Merge branch 'dev' into feat/redirect-tables

server/routers/badger/exchangeSession.ts

@@ -4,7 +4,12 @@ import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
-import { resourceAccessToken, resources, sessions } from "@server/db";
+import {
+    resourceAccessToken,
+    resourceSessions,
+    resources,
+    sessions
+} from "@server/db";
 import { db } from "@server/db";
 import { and, eq, inArray, or, sql } from "drizzle-orm";
 import {
@@ -128,7 +133,18 @@ export async function exchangeSession(
             );
         }
 
-        await db.delete(sessions).where(eq(sessions.sessionId, requestToken));
+        // Enforce single use: consume the request token. Checking the deleted
+        // row count makes concurrent exchanges of the same token race safely.
+        const consumed = await db
+            .delete(resourceSessions)
+            .where(eq(resourceSessions.sessionId, requestSession.sessionId))
+            .returning();
+
+        if (consumed.length === 0) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Invalid request token")
+            );
+        }
 
         const token = generateSessionToken();
 

server/routers/badger/verifySession.test.ts

@@ -383,6 +383,30 @@ function runSpecialCharacterTests() {
         "Deeply nested paths should still match"
     );
 
+    assertEquals(
+        isPathAllowed("*a*b", "xaxyb"),
+        true,
+        "Multiple wildcards within a segment should match"
+    );
+    assertEquals(
+        isPathAllowed("*a*b", "xaxyba"),
+        false,
+        "In-segment wildcard pattern must still be anchored at the end"
+    );
+
+    // a `.*`-style regex backtracks catastrophically here and never returns
+    const start = Date.now();
+    isPathAllowed("/" + "*a".repeat(10) + "b", "/" + "a".repeat(5000));
+    isPathAllowed(
+        "/" + Array(10).fill("*a*a*a*").join("/") + "/nevermatch",
+        "/" + Array(25).fill("a".repeat(200)).join("/")
+    );
+    assertEquals(
+        Date.now() - start < 1000,
+        true,
+        "In-segment wildcards should not backtrack exponentially"
+    );
+
     console.log("All special character tests passed!");
 }
 

server/routers/badger/verifySession.ts

@@ -170,17 +170,16 @@ export async function verifyResourceSession(
             originalRequestURL,
             requestIp,
             path,
+            method,
             headers,
             query,
-            method,
             badgerVersion
         } = parsedBody.data;
 
         // Extract HTTP Basic Auth credentials if present
         const clientHeaderAuth = extractBasicAuth(headers);
 
-        const clientUserAgent =
-            headers?.["user-agent"] || headers?.["User-Agent"];
+        const clientUserAgent = getClientHeader(headers, "user-agent");
         const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
 
         const clientIp = requestIp
@@ -486,7 +485,15 @@ export async function verifyResourceSession(
 
             // Browsers go to the resource auth / API key page. API clients get
             // a capability-shaped JSON auth error instead of a redirect.
-            if (clientIsBrowser) {
+            // Never redirect programmatic API calls (non-GET, or a known AI
+            // capability path): HTTP clients such as the OpenAI Python SDK
+            // (httpx) don't follow 302s on POST, so a redirect surfaces as
+            // an opaque failure with nothing logged in aiSessionLog since
+            // the request never reaches the gateway.
+            if (
+                clientIsBrowser &&
+                !isProgrammaticApiRequest(path, method, headers)
+            ) {
                 return notAllowed(res, redirectPath, resource.orgId);
             }
 
@@ -1772,14 +1779,29 @@ const NON_BROWSER_USER_AGENT_PATTERNS = [
     /wget/,
     /python-requests/,
     /python-urllib/,
+    /python-httpx/,
+    /httpx/,
+    /httpcore/,
+    /aiohttp/,
+    /urllib3/,
+    /openai\//,
+    /anthropic/,
     /go-http-client/,
     /okhttp/,
     /axios/,
     /node-fetch/,
+    /undici/,
     /postmanruntime/,
     /insomnia/,
     /libwww-perl/,
     /java\//,
+    /\bjava\b/,
+    /jakarta/,
+    /jersey/,
+    /netty/,
+    /jetty/,
+    /eclipse/,
+    /dbeaver/,
     /ruby/,
     /php/,
     /bot/,
@@ -1804,6 +1826,52 @@ function isBrowserUserAgent(userAgent: string | undefined): boolean {
     return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
 }
 
+function getClientHeader(
+    headers: Record<string, string> | undefined,
+    name: string
+): string | undefined {
+    if (!headers) {
+        return undefined;
+    }
+    const lower = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lower) {
+            return value;
+        }
+    }
+    return undefined;
+}
+
+// True for programmatic API calls that can't complete an interactive login,
+// even if the User-Agent looks like a browser (some SDKs reuse browser-ish
+// strings or omit a distinctive token). Badger turns a redirectUrl into a
+// 302, which HTTP clients don't follow on POST, so these must get a JSON
+// auth error instead.
+function isProgrammaticApiRequest(
+    path: string | undefined,
+    method: string | undefined,
+    headers: Record<string, string> | undefined
+): boolean {
+    if (method && method.toUpperCase() !== "GET") {
+        return true;
+    }
+    if (path && resolveAiCapabilityFromPath(path) !== null) {
+        return true;
+    }
+    const accept = getClientHeader(headers, "accept");
+    if (accept && !accept.toLowerCase().includes("text/html")) {
+        return true;
+    }
+    const secFetchMode = getClientHeader(headers, "sec-fetch-mode");
+    if (
+        secFetchMode &&
+        !["navigate", "document"].includes(secFetchMode.toLowerCase())
+    ) {
+        return true;
+    }
+    return false;
+}
+
 function extractBasicAuth(
     headers: Record<string, string> | undefined
 ): string | undefined {

server/routers/client/getClient.ts

@@ -1,6 +1,14 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, idp, idpOidcConfig, olms, users } from "@server/db";
+import {
+    clientOrgRoles,
+    db,
+    idp,
+    idpOidcConfig,
+    olms,
+    roles,
+    users
+} from "@server/db";
 import { clients, currentFingerprint } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -239,6 +247,8 @@ export type GetClientResponse = NonNullable<
     userType: string | null;
     idpName: string | null;
     idpVariant: string | null;
+    // roles assigned directly to the client (machine clients only)
+    roles: { roleId: number; name: string }[];
 };
 
 registry.registerPath({
@@ -394,6 +404,17 @@ export async function getClient(
             }
         }
 
+        const clientRoles = await db
+            .select({ roleId: roles.roleId, name: roles.name })
+            .from(clientOrgRoles)
+            .innerJoin(roles, eq(roles.roleId, clientOrgRoles.roleId))
+            .where(
+                and(
+                    eq(clientOrgRoles.clientId, client.clients.clientId),
+                    eq(clientOrgRoles.orgId, client.clients.orgId)
+                )
+            );
+
         const data: GetClientResponse = {
             ...client.clients,
             name: clientName,
@@ -407,7 +428,8 @@ export async function getClient(
             posture: postureData,
             userType,
             idpName,
-            idpVariant
+            idpVariant,
+            roles: clientRoles
         };
 
         return response<GetClientResponse>(res, {

server/routers/client/listClients.ts

@@ -1,5 +1,6 @@
 import {
     clientLabels,
+    clientOrgRoles,
     clients,
     clientSitesAssociationsCache,
     currentFingerprint,
@@ -8,6 +9,7 @@ import {
     olms,
     orgs,
     roleClients,
+    roles,
     sites,
     userClients,
     users,
@@ -25,6 +27,7 @@ import {
     asc,
     desc,
     eq,
+    exists,
     inArray,
     isNull,
     like,
@@ -138,6 +141,30 @@ const listClientsSchema = z.strictObject({
         .openapi({
             type: "array",
             description: "Filter by client labels"
+        }),
+    role_id: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            const raw = Array.isArray(val)
+                ? val
+                : typeof val === "string"
+                  ? val.split(",")
+                  : [val];
+            const ids = raw
+                .map((v) =>
+                    typeof v === "string" ? parseInt(v, 10) : Number(v)
+                )
+                .filter((n) => Number.isInteger(n) && n > 0);
+            return ids.length > 0 ? [...new Set(ids)] : undefined;
+        }, z.array(z.number().int().positive()).optional())
+        .catch(undefined)
+        .openapi({
+            type: "array",
+            items: { type: "integer" },
+            description:
+                "Filter clients that have any of these role ids assigned (repeat query param or comma-separated)"
         })
 });
 
@@ -195,6 +222,7 @@ type ClientWithSites = Awaited<ReturnType<typeof queryClientsBase>>[0] & {
     }>;
     olmUpdateAvailable?: boolean;
     labels?: Array<Pick<Label, "labelId" | "name" | "color">>;
+    roles: Array<{ roleId: number; name: string }>;
 };
 
 type OlmWithUpdateAvailable = ClientWithSites;
@@ -253,7 +281,8 @@ export async function listClients(
             status,
             sort_by,
             order,
-            labels: labelFilter
+            labels: labelFilter,
+            role_id: roleIdFilter
         } = parsedQuery.data;
 
         const parsedParams = listClientsParamsSchema.safeParse(req.params);
@@ -352,6 +381,23 @@ export async function listClients(
             );
         }
 
+        if (roleIdFilter && roleIdFilter.length > 0) {
+            conditions.push(
+                exists(
+                    db
+                        .select()
+                        .from(clientOrgRoles)
+                        .where(
+                            and(
+                                eq(clientOrgRoles.clientId, clients.clientId),
+                                eq(clientOrgRoles.orgId, orgId),
+                                inArray(clientOrgRoles.roleId, roleIdFilter)
+                            )
+                        )
+                )
+            );
+        }
+
         if (query) {
             const q = "%" + query.toLowerCase() + "%";
             const queryList = [
@@ -421,6 +467,25 @@ export async function listClients(
                 .orderBy(asc(clientLabels.clientLabelId));
         }
 
+        const rolesForClients =
+            clientIds.length > 0
+                ? await db
+                      .select({
+                          clientId: clientOrgRoles.clientId,
+                          roleId: roles.roleId,
+                          name: roles.name
+                      })
+                      .from(clientOrgRoles)
+                      .innerJoin(roles, eq(roles.roleId, clientOrgRoles.roleId))
+                      .where(
+                          and(
+                              inArray(clientOrgRoles.clientId, clientIds),
+                              eq(clientOrgRoles.orgId, orgId)
+                          )
+                      )
+                      .orderBy(asc(roles.name))
+                : [];
+
         // Group site associations by client ID
         const sitesByClient = siteAssociations.reduce(
             (acc, association) => {
@@ -451,7 +516,10 @@ export async function listClients(
                 sites: sitesByClient[client.clientId] || [],
                 labels: labelsForClients.filter(
                     (l) => l.clientId === client.clientId
-                )
+                ),
+                roles: rolesForClients
+                    .filter((r) => r.clientId === client.clientId)
+                    .map(({ roleId, name }) => ({ roleId, name }))
             };
         });
 

server/routers/external.ts

@@ -387,6 +387,13 @@ authenticated.get(
     siteResource.getSiteResource
 );
 
+authenticated.get(
+    "/site-resource/:siteResourceId/blueprint",
+    verifySiteResourceAccess,
+    verifyUserHasAction(ActionsEnum.getSiteResource),
+    siteResource.exportSiteResourceBlueprint
+);
+
 authenticated.post(
     "/site-resource/:siteResourceId",
     verifySiteResourceAccess,
@@ -765,6 +772,13 @@ authenticated.get(
     verifyUserHasAction(ActionsEnum.getResource),
     resource.getResource
 );
+
+authenticated.get(
+    "/resource/:resourceId/blueprint",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.getResource),
+    resource.exportResourceBlueprint
+);
 authenticated.get(
     "/org/:orgId/resource/:niceId",
     verifyOrgAccess,
@@ -835,6 +849,28 @@ authenticated.delete(
     resource.deleteResourceRule
 );
 
