First pass at HA

Adjust build functions
WIP - more conversion
2026-03-23 19:16:41 +00:00 · 2026-03-23 11:44:02 -07:00 · 2026-03-22 14:40:57 -07:00 · 2026-03-22 14:29:47 -07:00 · 2026-03-22 14:18:34 -07:00 · 2026-03-21 10:40:12 -07:00
52 changed files with 2623 additions and 2001 deletions
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -77,7 +77,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

            - name: Log in to Docker Hub
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -264,7 +264,7 @@ jobs:
              shell: bash

            - name: Install Go
-              uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+              uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
              with:
                  go-version: 1.24

@@ -299,7 +299,7 @@ jobs:
              shell: bash

            - name: Upload artifacts from /install/bin
-              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
              with:
                  name: install-bin
                  path: install/bin/
@@ -407,7 +407,7 @@ jobs:
              shell: bash

            - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
              with:
                registry: ghcr.io
                username: ${{ github.actor }}
@@ -415,7 +415,7 @@ jobs:

            - name: Install cosign
              # cosign is used to sign and verify container images (key and keyless)
-              uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+              uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

            - name: Dual-sign and verify (GHCR & Docker Hub)
              # Sign each image by digest using keyless (OIDC) and key-based signing,
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -24,7 +24,7 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

            - name: Set up Node.js
-              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+              uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
              with:
                node-version: '24'

--- a/.github/workflows/mirror.yaml
+++ b/.github/workflows/mirror.yaml
@@ -23,7 +23,7 @@ jobs:
          skopeo --version

      - name: Install cosign
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Input check
        run: |
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,7 +17,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: '24'

--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@

 <p align="center">
    <strong>
-        Get started with Pangolin at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
+        Start testing Pangolin at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
    </strong>
 </p>

@@ -60,9 +60,9 @@ Pangolin is an open-source, identity-based remote access platform built on WireG

 | <img width=500 /> | Description |
 |-----------------|--------------|
-| **Pangolin Cloud** | Fully managed service with instant setup and pay-as-you-go pricing — no infrastructure required. Or, self-host your own [remote node](https://docs.pangolin.net/manage/remote-node/understanding-nodes) and connect to our control plane. |
 | **Self-Host: Community Edition** | Free, open source, and licensed under AGPL-3. |
 | **Self-Host: Enterprise Edition** | Licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses earning under \$100K USD annually. |
+| **Pangolin Cloud** | Fully managed service with instant setup and pay-as-you-go pricing — no infrastructure required. Or, self-host your own [remote node](https://docs.pangolin.net/manage/remote-node/nodes) and connect to our control plane. |

 ## Key Features

@@ -85,16 +85,17 @@ Download the Pangolin client for your platform:

 ## Get Started

-### Sign up now
-
-Create an account at [app.pangolin.net](https://app.pangolin.net) to get started with Pangolin Cloud. A generous free tier is available.
-
 ### Check out the docs

 We encourage everyone to read the full documentation first, which is
 available at [docs.pangolin.net](https://docs.pangolin.net). This README provides only a very brief subset of
 the docs to illustrate some basic ideas.

+### Sign up and try now
+
+For Pangolin's managed service, you will first need to create an account at
+[app.pangolin.net](https://app.pangolin.net). We have a generous free tier to get started.
+
 ## Licensing

 Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License](https://pangolin.net/fcl.html). For inquiries about commercial licensing, please contact us at [contact@pangolin.net](mailto:contact@pangolin.net).
--- a/install/go.mod
+++ b/install/go.mod
@@ -1,11 +1,11 @@
 module installer

