig } = JSON.parse(
+            fs.readFileSync(requiredServerFilesPath, "utf8")
+        );
+        process.env.__NEXT_PRIVATE_STANDALONE_CONFIG =
+            JSON.stringify(nextConfig);
+    }
+
     //   const app = next({ dev });
     const app = next({
-        dev: process.env.ENVIRONMENT !== "prod",
+        dev,
         turbopack: false
     });
     const handle = app.getRequestHandler();

server/openApi.ts

@@ -33,7 +33,8 @@ export enum OpenAPITags {
     AiModel = "AI Model",
     AiBudget = "AI Budget",
     VirtualApiKey = "Virtual API Key",
-    Redirect = "Redirect"
+    Redirect = "Redirect",
+    Label = "Label"
 }
 
 // Order here controls the order tags are displayed in Swagger UI

server/private/lib/blueprints/MtlsSchema.ts

@@ -0,0 +1,19 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { z } from "zod";
+
+export const MtlsSchema = z.object({
+    enabled: z.boolean().optional(),
+    "ca-certificates": z.array(z.string().min(1)).optional()
+});

server/private/lib/dns/server.ts

@@ -384,7 +384,8 @@ export class AuthoritativeDNSServer {
         // Get records from cache or database
         const records = await this.getResourceRecordsByFullDomain(
             queryName,
-            queryType
+            queryType,
+            baseDomain!
         );
 
         if (records.length > 0) {
@@ -475,15 +476,30 @@ export class AuthoritativeDNSServer {
 
         const labels = queryName.replace(/\.$/, "").split(".");
 
-        // Fast path: O(1) in-memory Set lookup — no DB or network I/O
-        if (this.allDomains.size > 0) {
-            for (let i = 0; i < labels.length; i++) {
-                const candidate = labels.slice(i).join(".");
-                if (this.allDomains.has(candidate)) {
-                    this.authoritativeDomainCache.set(cacheKey, candidate);
-                    return candidate;
-                }
+        // Infrastructure zone cuts (e.g. this deployment's own nameserver
+        // zone, cname/site extension zones) that this server is
+        // authoritative for regardless of the customer `domains` table.
+        // Static config, so always available - checked alongside allDomains
+        // below rather than gating a separate fast path on it.
+        const configuredZones = (config.getRawConfig().dns?.zones ?? []).map(
+            (z) => z.toLowerCase()
+        );
+
+        // Fast path: O(1) in-memory Set/array lookup — no DB or network I/O
+        for (let i = 0; i < labels.length; i++) {
+            const candidate = labels.slice(i).join(".");
+            if (
+                this.allDomains.has(candidate) ||
+                configuredZones.includes(candidate)
+            ) {
+                this.authoritativeDomainCache.set(cacheKey, candidate);
+                return candidate;
             }
+        }
+
+        // Once the in-memory customer-domain set has loaded, the checks
+        // above are conclusive - no DB fallback needed.
+        if (this.allDomains.size > 0) {
             this.authoritativeDomainCache.set(cacheKey, null);
             return null;
         }
@@ -582,7 +598,8 @@ export class AuthoritativeDNSServer {
 
     private async getResourceRecordsByFullDomain(
         name: string,
-        queryType: dns.RecordType
+        queryType: dns.RecordType,
+        baseDomain: string
     ): Promise<DNSRecord[]> {
         const cacheKey = `resourceRecords:${name}:${queryType}`;
 
@@ -630,8 +647,14 @@ export class AuthoritativeDNSServer {
                 if (resourceRows.length === 0) {
                     // Resource doesn't exist at all — also pre-populate the domainExists
                     // cache so the subsequent domainExists() call hits memory, not the DB.
+                    // Skip that pre-population when `name` is the zone apex itself: the
+                    // apex always exists (it owns the SOA) even with no resource row, and
+                    // caching `false` here would make domainExists() return that stale
+                    // false instead of ever reaching its own apex check.
                     logger.debug(`No resource found for domain: ${name}`);
-                    this.cache.set(`exists:${name}`, false, 60);
+                    if (name.replace(/\.$/, "") !== baseDomain) {
+                        this.cache.set(`exists:${name}`, false, 60);
+                    }
                     this.cache.set(cacheKey, [], 60);
                     return [];
                 }

server/private/lib/exitNodes/exitNodes.ts

@@ -164,6 +164,7 @@ export async function listExitNodes(
             endpoint: exitNodes.endpoint,
             publicKey: exitNodes.publicKey,
             listenPort: exitNodes.listenPort,
+            relayPort: exitNodes.relayPort,
             reachableAt: exitNodes.reachableAt,
             maxConnections: exitNodes.maxConnections,
             online: exitNodes.online,

server/private/lib/offlineThresholds.ts

@@ -0,0 +1,27 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import type { OfflineThresholds } from "@server/lib/offlineThresholds";
+import privateConfig from "#private/lib/config";
+
+export function getOfflineThresholds(): OfflineThresholds {
+    const offlineChecker = privateConfig.getRawPrivateConfig().offline_checker;
+
+    return {
+        checkIntervalMs: offlineChecker.check_interval_ms,
+        newtMs: offlineChecker.newt_threshold_ms,
+        newtWireguardMs: offlineChecker.newt_wireguard_threshold_ms,
+        olmMs: offlineChecker.olm_threshold_ms,
+        remoteExitNodeMs: offlineChecker.remote_exit_node_threshold_ms
+    };
+}

server/private/lib/readConfigFile.ts

@@ -18,6 +18,7 @@ import { z } from "zod";
 import { colorsSchema } from "@server/lib/colorsSchema";
 import { build } from "@server/build";
 import { getEnvOrYaml } from "@server/lib/getEnvOrYaml";
+import { DEFAULT_OFFLINE_THRESHOLDS } from "@server/lib/offlineThresholds";
 
 const portSchema = z.number().positive().gt(0).lte(65535);
 
@@ -109,6 +110,16 @@ export const privateConfigSchema = z
                     .array(z.string())
                     .optional()
                     .default([]),
+                // Zone names (zone cuts) this server is authoritative for
+                // beyond the customer domains stored in the `domains` table -
+                // e.g. a self-hosted deployment's own nameserver zone or
+                // cname/site extension zones. Any query landing on one of
+                // these names, or an empty non-terminal beneath one, that
+                // doesn't match a more specific record gets NOERROR/NODATA +
+                // SOA (not NXDOMAIN), so QNAME-minimising resolvers (RFC
+                // 9156) don't treat the ancestor as proof nothing exists
+                // below it (RFC 8020). Left for the user to populate.
+                zones: z.array(z.string()).optional().default([]),
                 rate_limit: z
                     .object({
                         enabled: z.boolean().optional().default(true),
@@ -166,6 +177,36 @@ export const privateConfigSchema = z
                     .default("http://gerbil:3004")
             })
             .prefault({}),
+        // How long a newt site / olm client / remote exit node has to go
+        // without a ping before the offline checker marks it offline, and how
+        // often the checkers run.
+        offline_checker: z
+            .object({
+                check_interval_ms: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(DEFAULT_OFFLINE_THRESHOLDS.checkIntervalMs),
+                newt_threshold_ms: z
+                    .number()
+                    .int()
+                    .default(DEFAULT_OFFLINE_THRESHOLDS.newtMs),
+                // wireguard sites don't ping, so they are judged by their
+                // last bandwidth update instead
+                newt_wireguard_threshold_ms: z
+                    .number()
+                    .int()
+                    .default(DEFAULT_OFFLINE_THRESHOLDS.newtWireguardMs),
+                olm_threshold_ms: z
+                    .number()
+                    .int()
+                    .default(DEFAULT_OFFLINE_THRESHOLDS.olmMs),
+                remote_exit_node_threshold_ms: z
+                    .number()
+                    .int()
+                    .default(DEFAULT_OFFLINE_THRESHOLDS.remoteExitNodeMs)
+            })
+            .prefault({}),
         flags: z
             .object({
                 enable_redis: z.boolean().optional().default(false),

server/private/lib/traefik/getTraefikConfig.ts

@@ -22,6 +22,7 @@ import {
     domains,
     exitNodes,
     loginPage,
+    resourceMtlsCertificates,
     redirects,
     resources,
     siteNetworks,
@@ -54,6 +55,7 @@ import { buildWildcardTls } from "@server/lib/traefik/certResolver";
 import { buildCustomHeadersMiddleware } from "@server/lib/traefik/headersMiddleware";
 import {
     buildHttpLoadBalancerServers,
+    buildLoadBalancingStrategy,
     buildStickySessionCookie,
     buildStickySessionIp,
     buildTcpUdpLoadBalancerServers
@@ -132,6 +134,7 @@ export async function getTraefikConfig(
             domainId: resources.domainId,
             enabled: resources.enabled,
             stickySession: resources.stickySession,
+            loadBalancingStrategy: resources.loadBalancingStrategy,
             tlsServerName: resources.tlsServerName,
             setHostHeader: resources.setHostHeader,
             enableProxy: resources.enableProxy,
@@ -148,6 +151,8 @@ export async function getTraefikConfig(
             maintenanceMessage: resources.maintenanceMessage,
             maintenanceEstimatedTime: resources.maintenanceEstimatedTime,
 
+            mtlsEnabled: resources.mtlsEnabled,
+
             // Target fields
             targetId: targets.targetId,
             targetEnabled: targets.enabled,
@@ -274,6 +279,7 @@ export async function getTraefikConfig(
                 domainId: row.domainId,
                 enabled: row.enabled,
                 stickySession: row.stickySession,
+                loadBalancingStrategy: row.loadBalancingStrategy,
                 tlsServerName: row.tlsServerName,
                 setHostHeader: row.setHostHeader,
                 enableProxy: row.enableProxy,
@@ -295,7 +301,9 @@ export async function getTraefikConfig(
                 maintenanceModeType: row.maintenanceModeType,
                 maintenanceTitle: row.maintenanceTitle,
                 maintenanceMessage: row.maintenanceMessage,
-                maintenanceEstimatedTime: row.maintenanceEstimatedTime
+                maintenanceEstimatedTime: row.maintenanceEstimatedTime,
+
+                mtlsEnabled: row.mtlsEnabled
             });
         }
 
@@ -319,6 +327,33 @@ export async function getTraefikConfig(
         });
     }
 
+    // Trusted client-CA certificates for resources that require mTLS.
+    const mtlsResourceIds = [
+        ...new Set(
+            [...resourcesMap.values()]
+                .filter((r) => r.mode === "http" && r.mtlsEnabled)
+                .map((r) => r.resourceId as number)
+        )
+    ];
+    const mtlsCaCertsByResource = new Map<number, string[]>();
+    if (mtlsResourceIds.length > 0) {
+        const caRows = await db
+            .select({
+                resourceId: resourceMtlsCertificates.resourceId,
+                certificate: resourceMtlsCertificates.certificate
+            })
+            .from(resourceMtlsCertificates)
+            .where(
+                inArray(resourceMtlsCertificates.resourceId, mtlsResourceIds)
+            )
+            .orderBy(resourceMtlsCertificates.mtlsCertificateId);
+        for (const row of caRows) {
+            const list = mtlsCaCertsByResource.get(row.resourceId) ?? [];
+            list.push(row.certificate);
+            mtlsCaCertsByResource.set(row.resourceId, list);
+        }
+    }
+
     // Group browser gateway targets by resource
     const browserGatewayResourcesMap = browserGatewayUiUrl
         ? buildBrowserGatewayResourcesMap(
@@ -628,7 +663,7 @@ export async function getTraefikConfig(
                 resource.pathMatchType
             );
 
-            let tls = {};
+            let tls: Record<string, any> = {};
             if (!pangolinCertModeEnabled) {
                 tls = buildWildcardTls({
                     fullDomain,
@@ -650,9 +685,65 @@ export async function getTraefikConfig(
                 }
             }
 
+            // mTLS: Traefik resolves TLS options per hostname, and routers on
+            // the same host that reference different options make it fall back
+            // to the defaults, so the options are keyed on the resource (not
+            // the per-path router key) and every TLS router below (including
+            // the maintenance ones) references the same name.
+            const mtlsCaCerts =
+                resource.mtlsEnabled && resource.ssl
+                    ? mtlsCaCertsByResource.get(resource.resourceId)
+                    : undefined;
+            if (mtlsCaCerts && mtlsCaCerts.length > 0) {
+                const mtlsOptionsName = `resource-${resource.resourceId}-mtls`;
+                const mtlsHeadersMiddlewareName = `resource-${resource.resourceId}-mtls-headers`;
+
+                if (!config_output.tls) {
+                    config_output.tls = {};
+                }
+                if (!config_output.tls.options) {
+                    config_output.tls.options = {};
+                }
+                // caFiles entries are Traefik FileOrContent values: anything
+                // that isn't an existing file path is read as inline PEM, so
+                // the CA certs travel in this config to any exit node.
+                config_output.tls.options[mtlsOptionsName] = {
+                    clientAuth: {
+                        caFiles: mtlsCaCerts,
+                        clientAuthType: "RequireAndVerifyClientCert"
+                    }
+                };
+
+                config_output.http.middlewares[mtlsHeadersMiddlewareName] = {
+                    passTLSClientCert: {
+                        pem: false,
+                        info: {
+                            notAfter: true,
+                            notBefore: true,
+                            serialNumber: true,
+                            sans: true,
+                            subject: {
+                                commonName: true,
+                                organization: true
+                            },
+                            issuer: {
+                                commonName: true,
+                                organization: true
+                            }
+                        }
+                    }
+                };
+                routerMiddlewares.unshift(mtlsHeadersMiddlewareName);
+
+                tls = { ...tls, options: mtlsOptionsName };
+            }
+
             config_output.http.services![serviceName] = {
                 loadBalancer: {
                     servers: buildHttpLoadBalancerServers(targets),
+                    ...buildLoadBalancingStrategy(
+                        resource.loadBalancingStrategy
+                    ),
                     ...(resource.stickySession
                         ? buildStickySessionCookie(resource.ssl)
                         : {})

server/private/routers/billing/featureLifecycle.ts

@@ -303,6 +303,10 @@ async function disableFeature(
                 await disablemaintenancePage(orgId);
                 break;
 
+            case TierFeature.Mtls:
+                await disableMtls(orgId);
+                break;
+
             case TierFeature.DevicePosture:
                 await disableDevicePosture(orgId);
                 break;
@@ -519,6 +523,18 @@ async function disablemaintenancePage(orgId: string): Promise<void> {
     logger.info(`Disabled maintenance page on all resources for org ${orgId}`);
 }
 