+authenticated.put(
+    "/resource/:resourceId/mtls/certificate",
+    verifyResourceAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.createResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
+    resource.createResourceMtlsCertificate
+);
+authenticated.get(
+    "/resource/:resourceId/mtls/certificates",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.listResourceMtlsCertificates),
+    resource.listResourceMtlsCertificates
+);
+authenticated.delete(
+    "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.deleteResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
+    resource.deleteResourceMtlsCertificate
+);
+
 authenticated.get(
     "/target/:targetId",
     verifyTargetAccess,

server/routers/gerbil/createExitNode.ts

@@ -16,6 +16,7 @@ export async function createExitNode(
         const { value: address, release } = await getNextAvailableSubnet();
         try {
             const listenPort = config.getRawConfig().gerbil.start_port;
+            const relayPort = config.getRawConfig().gerbil.clients_start_port;
 
             const exitNodeName =
                 config.getRawConfig().gerbil.exit_node_name ||
@@ -30,6 +31,7 @@ export async function createExitNode(
                     address,
                     online: true,
                     listenPort,
+                    relayPort,
                     reachableAt,
                     name: exitNodeName
                 })

server/routers/gerbil/getConfig.ts

@@ -20,6 +20,7 @@ const getConfigSchema = z.object({
 
 export type GetConfigResponse = {
     listenPort: number;
+    relayPort: number;
     ipAddress: string;
     peers: {
         publicKey: string | null;
@@ -143,6 +144,7 @@ export async function generateGerbilConfig(exitNode: ExitNode) {
 
     const configResponse: GetConfigResponse = {
         listenPort: exitNode.listenPort || 51820,
+        relayPort: exitNode.relayPort || 21820,
         ipAddress: exitNode.address,
         peers
     };

server/routers/gerbil/updateHolePunch.ts

@@ -8,7 +8,8 @@ import {
     sites,
     clientSitesAssociationsCache,
     exitNodes,
-    ExitNode
+    ExitNode,
+    orgs
 } from "@server/db";
 import { db } from "@server/db";
 import { eq, and, inArray } from "drizzle-orm";
@@ -112,7 +113,12 @@ export async function updateHolePunch(
             destinations: destinations
         });
     } catch (error) {
-        if (!(error instanceof Error && error.message === "Exit node not allowed")) {
+        if (
+            !(
+                error instanceof Error &&
+                error.message === "Exit node not allowed"
+            )
+        ) {
             logger.error(error);
         }
         return next(
@@ -460,7 +466,18 @@ async function handleClientEndpointChange(
             return;
         }
 
-        if (sitesWithNewtsToUpdate.length > 250) {
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, client.orgId))
+            .limit(1);
+
+        if (!org) {
+            logger.warn(`Client ${clientId} org not found`);
+            return;
+        }
+
+        if (sitesWithNewtsToUpdate.length > org.settingsJitModeLimit) {
             logger.warn(
                 `Client ${clientId} has ${sitesWithNewtsToUpdate.length} connected sites so the client will be in jit mode anyway, skipping endpoint updates`
             );

server/routers/idp/validateOidcCallback.ts

@@ -23,6 +23,7 @@ import { LimitId } from "@server/lib/billing";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { usageService } from "@server/lib/billing/usageService";
 import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsForOrgs";
+import { pushClientIdentitiesForUser } from "@server/lib/clientIdentities";
 import config from "@server/lib/config";
 import { decrypt } from "@server/lib/crypto";
 import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
@@ -641,6 +642,17 @@ export async function validateOidcCallback(
                 );
             });
 
+            if (existingUser) {
+                // The sync above may have changed the user's name, email or
+                // roles, all of which newt forwards as Remote-* headers.
+                pushClientIdentitiesForUser(userId!).catch((err) => {
+                    logger.error(
+                        "Error pushing client identities after syncing OIDC user",
+                        { error: err }
+                    );
+                });
+            }
+
             for (const orgCount of orgUserCounts) {
                 await usageService.updateCount(
                     orgCount.orgId,

server/routers/integration.ts

@@ -17,6 +17,7 @@ import * as aiProvider from "./aiProvider";
 import * as aiBudget from "./aiBudget";
 import * as virtualApiKey from "./virtualApiKey";
 import * as redirect from "./redirect";
+import * as labels from "./labels";
 import {
     verifyApiKey,
     verifyApiKeyOrgAccess,
@@ -739,6 +740,39 @@ authenticated.delete(
     resource.deleteResourceRule
 );
 
+authenticated.put(
+    [
+        "/resource/:resourceId/mtls/certificate",
+        "/public-resource/:resourceId/mtls/certificate"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
+    resource.createResourceMtlsCertificate
+);
+
+authenticated.get(
+    [
+        "/resource/:resourceId/mtls/certificates",
+        "/public-resource/:resourceId/mtls/certificates"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResourceMtlsCertificates),
+    resource.listResourceMtlsCertificates
+);
+
+authenticated.delete(
+    [
+        "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
+        "/public-resource/:resourceId/mtls/certificate/:mtlsCertificateId"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
+    resource.deleteResourceMtlsCertificate
+);
+
 authenticated.get(
     "/target/:targetId",
     verifyApiKeyTargetAccess,
@@ -1884,3 +1918,53 @@ authenticated.delete(
     logActionAudit(ActionsEnum.deleteRedirect),
     redirect.deleteRedirect
 );
+
+authenticated.get(
+    "/org/:orgId/labels",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listOrgLabels),
+    labels.listOrgLabels
+);
+
+authenticated.post(
+    "/org/:orgId/labels",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createOrgLabel),
+    logActionAudit(ActionsEnum.createOrgLabel),
+    labels.createOrgLabel
+);
+
+authenticated.patch(
+    "/org/:orgId/label/:labelId",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.updateOrgLabel),
+    logActionAudit(ActionsEnum.updateOrgLabel),
+    labels.updateOrgLabel
+);
+
+authenticated.delete(
+    "/org/:orgId/label/:labelId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteOrgLabel),
+    logActionAudit(ActionsEnum.deleteOrgLabel),
+    labels.deleteOrgLabel
+);
+
+authenticated.put(
+    "/org/:orgId/label/:labelId/attach",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.attachLabelToItem),
+    logActionAudit(ActionsEnum.attachLabelToItem),
+    labels.attachLabelToItem
+);
+
+authenticated.put(
+    "/org/:orgId/label/:labelId/detach",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.detachLabelFromItem),
+    logActionAudit(ActionsEnum.detachLabelFromItem),
+    labels.detachLabelFromItem
+);

server/routers/labels/attachLabelToItem.ts

@@ -12,6 +12,7 @@ import {
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, isNull } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -31,6 +32,40 @@ const attachLabelBodySchema = z.strictObject({
     clientId: z.number().int().optional()
 });
 
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/label/{labelId}/attach",
+    description:
+        "Attach a label to a site, public resource, private resource or client.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: attachLabelBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function attachLabelToItem(
     req: Request,
     res: Response,

server/routers/labels/createOrgLabel.ts

@@ -9,6 +9,7 @@ import {
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -30,6 +31,39 @@ const bodySchema = z.strictObject({
     resourceId: z.number().int().optional()
 });
 
+registry.registerPath({
+    method: "post",
+    path: "/org/{orgId}/labels",
+    description: "Create a label in an organization.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function createOrgLabel(
     req: Request,
     res: Response,

server/routers/labels/deleteOrgLabel.ts

@@ -1,6 +1,7 @@
 import { db, labels } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -13,6 +14,32 @@ const paramsSchema = z.strictObject({
     labelId: z.string().transform(Number).pipe(z.int().positive())
 });
 
+registry.registerPath({
+    method: "delete",
+    path: "/org/{orgId}/label/{labelId}",
+    description: "Delete a label.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function deleteOrgLabel(
     req: Request,
     res: Response,

server/routers/labels/detachLabelFromItem.ts

@@ -12,6 +12,7 @@ import {
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, isNull } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -31,6 +32,40 @@ const detachLabelBodySchema = z.strictObject({
     clientId: z.number().int().optional()
 });
 
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/label/{labelId}/detach",
+    description:
+        "Detach a label from a site, public resource, private resource or client.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: detachLabelBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function detachLabelFromItem(
     req: Request,
     res: Response,

server/routers/labels/listOrgLabels.ts

@@ -2,6 +2,7 @@ import { db, labels } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, asc, eq, like, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -51,6 +52,33 @@ function queryLabelsBase() {
         .from(labels);
 }
 
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/labels",
+    description: "List labels in an organization.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        query: listLabelsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function listOrgLabels(
     req: Request,
     res: Response,

server/routers/labels/updateOrgLabel.ts

@@ -2,6 +2,7 @@ import { db, labels } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
+import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
 import { and, eq, ne, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
@@ -22,6 +23,39 @@ const updateLabelBodySchema = z.strictObject({
         .nonempty()
 });
 
+registry.registerPath({
+    method: "patch",
+    path: "/org/{orgId}/label/{labelId}",
+    description: "Update a label.",
+    tags: [OpenAPITags.Label],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: updateLabelBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function updateOrgLabel(
     req: Request,
     res: Response,

server/routers/launcher/formatLauncherAccess.ts

@@ -125,6 +125,16 @@ export function formatPublicResourceAccess(
 export function formatSiteResourceAccess(
     resource: SiteResourceAccessInput
 ): LauncherAccessFields {
+    // Exit node (gateway) destinations are always 0.0.0.0/0 — not useful to
+    // show or copy. The launcher UI renders a localized capability label.
+    if (resource.mode === "gateway") {
+        return {
+            accessDisplay: "",
+            accessCopyValue: "",
+            accessUrl: null
+        };
+    }
+
     if (
         (resource.mode === "http" || resource.mode === "inference") &&
         resource.fullDomain

server/routers/newt/buildConfiguration.ts

@@ -24,6 +24,10 @@ import {
     generateSubnetProxyTargetV2,
     SubnetProxyTargetV2
 } from "@server/lib/ip";
+import {
+    ClientIdentity,
+    getClientIdentities
+} from "@server/lib/clientIdentities";
 
 export async function buildClientConfigurationForNewtClient(
     site: Site,
@@ -96,7 +100,10 @@ export async function buildClientConfigurationForNewtClient(
                         await updatePeer(client.clients.clientId, {
                             siteId: site.siteId,
                             endpoint: site.endpoint!,
-                            relayEndpoint: `${exitNode.endpoint}:${config.getRawConfig().gerbil.clients_start_port}`,
+                            relayEndpoint: formatEndpoint(
+                                exitNode.endpoint,
+                                exitNode.relayPort
+                            ),
                             publicKey: site.publicKey!,
                             serverIP: site.address,
                             serverPort: site.listenPort
@@ -121,6 +128,7 @@ export async function buildClientConfigurationForNewtClient(
                                 siteId,
                                 exitNode: {
                                     publicKey: exitNode.publicKey,
+                                    relayPort: exitNode.relayPort,
                                     endpoint: exitNode.endpoint
                                 }
                             }
@@ -162,7 +170,8 @@ export async function buildClientConfigurationForNewtClient(
     if (allSiteResources.length === 0) {
         return {
             peers: validPeers,
-            targets: targetsToSend
+            targets: targetsToSend,
+            clientIdentities: [] as ClientIdentity[]
         };
     }
 
@@ -230,9 +239,26 @@ export async function buildClientConfigurationForNewtClient(
         }
     }
 
+    // Only clients that can reach an HTTP resource ever hit newt's HTTP proxy,
+    // so those are the only identities it needs to set Remote-* headers.
+    const httpClientIds = new Set<number>();
+    for (const resource of allSiteResources) {
+        if (resource.mode !== "http") {
+            continue;
+        }
+        for (const c of clientsByResourceId.get(resource.siteResourceId) ??
+            []) {
+            httpClientIds.add(c.clientId);
+        }
+    }
+    const clientIdentities = Array.from(
+        (await getClientIdentities(httpClientIds)).values()
+    );
+
     return {
         peers: validPeers,
-        targets: targetsToSend
+        targets: targetsToSend,
+        clientIdentities
     };
 }
 