-go 1.25.0
+go 1.24.0

 require (
 	github.com/charmbracelet/huh v0.8.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.41.0
+	golang.org/x/term v0.40.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )
--- a/install/go.sum
+++ b/install/go.sum
@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Прокси заявки чрез HTTPS, използвайки напълно квалифицирано име на домейн.",
    "resourceRaw": "Суров TCP/UDP ресурс",
    "resourceRawDescription": "Прокси заявки чрез сурови TCP/UDP, използвайки порт номер.",
-    "resourceRawDescriptionCloud": "Получавайте заявки чрез суров TCP/UDP с използване на портен номер. Изисква се сайтовете да се свързват към отдалечен възел.",
+    "resourceRawDescriptionCloud": "Прокси заявките през суров TCP/UDP, използвайки номер на порт. ИЗИСКВА ИЗПОЛЗВАНЕ НА ОТДАЛЕЧЕН УЗЕЛ.",
    "resourceCreate": "Създайте ресурс",
    "resourceCreateDescription": "Следвайте стъпките по-долу, за да създадете нов ресурс",
    "resourceSeeAll": "Вижте всички ресурси",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Име на пространство: {namespace}",
    "domainPickerShowMore": "Покажи повече",
    "regionSelectorTitle": "Избор на регион",
-    "domainPickerRemoteExitNodeWarning": "Предоставените домейни не се поддържат, когато сайтовете се свързват към отдалечени крайни възли. За да бъдат ресурсите налични на отдалечени възли, използвайте персонализиран домейн вместо това.",
    "regionSelectorInfo": "Изборът на регион ни помага да предоставим по-добра производителност за вашето местоположение. Не е необходимо да сте в същия регион като сървъра.",
    "regionSelectorPlaceholder": "Изберете регион",
    "regionSelectorComingSoon": "Очаква се скоро",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Край на следващата година",
    "actionLogsDescription": "Прегледайте историята на действията, извършени в тази организация",
    "accessLogsDescription": "Прегледайте заявките за удостоверяване на достъпа до ресурсите в тази организация",
-    "licenseRequiredToUse": "Изисква се лиценз за <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> или <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> за използване на тази функция. <bookADemoLink>Резервирайте демонстрация или пробен POC</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> е необходим за използване на тази функция. Тази функция също е налична в <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Резервирайте демонстрация или пробен POC</bookADemoLink>.",
+    "licenseRequiredToUse": "Изисква се лиценз за <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink>, за да използвате тази функция. Тази функция е също достъпна в <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "Необходимо е <enterpriseEditionLink>изданието Enterprise</enterpriseEditionLink>, за да използвате тази функция. Тази функция е също достъпна в <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Решавач на сертификати",
    "certResolverDescription": "Изберете решавач на сертификати за използване за този ресурс.",
    "selectCertResolver": "Изберете решавач на сертификати",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Активирайте одобрения на устройства",
    "approvalsEmptyStateStep2Description": "Редактирайте ролята и активирайте опцията 'Изискване на одобрения за устройства'. Потребители с тази роля ще трябва администраторско одобрение за нови устройства.",
    "approvalsEmptyStatePreviewDescription": "Преглед: Когато е активирано, чакащите заявки за устройства ще се появят тук за преглед",
-    "approvalsEmptyStateButtonText": "Управлявайте роли",
-    "domainErrorTitle": "Имаме проблем с проверката на вашия домейн"
+    "approvalsEmptyStateButtonText": "Управлявайте роли"
 }
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxy požadavky přes HTTPS pomocí plně kvalifikovaného názvu domény.",
    "resourceRaw": "Surový TCP/UDP zdroj",
    "resourceRawDescription": "Proxy požadavky přes nezpracovaný TCP/UDP pomocí čísla portu.",
-    "resourceRawDescriptionCloud": "Proxy požadavky na syrové TCP/UDP pomocí čísla portu. Vyžaduje připojení stránek ke vzdálenému uzlu.",
+    "resourceRawDescriptionCloud": "Požadavky na proxy přes syrové TCP/UDP pomocí portového čísla. ŽÁDOSTI POUŽÍVAT POUŽITÍ Z REMOTE NODE.",
    "resourceCreate": "Vytvořit zdroj",
    "resourceCreateDescription": "Postupujte podle níže uvedených kroků, abyste vytvořili a připojili nový zdroj",
    "resourceSeeAll": "Zobrazit všechny zdroje",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Jmenný prostor: {namespace}",
    "domainPickerShowMore": "Zobrazit více",
    "regionSelectorTitle": "Vybrat region",
-    "domainPickerRemoteExitNodeWarning": "Poskytnuté domény nejsou podporovány, když se stránky připojují k vzdáleným výstupním uzlům. Pro dostupné zdroje na vzdálených uzlech použijte vlastní doménu.",
    "regionSelectorInfo": "Výběr regionu nám pomáhá poskytovat lepší výkon pro vaši polohu. Nemusíte být ve stejném regionu jako váš server.",
    "regionSelectorPlaceholder": "Vyberte region",
    "regionSelectorComingSoon": "Již brzy",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Konec následujícího roku",
    "actionLogsDescription": "Zobrazit historii akcí provedených v této organizaci",
    "accessLogsDescription": "Zobrazit žádosti o ověření přístupu pro zdroje v této organizaci",
-    "licenseRequiredToUse": "Pro použití této funkce je vyžadována licence <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> nebo <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> . <bookADemoLink>Zarezervujte si demo nebo POC zkušební verzi</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> je vyžadována pro použití této funkce. Tato funkce je také k dispozici v <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Rezervujte si demo nebo POC zkušební verzi</bookADemoLink>.",
+    "licenseRequiredToUse": "Pro použití této funkce je vyžadována licence <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> . Tato funkce je také dostupná v <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> je vyžadována pro použití této funkce. Tato funkce je také k dispozici v <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Oddělovač certifikátů",
    "certResolverDescription": "Vyberte řešitele certifikátů pro tento dokument.",
    "selectCertResolver": "Vyberte řešič certifikátů",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Povolit schválení zařízení",
    "approvalsEmptyStateStep2Description": "Upravte roli a povolte možnost 'Vyžadovat schválení zařízení'. Uživatelé s touto rolí budou potřebovat schválení pro nová zařízení správce.",
    "approvalsEmptyStatePreviewDescription": "Náhled: Pokud je povoleno, čekající na zařízení se zde zobrazí žádosti o recenzi",
-    "approvalsEmptyStateButtonText": "Spravovat role",
-    "domainErrorTitle": "Máme problém s ověřením tvé domény"
+    "approvalsEmptyStateButtonText": "Spravovat role"
 }
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxy-Anfragen über HTTPS mit einem voll qualifizierten Domain-Namen.",
    "resourceRaw": "Direkte TCP/UDP Ressource (raw)",
    "resourceRawDescription": "Proxy-Anfragen über rohes TCP/UDP mit einer Portnummer.",
-    "resourceRawDescriptionCloud": "Proxy-Anfragen über rohe TCP/UDP mit Portnummer. Benötigt Sites, um sich mit einem entfernten Knoten zu verbinden.",
+    "resourceRawDescriptionCloud": "Proxy-Anfragen über rohe TCP/UDP mit einer Portnummer. Erfordert die NUTZUNG eines REMOTE Knotens.",
    "resourceCreate": "Ressource erstellen",
    "resourceCreateDescription": "Folgen Sie den Schritten unten, um eine neue Ressource zu erstellen",
    "resourceSeeAll": "Alle Ressourcen anzeigen",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Namespace: {namespace}",
    "domainPickerShowMore": "Mehr anzeigen",
    "regionSelectorTitle": "Region auswählen",
-    "domainPickerRemoteExitNodeWarning": "Angegebene Domains werden nicht unterstützt, wenn sich Websites mit externen Exit-Knoten verbinden. Damit Ressourcen auf entfernten Knoten verfügbar sind, verwenden Sie stattdessen eine eigene Domain.",
    "regionSelectorInfo": "Das Auswählen einer Region hilft uns, eine bessere Leistung für Ihren Standort bereitzustellen. Sie müssen sich nicht in derselben Region wie Ihr Server befinden.",
    "regionSelectorPlaceholder": "Wähle eine Region",
    "regionSelectorComingSoon": "Kommt bald",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Ende des folgenden Jahres",
    "actionLogsDescription": "Verlauf der in dieser Organisation durchgeführten Aktionen anzeigen",
    "accessLogsDescription": "Zugriffsauth-Anfragen für Ressourcen in dieser Organisation anzeigen",
-    "licenseRequiredToUse": "Eine <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> Lizenz oder <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> wird benötigt, um diese Funktion nutzen zu können. <bookADemoLink>Buchen Sie eine Demo oder POC Testversion</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "Die <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> wird benötigt, um diese Funktion nutzen zu können. Diese Funktion ist auch in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>verfügbar. <bookADemoLink>Buchen Sie eine Demo oder POC Testversion</bookADemoLink>.",
+    "licenseRequiredToUse": "Um diese Funktion nutzen zu können, ist eine <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> Lizenz erforderlich. Diese Funktion ist auch in der <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> verfügbar.",
+    "ossEnterpriseEditionRequired": "Um diese Funktion nutzen zu können, ist die <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> erforderlich. Diese Funktion ist auch in der <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> verfügbar.",
    "certResolver": "Zertifikatsauflöser",
    "certResolverDescription": "Wählen Sie den Zertifikatslöser aus, der für diese Ressource verwendet werden soll.",
    "selectCertResolver": "Zertifikatsauflöser auswählen",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Gerätegenehmigungen aktivieren",
    "approvalsEmptyStateStep2Description": "Bearbeite eine Rolle und aktiviere die Option 'Gerätegenehmigung erforderlich'. Benutzer mit dieser Rolle benötigen Administrator-Genehmigung für neue Geräte.",
    "approvalsEmptyStatePreviewDescription": "Vorschau: Wenn aktiviert, werden ausstehende Geräteanfragen hier zur Überprüfung angezeigt",
-    "approvalsEmptyStateButtonText": "Rollen verwalten",
-    "domainErrorTitle": "Wir haben Probleme mit der Überprüfung deiner Domain"
+    "approvalsEmptyStateButtonText": "Rollen verwalten"
 }
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxy requests over HTTPS using a fully qualified domain name.",
    "resourceRaw": "Raw TCP/UDP Resource",
    "resourceRawDescription": "Proxy requests over raw TCP/UDP using a port number.",
-    "resourceRawDescriptionCloud": "Proxy requests over raw TCP/UDP using a port number. Requires sites to connect to a remote node.",
+    "resourceRawDescriptionCloud": "Proxy requests over raw TCP/UDP using a port number. REQUIRES THE USE OF A REMOTE NODE.",
    "resourceCreate": "Create Resource",
    "resourceCreateDescription": "Follow the steps below to create a new resource",
    "resourceSeeAll": "See All Resources",
@@ -1120,7 +1120,6 @@
    "setupTokenDescription": "Enter the setup token from the server console.",
    "setupTokenRequired": "Setup token is required",
    "actionUpdateSite": "Update Site",
-    "actionResetSiteBandwidth": "Reset Organization Bandwidth",
    "actionListSiteRoles": "List Allowed Site Roles",
    "actionCreateResource": "Create Resource",
    "actionDeleteResource": "Delete Resource",
@@ -1428,7 +1427,6 @@
    "domainPickerNamespace": "Namespace: {namespace}",
    "domainPickerShowMore": "Show More",
    "regionSelectorTitle": "Select Region",
-    "domainPickerRemoteExitNodeWarning": "Provided domains are not supported when sites connect to remote exit nodes. For resources to be available on remote nodes, use a custom domain instead.",
    "regionSelectorInfo": "Selecting a region helps us provide better performance for your location. You do not have to be in the same region as your server.",
    "regionSelectorPlaceholder": "Choose a region",
    "regionSelectorComingSoon": "Coming Soon",
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxy proporciona solicitudes sobre HTTPS usando un nombre de dominio completamente calificado.",
    "resourceRaw": "Recurso TCP/UDP sin procesar",
    "resourceRawDescription": "Proxy proporciona solicitudes sobre TCP/UDP usando un número de puerto.",
-    "resourceRawDescriptionCloud": "Las peticiones de proxy sobre TCP/UDP crudas usando un número de puerto. Requiere que los sitios se conecten a un nodo remoto.",
+    "resourceRawDescriptionCloud": "Las peticiones de proxy sobre TCP/UDP crudas usando un número de puerto. REQUIERE EL USO DE UN NODO REMOTE.",
    "resourceCreate": "Crear Recurso",
    "resourceCreateDescription": "Siga los siguientes pasos para crear un nuevo recurso",
    "resourceSeeAll": "Ver todos los recursos",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Espacio de nombres: {namespace}",
    "domainPickerShowMore": "Mostrar más",
    "regionSelectorTitle": "Seleccionar Región",
-    "domainPickerRemoteExitNodeWarning": "Los dominios suministrados no son compatibles cuando los sitios se conectan a nodos de salida remotos. Para que los recursos estén disponibles en nodos remotos, utilice un dominio personalizado en su lugar.",
    "regionSelectorInfo": "Seleccionar una región nos ayuda a brindar un mejor rendimiento para tu ubicación. No tienes que estar en la misma región que tu servidor.",
    "regionSelectorPlaceholder": "Elige una región",
    "regionSelectorComingSoon": "Próximamente",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Fin del año siguiente",
    "actionLogsDescription": "Ver un historial de acciones realizadas en esta organización",
    "accessLogsDescription": "Ver solicitudes de acceso a los recursos de esta organización",
-    "licenseRequiredToUse": "Se requiere una licencia <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> o <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> para usar esta función. <bookADemoLink>Reserve una demostración o prueba POC</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "La <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> es necesaria para utilizar esta función. Esta función también está disponible en <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Reserva una demostración o prueba POC</bookADemoLink>.",
+    "licenseRequiredToUse": "Se requiere una licencia <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> para utilizar esta función. Esta característica también está disponible en <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "La <enterpriseEditionLink>versión Enterprise</enterpriseEditionLink> es necesaria para utilizar esta función. Esta función también está disponible en <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Resolver certificado",
    "certResolverDescription": "Seleccione la resolución de certificados a utilizar para este recurso.",
    "selectCertResolver": "Seleccionar Resolver Certificado",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Habilitar aprobaciones de dispositivo",
    "approvalsEmptyStateStep2Description": "Editar un rol y habilitar la opción 'Requerir aprobaciones de dispositivos'. Los usuarios con este rol necesitarán la aprobación del administrador para nuevos dispositivos.",
    "approvalsEmptyStatePreviewDescription": "Vista previa: Cuando está habilitado, las solicitudes de dispositivo pendientes aparecerán aquí para su revisión",
-    "approvalsEmptyStateButtonText": "Administrar roles",
-    "domainErrorTitle": "Estamos teniendo problemas para verificar su dominio"
+    "approvalsEmptyStateButtonText": "Administrar roles"
 }
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxy les demandes sur HTTPS en utilisant un nom de domaine entièrement qualifié.",
    "resourceRaw": "Ressource TCP/UDP brute",
    "resourceRawDescription": "Proxy les demandes sur TCP/UDP brut en utilisant un numéro de port.",
-    "resourceRawDescriptionCloud": "Requêtes de proxy sur TCP/UDP brute en utilisant un numéro de port. Nécessite des sites pour se connecter à un noeud distant.",
+    "resourceRawDescriptionCloud": "Requêtes de proxy sur TCP/UDP brute en utilisant un numéro de port. REQUISE L'UTILISATION D'UN Nœud DE REMOTE.",
    "resourceCreate": "Créer une ressource",
    "resourceCreateDescription": "Suivez les étapes ci-dessous pour créer une nouvelle ressource",
    "resourceSeeAll": "Voir toutes les ressources",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Espace de noms : {namespace}",
    "domainPickerShowMore": "Afficher plus",
    "regionSelectorTitle": "Sélectionner Région",
-    "domainPickerRemoteExitNodeWarning": "Les domaines fournis ne sont pas pris en charge lorsque les sites se connectent à des nœuds de sortie distants. Pour que les ressources soient disponibles sur des nœuds distants, utilisez un domaine personnalisé à la place.",
    "regionSelectorInfo": "Sélectionner une région nous aide à offrir de meilleures performances pour votre localisation. Vous n'avez pas besoin d'être dans la même région que votre serveur.",
    "regionSelectorPlaceholder": "Choisissez une région",
    "regionSelectorComingSoon": "Bientôt disponible",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Fin de l'année suivante",
    "actionLogsDescription": "Voir l'historique des actions effectuées dans cette organisation",
    "accessLogsDescription": "Voir les demandes d'authentification d'accès aux ressources de cette organisation",
-    "licenseRequiredToUse": "Une <enterpriseLicenseLink>licence Enterprise Edition</enterpriseLicenseLink> ou <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> est requise pour utiliser cette fonctionnalité. <bookADemoLink>Réservez une démonstration ou une évaluation de POC</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "La version <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> est requise pour utiliser cette fonctionnalité. Cette fonctionnalité est également disponible dans <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Réservez une démo ou un essai POC</bookADemoLink>.",
+    "licenseRequiredToUse": "Une licence <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> est nécessaire pour utiliser cette fonctionnalité. Cette fonctionnalité est également disponible dans <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "La version <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> est requise pour utiliser cette fonctionnalité. Cette fonctionnalité est également disponible dans <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Résolveur de certificat",
    "certResolverDescription": "Sélectionnez le solveur de certificat à utiliser pour cette ressource.",
    "selectCertResolver": "Sélectionnez le résolveur de certificat",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Activer les autorisations de l'appareil",
    "approvalsEmptyStateStep2Description": "Modifier un rôle et activer l'option 'Exiger les autorisations de l'appareil'. Les utilisateurs avec ce rôle auront besoin de l'approbation de l'administrateur pour les nouveaux appareils.",
    "approvalsEmptyStatePreviewDescription": "Aperçu: Lorsque cette option est activée, les demandes de périphérique en attente apparaîtront ici pour vérification",
-    "approvalsEmptyStateButtonText": "Gérer les rôles",
-    "domainErrorTitle": "Nous avons des difficultés à vérifier votre domaine"
+    "approvalsEmptyStateButtonText": "Gérer les rôles"
 }
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Richieste proxy su HTTPS usando un nome di dominio completo.",
    "resourceRaw": "Risorsa Raw TCP/UDP",
    "resourceRawDescription": "Richieste proxy su TCP/UDP grezzo utilizzando un numero di porta.",
-    "resourceRawDescriptionCloud": "Richiesta proxy su TCP/UDP grezzo utilizzando un numero di porta. Richiede siti per connettersi a un nodo remoto.",
+    "resourceRawDescriptionCloud": "Richieste proxy su TCP/UDP grezzo utilizzando un numero di porta. RICHIEDE L'USO DI UN NODO REMOTO.",
    "resourceCreate": "Crea Risorsa",
    "resourceCreateDescription": "Segui i passaggi seguenti per creare una nuova risorsa",
    "resourceSeeAll": "Vedi Tutte Le Risorse",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Namespace: {namespace}",
    "domainPickerShowMore": "Mostra Altro",
    "regionSelectorTitle": "Seleziona regione",
-    "domainPickerRemoteExitNodeWarning": "I domini forniti non sono supportati quando i siti si connettono a nodi di uscita remoti. Affinché le risorse siano disponibili su nodi remoti, utilizza invece un dominio personalizzato.",
    "regionSelectorInfo": "Selezionare una regione ci aiuta a fornire migliori performance per la tua posizione. Non devi necessariamente essere nella stessa regione del tuo server.",
    "regionSelectorPlaceholder": "Scegli una regione",
    "regionSelectorComingSoon": "Prossimamente",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Fine dell'anno successivo",
    "actionLogsDescription": "Visualizza una cronologia delle azioni eseguite in questa organizzazione",
    "accessLogsDescription": "Visualizza le richieste di autenticazione di accesso per le risorse in questa organizzazione",
-    "licenseRequiredToUse": "Per utilizzare questa funzione è necessaria una licenza <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> o <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> . <bookADemoLink>Prenota una demo o una prova POC</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "L' <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> è necessaria per utilizzare questa funzione. Questa funzione è disponibile anche in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Prenota una demo o una prova POC</bookADemoLink>.",
+    "licenseRequiredToUse": "Per utilizzare questa funzione è necessaria una licenza <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> . Questa funzionalità è disponibile anche in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "L' <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> è necessaria per utilizzare questa funzione. Questa funzionalità è disponibile anche in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Risolutore Di Certificato",
    "certResolverDescription": "Selezionare il risolutore di certificati da usare per questa risorsa.",
    "selectCertResolver": "Seleziona Risolutore Di Certificato",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Abilita Approvazioni Dispositivo",
    "approvalsEmptyStateStep2Description": "Modifica un ruolo e abilita l'opzione 'Richiedi l'approvazione del dispositivo'. Gli utenti con questo ruolo avranno bisogno dell'approvazione dell'amministratore per i nuovi dispositivi.",
    "approvalsEmptyStatePreviewDescription": "Anteprima: quando abilitato, le richieste di dispositivo in attesa appariranno qui per la revisione",
-    "approvalsEmptyStateButtonText": "Gestisci Ruoli",
-    "domainErrorTitle": "Stiamo avendo problemi a verificare il tuo dominio"
+    "approvalsEmptyStateButtonText": "Gestisci Ruoli"
 }
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "완전한 도메인 이름을 사용해 RAW 또는 HTTPS로 프록시 요청을 수행합니다.",
    "resourceRaw": "원시 TCP/UDP 리소스",
    "resourceRawDescription": "포트 번호를 사용하여 RAW TCP/UDP로 요청을 프록시합니다.",
-    "resourceRawDescriptionCloud": "포트 번호를 사용하여 원격 노드에 연결해야 합니다. 원격 노드에서 리소스를 사용하려면 사용자 지정 도메인을 사용하십시오.",
+    "resourceRawDescriptionCloud": "원시 TCP/UDP를 포트 번호를 사용하여 프록시 요청합니다. 원격 노드 사용이 필요합니다.",
    "resourceCreate": "리소스 생성",
    "resourceCreateDescription": "아래 단계를 따라 새 리소스를 생성하세요.",
    "resourceSeeAll": "모든 리소스 보기",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "이름 공간: {namespace}",
    "domainPickerShowMore": "더보기",
    "regionSelectorTitle": "지역 선택",
-    "domainPickerRemoteExitNodeWarning": "제공된 도메인은 원격 종료 노드에 연결된 사이트에서 지원되지 않습니다. 원격 노드에서 리소스를 사용하려면 사용자 지정 도메인을 사용하십시오.",
    "regionSelectorInfo": "지역을 선택하면 위치에 따라 더 나은 성능이 제공됩니다. 서버와 같은 지역에 있을 필요는 없습니다.",
    "regionSelectorPlaceholder": "지역 선택",
    "regionSelectorComingSoon": "곧 출시 예정",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "다음 연도 말",
    "actionLogsDescription": "이 조직에서 수행된 작업의 기록을 봅니다",
    "accessLogsDescription": "이 조직의 자원에 대한 접근 인증 요청을 확인합니다",
-    "licenseRequiredToUse": "이 기능을 사용하려면 <enterpriseLicenseLink>엔터프라이즈 에디션</enterpriseLicenseLink> 라이선스가 필요합니다. 이 기능은 <pangolinCloudLink>판골린 클라우드</pangolinCloudLink>에서도 사용할 수 있습니다. <bookADemoLink>데모 또는 POC 체험을 예약하세요</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "이 기능을 사용하려면 <enterpriseEditionLink>엔터프라이즈 에디션</enterpriseEditionLink>이(가) 필요합니다. 이 기능은 <pangolinCloudLink>판골린 클라우드</pangolinCloudLink>에서도 사용할 수 있습니다. <bookADemoLink>데모 또는 POC 체험을 예약하세요</bookADemoLink>.",
+    "licenseRequiredToUse": "이 기능을 사용하려면 <enterpriseLicenseLink>엔터프라이즈 에디션</enterpriseLicenseLink> 라이선스가 필요합니다. 이 기능은 <pangolinCloudLink>판골린 클라우드</pangolinCloudLink>에서도 사용할 수 있습니다.",
+    "ossEnterpriseEditionRequired": "이 기능을 사용하려면 <enterpriseEditionLink>엔터프라이즈 에디션</enterpriseEditionLink>이 필요합니다. 이 기능은 <pangolinCloudLink>판골린 클라우드</pangolinCloudLink>에서도 사용할 수 있습니다.",
    "certResolver": "인증서 해결사",
    "certResolverDescription": "이 리소스에 사용할 인증서 해결사를 선택하세요.",
    "selectCertResolver": "인증서 해결사 선택",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "장치 승인 활성화",
    "approvalsEmptyStateStep2Description": "역할을 편집하고 '장치 승인 요구' 옵션을 활성화하세요. 이 역할을 가진 사용자는 새 장치에 대해 관리자의 승인이 필요합니다.",
    "approvalsEmptyStatePreviewDescription": "미리 보기: 활성화된 경우, 승인 대기 중인 장치 요청이 검토용으로 여기에 표시됩니다.",
-    "approvalsEmptyStateButtonText": "역할 관리",
-    "domainErrorTitle": "도메인 확인에 문제가 발생했습니다."
+    "approvalsEmptyStateButtonText": "역할 관리"
 }