+// The uploaded CA certificates are kept so mTLS can be re-enabled on upgrade.
+async function disableMtls(orgId: string): Promise<void> {
+    await db
+        .update(resources)
+        .set({
+            mtlsEnabled: false
+        })
+        .where(eq(resources.orgId, orgId));
+
+    logger.info(`Disabled mTLS on all resources for org ${orgId}`);
+}
+
 async function disableDevicePosture(orgId: string): Promise<void> {}
 
 async function disableTwoFactorEnforcement(orgId: string): Promise<void> {

server/private/routers/client/addClientRole.ts

@@ -0,0 +1,161 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { clientOrgRoles, clients, db, roles } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    rebuildClientAssociationsFromClient,
+    isOrgRebuildRateLimited
+} from "@server/lib/rebuildClientAssociations";
+
+const addClientRoleParamsSchema = z.strictObject({
+    clientId: z.coerce.number().int().positive(),
+    roleId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/client/{clientId}/add-role/{roleId}",
+    description:
+        "Add a role to a machine client. The client is granted access to the private resources assigned to the role. Clients with a userId cannot be added to roles; they inherit the roles of their user.",
+    tags: [OpenAPITags.Role, OpenAPITags.Client],
+    request: {
+        params: addClientRoleParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function addClientRole(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = addClientRoleParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { clientId, roleId } = parsedParams.data;
+
+        if (req.user && !req.userOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "You do not have access to this organization"
+                )
+            );
+        }
+
+        const [role] = await db
+            .select()
+            .from(roles)
+            .where(eq(roles.roleId, roleId))
+            .limit(1);
+
+        if (!role) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid role ID")
+            );
+        }
+
+        const [client] = await db
+            .select()
+            .from(clients)
+            .where(eq(clients.clientId, clientId))
+            .limit(1);
+
+        if (!client || client.orgId !== role.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "Client not found or does not belong to the specified organization"
+                )
+            );
+        }
+
+        if (client.userId !== null) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Cannot add roles to clients that are associated with a user"
+                )
+            );
+        }
+
+        if (await isOrgRebuildRateLimited(role.orgId)) {
+            return next(
+                createHttpError(
+                    HttpCode.TOO_MANY_REQUESTS,
+                    "Too many concurrent rebuild operations for this organization. Please retry after a moment."
+                )
+            );
+        }
+
+        await db
+            .insert(clientOrgRoles)
+            .values({
+                clientId,
+                orgId: role.orgId,
+                roleId
+            })
+            .onConflictDoNothing();
+
+        rebuildClientAssociationsFromClient(client).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for client ${clientId} after adding role: ${e}`
+            );
+        });
+
+        return response(res, {
+            data: { clientId, orgId: role.orgId, roleId },
+            success: true,
+            error: false,
+            message: "Role added to client successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/client/index.ts

@@ -0,0 +1,16 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export * from "./addClientRole";
+export * from "./removeClientRole";
+export * from "./setClientRoles";

server/private/routers/client/removeClientRole.ts

@@ -0,0 +1,153 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { clientOrgRoles, clients, db, roles } from "@server/db";
+import { and, eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    rebuildClientAssociationsFromClient,
+    isOrgRebuildRateLimited
+} from "@server/lib/rebuildClientAssociations";
+
+const removeClientRoleParamsSchema = z.strictObject({
+    clientId: z.coerce.number().int().positive(),
+    roleId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/client/{clientId}/remove-role/{roleId}",
+    description:
+        "Remove a role from a machine client. Unlike users, machine clients are not required to keep at least one role.",
+    tags: [OpenAPITags.Role, OpenAPITags.Client],
+    request: {
+        params: removeClientRoleParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function removeClientRole(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = removeClientRoleParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { clientId, roleId } = parsedParams.data;
+
+        if (req.user && !req.userOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "You do not have access to this organization"
+                )
+            );
+        }
+
+        const [role] = await db
+            .select()
+            .from(roles)
+            .where(eq(roles.roleId, roleId))
+            .limit(1);
+
+        if (!role) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid role ID")
+            );
+        }
+
+        const [client] = await db
+            .select()
+            .from(clients)
+            .where(eq(clients.clientId, clientId))
+            .limit(1);
+
+        if (!client || client.orgId !== role.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "Client not found or does not belong to the specified organization"
+                )
+            );
+        }
+
+        if (await isOrgRebuildRateLimited(role.orgId)) {
+            return next(
+                createHttpError(
+                    HttpCode.TOO_MANY_REQUESTS,
+                    "Too many concurrent rebuild operations for this organization. Please retry after a moment."
+                )
+            );
+        }
+
+        await db
+            .delete(clientOrgRoles)
+            .where(
+                and(
+                    eq(clientOrgRoles.clientId, clientId),
+                    eq(clientOrgRoles.orgId, role.orgId),
+                    eq(clientOrgRoles.roleId, roleId)
+                )
+            );
+
+        rebuildClientAssociationsFromClient(client).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for client ${clientId} after removing role: ${e}`
+            );
+        });
+
+        return response(res, {
+            data: { clientId, orgId: role.orgId, roleId },
+            success: true,
+            error: false,
+            message: "Role removed from client successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/client/setClientRoles.ts

@@ -0,0 +1,204 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { clientOrgRoles, clients, db, roles } from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    rebuildClientAssociationsFromClient,
+    isOrgRebuildRateLimited
+} from "@server/lib/rebuildClientAssociations";
+
+const setClientRolesParamsSchema = z.strictObject({
+    clientId: z.coerce.number().int().positive()
+});
+
+const setClientRolesBodySchema = z.strictObject({
+    roleIds: z.array(z.int().positive())
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/client/{clientId}/roles",
+    description:
+        "Set all roles for a machine client, replacing any existing roles. An empty list removes all roles. Clients with a userId cannot be assigned roles; they inherit the roles of their user.",
+    tags: [OpenAPITags.Role, OpenAPITags.Client],
+    request: {
+        params: setClientRolesParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setClientRolesBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function setClientRoles(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = setClientRolesParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = setClientRolesBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { clientId } = parsedParams.data;
+        const { roleIds } = parsedBody.data;
+
+        if (req.user && !req.userOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "You do not have access to this organization"
+                )
+            );
+        }
+
+        const uniqueRoleIds = [...new Set(roleIds)];
+
+        const [client] = await db
+            .select()
+            .from(clients)
+            .where(eq(clients.clientId, clientId))
+            .limit(1);
+
+        if (!client) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Client not found")
+            );
+        }
+
+        if (client.userId !== null) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Cannot set roles on clients that are associated with a user"
+                )
+            );
+        }
+
+        const orgId = client.orgId;
+
+        if (uniqueRoleIds.length > 0) {
+            const orgRoles = await db
+                .select({ roleId: roles.roleId })
+                .from(roles)
+                .where(
+                    and(
+                        eq(roles.orgId, orgId),
+                        inArray(roles.roleId, uniqueRoleIds)
+                    )
+                );
+
+            if (orgRoles.length !== uniqueRoleIds.length) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "One or more role IDs are invalid for this organization"
+                    )
+                );
+            }
+        }
+
+        if (await isOrgRebuildRateLimited(orgId)) {
+            return next(
+                createHttpError(
+                    HttpCode.TOO_MANY_REQUESTS,
+                    "Too many concurrent rebuild operations for this organization. Please retry after a moment."
+                )
+            );
+        }
+
+        await db.transaction(async (trx) => {
+            await trx
+                .delete(clientOrgRoles)
+                .where(
+                    and(
+                        eq(clientOrgRoles.clientId, clientId),
+                        eq(clientOrgRoles.orgId, orgId)
+                    )
+                );
+
+            if (uniqueRoleIds.length > 0) {
+                await trx.insert(clientOrgRoles).values(
+                    uniqueRoleIds.map((roleId) => ({
+                        clientId,
+                        orgId,
+                        roleId
+                    }))
+                );
+            }
+        });
+
+        rebuildClientAssociationsFromClient(client).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for client ${clientId} after setting roles: ${e}`
+            );
+        });
+
+        return response(res, {
+            data: { clientId, orgId, roleIds: uniqueRoleIds },
+            success: true,
+            error: false,
+            message: "Client roles set successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/external.ts

@@ -29,6 +29,7 @@ import * as misc from "#private/routers/misc";
 import * as reKey from "#private/routers/re-key";
 import * as approval from "#private/routers/approvals";
 import * as user from "#private/routers/user";
+import * as client from "#private/routers/client";
 import * as siteProvisioning from "#private/routers/siteProvisioning";
 import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
 import * as alertRule from "#private/routers/alertRule";
@@ -674,6 +675,36 @@ authenticated.post(
     user.setUserOrgRoles
 );
 
+authenticated.post(
+    "/client/:clientId/add-role/:roleId",
+    verifyClientAccess,
+    verifyRoleAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.addClientRole),
+    logActionAudit(ActionsEnum.addClientRole),
+    client.addClientRole
+);
+
+authenticated.delete(
+    "/client/:clientId/remove-role/:roleId",
+    verifyClientAccess,
+    verifyRoleAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.removeClientRole),
+    logActionAudit(ActionsEnum.removeClientRole),
+    client.removeClientRole
+);
+
+authenticated.post(
+    "/client/:clientId/roles",
+    verifyClientAccess,
+    verifyRoleAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.setClientRoles),
+    logActionAudit(ActionsEnum.setClientRoles),
+    client.setClientRoles
+);
+
 authenticated.put(
     "/org/:orgId/site-provisioning-key",
     verifyValidLicense,

server/private/routers/gerbil/createExitNode.ts

@@ -34,6 +34,7 @@ export async function createExitNode(
             // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
             // const listenPort = await getNextAvailablePort();
             const listenPort = config.getRawConfig().gerbil.start_port;
+            const relayPort = config.getRawConfig().gerbil.clients_start_port;
 
             const exitNodeName =
                 config.getRawConfig().gerbil.exit_node_name ||
@@ -49,6 +50,7 @@ export async function createExitNode(
                         privateConfig.getRawPrivateConfig().app.region || null,
                     address,
                     listenPort,
+                    relayPort,
                     online: true,
                     reachableAt,
                     name: exitNodeName

server/private/routers/integration.ts

@@ -29,11 +29,13 @@ import {
     verifyApiKeyIdpAccess,
     verifyApiKeyRoleAccess,
     verifyApiKeyUserAccess,
+    verifyApiKeyClientAccess,
     verifyApiKeySiteProvisioningKeyAccess,
     verifyApiKeyResourcePolicyAccess,
     verifyLimits
 } from "@server/middlewares";
 import * as user from "#private/routers/user";
+import * as client from "#private/routers/client";
 import {
     verifyValidSubscription,
     verifyValidLicense
@@ -246,6 +248,36 @@ authenticated.delete(
     user.removeUserRole
 );
 
+authenticated.post(
+    "/client/:clientId/add-role/:roleId",
+    verifyApiKeyClientAccess,
+    verifyApiKeyRoleAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.addClientRole),
+    logActionAudit(ActionsEnum.addClientRole),
+    client.addClientRole
+);
+
+authenticated.delete(
+    "/client/:clientId/remove-role/:roleId",
+    verifyApiKeyClientAccess,
+    verifyApiKeyRoleAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.removeClientRole),
+    logActionAudit(ActionsEnum.removeClientRole),
+    client.removeClientRole
+);
+
+authenticated.post(
+    "/client/:clientId/roles",
+    verifyApiKeyClientAccess,
+    verifyApiKeyRoleAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.setClientRoles),
+    logActionAudit(ActionsEnum.setClientRoles),
+    client.setClientRoles
+);
+
 authenticated.put(
     "/org/:orgId/site-provisioning-key",
     verifyValidLicense,

server/private/routers/remoteExitNode/createRemoteExitNode.ts

@@ -201,10 +201,7 @@ export async function createRemoteExitNode(
         let releaseSubnetLock: (() => Promise<void>) | null = null;
         let newExitNodeAddress: string | null = null;
         if (!existingExitNode) {
-            const { value, release } = await getNextAvailableSubnet(
-                db,
-                orgId
-            );
+            const { value, release } = await getNextAvailableSubnet(db, orgId);
             newExitNodeAddress = value;
             releaseSubnetLock = release;
         }
@@ -220,6 +217,7 @@ export async function createRemoteExitNode(
                             endpoint: "",
                             publicKey: "",
                             listenPort: 0,
+                            relayPort: 0,
                             online: false,
                             type: "remoteExitNode"
                         })

server/private/routers/remoteExitNode/offlineChecker.ts

@@ -14,11 +14,10 @@
 import { db, exitNodes } from "@server/db";
 import { eq, lt, isNull, and, or } from "drizzle-orm";
 import logger from "@server/logger";
+import { getOfflineThresholds } from "#private/lib/offlineThresholds";
 
 // Track if the offline checker interval is running
 let offlineCheckerInterval: NodeJS.Timeout | null = null;
-const OFFLINE_CHECK_INTERVAL = 30 * 1000; // Check every 30 seconds
-const OFFLINE_THRESHOLD_MS = 2 * 60 * 1000; // 2 minutes
 
 /**
  * Starts the background interval that checks for clients that haven't pinged recently
@@ -31,11 +30,11 @@ export const startRemoteExitNodeOfflineChecker = (): void => {
 
     offlineCheckerInterval = setInterval(async () => {
         try {
-            const twoMinutesAgo = Math.floor(
-                (Date.now() - OFFLINE_THRESHOLD_MS) / 1000
+            const offlineBefore = Math.floor(
+                (Date.now() - getOfflineThresholds().remoteExitNodeMs) / 1000
             );
 
-            // Find clients that haven't pinged in the last 2 minutes and mark them as offline
+            // Find clients that haven't pinged within the offline threshold and mark them as offline
             const offlineNodes = await db
                 .update(exitNodes)
                 .set({ online: false })
@@ -44,7 +43,7 @@ export const startRemoteExitNodeOfflineChecker = (): void => {
                         eq(exitNodes.online, true),
                         eq(exitNodes.type, "remoteExitNode"),
                         or(
-                            lt(exitNodes.lastPing, twoMinutesAgo),
+                            lt(exitNodes.lastPing, offlineBefore),
                             isNull(exitNodes.lastPing)
                         )
                     )
@@ -65,7 +64,7 @@ export const startRemoteExitNodeOfflineChecker = (): void => {
         } catch (error) {
             logger.error("Error in offline checker interval", { error });
         }
-    }, OFFLINE_CHECK_INTERVAL);
+    }, getOfflineThresholds().checkIntervalMs);
 
     logger.debug("Started offline checker interval");
 };

server/private/routers/ws/ws.ts

@@ -329,6 +329,12 @@ const initializeRedisSubscription = async (): Promise<void> => {
                         redisMessage.message,
                         redisMessage.excludeClientId
                     );
+                } else if (
+                    redisMessage.type === "disconnect" &&
+                    redisMessage.targetClientId
+                ) {
+                    // Close the client's connections if any are on this node
+                    disconnectClientLocal(redisMessage.targetClientId);
                 }
             } catch (error) {
                 logger.error("Error processing Redis message:", error);
@@ -1285,13 +1291,43 @@ if (redisManager.isRedisEnabled()) {
     logger.debug("WebSocket handler initialized in local mode");
 }
 
-// Disconnect a specific client and force them to reconnect
+// Disconnect a specific client on every node and force them to reconnect
 const disconnectClient = async (clientId: string): Promise<boolean> => {
+    const localDisconnected = disconnectClientLocal(clientId);
+
+    if (!redisManager.isRedisEnabled()) {
+        return localDisconnected;
+    }
+
+    try {
+        // Flush queued direct messages first so anything sent to this client
+        // just before (e.g. olm/terminate) reaches the other nodes ahead of
+        // the disconnect on the same channel.
+        await flushPendingRedisDirectMessages();
+
+        const redisMessage: RedisMessage = {
+            type: "disconnect",
+            targetClientId: clientId,
+            fromNodeId: NODE_ID
+        };
+        await redisManager.publish(REDIS_CHANNEL, JSON.stringify(redisMessage));
+        return true;
+    } catch (error) {
+        logger.error(
+            `Failed to publish disconnect for client ID ${clientId} via Redis:`,
+            error
+        );
+        return localDisconnected;
+    }
+};
+
+// Disconnect a specific client's connections on this node only
+const disconnectClientLocal = (clientId: string): boolean => {
     const mapKey = getClientMapKey(clientId);
     const clients = connectedClients.get(mapKey);
 
     if (!clients || clients.length === 0) {
-        logger.debug(`No connections found for client ID: ${clientId}`);
+        logger.debug(`No local connections found for client ID: ${clientId}`);
         return false;
     }
 

server/routers/badger/exchangeSession.ts

@@ -4,7 +4,12 @@ import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
-import { resourceAccessToken, resources, sessions } from "@server/db";
+import {
+    resourceAccessToken,
+    resourceSessions,
+    resources,
+    sessions
+} from "@server/db";
 import { db } from "@server/db";
 import { and, eq, inArray, or, sql } from "drizzle-orm";
 import {
@@ -128,7 +133,18 @@ export async function exchangeSession(
             );
         }
 