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -12,7 +12,6 @@ import {
     supportsCertReferences
 } from "@server/lib/clientVersionChecks";
 import { dedupeCertsForTargets } from "@server/lib/ip";
-import config from "@server/lib/config";
 import { waitForSiteRebuildIdle } from "@server/lib/rebuildClientAssociations";
 
 export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
@@ -61,7 +60,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
 
     if (existingSite.lastHolePunch && now - existingSite.lastHolePunch > 12) {
         logger.warn(
-            `Site last hole punch is too old; skipping this register. The site is failing to hole punch and identify its network address with the server. Can the site reach the server on UDP port ${config.getRawConfig().gerbil.clients_start_port}?`
+            `Site last hole punch is too old; skipping this register. The site is failing to hole punch and identify its network address with the server. Can the site reach the server on its Relay UDP port?`
         );
         return;
     }
@@ -118,10 +117,8 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         }
     }
 
-    const { peers, targets } = await buildClientConfigurationForNewtClient(
-        site,
-        exitNode
-    );
+    const { peers, targets, clientIdentities } =
+        await buildClientConfigurationForNewtClient(site, exitNode);
 
     // Older newt clients only understand inline tlsCert/tlsKey on each
     // target, so only switch to certId references once we know the client
@@ -145,6 +142,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
                 peers,
                 targets: targetsToSend,
                 certs,
+                clientIdentities,
                 chainId: chainId
             }
         },

server/routers/newt/handleNewtRegisterMessage.ts

@@ -15,6 +15,7 @@ import { fetchContainers } from "./dockerSocket";
 import { buildTargetConfigurationForNewtClient } from "./buildConfiguration";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import { NewtErrorCodes, sendNewtError } from "./error";
+import { formatEndpoint } from "@server/lib/ip";
 
 export const handleNewtRegisterMessage: MessageHandler = async (context) => {
     const { message, client, sendToClient } = context;
@@ -224,7 +225,7 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
         message: {
             type: "newt/wg/connect",
             data: {
-                endpoint: `${exitNode.endpoint}:${exitNode.listenPort}`,
+                endpoint: formatEndpoint(exitNode.endpoint, exitNode.listenPort),
                 relayPort: config.getRawConfig().gerbil.clients_start_port,
                 publicKey: exitNode.publicKey,
                 serverIP: exitNode.address.split("/")[0],

server/routers/newt/offlineChecker.ts

@@ -3,12 +3,10 @@ import { hasActiveConnections } from "#dynamic/routers/ws";
 import { eq, lt, isNull, and, or, ne, not, inArray } from "drizzle-orm";
 import logger from "@server/logger";
 import { fireSiteOfflineAlert, fireSiteOnlineAlert } from "@server/lib/alerts";
+import { getOfflineThresholds } from "#dynamic/lib/offlineThresholds";
 
 // Track if the offline checker interval is running
 let offlineCheckerInterval: NodeJS.Timeout | null = null;
-const OFFLINE_CHECK_INTERVAL = 30 * 1000; // Check every 30 seconds
-const OFFLINE_THRESHOLD_MS = 2 * 60 * 1000; // 2 minutes
-const OFFLINE_THRESHOLD_BANDWIDTH_MS = 8 * 60 * 1000; // 8 minutes
 
 /**
  * Starts the background interval that checks for newt sites that haven't
@@ -24,8 +22,9 @@ export const startNewtOfflineChecker = (): void => {
 
     offlineCheckerInterval = setInterval(async () => {
         try {
-            const twoMinutesAgo = Math.floor(
-                (Date.now() - OFFLINE_THRESHOLD_MS) / 1000
+            const thresholds = getOfflineThresholds();
+            const offlineBefore = Math.floor(
+                (Date.now() - thresholds.newtMs) / 1000
             );
 
             // Find all online newt-type sites that haven't pinged recently
@@ -46,7 +45,7 @@ export const startNewtOfflineChecker = (): void => {
                         eq(sites.online, true),
                         eq(sites.type, "newt"),
                         or(
-                            lt(sites.lastPing, twoMinutesAgo),
+                            lt(sites.lastPing, offlineBefore),
                             isNull(sites.lastPing)
                         )
                     )
@@ -105,7 +104,7 @@ export const startNewtOfflineChecker = (): void => {
                 );
 
             const wireguardOfflineThreshold = Math.floor(
-                (Date.now() - OFFLINE_THRESHOLD_BANDWIDTH_MS) / 1000
+                (Date.now() - thresholds.newtWireguardMs) / 1000
             );
 
             // loop over each one. If its offline and there is a new update then mark it online. If its online and there is no update then mark it offline
@@ -117,7 +116,7 @@ export const startNewtOfflineChecker = (): void => {
                     site.online
                 ) {
                     logger.info(
-                        `Marking wireguard site ${site.siteId} offline: no bandwidth update in over ${OFFLINE_THRESHOLD_BANDWIDTH_MS / 60000} minutes`
+                        `Marking wireguard site ${site.siteId} offline: no bandwidth update in over ${thresholds.newtWireguardMs / 1000} seconds`
                     );
 
                     await db.transaction(async (trx) => {
@@ -161,7 +160,7 @@ export const startNewtOfflineChecker = (): void => {
         } catch (error) {
             logger.error("Error in newt offline checker interval", { error });
         }
-    }, OFFLINE_CHECK_INTERVAL);
+    }, getOfflineThresholds().checkIntervalMs);
 
     logger.debug("Started newt offline checker interval");
 };

server/routers/newt/peers.ts

@@ -127,6 +127,40 @@ export async function deletePeersBatch(
     logger.info(`Deleted ${peers.length} peer(s) from newts (batch)`);
 }
 
+export async function updatePeersBatch(
+    peers: {
+        siteId: number;
+        publicKey: string;
+        newtId: string;
+        peer: {
+            allowedIps?: string[];
+            endpoint?: string;
+        };
+    }[]
+) {
+    if (peers.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(
+        peers.map((peer) => ({
+            clientId: peer.newtId,
+            message: {
+                type: "newt/wg/peer/update",
+                data: {
+                    publicKey: peer.publicKey,
+                    ...peer.peer
+                }
+            },
+            options: { incrementConfigVersion: true }
+        }))
+    ).catch((error) => {
+        logger.warn(`Error sending batched newt peer updates:`, error);
+    });
+
+    logger.info(`Updated ${peers.length} peer(s) on newts (batch)`);
+}
+
 export async function updatePeer(
     siteId: number,
     publicKey: string,

server/routers/newt/sync.ts

@@ -28,10 +28,8 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
             .where(eq(exitNodes.exitNodeId, site.exitNodeId))
             .limit(1);
     }
-    const { peers, targets } = await buildClientConfigurationForNewtClient(
-        site,
-        exitNode
-    );
+    const { peers, targets, clientIdentities } =
+        await buildClientConfigurationForNewtClient(site, exitNode);
 
     // Older newt clients only understand inline tlsCert/tlsKey on each
     // target, so only switch to certId references once we know the client
@@ -55,6 +53,7 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
                 peers: peers,
                 clientTargets: clientTargets,
                 certs: certs,
+                clientIdentities: clientIdentities,
                 browserGatewayTargets: browserGatewayTargets,
                 remoteExitNodeSubnets: remoteExitNodeSubnets
             }

server/routers/newt/targets.ts

@@ -4,6 +4,7 @@ import logger from "@server/logger";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import { decrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
+import { formatEndpoint } from "@server/lib/ip";
 
 export async function addTargets(
     newtId: string,
@@ -14,9 +15,7 @@ export async function addTargets(
 ) {
     //create a list of udp and tcp targets
     const payloadTargets = targets.map((target) => {
-        return `${target.internalPort ? target.internalPort + ":" : ""}${
-            target.ip
-        }:${target.port}`;
+        return `${target.internalPort ? target.internalPort + ":" : ""}${formatEndpoint(target.ip, target.port)}`;
     });
 
     if (payloadTargets.length > 0) {
@@ -208,9 +207,7 @@ export async function removeTargets(
 ) {
     //create a list of udp and tcp targets
     const payloadTargets = targets.map((target) => {
-        return `${target.internalPort ? target.internalPort + ":" : ""}${
-            target.ip
-        }:${target.port}`;
+        return `${target.internalPort ? target.internalPort + ":" : ""}${formatEndpoint(target.ip, target.port)}`;
     });
 
     if (payloadTargets.length > 0) {

server/routers/olm/batchUtils.ts

@@ -0,0 +1,55 @@
+// Shared parsing for the olm relay/unrelay/local/unlocal websocket messages, which accept
+// either a single siteId or a batched siteIds array (with a parallel chainIds array), so
+// olm clients with many sites can coalesce decisions into one message instead of sending
+// one message per site. Older olm clients that only ever send the singular form are handled
+// identically to a batch of one, and the reply mirrors whichever form the request used.
+
+import { db, newts } from "@server/db";
+import { inArray } from "drizzle-orm";
+
+// Resolves the newtId for each of the given siteIds in a single query, for batching the
+// resulting newt/wg/peer/update pushes instead of looking each one up individually.
+export async function resolveNewtIdsBySite(
+    siteIds: number[]
+): Promise<Map<number, string>> {
+    if (siteIds.length === 0) {
+        return new Map();
+    }
+
+    const rows = await db
+        .select({ siteId: newts.siteId, newtId: newts.newtId })
+        .from(newts)
+        .where(inArray(newts.siteId, siteIds));
+
+    const map = new Map<number, string>();
+    for (const row of rows) {
+        if (row.siteId != null) {
+            map.set(row.siteId, row.newtId);
+        }
+    }
+    return map;
+}
+
+export type SiteChainBatch = {
+    siteIds: number[];
+    chainIds: (string | undefined)[];
+    isBatch: boolean;
+};
+
+export function parseSiteChainBatch(data: any): SiteChainBatch {
+    if (Array.isArray(data?.siteIds)) {
+        const siteIds: number[] = data.siteIds;
+        const chainIds: (string | undefined)[] =
+            Array.isArray(data.chainIds) &&
+            data.chainIds.length === siteIds.length
+                ? data.chainIds
+                : siteIds.map(() => data.chainId);
+        return { siteIds, chainIds, isBatch: true };
+    }
+
+    return {
+        siteIds: data?.siteId !== undefined ? [data.siteId] : [],
+        chainIds: [data?.chainId],
+        isBatch: false
+    };
+}

server/routers/olm/buildConfiguration.ts

@@ -18,7 +18,6 @@ import {
 import logger from "@server/logger";
 import { and, eq, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../newt/peers";
-import config from "@server/lib/config";
 import { SiR } from "react-icons/si";
 
 export async function buildSiteConfigurationForOlmClient(
@@ -129,7 +128,6 @@ export async function buildSiteConfigurationForOlmClient(
         }
     }
 
-    const clientsStartPort = config.getRawConfig().gerbil.clients_start_port;
     const peerOps: Promise<unknown>[] = [];
 
     // Process each site
@@ -216,7 +214,7 @@ export async function buildSiteConfigurationForOlmClient(
                 logger.warn(`Exit node not found for site ${site.siteId}`);
                 continue;
             }
-            relayEndpoint = `${exitNode.endpoint}:${clientsStartPort}`;
+            relayEndpoint = `${exitNode.endpoint}:${exitNode.relayPort}`;
         }
 
         // Add site configuration to the array
@@ -231,7 +229,7 @@ export async function buildSiteConfigurationForOlmClient(
             publicKey: site.publicKey,
             serverIP: site.address,
             serverPort: site.listenPort,
-            remoteSubnets: generateRemoteSubnets(allSiteResources),
+            remoteSubnets: generateRemoteSubnets(allSiteResources), // we dont add the gateway resources here
             aliases: generateAliasConfig(allSiteResources)
         });
     }

server/routers/olm/error.ts

@@ -1,7 +1,4 @@
 import { sendToClient } from "#dynamic/routers/ws";
-import config from "@server/lib/config";
-
-const udpPort = config.getRawConfig().gerbil.clients_start_port;
 
