Merge branch 'dev' into feat/redirect-tables

server/lib/billing/tierMatrix.ts

@@ -26,7 +26,8 @@ export enum TierFeature {
     WildcardSubdomain = "wildcardSubdomain",
     NewtAutoUpdate = "newtAutoUpdate",
     ResourcePolicies = "resourcePolicies",
-    RoleBasedSSHControls = "roleBasedSSHControls"
+    RoleBasedSSHControls = "roleBasedSSHControls",
+    Mtls = "mtls" // handle downgrade by disabling mTLS on resources
 }
 
 export const tierMatrix: Record<TierFeature, Tier[]> = {
@@ -70,5 +71,6 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
     [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.NewtAutoUpdate]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.ResourcePolicies]: ["tier3", "enterprise"],
-    [TierFeature.RoleBasedSSHControls]: ["tier3", "enterprise"]
+    [TierFeature.RoleBasedSSHControls]: ["tier3", "enterprise"],
+    [TierFeature.Mtls]: ["tier1", "tier2", "tier3", "enterprise"]
 };

server/lib/blueprints/MtlsSchema.ts

@@ -0,0 +1,3 @@
+import { z } from "zod";
+
+export const MtlsSchema = z.object({});

server/lib/blueprints/exportResourceBlueprint.ts

@@ -0,0 +1,689 @@
+import { stringify as stringifyYaml } from "yaml";
+import { and, asc, eq, isNull, not, or } from "drizzle-orm";
+import {
+    aiBudgets,
+    aiModels,
+    clients,
+    clientSiteResources,
+    db,
+    labels,
+    resourceAiModels,
+    resourceHeaderAuth,
+    resourceLabels,
+    resourcePassword,
+    resourcePincode,
+    resourcePolicies,
+    resourceRules,
+    resources,
+    resourceWhitelist,
+    roles,
+    roleResources,
+    roleSiteResources,
+    siteNetworks,
+    siteResourceAiModels,
+    siteResourceLabels,
+    siteResources,
+    sites,
+    targetHealthCheck,
+    targets,
+    userResources,
+    userSiteResources,
+    users
+} from "@server/db";
+import { queryResourcePolicy } from "@server/routers/policy/getResourcePolicy";
+import {
+    listPublicResourceAiProviders,
+    listSiteResourceAiProviders
+} from "@server/lib/aiInferenceResource";
+
+const HTTP_LIKE_PUBLIC_MODES = ["http", "ssh", "rdp", "vnc", "inference"];
+
+function reverseRuleAction(action: string): "allow" | "deny" | "pass" {
+    if (action === "ACCEPT") return "allow";
+    if (action === "PASS") return "pass";
+    return "deny";
+}
+
+function reverseRuleMatch(match: string): string {
+    return match.toLowerCase();
+}
+
+function stripUndefined<T extends Record<string, any>>(obj: T): T {
+    for (const key of Object.keys(obj)) {
+        if (obj[key] === undefined) {
+            delete obj[key];
+        }
+    }
+    return obj;
+}
+
+function buildHealthcheck(row: {
+    hcHostname: string | null;
+    hcPort: number | null;
+    hcEnabled: boolean | null;
+    hcPath: string | null;
+    hcScheme: string | null;
+    hcMode: string | null;
+    hcInterval: number | null;
+    hcUnhealthyInterval: number | null;
+    hcTimeout: number | null;
+    hcHeaders: string | null;
+    hcFollowRedirects: boolean | null;
+    hcMethod: string | null;
+    hcStatus: number | null;
+    hcHealthyThreshold: number | null;
+    hcUnhealthyThreshold: number | null;
+}) {
+    if (!row.hcHostname) {
+        return undefined;
+    }
+
+    let headers: { name: string; value: string }[] | undefined;
+    if (row.hcHeaders) {
+        try {
+            headers = JSON.parse(row.hcHeaders);
+        } catch {
+            headers = undefined;
+        }
+    }
+
+    return stripUndefined({
+        hostname: row.hcHostname,
+        port: row.hcPort ?? undefined,
+        enabled: row.hcEnabled ?? undefined,
+        path: row.hcPath ?? undefined,
+        scheme: row.hcScheme ?? undefined,
+        mode: row.hcMode ?? undefined,
+        interval: row.hcInterval ?? undefined,
+        "unhealthy-interval": row.hcUnhealthyInterval ?? undefined,
+        timeout: row.hcTimeout ?? undefined,
+        headers,
+        "follow-redirects": row.hcFollowRedirects ?? undefined,
+        method: row.hcMethod ?? undefined,
+        status: row.hcStatus ?? undefined,
+        "healthy-threshold": row.hcHealthyThreshold ?? undefined,
+        "unhealthy-threshold": row.hcUnhealthyThreshold ?? undefined
+    });
+}
+
+async function buildPublicAuthAndRules(resource: {
+    resourceId: number;
+    resourcePolicyId: number | null;
+    defaultResourcePolicyId: number | null;
+    sso: boolean | null;
+    skipToIdpId: number | null;
+}): Promise<{
+    policy: string | undefined;
+    auth: Record<string, any> | undefined;
+    rules: Record<string, any>[];
+    notes: string[];
+}> {
+    const notes: string[] = [];
+
+    if (resource.resourcePolicyId) {
+        // Shared policy attached: the policy's own auth config lives on the
+        // policy entity itself (edited separately). The resource only carries
+        // its own overrides in the legacy resource-level tables.
+        const [policyRow] = await db
+            .select({ niceId: resourcePolicies.niceId })
+            .from(resourcePolicies)
+            .where(eq(resourcePolicies.resourcePolicyId, resource.resourcePolicyId))
+            .limit(1);
+
+        const [roleRows, userRows, whitelistRows, ruleRows, passwordRow, pincodeRow, headerAuthRow] =
+            await Promise.all([
+                db
+                    .select({ name: roles.name })
+                    .from(roleResources)
+                    .innerJoin(
+                        roles,
+                        and(
+                            eq(roleResources.roleId, roles.roleId),
+                            or(isNull(roles.isAdmin), not(roles.isAdmin))
+                        )
+                    )
+                    .where(eq(roleResources.resourceId, resource.resourceId)),
+                db
+                    .select({ username: users.username })
+                    .from(userResources)
+                    .innerJoin(users, eq(userResources.userId, users.userId))
+                    .where(eq(userResources.resourceId, resource.resourceId)),
+                db
+                    .select({ email: resourceWhitelist.email })
+                    .from(resourceWhitelist)
+                    .where(eq(resourceWhitelist.resourceId, resource.resourceId)),
+                db
+                    .select({
+                        enabled: resourceRules.enabled,
+                        priority: resourceRules.priority,
+                        action: resourceRules.action,
+                        match: resourceRules.match,
+                        value: resourceRules.value
+                    })
+                    .from(resourceRules)
+                    .where(eq(resourceRules.resourceId, resource.resourceId)),
+                db
+                    .select({ passwordId: resourcePassword.passwordId })
+                    .from(resourcePassword)
+                    .where(eq(resourcePassword.resourceId, resource.resourceId))
+                    .limit(1),
+                db
+                    .select({ pincodeId: resourcePincode.pincodeId })
+                    .from(resourcePincode)
+                    .where(eq(resourcePincode.resourceId, resource.resourceId))
+                    .limit(1),
+                db
+                    .select({ headerAuthId: resourceHeaderAuth.headerAuthId })
+                    .from(resourceHeaderAuth)
+                    .where(eq(resourceHeaderAuth.resourceId, resource.resourceId))
+                    .limit(1)
+            ]);
+
+        if (passwordRow.length > 0) {
+            notes.push(
+                "A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
+            );
+        }
+        if (pincodeRow.length > 0) {
+            notes.push(
+                "A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
+            );
+        }
+        if (headerAuthRow.length > 0) {
+            notes.push(
+                "Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
+            );
+        }
+
+        const auth = stripUndefined({
+            "sso-enabled": resource.sso ?? undefined,
+            "sso-roles": roleRows.length ? roleRows.map((r) => r.name) : undefined,
+            "sso-users": userRows.length
+                ? userRows.map((u) => u.username)
+                : undefined,
+            "whitelist-users": whitelistRows.length
+                ? whitelistRows.map((w) => w.email)
+                : undefined,
+            "auto-login-idp": resource.skipToIdpId ?? undefined
+        });
+
+        return {
+            policy: policyRow?.niceId,
+            auth: Object.keys(auth).length > 0 ? auth : undefined,
+            rules: ruleRows.map((r) =>
+                stripUndefined({
+                    action: reverseRuleAction(r.action),
+                    match: reverseRuleMatch(r.match),
+                    value: r.value,
+                    priority: r.priority,
+                    enabled: r.enabled
+                })
+            ),
+            notes
+        };
+    }
+
+    if (!resource.defaultResourcePolicyId) {
+        return { policy: undefined, auth: undefined, rules: [], notes };
+    }
+
+    // Inline policy: the resource's own default (non-shared) policy carries
+    // all of its auth config.
+    const policy = await queryResourcePolicy({
+        resourcePolicyId: resource.defaultResourcePolicyId
+    });
+
+    if (!policy) {
+        return { policy: undefined, auth: undefined, rules: [], notes };
+    }
+
+    if (policy.passwordId) {
+        notes.push(
+            "A password is configured on this resource. Passwords cannot be exported for security reasons; re-set it after applying this blueprint."
+        );
+    }
+    if (policy.pincodeId) {
+        notes.push(
+            "A pincode is configured on this resource. Pincodes cannot be exported for security reasons; re-set it after applying this blueprint."
+        );
+    }
+    if (policy.headerAuth?.id) {
+        notes.push(
+            "Basic auth is configured on this resource. Basic auth credentials cannot be exported for security reasons; re-set it after applying this blueprint."
+        );
+    }
+
+    const auth = stripUndefined({
+        "sso-enabled": policy.sso ?? undefined,
+        "sso-roles": policy.roles.length
+            ? policy.roles.map((r) => r.name)
+            : undefined,
+        "sso-users": policy.users.length
+            ? policy.users.map((u) => u.username)
+            : undefined,
+        "whitelist-users": policy.emailWhiteList.length
+            ? policy.emailWhiteList.map((w) => w.email)
+            : undefined,
+        "auto-login-idp": policy.idpId ?? undefined
+    });
+
+    return {
+        policy: undefined,
+        auth: Object.keys(auth).length > 0 ? auth : undefined,
+        rules: policy.rules.map((r) =>
+            stripUndefined({
+                action: reverseRuleAction(r.action),
+                match: reverseRuleMatch(r.match),
+                value: r.value,
+                priority: r.priority,
+                enabled: r.enabled
+            })
+        ),
+        notes
+    };
+}
+
+async function buildAiProvidersAndBudget(input:
+    | { scope: "public"; resourceId: number }
+    | { scope: "site"; siteResourceId: number }
+) {
+    const providers =
+        input.scope === "public"
+            ? await listPublicResourceAiProviders(input.resourceId)
+            : await listSiteResourceAiProviders(input.siteResourceId);
+
+    const aiProvidersConfig = await Promise.all(
+        providers.map(async (p) => {
+            const entry: Record<string, any> = {
+                provider: p.niceId,
+                "access-mode": p.accessMode,
+                enabled: p.enabled
+            };
+
+            if (p.accessMode === "select") {
+                const modelRows =
+                    input.scope === "public"
+                        ? await db
+                              .select({ modelKey: aiModels.modelKey })
+                              .from(resourceAiModels)
+                              .innerJoin(
+                                  aiModels,
+                                  eq(resourceAiModels.modelId, aiModels.modelId)
+                              )
+                              .where(
+                                  and(
+                                      eq(
+                                          resourceAiModels.resourceId,
+                                          input.resourceId
+                                      ),
+                                      eq(aiModels.providerId, p.providerId)
+                                  )
+                              )
+                        : await db
+                              .select({ modelKey: aiModels.modelKey })
+                              .from(siteResourceAiModels)
+                              .innerJoin(
+                                  aiModels,
+                                  eq(siteResourceAiModels.modelId, aiModels.modelId)
+                              )
+                              .where(