-        await db.delete(sessions).where(eq(sessions.sessionId, requestToken));
+        // Enforce single use: consume the request token. Checking the deleted
+        // row count makes concurrent exchanges of the same token race safely.
+        const consumed = await db
+            .delete(resourceSessions)
+            .where(eq(resourceSessions.sessionId, requestSession.sessionId))
+            .returning();
+
+        if (consumed.length === 0) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Invalid request token")
+            );
+        }
 
         const token = generateSessionToken();
 

server/routers/badger/verifySession.test.ts

@@ -383,6 +383,30 @@ function runSpecialCharacterTests() {
         "Deeply nested paths should still match"
     );
 
+    assertEquals(
+        isPathAllowed("*a*b", "xaxyb"),
+        true,
+        "Multiple wildcards within a segment should match"
+    );
+    assertEquals(
+        isPathAllowed("*a*b", "xaxyba"),
+        false,
+        "In-segment wildcard pattern must still be anchored at the end"
+    );
+
+    // a `.*`-style regex backtracks catastrophically here and never returns
+    const start = Date.now();
+    isPathAllowed("/" + "*a".repeat(10) + "b", "/" + "a".repeat(5000));
+    isPathAllowed(
+        "/" + Array(10).fill("*a*a*a*").join("/") + "/nevermatch",
+        "/" + Array(25).fill("a".repeat(200)).join("/")
+    );
+    assertEquals(
+        Date.now() - start < 1000,
+        true,
+        "In-segment wildcards should not backtrack exponentially"
+    );
+
     console.log("All special character tests passed!");
 }
 

server/routers/badger/verifySession.ts

@@ -170,17 +170,16 @@ export async function verifyResourceSession(
             originalRequestURL,
             requestIp,
             path,
+            method,
             headers,
             query,
-            method,
             badgerVersion
         } = parsedBody.data;
 
         // Extract HTTP Basic Auth credentials if present
         const clientHeaderAuth = extractBasicAuth(headers);
 
-        const clientUserAgent =
-            headers?.["user-agent"] || headers?.["User-Agent"];
+        const clientUserAgent = getClientHeader(headers, "user-agent");
         const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
 
         const clientIp = requestIp
@@ -486,7 +485,15 @@ export async function verifyResourceSession(
 
             // Browsers go to the resource auth / API key page. API clients get
             // a capability-shaped JSON auth error instead of a redirect.
-            if (clientIsBrowser) {
+            // Never redirect programmatic API calls (non-GET, or a known AI
+            // capability path): HTTP clients such as the OpenAI Python SDK
+            // (httpx) don't follow 302s on POST, so a redirect surfaces as
+            // an opaque failure with nothing logged in aiSessionLog since
+            // the request never reaches the gateway.
+            if (
+                clientIsBrowser &&
+                !isProgrammaticApiRequest(path, method, headers)
+            ) {
                 return notAllowed(res, redirectPath, resource.orgId);
             }
 
@@ -1772,14 +1779,29 @@ const NON_BROWSER_USER_AGENT_PATTERNS = [
     /wget/,
     /python-requests/,
     /python-urllib/,
+    /python-httpx/,
+    /httpx/,
+    /httpcore/,
+    /aiohttp/,
+    /urllib3/,
+    /openai\//,
+    /anthropic/,
     /go-http-client/,
     /okhttp/,
     /axios/,
     /node-fetch/,
+    /undici/,
     /postmanruntime/,
     /insomnia/,
     /libwww-perl/,
     /java\//,
+    /\bjava\b/,
+    /jakarta/,
+    /jersey/,
+    /netty/,
+    /jetty/,
+    /eclipse/,
+    /dbeaver/,
     /ruby/,
     /php/,
     /bot/,
@@ -1804,6 +1826,52 @@ function isBrowserUserAgent(userAgent: string | undefined): boolean {
     return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
 }
 
+function getClientHeader(
+    headers: Record<string, string> | undefined,
+    name: string
+): string | undefined {
+    if (!headers) {
+        return undefined;
+    }
+    const lower = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lower) {
+            return value;
+        }
+    }
+    return undefined;
+}
+
+// True for programmatic API calls that can't complete an interactive login,
+// even if the User-Agent looks like a browser (some SDKs reuse browser-ish
+// strings or omit a distinctive token). Badger turns a redirectUrl into a
+// 302, which HTTP clients don't follow on POST, so these must get a JSON
+// auth error instead.
+function isProgrammaticApiRequest(
+    path: string | undefined,
+    method: string | undefined,
+    headers: Record<string, string> | undefined
+): boolean {
+    if (method && method.toUpperCase() !== "GET") {
+        return true;
+    }
+    if (path && resolveAiCapabilityFromPath(path) !== null) {
+        return true;
+    }
+    const accept = getClientHeader(headers, "accept");
+    if (accept && !accept.toLowerCase().includes("text/html")) {
+        return true;
+    }
+    const secFetchMode = getClientHeader(headers, "sec-fetch-mode");
+    if (
+        secFetchMode &&
+        !["navigate", "document"].includes(secFetchMode.toLowerCase())
+    ) {
+        return true;
+    }
+    return false;
+}
+
 function extractBasicAuth(
     headers: Record<string, string> | undefined
 ): string | undefined {

server/routers/client/getClient.ts

@@ -1,6 +1,14 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, idp, idpOidcConfig, olms, users } from "@server/db";
+import {
+    clientOrgRoles,
+    db,
+    idp,
+    idpOidcConfig,
+    olms,
+    roles,
+    users
+} from "@server/db";
 import { clients, currentFingerprint } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -239,6 +247,8 @@ export type GetClientResponse = NonNullable<
     userType: string | null;
     idpName: string | null;
     idpVariant: string | null;
+    // roles assigned directly to the client (machine clients only)
+    roles: { roleId: number; name: string }[];
 };
 
 registry.registerPath({
@@ -394,6 +404,17 @@ export async function getClient(
             }
         }
 
+        const clientRoles = await db
+            .select({ roleId: roles.roleId, name: roles.name })
+            .from(clientOrgRoles)
+            .innerJoin(roles, eq(roles.roleId, clientOrgRoles.roleId))
+            .where(
+                and(
+                    eq(clientOrgRoles.clientId, client.clients.clientId),
+                    eq(clientOrgRoles.orgId, client.clients.orgId)
+                )
+            );
+
         const data: GetClientResponse = {
             ...client.clients,
             name: clientName,
@@ -407,7 +428,8 @@ export async function getClient(
             posture: postureData,
             userType,
             idpName,
-            idpVariant
+            idpVariant,
+            roles: clientRoles
         };
 
         return response<GetClientResponse>(res, {

server/routers/client/listClients.ts

@@ -1,5 +1,6 @@
 import {
     clientLabels,
+    clientOrgRoles,
     clients,
     clientSitesAssociationsCache,
     currentFingerprint,
@@ -8,6 +9,7 @@ import {
     olms,
     orgs,
     roleClients,
+    roles,
     sites,
     userClients,
     users,
@@ -25,6 +27,7 @@ import {
     asc,
     desc,
     eq,
+    exists,
     inArray,
     isNull,
     like,
@@ -138,6 +141,30 @@ const listClientsSchema = z.strictObject({
         .openapi({
             type: "array",
             description: "Filter by client labels"
+        }),
+    role_id: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            const raw = Array.isArray(val)
+                ? val
+                : typeof val === "string"
+                  ? val.split(",")
+                  : [val];
+            const ids = raw
+                .map((v) =>
+                    typeof v === "string" ? parseInt(v, 10) : Number(v)
+                )
+                .filter((n) => Number.isInteger(n) && n > 0);
+            return ids.length > 0 ? [...new Set(ids)] : undefined;
+        }, z.array(z.number().int().positive()).optional())
+        .catch(undefined)
+        .openapi({
+            type: "array",
+            items: { type: "integer" },
+            description:
+                "Filter clients that have any of these role ids assigned (repeat query param or comma-separated)"
         })
 });
 
@@ -195,6 +222,7 @@ type ClientWithSites = Awaited<ReturnType<typeof queryClientsBase>>[0] & {
     }>;
     olmUpdateAvailable?: boolean;
     labels?: Array<Pick<Label, "labelId" | "name" | "color">>;
+    roles: Array<{ roleId: number; name: string }>;
 };
 
 type OlmWithUpdateAvailable = ClientWithSites;
@@ -253,7 +281,8 @@ export async function listClients(
             status,
             sort_by,
             order,
-            labels: labelFilter
+            labels: labelFilter,
+            role_id: roleIdFilter
         } = parsedQuery.data;
 
         const parsedParams = listClientsParamsSchema.safeParse(req.params);
@@ -352,6 +381,23 @@ export async function listClients(
             );
         }
 
+        if (roleIdFilter && roleIdFilter.length > 0) {
+            conditions.push(
+                exists(
+                    db
+                        .select()
+                        .from(clientOrgRoles)
+                        .where(
+                            and(
+                                eq(clientOrgRoles.clientId, clients.clientId),
+                                eq(clientOrgRoles.orgId, orgId),
+                                inArray(clientOrgRoles.roleId, roleIdFilter)
+                            )
+                        )
+                )
+            );
+        }
+
         if (query) {
             const q = "%" + query.toLowerCase() + "%";
             const queryList = [
@@ -421,6 +467,25 @@ export async function listClients(
                 .orderBy(asc(clientLabels.clientLabelId));
         }
 
+        const rolesForClients =
+            clientIds.length > 0
+                ? await db
+                      .select({
+                          clientId: clientOrgRoles.clientId,
+                          roleId: roles.roleId,
+                          name: roles.name
+                      })
+                      .from(clientOrgRoles)
+                      .innerJoin(roles, eq(roles.roleId, clientOrgRoles.roleId))
+                      .where(
+                          and(
+                              inArray(clientOrgRoles.clientId, clientIds),
+                              eq(clientOrgRoles.orgId, orgId)
+                          )
+                      )
+                      .orderBy(asc(roles.name))
+                : [];
+
         // Group site associations by client ID
         const sitesByClient = siteAssociations.reduce(
             (acc, association) => {
@@ -451,7 +516,10 @@ export async function listClients(
                 sites: sitesByClient[client.clientId] || [],
                 labels: labelsForClients.filter(
                     (l) => l.clientId === client.clientId
-                )
+                ),
+                roles: rolesForClients
+                    .filter((r) => r.clientId === client.clientId)
+                    .map(({ roleId, name }) => ({ roleId, name }))
             };
         });
 

server/routers/external.ts

@@ -387,6 +387,13 @@ authenticated.get(
     siteResource.getSiteResource
 );
 
+authenticated.get(
+    "/site-resource/:siteResourceId/blueprint",
+    verifySiteResourceAccess,
+    verifyUserHasAction(ActionsEnum.getSiteResource),
+    siteResource.exportSiteResourceBlueprint
+);
+
 authenticated.post(
     "/site-resource/:siteResourceId",
     verifySiteResourceAccess,
@@ -765,6 +772,13 @@ authenticated.get(
     verifyUserHasAction(ActionsEnum.getResource),
     resource.getResource
 );
+
+authenticated.get(
+    "/resource/:resourceId/blueprint",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.getResource),
+    resource.exportResourceBlueprint
+);
 authenticated.get(
     "/org/:orgId/resource/:niceId",
     verifyOrgAccess,
@@ -835,6 +849,28 @@ authenticated.delete(
     resource.deleteResourceRule
 );
 
+authenticated.put(
+    "/resource/:resourceId/mtls/certificate",
+    verifyResourceAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.createResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
+    resource.createResourceMtlsCertificate
+);
+authenticated.get(
+    "/resource/:resourceId/mtls/certificates",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.listResourceMtlsCertificates),
+    resource.listResourceMtlsCertificates
+);
+authenticated.delete(
+    "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.deleteResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
+    resource.deleteResourceMtlsCertificate
+);
+
 authenticated.get(
     "/target/:targetId",
     verifyTargetAccess,

server/routers/gerbil/createExitNode.ts

@@ -16,6 +16,7 @@ export async function createExitNode(
         const { value: address, release } = await getNextAvailableSubnet();
         try {
             const listenPort = config.getRawConfig().gerbil.start_port;
+            const relayPort = config.getRawConfig().gerbil.clients_start_port;
 
             const exitNodeName =
                 config.getRawConfig().gerbil.exit_node_name ||
@@ -30,6 +31,7 @@ export async function createExitNode(
                     address,
                     online: true,
                     listenPort,
+                    relayPort,
                     reachableAt,
                     name: exitNodeName
                 })

server/routers/gerbil/getConfig.ts

@@ -20,6 +20,7 @@ const getConfigSchema = z.object({
 
 export type GetConfigResponse = {
     listenPort: number;
+    relayPort: number;
     ipAddress: string;
     peers: {
         publicKey: string | null;
@@ -143,6 +144,7 @@ export async function generateGerbilConfig(exitNode: ExitNode) {
 
     const configResponse: GetConfigResponse = {
         listenPort: exitNode.listenPort || 51820,
+        relayPort: exitNode.relayPort || 21820,
         ipAddress: exitNode.address,
         peers
     };

server/routers/gerbil/updateHolePunch.ts

@@ -8,7 +8,8 @@ import {
     sites,
     clientSitesAssociationsCache,
     exitNodes,
-    ExitNode
+    ExitNode,
+    orgs
 } from "@server/db";
 import { db } from "@server/db";
 import { eq, and, inArray } from "drizzle-orm";
@@ -112,7 +113,12 @@ export async function updateHolePunch(
             destinations: destinations
         });
     } catch (error) {
-        if (!(error instanceof Error && error.message === "Exit node not allowed")) {
+        if (
+            !(
+                error instanceof Error &&
+                error.message === "Exit node not allowed"
+            )
+        ) {
             logger.error(error);
         }
         return next(
@@ -460,7 +466,18 @@ async function handleClientEndpointChange(
             return;
         }
 
-        if (sitesWithNewtsToUpdate.length > 250) {
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, client.orgId))
+            .limit(1);
+
+        if (!org) {
+            logger.warn(`Client ${clientId} org not found`);
+            return;
+        }
+
+        if (sitesWithNewtsToUpdate.length > org.settingsJitModeLimit) {
             logger.warn(
                 `Client ${clientId} has ${sitesWithNewtsToUpdate.length} connected sites so the client will be in jit mode anyway, skipping endpoint updates`
             );

server/routers/idp/validateOidcCallback.ts

@@ -23,6 +23,7 @@ import { LimitId } from "@server/lib/billing";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { usageService } from "@server/lib/billing/usageService";
 import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsForOrgs";
+import { pushClientIdentitiesForUser } from "@server/lib/clientIdentities";
 import config from "@server/lib/config";
 import { decrypt } from "@server/lib/crypto";
 import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
@@ -641,6 +642,17 @@ export async function validateOidcCallback(
                 );
             });
 