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxy forespørsler over HTTPS ved å bruke et fullstendig kvalifisert domenenavn.",
    "resourceRaw": "Rå TCP/UDP-ressurs",
    "resourceRawDescription": "Proxy forespørsler over rå TCP/UDP ved å bruke et portnummer.",
-    "resourceRawDescriptionCloud": "Proxy forespørsler om rå TCP/UDP ved hjelp av et portnummer. Krever sider for å koble til en ekstern node.",
+    "resourceRawDescriptionCloud": "Proxy ber om et portnummer. Om du vil bruke et sportsnummer.",
    "resourceCreate": "Opprett ressurs",
    "resourceCreateDescription": "Følg trinnene nedenfor for å opprette en ny ressurs",
    "resourceSeeAll": "Se alle ressurser",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Navnerom: {namespace}",
    "domainPickerShowMore": "Vis mer",
    "regionSelectorTitle": "Velg Region",
-    "domainPickerRemoteExitNodeWarning": "Tilbudte domener støttes ikke når sider kobles til eksterne avkjøringsnoder. For ressurser som skal være tilgjengelige på eksterne noder, brukes et egendefinert domene i stedet.",
    "regionSelectorInfo": "Å velge en region hjelper oss med å gi bedre ytelse for din lokasjon. Du trenger ikke være i samme region som serveren.",
    "regionSelectorPlaceholder": "Velg en region",
    "regionSelectorComingSoon": "Kommer snart",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Slutt på neste år",
    "actionLogsDescription": "Vis historikk for handlinger som er utført i denne organisasjonen",
    "accessLogsDescription": "Vis autoriseringsforespørsler for ressurser i denne organisasjonen",
-    "licenseRequiredToUse": "En <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> lisens eller <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> er påkrevd for å bruke denne funksjonen. <bookADemoLink>Bestill en demo eller POC prøveversjon</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> er nødvendig for å bruke denne funksjonen. Denne funksjonen er også tilgjengelig i <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Bestill en demo eller POC studie</bookADemoLink>.",
+    "licenseRequiredToUse": "En <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> lisens er påkrevd for å bruke denne funksjonen. Denne funksjonen er også tilgjengelig i <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> er nødvendig for å bruke denne funksjonen. Denne funksjonen er også tilgjengelig i <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Sertifikat løser",
    "certResolverDescription": "Velg sertifikatløser som skal brukes for denne ressursen.",
    "selectCertResolver": "Velg sertifikatløser",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Aktiver enhetsgodkjenninger",
    "approvalsEmptyStateStep2Description": "Rediger en rolle og aktiver alternativet 'Kreve enhetsgodkjenninger'. Brukere med denne rollen vil trenge administratorgodkjenning for nye enheter.",
    "approvalsEmptyStatePreviewDescription": "Forhåndsvisning: Når aktivert, ventende enhets forespørsler vil vises her for vurdering",
-    "approvalsEmptyStateButtonText": "Administrer Roller",
-    "domainErrorTitle": "Vi har problemer med å verifisere domenet ditt"
+    "approvalsEmptyStateButtonText": "Administrer Roller"
 }
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxyverzoeken via HTTPS met een volledig gekwalificeerde domeinnaam.",
    "resourceRaw": "TCP/UDP bron",
    "resourceRawDescription": "Proxyverzoeken via ruwe TCP/UDP met een poortnummer.",
-    "resourceRawDescriptionCloud": "Proxy verzoeken over rauwe TCP/UDP met behulp van een poortnummer. Vereist sites om verbinding te maken met een remote node.",
+    "resourceRawDescriptionCloud": "Proxy vraagt om onbewerkte TCP/UDP met behulp van een poortnummer. VEREIST HET GEBRUIK VAN EEN AFSTANDSBEDIENING NODE.",
    "resourceCreate": "Bron maken",
    "resourceCreateDescription": "Volg de onderstaande stappen om een nieuwe bron te maken",
    "resourceSeeAll": "Alle bronnen bekijken",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Naamruimte: {namespace}",
    "domainPickerShowMore": "Meer weergeven",
    "regionSelectorTitle": "Selecteer Regio",
-    "domainPickerRemoteExitNodeWarning": "Opgegeven domeinen worden niet ondersteund wanneer websites verbinding maken met externe sluitnodes. Gebruik in plaats daarvan een aangepast domein. Om bronnen beschikbaar te maken op externe nodes.",
    "regionSelectorInfo": "Het selecteren van een regio helpt ons om betere prestaties te leveren voor uw locatie. U hoeft niet in dezelfde regio als uw server te zijn.",
    "regionSelectorPlaceholder": "Kies een regio",
    "regionSelectorComingSoon": "Komt binnenkort",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Einde van volgend jaar",
    "actionLogsDescription": "Bekijk een geschiedenis van acties die worden uitgevoerd in deze organisatie",
    "accessLogsDescription": "Toegangsverificatieverzoeken voor resources in deze organisatie bekijken",
-    "licenseRequiredToUse": "Een <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> licentie of <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> is vereist om deze functie te gebruiken. <bookADemoLink>Boek een demo of POC trial</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "De <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> is vereist om deze functie te gebruiken. Deze functie is ook beschikbaar in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Boek een demo of POC trial</bookADemoLink>.",
+    "licenseRequiredToUse": "Een <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> licentie is vereist om deze functie te gebruiken. Deze functie is ook beschikbaar in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "De <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> is vereist om deze functie te gebruiken. Deze functie is ook beschikbaar in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Certificaat Resolver",
    "certResolverDescription": "Selecteer de certificaat resolver die moet worden gebruikt voor deze resource.",
    "selectCertResolver": "Certificaat Resolver selecteren",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Toestel goedkeuringen inschakelen",
    "approvalsEmptyStateStep2Description": "Bewerk een rol en schakel de optie 'Vereist Apparaat Goedkeuringen' in. Gebruikers met deze rol hebben admin goedkeuring nodig voor nieuwe apparaten.",
    "approvalsEmptyStatePreviewDescription": "Voorbeeld: Indien ingeschakeld, zullen in afwachting van apparaatverzoeken hier verschijnen om te beoordelen",
-    "approvalsEmptyStateButtonText": "Rollen beheren",
-    "domainErrorTitle": "We ondervinden problemen bij het controleren van uw domein"
+    "approvalsEmptyStateButtonText": "Rollen beheren"
 }
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxy zapytań przez HTTPS przy użyciu w pełni kwalifikowanej nazwy domeny.",
    "resourceRaw": "Surowy zasób TCP/UDP",
    "resourceRawDescription": "Proxy zapytań przez surowe TCP/UDP przy użyciu numeru portu.",
-    "resourceRawDescriptionCloud": "Żądania proxy nad surowym TCP/UDP przy użyciu numeru portu. Wymaga stron aby połączyć się ze zdalnym węzłem.",
+    "resourceRawDescriptionCloud": "Proxy żądania przesyłania danych nad surowym TCP/UDP przy użyciu numeru portu. Wymaga UŻYTKOWANIA PALIWA węzła.",
    "resourceCreate": "Utwórz zasób",
    "resourceCreateDescription": "Wykonaj poniższe kroki, aby utworzyć nowy zasób",
    "resourceSeeAll": "Zobacz wszystkie zasoby",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Przestrzeń nazw: {namespace}",
    "domainPickerShowMore": "Pokaż więcej",
    "regionSelectorTitle": "Wybierz region",
-    "domainPickerRemoteExitNodeWarning": "Podane domeny nie są obsługiwane, gdy witryny łączą się ze zdalnymi węzłami wyjścia. Aby zasoby były dostępne w węzłach zdalnych, użyj domeny niestandardowej.",
    "regionSelectorInfo": "Wybór regionu pomaga nam zapewnić lepszą wydajność dla Twojej lokalizacji. Nie musisz być w tym samym regionie co Twój serwer.",
    "regionSelectorPlaceholder": "Wybierz region",
    "regionSelectorComingSoon": "Wkrótce dostępne",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Koniec następnego roku",
    "actionLogsDescription": "Zobacz historię działań wykonywanych w tej organizacji",
    "accessLogsDescription": "Wyświetl prośby o autoryzację dostępu do zasobów w tej organizacji",
-    "licenseRequiredToUse": "Do korzystania z tej funkcji wymagana jest licencja <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> lub <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> . <bookADemoLink>Zarezerwuj wersję demonstracyjną lub wersję próbną POC</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> jest wymagany do korzystania z tej funkcji. Ta funkcja jest również dostępna w <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Zarezerwuj demo lub okres próbny POC</bookADemoLink>.",
+    "licenseRequiredToUse": "Do korzystania z tej funkcji wymagana jest licencja <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> . Ta funkcja jest również dostępna w <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> jest wymagany do korzystania z tej funkcji. Ta funkcja jest również dostępna w <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Rozwiązywanie certyfikatów",
    "certResolverDescription": "Wybierz resolver certyfikatów do użycia dla tego zasobu.",
    "selectCertResolver": "Wybierz Resolver certyfikatów",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Włącz zatwierdzanie urządzenia",
    "approvalsEmptyStateStep2Description": "Edytuj rolę i włącz opcję \"Wymagaj zatwierdzenia urządzenia\". Użytkownicy z tą rolą będą potrzebowali zatwierdzenia administratora dla nowych urządzeń.",
    "approvalsEmptyStatePreviewDescription": "Podgląd: Gdy włączone, oczekujące prośby o sprawdzenie pojawią się tutaj",
-    "approvalsEmptyStateButtonText": "Zarządzaj rolami",
-    "domainErrorTitle": "Mamy problem z weryfikacją Twojej domeny"
+    "approvalsEmptyStateButtonText": "Zarządzaj rolami"
 }
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Proxies requests sobre HTTPS usando um nome de domínio totalmente qualificado.",
    "resourceRaw": "Recurso TCP/UDP bruto",
    "resourceRawDescription": "Proxies solicitações sobre TCP/UDP bruto usando um número de porta.",
-    "resourceRawDescriptionCloud": "Proxy solicita por TCP/UDP bruto usando um número de porta. Requer que sites se conectem a um nó remoto.",
+    "resourceRawDescriptionCloud": "Proxy solicita sobre TCP/UDP bruto usando um número de porta. OBRIGATÓRIO O USO DE UMA NOTA REMOTA.",
    "resourceCreate": "Criar Recurso",
    "resourceCreateDescription": "Siga os passos abaixo para criar um novo recurso",
    "resourceSeeAll": "Ver todos os recursos",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Namespace: {namespace}",
    "domainPickerShowMore": "Mostrar Mais",
    "regionSelectorTitle": "Selecionar Região",
-    "domainPickerRemoteExitNodeWarning": "Domínios fornecidos não são suportados quando os sites se conectam a nós de saída remota. Para recursos disponíveis em nós remotos, use um domínio personalizado.",
    "regionSelectorInfo": "Selecionar uma região nos ajuda a fornecer melhor desempenho para sua localização. Você não precisa estar na mesma região que seu servidor.",
    "regionSelectorPlaceholder": "Escolher uma região",
    "regionSelectorComingSoon": "Em breve",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Fim do ano seguinte",
    "actionLogsDescription": "Visualizar histórico de ações realizadas nesta organização",
    "accessLogsDescription": "Ver solicitações de autenticação de recursos nesta organização",
-    "licenseRequiredToUse": "Uma licença <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> ou <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> é necessária para usar este recurso. <bookADemoLink>Reserve um teste de demonstração ou POC</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "O <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> é necessário para usar este recurso. Este recurso também está disponível no <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Reserve uma demonstração ou avaliação POC</bookADemoLink>.",
+    "licenseRequiredToUse": "Uma licença <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> é necessária para usar este recurso. Este recurso também está disponível no <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "O <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> é necessário para usar este recurso. Este recurso também está disponível no <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Resolvedor de Certificado",
    "certResolverDescription": "Selecione o resolvedor de certificados para este recurso.",
    "selectCertResolver": "Selecionar solucionador de certificado",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Habilitar Aprovações do Dispositivo",
    "approvalsEmptyStateStep2Description": "Editar uma função e habilitar a opção 'Exigir aprovação de dispositivos'. Usuários com essa função precisarão de aprovação de administrador para novos dispositivos.",
    "approvalsEmptyStatePreviewDescription": "Pré-visualização: Quando ativado, solicitações de dispositivo pendentes aparecerão aqui para revisão",
-    "approvalsEmptyStateButtonText": "Gerir Funções",
-    "domainErrorTitle": "Estamos tendo problemas ao verificar seu domínio"
+    "approvalsEmptyStateButtonText": "Gerir Funções"
 }
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Проксировать запросы через HTTPS с использованием полного доменного имени.",
    "resourceRaw": "Сырой TCP/UDP-ресурс",
    "resourceRawDescription": "Проксировать запросы по сырому TCP/UDP с использованием номера порта.",
-    "resourceRawDescriptionCloud": "Прокси запросы через необработанный TCP/UDP с использованием номера порта. Требуется подключение сайтов к удаленному узлу.",
+    "resourceRawDescriptionCloud": "Прокси-запросы через необработанный TCP/UDP с использованием номера порта. ТРЕБУЕТЕСЬ ИСПОЛЬЗОВАТЬ НЕОБХОДИМЫ.",
    "resourceCreate": "Создание ресурса",
    "resourceCreateDescription": "Следуйте инструкциям ниже для создания нового ресурса",
    "resourceSeeAll": "Посмотреть все ресурсы",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Пространство имен: {namespace}",
    "domainPickerShowMore": "Показать еще",
    "regionSelectorTitle": "Выберите регион",
-    "domainPickerRemoteExitNodeWarning": "Предоставленные домены не поддерживаются при подключении сайтов к удаленным узлам. Для доступа к ресурсам на удаленных узлах используйте пользовательский домен.",
    "regionSelectorInfo": "Выбор региона помогает нам обеспечить лучшее качество обслуживания для вашего расположения. Вам необязательно находиться в том же регионе, что и ваш сервер.",
    "regionSelectorPlaceholder": "Выбор региона",
    "regionSelectorComingSoon": "Скоро будет",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Конец следующего года",
    "actionLogsDescription": "Просмотр истории действий, выполненных в этой организации",
    "accessLogsDescription": "Просмотр запросов авторизации доступа к ресурсам этой организации",
-    "licenseRequiredToUse": "Требуется лицензия на <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> или <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> для использования этой функции. <bookADemoLink>Забронируйте демонстрацию или пробный POC</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> требуется для использования этой функции. Эта функция также доступна в <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>. <bookADemoLink>Забронируйте демонстрацию или пробный POC</bookADemoLink>.",
+    "licenseRequiredToUse": "Лицензия на <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> требуется для использования этой функции. Эта функция также доступна в <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "ossEnterpriseEditionRequired": "Для использования этой функции требуется <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink>. Эта функция также доступна в <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
    "certResolver": "Резольвер сертификата",
    "certResolverDescription": "Выберите резолвер сертификата, который будет использоваться для этого ресурса.",
    "selectCertResolver": "Выберите резолвер сертификата",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Включить утверждения устройства",
    "approvalsEmptyStateStep2Description": "Редактировать роль и включить опцию 'Требовать утверждения устройств'. Пользователям с этой ролью потребуется подтверждение администратора для новых устройств.",
    "approvalsEmptyStatePreviewDescription": "Предпросмотр: Если включено, ожидающие запросы на устройство появятся здесь для проверки",
-    "approvalsEmptyStateButtonText": "Управление ролями",
-    "domainErrorTitle": "У нас возникли проблемы с проверкой вашего домена"
+    "approvalsEmptyStateButtonText": "Управление ролями"
 }
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "Tam nitelikli bir etki alanı adı kullanarak HTTPS üzerinden proxy isteklerini yönlendirin.",
    "resourceRaw": "Ham TCP/UDP Kaynağı",
    "resourceRawDescription": "Port numarası kullanarak ham TCP/UDP üzerinden proxy isteklerini yönlendirin.",
-    "resourceRawDescriptionCloud": "Proxy isteklerini bir port numarası kullanarak ham TCP/UDP üzerinden yapın. Sitelerin uzak bir düğüme bağlanması gereklidir.",
+    "resourceRawDescriptionCloud": "Bir port numarası kullanarak ham TCP/UDP üzerinden istekleri proxy ile yönlendirin. UZAKTAN BİR DÜĞÜM KULLANIMINI GEREKTİRİR.",
    "resourceCreate": "Kaynak Oluştur",
    "resourceCreateDescription": "Yeni bir kaynak oluşturmak için aşağıdaki adımları izleyin",
    "resourceSeeAll": "Tüm Kaynakları Gör",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "Ad Alanı: {namespace}",
    "domainPickerShowMore": "Daha Fazla Göster",
    "regionSelectorTitle": "Bölge Seç",
-    "domainPickerRemoteExitNodeWarning": "Belirtilen alan adları, siteler uzak çıkış düğümlerine bağlandığında desteklenmez. Kaynakların uzak düğümlerde kullanılabilir olması için özel bir alan adı kullanın.",
    "regionSelectorInfo": "Bir bölge seçmek, konumunuz için daha iyi performans sağlamamıza yardımcı olur. Sunucunuzla aynı bölgede olmanıza gerek yoktur.",
    "regionSelectorPlaceholder": "Bölge Seçin",
    "regionSelectorComingSoon": "Yakında Geliyor",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "Bir sonraki yılın sonu",
    "actionLogsDescription": "Bu organizasyondaki eylemler geçmişini görüntüleyin",
    "accessLogsDescription": "Bu organizasyondaki kaynaklar için erişim kimlik doğrulama isteklerini görüntüleyin",
-    "licenseRequiredToUse": "Bu özelliği kullanmak için bir <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> lisansı veya <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> gereklidir. <bookADemoLink>Tanıtım veya POC denemesi ayarlayın</bookADemoLink>.",
-    "ossEnterpriseEditionRequired": "Bu özelliği kullanmak için <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> gereklidir. Bu özellik ayrıca <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>’da da mevcuttur. <bookADemoLink>Tanıtım veya POC denemesi ayarlayın</bookADemoLink>.",
+    "licenseRequiredToUse": "Bu özelliği kullanmak için bir <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> lisansı gereklidir. Bu özellik ayrıca <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>'da da mevcuttur.",
+    "ossEnterpriseEditionRequired": "Bu özelliği kullanmak için <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> gereklidir. Bu özellik ayrıca <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>'da da mevcuttur.",
    "certResolver": "Sertifika Çözücü",
    "certResolverDescription": "Bu kaynak için kullanılacak sertifika çözücüsünü seçin.",
    "selectCertResolver": "Sertifika Çözücü Seçin",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "Cihaz Onaylarını Etkinleştir",
    "approvalsEmptyStateStep2Description": "Bir rolü düzenleyin ve 'Cihaz Onaylarını Gerektir' seçeneğini etkinleştirin. Bu role sahip kullanıcıların yeni cihazlar için yönetici onayına ihtiyacı olacaktır.",
    "approvalsEmptyStatePreviewDescription": "Önizleme: Etkinleştirildiğinde, bekleyen cihaz talepleri incelenmek üzere burada görünecektir.",
-    "approvalsEmptyStateButtonText": "Rolleri Yönet",
-    "domainErrorTitle": "Alan adınızı doğrulamada sorun yaşıyoruz"
+    "approvalsEmptyStateButtonText": "Rolleri Yönet"
 }
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -175,7 +175,7 @@
    "resourceHTTPDescription": "通过使用完全限定的域名的HTTPS代理请求。",
    "resourceRaw": "TCP/UDP 资源",
    "resourceRawDescription": "通过使用端口号的原始TCP/UDP代理请求。",
-    "resourceRawDescriptionCloud": "正在使用端口号使用 TCP/UDP 代理请求。需要站点连接到远程节点。",
+    "resourceRawDescriptionCloud": "正在使用端口号的 TCP/UDP 代理请求。请使用一个REMOTE",
    "resourceCreate": "创建资源",
    "resourceCreateDescription": "按照下面的步骤创建新资源",
    "resourceSeeAll": "查看所有资源",
@@ -1426,7 +1426,6 @@
    "domainPickerNamespace": "命名空间：{namespace}",
    "domainPickerShowMore": "显示更多",
    "regionSelectorTitle": "选择区域",
-    "domainPickerRemoteExitNodeWarning": "当站点连接到远程退出节点时不支持所提供的域。为了资源可在远程节点上使用，请使用自定义域名。",
    "regionSelectorInfo": "选择区域以帮助提升您所在地的性能。您不必与服务器在相同的区域。",
    "regionSelectorPlaceholder": "选择一个区域",
    "regionSelectorComingSoon": "即将推出",
@@ -2343,8 +2342,8 @@
    "logRetentionEndOfFollowingYear": "下一年结束",
    "actionLogsDescription": "查看此机构执行的操作历史",
    "accessLogsDescription": "查看此机构资源的访问认证请求",
-    "licenseRequiredToUse": "使用此功能需要<enterpriseLicenseLink>企业版</enterpriseLicenseLink>许可证或<pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>。<bookADemoLink>预约演示或POC试用</bookADemoLink>。",
-    "ossEnterpriseEditionRequired": "需要 <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> 才能使用此功能。 此功能也可在 <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>上获取。 <bookADemoLink>预订演示或POC 试用</bookADemoLink>。",
+    "licenseRequiredToUse": "需要 <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> 许可才能使用此功能。此功能也可在 <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> 中使用。",
+    "ossEnterpriseEditionRequired": "<enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> 需要使用此功能。此功能也可在 <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink> 中使用。",
    "certResolver": "证书解决器",
    "certResolverDescription": "选择用于此资源的证书解析器。",
    "selectCertResolver": "选择证书解析",
@@ -2681,6 +2680,5 @@
    "approvalsEmptyStateStep2Title": "启用设备批准",
    "approvalsEmptyStateStep2Description": "编辑角色并启用“需要设备审批”选项。具有此角色的用户需要管理员批准新设备。",
    "approvalsEmptyStatePreviewDescription": "预览：如果启用，待处理设备请求将出现在这里供审核",
-    "approvalsEmptyStateButtonText": "管理角色",
-    "domainErrorTitle": "我们在验证您的域名时遇到了问题"
+    "approvalsEmptyStateButtonText": "管理角色"
 }
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
    },
    "dependencies": {
        "@asteasolutions/zod-to-openapi": "8.4.1",
-        "@aws-sdk/client-s3": "3.1011.0",
+        "@aws-sdk/client-s3": "3.1004.0",
        "@faker-js/faker": "10.3.0",
        "@headlessui/react": "2.2.9",
        "@hookform/resolvers": "5.2.2",
@@ -62,8 +62,8 @@
        "@react-email/components": "1.0.8",
        "@react-email/render": "2.0.4",
        "@react-email/tailwind": "2.0.5",
-        "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.0",
+        "@simplewebauthn/browser": "13.2.2",
+        "@simplewebauthn/server": "13.2.3",
        "@tailwindcss/forms": "0.5.11",
        "@tanstack/react-query": "5.90.21",
        "@tanstack/react-table": "8.21.3",
@@ -133,7 +133,7 @@
    "devDependencies": {
        "@dotenvx/dotenvx": "1.54.1",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/preview-server": "5.2.10",
+        "@react-email/preview-server": "5.2.8",
        "@tailwindcss/postcss": "4.2.1",
        "@tanstack/react-query-devtools": "5.91.3",
        "@types/better-sqlite3": "7.6.13",
@@ -159,14 +159,14 @@
        "@types/ws": "8.18.1",
        "@types/yargs": "17.0.35",
        "babel-plugin-react-compiler": "1.0.0",
-        "drizzle-kit": "0.31.10",
+        "drizzle-kit": "0.31.9",
        "esbuild": "0.27.3",
        "esbuild-node-externals": "1.20.1",
-        "eslint": "10.0.3",
-        "eslint-config-next": "16.1.7",
-        "postcss": "8.5.8",
+        "eslint": "9.39.2",
+        "eslint-config-next": "16.1.6",
+        "postcss": "8.5.6",
        "prettier": "3.8.1",
-        "react-email": "5.2.10",
+        "react-email": "5.2.8",
        "tailwindcss": "4.2.1",
        "tsc-alias": "1.8.16",
        "tsx": "4.21.0",
--- a/server/auth/actions.ts
+++ b/server/auth/actions.ts
@@ -19,7 +19,6 @@ export enum ActionsEnum {
    getSite = "getSite",
    listSites = "listSites",
    updateSite = "updateSite",
-    resetSiteBandwidth = "resetSiteBandwidth",
    reGenerateSecret = "reGenerateSecret",
    createResource = "createResource",
    deleteResource = "deleteResource",
--- a/server/db/pg/schema/schema.ts
+++ b/server/db/pg/schema/schema.ts
@@ -216,12 +216,18 @@ export const exitNodes = pgTable("exitNodes", {
 export const siteResources = pgTable("siteResources", {
    // this is for the clients
    siteResourceId: serial("siteResourceId").primaryKey(),
-    siteId: integer("siteId")
-        .notNull()
-        .references(() => sites.siteId, { onDelete: "cascade" }),
    orgId: varchar("orgId")
        .notNull()
        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    networkId: integer("networkId").references(() => networks.networkId, {
+        onDelete: "set null"
+    }),
+    defaultNetworkId: integer("defaultNetworkId").references(
+        () => networks.networkId,
+        {
+            onDelete: "restrict"
+        }
+    ),
    niceId: varchar("niceId").notNull(),
    name: varchar("name").notNull(),
    mode: varchar("mode").$type<"host" | "cidr">().notNull(), // "host" | "cidr" | "port"
@@ -241,6 +247,32 @@ export const siteResources = pgTable("siteResources", {
        .default("site")
 });