 // Error codes for registration failures
 export const OlmErrorCodes = {
@@ -93,7 +90,7 @@ export const OlmErrorCodes = {
     },
     HOLEPUNCH_MISSING: {
         code: "HOLEPUNCH_MISSING",
-        message: `Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port ${udpPort} and try registering again.`
+        message: `Unable to coordinate client P2P connection. Please ensure your client can reach the server on its relay UDP port and try registering again.`
     },
     NO_AVAILABLE_SUBNET: {
         code: "NO_AVAILABLE_SUBNET",

server/routers/olm/gateway.ts

@@ -0,0 +1,82 @@
+import { sendToClientsBatch } from "#dynamic/routers/ws";
+import { db, olms } from "@server/db";
+import { canCompress } from "@server/lib/clientVersionChecks";
+import logger from "@server/logger";
+import { inArray } from "drizzle-orm";
+
+// The olm only tracks which gateway (exit node) site resource it selected, by
+// its numeric siteResourceId, and the site IDs that resource currently
+// resolves to. So all the server has to push is what changed for that one
+// resource; the olm ignores a message whose siteResourceId isn't the one it
+// selected, which stops a site added to some other gateway resource from
+// being pulled into the client's gateway set. (Creates aren't pushed: a
+// client has to select a gateway resource before it can be using it.)
+
+async function sendGatewayMessageToClients(
+    clientIds: number[],
+    type: string,
+    data: Record<string, unknown>
+): Promise<void> {
+    const uniqueClientIds = Array.from(new Set(clientIds));
+    if (uniqueClientIds.length === 0) {
+        return;
+    }
+
+    const olmRows = await db
+        .select({
+            olmId: olms.olmId,
+            version: olms.version
+        })
+        .from(olms)
+        .where(inArray(olms.clientId, uniqueClientIds));
+
+    const payloads = olmRows.map((olm) => ({
+        clientId: olm.olmId,
+        message: { type, data },
+        options: {
+            compress: canCompress(olm.version, "olm"),
+            incrementConfigVersion: true
+        }
+    }));
+
+    if (payloads.length === 0) {
+        return;
+    }
+
+    await sendToClientsBatch(payloads).catch((error) => {
+        logger.error(`Error sending ${type} messages to olms:`, error);
+    });
+}
+
+// Tells the olms of the given clients that sites were added to / removed from
+// the gateway site resource, so those that selected it can adjust the set of
+// sites they use as the gateway.
+export async function sendGatewaySitesUpdate(
+    clientIds: number[],
+    siteResourceId: number,
+    addedSiteIds: number[],
+    removedSiteIds: number[]
+): Promise<void> {
+    if (addedSiteIds.length === 0 && removedSiteIds.length === 0) {
+        return;
+    }
+
+    await sendGatewayMessageToClients(
+        clientIds,
+        "olm/wg/gateway/sites/update",
+        { siteResourceId, addedSiteIds, removedSiteIds }
+    );
+}
+
+// Tells the olms of the given clients that the gateway site resource can no
+// longer be used as a gateway (it was deleted, disabled, changed to another
+// mode, or the client lost access to it), so those that selected it drop out
+// of gateway mode.
+export async function sendGatewayDisable(
+    clientIds: number[],
+    siteResourceId: number
+): Promise<void> {
+    await sendGatewayMessageToClients(clientIds, "olm/wg/gateway/disable", {
+        siteResourceId
+    });
+}

server/routers/olm/getOlmToken.ts

@@ -8,7 +8,8 @@ import {
     ExitNode,
     exitNodes,
     sites,
-    clientSitesAssociationsCache
+    clientSitesAssociationsCache,
+    orgs
 } from "@server/db";
 import { olms } from "@server/db";
 import HttpCode from "@server/types/HttpCode";
@@ -97,13 +98,13 @@ export async function getOlmToken(
                 await validateSessionToken(userToken);
             if (!userSession || !user) {
                 return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid user token")
+                    createHttpError(HttpCode.UNAUTHORIZED, "Invalid user token")
                 );
             }
             if (user.userId !== existingOlm.userId) {
                 return next(
                     createHttpError(
-                        HttpCode.BAD_REQUEST,
+                        HttpCode.UNAUTHORIZED,
                         "User token does not match olm"
                     )
                 );
@@ -225,7 +226,23 @@ export async function getOlmToken(
             )
             .where(eq(clientSitesAssociationsCache.clientId, clientIdToUse!));
 
-        if (clientSites.length > 250 && build == "saas") {
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgIdToUse))
+            .limit(1);
+
+        if (!org) {
+            logger.warn(`Client ${clientIdToUse} org not found`);
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Client's org not found"
+                )
+            );
+        }
+
+        if (clientSites.length > org.settingsJitModeLimit && build == "saas") {
             // set all of the cache rows isJitMode to true
             await db
                 .update(clientSitesAssociationsCache)
@@ -272,7 +289,7 @@ export async function getOlmToken(
         let exitNodesHpData = allExitNodes.map((exitNode: ExitNode) => {
             return {
                 publicKey: exitNode.publicKey,
-                relayPort: config.getRawConfig().gerbil.clients_start_port,
+                relayPort: exitNode.relayPort,
                 endpoint: exitNode.endpoint,
                 siteIds: exitNodeIdToSiteIds[exitNode.exitNodeId] ?? []
             };
@@ -330,8 +347,7 @@ export async function getOlmToken(
                 exitNodesHpData = [
                     {
                         publicKey: best.publicKey,
-                        relayPort:
-                            config.getRawConfig().gerbil.clients_start_port,
+                        relayPort: best.relayPort,
                         endpoint: best.endpoint,
                         siteIds: []
                         // it should still HP without the site ids but it will get stuck in the client

server/routers/olm/handleOlmLocalMessage.ts

@@ -1,9 +1,10 @@
 import { db, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmLocalMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -40,33 +41,82 @@ export const handleOlmLocalMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site || !site.exitNodeId) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Local message has no siteId(s)");
         return;
     }
 
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the newt knows to accept local
+    // Get the sites
+    const siteRows = await db
+        .select()
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
+
+    const valid: { siteId: number; chainId?: string }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site || !site.exitNodeId) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        valid.push({ siteId, chainId: chainIds[i] });
+    }
+
+    if (valid.length === 0) {
+        return;
+    }
+
+    // Only ack sites we can actually tell their newt to accept local
+    const newtIdBySiteId = await resolveNewtIdsBySite(valid.map((v) => v.siteId));
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt to accept local
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: "" } // this removes the endpoint so the newt knows to accept local
+        }))
+    );
+
     // Just ack the message, we don't keep sending it
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/local",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/local",
-            data: {
-                siteId: siteId,
-                chainId
-            }
+            data: { siteId: single.siteId, chainId: single.chainId }
         },
         broadcast: false,
         excludeSender: false

server/routers/olm/handleOlmPingMessage.ts

@@ -1,4 +1,4 @@
-import { getClientConfigVersion } from "#dynamic/routers/ws";
+import { disconnectClient, getClientConfigVersion } from "#dynamic/routers/ws";
 import { db } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, Olm } from "@server/db";
@@ -11,6 +11,29 @@ import { encodeHexLowerCase } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { sendOlmSyncMessage } from "./sync";
 import { handleFingerprintInsertion } from "./fingerprintingUtils";
+import { sendTerminateClient } from "../client/terminate";
+import { OlmErrorCodes } from "./error";
+
+type OlmErrorCode = (typeof OlmErrorCodes)[keyof typeof OlmErrorCodes];
+
+/**
+ * Tells the olm why it is being kicked, then closes its websocket so it
+ * does not linger connected until the offline checker notices.
+ */
+async function terminateOlm(
+    clientId: number,
+    olmId: string,
+    error: OlmErrorCode
+) {
+    try {
+        await sendTerminateClient(clientId, error, olmId);
+        // wait a moment to ensure the message is sent
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+        await disconnectClient(olmId);
+    } catch (err) {
+        logger.error(`Error terminating olm ${olmId}`, { error: err });
+    }
+}
 
 /**
  * Handles ping messages from clients and responds with pong
@@ -60,14 +83,29 @@ export const handleOlmPingMessage: MessageHandler = async (context) => {
                 await validateSessionToken(userToken);
             if (!userSession || !user) {
                 logger.warn("Invalid user session for olm ping");
-                return; // by returning here we just ignore the ping and the setInterval will force it to disconnect
+                await terminateOlm(
+                    client.clientId,
+                    olm.olmId,
+                    OlmErrorCodes.INVALID_USER_SESSION
+                );
+                return;
             }
             if (user.userId !== olm.userId) {
                 logger.warn("User ID mismatch for olm ping");
+                await terminateOlm(
+                    client.clientId,
+                    olm.olmId,
+                    OlmErrorCodes.USER_ID_MISMATCH
+                );
                 return;
             }
             if (user.userId !== client.userId) {
                 logger.warn("Client user ID mismatch for olm ping");
+                await terminateOlm(
+                    client.clientId,
+                    olm.olmId,
+                    OlmErrorCodes.USER_ID_MISMATCH
+                );
                 return;
             }
 
@@ -85,6 +123,18 @@ export const handleOlmPingMessage: MessageHandler = async (context) => {
                 logger.warn(
                     `Olm user ${olm.userId} does not pass access policies for org ${client.orgId}: ${policyCheck.error}`
                 );
+                let error: OlmErrorCode =
+                    OlmErrorCodes.ORG_ACCESS_POLICY_DENIED;
+                if (policyCheck.policies?.passwordAge?.compliant === false) {
+                    error = OlmErrorCodes.ORG_ACCESS_POLICY_PASSWORD_EXPIRED;
+                } else if (
+                    policyCheck.policies?.maxSessionLength?.compliant === false
+                ) {
+                    error = OlmErrorCodes.ORG_ACCESS_POLICY_SESSION_EXPIRED;
+                } else if (policyCheck.policies?.requiredTwoFactor === false) {
+                    error = OlmErrorCodes.ORG_ACCESS_POLICY_2FA_REQUIRED;
+                }
+                await terminateOlm(client.clientId, olm.olmId, error);
                 return;
             }
         }

server/routers/olm/handleOlmRegisterMessage.ts

@@ -20,7 +20,6 @@ import { OlmErrorCodes, sendOlmError } from "./error";
 import { handleFingerprintInsertion } from "./fingerprintingUtils";
 import { build } from "@server/build";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import config from "@server/lib/config";
 import cache from "#dynamic/lib/cache"; // not using regional here because we need this in the register message handler before we know where the client is
 import { waitForClientRebuildIdle } from "@server/lib/rebuildClientAssociations";
 import {
@@ -30,6 +29,7 @@ import {
 } from "#dynamic/lib/exitNodes";
 import { getUniqueSubnetForExitNode } from "@server/lib/exitNodes";
 import { addPeer, deletePeer } from "../gerbil/peers";
+import { formatEndpoint } from "@server/lib/ip";
 
 const HOLEPUNCH_STALE_CHAIN_THRESHOLD = 18;
 const HOLEPUNCH_STALE_CHAIN_TTL_SECONDS = 1800;
@@ -277,7 +277,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
     );
 
     let jitMode = false;
-    if (sitesCount > 250 && build == "saas") {
+    if (sitesCount > org.settingsJitModeLimit && build == "saas") {
         // THIS IS THE MAX ON THE BUSINESS TIER
         // we have too many sites
         // If we have too many sites we need to drop into fully JIT mode by not sending any of the sites
@@ -437,7 +437,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
     // TODO: I still think there is a better way to do this rather than locking it out here but ???
     if (now - (client.lastHolePunch || 0) > 12 && sitesCount > 0) {
         logger.warn(
-            `[handleOlmRegisterMessage] Client last hole punch is too old and we have sites to send; skipping this register. The client is failing to hole punch and identify its network address with the server. Can the client reach the server on UDP port ${config.getRawConfig().gerbil.clients_start_port}?`,
+            `[handleOlmRegisterMessage] Client last hole punch is too old and we have sites to send; skipping this register. The client is failing to hole punch and identify its network address with the server. Can the client reach the server on its relay UDP port?`,
             { orgId: client.orgId, clientId: client.clientId }
         );
 