+                                  and(
+                                      eq(
+                                          siteResourceAiModels.siteResourceId,
+                                          input.siteResourceId
+                                      ),
+                                      eq(aiModels.providerId, p.providerId)
+                                  )
+                              );
+
+                if (modelRows.length > 0) {
+                    entry.models = modelRows.map((m) => m.modelKey);
+                }
+            }
+
+            return entry;
+        })
+    );
+
+    const budgetRows = await db
+        .select()
+        .from(aiBudgets)
+        .where(
+            input.scope === "public"
+                ? eq(aiBudgets.resourceId, input.resourceId)
+                : eq(aiBudgets.siteResourceId, input.siteResourceId)
+        );
+
+    const aiBudgetConfig = budgetRows.map((b) => ({
+        amount: b.amount,
+        unit: b.unit,
+        period: b.period,
+        enforcement: b.enforcement,
+        enabled: b.enabled
+    }));
+
+    return { aiProvidersConfig, aiBudgetConfig };
+}
+
+export async function generatePublicResourceBlueprintYaml(
+    resourceId: number
+): Promise<{ niceId: string; contents: string }> {
+    const [resource] = await db
+        .select()
+        .from(resources)
+        .where(eq(resources.resourceId, resourceId))
+        .limit(1);
+
+    if (!resource) {
+        throw new Error(`Resource ${resourceId} not found`);
+    }
+
+    const mode = resource.mode;
+    const isHttpLike = HTTP_LIKE_PUBLIC_MODES.includes(mode);
+    const isInference = mode === "inference";
+
+    const resourceConfig: Record<string, any> = {
+        name: resource.name,
+        mode,
+        enabled: resource.enabled
+    };
+
+    if (isHttpLike) {
+        if (resource.fullDomain) {
+            resourceConfig["full-domain"] = resource.fullDomain;
+        }
+        resourceConfig.ssl = resource.ssl;
+    } else {
+        if (resource.proxyPort) {
+            resourceConfig["proxy-port"] = resource.proxyPort;
+        }
+        if (mode === "tcp") {
+            resourceConfig["proxy-protocol"] = resource.proxyProtocol;
+            resourceConfig["proxy-protocol-version"] =
+                resource.proxyProtocolVersion ?? undefined;
+        }
+    }
+
+    if (resource.setHostHeader) {
+        resourceConfig["host-header"] = resource.setHostHeader;
+    }
+    if (resource.tlsServerName) {
+        resourceConfig["tls-server-name"] = resource.tlsServerName;
+    }
+    if (
+        resource.loadBalancingStrategy &&
+        resource.loadBalancingStrategy !== "wrr"
+    ) {
+        resourceConfig["load-balancing-strategy"] =
+            resource.loadBalancingStrategy;
+    }
+    if (resource.requestHeaders) {
+        try {
+            resourceConfig.requestHeaders = JSON.parse(resource.requestHeaders);
+        } catch {
+            // ignore malformed stored headers
+        }
+    }
+    if (resource.responseHeaders) {
+        try {
+            resourceConfig.responseHeaders = JSON.parse(resource.responseHeaders);
+        } catch {
+            // ignore malformed stored headers
+        }
+    }
+
+    if (mode === "ssh") {
+        resourceConfig["auth-daemon"] = stripUndefined({
+            pam: resource.pamMode ?? undefined,
+            mode: resource.authDaemonMode ?? undefined,
+            port: resource.authDaemonPort ?? undefined
+        });
+    }
+
+    if (resource.maintenanceModeEnabled) {
+        resourceConfig.maintenance = stripUndefined({
+            enabled: resource.maintenanceModeEnabled,
+            type: resource.maintenanceModeType ?? undefined,
+            title: resource.maintenanceTitle ?? undefined,
+            message: resource.maintenanceMessage ?? undefined,
+            "estimated-time": resource.maintenanceEstimatedTime ?? undefined
+        });
+    }
+
+    // Labels
+    const labelRows = await db
+        .select({ name: labels.name })
+        .from(resourceLabels)
+        .innerJoin(labels, eq(resourceLabels.labelId, labels.labelId))
+        .where(eq(resourceLabels.resourceId, resourceId));
+    if (labelRows.length > 0) {
+        resourceConfig.labels = labelRows.map((l) => l.name);
+    }
+
+    // Auth / rules / shared policy
+    const { policy, auth, rules, notes } = await buildPublicAuthAndRules(
+        resource
+    );
+    if (policy) {
+        resourceConfig.policy = policy;
+    }
+    if (auth) {
+        resourceConfig.auth = auth;
+    }
+    if (rules.length > 0) {
+        resourceConfig.rules = rules;
+    }
+
+    // Targets (all modes except inference use targets)
+    if (!isInference) {
+        const targetRows = await db
+            .select({
+                ip: targets.ip,
+                method: targets.method,
+                port: targets.port,
+                enabled: targets.enabled,
+                internalPort: targets.internalPort,
+                path: targets.path,
+                pathMatchType: targets.pathMatchType,
+                rewritePath: targets.rewritePath,
+                rewritePathType: targets.rewritePathType,
+                priority: targets.priority,
+                siteNiceId: sites.niceId,
+                hcEnabled: targetHealthCheck.hcEnabled,
+                hcPath: targetHealthCheck.hcPath,
+                hcScheme: targetHealthCheck.hcScheme,
+                hcMode: targetHealthCheck.hcMode,
+                hcHostname: targetHealthCheck.hcHostname,
+                hcPort: targetHealthCheck.hcPort,
+                hcInterval: targetHealthCheck.hcInterval,
+                hcUnhealthyInterval: targetHealthCheck.hcUnhealthyInterval,
+                hcTimeout: targetHealthCheck.hcTimeout,
+                hcHeaders: targetHealthCheck.hcHeaders,
+                hcFollowRedirects: targetHealthCheck.hcFollowRedirects,
+                hcMethod: targetHealthCheck.hcMethod,
+                hcStatus: targetHealthCheck.hcStatus,
+                hcHealthyThreshold: targetHealthCheck.hcHealthyThreshold,
+                hcUnhealthyThreshold: targetHealthCheck.hcUnhealthyThreshold
+            })
+            .from(targets)
+            .leftJoin(sites, eq(sites.siteId, targets.siteId))
+            .leftJoin(
+                targetHealthCheck,
+                eq(targetHealthCheck.targetId, targets.targetId)
+            )
+            .where(eq(targets.resourceId, resourceId))
+            .orderBy(asc(targets.targetId));
+
+        resourceConfig.targets = targetRows.map((row) =>
+            stripUndefined({
+                site: row.siteNiceId ?? undefined,
+                method: mode === "http" ? row.method ?? undefined : undefined,
+                hostname: row.ip,
+                port: row.port,
+                enabled: row.enabled,
+                "internal-port": row.internalPort ?? undefined,
+                path: row.path ?? undefined,
+                "path-match": row.pathMatchType ?? undefined,
+                "rewrite-path": row.rewritePath ?? undefined,
+                "rewrite-match": row.rewritePathType ?? undefined,
+                priority: row.priority,
+                healthcheck: buildHealthcheck(row)
+            })
+        );
+    } else {
+        const { aiProvidersConfig, aiBudgetConfig } =
+            await buildAiProvidersAndBudget({ scope: "public", resourceId });
+        resourceConfig["ai-providers"] = aiProvidersConfig;
+        if (aiBudgetConfig.length > 0) {
+            resourceConfig["ai-budget"] = aiBudgetConfig;
+        }
+    }
+
+    const config = {
+        "proxy-resources": {
+            [resource.niceId]: resourceConfig
+        }
+    };
+
+    const notesPrefix =
+        notes.length > 0
+            ? notes.map((n) => `# ${n}`).join("\n") + "\n\n"
+            : "";
+
+    return {
+        niceId: resource.niceId,
+        contents: notesPrefix + stringifyYaml(config)
+    };
+}
+
+export async function generatePrivateResourceBlueprintYaml(
+    siteResourceId: number
+): Promise<{ niceId: string; contents: string }> {
+    const [siteResource] = await db
+        .select()
+        .from(siteResources)
+        .where(eq(siteResources.siteResourceId, siteResourceId))
+        .limit(1);
+
+    if (!siteResource) {
+        throw new Error(`Site resource ${siteResourceId} not found`);
+    }
+
+    const mode = siteResource.mode;
+    const isInference = mode === "inference";
+    const isHttpLike = mode === "http" || isInference;
+
+    const resourceConfig: Record<string, any> = {
+        name: siteResource.name,
+        mode,
+        enabled: siteResource.enabled
+    };
+
+    if (!isInference && siteResource.networkId) {
+        const siteRows = await db
+            .select({ niceId: sites.niceId })
+            .from(siteNetworks)
+            .innerJoin(sites, eq(siteNetworks.siteId, sites.siteId))
+            .where(eq(siteNetworks.networkId, siteResource.networkId));
+        if (siteRows.length > 0) {
+            resourceConfig.sites = siteRows.map((s) => s.niceId);
+        }
+    }
+
+    if (siteResource.destination) {
+        resourceConfig.destination = siteResource.destination;
+    }
+    if (siteResource.destinationPort) {
+        resourceConfig["destination-port"] = siteResource.destinationPort;
+    }
+
+    if (!isHttpLike) {
+        resourceConfig["tcp-ports"] = siteResource.tcpPortRangeString;
+        resourceConfig["udp-ports"] = siteResource.udpPortRangeString;
+        resourceConfig["disable-icmp"] = siteResource.disableIcmp;
+    }
+
+    if (isHttpLike) {
+        if (siteResource.fullDomain) {
+            resourceConfig["full-domain"] = siteResource.fullDomain;
+        }
+        resourceConfig.ssl = siteResource.ssl;
+        if (siteResource.scheme) {
+            resourceConfig.scheme = siteResource.scheme;
+        }
+    }
+
+    if (siteResource.alias) {
+        resourceConfig.alias = siteResource.alias;
+    }
+
+    if (mode === "ssh") {
+        resourceConfig["auth-daemon"] = stripUndefined({
+            pam: siteResource.pamMode ?? undefined,
+            mode: siteResource.authDaemonMode ?? undefined,
+            port: siteResource.authDaemonPort ?? undefined
+        });
+    }
+
+    const [roleRows, userRows, clientRows, labelRows] = await Promise.all([
+        db
+            .select({ name: roles.name })
+            .from(roleSiteResources)
+            .innerJoin(
+                roles,
+                and(
+                    eq(roleSiteResources.roleId, roles.roleId),
+                    or(isNull(roles.isAdmin), not(roles.isAdmin))
+                )
+            )
+            .where(eq(roleSiteResources.siteResourceId, siteResourceId)),
+        db
+            .select({ username: users.username })
+            .from(userSiteResources)
+            .innerJoin(users, eq(userSiteResources.userId, users.userId))
+            .where(eq(userSiteResources.siteResourceId, siteResourceId)),
+        db
+            .select({ niceId: clients.niceId })
+            .from(clientSiteResources)
+            .innerJoin(clients, eq(clientSiteResources.clientId, clients.clientId))
+            .where(eq(clientSiteResources.siteResourceId, siteResourceId)),
+        db
+            .select({ name: labels.name })
+            .from(siteResourceLabels)
+            .innerJoin(labels, eq(siteResourceLabels.labelId, labels.labelId))
+            .where(eq(siteResourceLabels.siteResourceId, siteResourceId))
+    ]);
+
+    if (roleRows.length > 0) {
+        resourceConfig.roles = roleRows.map((r) => r.name);
+    }
+    if (userRows.length > 0) {
+        resourceConfig.users = userRows.map((u) => u.username);
+    }
+    if (clientRows.length > 0) {
+        resourceConfig.machines = clientRows.map((c) => c.niceId);
+    }
+    if (labelRows.length > 0) {
+        resourceConfig.labels = labelRows.map((l) => l.name);
+    }
+
+    if (isInference) {
+        const { aiProvidersConfig, aiBudgetConfig } =
+            await buildAiProvidersAndBudget({ scope: "site", siteResourceId });
+        resourceConfig["ai-providers"] = aiProvidersConfig;
+        if (aiBudgetConfig.length > 0) {
+            resourceConfig["ai-budget"] = aiBudgetConfig;
+        }
+    }
+
+    const config = {
+        "client-resources": {
+            [siteResource.niceId]: resourceConfig
+        }
+    };
+
+    return {
+        niceId: siteResource.niceId,
+        contents: stringifyYaml(config)
+    };
+}

server/lib/blueprints/privateResources.ts

@@ -259,6 +259,11 @@ export async function updatePrivateResources(
             }
 
             const isInference = resourceData.mode === "inference";
+            const isGateway = resourceData.mode === "gateway";
+            // gateway resources always route the whole subnet with everything open
+            const effectiveDestination = isGateway
+                ? "0.0.0.0/0"
+                : resourceData.destination;
 