+export const networks = pgTable("networks", {
+    networkId: serial("networkId").primaryKey(),
+    niceId: text("niceId"),
+    name: text("name"),
+    scope: varchar("scope")
+        .$type<"global" | "resource">()
+        .notNull()
+        .default("global"),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});
+
+export const siteNetworks = pgTable("siteNetworks", {
+    siteId: integer("siteId")
+        .notNull()
+        .references(() => sites.siteId, {
+            onDelete: "cascade"
+        }),
+    networkId: integer("networkId")
+        .notNull()
+        .references(() => networks.networkId, { onDelete: "cascade" })
+});
+
 export const clientSiteResources = pgTable("clientSiteResources", {
    clientId: integer("clientId")
        .notNull()
@@ -1074,3 +1106,4 @@ export type RequestAuditLog = InferSelectModel<typeof requestAuditLog>;
 export type RoundTripMessageTracker = InferSelectModel<
    typeof roundTripMessageTracker
 >;
+export type Network = InferSelectModel<typeof networks>;
--- a/server/db/sqlite/schema/schema.ts
+++ b/server/db/sqlite/schema/schema.ts
@@ -82,6 +82,9 @@ export const sites = sqliteTable("sites", {
    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
        onDelete: "set null"
    }),
+    networkId: integer("networkId").references(() => networks.networkId, {
+        onDelete: "set null"
+    }),
    name: text("name").notNull(),
    pubKey: text("pubKey"),
    subnet: text("subnet"),
@@ -239,12 +242,16 @@ export const siteResources = sqliteTable("siteResources", {
    siteResourceId: integer("siteResourceId").primaryKey({
        autoIncrement: true
    }),
-    siteId: integer("siteId")
-        .notNull()
-        .references(() => sites.siteId, { onDelete: "cascade" }),
    orgId: text("orgId")
        .notNull()
        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    networkId: integer("networkId").references(() => networks.networkId, {
+        onDelete: "set null"
+    }),
+    defaultNetworkId: integer("defaultNetworkId").references(
+        () => networks.networkId,
+        { onDelete: "restrict" }
+    ),
    niceId: text("niceId").notNull(),
    name: text("name").notNull(),
    mode: text("mode").$type<"host" | "cidr">().notNull(), // "host" | "cidr" | "port"
@@ -266,6 +273,30 @@ export const siteResources = sqliteTable("siteResources", {
        .default("site")
 });