+            if (existingUser) {
+                // The sync above may have changed the user's name, email or
+                // roles, all of which newt forwards as Remote-* headers.
+                pushClientIdentitiesForUser(userId!).catch((err) => {
+                    logger.error(
+                        "Error pushing client identities after syncing OIDC user",
+                        { error: err }
+                    );
+                });
+            }
+
             for (const orgCount of orgUserCounts) {
                 await usageService.updateCount(
                     orgCount.orgId,

server/routers/integration.ts

@@ -17,6 +17,7 @@ import * as aiProvider from "./aiProvider";
 import * as aiBudget from "./aiBudget";
 import * as virtualApiKey from "./virtualApiKey";
 import * as redirect from "./redirect";
+import * as labels from "./labels";
 import {
     verifyApiKey,
     verifyApiKeyOrgAccess,
@@ -739,6 +740,39 @@ authenticated.delete(
     resource.deleteResourceRule
 );
 
+authenticated.put(
+    [
+        "/resource/:resourceId/mtls/certificate",
+        "/public-resource/:resourceId/mtls/certificate"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
+    resource.createResourceMtlsCertificate
+);
+
+authenticated.get(
+    [
+        "/resource/:resourceId/mtls/certificates",
+        "/public-resource/:resourceId/mtls/certificates"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResourceMtlsCertificates),
+    resource.listResourceMtlsCertificates
+);
+
+authenticated.delete(
+    [
+        "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
+        "/public-resource/:resourceId/mtls/certificate/:mtlsCertificateId"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
+    resource.deleteResourceMtlsCertificate
+);
+
 authenticated.get(
     "/target/:targetId",
     verifyApiKeyTargetAccess,
@@ -1884,3 +1918,53 @@ authenticated.delete(
     logActionAudit(ActionsEnum.deleteRedirect),
     redirect.deleteRedirect
 );
+
+authenticated.get(
+    "/org/:orgId/labels",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listOrgLabels),
+    labels.listOrgLabels
+);
+
+authenticated.post(
+    "/org/:orgId/labels",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createOrgLabel),
+    logActionAudit(ActionsEnum.createOrgLabel),
+    labels.createOrgLabel
+);
+
+authenticated.patch(
+    "/org/:orgId/label/:labelId",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.updateOrgLabel),
+    logActionAudit(ActionsEnum.updateOrgLabel),
+    labels.updateOrgLabel
+);
+
+authenticated.delete(
+    "/org/:orgId/label/:labelId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteOrgLabel),
+    logActionAudit(ActionsEnum.deleteOrgLabel),
+    labels.deleteOrgLabel
+);
+
+authenticated.put(
+    "/org/:orgId/label/:labelId/attach",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.attachLabelToItem),
+    logActionAudit(ActionsEnum.attachLabelToItem),
+    labels.attachLabelToItem
+);
+
+authenticated.put(
+    "/org/:orgId/label/:labelId/detach",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.detachLabelFromItem),
+    logActionAudit(ActionsEnum.detachLabelFromItem),
+    labels.detachLabelFromItem
+);

server/routers/labels/attachLabelToItem.ts

@@ -12,6 +12,7 @@ import {
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, isNull } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -31,6 +32,40 @@ const attachLabelBodySchema = z.strictObject({
     clientId: z.number().int().optional()
 });
 
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/label/{labelId}/attach",
+    description:
+        "Attach a label to a site, public resource, private resource or client.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: attachLabelBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function attachLabelToItem(
     req: Request,
     res: Response,

server/routers/labels/createOrgLabel.ts

@@ -9,6 +9,7 @@ import {
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -30,6 +31,39 @@ const bodySchema = z.strictObject({
     resourceId: z.number().int().optional()
 });
 
+registry.registerPath({
+    method: "post",
+    path: "/org/{orgId}/labels",
+    description: "Create a label in an organization.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function createOrgLabel(
     req: Request,
     res: Response,

server/routers/labels/deleteOrgLabel.ts

@@ -1,6 +1,7 @@
 import { db, labels } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -13,6 +14,32 @@ const paramsSchema = z.strictObject({
     labelId: z.string().transform(Number).pipe(z.int().positive())
 });
 
+registry.registerPath({
+    method: "delete",
+    path: "/org/{orgId}/label/{labelId}",
+    description: "Delete a label.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function deleteOrgLabel(
     req: Request,
     res: Response,

server/routers/labels/detachLabelFromItem.ts

@@ -12,6 +12,7 @@ import {
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, isNull } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -31,6 +32,40 @@ const detachLabelBodySchema = z.strictObject({
     clientId: z.number().int().optional()
 });
 
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/label/{labelId}/detach",
+    description:
+        "Detach a label from a site, public resource, private resource or client.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: detachLabelBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function detachLabelFromItem(
     req: Request,
     res: Response,

server/routers/labels/listOrgLabels.ts

@@ -2,6 +2,7 @@ import { db, labels } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, asc, eq, like, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -51,6 +52,33 @@ function queryLabelsBase() {
         .from(labels);
 }
 
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/labels",
+    description: "List labels in an organization.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        query: listLabelsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listOrgLabels(
     req: Request,
     res: Response,

server/routers/labels/updateOrgLabel.ts

@@ -2,6 +2,7 @@ import { db, labels } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, ne, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -22,6 +23,39 @@ const updateLabelBodySchema = z.strictObject({
         .nonempty()
 });
 
+registry.registerPath({
+    method: "patch",
+    path: "/org/{orgId}/label/{labelId}",
+    description: "Update a label.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateLabelBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function updateOrgLabel(
     req: Request,
     res: Response,

server/routers/launcher/formatLauncherAccess.ts

@@ -125,6 +125,16 @@ export function formatPublicResourceAccess(
 export function formatSiteResourceAccess(
     resource: SiteResourceAccessInput
 ): LauncherAccessFields {
+    // Exit node (gateway) destinations are always 0.0.0.0/0 — not useful to
+    // show or copy. The launcher UI renders a localized capability label.
+    if (resource.mode === "gateway") {
+        return {
+            accessDisplay: "",
+            accessCopyValue: "",
+            accessUrl: null
+        };
+    }
+
     if (
         (resource.mode === "http" || resource.mode === "inference") &&
         resource.fullDomain

server/routers/newt/buildConfiguration.ts

@@ -24,6 +24,10 @@ import {
     generateSubnetProxyTargetV2,
     SubnetProxyTargetV2
 } from "@server/lib/ip";
+import {
+    ClientIdentity,
+    getClientIdentities
+} from "@server/lib/clientIdentities";
 
 export async function buildClientConfigurationForNewtClient(
     site: Site,
@@ -96,7 +100,10 @@ export async function buildClientConfigurationForNewtClient(
                         await updatePeer(client.clients.clientId, {
                             siteId: site.siteId,
                             endpoint: site.endpoint!,
-                            relayEndpoint: `${exitNode.endpoint}:${config.getRawConfig().gerbil.clients_start_port}`,
+                            relayEndpoint: formatEndpoint(
+                                exitNode.endpoint,
+                                exitNode.relayPort
+                            ),
                             publicKey: site.publicKey!,
                             serverIP: site.address,
                             serverPort: site.listenPort
@@ -121,6 +128,7 @@ export async function buildClientConfigurationForNewtClient(
                                 siteId,
                                 exitNode: {
                                     publicKey: exitNode.publicKey,
+                                    relayPort: exitNode.relayPort,
                                     endpoint: exitNode.endpoint
                                 }
                             }
@@ -162,7 +170,8 @@ export async function buildClientConfigurationForNewtClient(
     if (allSiteResources.length === 0) {
         return {
             peers: validPeers,
-            targets: targetsToSend
+            targets: targetsToSend,
+            clientIdentities: [] as ClientIdentity[]
         };
     }
 
@@ -230,9 +239,26 @@ export async function buildClientConfigurationForNewtClient(
         }
     }
 
+    // Only clients that can reach an HTTP resource ever hit newt's HTTP proxy,
+    // so those are the only identities it needs to set Remote-* headers.
+    const httpClientIds = new Set<number>();
+    for (const resource of allSiteResources) {
+        if (resource.mode !== "http") {
+            continue;
+        }
+        for (const c of clientsByResourceId.get(resource.siteResourceId) ??
+            []) {
+            httpClientIds.add(c.clientId);
+        }
+    }
+    const clientIdentities = Array.from(
+        (await getClientIdentities(httpClientIds)).values()
+    );
+
     return {
         peers: validPeers,
-        targets: targetsToSend
+        targets: targetsToSend,
+        clientIdentities
     };
 }
 

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -12,7 +12,6 @@ import {
     supportsCertReferences
 } from "@server/lib/clientVersionChecks";
 import { dedupeCertsForTargets } from "@server/lib/ip";
-import config from "@server/lib/config";
 import { waitForSiteRebuildIdle } from "@server/lib/rebuildClientAssociations";
 
 export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
@@ -61,7 +60,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
 
     if (existingSite.lastHolePunch && now - existingSite.lastHolePunch > 12) {
         logger.warn(
-            `Site last hole punch is too old; skipping this register. The site is failing to hole punch and identify its network address with the server. Can the site reach the server on UDP port ${config.getRawConfig().gerbil.clients_start_port}?`
+            `Site last hole punch is too old; skipping this register. The site is failing to hole punch and identify its network address with the server. Can the site reach the server on its Relay UDP port?`
         );
         return;
     }
@@ -118,10 +117,8 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         }
     }
 
-    const { peers, targets } = await buildClientConfigurationForNewtClient(
-        site,
-        exitNode
-    );
+    const { peers, targets, clientIdentities } =
+        await buildClientConfigurationForNewtClient(site, exitNode);
 
     // Older newt clients only understand inline tlsCert/tlsKey on each
     // target, so only switch to certId references once we know the client
@@ -145,6 +142,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
                 peers,
                 targets: targetsToSend,
                 certs,
+                clientIdentities,
                 chainId: chainId
             }
         },

server/routers/newt/handleNewtRegisterMessage.ts

@@ -15,6 +15,7 @@ import { fetchContainers } from "./dockerSocket";
 import { buildTargetConfigurationForNewtClient } from "./buildConfiguration";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import { NewtErrorCodes, sendNewtError } from "./error";
+import { formatEndpoint } from "@server/lib/ip";
 
 export const handleNewtRegisterMessage: MessageHandler = async (context) => {
     const { message, client, sendToClient } = context;
@@ -224,7 +225,7 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
         message: {
             type: "newt/wg/connect",
             data: {
-                endpoint: `${exitNode.endpoint}:${exitNode.listenPort}`,
+                endpoint: formatEndpoint(exitNode.endpoint, exitNode.listenPort),
                 relayPort: config.getRawConfig().gerbil.clients_start_port,
                 publicKey: exitNode.publicKey,
                 serverIP: exitNode.address.split("/")[0],

server/routers/newt/offlineChecker.ts

@@ -3,12 +3,10 @@ import { hasActiveConnections } from "#dynamic/routers/ws";
 import { eq, lt, isNull, and, or, ne, not, inArray } from "drizzle-orm";
 import logger from "@server/logger";
 import { fireSiteOfflineAlert, fireSiteOnlineAlert } from "@server/lib/alerts";
+import { getOfflineThresholds } from "#dynamic/lib/offlineThresholds";
 
 // Track if the offline checker interval is running
 let offlineCheckerInterval: NodeJS.Timeout | null = null;
-const OFFLINE_CHECK_INTERVAL = 30 * 1000; // Check every 30 seconds
-const OFFLINE_THRESHOLD_MS = 2 * 60 * 1000; // 2 minutes
-const OFFLINE_THRESHOLD_BANDWIDTH_MS = 8 * 60 * 1000; // 8 minutes
 
 /**
  * Starts the background interval that checks for newt sites that haven't
@@ -24,8 +22,9 @@ export const startNewtOfflineChecker = (): void => {
 
     offlineCheckerInterval = setInterval(async () => {
         try {
-            const twoMinutesAgo = Math.floor(
-                (Date.now() - OFFLINE_THRESHOLD_MS) / 1000
+            const thresholds = getOfflineThresholds();
+            const offlineBefore = Math.floor(
+                (Date.now() - thresholds.newtMs) / 1000
             );
 
             // Find all online newt-type sites that haven't pinged recently
@@ -46,7 +45,7 @@ export const startNewtOfflineChecker = (): void => {
                         eq(sites.online, true),
                         eq(sites.type, "newt"),
                         or(
-                            lt(sites.lastPing, twoMinutesAgo),
+                            lt(sites.lastPing, offlineBefore),
                             isNull(sites.lastPing)
                         )
                     )
@@ -105,7 +104,7 @@ export const startNewtOfflineChecker = (): void => {
                 );
 
             const wireguardOfflineThreshold = Math.floor(
-                (Date.now() - OFFLINE_THRESHOLD_BANDWIDTH_MS) / 1000
+                (Date.now() - thresholds.newtWireguardMs) / 1000
             );
 
             // loop over each one. If its offline and there is a new update then mark it online. If its online and there is no update then mark it offline
@@ -117,7 +116,7 @@ export const startNewtOfflineChecker = (): void => {
                     site.online
                 ) {
                     logger.info(
-                        `Marking wireguard site ${site.siteId} offline: no bandwidth update in over ${OFFLINE_THRESHOLD_BANDWIDTH_MS / 60000} minutes`
+                        `Marking wireguard site ${site.siteId} offline: no bandwidth update in over ${thresholds.newtWireguardMs / 1000} seconds`
                     );
 
                     await db.transaction(async (trx) => {
@@ -161,7 +160,7 @@ export const startNewtOfflineChecker = (): void => {
         } catch (error) {
             logger.error("Error in newt offline checker interval", { error });
         }
-    }, OFFLINE_CHECK_INTERVAL);
+    }, getOfflineThresholds().checkIntervalMs);
 
     logger.debug("Started newt offline checker interval");
 };

server/routers/newt/peers.ts

@@ -127,6 +127,40 @@ export async function deletePeersBatch(
     logger.info(`Deleted ${peers.length} peer(s) from newts (batch)`);
 }
 
+export async function updatePeersBatch(
+    peers: {
+        siteId: number;
+        publicKey: string;
+        newtId: string;
+        peer: {
+            allowedIps?: string[];
+            endpoint?: string;
+        };
+    }[]
+) {
+    if (peers.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(
+        peers.map((peer) => ({
+            clientId: peer.newtId,
+            message: {
+                type: "newt/wg/peer/update",
+                data: {
+                    publicKey: peer.publicKey,
+                    ...peer.peer
+                }
+            },
+            options: { incrementConfigVersion: true }
+        }))
+    ).catch((error) => {
+        logger.warn(`Error sending batched newt peer updates:`, error);
+    });
+
+    logger.info(`Updated ${peers.length} peer(s) on newts (batch)`);
+}
+
 export async function updatePeer(
     siteId: number,
     publicKey: string,

server/routers/newt/sync.ts

@@ -28,10 +28,8 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
             .where(eq(exitNodes.exitNodeId, site.exitNodeId))
             .limit(1);
     }
-    const { peers, targets } = await buildClientConfigurationForNewtClient(
-        site,
-        exitNode
-    );
+    const { peers, targets, clientIdentities } =
+        await buildClientConfigurationForNewtClient(site, exitNode);
 