@@ -508,7 +508,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
                         ? {
                               aliases: exitNodeAliases,
                               connect: exitNodeAliases.length > 0, // we do not need to connect to the exit node if we do not have inference resources and right now all site resources on the exit node have an alias
-                              endpoint: `${exitNode.endpoint}:${exitNode.listenPort}`,
+                              endpoint: formatEndpoint(exitNode.endpoint, exitNode.listenPort),
                               publicKey: exitNode.publicKey,
                               serverIP: exitNode.address.split("/")[0],
                               tunnelIP: `${clientSubnet.split("/")[0]}/${exitNode.address.split("/")[1]}` // we need to use the exit node's subnet mask here because the client will be using the exit node's subnet mask for its routing table so we can address it

server/routers/olm/handleOlmRelayMessage.ts

@@ -1,10 +1,10 @@
 import { db, exitNodes, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { and, eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
-import config from "@server/lib/config";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmRelayMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -41,29 +41,68 @@ export const handleOlmRelayMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site || !site.exitNodeId) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Relay message has no siteId(s)");
         return;
     }
 
-    // get the site's exit node
-    const [exitNode] = await db
+    // Get the sites
+    const siteRows = await db
         .select()
-        .from(exitNodes)
-        .where(eq(exitNodes.exitNodeId, site.exitNodeId))
-        .limit(1);
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
 
-    if (!exitNode) {
-        logger.warn("Exit node not found for site");
+    const exitNodeIds = [
+        ...new Set(
+            siteRows
+                .map((s) => s.exitNodeId)
+                .filter((id): id is number => id != null)
+        )
+    ];
+
+    // Get the sites' exit nodes
+    const exitNodeRows = exitNodeIds.length
+        ? await db
+              .select()
+              .from(exitNodes)
+              .where(inArray(exitNodes.exitNodeId, exitNodeIds))
+        : [];
+    const exitNodesById = new Map(exitNodeRows.map((e) => [e.exitNodeId, e]));
+
+    const valid: {
+        siteId: number;
+        chainId?: string;
+        relayEndpoint: string;
+        relayPort: number;
+    }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site || !site.exitNodeId) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        const exitNode = exitNodesById.get(site.exitNodeId);
+        if (!exitNode) {
+            logger.warn(`Exit node not found for site ${siteId}`);
+            continue;
+        }
+
+        valid.push({
+            siteId,
+            chainId: chainIds[i],
+            relayEndpoint: exitNode.endpoint,
+            relayPort: exitNode.relayPort
+        });
+    }
+
+    if (valid.length === 0) {
         return;
     }
 
@@ -75,23 +114,64 @@ export const handleOlmRelayMessage: MessageHandler = async (context) => {
         .where(
             and(
                 eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                eq(clientSitesAssociationsCache.siteId, siteId)
+                inArray(
+                    clientSitesAssociationsCache.siteId,
+                    valid.map((v) => v.siteId)
+                )
             )
         );
 
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the newt knows to relay
+    // Only ack sites we can actually tell their newt to relay for
+    const newtIdBySiteId = await resolveNewtIdsBySite(
+        valid.map((v) => v.siteId)
+    );
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt so it knows to relay
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: "" } // this removes the endpoint so the newt knows to relay
+        }))
+    );
+
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/relay",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    relayEndpoints: pushable.map((v) => v.relayEndpoint),
+                    relayPort: pushable.map((v) => v.relayPort),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/relay",
             data: {
-                siteId: siteId,
-                relayEndpoint: exitNode.endpoint,
-                relayPort: config.getRawConfig().gerbil.clients_start_port,
-                chainId
+                siteId: single.siteId,
+                relayEndpoint: single.relayEndpoint,
+                relayPort: single.relayPort,
+                chainId: single.chainId
             }
         },
         broadcast: false,

server/routers/olm/handleOlmServerInitAddPeerHandshake.ts

@@ -97,6 +97,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
             logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Multiple resources found matching the criteria`
             );
+            await sendCancel();
             return;
         }
 
@@ -216,6 +217,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
                 siteId: site.siteId,
                 exitNode: {
                     publicKey: exitNode.publicKey,
+                    relayPort: exitNode.relayPort,
                     endpoint: exitNode.endpoint
                 }
             },

server/routers/olm/handleOlmUnLocalMessage.ts

@@ -1,9 +1,10 @@
-import { db, exitNodes, sites } from "@server/db";
+import { db, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { and, eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmUnLocalMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -40,54 +41,111 @@ export const handleOlmUnLocalMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Unlocal message has no siteId(s)");
         return;
     }
 
-    const [clientSiteAssociation] = await db
+    // Get the sites
+    const siteRows = await db
+        .select()
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
+
+    const assocRows = await db
         .select()
         .from(clientSitesAssociationsCache)
         .where(
             and(
                 eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                eq(clientSitesAssociationsCache.siteId, siteId)
+                inArray(clientSitesAssociationsCache.siteId, siteIds)
             )
         );
+    const assocBySiteId = new Map(assocRows.map((a) => [a.siteId, a]));
 
-    if (!clientSiteAssociation) {
-        logger.warn("Client-Site association not found");
+    const valid: { siteId: number; chainId?: string; endpoint: string }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        const clientSiteAssociation = assocBySiteId.get(siteId);
+        if (!clientSiteAssociation) {
+            logger.warn(`Client-Site association not found for site ${siteId}`);
+            continue;
+        }
+
+        if (!clientSiteAssociation.endpoint) {
+            logger.warn(
+                `Client-Site association has no endpoint, cannot unrelay site ${siteId}`
+            );
+            continue;
+        }
+
+        valid.push({
+            siteId,
+            chainId: chainIds[i],
+            endpoint: clientSiteAssociation.isRelayed
+                ? ""
+                : clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+        });
+    }
+
+    if (valid.length === 0) {
         return;
     }
 
-    if (!clientSiteAssociation.endpoint) {
-        logger.warn("Client-Site association has no endpoint, cannot unrelay");
-        return;
-    }
-
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.isRelayed
-            ? ""
-            : clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+    // Only ack sites we can actually push to their newt
+    const newtIdBySiteId = await resolveNewtIdsBySite(valid.map((v) => v.siteId));
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: v.endpoint }
+        }))
+    );
+
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/unlocal",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/unlocal",
-            data: {
-                siteId: siteId,
-                chainId
-            }
+            data: { siteId: single.siteId, chainId: single.chainId }
         },
         broadcast: false,
         excludeSender: false

server/routers/olm/handleOlmUnRelayMessage.ts

@@ -1,9 +1,10 @@
 import { db, exitNodes, sites } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import { and, eq, inArray } from "drizzle-orm";
+import { updatePeersBatch } from "../newt/peers";
 import logger from "@server/logger";
+import { parseSiteChainBatch, resolveNewtIdsBySite } from "./batchUtils";
 
 export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
@@ -40,21 +41,21 @@ export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { siteId, chainId } = message.data;
+    const { siteIds, chainIds, isBatch } = parseSiteChainBatch(message.data);
 
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site) {
-        logger.warn("Site not found or has no exit node");
+    if (siteIds.length === 0) {
+        logger.warn("Unrelay message has no siteId(s)");
         return;
     }
 
-    const [clientSiteAssociation] = await db
+    // Get the sites
+    const siteRows = await db
+        .select()
+        .from(sites)
+        .where(inArray(sites.siteId, siteIds));
+    const sitesById = new Map(siteRows.map((s) => [s.siteId, s]));
+
+    const assocRows = await db
         .update(clientSitesAssociationsCache)
         .set({
             isRelayed: false
@@ -62,33 +63,100 @@ export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
         .where(
             and(
                 eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                eq(clientSitesAssociationsCache.siteId, siteId)
+                inArray(clientSitesAssociationsCache.siteId, siteIds)
             )
         )
         .returning();
+    const assocBySiteId = new Map(assocRows.map((a) => [a.siteId, a]));
 
-    if (!clientSiteAssociation) {
-        logger.warn("Client-Site association not found");
+    const valid: {
+        siteId: number;
+        chainId?: string;
+        endpoint: string;
+        clientEndpoint: string;
+    }[] = [];
+
+    for (let i = 0; i < siteIds.length; i++) {
+        const siteId = siteIds[i];
+
+        const site = sitesById.get(siteId);
+        if (!site) {
+            logger.warn(`Site ${siteId} not found or has no exit node`);
+            continue;
+        }
+
+        const clientSiteAssociation = assocBySiteId.get(siteId);
+        if (!clientSiteAssociation) {
+            logger.warn(`Client-Site association not found for site ${siteId}`);
+            continue;
+        }
+
+        if (!clientSiteAssociation.endpoint) {
+            logger.warn(
+                `Client-Site association has no endpoint, cannot unrelay site ${siteId}`
+            );
+            continue;
+        }
+
+        valid.push({
+            siteId,
+            chainId: chainIds[i],
+            endpoint: site.endpoint ?? "",
+            clientEndpoint: clientSiteAssociation.endpoint
+        });
+    }
+
+    if (valid.length === 0) {
         return;
     }
 
-    if (!clientSiteAssociation.endpoint) {
-        logger.warn("Client-Site association has no endpoint, cannot unrelay");
-        return;
-    }
-
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+    // Only ack sites we can actually tell their newt to connect directly
+    const newtIdBySiteId = await resolveNewtIdsBySite(valid.map((v) => v.siteId));
+    const pushable = valid.filter((v) => {
+        if (!newtIdBySiteId.has(v.siteId)) {
+            logger.warn(`Newt not found for site ${v.siteId}`);
+            return false;
+        }
+        return true;
     });
 
+    if (pushable.length === 0) {
+        return;
+    }
+
+    // update the peer on each newt to connect directly to the client
+    await updatePeersBatch(
+        pushable.map((v) => ({
+            siteId: v.siteId,
+            publicKey: client.pubKey!,
+            newtId: newtIdBySiteId.get(v.siteId)!,
+            peer: { endpoint: v.clientEndpoint } // this is the endpoint of the client to connect directly to the newt
+        }))
+    );
+
+    if (isBatch) {
+        return {
+            message: {
+                type: "olm/wg/peer/unrelay",
+                data: {
+                    siteIds: pushable.map((v) => v.siteId),
+                    endpoints: pushable.map((v) => v.endpoint),
+                    chainIds: pushable.map((v) => v.chainId)
+                }
+            },
+            broadcast: false,
+            excludeSender: false
+        };
+    }
+
+    const single = pushable[0];
     return {
         message: {
             type: "olm/wg/peer/unrelay",
             data: {
-                siteId: siteId,
-                endpoint: site.endpoint,
-                chainId
+                siteId: single.siteId,
+                endpoint: single.endpoint,
+                chainId: single.chainId
             }
         },
         broadcast: false,

server/routers/olm/offlineChecker.ts

@@ -5,11 +5,10 @@ import { eq, lt, isNull, and, or } from "drizzle-orm";
 import logger from "@server/logger";
 import { sendTerminateClient } from "../client/terminate";
 import { OlmErrorCodes } from "./error";
+import { getOfflineThresholds } from "#dynamic/lib/offlineThresholds";
 
 // Track if the offline checker interval is running
 let offlineCheckerInterval: NodeJS.Timeout | null = null;
-const OFFLINE_CHECK_INTERVAL = 30 * 1000; // Check every 30 seconds
-const OFFLINE_THRESHOLD_MS = 2 * 60 * 1000; // 2 minutes
 
 /**
  * Starts the background interval that checks for clients that haven't pinged recently
@@ -22,13 +21,13 @@ export const startOlmOfflineChecker = (): void => {
 
     offlineCheckerInterval = setInterval(async () => {
         try {
-            const twoMinutesAgo = Math.floor(
-                (Date.now() - OFFLINE_THRESHOLD_MS) / 1000
+            const offlineBefore = Math.floor(
+                (Date.now() - getOfflineThresholds().olmMs) / 1000
             );
 