+export const networks = sqliteTable("networks", {
+    networkId: integer("networkId").primaryKey({ autoIncrement: true }),
+    niceId: text("niceId"),
+    name: text("name"),
+    scope: text("scope")
+        .$type<"global" | "resource">()
+        .notNull()
+        .default("global"),
+    orgId: text("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" })
+});
+
+export const siteNetworks = sqliteTable("siteNetworks", {
+    siteId: integer("siteId")
+        .notNull()
+        .references(() => sites.siteId, {
+            onDelete: "cascade"
+        }),
+    networkId: integer("networkId")
+        .notNull()
+        .references(() => networks.networkId, { onDelete: "cascade" })
+});
+
 export const clientSiteResources = sqliteTable("clientSiteResources", {
    clientId: integer("clientId")
        .notNull()
@@ -1158,6 +1189,7 @@ export type ApiKey = InferSelectModel<typeof apiKeys>;
 export type ApiKeyAction = InferSelectModel<typeof apiKeyActions>;
 export type ApiKeyOrg = InferSelectModel<typeof apiKeyOrg>;
 export type SiteResource = InferSelectModel<typeof siteResources>;
+export type Network = InferSelectModel<typeof networks>;
 export type OrgDomains = InferSelectModel<typeof orgDomains>;
 export type SetupToken = InferSelectModel<typeof setupTokens>;
 export type HostMeta = InferSelectModel<typeof hostMeta>;
--- a/server/lib/blueprints/applyBlueprint.ts
+++ b/server/lib/blueprints/applyBlueprint.ts
@@ -121,8 +121,8 @@ export async function applyBlueprint({
            for (const result of clientResourcesResults) {
                if (
                    result.oldSiteResource &&
-                    result.oldSiteResource.siteId !=
-                        result.newSiteResource.siteId
+                    JSON.stringify(result.newSites?.sort()) !==
+                        JSON.stringify(result.oldSites?.sort())
                ) {
                    // query existing associations
                    const existingRoleIds = await trx
@@ -222,13 +222,15 @@ export async function applyBlueprint({
                        trx
                    );
                } else {
-                    const [newSite] = await trx
+                    let good = true;
+                    for (const newSite of result.newSites) {
+                        const [site] = await trx
                            .select()
                            .from(sites)
                            .innerJoin(newts, eq(sites.siteId, newts.siteId))
                            .where(
                                and(
-                                eq(sites.siteId, result.newSiteResource.siteId),
+                                    eq(sites.siteId, newSite.siteId),
                                    eq(sites.orgId, orgId),
                                    eq(sites.type, "newt"),
                                    isNotNull(sites.pubKey)
@@ -236,24 +238,30 @@ export async function applyBlueprint({
                            )
                            .limit(1);