             // Update existing resource
             const [updatedResource] = await trx
@@ -268,23 +273,28 @@ export async function updatePrivateResources(
                     mode: resourceData.mode,
                     ssl: resourceSsl,
                     scheme: resourceData.scheme,
-                    destination: resourceData.destination,
+                    destination: effectiveDestination,
                     destinationPort: resourceData["destination-port"],
                     enabled: resourceEnabled,
                     alias: resourceData.alias || null,
-                    disableIcmp:
-                        resourceData["disable-icmp"] ||
-                        (resourceData.mode == "http" || isInference
-                            ? true
-                            : false), // default to true for http/inference resources, otherwise false
+                    disableIcmp: isGateway
+                        ? false // gateway always allows icmp
+                        : resourceData["disable-icmp"] ||
+                          (resourceData.mode == "http" || isInference
+                              ? true
+                              : false), // default to true for http/inference resources, otherwise false
                     tcpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? "443,80"
-                            : resourceData["tcp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["tcp-ports"],
                     udpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? ""
-                            : resourceData["udp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["udp-ports"],
                     fullDomain: resourceData["full-domain"] || null,
                     subdomain: domainInfo ? domainInfo.subdomain : null,
                     domainId: domainInfo ? domainInfo.domainId : null,
@@ -529,6 +539,11 @@ export async function updatePrivateResources(
             }
 
             const isInference = resourceData.mode === "inference";
+            const isGateway = resourceData.mode === "gateway";
+            // gateway resources always route the whole subnet with everything open
+            const effectiveDestination = isGateway
+                ? "0.0.0.0/0"
+                : resourceData.destination;
 
             let domainInfo:
                 | { subdomain: string | null; domainId: string }
@@ -590,24 +605,29 @@ export async function updatePrivateResources(
                     mode: resourceData.mode,
                     ssl: resourceSsl,
                     scheme: resourceData.scheme,
-                    destination: resourceData.destination,
+                    destination: effectiveDestination,
                     destinationPort: resourceData["destination-port"],
                     enabled: resourceEnabled,
                     alias: resourceData.alias || null,
                     aliasAddress: aliasAddress,
-                    disableIcmp:
-                        resourceData["disable-icmp"] ||
-                        (resourceData.mode == "http" || isInference
-                            ? true
-                            : false), // default to true for http/inference resources, otherwise false
+                    disableIcmp: isGateway
+                        ? false // gateway always allows icmp
+                        : resourceData["disable-icmp"] ||
+                          (resourceData.mode == "http" || isInference
+                              ? true
+                              : false), // default to true for http/inference resources, otherwise false
                     tcpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? "443,80"
-                            : resourceData["tcp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["tcp-ports"],
                     udpPortRangeString:
                         resourceData.mode == "http" || isInference
                             ? ""
-                            : resourceData["udp-ports"],
+                            : isGateway
+                              ? "*"
+                              : resourceData["udp-ports"],
                     fullDomain: resourceData["full-domain"] || null,
                     subdomain: domainInfo ? domainInfo.subdomain : null,
                     domainId: domainInfo ? domainInfo.domainId : null,

server/lib/blueprints/publicResources.ts

@@ -10,6 +10,7 @@ import {
     Resource,
     resourceHeaderAuth,
     resourceHeaderAuthExtendedCompatibility,
+    resourceMtlsCertificates,
     resourcePassword,
     resourcePincode,
     resourcePolicies,
@@ -62,6 +63,10 @@ import { LimitId } from "../billing";
 import { usageService } from "../billing/usageService";
 import { syncInferenceAiConfig } from "./aiProviders";
 import { syncAiBudgets } from "./aiBudgets";
+import {
+    MAX_MTLS_CERTIFICATES_PER_RESOURCE,
+    parseCaCertificates
+} from "../mtlsCertificate";
 
 export type PublicResourcesResults = {
     proxyResource: Resource;
@@ -274,6 +279,20 @@ export async function updatePublicResources(
             ? JSON.stringify(resourceData.responseHeaders)
             : null;
 
+        // mTLS is a security control: refuse (rather than silently drop) a
+        // blueprint that asks for it on a plan that doesn't include it.
+        if (resourceData.mtls?.enabled) {
+            const mtlsLicensed = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.mtls
+            );
+            if (!mtlsLicensed) {
+                throw new Error(
+                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
+                );
+            }
+        }
+
         if (resourceData.policy) {
             const isLicensed = await isLicensedOrSubscribed(
                 orgId,
@@ -405,6 +424,9 @@ export async function updatePublicResources(
                             setHostHeader: resourceData["host-header"] || null,
                             tlsServerName:
                                 resourceData["tls-server-name"] || null,
+                            loadBalancingStrategy:
+                                resourceData["load-balancing-strategy"] ??
+                                "wrr",
                             emailWhitelistEnabled: resourceData.auth?.[
                                 "whitelist-users"
                             ]
@@ -431,6 +453,7 @@ export async function updatePublicResources(
                                 resourceData.maintenance?.message,
                             maintenanceEstimatedTime:
                                 resourceData.maintenance?.["estimated-time"],
+                            mtlsEnabled: resourceData.mtls?.enabled,
                             proxyProtocol:
                                 resourceData.mode === "tcp"
                                     ? (resourceData["proxy-protocol"] ?? false)
@@ -608,6 +631,9 @@ export async function updatePublicResources(
                             setHostHeader: resourceData["host-header"] || null,
                             tlsServerName:
                                 resourceData["tls-server-name"] || null,
+                            loadBalancingStrategy:
+                                resourceData["load-balancing-strategy"] ??
+                                "wrr",
                             requestHeaders,
                             responseHeaders,
                             maintenanceModeEnabled:
@@ -618,6 +644,7 @@ export async function updatePublicResources(
                                 resourceData.maintenance?.message,
                             maintenanceEstimatedTime:
                                 resourceData.maintenance?.["estimated-time"],
+                            mtlsEnabled: resourceData.mtls?.enabled,
                             proxyProtocol:
                                 resourceData.mode === "tcp"
                                     ? (resourceData["proxy-protocol"] ?? false)
@@ -722,6 +749,14 @@ export async function updatePublicResources(
                     resourceId: existingResource.resourceId,
                     budgets: resourceData["ai-budget"] || []
                 });
+
+                if (resourceData.mtls?.["ca-certificates"]) {
+                    await syncResourceMtlsCertificates(
+                        existingResource.resourceId,
+                        resourceData.mtls["ca-certificates"],
+                        trx
+                    );
+                }
             }
 
             const existingResourceTargets = await trx
@@ -1231,6 +1266,8 @@ export async function updatePublicResources(
                     enabled: resourceEnabled,
                     setHostHeader: resourceData["host-header"] || null,
                     tlsServerName: resourceData["tls-server-name"] || null,
+                    loadBalancingStrategy:
+                        resourceData["load-balancing-strategy"] ?? "wrr",
                     ssl: resourceSsl,
                     requestHeaders,
                     responseHeaders,
@@ -1246,6 +1283,7 @@ export async function updatePublicResources(
                     maintenanceMessage: resourceData.maintenance?.message,
                     maintenanceEstimatedTime:
                         resourceData.maintenance?.["estimated-time"],
+                    mtlsEnabled: resourceData.mtls?.enabled,
                     proxyProtocol:
                         resourceData.mode === "tcp"
                             ? (resourceData["proxy-protocol"] ?? false)
@@ -1300,6 +1338,14 @@ export async function updatePublicResources(
                 budgets: resourceData["ai-budget"] || []
             });
 
+            if (resourceData.mtls?.["ca-certificates"]) {
+                await syncResourceMtlsCertificates(
+                    newResource.resourceId,
+                    resourceData.mtls["ca-certificates"],
+                    trx
+                );
+            }
+
             await trx.insert(roleResources).values({
                 roleId: adminRole.roleId,
                 resourceId: newResource.resourceId
@@ -1643,6 +1689,63 @@ async function syncUserResources(
     }
 }
 
+async function syncResourceMtlsCertificates(
+    resourceId: number,
+    caCertificates: string[],
+    trx: Transaction
+) {
+    // A PEM entry may itself be a bundle; flatten and dedupe by fingerprint.
+    const desired = new Map<string, ReturnType<typeof parseCaCertificates>[0]>();
+    for (const pem of caCertificates) {
+        for (const cert of parseCaCertificates(pem)) {
+            desired.set(cert.fingerprint, cert);
+        }
+    }
+
+    if (desired.size > MAX_MTLS_CERTIFICATES_PER_RESOURCE) {
+        throw new Error(
+            `A resource can have at most ${MAX_MTLS_CERTIFICATES_PER_RESOURCE} trusted CA certificates`
+        );
+    }
+
+    const existing = await trx
+        .select()
+        .from(resourceMtlsCertificates)
+        .where(eq(resourceMtlsCertificates.resourceId, resourceId));
+
+    const existingFingerprints = new Set(existing.map((c) => c.fingerprint));
+
+    for (const cert of desired.values()) {
+        if (existingFingerprints.has(cert.fingerprint)) {
+            continue;
+        }
+        await trx.insert(resourceMtlsCertificates).values({
+            resourceId,
+            certificate: cert.certificate,
+            subject: cert.subject,
+            issuer: cert.issuer,
+            serialNumber: cert.serialNumber,
+            fingerprint: cert.fingerprint,
+            notBefore: cert.notBefore,
+            notAfter: cert.notAfter,
+            createdAt: Date.now()
+        });
+    }
+
+    for (const row of existing) {
+        if (!row.fingerprint || !desired.has(row.fingerprint)) {
+            await trx
+                .delete(resourceMtlsCertificates)
+                .where(
+                    eq(
+                        resourceMtlsCertificates.mtlsCertificateId,
+                        row.mtlsCertificateId
+                    )
+                );
+        }
+    }
+}
+
 async function syncWhitelistUsers(
     resourceId: number,
     whitelistUsers: string[],