             // TODO: WE NEED TO MAKE SURE THIS WORKS WITH DISTRIBUTED NODES ALL DOING THE SAME THING
 
-            // Find clients that haven't pinged in the last 2 minutes and mark them as offline
+            // Find clients that haven't pinged within the offline threshold and mark them as offline
             const offlineClients = await db
                 .update(clients)
                 .set({ online: false })
@@ -36,7 +35,7 @@ export const startOlmOfflineChecker = (): void => {
                     and(
                         eq(clients.online, true),
                         or(
-                            lt(clients.lastPing, twoMinutesAgo),
+                            lt(clients.lastPing, offlineBefore),
                             isNull(clients.lastPing)
                         )
                     )
@@ -75,7 +74,7 @@ export const startOlmOfflineChecker = (): void => {
         } catch (error) {
             logger.error("Error in offline checker interval", { error });
         }
-    }, OFFLINE_CHECK_INTERVAL);
+    }, getOfflineThresholds().checkIntervalMs);
 
     logger.debug("Started offline checker interval");
 };

server/routers/olm/peers.ts

@@ -1,7 +1,6 @@
 import { sendToClient, sendToClientsBatch } from "#dynamic/routers/ws";
 import { clientSitesAssociationsCache, db, olms } from "@server/db";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import config from "@server/lib/config";
 import logger from "@server/logger";
 import { and, eq, inArray } from "drizzle-orm";
 import { Alias } from "yaml";
@@ -155,6 +154,7 @@ export async function initPeerAddHandshake(
         siteId: number;
         exitNode: {
             publicKey: string;
+            relayPort: number;
             endpoint: string;
         };
     },
@@ -181,7 +181,7 @@ export async function initPeerAddHandshake(
                 siteId: peer.siteId,
                 exitNode: {
                     publicKey: peer.exitNode.publicKey,
-                    relayPort: config.getRawConfig().gerbil.clients_start_port,
+                    relayPort: peer.exitNode.relayPort,
                     endpoint: peer.exitNode.endpoint
                 },
                 chainId
@@ -297,6 +297,7 @@ export async function initPeerAddHandshakeBatch(
             siteId: number;
             exitNode: {
                 publicKey: string;
+                relayPort: number;
                 endpoint: string;
             };
         };
@@ -317,8 +318,7 @@ export async function initPeerAddHandshakeBatch(
                     siteId: item.peer.siteId,
                     exitNode: {
                         publicKey: item.peer.exitNode.publicKey,
-                        relayPort:
-                            config.getRawConfig().gerbil.clients_start_port,
+                        relayPort: item.peer.exitNode.relayPort,
                         endpoint: item.peer.exitNode.endpoint
                     },
                     chainId: item.chainId

server/routers/olm/sync.ts

@@ -5,13 +5,13 @@ import {
     exitNodes,
     Olm,
     sites,
-    clientSitesAssociationsCache
+    clientSitesAssociationsCache,
+    orgs
 } from "@server/db";
 import { buildSiteConfigurationForOlmClient } from "./buildConfiguration";
 import { sendToClient } from "#dynamic/routers/ws";
 import logger from "@server/logger";
 import { count, eq, inArray } from "drizzle-orm";
-import config from "@server/lib/config";
 import { canCompress } from "@server/lib/clientVersionChecks";
 import { build } from "@server/build";
 
@@ -36,8 +36,19 @@ export async function sendOlmSyncMessage(olm: Olm, client: Client) {
         { orgId: client.orgId }
     );
 
+    const [org] = await db
+        .select()
+        .from(orgs)
+        .where(eq(orgs.orgId, client.orgId))
+        .limit(1);
+
+    if (!org) {
+        logger.warn(`Client ${client.clientId} org not found`);
+        return;
+    }
+
     let jitMode = false;
-    if (sitesCount > 250 && build == "saas") {
+    if (sitesCount > org.settingsJitModeLimit && build == "saas") {
         // THIS IS THE MAX ON THE BUSINESS TIER
         // we have too many sites
         // If we have too many sites we need to drop into fully JIT mode by not sending any of the sites
@@ -113,7 +124,7 @@ export async function sendOlmSyncMessage(olm: Olm, client: Client) {
         exitNodesData = allExitNodes.map((exitNode) => {
             return {
                 publicKey: exitNode.publicKey,
-                relayPort: config.getRawConfig().gerbil.clients_start_port,
+                relayPort: exitNode.relayPort,
                 endpoint: exitNode.endpoint,
                 siteIds: exitNodeIdToSiteIds[exitNode.exitNodeId] ?? []
             };

server/routers/org/deleteOrg.ts

@@ -7,7 +7,7 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { deleteOrgById, sendTerminationMessages } from "@server/lib/deleteOrg";
-import { db, userOrgs, orgs } from "@server/db";
+import { db, Org, userOrgs, orgs } from "@server/db";
 import { eq, and } from "drizzle-orm";
 
 const deleteOrgSchema = z.strictObject({
@@ -59,35 +59,60 @@ export async function deleteOrg(
         }
         const { orgId } = parsedParams.data;
 
-        const [data] = await db
-            .select()
-            .from(userOrgs)
-            .innerJoin(orgs, eq(userOrgs.orgId, orgs.orgId))
-            .where(
-                and(
-                    eq(userOrgs.orgId, orgId),
-                    eq(userOrgs.userId, req.user!.userId)
-                )
-            );
+        let org: Org | undefined;
 
-        const org = data?.orgs;
-        const userOrg = data?.userOrgs;
+        if (req.user) {
+            // Dashboard sessions may delete only an organization the user owns.
+            const [data] = await db
+                .select()
+                .from(userOrgs)
+                .innerJoin(orgs, eq(userOrgs.orgId, orgs.orgId))
+                .where(
+                    and(
+                        eq(userOrgs.orgId, orgId),
+                        eq(userOrgs.userId, req.user.userId)
+                    )
+                );
 
-        if (!org || !userOrg) {
+            if (!data) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Organization with ID ${orgId} not found`
+                    )
+                );
+            }
+
+            if (!data.userOrgs.isOwner) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Only organization owners can delete the organization"
+                    )
+                );
+            }
+
+            org = data.orgs;
+        } else if (req.apiKey) {
+            // Integration API requests carry no user session. The route is already
+            // restricted by verifyApiKeyIsRoot and verifyApiKeyHasAction(deleteOrg).
+            [org] = await db
+                .select()
+                .from(orgs)
+                .where(eq(orgs.orgId, orgId))
+                .limit(1);
+
+            if (!org) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Organization with ID ${orgId} not found`
+                    )
+                );
+            }
+        } else {
             return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Organization with ID ${orgId} not found`
-                )
-            );
-        }
-
-        if (!userOrg.isOwner) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Only organization owners can delete the organization"
-                )
+                createHttpError(HttpCode.UNAUTHORIZED, "Not authenticated")
             );
         }
 

server/routers/resource/createResourceMtlsCertificate.ts

@@ -0,0 +1,239 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resourceMtlsCertificates, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import {
+    MAX_MTLS_CERTIFICATES_PER_RESOURCE,
+    parseCaCertificates
+} from "@server/lib/mtlsCertificate";
+
+const createResourceMtlsCertificateParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createResourceMtlsCertificateBodySchema = z.strictObject({
+    name: z.string().min(1).max(255).optional(),
+    certificate: z.string().min(1).max(100_000)
+});
+
+export type CreateResourceMtlsCertificateResponse = {
+    certificates: {
+        mtlsCertificateId: number;
+        resourceId: number;
+        name: string | null;
+        subject: string | null;
+        issuer: string | null;
+        serialNumber: string | null;
+        fingerprint: string | null;
+        notBefore: number | null;
+        notAfter: number | null;
+        createdAt: number;
+    }[];
+};
+
+const description =
+    "Add a trusted CA certificate that clients must present a certificate signed by when mTLS is enabled on a resource. Accepts a PEM bundle; each certificate in the bundle is stored separately.";
+
+registry.registerPath({
+    method: "put",
+    path: "/resource/{resourceId}/mtls/certificate",
+    description,
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: createResourceMtlsCertificateParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourceMtlsCertificateBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/public-resource/{resourceId}/mtls/certificate",
+    description,
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: createResourceMtlsCertificateParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourceMtlsCertificateBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createResourceMtlsCertificate(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams =
+            createResourceMtlsCertificateParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = createResourceMtlsCertificateBodySchema.safeParse(
+            req.body
+        );
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+        const { name, certificate } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (resource.mode !== "http") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "mTLS is only supported on HTTP resources"
+                )
+            );
+        }
+
+        const isLicensed = await isLicensedOrSubscribed(
+            resource.orgId,
+            tierMatrix.mtls
+        );
+        if (!isLicensed) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
+                )
+            );
+        }
+
+        let parsedCerts;
+        try {
+            parsedCerts = parseCaCertificates(certificate);
+        } catch (e) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    e instanceof Error ? e.message : "Invalid certificate"
+                )
+            );
+        }
+
+        const existing = await db
+            .select({ fingerprint: resourceMtlsCertificates.fingerprint })
+            .from(resourceMtlsCertificates)
+            .where(eq(resourceMtlsCertificates.resourceId, resourceId));
+
+        const existingFingerprints = new Set(existing.map((c) => c.fingerprint));
+        const newCerts = parsedCerts.filter(
+            (c) => !existingFingerprints.has(c.fingerprint)
+        );
+
+        if (newCerts.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.CONFLICT,
+                    parsedCerts.length === 1
+                        ? "This CA certificate has already been added to this resource"
+                        : "All certificates in this bundle have already been added to this resource"
+                )
+            );
+        }
+
+        if (
+            existing.length + newCerts.length >
+            MAX_MTLS_CERTIFICATES_PER_RESOURCE
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `A resource can have at most ${MAX_MTLS_CERTIFICATES_PER_RESOURCE} trusted CA certificates`
+                )
+            );
+        }
+
+        const now = Date.now();
+        const inserted = await db
+            .insert(resourceMtlsCertificates)
+            .values(
+                newCerts.map((c) => ({
+                    resourceId,
+                    // a label only makes sense for a single certificate
+                    name: newCerts.length === 1 ? (name ?? null) : null,
+                    certificate: c.certificate,
+                    subject: c.subject,
+                    issuer: c.issuer,
+                    serialNumber: c.serialNumber,
+                    fingerprint: c.fingerprint,
+                    notBefore: c.notBefore,
+                    notAfter: c.notAfter,
+                    createdAt: now
+                }))
+            )
+            .returning({
+                mtlsCertificateId: resourceMtlsCertificates.mtlsCertificateId,
+                resourceId: resourceMtlsCertificates.resourceId,
+                name: resourceMtlsCertificates.name,
+                subject: resourceMtlsCertificates.subject,
+                issuer: resourceMtlsCertificates.issuer,
+                serialNumber: resourceMtlsCertificates.serialNumber,
+                fingerprint: resourceMtlsCertificates.fingerprint,
+                notBefore: resourceMtlsCertificates.notBefore,
+                notAfter: resourceMtlsCertificates.notAfter,
+                createdAt: resourceMtlsCertificates.createdAt
+            });
+
+        return response<CreateResourceMtlsCertificateResponse>(res, {
+            data: { certificates: inserted },
+            success: true,
+            error: false,
+            message: "CA certificate added successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/deleteResourceMtlsCertificate.ts