-                    if (!newSite) {
+                        if (!site) {
                            logger.debug(
-                            `No newt site found for client resource ${result.newSiteResource.siteResourceId}, skipping target update`
+                                `No newt sites found for client resource ${result.newSiteResource.siteResourceId}, skipping target update`
                            );
-                        continue;
+                            good = false;
+                            break;
                        }

                        logger.debug(
-                        `Updating client resource ${result.newSiteResource.siteResourceId} on site ${newSite.sites.siteId}`
+                            `Updating client resource ${result.newSiteResource.siteResourceId} on site ${newSite.siteId}`
                        );
+                    }
+
+                    if (!good) {
+                        continue;
+                    }

                    await handleMessagingForUpdatedSiteResource(
                        result.oldSiteResource,
                        result.newSiteResource,
-                        {
-                            siteId: newSite.sites.siteId,
-                            orgId: newSite.sites.orgId
-                        },
+                        result.newSites.map((site) => ({
+                            siteId: site.siteId,
+                            orgId: result.newSiteResource.orgId
+                        })),
                        trx
                    );
                }
--- a/server/lib/blueprints/clientResources.ts
+++ b/server/lib/blueprints/clientResources.ts
@@ -3,12 +3,15 @@ import {
    clientSiteResources,
    roles,
    roleSiteResources,
+    Site,
    SiteResource,
+    siteNetworks,
    siteResources,
    Transaction,
    userOrgs,
    users,
-    userSiteResources
+    userSiteResources,
+    networks
 } from "@server/db";
 import { sites } from "@server/db";
 import { eq, and, ne, inArray, or } from "drizzle-orm";
@@ -19,6 +22,8 @@ import { getNextAvailableAliasAddress } from "../ip";
 export type ClientResourcesResults = {
    newSiteResource: SiteResource;
    oldSiteResource?: SiteResource;
+    newSites: { siteId: number }[];
+    oldSites: { siteId: number }[];
 }[];

 export async function updateClientResources(
@@ -43,12 +48,21 @@ export async function updateClientResources(
            )
            .limit(1);

+        const existingSiteIds = existingResource?.networkId
+            ? await trx
+                  .select({ siteId: sites.siteId })
+                  .from(siteNetworks)
+                  .where(eq(siteNetworks.networkId, existingResource.networkId))
+            : [];
+
+        let allSites: { siteId: number }[] = [];
+        if (resourceData.site) {
+            let siteSingle;
            const resourceSiteId = resourceData.site;
-        let site;

            if (resourceSiteId) {
                // Look up site by niceId
-            [site] = await trx
+                [siteSingle] = await trx
                    .select({ siteId: sites.siteId })
                    .from(sites)
                    .where(
@@ -60,20 +74,45 @@ export async function updateClientResources(
                    .limit(1);
            } else if (siteId) {
                // Use the provided siteId directly, but verify it belongs to the org
-            [site] = await trx
+                [siteSingle] = await trx
                    .select({ siteId: sites.siteId })
                    .from(sites)
-                .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
+                    .where(
+                        and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
+                    )
                    .limit(1);
            } else {
                throw new Error(`Target site is required`);
            }