server/lib/blueprints/types.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { existsSync } from "node:fs";
 import { portRangeStringSchema } from "@server/lib/ip";
 import { MaintenanceSchema } from "#dynamic/lib/blueprints/MaintenanceSchema";
+import { MtlsSchema } from "#dynamic/lib/blueprints/MtlsSchema";
 import { isValidRegionId } from "@server/db/regions";
 import { isValidHttpMethodList } from "@server/lib/validators";
 import { wildcardSubdomainSchema } from "@server/lib/schemas";
@@ -47,7 +48,7 @@ const healthCheckHostnameSchema = z
                 return true;
             }
             const hostnameRegex =
-                /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)*[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+                /^(?:[a-zA-Z0-9_](?:[a-zA-Z0-9_-]{0,61}[a-zA-Z0-9_])?\.)*[a-zA-Z0-9_](?:[a-zA-Z0-9_-]{0,61}[a-zA-Z0-9_])?$/;
             return hostnameRegex.test(val);
         },
         {
@@ -326,11 +327,15 @@ export const PublicResourceSchema = z
         auth: AuthSchema.optional(),
         "host-header": z.string().optional(),
         "tls-server-name": z.string().optional(),
+        "load-balancing-strategy": z
+            .enum(["wrr", "p2c", "hrw", "leasttime"])
+            .optional(),
         headers: z.array(HeaderSchema).optional(), // deprecated alias for requestHeaders
         requestHeaders: z.array(HeaderSchema).optional(),
         responseHeaders: z.array(HeaderSchema).optional(),
         rules: z.array(RuleSchema).optional(),
         maintenance: MaintenanceSchema.optional(),
+        mtls: MtlsSchema.optional(),
         "auth-daemon": AuthDaemonSchema.optional(),
         "proxy-protocol": z.boolean().optional(),
         "proxy-protocol-version": z.int().min(1).optional(),
@@ -445,6 +450,48 @@ export const PublicResourceSchema = z
             error: "When protocol is 'http', 'ssh', 'rdp', 'vnc', or 'inference', a 'full-domain' must be provided"
         }
     )
+    .refine(
+        (resource) => {
+            if (isTargetsOnlyResource(resource) || !resource.mtls?.enabled) {
+                return true;
+            }
+
+            return (resource.mode ?? resource.protocol) === "http";
+        },
+        {
+            path: ["mtls"],
+            error: "mTLS is only supported when mode is 'http'"
+        }
+    )
+    .refine(
+        (resource) => {
+            if (isTargetsOnlyResource(resource) || !resource.mtls?.enabled) {
+                return true;
+            }
+
+            return resource.ssl !== false;
+        },
+        {
+            path: ["mtls"],
+            error: "mTLS requires 'ssl' to be enabled"
+        }
+    )
+    .refine(
+        (resource) => {
+            if (isTargetsOnlyResource(resource) || !resource.mtls?.enabled) {
+                return true;
+            }
+
+            const caCertificates = (
+                resource.mtls as { "ca-certificates"?: string[] }
+            )["ca-certificates"];
+            return (caCertificates?.length ?? 0) > 0;
+        },
+        {
+            path: ["mtls", "ca-certificates"],
+            error: "mTLS requires at least one entry in 'ca-certificates'"
+        }
+    )
     .refine(
         (resource) => {
             if (isTargetsOnlyResource(resource)) {
@@ -612,7 +659,18 @@ export function isTargetsOnlyResource(resource: any): boolean {
 export const PrivateResourceSchema = z
     .object({
         name: z.string().min(1).max(255),
-        mode: z.enum(["host", "cidr", "http", "ssh", "inference"]),
+        // "exit-node" is accepted as an alias for "gateway" (matches the UI naming)
+        mode: z
+            .enum([
+                "host",
+                "cidr",
+                "http",
+                "ssh",
+                "inference",
+                "gateway",
+                "exit-node"
+            ])
+            .transform((mode) => (mode === "exit-node" ? "gateway" : mode)),
         site: z.string().optional(), // DEPRECATED IN FAVOR OF sites
         sites: z.array(z.string()).optional().default([]),
         // protocol: z.enum(["tcp", "udp"]).optional(),
@@ -652,13 +710,15 @@ export const PrivateResourceSchema = z
     })
     .refine(
         (data) => {
-            // destination is optional only for ssh+native or inference; required for everything else
+            // destination is optional only for ssh+native, inference, or gateway
+            // (gateway always routes the whole subnet, so destination is ignored); required for everything else
             const isNativeSSH =
                 data.mode === "ssh" &&
                 (data["auth-daemon"] === undefined ||
                     data["auth-daemon"].mode === "native");
             if (
                 data.mode !== "inference" &&
+                data.mode !== "gateway" &&
                 !isNativeSSH &&
                 !data.destination
             ) {
@@ -669,7 +729,7 @@ export const PrivateResourceSchema = z
         {
             path: ["destination"],
             message:
-                "destination is required unless mode is 'ssh' with auth-daemon mode 'native', or mode is 'inference'"
+                "destination is required unless mode is 'ssh' with auth-daemon mode 'native', 'inference', or 'gateway'"
         }
     )
     .refine(
@@ -816,25 +876,20 @@ export const ConfigSchema = z
     .object({
         "proxy-resources": z
             .record(z.string(), PublicResourceSchema)
-            .optional()
             .prefault({}),
         "public-resources": z
             .record(z.string(), PublicResourceSchema)
-            .optional()
             .prefault({}),
         "client-resources": z
             .record(z.string(), PrivateResourceSchema)
-            .optional()
             .prefault({}),
         "private-resources": z
             .record(z.string(), PrivateResourceSchema)
-            .optional()
             .prefault({}),
         "public-policies": z
             .record(z.string(), ResourcePolicySchema)
-            .optional()
             .prefault({}),
-        sites: z.record(z.string(), SiteSchema).optional().prefault({})
+        sites: z.record(z.string(), SiteSchema).prefault({})
     })
     .transform((data) => {
         // Merge public-resources into proxy-resources

server/lib/clientIdentities.ts

@@ -0,0 +1,357 @@
+import {
+    clientOrgRoles,
+    clients,
+    clientSiteResourcesAssociationsCache,
+    db,
+    newts,
+    roles,
+    siteNetworks,
+    siteResources,
+    Transaction,
+    userOrgRoles,
+    users
+} from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import { sendToClientsBatch } from "#dynamic/routers/ws";
+import {
+    canCompress,
+    supportsClientIdentities
+} from "@server/lib/clientVersionChecks";
+import logger from "@server/logger";
+
+// Keeps IN (...) lists well under the bound-parameter limits of both
+// Postgres and SQLite when an org has thousands of clients.
+const ID_CHUNK_SIZE = 1000;
+
+function chunk<T>(items: T[]): T[][] {
+    const chunks: T[][] = [];
+    for (let i = 0; i < items.length; i += ID_CHUNK_SIZE) {
+        chunks.push(items.slice(i, i + ID_CHUNK_SIZE));
+    }
+    return chunks;
+}
+
+/**
+ * Identity of a client as seen by newt's HTTP proxy, which turns it into the
+ * same Remote-* headers that Badger sets for public resources. Keyed by the
+ * client's tunnel IP since that is the source address newt sees on requests.
+ * User clients carry the owning user's details; machine clients (no user)
+ * carry the client's name and its machine roles.
+ */
+export type ClientIdentity = {
+    ip: string;
+    userId?: string;
+    username?: string;
+    email?: string;
+    name?: string;
+    role?: string;
+};
+
+/**
+ * Builds the identity for each of the given clients, keyed by clientId.
+ * Clients without a subnet are omitted since newt could never match them.
+ */
+export async function getClientIdentities(
+    clientIds: Iterable<number>,
+    trx: Transaction | typeof db = db
+): Promise<Map<number, ClientIdentity>> {
+    const identities = new Map<number, ClientIdentity>();
+    const uniqueClientIds = Array.from(new Set(clientIds));
+    if (uniqueClientIds.length === 0) {
+        return identities;
+    }
+
+    const clientRows = (
+        await Promise.all(
+            chunk(uniqueClientIds).map((ids) =>
+                trx
+                    .select({
+                        clientId: clients.clientId,
+                        orgId: clients.orgId,
+                        subnet: clients.subnet,
+                        clientName: clients.name,
+                        userId: users.userId,
+                        username: users.username,
+                        email: users.email,
+                        userName: users.name
+                    })
+                    .from(clients)
+                    .leftJoin(users, eq(clients.userId, users.userId))
+                    .where(inArray(clients.clientId, ids))
+            )
+        )
+    ).flat();
+
+    // Roles only matter in the client's own org, so restrict the role
+    // lookups to those orgs rather than every org the users belong to.
+    const orgIds = Array.from(new Set(clientRows.map((c) => c.orgId)));
+    const userIds = Array.from(
+        new Set(
+            clientRows
+                .map((c) => c.userId)
+                .filter((id): id is string => id !== null)
+        )
+    );
+    const machineClientIds = clientRows
+        .filter((c) => c.userId === null)
+        .map((c) => c.clientId);
+
+    const [userRoleRows, clientRoleRows] = await Promise.all([
+        Promise.all(
+            chunk(userIds).map((ids) =>
+                trx
+                    .select({
+                        userId: userOrgRoles.userId,
+                        orgId: userOrgRoles.orgId,
+                        roleName: roles.name
+                    })
+                    .from(userOrgRoles)
+                    .innerJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
+                    .where(
+                        and(
+                            inArray(userOrgRoles.userId, ids),
+                            inArray(userOrgRoles.orgId, orgIds)
+                        )
+                    )
+            )
+        ).then((rows) => rows.flat()),
+        Promise.all(
+            chunk(machineClientIds).map((ids) =>
+                trx
+                    .select({
+                        clientId: clientOrgRoles.clientId,
+                        orgId: clientOrgRoles.orgId,
+                        roleName: roles.name
+                    })
+                    .from(clientOrgRoles)
+                    .innerJoin(roles, eq(clientOrgRoles.roleId, roles.roleId))
+                    .where(inArray(clientOrgRoles.clientId, ids))
+            )
+        ).then((rows) => rows.flat())
+    ]);
+
+    const rolesByUserOrg = new Map<string, string[]>();
+    for (const row of userRoleRows) {
+        const key = `${row.userId}:${row.orgId}`;
+        const list = rolesByUserOrg.get(key) ?? [];
+        list.push(row.roleName);
+        rolesByUserOrg.set(key, list);
+    }
+    const rolesByClientOrg = new Map<string, string[]>();
+    for (const row of clientRoleRows) {
+        const key = `${row.clientId}:${row.orgId}`;
+        const list = rolesByClientOrg.get(key) ?? [];
+        list.push(row.roleName);
+        rolesByClientOrg.set(key, list);
+    }
+
+    for (const row of clientRows) {
+        if (!row.subnet) {
+            continue;
+        }
+        const ip = row.subnet.split("/")[0];
+
+        if (row.userId) {
+            const roleNames = rolesByUserOrg.get(`${row.userId}:${row.orgId}`);
+            identities.set(row.clientId, {
+                ip,
+                userId: row.userId,
+                username: row.username ?? undefined,
+                email: row.email ?? undefined,
+                name: row.userName ?? undefined,
+                role: roleNames?.length ? roleNames.join(", ") : undefined
+            });
+        } else {
+            const roleNames = rolesByClientOrg.get(
+                `${row.clientId}:${row.orgId}`
+            );
+            identities.set(row.clientId, {
+                ip,
+                name: row.clientName,
+                role: roleNames?.length ? roleNames.join(", ") : undefined
+            });
+        }
+    }
+
+    return identities;
+}
+
+/**
+ * Upserts the identities of the given clients on each newt, outside of a full
+ * newt/sync or newt/wg/receive-config. Send this before (or alongside) any
+ * HTTP subnet proxy targets that reference the clients so that the first
+ * proxied request already carries the Remote-* headers.
+ */
+export async function sendClientIdentitiesAdd(
+    entries: {
+        newtId: string;
+        version?: string | null;
+        clientIds: number[];
+    }[],
+    trx: Transaction | typeof db = db
+) {
+    const supported = entries.filter(
+        (e) => e.clientIds.length > 0 && supportsClientIdentities(e.version)
+    );
+    if (supported.length === 0) {
+        return;
+    }
+
+    // Fetched once for all newts; the same clients usually span many sites.
+    const identities = await getClientIdentities(
+        supported.flatMap((e) => e.clientIds),
+        trx
+    );
+
+    const messages = supported
+        .map((entry) => ({
+            entry,
+            data: Array.from(new Set(entry.clientIds))
+                .map((id) => identities.get(id))
+                .filter((i): i is ClientIdentity => i !== undefined)
+        }))
+        .filter(({ data }) => data.length > 0)
+        .map(({ entry, data }) => ({
+            clientId: entry.newtId,
+            message: {
+                type: "newt/wg/client-identities/add",
+                data
+            },
+            options: {
+                incrementConfigVersion: true,
+                compress: canCompress(entry.version, "newt")
+            }
+        }));
+
+    if (messages.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(messages).catch((error) => {
+        logger.warn(`Error sending client identities to newts:`, error);
+    });
+}
+
+/**
+ * Re-pushes the identities of the given clients to the newt of every site
+ * where they can reach an enabled HTTP resource, e.g. after the owning user's
+ * name, email or roles change. Sites where a client only has non-HTTP access
+ * never see its traffic in the HTTP proxy, so they are skipped. Relies on
+ * clientSiteResourcesAssociationsCache being current.
+ */
+export async function pushClientIdentitiesToSites(
+    clientIds: number[],
+    trx: Transaction | typeof db = db
+) {
+    const uniqueClientIds = Array.from(new Set(clientIds));
+    if (uniqueClientIds.length === 0) {
+        return;
+    }
+
+    const rows = (
+        await Promise.all(
+            chunk(uniqueClientIds).map((ids) =>
+                trx
+                    .selectDistinct({
+                        clientId: clientSiteResourcesAssociationsCache.clientId,
+                        newtId: newts.newtId,
+                        version: newts.version
+                    })
+                    .from(clientSiteResourcesAssociationsCache)
+                    .innerJoin(
+                        siteResources,
+                        eq(
+                            siteResources.siteResourceId,
+                            clientSiteResourcesAssociationsCache.siteResourceId
+                        )
+                    )
+                    .innerJoin(
+                        siteNetworks,
+                        eq(siteNetworks.networkId, siteResources.networkId)
+                    )
+                    .innerJoin(newts, eq(newts.siteId, siteNetworks.siteId))
+                    .where(
+                        and(
+                            inArray(
+                                clientSiteResourcesAssociationsCache.clientId,
+                                ids
+                            ),
+                            eq(siteResources.mode, "http"),
+                            eq(siteResources.enabled, true)
+                        )
+                    )
+            )
+        )
+    ).flat();
+
+    const byNewt = new Map<
+        string,
+        { newtId: string; version: string | null; clientIds: number[] }
+    >();
+    for (const row of rows) {
+        let entry = byNewt.get(row.newtId);
+        if (!entry) {
+            entry = { newtId: row.newtId, version: row.version, clientIds: [] };
+            byNewt.set(row.newtId, entry);
+        }
+        entry.clientIds.push(row.clientId);
+    }
+
+    await sendClientIdentitiesAdd(Array.from(byNewt.values()), trx);
+}
+
+/**
+ * Re-pushes the identities of every client owned by the user, e.g. after an
+ * IdP login updates their name or email.
+ */
+export async function pushClientIdentitiesForUser(
+    userId: string,
+    trx: Transaction | typeof db = db
+) {
+    const userClients = await trx
+        .select({ clientId: clients.clientId })
+        .from(clients)
+        .where(eq(clients.userId, userId));
+
+    await pushClientIdentitiesToSites(
+        userClients.map((c) => c.clientId),
+        trx
+    );
+}
+
+/**
+ * Re-pushes the identities of every client holding the role, either through
+ * the owning user or directly as a machine client, e.g. after a role rename.
+ */
+export async function pushClientIdentitiesForRole(
+    roleId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+) {
+    const [userClients, machineClients] = await Promise.all([
+        // Driven from the org's clients so the join can use userOrgRoles'
+        // (userId, orgId, roleId) unique index; userOrgRoles has no index on
+        // roleId alone.
+        trx
+            .select({ clientId: clients.clientId })
+            .from(clients)
+            .innerJoin(
+                userOrgRoles,
+                and(
+                    eq(userOrgRoles.userId, clients.userId),
+                    eq(userOrgRoles.orgId, clients.orgId),
+                    eq(userOrgRoles.roleId, roleId)
+                )
+            )
+            .where(eq(clients.orgId, orgId)),
+        trx
+            .select({ clientId: clientOrgRoles.clientId })
+            .from(clientOrgRoles)
+            .where(eq(clientOrgRoles.roleId, roleId))
+    ]);
+
+    await pushClientIdentitiesToSites(
+        [...userClients, ...machineClients].map((c) => c.clientId),
+        trx
+    );
+}