     // Older newt clients only understand inline tlsCert/tlsKey on each
     // target, so only switch to certId references once we know the client
@@ -55,6 +53,7 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
                 peers: peers,
                 clientTargets: clientTargets,
                 certs: certs,
+                clientIdentities: clientIdentities,
                 browserGatewayTargets: browserGatewayTargets,
                 remoteExitNodeSubnets: remoteExitNodeSubnets
             }

server/routers/newt/targets.ts

@@ -4,6 +4,7 @@ import logger from "@server/logger";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import { decrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
+import { formatEndpoint } from "@server/lib/ip";
 
 export async function addTargets(
     newtId: string,
@@ -14,9 +15,7 @@ export async function addTargets(
 ) {
     //create a list of udp and tcp targets
     const payloadTargets = targets.map((target) => {
-        return `${target.internalPort ? target.internalPort + ":" : ""}${
-            target.ip
-        }:${target.port}`;
+        return `${target.internalPort ? target.internalPort + ":" : ""}${formatEndpoint(target.ip, target.port)}`;
     });
 
     if (payloadTargets.length > 0) {
@@ -208,9 +207,7 @@ export async function removeTargets(
 ) {
     //create a list of udp and tcp targets
     const payloadTargets = targets.map((target) => {
-        return `${target.internalPort ? target.internalPort + ":" : ""}${
-            target.ip
-        }:${target.port}`;
+        return `${target.internalPort ? target.internalPort + ":" : ""}${formatEndpoint(target.ip, target.port)}`;
     });
 
     if (payloadTargets.length > 0) {

server/routers/olm/batchUtils.ts

@@ -0,0 +1,55 @@
+// Shared parsing for the olm relay/unrelay/local/unlocal websocket messages, which accept
+// either a single siteId or a batched siteIds array (with a parallel chainIds array), so
+// olm clients with many sites can coalesce decisions into one message instead of sending
+// one message per site. Older olm clients that only ever send the singular form are handled
+// identically to a batch of one, and the reply mirrors whichever form the request used.
+
+import { db, newts } from "@server/db";
+import { inArray } from "drizzle-orm";
+
+// Resolves the newtId for each of the given siteIds in a single query, for batching the
+// resulting newt/wg/peer/update pushes instead of looking each one up individually.
+export async function resolveNewtIdsBySite(
+    siteIds: number[]
+): Promise<Map<number, string>> {
+    if (siteIds.length === 0) {
+        return new Map();
+    }
+
+    const rows = await db
+        .select({ siteId: newts.siteId, newtId: newts.newtId })
+        .from(newts)
+        .where(inArray(newts.siteId, siteIds));
+
+    const map = new Map<number, string>();
+    for (const row of rows) {
+        if (row.siteId != null) {
+            map.set(row.siteId, row.newtId);
+        }
+    }
+    return map;
+}
+
+export type SiteChainBatch = {
+    siteIds: number[];
+    chainIds: (string | undefined)[];
+    isBatch: boolean;
+};
+
+export function parseSiteChainBatch(data: any): SiteChainBatch {
+    if (Array.isArray(data?.siteIds)) {
+        const siteIds: number[] = data.siteIds;
+        const chainIds: (string | undefined)[] =
+            Array.isArray(data.chainIds) &&
+            data.chainIds.length === siteIds.length
+                ? data.chainIds
+                : siteIds.map(() => data.chainId);
+        return { siteIds, chainIds, isBatch: true };
+    }
+
+    return {
+        siteIds: data?.siteId !== undefined ? [data.siteId] : [],
+        chainIds: [data?.chainId],
+        isBatch: false
+    };
+}

server/routers/olm/buildConfiguration.ts

@@ -18,7 +18,6 @@ import {
 import logger from "@server/logger";
 import { and, eq, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../newt/peers";
-import config from "@server/lib/config";
 import { SiR } from "react-icons/si";
 
 export async function buildSiteConfigurationForOlmClient(
@@ -129,7 +128,6 @@ export async function buildSiteConfigurationForOlmClient(
         }
     }
 
-    const clientsStartPort = config.getRawConfig().gerbil.clients_start_port;
     const peerOps: Promise<unknown>[] = [];
 
     // Process each site
@@ -216,7 +214,7 @@ export async function buildSiteConfigurationForOlmClient(
                 logger.warn(`Exit node not found for site ${site.siteId}`);
                 continue;
             }
-            relayEndpoint = `${exitNode.endpoint}:${clientsStartPort}`;
+            relayEndpoint = `${exitNode.endpoint}:${exitNode.relayPort}`;
         }
 
         // Add site configuration to the array
@@ -231,7 +229,7 @@ export async function buildSiteConfigurationForOlmClient(
             publicKey: site.publicKey,
             serverIP: site.address,
             serverPort: site.listenPort,
-            remoteSubnets: generateRemoteSubnets(allSiteResources),
+            remoteSubnets: generateRemoteSubnets(allSiteResources), // we dont add the gateway resources here
             aliases: generateAliasConfig(allSiteResources)
         });
     }

server/routers/olm/error.ts

@@ -1,7 +1,4 @@
 import { sendToClient } from "#dynamic/routers/ws";
-import config from "@server/lib/config";
-
-const udpPort = config.getRawConfig().gerbil.clients_start_port;
 
 // Error codes for registration failures
 export const OlmErrorCodes = {
@@ -93,7 +90,7 @@ export const OlmErrorCodes = {
     },
     HOLEPUNCH_MISSING: {
         code: "HOLEPUNCH_MISSING",
-        message: `Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port ${udpPort} and try registering again.`
+        message: `Unable to coordinate client P2P connection. Please ensure your client can reach the server on its relay UDP port and try registering again.`
     },
     NO_AVAILABLE_SUBNET: {
         code: "NO_AVAILABLE_SUBNET",

server/routers/olm/gateway.ts

@@ -0,0 +1,82 @@
+import { sendToClientsBatch } from "#dynamic/routers/ws";
+import { db, olms } from "@server/db";
+import { canCompress } from "@server/lib/clientVersionChecks";
+import logger from "@server/logger";
+import { inArray } from "drizzle-orm";
+
+// The olm only tracks which gateway (exit node) site resource it selected, by
+// its numeric siteResourceId, and the site IDs that resource currently
+// resolves to. So all the server has to push is what changed for that one
+// resource; the olm ignores a message whose siteResourceId isn't the one it
+// selected, which stops a site added to some other gateway resource from
+// being pulled into the client's gateway set. (Creates aren't pushed: a
+// client has to select a gateway resource before it can be using it.)
+
+async function sendGatewayMessageToClients(
+    clientIds: number[],
+    type: string,
+    data: Record<string, unknown>
+): Promise<void> {
+    const uniqueClientIds = Array.from(new Set(clientIds));
+    if (uniqueClientIds.length === 0) {
+        return;
+    }
+
+    const olmRows = await db
+        .select({
+            olmId: olms.olmId,
+            version: olms.version
+        })
+        .from(olms)
+        .where(inArray(olms.clientId, uniqueClientIds));
+
+    const payloads = olmRows.map((olm) => ({
+        clientId: olm.olmId,
+        message: { type, data },
+        options: {
+            compress: canCompress(olm.version, "olm"),
+            incrementConfigVersion: true
+        }
+    }));
+
+    if (payloads.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(payloads).catch((error) => {
+        logger.error(`Error sending ${type} messages to olms:`, error);
+    });
+}
+
+// Tells the olms of the given clients that sites were added to / removed from
+// the gateway site resource, so those that selected it can adjust the set of
+// sites they use as the gateway.
+export async function sendGatewaySitesUpdate(
+    clientIds: number[],
+    siteResourceId: number,
+    addedSiteIds: number[],
+    removedSiteIds: number[]
+): Promise<void> {
+    if (addedSiteIds.length === 0 && removedSiteIds.length === 0) {
+        return;
+    }
+
+    await sendGatewayMessageToClients(
+        clientIds,
+        "olm/wg/gateway/sites/update",
+        { siteResourceId, addedSiteIds, removedSiteIds }
+    );
+}
+
+// Tells the olms of the given clients that the gateway site resource can no
+// longer be used as a gateway (it was deleted, disabled, changed to another
+// mode, or the client lost access to it), so those that selected it drop out
+// of gateway mode.
+export async function sendGatewayDisable(
+    clientIds: number[],
+    siteResourceId: number
+): Promise<void> {
+    await sendGatewayMessageToClients(clientIds, "olm/wg/gateway/disable", {
+        siteResourceId
+    });
+}

server/routers/olm/getOlmToken.ts

@@ -8,7 +8,8 @@ import {
     ExitNode,
     exitNodes,
     sites,
-    clientSitesAssociationsCache
+    clientSitesAssociationsCache,
+    orgs
 } from "@server/db";
 import { olms } from "@server/db";
 import HttpCode from "@server/types/HttpCode";
@@ -97,13 +98,13 @@ export async function getOlmToken(
                 await validateSessionToken(userToken);
             if (!userSession || !user) {
                 return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid user token")
+                    createHttpError(HttpCode.UNAUTHORIZED, "Invalid user token")
                 );
             }
             if (user.userId !== existingOlm.userId) {
                 return next(
                     createHttpError(
-                        HttpCode.BAD_REQUEST,
+                        HttpCode.UNAUTHORIZED,
                         "User token does not match olm"
                     )
                 );
@@ -225,7 +226,23 @@ export async function getOlmToken(
             )
             .where(eq(clientSitesAssociationsCache.clientId, clientIdToUse!));
 
-        if (clientSites.length > 250 && build == "saas") {
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgIdToUse))
+            .limit(1);
+
+        if (!org) {
+            logger.warn(`Client ${clientIdToUse} org not found`);
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Client's org not found"
+                )
+            );
+        }
+
+        if (clientSites.length > org.settingsJitModeLimit && build == "saas") {
             // set all of the cache rows isJitMode to true
             await db
                 .update(clientSitesAssociationsCache)
@@ -272,7 +289,7 @@ export async function getOlmToken(
         let exitNodesHpData = allExitNodes.map((exitNode: ExitNode) => {
             return {
                 publicKey: exitNode.publicKey,
-                relayPort: config.getRawConfig().gerbil.clients_start_port,
+                relayPort: exitNode.relayPort,
                 endpoint: exitNode.endpoint,
                 siteIds: exitNodeIdToSiteIds[exitNode.exitNodeId] ?? []
             };
@@ -330,8 +347,7 @@ export async function getOlmToken(
                 exitNodesHpData = [
                     {
                         publicKey: best.publicKey,
-                        relayPort:
-                            config.getRawConfig().gerbil.clients_start_port,
+                        relayPort: best.relayPort,
                         endpoint: best.endpoint,
                         siteIds: []
                         // it should still HP without the site ids but it will get stuck in the client

server/routers/olm/handleOlmLocalMessage.ts

@@ -1,9 +1,10 @@
 import { db, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmLocalMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -40,33 +41,82 @@ export const handleOlmLocalMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site || !site.exitNodeId) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Local message has no siteId(s)");
         return;
     }
 
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the newt knows to accept local
+    // Get the sites
+    const siteRows = await db
+        .select()
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
+
+    const valid: { siteId: number; chainId?: string }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site || !site.exitNodeId) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        valid.push({ siteId, chainId: chainIds[i] });
+    }
+
+    if (valid.length === 0) {
+        return;
+    }
+
+    // Only ack sites we can actually tell their newt to accept local
+    const newtIdBySiteId = await resolveNewtIdsBySite(valid.map((v) => v.siteId));
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt to accept local
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: "" } // this removes the endpoint so the newt knows to accept local
+        }))
+    );
+
     // Just ack the message, we don't keep sending it
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/local",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/local",
-            data: {
-                siteId: siteId,
-                chainId
-            }
+            data: { siteId: single.siteId, chainId: single.chainId }
         },
         broadcast: false,
         excludeSender: false

server/routers/olm/handleOlmPingMessage.ts

@@ -1,4 +1,4 @@
-import { getClientConfigVersion } from "#dynamic/routers/ws";
+import { disconnectClient, getClientConfigVersion } from "#dynamic/routers/ws";
 import { db } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, Olm } from "@server/db";
@@ -11,6 +11,29 @@ import { encodeHexLowerCase } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { sendOlmSyncMessage } from "./sync";
 import { handleFingerprintInsertion } from "./fingerprintingUtils";
+import { sendTerminateClient } from "../client/terminate";
+import { OlmErrorCodes } from "./error";
+
+type OlmErrorCode = (typeof OlmErrorCodes)[keyof typeof OlmErrorCodes];
+
+/**
+ * Tells the olm why it is being kicked, then closes its websocket so it
+ * does not linger connected until the offline checker notices.
+ */
+async function terminateOlm(
+    clientId: number,
+    olmId: string,
+    error: OlmErrorCode
+) {
+    try {
+        await sendTerminateClient(clientId, error, olmId);
+        // wait a moment to ensure the message is sent
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+        await disconnectClient(olmId);
+    } catch (err) {
+        logger.error(`Error terminating olm ${olmId}`, { error: err });
+    }
+}
 
 /**
  * Handles ping messages from clients and responds with pong
@@ -60,14 +83,29 @@ export const handleOlmPingMessage: MessageHandler = async (context) => {
                 await validateSessionToken(userToken);
             if (!userSession || !user) {
                 logger.warn("Invalid user session for olm ping");
-                return; // by returning here we just ignore the ping and the setInterval will force it to disconnect
+                await terminateOlm(
+                    client.clientId,
+                    olm.olmId,
+                    OlmErrorCodes.INVALID_USER_SESSION
+                );
+                return;
             }
             if (user.userId !== olm.userId) {
                 logger.warn("User ID mismatch for olm ping");
+                await terminateOlm(
+                    client.clientId,
+                    olm.olmId,
+                    OlmErrorCodes.USER_ID_MISMATCH
+                );
                 return;
             }
             if (user.userId !== client.userId) {
                 logger.warn("Client user ID mismatch for olm ping");
+                await terminateOlm(
+                    client.clientId,
+                    olm.olmId,
+                    OlmErrorCodes.USER_ID_MISMATCH
+                );
                 return;
             }
 
@@ -85,6 +123,18 @@ export const handleOlmPingMessage: MessageHandler = async (context) => {
                 logger.warn(
                     `Olm user ${olm.userId} does not pass access policies for org ${client.orgId}: ${policyCheck.error}`
                 );
+                let error: OlmErrorCode =
+                    OlmErrorCodes.ORG_ACCESS_POLICY_DENIED;
+                if (policyCheck.policies?.passwordAge?.compliant === false) {
+                    error = OlmErrorCodes.ORG_ACCESS_POLICY_PASSWORD_EXPIRED;
+                } else if (
+                    policyCheck.policies?.maxSessionLength?.compliant === false
+                ) {
+                    error = OlmErrorCodes.ORG_ACCESS_POLICY_SESSION_EXPIRED;
+                } else if (policyCheck.policies?.requiredTwoFactor === false) {
+                    error = OlmErrorCodes.ORG_ACCESS_POLICY_2FA_REQUIRED;
+                }
+                await terminateOlm(client.clientId, olm.olmId, error);
                 return;
             }
         }

server/routers/olm/handleOlmRegisterMessage.ts

@@ -20,7 +20,6 @@ import { OlmErrorCodes, sendOlmError } from "./error";
 import { handleFingerprintInsertion } from "./fingerprintingUtils";
 import { build } from "@server/build";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import config from "@server/lib/config";
 import cache from "#dynamic/lib/cache"; // not using regional here because we need this in the register message handler before we know where the client is
 import { waitForClientRebuildIdle } from "@server/lib/rebuildClientAssociations";
 import {
@@ -30,6 +29,7 @@ import {
 } from "#dynamic/lib/exitNodes";
 import { getUniqueSubnetForExitNode } from "@server/lib/exitNodes";
 import { addPeer, deletePeer } from "../gerbil/peers";
+import { formatEndpoint } from "@server/lib/ip";
 
 const HOLEPUNCH_STALE_CHAIN_THRESHOLD = 18;
 const HOLEPUNCH_STALE_CHAIN_TTL_SECONDS = 1800;
@@ -277,7 +277,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
     );
 
     let jitMode = false;
-    if (sitesCount > 250 && build == "saas") {
+    if (sitesCount > org.settingsJitModeLimit && build == "saas") {
         // THIS IS THE MAX ON THE BUSINESS TIER
         // we have too many sites
         // If we have too many sites we need to drop into fully JIT mode by not sending any of the sites
@@ -437,7 +437,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
     // TODO: I still think there is a better way to do this rather than locking it out here but ???
     if (now - (client.lastHolePunch || 0) > 12 && sitesCount > 0) {
         logger.warn(
-            `[handleOlmRegisterMessage] Client last hole punch is too old and we have sites to send; skipping this register. The client is failing to hole punch and identify its network address with the server. Can the client reach the server on UDP port ${config.getRawConfig().gerbil.clients_start_port}?`,
+            `[handleOlmRegisterMessage] Client last hole punch is too old and we have sites to send; skipping this register. The client is failing to hole punch and identify its network address with the server. Can the client reach the server on its relay UDP port?`,
             { orgId: client.orgId, clientId: client.clientId }
         );
 