-        if (!site) {
+            if (!siteSingle) {
                throw new Error(
                    `Site not found: ${resourceSiteId} in org ${orgId}`
                );
            }
+            allSites.push(siteSingle);
+        }
+
+        if (resourceData.sites) {
+            for (const siteNiceId of resourceData.sites) {
+                const [site] = await trx
+                    .select({ siteId: sites.siteId })
+                    .from(sites)
+                    .where(
+                        and(
+                            eq(sites.niceId, siteNiceId),
+                            eq(sites.orgId, orgId)
+                        )
+                    )
+                    .limit(1);
+                if (!site) {
+                    throw new Error(
+                        `Site not found: ${siteId} in org ${orgId}`
+                    );
+                }
+                allSites.push(site);
+            }
+        }

        if (existingResource) {
            // Update existing resource
@@ -81,7 +120,6 @@ export async function updateClientResources(
                .update(siteResources)
                .set({
                    name: resourceData.name || resourceNiceId,
-                    siteId: site.siteId,
                    mode: resourceData.mode,
                    destination: resourceData.destination,
                    enabled: true, // hardcoded for now
@@ -102,6 +140,21 @@ export async function updateClientResources(
            const siteResourceId = existingResource.siteResourceId;
            const orgId = existingResource.orgId;

+            if (updatedResource.networkId) {
+                await trx
+                    .delete(siteNetworks)
+                    .where(
+                        eq(siteNetworks.networkId, updatedResource.networkId)
+                    );
+
+                for (const site of allSites) {
+                    await trx.insert(siteNetworks).values({
+                        siteId: site.siteId,
+                        networkId: updatedResource.networkId
+                    });
+                }
+            }
+
            await trx
                .delete(clientSiteResources)
                .where(eq(clientSiteResources.siteResourceId, siteResourceId));
@@ -204,7 +257,9 @@ export async function updateClientResources(

            results.push({
                newSiteResource: updatedResource,
-                oldSiteResource: existingResource
+                oldSiteResource: existingResource,
+                newSites: allSites,
+                oldSites: existingSiteIds
            });
        } else {
            let aliasAddress: string | null = null;
@@ -213,13 +268,22 @@ export async function updateClientResources(
                aliasAddress = await getNextAvailableAliasAddress(orgId);
            }

+            const [network] = await trx
+                .insert(networks)
+                .values({
+                    scope: "resource",
+                    orgId: orgId
+                })
+                .returning();
+
            // Create new resource
            const [newResource] = await trx
                .insert(siteResources)
                .values({
                    orgId: orgId,
-                    siteId: site.siteId,
                    niceId: resourceNiceId,
+                    networkId: network.networkId,
+                    defaultNetworkId: network.networkId,
                    name: resourceData.name || resourceNiceId,
                    mode: resourceData.mode,
                    destination: resourceData.destination,
@@ -235,6 +299,13 @@ export async function updateClientResources(

            const siteResourceId = newResource.siteResourceId;

+            for (const site of allSites) {
+                await trx.insert(siteNetworks).values({
+                    siteId: site.siteId,
+                    networkId: network.networkId
+                });
+            }
+
            const [adminRole] = await trx
                .select()
                .from(roles)
@@ -324,7 +395,11 @@ export async function updateClientResources(
                `Created new client resource ${newResource.name} (${newResource.siteResourceId}) for org ${orgId}`
            );

-            results.push({ newSiteResource: newResource });
+            results.push({
+                newSiteResource: newResource,
+                newSites: allSites,
+                oldSites: existingSiteIds
+            });
        }
    }

--- a/server/lib/blueprints/types.ts
+++ b/server/lib/blueprints/types.ts
@@ -312,7 +312,8 @@ export const ClientResourceSchema = z
    .object({
        name: z.string().min(1).max(255),
        mode: z.enum(["host", "cidr"]),
-        site: z.string(),
+        site: z.string(), // DEPRECATED IN FAVOR OF sites
+        sites: z.array(z.string()).optional().default([]),
        // protocol: z.enum(["tcp", "udp"]).optional(),
        // proxyPort: z.int().positive().optional(),
        // destinationPort: z.int().positive().optional(),
--- a/server/lib/rebuildClientAssociations.ts
+++ b/server/lib/rebuildClientAssociations.ts
@@ -11,6 +11,7 @@ import {
    roleSiteResources,
    Site,
    SiteResource,
+    siteNetworks,
    siteResources,
    sites,
    Transaction,
@@ -47,15 +48,23 @@ export async function getClientSiteResourceAccess(
    siteResource: SiteResource,
    trx: Transaction | typeof db = db
 ) {
-    // get the site
-    const [site] = await trx
+    // get all sites associated with this siteResource via its network
+    const sitesList = siteResource.networkId
+        ? await trx
              .select()
              .from(sites)
-        .where(eq(sites.siteId, siteResource.siteId))
-        .limit(1);
+              .innerJoin(
+                  siteNetworks,
+                  eq(siteNetworks.siteId, sites.siteId)
+              )
+              .where(eq(siteNetworks.networkId, siteResource.networkId))
+              .then((rows) => rows.map((row) => row.sites))
+        : [];

-    if (!site) {
-        throw new Error(`Site with ID ${siteResource.siteId} not found`);
+    if (sitesList.length === 0) {
+        logger.warn(
+            `No sites found for siteResource ${siteResource.siteResourceId} with networkId ${siteResource.networkId}`
+        );
    }

    const roleIds = await trx
@@ -136,7 +145,7 @@ export async function getClientSiteResourceAccess(
    const mergedAllClientIds = mergedAllClients.map((c) => c.clientId);

    return {
-        site,
+        sitesList,
        mergedAllClients,
        mergedAllClientIds
    };
@@ -152,17 +161,18 @@ export async function rebuildClientAssociationsFromSiteResource(
        subnet: string | null;
    }[];
 }> {
-    const siteId = siteResource.siteId;
-
-    const { site, mergedAllClients, mergedAllClientIds } =
+    const { sitesList, mergedAllClients, mergedAllClientIds } =
        await getClientSiteResourceAccess(siteResource, trx);

    /////////// process the client-siteResource associations ///////////

-    // get all of the clients associated with other resources on this site
-    const allUpdatedClientsFromOtherResourcesOnThisSite = await trx
+    // get all of the clients associated with other resources in the same network,
+    // joined through siteNetworks so we know which siteId each client belongs to
+    const allUpdatedClientsFromOtherResourcesOnThisSite = siteResource.networkId
+        ? await trx
              .select({
-            clientId: clientSiteResourcesAssociationsCache.clientId
+                  clientId: clientSiteResourcesAssociationsCache.clientId,
+                  siteId: siteNetworks.siteId
              })
              .from(clientSiteResourcesAssociationsCache)
              .innerJoin(
@@ -172,20 +182,30 @@ export async function rebuildClientAssociationsFromSiteResource(
                      siteResources.siteResourceId
                  )
              )
+              .innerJoin(
+                  siteNetworks,
+                  eq(siteNetworks.networkId, siteResources.networkId)
+              )
              .where(
                  and(
-                eq(siteResources.siteId, siteId),
-                ne(siteResources.siteResourceId, siteResource.siteResourceId)
+                      eq(siteResources.networkId, siteResource.networkId),
+                      ne(
+                          siteResources.siteResourceId,
+                          siteResource.siteResourceId
                      )
-        );
+                  )
+              )
+        : [];

-    const allClientIdsFromOtherResourcesOnThisSite = Array.from(
-        new Set(
-            allUpdatedClientsFromOtherResourcesOnThisSite.map(
-                (row) => row.clientId
-            )
-        )
-    );
+    // Build a per-site map so the loop below can check by siteId rather than
+    // across the entire network.
+    const clientsFromOtherResourcesBySite = new Map<number, Set<number>>();
+    for (const row of allUpdatedClientsFromOtherResourcesOnThisSite) {
+        if (!clientsFromOtherResourcesBySite.has(row.siteId)) {
+            clientsFromOtherResourcesBySite.set(row.siteId, new Set());
+        }
+        clientsFromOtherResourcesBySite.get(row.siteId)!.add(row.clientId);
+    }

    const existingClientSiteResources = await trx
        .select({
@@ -259,31 +279,39 @@ export async function rebuildClientAssociationsFromSiteResource(

    /////////// process the client-site associations ///////////

+    for (const site of sitesList) {
+        const siteId = site.siteId;
+
        const existingClientSites = await trx
            .select({
                clientId: clientSitesAssociationsCache.clientId
            })
            .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.siteId, siteResource.siteId));
+            .where(eq(clientSitesAssociationsCache.siteId, siteId));

        const existingClientSiteIds = existingClientSites.map(
            (row) => row.clientId
        );

        // Get full client details for existing clients (needed for sending delete messages)
-    const existingClients = await trx
+        const existingClients =
+            existingClientSiteIds.length > 0
+                ? await trx
                      .select({
                          clientId: clients.clientId,
                          pubKey: clients.pubKey,
                          subnet: clients.subnet
                      })
                      .from(clients)
-        .where(inArray(clients.clientId, existingClientSiteIds));
+                      .where(inArray(clients.clientId, existingClientSiteIds))
+                : [];
+
+        const otherResourceClientIds = clientsFromOtherResourcesBySite.get(siteId) ?? new Set<number>();

        const clientSitesToAdd = mergedAllClientIds.filter(
            (clientId) =>
                !existingClientSiteIds.includes(clientId) &&
-            !allClientIdsFromOtherResourcesOnThisSite.includes(clientId) // dont remove if there is still another connection for another site resource
+                !otherResourceClientIds.has(clientId) // dont add if already connected via another site resource
        );

        const clientSitesToInsert = clientSitesToAdd.map((clientId) => ({
@@ -302,7 +330,7 @@ export async function rebuildClientAssociationsFromSiteResource(
        const clientSitesToRemove = existingClientSiteIds.filter(
            (clientId) =>
                !mergedAllClientIds.includes(clientId) &&
-            !allClientIdsFromOtherResourcesOnThisSite.includes(clientId) // dont remove if there is still another connection for another site resource
+                !otherResourceClientIds.has(clientId) // dont remove if there is still another connection for another site resource
        );

        if (clientSitesToRemove.length > 0) {
@@ -319,8 +347,6 @@ export async function rebuildClientAssociationsFromSiteResource(
                );
        }

-    /////////// send the messages ///////////
-
        // Now handle the messages to add/remove peers on both the newt and olm sides
        await handleMessagesForSiteClients(
            site,
@@ -331,10 +357,12 @@ export async function rebuildClientAssociationsFromSiteResource(
            clientSitesToRemove,
            trx
        );
+    }