server/lib/clientVersionChecks.ts

@@ -34,3 +34,18 @@ export function supportsCertReferences(
         return false;
     }
 }
+
+// Whether this newt client understands newt/wg/client-identities/add, used to
+// set Remote-* headers on requests through its HTTP proxy. Bump the version
+// floor here to match whatever release first ships the newt-side support.
+export function supportsClientIdentities(
+    clientVersion: string | null | undefined
+): boolean {
+    try {
+        if (!clientVersion) return false;
+        if (!semver.valid(clientVersion)) return false;
+        return semver.gte(clientVersion, "1.19.0");
+    } catch {
+        return false;
+    }
+}

server/lib/consts.ts

@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.23.0";
+export const APP_VERSION = "1.24.0";
 
 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);

server/lib/deleteSiteAssociatedResources.ts

@@ -17,7 +17,6 @@ import {
     performDeleteSiteResources,
     runSiteResourceDeleteSideEffects
 } from "@server/lib/deleteSiteResource";
-import logger from "@server/logger";
 
 export const MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE = 250;
 

server/lib/exitNodes/exitNodes.ts

@@ -36,6 +36,7 @@ export async function listExitNodes(
             endpoint: exitNodes.endpoint,
             publicKey: exitNodes.publicKey,
             listenPort: exitNodes.listenPort,
+            relayPort: exitNodes.relayPort,
             reachableAt: exitNodes.reachableAt,
             maxConnections: exitNodes.maxConnections,
             online: exitNodes.online,

server/lib/ip.ts

@@ -500,6 +500,7 @@ export function generateRemoteSubnets(
             if (!sr.enabled) return false;
             if (!sr.destination) return false;
 
+            // we purposely filter out the gateway resource here because we add it manually on the client
             if (sr.mode === "cidr") {
                 // check if its a valid CIDR using zod
                 const cidrSchema = z.union([z.cidrv4(), z.cidrv6()]);
@@ -808,7 +809,7 @@ export async function generateSubnetProxyTargetV2(
                 resourceId: siteResource.siteResourceId
             });
         }
-    } else if (siteResource.mode == "cidr") {
+    } else if (siteResource.mode == "cidr" || siteResource.mode == "gateway") {
         targets.push({
             sourcePrefixes: [],
             destPrefix: siteResource.destination!,

server/lib/mtlsCertificate.ts

@@ -0,0 +1,61 @@
+import { X509Certificate } from "crypto";
+
+export const MAX_MTLS_CERTIFICATES_PER_RESOURCE = 20;
+
+export type ParsedCaCertificate = {
+    certificate: string;
+    subject: string;
+    issuer: string;
+    serialNumber: string;
+    fingerprint: string;
+    notBefore: number;
+    notAfter: number;
+};
+
+const PEM_CERTIFICATE_REGEX =
+    /-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g;
+
+// Certificate subjects/issuers come back as newline-separated "CN=foo\nO=bar";
+// flatten to a single readable line for storage and display.
+function flattenDn(dn: string): string {
+    return dn.split("\n").join(", ");
+}
+
+/**
+ * Parses one or more PEM-encoded CA certificates (a bundle is split into its
+ * individual certificates). Throws an Error with a user-presentable message
+ * if the input is not a valid certificate or looks like a private key.
+ */
+export function parseCaCertificates(input: string): ParsedCaCertificate[] {
+    if (/PRIVATE KEY/.test(input)) {
+        throw new Error(
+            "This looks like a private key, not a certificate. Upload the CA's public certificate only."
+        );
+    }
+
+    const blocks = input.match(PEM_CERTIFICATE_REGEX);
+    if (!blocks || blocks.length === 0) {
+        throw new Error(
+            "Invalid certificate: no PEM-encoded certificate found. Expected a block starting with -----BEGIN CERTIFICATE-----."
+        );
+    }
+
+    return blocks.map((block) => {
+        let cert: X509Certificate;
+        try {
+            cert = new X509Certificate(block);
+        } catch {
+            throw new Error("Invalid certificate: could not parse PEM.");
+        }
+
+        return {
+            certificate: block.trim() + "\n",
+            subject: flattenDn(cert.subject),
+            issuer: flattenDn(cert.issuer),
+            serialNumber: cert.serialNumber,
+            fingerprint: cert.fingerprint256,
+            notBefore: new Date(cert.validFrom).getTime(),
+            notAfter: new Date(cert.validTo).getTime()
+        };
+    });
+}

server/lib/offlineThresholds.ts

@@ -0,0 +1,26 @@
+export type OfflineThresholds = {
+    // how often the offline checkers run
+    checkIntervalMs: number;
+    // newt sites that stop pinging for this long are marked offline
+    newtMs: number;
+    // wireguard sites with no bandwidth update for this long are marked offline
+    newtWireguardMs: number;
+    // olm clients that stop pinging for this long are marked offline
+    olmMs: number;
+    // remote exit nodes that stop pinging for this long are marked offline
+    remoteExitNodeMs: number;
+};
+
+export const DEFAULT_OFFLINE_THRESHOLDS: OfflineThresholds = {
+    checkIntervalMs: 30 * 1000, // 30 seconds
+    newtMs: 2 * 60 * 1000, // 2 minutes
+    newtWireguardMs: 8 * 60 * 1000, // 8 minutes
+    olmMs: 2 * 60 * 1000, // 2 minutes
+    remoteExitNodeMs: 2 * 60 * 1000 // 2 minutes
+};
+
+// The thresholds are only configurable in the private config file, so the
+// open build always uses the defaults. See server/private/lib/offlineThresholds.ts
+export function getOfflineThresholds(): OfflineThresholds {
+    return DEFAULT_OFFLINE_THRESHOLDS;
+}

server/lib/pathMatch.ts

@@ -1,18 +1,37 @@
-const MAX_RECURSION_DEPTH = 100;
+// Matches a single segment against a glob where `*` matches any run of
+// characters and `?` matches exactly one. Greedy two-pointer matching that
+// only ever backtracks to the most recent `*`, so it runs in
+// O(pattern * text) worst case. Compiling to a `.*` regex instead
+// backtracks catastrophically on patterns like `*a*a*a*a*b`.
+function matchSegmentGlob(pattern: string, text: string): boolean {
+    let p = 0;
+    let t = 0;
+    let starP = -1;
+    let starT = 0;
 