@@ -508,7 +508,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
                         ? {
                               aliases: exitNodeAliases,
                               connect: exitNodeAliases.length > 0, // we do not need to connect to the exit node if we do not have inference resources and right now all site resources on the exit node have an alias
-                              endpoint: `${exitNode.endpoint}:${exitNode.listenPort}`,
+                              endpoint: formatEndpoint(exitNode.endpoint, exitNode.listenPort),
                               publicKey: exitNode.publicKey,
                               serverIP: exitNode.address.split("/")[0],
                               tunnelIP: `${clientSubnet.split("/")[0]}/${exitNode.address.split("/")[1]}` // we need to use the exit node's subnet mask here because the client will be using the exit node's subnet mask for its routing table so we can address it

server/routers/olm/handleOlmRelayMessage.ts

@@ -1,10 +1,10 @@
 import { db, exitNodes, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { and, eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
-import config from "@server/lib/config";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmRelayMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -41,29 +41,68 @@ export const handleOlmRelayMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site || !site.exitNodeId) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Relay message has no siteId(s)");
         return;
     }
 
-    // get the site's exit node
-    const [exitNode] = await db
+    // Get the sites
+    const siteRows = await db
         .select()
-        .from(exitNodes)
-        .where(eq(exitNodes.exitNodeId, site.exitNodeId))
-        .limit(1);
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
 
-    if (!exitNode) {
-        logger.warn("Exit node not found for site");
+    const exitNodeIds = [
+        ...new Set(
+            siteRows
+                .map((s) => s.exitNodeId)
+                .filter((id): id is number => id != null)
+        )
+    ];
+
+    // Get the sites' exit nodes
+    const exitNodeRows = exitNodeIds.length
+        ? await db
+              .select()
+              .from(exitNodes)
+              .where(inArray(exitNodes.exitNodeId, exitNodeIds))
+        : [];
+    const exitNodesById = new Map(exitNodeRows.map((e) => [e.exitNodeId, e]));
+
+    const valid: {
+        siteId: number;
+        chainId?: string;
+        relayEndpoint: string;
+        relayPort: number;
+    }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site || !site.exitNodeId) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        const exitNode = exitNodesById.get(site.exitNodeId);
+        if (!exitNode) {
+            logger.warn(`Exit node not found for site ${siteId}`);
+            continue;
+        }
+
+        valid.push({
+            siteId,
+            chainId: chainIds[i],
+            relayEndpoint: exitNode.endpoint,
+            relayPort: exitNode.relayPort
+        });
+    }
+
+    if (valid.length === 0) {
         return;
     }
 
@@ -75,23 +114,64 @@ export const handleOlmRelayMessage: MessageHandler = async (context) => {
         .where(
             and(
                 eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                eq(clientSitesAssociationsCache.siteId, siteId)
+                inArray(
+                    clientSitesAssociationsCache.siteId,
+                    valid.map((v) => v.siteId)
+                )
             )
         );
 
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the newt knows to relay
+    // Only ack sites we can actually tell their newt to relay for
+    const newtIdBySiteId = await resolveNewtIdsBySite(
+        valid.map((v) => v.siteId)
+    );
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt so it knows to relay
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: "" } // this removes the endpoint so the newt knows to relay
+        }))
+    );
+
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/relay",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    relayEndpoints: pushable.map((v) => v.relayEndpoint),
+                    relayPort: pushable.map((v) => v.relayPort),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/relay",
             data: {
-                siteId: siteId,
-                relayEndpoint: exitNode.endpoint,
-                relayPort: config.getRawConfig().gerbil.clients_start_port,
-                chainId
+                siteId: single.siteId,
+                relayEndpoint: single.relayEndpoint,
+                relayPort: single.relayPort,
+                chainId: single.chainId
             }
         },
         broadcast: false,

server/routers/olm/handleOlmServerInitAddPeerHandshake.ts

@@ -97,6 +97,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
             logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Multiple resources found matching the criteria`
             );
+            await sendCancel();
             return;
         }
 
@@ -216,6 +217,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
                 siteId: site.siteId,
                 exitNode: {
                     publicKey: exitNode.publicKey,
+                    relayPort: exitNode.relayPort,
                     endpoint: exitNode.endpoint
                 }
             },

server/routers/olm/handleOlmUnLocalMessage.ts

@@ -1,9 +1,10 @@
-import { db, exitNodes, sites } from "@server/db";
+import { db, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { and, eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmUnLocalMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -40,54 +41,111 @@ export const handleOlmUnLocalMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Unlocal message has no siteId(s)");
         return;
     }
 
-    const [clientSiteAssociation] = await db
+    // Get the sites
+    const siteRows = await db
+        .select()
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
+
+    const assocRows = await db
         .select()
         .from(clientSitesAssociationsCache)
         .where(
             and(
                 eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                eq(clientSitesAssociationsCache.siteId, siteId)
+                inArray(clientSitesAssociationsCache.siteId, siteIds)
             )
         );
+    const assocBySiteId = new Map(assocRows.map((a) => [a.siteId, a]));
 
-    if (!clientSiteAssociation) {
-        logger.warn("Client-Site association not found");
+    const valid: { siteId: number; chainId?: string; endpoint: string }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        const clientSiteAssociation = assocBySiteId.get(siteId);
+        if (!clientSiteAssociation) {
+            logger.warn(`Client-Site association not found for site ${siteId}`);
+            continue;
+        }
+
+        if (!clientSiteAssociation.endpoint) {
+            logger.warn(
+                `Client-Site association has no endpoint, cannot unrelay site ${siteId}`
+            );
+            continue;
+        }
+
+        valid.push({
+            siteId,
+            chainId: chainIds[i],
+            endpoint: clientSiteAssociation.isRelayed
+                ? ""
+                : clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+        });
+    }
+
+    if (valid.length === 0) {
         return;
     }
 
-    if (!clientSiteAssociation.endpoint) {
-        logger.warn("Client-Site association has no endpoint, cannot unrelay");
-        return;
-    }
-
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.isRelayed
-            ? ""
-            : clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+    // Only ack sites we can actually push to their newt
+    const newtIdBySiteId = await resolveNewtIdsBySite(valid.map((v) => v.siteId));
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: v.endpoint }
+        }))
+    );
+
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/unlocal",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/unlocal",
-            data: {
-                siteId: siteId,
-                chainId
-            }
+            data: { siteId: single.siteId, chainId: single.chainId }
         },
         broadcast: false,
         excludeSender: false

server/routers/olm/handleOlmUnRelayMessage.ts

@@ -1,9 +1,10 @@
 import { db, exitNodes, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { and, eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -40,21 +41,21 @@ export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Unrelay message has no siteId(s)");
         return;
     }
 
-    const [clientSiteAssociation] = await db
+    // Get the sites
+    const siteRows = await db
+        .select()
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
+
+    const assocRows = await db
         .update(clientSitesAssociationsCache)
         .set({
             isRelayed: false
@@ -62,33 +63,100 @@ export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
         .where(
             and(
                 eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                eq(clientSitesAssociationsCache.siteId, siteId)
+                inArray(clientSitesAssociationsCache.siteId, siteIds)
             )
         )
         .returning();
+    const assocBySiteId = new Map(assocRows.map((a) => [a.siteId, a]));
 
-    if (!clientSiteAssociation) {
-        logger.warn("Client-Site association not found");
+    const valid: {
+        siteId: number;
+        chainId?: string;
+        endpoint: string;
+        clientEndpoint: string;
+    }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        const clientSiteAssociation = assocBySiteId.get(siteId);
+        if (!clientSiteAssociation) {
+            logger.warn(`Client-Site association not found for site ${siteId}`);
+            continue;
+        }
+
+        if (!clientSiteAssociation.endpoint) {
+            logger.warn(
+                `Client-Site association has no endpoint, cannot unrelay site ${siteId}`
+            );
+            continue;
+        }
+
+        valid.push({
+            siteId,
+            chainId: chainIds[i],
+            endpoint: site.endpoint ?? "",
+            clientEndpoint: clientSiteAssociation.endpoint
+        });
+    }
+
+    if (valid.length === 0) {
         return;
     }
 
-    if (!clientSiteAssociation.endpoint) {
-        logger.warn("Client-Site association has no endpoint, cannot unrelay");
-        return;
-    }
-
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+    // Only ack sites we can actually tell their newt to connect directly
+    const newtIdBySiteId = await resolveNewtIdsBySite(valid.map((v) => v.siteId));
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt to connect directly to the client
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: v.clientEndpoint } // this is the endpoint of the client to connect directly to the newt
+        }))
+    );
+
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/unrelay",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    endpoints: pushable.map((v) => v.endpoint),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/unrelay",
             data: {
-                siteId: siteId,
-                endpoint: site.endpoint,
-                chainId
+                siteId: single.siteId,
+                endpoint: single.endpoint,
+                chainId: single.chainId
             }
         },
         broadcast: false,

server/routers/olm/offlineChecker.ts

@@ -5,11 +5,10 @@ import { eq, lt, isNull, and, or } from "drizzle-orm";
 import logger from "@server/logger";
 import { sendTerminateClient } from "../client/terminate";
 import { OlmErrorCodes } from "./error";
+import { getOfflineThresholds } from "#dynamic/lib/offlineThresholds";
 
 // Track if the offline checker interval is running
 let offlineCheckerInterval: NodeJS.Timeout | null = null;
-const OFFLINE_CHECK_INTERVAL = 30 * 1000; // Check every 30 seconds
-const OFFLINE_THRESHOLD_MS = 2 * 60 * 1000; // 2 minutes
 
 /**
  * Starts the background interval that checks for clients that haven't pinged recently
@@ -22,13 +21,13 @@ export const startOlmOfflineChecker = (): void => {
 
     offlineCheckerInterval = setInterval(async () => {
         try {
-            const twoMinutesAgo = Math.floor(
-                (Date.now() - OFFLINE_THRESHOLD_MS) / 1000
+            const offlineBefore = Math.floor(
+                (Date.now() - getOfflineThresholds().olmMs) / 1000
             );
 
             // TODO: WE NEED TO MAKE SURE THIS WORKS WITH DISTRIBUTED NODES ALL DOING THE SAME THING
 
-            // Find clients that haven't pinged in the last 2 minutes and mark them as offline
+            // Find clients that haven't pinged within the offline threshold and mark them as offline
             const offlineClients = await db
                 .update(clients)
                 .set({ online: false })
@@ -36,7 +35,7 @@ export const startOlmOfflineChecker = (): void => {
                     and(
                         eq(clients.online, true),
                         or(
-                            lt(clients.lastPing, twoMinutesAgo),
+                            lt(clients.lastPing, offlineBefore),
                             isNull(clients.lastPing)
                         )
                     )
@@ -75,7 +74,7 @@ export const startOlmOfflineChecker = (): void => {
         } catch (error) {
             logger.error("Error in offline checker interval", { error });
         }
-    }, OFFLINE_CHECK_INTERVAL);
+    }, getOfflineThresholds().checkIntervalMs);
 
     logger.debug("Started offline checker interval");
 };

server/routers/olm/peers.ts

@@ -1,7 +1,6 @@
 import { sendToClient, sendToClientsBatch } from "#dynamic/routers/ws";
 import { clientSitesAssociationsCache, db, olms } from "@server/db";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import config from "@server/lib/config";
 import logger from "@server/logger";
 import { and, eq, inArray } from "drizzle-orm";
 import { Alias } from "yaml";
@@ -155,6 +154,7 @@ export async function initPeerAddHandshake(
         siteId: number;
         exitNode: {
             publicKey: string;
+            relayPort: number;
             endpoint: string;
         };
     },
@@ -181,7 +181,7 @@ export async function initPeerAddHandshake(
                 siteId: peer.siteId,
                 exitNode: {
                     publicKey: peer.exitNode.publicKey,
-                    relayPort: config.getRawConfig().gerbil.clients_start_port,
+                    relayPort: peer.exitNode.relayPort,
                     endpoint: peer.exitNode.endpoint
                 },
                 chainId
@@ -297,6 +297,7 @@ export async function initPeerAddHandshakeBatch(
             siteId: number;
             exitNode: {
                 publicKey: string;
+                relayPort: number;
                 endpoint: string;
             };
         };
@@ -317,8 +318,7 @@ export async function initPeerAddHandshakeBatch(
                     siteId: item.peer.siteId,
                     exitNode: {
                         publicKey: item.peer.exitNode.publicKey,
-                        relayPort:
-                            config.getRawConfig().gerbil.clients_start_port,
+                        relayPort: item.peer.exitNode.relayPort,
                         endpoint: item.peer.exitNode.endpoint
                     },
                     chainId: item.chainId

server/routers/olm/sync.ts

@@ -5,13 +5,13 @@ import {
     exitNodes,
     Olm,
     sites,
-    clientSitesAssociationsCache
+    clientSitesAssociationsCache,
+    orgs
 } from "@server/db";
 import { buildSiteConfigurationForOlmClient } from "./buildConfiguration";
 import { sendToClient } from "#dynamic/routers/ws";
 import logger from "@server/logger";
 import { count, eq, inArray } from "drizzle-orm";
-import config from "@server/lib/config";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import { build } from "@server/build";
 
@@ -36,8 +36,19 @@ export async function sendOlmSyncMessage(olm: Olm, client: Client) {
         { orgId: client.orgId }
     );
 
+    const [org] = await db
+        .select()
+        .from(orgs)
+        .where(eq(orgs.orgId, client.orgId))
+        .limit(1);
+
+    if (!org) {
+        logger.warn(`Client ${client.clientId} org not found`);
+        return;
+    }
+
     let jitMode = false;
-    if (sitesCount > 250 && build == "saas") {
+    if (sitesCount > org.settingsJitModeLimit && build == "saas") {
         // THIS IS THE MAX ON THE BUSINESS TIER
         // we have too many sites
         // If we have too many sites we need to drop into fully JIT mode by not sending any of the sites
@@ -113,7 +124,7 @@ export async function sendOlmSyncMessage(olm: Olm, client: Client) {
         exitNodesData = allExitNodes.map((exitNode) => {
             return {
                 publicKey: exitNode.publicKey,
-                relayPort: config.getRawConfig().gerbil.clients_start_port,
+                relayPort: exitNode.relayPort,
                 endpoint: exitNode.endpoint,
                 siteIds: exitNodeIdToSiteIds[exitNode.exitNodeId] ?? []
             };

server/routers/org/deleteOrg.ts

@@ -7,7 +7,7 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { deleteOrgById, sendTerminationMessages } from "@server/lib/deleteOrg";
-import { db, userOrgs, orgs } from "@server/db";
+import { db, Org, userOrgs, orgs } from "@server/db";
 import { eq, and } from "drizzle-orm";
 
 const deleteOrgSchema = z.strictObject({
@@ -59,35 +59,60 @@ export async function deleteOrg(
         }
         const { orgId } = parsedParams.data;
 