@@ -0,0 +1,135 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resourceMtlsCertificates, resources } from "@server/db";
+import { and, count, eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const deleteResourceMtlsCertificateParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive(),
+    mtlsCertificateId: z.coerce.number().int().positive()
+});
+
+const description =
+    "Remove a trusted CA certificate from a resource. If it is the last one, mTLS is disabled on the resource since it can no longer verify any client.";
+
+registry.registerPath({
+    method: "delete",
+    path: "/resource/{resourceId}/mtls/certificate/{mtlsCertificateId}",
+    description,
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: deleteResourceMtlsCertificateParamsSchema
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/public-resource/{resourceId}/mtls/certificate/{mtlsCertificateId}",
+    description,
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: deleteResourceMtlsCertificateParamsSchema
+    },
+    responses: {}
+});
+
+export type DeleteResourceMtlsCertificateResponse = {
+    // true when removing the last CA certificate forced mTLS off
+    mtlsDisabled: boolean;
+};
+
+export async function deleteResourceMtlsCertificate(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams =
+            deleteResourceMtlsCertificateParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { resourceId, mtlsCertificateId } = parsedParams.data;
+
+        const [existing] = await db
+            .select()
+            .from(resourceMtlsCertificates)
+            .where(
+                and(
+                    eq(
+                        resourceMtlsCertificates.mtlsCertificateId,
+                        mtlsCertificateId
+                    ),
+                    eq(resourceMtlsCertificates.resourceId, resourceId)
+                )
+            )
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `CA certificate with ID ${mtlsCertificateId} not found`
+                )
+            );
+        }
+
+        let mtlsDisabled = false;
+        await db.transaction(async (trx) => {
+            await trx
+                .delete(resourceMtlsCertificates)
+                .where(
+                    eq(
+                        resourceMtlsCertificates.mtlsCertificateId,
+                        mtlsCertificateId
+                    )
+                );
+
+            const [{ remaining }] = await trx
+                .select({ remaining: count() })
+                .from(resourceMtlsCertificates)
+                .where(eq(resourceMtlsCertificates.resourceId, resourceId));
+
+            // With no CA left there is nothing to verify clients against, so
+            // leaving mTLS "enabled" would either lock everyone out or be
+            // silently ignored by the Traefik config builder.
+            if (remaining === 0) {
+                const updated = await trx
+                    .update(resources)
+                    .set({ mtlsEnabled: false })
+                    .where(
+                        and(
+                            eq(resources.resourceId, resourceId),
+                            eq(resources.mtlsEnabled, true)
+                        )
+                    )
+                    .returning({ resourceId: resources.resourceId });
+                mtlsDisabled = updated.length > 0;
+            }
+        });
+
+        return response<DeleteResourceMtlsCertificateResponse>(res, {
+            data: { mtlsDisabled },
+            success: true,
+            error: false,
+            message: "CA certificate removed successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/exportResourceBlueprint.ts

@@ -0,0 +1,100 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { generatePublicResourceBlueprintYaml } from "@server/lib/blueprints/exportResourceBlueprint";
+
+const exportResourceBlueprintSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+export type ExportResourceBlueprintResponse = {
+    name: string;
+    contents: string;
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/resource/{resourceId}/blueprint",
+    description:
+        "Generate a blueprint YAML snippet that recreates this resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Blueprint],
+    request: {
+        params: exportResourceBlueprintSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function exportResourceBlueprint(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = exportResourceBlueprintSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select({ niceId: resources.niceId })
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        const { niceId, contents } =
+            await generatePublicResourceBlueprintYaml(resourceId);
+
+        return response<ExportResourceBlueprintResponse>(res, {
+            data: { name: niceId, contents },
+            success: true,
+            error: false,
+            message: "Blueprint generated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                error instanceof Error ? error.message : "An error occurred"
+            )
+        );
+    }
+}

server/routers/resource/index.ts

@@ -21,6 +21,9 @@ export * from "./createResourceRule";
 export * from "./deleteResourceRule";
 export * from "./listResourceRules";
 export * from "./updateResourceRule";
+export * from "./createResourceMtlsCertificate";
+export * from "./deleteResourceMtlsCertificate";
+export * from "./listResourceMtlsCertificates";
 export * from "./getUserResources";
 export * from "./listUserResourceAliases";
 export * from "./setResourceHeaderAuth";
@@ -43,3 +46,4 @@ export * from "./listResourceAiProviders";
 export * from "./setResourceAiProviders";
 export * from "./addAiProviderToResource";
 export * from "./removeAiProviderFromResource";
+export * from "./exportResourceBlueprint";

server/routers/resource/listResourceMtlsCertificates.ts

@@ -0,0 +1,111 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resourceMtlsCertificates, resources } from "@server/db";
+import { asc, eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const listResourceMtlsCertificatesParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+function queryResourceMtlsCertificates(resourceId: number) {
+    return db
+        .select({
+            mtlsCertificateId: resourceMtlsCertificates.mtlsCertificateId,
+            resourceId: resourceMtlsCertificates.resourceId,
+            name: resourceMtlsCertificates.name,
+            subject: resourceMtlsCertificates.subject,
+            issuer: resourceMtlsCertificates.issuer,
+            serialNumber: resourceMtlsCertificates.serialNumber,
+            fingerprint: resourceMtlsCertificates.fingerprint,
+            notBefore: resourceMtlsCertificates.notBefore,
+            notAfter: resourceMtlsCertificates.notAfter,
+            createdAt: resourceMtlsCertificates.createdAt
+        })
+        .from(resourceMtlsCertificates)
+        .where(eq(resourceMtlsCertificates.resourceId, resourceId))
+        .orderBy(asc(resourceMtlsCertificates.mtlsCertificateId));
+}
+
+export type ListResourceMtlsCertificatesResponse = {
+    certificates: Awaited<ReturnType<typeof queryResourceMtlsCertificates>>;
+};
+
+const description = "List the trusted CA certificates for a resource's mTLS.";
+
+registry.registerPath({
+    method: "get",
+    path: "/resource/{resourceId}/mtls/certificates",
+    description,
+    tags: [OpenAPITags.PublicResourceLegacy],
+    request: {
+        params: listResourceMtlsCertificatesParamsSchema
+    },
+    responses: {}
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/public-resource/{resourceId}/mtls/certificates",
+    description,
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: listResourceMtlsCertificatesParamsSchema
+    },
+    responses: {}
+});
+
+export async function listResourceMtlsCertificates(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams =
+            listResourceMtlsCertificatesParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select({ resourceId: resources.resourceId })
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const certificates = await queryResourceMtlsCertificates(resourceId);
+
+        return response<ListResourceMtlsCertificatesResponse>(res, {
+            data: { certificates },
+            success: true,
+            error: false,
+            message: "CA certificates retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/updateResource.ts

@@ -6,6 +6,7 @@ import {
     loginPage,
     resourceHeaderAuth,
     resourceHeaderAuthExtendedCompatibility,
+    resourceMtlsCertificates,
     resourcePassword,
     resourcePincode,
     resourceRules,
@@ -24,7 +25,7 @@ import {
     resourcePolicies,
     resources
 } from "@server/db";
-import { eq, and, ne } from "drizzle-orm";
+import { eq, and, ne, count } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -89,6 +90,12 @@ const updateHttpResourceBodySchema = z
         domainId: z.string().optional(),
         enabled: z.boolean().optional(),
         stickySession: z.boolean().optional(),
+        loadBalancingStrategy: z
+            .enum(["wrr", "p2c", "hrw", "leasttime"])
+            .optional()
+            .describe(
+                "How requests are distributed across targets: wrr (weighted round robin, default), p2c (power of two choices), hrw (highest random weight / client IP hashing), leasttime (lowest response time)."
+            ),
         tlsServerName: z.string().nullable().optional(),
         setHostHeader: z.string().nullable().optional(),
         skipToIdpId: z
@@ -117,6 +124,12 @@ const updateHttpResourceBodySchema = z
         maintenanceTitle: z.string().max(255).nullable().optional(),
         maintenanceMessage: z.string().max(2000).nullable().optional(),
         maintenanceEstimatedTime: z.string().max(100).nullable().optional(),
+        mtlsEnabled: z
+            .boolean()
+            .optional()
+            .describe(
+                "Require clients to present a certificate signed by one of the resource's trusted CA certificates. Requires SSL and at least one CA certificate."
+            ),
         postAuthPath: z.string().nullable().optional(),
         // SSH settings
         pamMode: z.enum(["passthrough", "push"]).optional(),
@@ -508,8 +521,58 @@ async function updateHttpResource(
         }
     }
 
+    const effectiveSsl = updateData.ssl ?? resource.ssl;
+    const effectiveMtlsEnabled = updateData.mtlsEnabled ?? resource.mtlsEnabled;
+
+    if (updateData.mtlsEnabled === true) {
+        if (resource.mode !== "http") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "mTLS is only supported on HTTP resources."
+                )
+            );
+        }
+
+        const isMtlsLicensed = await isLicensedOrSubscribed(
+            resource.orgId,
+            tierMatrix.mtls
+        );
+        if (!isMtlsLicensed) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
+                )
+            );
+        }
+
+        const [{ certificateCount }] = await db
+            .select({ certificateCount: count() })
+            .from(resourceMtlsCertificates)
+            .where(eq(resourceMtlsCertificates.resourceId, resource.resourceId));
+
+        if (certificateCount === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Add at least one trusted CA certificate before enabling mTLS."
+                )
+            );
+        }
+    }
+
+    if (effectiveMtlsEnabled && !effectiveSsl) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                "mTLS requires SSL to be enabled for this resource. Disable mTLS before turning SSL off."
+            )
+        );
+    }
+
     // catch when the resource policy changes or gets cleared
-    if (updateData.resourcePolicyId !== undefined && 
+    if (updateData.resourcePolicyId !== undefined &&
         resource.resourcePolicyId !== updateData.resourcePolicyId) {
         await clearResourceSpecificSettings(
             resource.resourceId,

server/routers/role/deleteRole.ts

@@ -1,8 +1,9 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db } from "@server/db";
+import { Client, clientOrgRoles, clients, db } from "@server/db";
 import { roles, userOrgRoles } from "@server/db";
 import { and, eq, exists, aliasedTable } from "drizzle-orm";
+import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -128,7 +129,21 @@ export async function deleteRole(
             );
         }
 
+        let machineClientsToRebuild: Client[] = [];
         await db.transaction(async (trx) => {
+            // machine clients in this role lose it when the role is deleted
+            // (clientOrgRoles cascades) and are not moved to the new role, so
+            // their associations need to be rebuilt afterwards
+            machineClientsToRebuild = await trx
+                .select({ client: clients })
+                .from(clientOrgRoles)
+                .innerJoin(
+                    clients,
+                    eq(clients.clientId, clientOrgRoles.clientId)
+                )
+                .where(eq(clientOrgRoles.roleId, roleId))
+                .then((rows) => rows.map((row) => row.client));
+
             const uorNewRole = aliasedTable(userOrgRoles, "user_org_roles_new");
 
             // Users who already have newRoleId: drop the old assignment only (unique on userId+orgId+roleId).
@@ -158,6 +173,14 @@ export async function deleteRole(
             await trx.delete(roles).where(eq(roles.roleId, roleId));
         });
 
+        for (const machineClient of machineClientsToRebuild) {
+            rebuildClientAssociationsFromClient(machineClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${machineClient.clientId} after deleting role ${roleId}: ${e}`
+                );
+            });
+        }
+
         return response(res, {
             data: null,
             success: true,

server/routers/role/updateRole.ts

@@ -12,6 +12,7 @@ import { fromError } from "zod-validation-error";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { OpenAPITags, registry } from "@server/openApi";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { pushClientIdentitiesForRole } from "@server/lib/clientIdentities";
 
 const updateRoleParamsSchema = z.strictObject({
     roleId: z.coerce.number().int().positive()
@@ -216,6 +217,16 @@ export async function updateRole(
             );
         }
 
+        if (updateData.name !== undefined && updateData.name !== role[0].name) {
+            // Role names are forwarded by newt as the Remote-Role header.
+            pushClientIdentitiesForRole(roleId, orgId).catch((err) => {
+                logger.error(
+                    `Error pushing client identities after renaming role ${roleId}`,
+                    err
+                );
+            });
+        }
+
         return response(res, {
             data: updatedRole,
             success: true,

server/routers/siteResource/createSiteResource.ts

@@ -53,7 +53,7 @@ const createSiteResourceSchema = z
         name: z.string().min(1).max(255),
         niceId: z.string().optional(),
         // protocol: z.enum(["tcp", "udp"]).optional(),
-        mode: z.enum(["host", "cidr", "http", "ssh", "inference"]),
+        mode: z.enum(["host", "cidr", "http", "ssh", "inference", "gateway"]),
         ssl: z.boolean().optional(), // only used for http mode
         scheme: z.enum(["http", "https"]).optional(),
         siteIds: z.array(z.int()).optional(),
@@ -165,10 +165,11 @@ const createSiteResourceSchema = z
     )
     .refine(
         (data) => {
-            // destination is only optional for ssh mode with native authDaemonMode or inference
+            // destination is only optional for ssh mode with native authDaemonMode, inference, or gateway
             if (
                 (data.mode === "ssh" && data.authDaemonMode === "native") ||
-                data.mode == "inference"
+                data.mode == "inference" ||
+                data.mode == "gateway"
             ) {
                 return true;
             }
@@ -179,7 +180,7 @@ const createSiteResourceSchema = z
         },
         {
             message:
-                "Destination is required unless mode is ssh with authDaemonMode native or inference"
+                "Destination is required unless mode is ssh with authDaemonMode native, inference, or gateway"
         }
     )
     .refine(
@@ -447,14 +448,18 @@ export async function createSiteResource(
             );
         }
 