-const segmentRegexCache = new Map<string, RegExp>();
-
-function getSegmentRegex(patternPart: string): RegExp {
-    let regex = segmentRegexCache.get(patternPart);
-    if (!regex) {
-        const regexPattern = patternPart
-            .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-            .replace(/\*/g, ".*")
-            .replace(/\?/g, ".");
-        regex = new RegExp(`^${regexPattern}$`);
-        segmentRegexCache.set(patternPart, regex);
+    while (t < text.length) {
+        if (p < pattern.length && pattern[p] === "*") {
+            starP = p++;
+            starT = t;
+        } else if (
+            p < pattern.length &&
+            (pattern[p] === "?" || pattern[p] === text[t])
+        ) {
+            p++;
+            t++;
+        } else if (starP !== -1) {
+            // let the last `*` swallow one more character and retry
+            p = starP + 1;
+            t = ++starT;
+        } else {
+            return false;
+        }
     }
-    return regex;
+
+    while (p < pattern.length && pattern[p] === "*") {
+        p++;
+    }
+    return p === pattern.length;
 }
 
 // Decodes percent-encoding (so an encoded slash like `%2F` is treated as a
@@ -56,55 +75,40 @@ export function isPathAllowed(pattern: string, path: string): boolean {
     const patternParts = decodeAndResolvePath(pattern);
     const pathParts = decodeAndResolvePath(path);
 
-    function matchSegments(
-        patternIndex: number,
-        pathIndex: number,
-        depth: number = 0
-    ): boolean {
-        if (depth > MAX_RECURSION_DEPTH) {
-            return false;
-        }
+    // Iterative dynamic-programming matcher. The previous recursive
+    // implementation forked on every bare `*`, which backtracked
+    // exponentially and let an unauthenticated path rule pin the event loop.
+    // `dp[i][j]` is true when patternParts[i..] matches pathParts[j..].
+    const m = patternParts.length;
+    const n = pathParts.length;
+    const dp: boolean[][] = Array.from({ length: m + 1 }, () =>
+        new Array<boolean>(n + 1).fill(false)
+    );
 
-        const currentPatternPart = patternParts[patternIndex];
-        const currentPathPart = pathParts[pathIndex];
-
-        if (patternIndex >= patternParts.length) {
-            return pathIndex >= pathParts.length;
-        }
-
-        if (pathIndex >= pathParts.length) {
-            return patternParts.slice(patternIndex).every((p) => p === "*");
-        }
-
-        if (currentPatternPart === "*") {
-            if (matchSegments(patternIndex + 1, pathIndex, depth + 1)) {
-                return true;
-            }
-            if (matchSegments(patternIndex, pathIndex + 1, depth + 1)) {
-                return true;
-            }
-            return false;
-        }
-
-        if (currentPatternPart.includes("*")) {
-            const regex = getSegmentRegex(currentPatternPart);
-
-            if (regex.test(currentPathPart)) {
-                return matchSegments(
-                    patternIndex + 1,
-                    pathIndex + 1,
-                    depth + 1
-                );
-            }
-            return false;
-        }
-
-        if (currentPatternPart !== currentPathPart) {
-            return false;
-        }
-
-        return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
+    dp[m][n] = true;
+    for (let j = 0; j < n; j++) {
+        dp[m][j] = false;
+    }
+    for (let i = m - 1; i >= 0; i--) {
+        dp[i][n] = patternParts.slice(i).every((p) => p === "*");
     }
 
-    return matchSegments(0, 0, 0);
+    for (let i = m - 1; i >= 0; i--) {
+        const currentPatternPart = patternParts[i];
+        for (let j = n - 1; j >= 0; j--) {
+            if (currentPatternPart === "*") {
+                // match zero segments, or consume one path segment
+                dp[i][j] = dp[i + 1][j] || dp[i][j + 1];
+            } else if (currentPatternPart.includes("*")) {
+                dp[i][j] =
+                    dp[i + 1][j + 1] &&
+                    matchSegmentGlob(currentPatternPart, pathParts[j]);
+            } else {
+                dp[i][j] =
+                    currentPatternPart === pathParts[j] && dp[i + 1][j + 1];
+            }
+        }
+    }
+
+    return dp[0][0];
 }

server/lib/readConfigFile.ts

@@ -149,6 +149,8 @@ export const configSchema = z
                     })
                     .optional(),
                 trust_proxy: z.int().gte(0).optional().default(1),
+                trust_ips: z.array(z.string()).optional().default([]),
+                custom_ip_header: z.string().optional().default(""),
                 // Opt-in: have Traefik/Badger stamp the resolved client IP
                 // into a dedicated header (X-Pangolin-Client-Ip) on the
                 // site-resource AI gateway route, so it survives an
@@ -174,36 +176,7 @@ export const configSchema = z
                 maxmind_db_path: z.string().optional(),
                 maxmind_asn_path: z.string().optional()
             })
-            .optional()
-            .default({
-                integration_port: 3003,
-                external_port: 3000,
-                internal_port: 3001,
-                ai_gateway_port: 3005,
-                next_port: 3002,
-                internal_hostname: "pangolin",
-                session_cookie_name: "p_session_token",
-                resource_access_token_param: "p_token",
-                resource_access_token_headers: {
-                    id: "P-Access-Token-Id",
-                    token: "P-Access-Token"
-                },
-                remote_headers: {
-                    user_id: "Remote-User-Id",
-                    virtual_api_key_id: "Remote-Virtual-Api-Key-Id",
-                    user: "Remote-User",
-                    email: "Remote-Email",
-                    name: "Remote-Name",
-                    role: "Remote-Role"
-                },
-                resource_session_request_param:
-                    "resource_session_request_param",
-                dashboard_session_length_hours: 720,
-                resource_session_length_hours: 720,
-                trust_proxy: 1,
-                enable_ai_gateway_client_ip_header: false,
-                secret: undefined
-            }),
+            .prefault({}),
         postgres: z
             .object({
                 connection_string: z.string().optional(),

server/lib/rebuildClientAssociations.ts

@@ -1,5 +1,6 @@
 import {
     Client,
+    clientOrgRoles,
     clients,
     clientSiteResources,
     clientSiteResourcesAssociationsCache,
@@ -17,11 +18,16 @@ import {
     sites,
     Transaction,
     userOrgRoles,
-    userSiteResources
+    userSiteResources,
+    orgs
 } from "@server/db";
 import { and, count, eq, inArray, isNotNull, ne } from "drizzle-orm";
 
 import { deletePeersBatch as newtDeletePeersBatch } from "@server/routers/newt/peers";
+import {
+    sendGatewayDisable,
+    sendGatewaySitesUpdate
+} from "@server/routers/olm/gateway";
 import {
     initPeerAddHandshakeBatch,
     deletePeersBatch as olmDeletePeersBatch
@@ -29,7 +35,6 @@ import {
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import { sendToClientsBatch } from "#dynamic/routers/ws";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import config from "@server/lib/config";
 import logger from "@server/logger";
 import {
     generateAliasConfig,
@@ -46,6 +51,10 @@ import {
     updatePeerDataBatch,
     updateTargets
 } from "@server/routers/client/targets";
+import {
+    pushClientIdentitiesToSites,
+    sendClientIdentitiesAdd
+} from "@server/lib/clientIdentities";
 import { lockManager } from "#dynamic/lib/lock";
 import { rebuildQueue } from "#dynamic/lib/rebuildQueue";
 import { withRetry, isTransientError } from "@server/lib/dbRetry";
@@ -234,7 +243,8 @@ export async function getClientSiteResourceAccess(
         .select({
             clientId: clients.clientId,
             pubKey: clients.pubKey,
-            subnet: clients.subnet
+            subnet: clients.subnet,
+            orgId: clients.orgId
         })
         .from(clients)
         .where(
@@ -251,16 +261,38 @@ export async function getClientSiteResourceAccess(
             eq(clientSiteResources.siteResourceId, siteResource.siteResourceId)
         );
 
-    const directClientIds = allClientSiteResources.map((row) => row.clientId);
+    // clients (machines) that get access through a role assigned directly to
+    // the client instead of through a user
+    const roleClientIds =
+        roleIds.length > 0
+            ? await trx
+                  .select({ clientId: clientOrgRoles.clientId })
+                  .from(clientOrgRoles)
+                  .where(
+                      and(
+                          inArray(clientOrgRoles.roleId, roleIds),
+                          eq(clientOrgRoles.orgId, siteResource.orgId)
+                      )
+                  )
+                  .then((rows) => rows.map((row) => row.clientId))
+            : [];
 
-    // Get full client details for directly associated clients
+    const directClientIds = Array.from(
+        new Set([
+            ...allClientSiteResources.map((row) => row.clientId),
+            ...roleClientIds
+        ])
+    );
+
+    // Get full client details for directly and client-role associated clients
     const directClients =
         directClientIds.length > 0
             ? await trx
                   .select({
                       clientId: clients.clientId,
                       pubKey: clients.pubKey,
-                      subnet: clients.subnet
+                      subnet: clients.subnet,
+                      orgId: clients.orgId
                   })
                   .from(clients)
                   .where(
@@ -279,7 +311,7 @@ export async function getClientSiteResourceAccess(
     const mergedAllClientIds = mergedAllClients.map((c) => c.clientId);
 
     logger.debug(
-        `rebuildClientAssociations: [getClientSiteResourceAccess] siteResourceId=${siteResource.siteResourceId} mergedClientCount=${mergedAllClientIds.length} clientIds=[${mergedAllClientIds.join(", ")}] (userBased=${newAllClients.length} direct=${directClients.length})`
+        `rebuildClientAssociations: [getClientSiteResourceAccess] siteResourceId=${siteResource.siteResourceId} mergedClientCount=${mergedAllClientIds.length} clientIds=[${mergedAllClientIds.join(", ")}] (userBased=${newAllClients.length} direct=${directClients.length} clientRoleBased=${roleClientIds.length})`
     );
 
     return {
@@ -463,7 +495,8 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                   .select({
                       clientId: clients.clientId,
                       pubKey: clients.pubKey,
-                      subnet: clients.subnet
+                      subnet: clients.subnet,
+                      orgId: clients.orgId
                   })
                   .from(clients)
                   .where(
@@ -532,6 +565,19 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
             );
     }
 
+    // A client that loses access to a gateway resource (it was deleted, or the
+    // client's roles/users/machines no longer include it) can't keep using it
+    // as its gateway. The olm ignores this unless it selected this resource.
+    if (
+        siteResource.mode === "gateway" &&
+        clientSiteResourcesToRemove.length > 0
+    ) {
+        await sendGatewayDisable(
+            clientSiteResourcesToRemove,
+            siteResource.siteResourceId
+        );
+    }
+
     /////////// process the client-site associations ///////////
 
     logger.debug(
@@ -568,7 +614,8 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                           .select({
                               clientId: clients.clientId,
                               pubKey: clients.pubKey,
-                              subnet: clients.subnet
+                              subnet: clients.subnet,
+                              orgId: clients.orgId
                           })
                           .from(clients)
                           .where(
@@ -720,11 +767,13 @@ async function handleMessagesForSiteClients(
         clientId: number;
         pubKey: string | null;
         subnet: string | null;
+        orgId: string;
     }[],
     existingClients: {
         clientId: number;
         pubKey: string | null;
         subnet: string | null;
+        orgId: string;
     }[],
     clientSitesToAdd: number[],
     clientSitesToRemove: number[],
@@ -792,6 +841,7 @@ async function handleMessagesForSiteClients(
             siteId: number;
             exitNode: {
                 publicKey: string;
+                relayPort: number;
                 endpoint: string;
             };
         };
@@ -805,6 +855,7 @@ async function handleMessagesForSiteClients(
             clientId: number;
             pubKey: string | null;
             subnet: string | null;
+            orgId: string;
         }
     >();
 
@@ -860,6 +911,22 @@ async function handleMessagesForSiteClients(
             .map((r) => [r.clientId as number, r.olmId])
     );
 