-        const [data] = await db
-            .select()
-            .from(userOrgs)
-            .innerJoin(orgs, eq(userOrgs.orgId, orgs.orgId))
-            .where(
-                and(
-                    eq(userOrgs.orgId, orgId),
-                    eq(userOrgs.userId, req.user!.userId)
-                )
-            );
+        let org: Org | undefined;
 
-        const org = data?.orgs;
-        const userOrg = data?.userOrgs;
+        if (req.user) {
+            // Dashboard sessions may delete only an organization the user owns.
+            const [data] = await db
+                .select()
+                .from(userOrgs)
+                .innerJoin(orgs, eq(userOrgs.orgId, orgs.orgId))
+                .where(
+                    and(
+                        eq(userOrgs.orgId, orgId),
+                        eq(userOrgs.userId, req.user.userId)
+                    )
+                );
 
-        if (!org || !userOrg) {
+            if (!data) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Organization with ID ${orgId} not found`
+                    )
+                );
+            }
+
+            if (!data.userOrgs.isOwner) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Only organization owners can delete the organization"
+                    )
+                );
+            }
+
+            org = data.orgs;
+        } else if (req.apiKey) {
+            // Integration API requests carry no user session. The route is already
+            // restricted by verifyApiKeyIsRoot and verifyApiKeyHasAction(deleteOrg).
+            [org] = await db
+                .select()
+                .from(orgs)
+                .where(eq(orgs.orgId, orgId))
+                .limit(1);
+
+            if (!org) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Organization with ID ${orgId} not found`
+                    )
+                );
+            }
+        } else {
             return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Organization with ID ${orgId} not found`
-                )
-            );
-        }
-
-        if (!userOrg.isOwner) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Only organization owners can delete the organization"
-                )
+                createHttpError(HttpCode.UNAUTHORIZED, "Not authenticated")
             );
         }
 

server/routers/resource/createResourceMtlsCertificate.ts

@@ -0,0 +1,239 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resourceMtlsCertificates, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import {
+    MAX_MTLS_CERTIFICATES_PER_RESOURCE,
+    parseCaCertificates
+} from "@server/lib/mtlsCertificate";
+
+const createResourceMtlsCertificateParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createResourceMtlsCertificateBodySchema = z.strictObject({
+    name: z.string().min(1).max(255).optional(),
+    certificate: z.string().min(1).max(100_000)
+});
+
+export type CreateResourceMtlsCertificateResponse = {
+    certificates: {
+        mtlsCertificateId: number;
+        resourceId: number;
+        name: string | null;
+        subject: string | null;
+        issuer: string | null;
+        serialNumber: string | null;
+        fingerprint: string | null;
+        notBefore: number | null;
+        notAfter: number | null;
+        createdAt: number;
+    }[];
+};
+
+const description =
+    "Add a trusted CA certificate that clients must present a certificate signed by when mTLS is enabled on a resource. Accepts a PEM bundle; each certificate in the bundle is stored separately.";
+
+registry.registerPath({
+    method: "put",
+    path: "/resource/{resourceId}/mtls/certificate",
+    description,
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createResourceMtlsCertificateParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourceMtlsCertificateBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/mtls/certificate",
+    description,
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: createResourceMtlsCertificateParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourceMtlsCertificateBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createResourceMtlsCertificate(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams =
+            createResourceMtlsCertificateParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = createResourceMtlsCertificateBodySchema.safeParse(
+            req.body
+        );
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+        const { name, certificate } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (resource.mode !== "http") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "mTLS is only supported on HTTP resources"
+                )
+            );
+        }
+
+        const isLicensed = await isLicensedOrSubscribed(
+            resource.orgId,
+            tierMatrix.mtls
+        );
+        if (!isLicensed) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
+                )
+            );
+        }
+
+        let parsedCerts;
+        try {
+            parsedCerts = parseCaCertificates(certificate);
+        } catch (e) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    e instanceof Error ? e.message : "Invalid certificate"
+                )
+            );
+        }
+
+        const existing = await db
+            .select({ fingerprint: resourceMtlsCertificates.fingerprint })
+            .from(resourceMtlsCertificates)
+            .where(eq(resourceMtlsCertificates.resourceId, resourceId));
+
+        const existingFingerprints = new Set(existing.map((c) => c.fingerprint));
+        const newCerts = parsedCerts.filter(
+            (c) => !existingFingerprints.has(c.fingerprint)
+        );
+
+        if (newCerts.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.CONFLICT,
+                    parsedCerts.length === 1
+                        ? "This CA certificate has already been added to this resource"
+                        : "All certificates in this bundle have already been added to this resource"
+                )
+            );
+        }
+
+        if (
+            existing.length + newCerts.length >
+            MAX_MTLS_CERTIFICATES_PER_RESOURCE
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `A resource can have at most ${MAX_MTLS_CERTIFICATES_PER_RESOURCE} trusted CA certificates`
+                )
+            );
+        }
+
+        const now = Date.now();
+        const inserted = await db
+            .insert(resourceMtlsCertificates)
+            .values(
+                newCerts.map((c) => ({
+                    resourceId,
+                    // a label only makes sense for a single certificate
+                    name: newCerts.length === 1 ? (name ?? null) : null,
+                    certificate: c.certificate,
+                    subject: c.subject,
+                    issuer: c.issuer,
+                    serialNumber: c.serialNumber,
+                    fingerprint: c.fingerprint,
+                    notBefore: c.notBefore,
+                    notAfter: c.notAfter,
+                    createdAt: now
+                }))
+            )
+            .returning({
+                mtlsCertificateId: resourceMtlsCertificates.mtlsCertificateId,
+                resourceId: resourceMtlsCertificates.resourceId,
+                name: resourceMtlsCertificates.name,
+                subject: resourceMtlsCertificates.subject,
+                issuer: resourceMtlsCertificates.issuer,
+                serialNumber: resourceMtlsCertificates.serialNumber,
+                fingerprint: resourceMtlsCertificates.fingerprint,
+                notBefore: resourceMtlsCertificates.notBefore,
+                notAfter: resourceMtlsCertificates.notAfter,
+                createdAt: resourceMtlsCertificates.createdAt
+            });
+
+        return response<CreateResourceMtlsCertificateResponse>(res, {
+            data: { certificates: inserted },
+            success: true,
+            error: false,
+            message: "CA certificate added successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/deleteResourceMtlsCertificate.ts

@@ -0,0 +1,135 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resourceMtlsCertificates, resources } from "@server/db";
+import { and, count, eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const deleteResourceMtlsCertificateParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive(),
+    mtlsCertificateId: z.coerce.number().int().positive()
+});
+
+const description =
+    "Remove a trusted CA certificate from a resource. If it is the last one, mTLS is disabled on the resource since it can no longer verify any client.";
+
+registry.registerPath({
+    method: "delete",
+    path: "/resource/{resourceId}/mtls/certificate/{mtlsCertificateId}",
+    description,
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: deleteResourceMtlsCertificateParamsSchema
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}/mtls/certificate/{mtlsCertificateId}",
+    description,
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: deleteResourceMtlsCertificateParamsSchema
+    },
+    responses: {}
+});
+
+export type DeleteResourceMtlsCertificateResponse = {
+    // true when removing the last CA certificate forced mTLS off
+    mtlsDisabled: boolean;
+};
+
+export async function deleteResourceMtlsCertificate(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams =
+            deleteResourceMtlsCertificateParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { resourceId, mtlsCertificateId } = parsedParams.data;
+
+        const [existing] = await db
+            .select()
+            .from(resourceMtlsCertificates)
+            .where(
+                and(
+                    eq(
+                        resourceMtlsCertificates.mtlsCertificateId,
+                        mtlsCertificateId
+                    ),
+                    eq(resourceMtlsCertificates.resourceId, resourceId)
+                )
+            )
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `CA certificate with ID ${mtlsCertificateId} not found`
+                )
+            );
+        }
+
+        let mtlsDisabled = false;
+        await db.transaction(async (trx) => {
+            await trx
+                .delete(resourceMtlsCertificates)
+                .where(
+                    eq(
+                        resourceMtlsCertificates.mtlsCertificateId,
+                        mtlsCertificateId
+                    )
+                );
+
+            const [{ remaining }] = await trx
+                .select({ remaining: count() })
+                .from(resourceMtlsCertificates)
+                .where(eq(resourceMtlsCertificates.resourceId, resourceId));
+
+            // With no CA left there is nothing to verify clients against, so
+            // leaving mTLS "enabled" would either lock everyone out or be
+            // silently ignored by the Traefik config builder.
+            if (remaining === 0) {
+                const updated = await trx
+                    .update(resources)
+                    .set({ mtlsEnabled: false })
+                    .where(
+                        and(
+                            eq(resources.resourceId, resourceId),
+                            eq(resources.mtlsEnabled, true)
+                        )
+                    )
+                    .returning({ resourceId: resources.resourceId });
+                mtlsDisabled = updated.length > 0;
+            }
+        });
+
+        return response<DeleteResourceMtlsCertificateResponse>(res, {
+            data: { mtlsDisabled },
+            success: true,
+            error: false,
+            message: "CA certificate removed successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/exportResourceBlueprint.ts

@@ -0,0 +1,100 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { generatePublicResourceBlueprintYaml } from "@server/lib/blueprints/exportResourceBlueprint";
+
+const exportResourceBlueprintSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+export type ExportResourceBlueprintResponse = {
+    name: string;
+    contents: string;
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/resource/{resourceId}/blueprint",
+    description:
+        "Generate a blueprint YAML snippet that recreates this resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Blueprint],
+    request: {
+        params: exportResourceBlueprintSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function exportResourceBlueprint(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = exportResourceBlueprintSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select({ niceId: resources.niceId })
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        const { niceId, contents } =
+            await generatePublicResourceBlueprintYaml(resourceId);
+
+        return response<ExportResourceBlueprintResponse>(res, {
+            data: { name: niceId, contents },
+            success: true,
+            error: false,
+            message: "Blueprint generated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                error instanceof Error ? error.message : "An error occurred"
+            )
+        );
+    }
+}

server/routers/resource/index.ts

@@ -21,6 +21,9 @@ export * from "./createResourceRule";
 export * from "./deleteResourceRule";
 export * from "./listResourceRules";
 export * from "./updateResourceRule";
+export * from "./createResourceMtlsCertificate";
+export * from "./deleteResourceMtlsCertificate";
+export * from "./listResourceMtlsCertificates";
 export * from "./getUserResources";
 export * from "./listUserResourceAliases";
 export * from "./setResourceHeaderAuth";
@@ -43,3 +46,4 @@ export * from "./listResourceAiProviders";
 export * from "./setResourceAiProviders";
 export * from "./addAiProviderToResource";
 export * from "./removeAiProviderFromResource";
+export * from "./exportResourceBlueprint";

server/routers/resource/listResourceMtlsCertificates.ts

@@ -0,0 +1,111 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resourceMtlsCertificates, resources } from "@server/db";
+import { asc, eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const listResourceMtlsCertificatesParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+function queryResourceMtlsCertificates(resourceId: number) {
+    return db
+        .select({
+            mtlsCertificateId: resourceMtlsCertificates.mtlsCertificateId,
+            resourceId: resourceMtlsCertificates.resourceId,
+            name: resourceMtlsCertificates.name,
+            subject: resourceMtlsCertificates.subject,
+            issuer: resourceMtlsCertificates.issuer,
+            serialNumber: resourceMtlsCertificates.serialNumber,
+            fingerprint: resourceMtlsCertificates.fingerprint,
+            notBefore: resourceMtlsCertificates.notBefore,
+            notAfter: resourceMtlsCertificates.notAfter,
+            createdAt: resourceMtlsCertificates.createdAt
+        })
+        .from(resourceMtlsCertificates)
+        .where(eq(resourceMtlsCertificates.resourceId, resourceId))
+        .orderBy(asc(resourceMtlsCertificates.mtlsCertificateId));
+}
+
+export type ListResourceMtlsCertificatesResponse = {
+    certificates: Awaited<ReturnType<typeof queryResourceMtlsCertificates>>;
+};
+
+const description = "List the trusted CA certificates for a resource's mTLS.";
+
+registry.registerPath({
+    method: "get",
+    path: "/resource/{resourceId}/mtls/certificates",
+    description,
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceMtlsCertificatesParamsSchema
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/mtls/certificates",
+    description,
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: listResourceMtlsCertificatesParamsSchema
+    },
+    responses: {}
+});
+
+export async function listResourceMtlsCertificates(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams =
+            listResourceMtlsCertificatesParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select({ resourceId: resources.resourceId })
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const certificates = await queryResourceMtlsCertificates(resourceId);
+
+        return response<ListResourceMtlsCertificatesResponse>(res, {
+            data: { certificates },
+            success: true,
+            error: false,
+            message: "CA certificates retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/updateResource.ts

@@ -6,6 +6,7 @@ import {
     loginPage,
     resourceHeaderAuth,
     resourceHeaderAuthExtendedCompatibility,
+    resourceMtlsCertificates,
     resourcePassword,
     resourcePincode,
     resourceRules,
@@ -24,7 +25,7 @@ import {
     resourcePolicies,
     resources
 } from "@server/db";
-import { eq, and, ne } from "drizzle-orm";
+import { eq, and, ne, count } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -89,6 +90,12 @@ const updateHttpResourceBodySchema = z
         domainId: z.string().optional(),
         enabled: z.boolean().optional(),
         stickySession: z.boolean().optional(),
+        loadBalancingStrategy: z
+            .enum(["wrr", "p2c", "hrw", "leasttime"])
+            .optional()
+            .describe(
+                "How requests are distributed across targets: wrr (weighted round robin, default), p2c (power of two choices), hrw (highest random weight / client IP hashing), leasttime (lowest response time)."
+            ),
         tlsServerName: z.string().nullable().optional(),
         setHostHeader: z.string().nullable().optional(),
         skipToIdpId: z
@@ -117,6 +124,12 @@ const updateHttpResourceBodySchema = z
         maintenanceTitle: z.string().max(255).nullable().optional(),
         maintenanceMessage: z.string().max(2000).nullable().optional(),
         maintenanceEstimatedTime: z.string().max(100).nullable().optional(),
+        mtlsEnabled: z
+            .boolean()
+            .optional()
+            .describe(
+                "Require clients to present a certificate signed by one of the resource's trusted CA certificates. Requires SSL and at least one CA certificate."
+            ),
         postAuthPath: z.string().nullable().optional(),
         // SSH settings
         pamMode: z.enum(["passthrough", "push"]).optional(),
@@ -508,8 +521,58 @@ async function updateHttpResource(
         }
     }
 