+        // gateway resources always route the whole subnet with everything open
+        const effectiveDestination =
+            mode === "gateway" ? "0.0.0.0/0" : destination;
+
         // Only check if destination is an IP address
         const isIp = z
             .union([z.ipv4(), z.ipv6()])
-            .safeParse(destination).success;
+            .safeParse(effectiveDestination).success;
         if (
             isIp &&
-            (isIpInCidr(destination!, org.subnet) ||
-                isIpInCidr(destination!, org.utilitySubnet))
+            (isIpInCidr(effectiveDestination!, org.subnet) ||
+                isIpInCidr(effectiveDestination!, org.utilitySubnet))
         ) {
             return next(
                 createHttpError(
@@ -584,6 +589,32 @@ export async function createSiteResource(
                     tcpPortRangeStringAdjusted = destinationPort
                         ? destinationPort.toString()
                         : "22";
+                } else if (mode === "gateway") {
+                    tcpPortRangeStringAdjusted = "*";
+                }
+
+                let udpPortRangeStringAdjusted = udpPortRangeString;
+                if (mode === "gateway") {
+                    udpPortRangeStringAdjusted = "*";
+                } else if (
+                    mode === "http" ||
+                    mode === "ssh" ||
+                    mode === "inference"
+                ) {
+                    udpPortRangeStringAdjusted = "";
+                }
+
+                // default to true for http/ssh/inference, false otherwise;
+                // gateway always allows icmp
+                let disableIcmpAdjusted = disableIcmp ?? false;
+                if (mode === "gateway") {
+                    disableIcmpAdjusted = false;
+                } else if (
+                    mode === "http" ||
+                    mode === "ssh" ||
+                    mode === "inference"
+                ) {
+                    disableIcmpAdjusted = true;
                 }
 
                 // Create the site resource
@@ -594,21 +625,14 @@ export async function createSiteResource(
                     mode,
                     ssl,
                     networkId: network ? network.networkId : null,
-                    destination: destination, // the ssh can be null
+                    destination: effectiveDestination, // the ssh can be null
                     scheme,
                     destinationPort,
                     alias: alias ? alias.trim() : null,
                     aliasAddress,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,
-                    udpPortRangeString:
-                        mode == "http" || mode == "ssh" || mode == "inference"
-                            ? ""
-                            : udpPortRangeString,
-                    disableIcmp:
-                        disableIcmp ||
-                        (mode == "http" || mode == "ssh" || mode == "inference"
-                            ? true
-                            : false), // default to true for http resources, otherwise false
+                    udpPortRangeString: udpPortRangeStringAdjusted,
+                    disableIcmp: disableIcmpAdjusted,
                     domainId,
                     subdomain: finalSubdomain,
                     fullDomain,

server/routers/siteResource/exportSiteResourceBlueprint.ts

@@ -0,0 +1,100 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, siteResources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { generatePrivateResourceBlueprintYaml } from "@server/lib/blueprints/exportResourceBlueprint";
+
+const exportSiteResourceBlueprintSchema = z.strictObject({
+    siteResourceId: z.coerce.number().int().positive()
+});
+
+export type ExportSiteResourceBlueprintResponse = {
+    name: string;
+    contents: string;
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/site-resource/{siteResourceId}/blueprint",
+    description:
+        "Generate a blueprint YAML snippet that recreates this site resource.",
+    tags: [OpenAPITags.PrivateResource, OpenAPITags.Blueprint],
+    request: {
+        params: exportSiteResourceBlueprintSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function exportSiteResourceBlueprint(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = exportSiteResourceBlueprintSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { siteResourceId } = parsedParams.data;
+
+        const [siteResource] = await db
+            .select({ niceId: siteResources.niceId })
+            .from(siteResources)
+            .where(eq(siteResources.siteResourceId, siteResourceId))
+            .limit(1);
+
+        if (!siteResource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Site resource not found")
+            );
+        }
+
+        const { niceId, contents } =
+            await generatePrivateResourceBlueprintYaml(siteResourceId);
+
+        return response<ExportSiteResourceBlueprintResponse>(res, {
+            data: { name: niceId, contents },
+            success: true,
+            error: false,
+            message: "Blueprint generated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                error instanceof Error ? error.message : "An error occurred"
+            )
+        );
+    }
+}

server/routers/siteResource/index.ts

@@ -25,3 +25,4 @@ export * from "./listSiteResourceAiProviders";
 export * from "./setSiteResourceAiProviders";
 export * from "./addAiProviderToSiteResource";
 export * from "./removeAiProviderFromSiteResource";
+export * from "./exportSiteResourceBlueprint";

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -55,12 +55,12 @@ const listAllSiteResourcesByOrgQuerySchema = z.strictObject({
         }),
     query: z.string().optional(),
     mode: z
-        .enum(["host", "cidr", "http", "ssh", "inference"])
+        .enum(["host", "cidr", "http", "ssh", "inference", "gateway"])
         .optional()
         .catch(undefined)
         .openapi({
             type: "string",
-            enum: ["host", "cidr", "http", "ssh", "inference"],
+            enum: ["host", "cidr", "http", "ssh", "inference", "gateway"],
             description: "Filter site resources by mode"
         }),
     sort_by: z

server/routers/siteResource/updateSiteResource.ts

@@ -51,7 +51,9 @@ const updateSiteResourceSchema = z
             )
             .optional(),
         // mode: z.enum(["host", "cidr", "port"]).optional(),
-        mode: z.enum(["host", "cidr", "http", "ssh", "inference"]).optional(),
+        mode: z
+            .enum(["host", "cidr", "http", "ssh", "inference", "gateway"])
+            .optional(),
         ssl: z.boolean().optional(),
         scheme: z.enum(["http", "https"]).nullish(),
         destinationPort: z.int().positive().nullish(),
@@ -158,10 +160,11 @@ const updateSiteResourceSchema = z
             if (data.mode === undefined && data.destination === undefined) {
                 return true;
             }
-            // destination is only optional for ssh mode with native authDaemonMode or inference
+            // destination is only optional for ssh mode with native authDaemonMode, inference, or gateway
             if (
                 (data.mode === "ssh" && data.authDaemonMode === "native") ||
-                data.mode == "inference"
+                data.mode == "inference" ||
+                data.mode == "gateway"
             ) {
                 return true;
             }
@@ -172,7 +175,7 @@ const updateSiteResourceSchema = z
         },
         {
             message:
-                "Destination is required unless mode is ssh with authDaemonMode native or inference"
+                "Destination is required unless mode is ssh with authDaemonMode native, inference, or gateway"
         }
     )
     .refine(
@@ -409,14 +412,18 @@ export async function updateSiteResource(
             }
         }
 
+        // gateway resources always route the whole subnet with everything open
+        const effectiveDestination =
+            mode === "gateway" ? "0.0.0.0/0" : destination;
+
         // Only check if destination is an IP address
         const isIp = z
             .union([z.ipv4(), z.ipv6()])
-            .safeParse(destination).success;
+            .safeParse(effectiveDestination).success;
         if (
             isIp &&
-            (isIpInCidr(destination!, org.subnet) ||
-                isIpInCidr(destination!, org.utilitySubnet))
+            (isIpInCidr(effectiveDestination!, org.subnet) ||
+                isIpInCidr(effectiveDestination!, org.utilitySubnet))
         ) {
             return next(
                 createHttpError(
@@ -542,6 +549,34 @@ export async function updateSiteResource(
                 tcpPortRangeStringAdjusted = destinationPort
                     ? destinationPort.toString()
                     : "22";
+            } else if (mode === "gateway") {
+                tcpPortRangeStringAdjusted = "*";
+            }
+
+            // undefined means "leave unchanged" (partial update); only
+            // adjusted when the mode is explicitly being changed
+            let udpPortRangeStringAdjusted = udpPortRangeString;
+            if (mode === "gateway") {
+                udpPortRangeStringAdjusted = "*";
+            } else if (
+                mode === "http" ||
+                mode === "ssh" ||
+                mode === "inference"
+            ) {
+                udpPortRangeStringAdjusted = "";
+            }
+
+            let disableIcmpAdjusted = disableIcmp;
+            if (mode === "gateway") {
+                disableIcmpAdjusted = false;
+            } else if (
+                mode === "http" ||
+                mode === "ssh" ||
+                mode === "inference"
+            ) {
+                disableIcmpAdjusted = true;
+            } else if (mode !== undefined) {
+                disableIcmpAdjusted = disableIcmp ?? false;
             }
 
             [updatedSiteResource] = await trx
@@ -552,7 +587,8 @@ export async function updateSiteResource(
                     mode: mode,
                     scheme,
                     ssl,
-                    destination: destination,
+                    destination:
+                        mode === "gateway" ? effectiveDestination : destination,
                     destinationPort: destinationPort,
                     enabled: enabled,
                     alias:
@@ -562,19 +598,8 @@ export async function updateSiteResource(
                                 : null
                             : undefined,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,
-                    udpPortRangeString:
-                        mode == "http" || mode == "ssh" || mode == "inference"
-                            ? ""
-                            : udpPortRangeString,
-                    disableIcmp:
-                        mode !== undefined
-                            ? disableIcmp ||
-                              (mode == "http" ||
-                              mode == "ssh" ||
-                              mode == "inference"
-                                  ? true
-                                  : false)
-                            : disableIcmp,
+                    udpPortRangeString: udpPortRangeStringAdjusted,
+                    disableIcmp: disableIcmpAdjusted,
                     domainId,
                     subdomain: finalSubdomain,
                     fullDomain,

server/routers/traefik/traefikConfigProvider.ts

@@ -51,6 +51,10 @@ export async function traefikConfigProvider(
                                         .internal_hostname
                                 }:${config.getRawConfig().server.internal_port}`
                             ).href,
+                        disableDefaultCFIPs: config.getRawConfig().server.trust_ips.length > 0,
+                        customIPHeader: config.getRawConfig().server.custom_ip_header,
+                        trustip: config.getRawConfig().server.trust_ips,
+
                         userSessionCookieName:
                             config.getRawConfig().server.session_cookie_name,
 

server/routers/ws/handleRoundTripMessage.ts

@@ -9,9 +9,7 @@ interface RoundTripCompleteMessage {
     error?: string;
 }
 
-export const handleRoundTripMessage: MessageHandler = async (
-    context
-) => {
+export const handleRoundTripMessage: MessageHandler = async (context) => {
     const { message, client: c } = context;
 
     logger.info("Handling round trip message");
@@ -36,10 +34,14 @@ export const handleRoundTripMessage: MessageHandler = async (
             })
             .where(eq(roundTripMessageTracker.messageId, messageId));
 
-        logger.info(`Round trip message ${messageId} marked as complete: ${complete}`);
+        logger.info(
+            `Round trip message ${messageId} marked as complete: ${complete}`
+        );
 
         if (error) {
-            logger.warn(`Round trip message ${messageId} completed with error: ${error}`);
+            logger.debug(
+                `Round trip message ${messageId} did not complete: ${error}`
+            );
         }
     } catch (error) {
         logger.error("Error processing round trip message:", error);

server/routers/ws/types.ts

@@ -104,4 +104,9 @@ export type RedisMessage =
           message: WSMessage;
           fromNodeId: string;
           options?: SendMessageOptions;
+      }
+    | {
+          type: "disconnect";
+          targetClientId: string;
+          fromNodeId: string;
       };