+    // Batch-fetch the orgs for all clients we need to process so we don't
+    // issue a redundant query per client in the loop below
+    const orgIdsToProcess = Array.from(
+        new Set(
+            Array.from(clientsToProcess.values()).map((client) => client.orgId)
+        )
+    );
+    const orgRows =
+        orgIdsToProcess.length > 0
+            ? await trx
+                  .select()
+                  .from(orgs)
+                  .where(inArray(orgs.orgId, orgIdsToProcess))
+            : [];
+    const orgByOrgId = new Map(orgRows.map((org) => [org.orgId, org]));
+
     for (const client of clientsToProcess.values()) {
         // UPDATE THE NEWT
         if (!client.subnet || !client.pubKey) {
@@ -899,7 +966,14 @@ async function handleMessagesForSiteClients(
         }
 
         if (isAdd) {
-            if (clientSiteCounts[client.clientId] > 250) {
+            const org = orgByOrgId.get(client.orgId);
+
+            if (!org) {
+                logger.warn(`Client ${client.clientId} org not found`);
+                continue;
+            }
+
+            if (clientSiteCounts[client.clientId] > org.settingsJitModeLimit) {
                 // skip adding the peer if we have more than 250 sites because we are in jit mode anyway
                 logger.info(
                     `rebuildClientAssociations: Client ${client.clientId} has ${clientSiteCounts[client.clientId]} sites so skipping adding peer to newt and olm because it is likely in jit mode`
@@ -913,6 +987,7 @@ async function handleMessagesForSiteClients(
                     siteId,
                     exitNode: {
                         publicKey: exitNode.publicKey,
+                        relayPort: exitNode.relayPort,
                         endpoint: exitNode.endpoint
                     }
                 },
@@ -1190,8 +1265,6 @@ async function syncClientExitNodeConnections(
             .map((r) => [r.clientId as number, r])
     );
 
-    const relayPort = config.getRawConfig().gerbil.clients_start_port;
-
     const connectPayloads: {
         clientId: string;
         message: { type: string; data: any };
@@ -1230,7 +1303,7 @@ async function syncClientExitNodeConnections(
                     data: {
                         connect: true,
                         endpoint: `${exitNode.endpoint}:${exitNode.listenPort}`,
-                        relayPort,
+                        relayPort: exitNode.relayPort,
                         publicKey: exitNode.publicKey,
                         serverIP: exitNode.address.split("/")[0],
                         tunnelIP: client.exitNodeSubnet.split("/")[0],
@@ -1368,6 +1441,8 @@ async function handleSubnetProxyTargetUpdates(
         >;
         version: string | null;
     }[] = [];
+    const identitiesToAddBatch: Parameters<typeof sendClientIdentitiesAdd>[0] =
+        [];
 
     for (const siteData of sitesList) {
         const siteId = siteData.siteId;
@@ -1404,6 +1479,14 @@ async function handleSubnetProxyTargetUpdates(
                         targets: targetsToAdd,
                         version: newt.version
                     });
+
+                    if (siteResource.mode === "http") {
+                        identitiesToAddBatch.push({
+                            newtId: newt.newtId,
+                            version: newt.version,
+                            clientIds: addedClients.map((c) => c.clientId)
+                        });
+                    }
                 }
 
                 olmJobs.push(
@@ -1512,6 +1595,10 @@ async function handleSubnetProxyTargetUpdates(
         }
     }
 
+    // Identities first so the HTTP proxy never serves an added client
+    // without its Remote-* headers.
+    await sendClientIdentitiesAdd(identitiesToAddBatch, trx);
+
     if (targetsToAddBatch.length > 0) {
         proxyJobs.push(addSubnetProxyTargetsBatch(targetsToAddBatch));
     }
@@ -1570,7 +1657,8 @@ export async function handleMessagingForUpdatedSiteResource(
         .select({
             clientId: clientSiteResourcesAssociationsCache.clientId,
             pubKey: clients.pubKey,
-            subnet: clients.subnet
+            subnet: clients.subnet,
+            orgId: clients.orgId
         })
         .from(clientSiteResourcesAssociationsCache)
         .innerJoin(
@@ -1597,6 +1685,28 @@ export async function handleMessagingForUpdatedSiteResource(
         `handleMessagingForUpdatedSiteResource: generated updated targets count=${targets ? targets.length : 0}`
     );
 
+    // Make sure sites newly serving this resource over HTTP know the identity
+    // of each client that can reach it before targets are sent below. Sites
+    // that already served it over HTTP got them when the clients were added,
+    // so plain edits of an HTTP resource send nothing here.
+    if (targets && updatedSiteResource.mode === "http") {
+        const identitySiteIds =
+            existingSiteResource?.mode === "http"
+                ? updatedSiteIds.filter((id) => !existingSiteIds.includes(id))
+                : updatedSiteIds;
+        await sendClientIdentitiesAdd(
+            identitySiteIds
+                .map((siteId) => newtBySiteId.get(siteId))
+                .filter((newt) => newt !== undefined)
+                .map((newt) => ({
+                    newtId: newt.newtId,
+                    version: newt.version,
+                    clientIds: mergedAllClients.map((c) => c.clientId)
+                })),
+            trx
+        );
+    }
+
     const oldDestinationStillInUseClientSitePairs = new Set<string>();
     if (
         existingSiteResource?.destination &&
@@ -2024,6 +2134,29 @@ export async function handleMessagingForUpdatedSiteResource(
         );
     }
 
+    // The olm only knows which gateway resource it selected and the sites it
+    // is currently using for it, so tell the clients that have access to this
+    // one what changed. Clients that lost access are handled by the rebuild.
+    if (existingSiteResource?.mode === "gateway") {
+        const clientIds = mergedAllClients.map((c) => c.clientId);
+        if (
+            updatedSiteResource.mode !== "gateway" ||
+            !updatedSiteResource.enabled
+        ) {
+            await sendGatewayDisable(
+                clientIds,
+                updatedSiteResource.siteResourceId
+            );
+        } else {
+            await sendGatewaySitesUpdate(
+                clientIds,
+                updatedSiteResource.siteResourceId,
+                addedSiteIds,
+                removedSiteIds
+            );
+        }
+    }
+
     logger.debug(
         `handleMessagingForUpdatedSiteResource: DONE siteResourceId=${updatedSiteResource.siteResourceId}`
     );
@@ -2078,11 +2211,16 @@ export async function rebuildClientAssociationsFromClient(
     }
 }
 
-async function rebuildClientAssociationsFromClientImpl(
+// Derives the set of site resources a client should have access to from its
+// permissions: direct client associations, the owning user's direct and
+// role-based associations, and roles assigned directly to the client
+// (machine clients). Shared by the rebuild and the cache verification so they
+// can't drift apart.
+async function getClientSiteResourceIds(
     client: Client,
     trx: Transaction | typeof db = db
-): Promise<void> {
-    let newSiteResourceIds: number[] = [];
+): Promise<number[]> {
+    const newSiteResourceIds: number[] = [];
 
     // 1. Direct client associations
     const directSiteResources = await trx
@@ -2103,7 +2241,20 @@ async function rebuildClientAssociationsFromClientImpl(
         ...directSiteResources.map((r) => r.siteResourceId)
     );
 
-    // 2. User-based and role-based access (if client has a userId)
+    // 2. Roles assigned directly to the client (machine clients). These are
+    // locked onto this org or else cross-org access could happen
+    const roleIds = await trx
+        .select({ roleId: clientOrgRoles.roleId })
+        .from(clientOrgRoles)
+        .where(
+            and(
+                eq(clientOrgRoles.clientId, client.clientId),
+                eq(clientOrgRoles.orgId, client.orgId)
+            )
+        )
+        .then((rows) => rows.map((row) => row.roleId));
+
+    // 3. User-based and user role-based access (if client has a userId)
     if (client.userId) {
         // Direct user associations
         const userSiteResourceIds = await trx
@@ -2127,8 +2278,7 @@ async function rebuildClientAssociationsFromClientImpl(
             ...userSiteResourceIds.map((r) => r.siteResourceId)
         );
 
-        // Role-based access
-        const roleIds = await trx
+        const userRoleIds = await trx
             .select({ roleId: userOrgRoles.roleId })
             .from(userOrgRoles)
             .where(
@@ -2139,32 +2289,45 @@ async function rebuildClientAssociationsFromClientImpl(
             ) // this needs to be locked onto this org or else cross-org access could happen
             .then((rows) => rows.map((row) => row.roleId));
 
-        if (roleIds.length > 0) {
-            const roleSiteResourceIds = await trx
-                .select({ siteResourceId: roleSiteResources.siteResourceId })
-                .from(roleSiteResources)
-                .innerJoin(
-                    siteResources,
-                    eq(
-                        siteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    and(
-                        inArray(roleSiteResources.roleId, roleIds),
-                        eq(siteResources.orgId, client.orgId) // filter by org to prevent cross-org associations
-                    )
-                );
+        roleIds.push(...userRoleIds);
+    }
 
-            newSiteResourceIds.push(
-                ...roleSiteResourceIds.map((r) => r.siteResourceId)
+    // Role-based access (client roles and user roles)
+    if (roleIds.length > 0) {
+        const roleSiteResourceIds = await trx
+            .select({ siteResourceId: roleSiteResources.siteResourceId })
+            .from(roleSiteResources)
+            .innerJoin(
+                siteResources,
+                eq(
+                    siteResources.siteResourceId,
+                    roleSiteResources.siteResourceId
+                )
+            )
+            .where(
+                and(
+                    inArray(
+                        roleSiteResources.roleId,
+                        Array.from(new Set(roleIds))
+                    ),
+                    eq(siteResources.orgId, client.orgId) // filter by org to prevent cross-org associations
+                )
             );
-        }
+
+        newSiteResourceIds.push(
+            ...roleSiteResourceIds.map((r) => r.siteResourceId)
+        );
     }
 
     // Remove duplicates
-    newSiteResourceIds = Array.from(new Set(newSiteResourceIds));
+    return Array.from(new Set(newSiteResourceIds));
+}
+
+async function rebuildClientAssociationsFromClientImpl(
+    client: Client,
+    trx: Transaction | typeof db = db
+): Promise<void> {
+    const newSiteResourceIds = await getClientSiteResourceIds(client, trx);
 
     // Get full siteResource details
     const newSiteResources =
@@ -2294,6 +2457,15 @@ async function rebuildClientAssociationsFromClientImpl(
 
     /////////// Send messages ///////////
 
+    // Push this client's identity to every site where it can reach an HTTP
+    // resource before any targets referencing it, so newt's HTTP proxy can
+    // set Remote-* headers from the first request. Also refreshes it after
+    // role changes, which land here as well. Skipped outright for clients
+    // without HTTP access, which is the common case.
+    if (newSiteResources.some((r) => r.mode === "http" && r.enabled)) {
+        await pushClientIdentitiesToSites([client.clientId], trx);
+    }
+
     // Handle messages for sites being added
     await handleMessagesForClientSites(client, sitesToAdd, sitesToRemove, trx);
 
@@ -2379,6 +2551,7 @@ async function handleMessagesForClientSites(
             siteId: number;
             exitNode: {
                 publicKey: string;
+                relayPort: number;
                 endpoint: string;
             };
         };
@@ -2391,6 +2564,19 @@ async function handleMessagesForClientSites(
         .where(eq(clientSitesAssociationsCache.clientId, client.clientId))
         .then((rows) => Number(rows[0].count));
 
+    // client.orgId is constant for this call, so fetch the org once
+    // instead of re-querying it for every site in the loop below
+    const [org] = await trx
+        .select()
+        .from(orgs)
+        .where(eq(orgs.orgId, client.orgId))
+        .limit(1);
+
+    if (!org) {
+        logger.warn(`Client ${client.clientId} org not found`);
+        return;
+    }
+
     for (const siteData of sitesData) {
         const site = siteData.sites;
         const exitNode = siteData.exitNodes;
@@ -2451,7 +2637,7 @@ async function handleMessagesForClientSites(
                 continue;
             }
 