+    const effectiveSsl = updateData.ssl ?? resource.ssl;
+    const effectiveMtlsEnabled = updateData.mtlsEnabled ?? resource.mtlsEnabled;
+
+    if (updateData.mtlsEnabled === true) {
+        if (resource.mode !== "http") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "mTLS is only supported on HTTP resources."
+                )
+            );
+        }
+
+        const isMtlsLicensed = await isLicensedOrSubscribed(
+            resource.orgId,
+            tierMatrix.mtls
+        );
+        if (!isMtlsLicensed) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
+                )
+            );
+        }
+
+        const [{ certificateCount }] = await db
+            .select({ certificateCount: count() })
+            .from(resourceMtlsCertificates)
+            .where(eq(resourceMtlsCertificates.resourceId, resource.resourceId));
+
+        if (certificateCount === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Add at least one trusted CA certificate before enabling mTLS."
+                )
+            );
+        }
+    }
+
+    if (effectiveMtlsEnabled && !effectiveSsl) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                "mTLS requires SSL to be enabled for this resource. Disable mTLS before turning SSL off."
+            )
+        );
+    }
+
     // catch when the resource policy changes or gets cleared
-    if (updateData.resourcePolicyId !== undefined && 
+    if (updateData.resourcePolicyId !== undefined &&
         resource.resourcePolicyId !== updateData.resourcePolicyId) {
         await clearResourceSpecificSettings(
             resource.resourceId,

server/routers/role/deleteRole.ts

@@ -1,8 +1,9 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db } from "@server/db";
+import { Client, clientOrgRoles, clients, db } from "@server/db";
 import { roles, userOrgRoles } from "@server/db";
 import { and, eq, exists, aliasedTable } from "drizzle-orm";
+import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -128,7 +129,21 @@ export async function deleteRole(
             );
         }
 
+        let machineClientsToRebuild: Client[] = [];
         await db.transaction(async (trx) => {
+            // machine clients in this role lose it when the role is deleted
+            // (clientOrgRoles cascades) and are not moved to the new role, so
+            // their associations need to be rebuilt afterwards
+            machineClientsToRebuild = await trx
+                .select({ client: clients })
+                .from(clientOrgRoles)
+                .innerJoin(
+                    clients,
+                    eq(clients.clientId, clientOrgRoles.clientId)
+                )
+                .where(eq(clientOrgRoles.roleId, roleId))
+                .then((rows) => rows.map((row) => row.client));
+
             const uorNewRole = aliasedTable(userOrgRoles, "user_org_roles_new");
 
             // Users who already have newRoleId: drop the old assignment only (unique on userId+orgId+roleId).
@@ -158,6 +173,14 @@ export async function deleteRole(
             await trx.delete(roles).where(eq(roles.roleId, roleId));
         });
 
+        for (const machineClient of machineClientsToRebuild) {
+            rebuildClientAssociationsFromClient(machineClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${machineClient.clientId} after deleting role ${roleId}: ${e}`
+                );
+            });
+        }
+
         return response(res, {
             data: null,
             success: true,

server/routers/role/updateRole.ts

@@ -12,6 +12,7 @@ import { fromError } from "zod-validation-error";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { OpenAPITags, registry } from "@server/openApi";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { pushClientIdentitiesForRole } from "@server/lib/clientIdentities";
 
 const updateRoleParamsSchema = z.strictObject({
     roleId: z.coerce.number().int().positive()
@@ -216,6 +217,16 @@ export async function updateRole(
             );
         }
 
+        if (updateData.name !== undefined && updateData.name !== role[0].name) {
+            // Role names are forwarded by newt as the Remote-Role header.
+            pushClientIdentitiesForRole(roleId, orgId).catch((err) => {
+                logger.error(
+                    `Error pushing client identities after renaming role ${roleId}`,
+                    err
+                );
+            });
+        }
+
         return response(res, {
             data: updatedRole,
             success: true,

server/routers/siteResource/createSiteResource.ts

@@ -53,7 +53,7 @@ const createSiteResourceSchema = z
         name: z.string().min(1).max(255),
         niceId: z.string().optional(),
         // protocol: z.enum(["tcp", "udp"]).optional(),
-        mode: z.enum(["host", "cidr", "http", "ssh", "inference"]),
+        mode: z.enum(["host", "cidr", "http", "ssh", "inference", "gateway"]),
         ssl: z.boolean().optional(), // only used for http mode
         scheme: z.enum(["http", "https"]).optional(),
         siteIds: z.array(z.int()).optional(),
@@ -165,10 +165,11 @@ const createSiteResourceSchema = z
     )
     .refine(
         (data) => {
-            // destination is only optional for ssh mode with native authDaemonMode or inference
+            // destination is only optional for ssh mode with native authDaemonMode, inference, or gateway
             if (
                 (data.mode === "ssh" && data.authDaemonMode === "native") ||
-                data.mode == "inference"
+                data.mode == "inference" ||
+                data.mode == "gateway"
             ) {
                 return true;
             }
@@ -179,7 +180,7 @@ const createSiteResourceSchema = z
         },
         {
             message:
-                "Destination is required unless mode is ssh with authDaemonMode native or inference"
+                "Destination is required unless mode is ssh with authDaemonMode native, inference, or gateway"
         }
     )
     .refine(
@@ -447,14 +448,18 @@ export async function createSiteResource(
             );
         }
 
+        // gateway resources always route the whole subnet with everything open
+        const effectiveDestination =
+            mode === "gateway" ? "0.0.0.0/0" : destination;
+
         // Only check if destination is an IP address
         const isIp = z
             .union([z.ipv4(), z.ipv6()])
-            .safeParse(destination).success;
+            .safeParse(effectiveDestination).success;
         if (
             isIp &&
-            (isIpInCidr(destination!, org.subnet) ||
-                isIpInCidr(destination!, org.utilitySubnet))
+            (isIpInCidr(effectiveDestination!, org.subnet) ||
+                isIpInCidr(effectiveDestination!, org.utilitySubnet))
         ) {
             return next(
                 createHttpError(
@@ -584,6 +589,32 @@ export async function createSiteResource(
                     tcpPortRangeStringAdjusted = destinationPort
                         ? destinationPort.toString()
                         : "22";
+                } else if (mode === "gateway") {
+                    tcpPortRangeStringAdjusted = "*";
+                }
+
+                let udpPortRangeStringAdjusted = udpPortRangeString;
+                if (mode === "gateway") {
+                    udpPortRangeStringAdjusted = "*";
+                } else if (
+                    mode === "http" ||
+                    mode === "ssh" ||
+                    mode === "inference"
+                ) {
+                    udpPortRangeStringAdjusted = "";
+                }
+
+                // default to true for http/ssh/inference, false otherwise;
+                // gateway always allows icmp
+                let disableIcmpAdjusted = disableIcmp ?? false;
+                if (mode === "gateway") {
+                    disableIcmpAdjusted = false;
+                } else if (
+                    mode === "http" ||
+                    mode === "ssh" ||
+                    mode === "inference"
+                ) {
+                    disableIcmpAdjusted = true;
                 }
 
                 // Create the site resource
@@ -594,21 +625,14 @@ export async function createSiteResource(
                     mode,
                     ssl,
                     networkId: network ? network.networkId : null,
-                    destination: destination, // the ssh can be null
+                    destination: effectiveDestination, // the ssh can be null
                     scheme,
                     destinationPort,
                     alias: alias ? alias.trim() : null,
                     aliasAddress,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,
-                    udpPortRangeString:
-                        mode == "http" || mode == "ssh" || mode == "inference"
-                            ? ""
-                            : udpPortRangeString,
-                    disableIcmp:
-                        disableIcmp ||
-                        (mode == "http" || mode == "ssh" || mode == "inference"
-                            ? true
-                            : false), // default to true for http resources, otherwise false
+                    udpPortRangeString: udpPortRangeStringAdjusted,
+                    disableIcmp: disableIcmpAdjusted,
                     domainId,
                     subdomain: finalSubdomain,
                     fullDomain,

server/routers/siteResource/exportSiteResourceBlueprint.ts

@@ -0,0 +1,100 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, siteResources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { generatePrivateResourceBlueprintYaml } from "@server/lib/blueprints/exportResourceBlueprint";
+
+const exportSiteResourceBlueprintSchema = z.strictObject({
+    siteResourceId: z.coerce.number().int().positive()
+});
+
+export type ExportSiteResourceBlueprintResponse = {
+    name: string;
+    contents: string;
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/site-resource/{siteResourceId}/blueprint",
+    description:
+        "Generate a blueprint YAML snippet that recreates this site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Blueprint],
+    request: {
+        params: exportSiteResourceBlueprintSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function exportSiteResourceBlueprint(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = exportSiteResourceBlueprintSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { siteResourceId } = parsedParams.data;
+
+        const [siteResource] = await db
+            .select({ niceId: siteResources.niceId })
+            .from(siteResources)
+            .where(eq(siteResources.siteResourceId, siteResourceId))
+            .limit(1);
+
+        if (!siteResource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Site resource not found")
+            );
+        }
+
+        const { niceId, contents } =
+            await generatePrivateResourceBlueprintYaml(siteResourceId);
+
+        return response<ExportSiteResourceBlueprintResponse>(res, {
+            data: { name: niceId, contents },
+            success: true,
+            error: false,
+            message: "Blueprint generated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                error instanceof Error ? error.message : "An error occurred"
+            )
+        );
+    }
+}

server/routers/siteResource/index.ts

@@ -25,3 +25,4 @@ export * from "./listSiteResourceAiProviders";
 export * from "./setSiteResourceAiProviders";
 export * from "./addAiProviderToSiteResource";
 export * from "./removeAiProviderFromSiteResource";
+export * from "./exportSiteResourceBlueprint";

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -55,12 +55,12 @@ const listAllSiteResourcesByOrgQuerySchema = z.strictObject({
         }),
     query: z.string().optional(),
     mode: z
-        .enum(["host", "cidr", "http", "ssh", "inference"])
+        .enum(["host", "cidr", "http", "ssh", "inference", "gateway"])
         .optional()
         .catch(undefined)
         .openapi({
             type: "string",
-            enum: ["host", "cidr", "http", "ssh", "inference"],
+            enum: ["host", "cidr", "http", "ssh", "inference", "gateway"],
             description: "Filter site resources by mode"
         }),
     sort_by: z

server/routers/siteResource/updateSiteResource.ts

@@ -51,7 +51,9 @@ const updateSiteResourceSchema = z
             )
             .optional(),
         // mode: z.enum(["host", "cidr", "port"]).optional(),
-        mode: z.enum(["host", "cidr", "http", "ssh", "inference"]).optional(),
+        mode: z
+            .enum(["host", "cidr", "http", "ssh", "inference", "gateway"])
+            .optional(),
         ssl: z.boolean().optional(),
         scheme: z.enum(["http", "https"]).nullish(),
         destinationPort: z.int().positive().nullish(),
@@ -158,10 +160,11 @@ const updateSiteResourceSchema = z
             if (data.mode === undefined && data.destination === undefined) {
                 return true;
             }
-            // destination is only optional for ssh mode with native authDaemonMode or inference
+            // destination is only optional for ssh mode with native authDaemonMode, inference, or gateway
             if (
                 (data.mode === "ssh" && data.authDaemonMode === "native") ||
-                data.mode == "inference"
+                data.mode == "inference" ||
+                data.mode == "gateway"
             ) {
                 return true;
             }
@@ -172,7 +175,7 @@ const updateSiteResourceSchema = z
         },
         {
             message:
-                "Destination is required unless mode is ssh with authDaemonMode native or inference"
+                "Destination is required unless mode is ssh with authDaemonMode native, inference, or gateway"
         }
     )
     .refine(
@@ -409,14 +412,18 @@ export async function updateSiteResource(
             }
         }
 
+        // gateway resources always route the whole subnet with everything open
+        const effectiveDestination =
+            mode === "gateway" ? "0.0.0.0/0" : destination;
+
         // Only check if destination is an IP address
         const isIp = z
             .union([z.ipv4(), z.ipv6()])
-            .safeParse(destination).success;
+            .safeParse(effectiveDestination).success;
         if (
             isIp &&
-            (isIpInCidr(destination!, org.subnet) ||
-                isIpInCidr(destination!, org.utilitySubnet))
+            (isIpInCidr(effectiveDestination!, org.subnet) ||
+                isIpInCidr(effectiveDestination!, org.utilitySubnet))
         ) {
             return next(
                 createHttpError(
@@ -542,6 +549,34 @@ export async function updateSiteResource(
                 tcpPortRangeStringAdjusted = destinationPort
                     ? destinationPort.toString()
                     : "22";
+            } else if (mode === "gateway") {
+                tcpPortRangeStringAdjusted = "*";
+            }
+
+            // undefined means "leave unchanged" (partial update); only
+            // adjusted when the mode is explicitly being changed
+            let udpPortRangeStringAdjusted = udpPortRangeString;
+            if (mode === "gateway") {
+                udpPortRangeStringAdjusted = "*";
+            } else if (
+                mode === "http" ||
+                mode === "ssh" ||
+                mode === "inference"
+            ) {
+                udpPortRangeStringAdjusted = "";
+            }
+
+            let disableIcmpAdjusted = disableIcmp;
+            if (mode === "gateway") {
+                disableIcmpAdjusted = false;
+            } else if (
+                mode === "http" ||
+                mode === "ssh" ||
+                mode === "inference"
+            ) {
+                disableIcmpAdjusted = true;
+            } else if (mode !== undefined) {
+                disableIcmpAdjusted = disableIcmp ?? false;
             }
 
             [updatedSiteResource] = await trx
@@ -552,7 +587,8 @@ export async function updateSiteResource(
                     mode: mode,
                     scheme,
                     ssl,
-                    destination: destination,
+                    destination:
+                        mode === "gateway" ? effectiveDestination : destination,
                     destinationPort: destinationPort,
                     enabled: enabled,
                     alias:
@@ -562,19 +598,8 @@ export async function updateSiteResource(
                                 : null
                             : undefined,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,
-                    udpPortRangeString:
-                        mode == "http" || mode == "ssh" || mode == "inference"
-                            ? ""
-                            : udpPortRangeString,
-                    disableIcmp:
-                        mode !== undefined
-                            ? disableIcmp ||
-                              (mode == "http" ||
-                              mode == "ssh" ||
-                              mode == "inference"
-                                  ? true
-                                  : false)
-                            : disableIcmp,
+                    udpPortRangeString: udpPortRangeStringAdjusted,
+                    disableIcmp: disableIcmpAdjusted,
                     domainId,
                     subdomain: finalSubdomain,
                     fullDomain,

server/routers/traefik/traefikConfigProvider.ts

@@ -51,6 +51,10 @@ export async function traefikConfigProvider(
                                         .internal_hostname
                                 }:${config.getRawConfig().server.internal_port}`
                             ).href,
+                        disableDefaultCFIPs: config.getRawConfig().server.trust_ips.length > 0,
+                        customIPHeader: config.getRawConfig().server.custom_ip_header,
+                        trustip: config.getRawConfig().server.trust_ips,
+
                         userSessionCookieName:
                             config.getRawConfig().server.session_cookie_name,
 

server/routers/ws/handleRoundTripMessage.ts

@@ -9,9 +9,7 @@ interface RoundTripCompleteMessage {
     error?: string;
 }
 
-export const handleRoundTripMessage: MessageHandler = async (
-    context
-) => {
+export const handleRoundTripMessage: MessageHandler = async (context) => {
     const { message, client: c } = context;
 
     logger.info("Handling round trip message");
@@ -36,10 +34,14 @@ export const handleRoundTripMessage: MessageHandler = async (
             })
             .where(eq(roundTripMessageTracker.messageId, messageId));
 
-        logger.info(`Round trip message ${messageId} marked as complete: ${complete}`);
+        logger.info(
+            `Round trip message ${messageId} marked as complete: ${complete}`
+        );
 
         if (error) {
-            logger.warn(`Round trip message ${messageId} completed with error: ${error}`);
+            logger.debug(
+                `Round trip message ${messageId} did not complete: ${error}`
+            );
         }
     } catch (error) {
         logger.error("Error processing round trip message:", error);