-            if (totalSitesOnClient > 250) {
+            if (totalSitesOnClient > org.settingsJitModeLimit) {
                 // skip adding the site if we have more than 250 because we are in jit mode anyway
                 logger.info(
                     `rebuildClientAssociations: Client ${client.clientId} has ${totalSitesOnClient} sites so skipping adding peer to newt and olm because it is likely in jit mode`
@@ -2465,6 +2651,7 @@ async function handleMessagesForClientSites(
                     siteId: site.siteId,
                     exitNode: {
                         publicKey: exitNode.publicKey,
+                        relayPort: exitNode.relayPort,
                         endpoint: exitNode.endpoint
                     }
                 },
@@ -2861,86 +3048,7 @@ export async function verifyClientAssociationsCache(
     client: Client,
     trx: Transaction | typeof db = db
 ): Promise<ClientAssociationsCacheVerification> {
-    let newSiteResourceIds: number[] = [];
-
-    // 1. Direct client associations
-    const directSiteResources = await trx
-        .select({ siteResourceId: clientSiteResources.siteResourceId })
-        .from(clientSiteResources)
-        .innerJoin(
-            siteResources,
-            eq(siteResources.siteResourceId, clientSiteResources.siteResourceId)
-        )
-        .where(
-            and(
-                eq(clientSiteResources.clientId, client.clientId),
-                eq(siteResources.orgId, client.orgId)
-            )
-        );
-
-    newSiteResourceIds.push(
-        ...directSiteResources.map((r) => r.siteResourceId)
-    );
-
-    // 2. User-based and role-based access (if client has a userId)
-    if (client.userId) {
-        const userSiteResourceIds = await trx
-            .select({ siteResourceId: userSiteResources.siteResourceId })
-            .from(userSiteResources)
-            .innerJoin(
-                siteResources,
-                eq(
-                    siteResources.siteResourceId,
-                    userSiteResources.siteResourceId
-                )
-            )
-            .where(
-                and(
-                    eq(userSiteResources.userId, client.userId),
-                    eq(siteResources.orgId, client.orgId)
-                )
-            );
-
-        newSiteResourceIds.push(
-            ...userSiteResourceIds.map((r) => r.siteResourceId)
-        );
-
-        const roleIds = await trx
-            .select({ roleId: userOrgRoles.roleId })
-            .from(userOrgRoles)
-            .where(
-                and(
-                    eq(userOrgRoles.userId, client.userId),
-                    eq(userOrgRoles.orgId, client.orgId)
-                )
-            )
-            .then((rows) => rows.map((row) => row.roleId));
-
-        if (roleIds.length > 0) {
-            const roleSiteResourceIds = await trx
-                .select({ siteResourceId: roleSiteResources.siteResourceId })
-                .from(roleSiteResources)
-                .innerJoin(
-                    siteResources,
-                    eq(
-                        siteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    and(
-                        inArray(roleSiteResources.roleId, roleIds),
-                        eq(siteResources.orgId, client.orgId)
-                    )
-                );
-
-            newSiteResourceIds.push(
-                ...roleSiteResourceIds.map((r) => r.siteResourceId)
-            );
-        }
-    }
-
-    newSiteResourceIds = Array.from(new Set(newSiteResourceIds));
+    const newSiteResourceIds = await getClientSiteResourceIds(client, trx);
 
     const newSiteResources =
         newSiteResourceIds.length > 0
@@ -3061,7 +3169,8 @@ export async function cleanupSiteAssociations(
                   .select({
                       clientId: clients.clientId,
                       pubKey: clients.pubKey,
-                      subnet: clients.subnet
+                      subnet: clients.subnet,
+                      orgId: clients.orgId
                   })
                   .from(clients)
                   .where(inArray(clients.clientId, cachedClientIds))

server/lib/traefik/TraefikConfigManager.ts

@@ -297,7 +297,7 @@ export class TraefikConfigManager {
                     const secondsUntilExpiry =
                         localState.expiresAt - nowInSeconds;
                     const daysUntilExpiry = secondsUntilExpiry / (60 * 60 * 24);
-                    if (daysUntilExpiry < 45) {
+                    if (daysUntilExpiry < 15) {
                         logger.info(
                             `Fetching certificates due to upcoming expiry for ${domain} (${Math.round(daysUntilExpiry)} days remaining)`
                         );
@@ -314,7 +314,7 @@ export class TraefikConfigManager {
                     const nowInSeconds = Math.floor(Date.now() / 1000);
                     const secondsUntilExpiry = state.expiresAt - nowInSeconds;
                     const daysUntilExpiry = secondsUntilExpiry / (60 * 60 * 24);
-                    if (daysUntilExpiry < 45) {
+                    if (daysUntilExpiry < 15) {
                         logger.info(
                             `Fetching certificates due to upcoming expiry for wildcard cert ${certDomain} (${Math.round(daysUntilExpiry)} days remaining)`
                         );

server/lib/traefik/getTraefikConfig.ts

@@ -42,6 +42,7 @@ import { buildWildcardTls } from "./certResolver";
 import { buildCustomHeadersMiddleware } from "./headersMiddleware";
 import {
     buildHttpLoadBalancerServers,
+    buildLoadBalancingStrategy,
     buildStickySessionCookie,
     buildStickySessionIp,
     buildTcpUdpLoadBalancerServers
@@ -95,6 +96,7 @@ export async function getTraefikConfig(
             domainId: resources.domainId,
             enabled: resources.enabled,
             stickySession: resources.stickySession,
+            loadBalancingStrategy: resources.loadBalancingStrategy,
             tlsServerName: resources.tlsServerName,
             setHostHeader: resources.setHostHeader,
             enableProxy: resources.enableProxy,
@@ -225,6 +227,7 @@ export async function getTraefikConfig(
                 domainId: row.domainId,
                 enabled: row.enabled,
                 stickySession: row.stickySession,
+                loadBalancingStrategy: row.loadBalancingStrategy,
                 tlsServerName: row.tlsServerName,
                 setHostHeader: row.setHostHeader,
                 enableProxy: row.enableProxy,
@@ -542,6 +545,9 @@ export async function getTraefikConfig(
             config_output.http.services![serviceName] = {
                 loadBalancer: {
                     servers: buildHttpLoadBalancerServers(targets),
+                    ...buildLoadBalancingStrategy(
+                        resource.loadBalancingStrategy
+                    ),
                     ...(resource.stickySession
                         ? buildStickySessionCookie(resource.ssl)
                         : {})

server/lib/traefik/loadBalancer.test.ts

@@ -0,0 +1,100 @@
+import "@server/extendZod";
+import { assertEqualsObj } from "@test/assert";
+import {
+    buildHttpLoadBalancerServers,
+    buildLoadBalancingStrategy,
+    buildTcpUdpLoadBalancerServers
+} from "./loadBalancer";
+import type { TargetWithSite } from "./types";
+
+function makeTarget(ip: string, siteType: string): TargetWithSite {
+    return {
+        targetId: 1,
+        resourceId: 1,
+        providerId: null,
+        siteId: 1,
+        ip,
+        port: 8080,
+        internalPort: 9000,
+        method: "http",
+        enabled: true,
+        health: "healthy",
+        path: null,
+        pathMatchType: null,
+        rewritePath: null,
+        rewritePathType: null,
+        priority: 100,
+        mode: "http",
+        authToken: null,
+        site: {
+            siteId: 1,
+            type: siteType,
+            subnet: null,
+            exitNodeId: null,
+            online: true
+        }
+    };
+}
+
+function runTests() {
+    const ipCases = [
+        { ip: "2001:db8::1", host: "[2001:db8::1]" },
+        { ip: "192.0.2.1", host: "192.0.2.1" }
+    ];
+    const cases = [
+        ...ipCases,
+        { ip: "backend.example.com", host: "backend.example.com" }
+    ];
+
+    for (const { ip, host } of cases) {
+        const target = makeTarget(ip, "local");
+        assertEqualsObj(
+            buildHttpLoadBalancerServers([target]),
+            [{ url: `http://${host}:8080` }],
+            `Local HTTP target ${ip} should format its endpoint`
+        );
+        assertEqualsObj(
+            buildTcpUdpLoadBalancerServers([target]),
+            [{ address: `${host}:8080` }],
+            `Local TCP/UDP target ${ip} should format its endpoint`
+        );
+    }
+
+    for (const { ip, host } of ipCases) {
+        const target = makeTarget("backend.example.com", "newt");
+        target.site.subnet = `${ip}/${ip.includes(":") ? 128 : 32}`;
+
+        assertEqualsObj(
+            buildHttpLoadBalancerServers([target]),
+            [{ url: `http://${host}:9000` }],
+            "Newt HTTP target should use the subnet endpoint and internal port"
+        );
+        assertEqualsObj(
+            buildTcpUdpLoadBalancerServers([target]),
+            [{ address: `${host}:9000` }],
+            "Newt TCP/UDP target should use the subnet endpoint and internal port"
+        );
+    }
+
+    assertEqualsObj(
+        buildLoadBalancingStrategy("wrr"),
+        {},
+        "Default wrr strategy should be omitted"
+    );
+    assertEqualsObj(
+        buildLoadBalancingStrategy(null),
+        {},
+        "Missing strategy should be omitted"
+    );
+    for (const strategy of ["p2c", "hrw", "leasttime"]) {
+        assertEqualsObj(
+            buildLoadBalancingStrategy(strategy),
+            { strategy },
+            `${strategy} strategy should be emitted`
+        );
+    }
+
+    console.log("All load balancer endpoint tests passed!");
+}
+
+runTests();

server/lib/traefik/loadBalancer.ts

@@ -1,3 +1,4 @@
+import { formatEndpoint } from "@server/lib/ip";
 import { TargetWithSite } from "./types";
 
 /**
@@ -48,12 +49,12 @@ export function buildHttpLoadBalancerServers(targets: TargetWithSite[]) {
                 target.site.type === "wireguard"
             ) {
                 return {
-                    url: `${target.method}://${target.ip}:${target.port}`
+                    url: `${target.method}://${formatEndpoint(target.ip, target.port)}`
                 };
             } else if (target.site.type === "newt") {
                 const ip = target.site.subnet!.split("/")[0];
                 return {
-                    url: `${target.method}://${ip}:${target.internalPort}`
+                    url: `${target.method}://${formatEndpoint(ip, target.internalPort!)}`
                 };
             }
         })
@@ -62,6 +63,18 @@ export function buildHttpLoadBalancerServers(targets: TargetWithSite[]) {
         );
 }
 
+/**
+ * Build the loadBalancer.strategy for an HTTP-mode resource. Traefik defaults
+ * to wrr when strategy is omitted, so only emit it for the non-default
+ * strategies to keep the generated config unchanged for existing resources.
+ */
+export function buildLoadBalancingStrategy(strategy: string | null) {
+    if (!strategy || strategy === "wrr") {
+        return {};
+    }
+    return { strategy };
+}
+
 export function buildStickySessionCookie(ssl: boolean | null) {
     return {
         sticky: {
@@ -111,12 +124,12 @@ export function buildTcpUdpLoadBalancerServers(targets: TargetWithSite[]) {
                 target.site.type === "wireguard"
             ) {
                 return {
-                    address: `${target.ip}:${target.port}`
+                    address: formatEndpoint(target.ip, target.port)
                 };
             } else if (target.site.type === "newt") {
                 const ip = target.site.subnet!.split("/")[0];
                 return {
-                    address: `${ip}:${target.internalPort}`
+                    address: formatEndpoint(ip, target.internalPort!)
                 };
             }
         });