    // Handle subnet proxy target updates for the resource associations
    await handleSubnetProxyTargetUpdates(
        siteResource,
+        sitesList,
        mergedAllClients,
        existingResourceClients,
        clientSiteResourcesToAdd,
@@ -623,6 +651,7 @@ export async function updateClientSiteDestinations(

 async function handleSubnetProxyTargetUpdates(
    siteResource: SiteResource,
+    sitesList: Site[],
    allClients: {
        clientId: number;
        pubKey: string | null;
@@ -637,22 +666,26 @@ async function handleSubnetProxyTargetUpdates(
    clientSiteResourcesToRemove: number[],
    trx: Transaction | typeof db = db
 ): Promise<void> {
+    const proxyJobs: Promise<any>[] = [];
+    const olmJobs: Promise<any>[] = [];
+
+    for (const siteData of sitesList) {
+        const siteId = siteData.siteId;
+
        // Get the newt for this site
        const [newt] = await trx
            .select()
            .from(newts)
-        .where(eq(newts.siteId, siteResource.siteId))
+            .where(eq(newts.siteId, siteId))
            .limit(1);

        if (!newt) {
            logger.warn(
-            `Newt not found for site ${siteResource.siteId}, skipping subnet proxy target updates`
+                `Newt not found for site ${siteId}, skipping subnet proxy target updates`
            );
-        return;
+            continue;
        }

-    const proxyJobs = [];
-    const olmJobs = [];
        // Generate targets for added associations
        if (clientSiteResourcesToAdd.length > 0) {
            const addedClients = allClients.filter((client) =>
@@ -667,7 +700,7 @@ async function handleSubnetProxyTargetUpdates(

                if (targetsToAdd.length > 0) {
                    logger.info(
-                    `Adding ${targetsToAdd.length} subnet proxy targets for siteResource ${siteResource.siteResourceId}`
+                        `Adding ${targetsToAdd.length} subnet proxy targets for siteResource ${siteResource.siteResourceId} on site ${siteId}`
                    );
                    proxyJobs.push(
                        addSubnetProxyTargets(
@@ -682,7 +715,7 @@ async function handleSubnetProxyTargetUpdates(
                    olmJobs.push(
                        addPeerData(
                            client.clientId,
-                        siteResource.siteId,
+                            siteId,
                            generateRemoteSubnets([siteResource]),
                            generateAliasConfig([siteResource])
                        )
@@ -707,7 +740,7 @@ async function handleSubnetProxyTargetUpdates(

                if (targetsToRemove.length > 0) {
                    logger.info(
-                    `Removing ${targetsToRemove.length} subnet proxy targets for siteResource ${siteResource.siteResourceId}`
+                        `Removing ${targetsToRemove.length} subnet proxy targets for siteResource ${siteResource.siteResourceId} on site ${siteId}`
                    );
                    proxyJobs.push(
                        removeSubnetProxyTargets(
@@ -719,7 +752,11 @@ async function handleSubnetProxyTargetUpdates(
                }

                for (const client of removedClients) {
-                // Check if this client still has access to another resource on this site with the same destination
+                    // Check if this client still has access to another resource
+                    // on this specific site with the same destination. We scope
+                    // by siteId (via siteNetworks) rather than networkId because
+                    // removePeerData operates per-site — a resource on a different
+                    // site sharing the same network should not block removal here.
                    const destinationStillInUse = await trx
                        .select()
                        .from(siteResources)
@@ -730,13 +767,17 @@ async function handleSubnetProxyTargetUpdates(
                                siteResources.siteResourceId
                            )
                        )
+                        .innerJoin(
+                            siteNetworks,
+                            eq(siteNetworks.networkId, siteResources.networkId)
+                        )
                        .where(
                            and(
                                eq(
                                    clientSiteResourcesAssociationsCache.clientId,
                                    client.clientId
                                ),
-                            eq(siteResources.siteId, siteResource.siteId),
+                                eq(siteNetworks.siteId, siteId),
                                eq(
                                    siteResources.destination,
                                    siteResource.destination
@@ -757,7 +798,7 @@ async function handleSubnetProxyTargetUpdates(
                    olmJobs.push(
                        removePeerData(
                            client.clientId,
-                        siteResource.siteId,
+                            siteId,
                            remoteSubnetsToRemove,
                            generateAliasConfig([siteResource])
                        )
@@ -765,6 +806,7 @@ async function handleSubnetProxyTargetUpdates(
                }
            }
        }
+    }

    await Promise.all(proxyJobs);
 }
@@ -868,10 +910,25 @@ export async function rebuildClientAssociationsFromClient(
                  )
            : [];

-    // Group by siteId for site-level associations
-    const newSiteIds = Array.from(
-        new Set(newSiteResources.map((sr) => sr.siteId))
+    // Group by siteId for site-level associations — look up via siteNetworks since
+    // siteResources no longer carries a direct siteId column.
+    const networkIds = Array.from(
+        new Set(
+            newSiteResources
+                .map((sr) => sr.networkId)
+                .filter((id): id is number => id !== null)
+        )
    );
+    const newSiteIds =
+        networkIds.length > 0
+            ? await trx
+                  .select({ siteId: siteNetworks.siteId })
+                  .from(siteNetworks)
+                  .where(inArray(siteNetworks.networkId, networkIds))
+                  .then((rows) =>
+                      Array.from(new Set(rows.map((r) => r.siteId)))
+                  )
+            : [];

    /////////// Process client-siteResource associations ///////////

@@ -1144,13 +1201,45 @@ async function handleMessagesForClientResources(
            resourcesToAdd.includes(r.siteResourceId)
        );

+        // Build (resource, siteId) pairs by looking up siteNetworks for each resource's networkId
+        const addedNetworkIds = Array.from(
+            new Set(
+                addedResources
+                    .map((r) => r.networkId)
+                    .filter((id): id is number => id !== null)
+            )
+        );
+        const addedSiteNetworkRows =
+            addedNetworkIds.length > 0
+                ? await trx
+                      .select({
+                          networkId: siteNetworks.networkId,
+                          siteId: siteNetworks.siteId
+                      })
+                      .from(siteNetworks)
+                      .where(inArray(siteNetworks.networkId, addedNetworkIds))
+                : [];
+        const addedNetworkToSites = new Map<number, number[]>();
+        for (const row of addedSiteNetworkRows) {
+            if (!addedNetworkToSites.has(row.networkId)) {
+                addedNetworkToSites.set(row.networkId, []);
+            }
+            addedNetworkToSites.get(row.networkId)!.push(row.siteId);
+        }
+
        // Group by site for proxy updates
        const addedBySite = new Map<number, SiteResource[]>();
        for (const resource of addedResources) {
-            if (!addedBySite.has(resource.siteId)) {
-                addedBySite.set(resource.siteId, []);
+            const siteIds =
+                resource.networkId != null
+                    ? (addedNetworkToSites.get(resource.networkId) ?? [])
+                    : [];
+            for (const siteId of siteIds) {
+                if (!addedBySite.has(siteId)) {
+                    addedBySite.set(siteId, []);
+                }
+                addedBySite.get(siteId)!.push(resource);
            }
-            addedBySite.get(resource.siteId)!.push(resource);
        }

        // Add subnet proxy targets for each site
@@ -1192,7 +1281,7 @@ async function handleMessagesForClientResources(
                    olmJobs.push(
                        addPeerData(
                            client.clientId,
-                            resource.siteId,
+                            siteId,
                            generateRemoteSubnets([resource]),
                            generateAliasConfig([resource])
                        )
@@ -1204,7 +1293,7 @@ async function handleMessagesForClientResources(
                        error.message.includes("not found")
                    ) {
                        logger.debug(
-                            `Olm data not found for client ${client.clientId} and site ${resource.siteId}, skipping removal`
+                            `Olm data not found for client ${client.clientId} and site ${siteId}, skipping addition`
                        );
                    } else {
                        throw error;
@@ -1221,13 +1310,45 @@ async function handleMessagesForClientResources(
            .from(siteResources)
            .where(inArray(siteResources.siteResourceId, resourcesToRemove));

+        // Build (resource, siteId) pairs via siteNetworks
+        const removedNetworkIds = Array.from(
+            new Set(
+                removedResources
+                    .map((r) => r.networkId)
+                    .filter((id): id is number => id !== null)
+            )
+        );
+        const removedSiteNetworkRows =
+            removedNetworkIds.length > 0
+                ? await trx
+                      .select({
+                          networkId: siteNetworks.networkId,
+                          siteId: siteNetworks.siteId
+                      })
+                      .from(siteNetworks)
+                      .where(inArray(siteNetworks.networkId, removedNetworkIds))
+                : [];
+        const removedNetworkToSites = new Map<number, number[]>();
+        for (const row of removedSiteNetworkRows) {
+            if (!removedNetworkToSites.has(row.networkId)) {
+                removedNetworkToSites.set(row.networkId, []);
+            }
+            removedNetworkToSites.get(row.networkId)!.push(row.siteId);
+        }
+
        // Group by site for proxy updates
        const removedBySite = new Map<number, SiteResource[]>();
        for (const resource of removedResources) {
-            if (!removedBySite.has(resource.siteId)) {
-                removedBySite.set(resource.siteId, []);
+            const siteIds =
+                resource.networkId != null
+                    ? (removedNetworkToSites.get(resource.networkId) ?? [])
+                    : [];
+            for (const siteId of siteIds) {
+                if (!removedBySite.has(siteId)) {
+                    removedBySite.set(siteId, []);
+                }
+                removedBySite.get(siteId)!.push(resource);
            }
-            removedBySite.get(resource.siteId)!.push(resource);
        }

        // Remove subnet proxy targets for each site
@@ -1265,7 +1386,11 @@ async function handleMessagesForClientResources(
                }

                try {
-                    // Check if this client still has access to another resource on this site with the same destination
+                    // Check if this client still has access to another resource
+                    // on this specific site with the same destination. We scope
+                    // by siteId (via siteNetworks) rather than networkId because
+                    // removePeerData operates per-site — a resource on a different
+                    // site sharing the same network should not block removal here.
                    const destinationStillInUse = await trx
                        .select()
                        .from(siteResources)
@@ -1276,13 +1401,17 @@ async function handleMessagesForClientResources(
                                siteResources.siteResourceId
                            )
                        )
+                        .innerJoin(
+                            siteNetworks,
+                            eq(siteNetworks.networkId, siteResources.networkId)
+                        )
                        .where(
                            and(
                                eq(
                                    clientSiteResourcesAssociationsCache.clientId,
                                    client.clientId
                                ),
-                                eq(siteResources.siteId, resource.siteId),
+                                eq(siteNetworks.siteId, siteId),
                                eq(
                                    siteResources.destination,
                                    resource.destination
@@ -1304,7 +1433,7 @@ async function handleMessagesForClientResources(
                    olmJobs.push(
                        removePeerData(
                            client.clientId,
-                            resource.siteId,
+                            siteId,
                            remoteSubnetsToRemove,
                            generateAliasConfig([resource])
                        )
@@ -1316,7 +1445,7 @@ async function handleMessagesForClientResources(
                        error.message.includes("not found")
                    ) {
                        logger.debug(
-                            `Olm data not found for client ${client.clientId} and site ${resource.siteId}, skipping removal`
+                            `Olm data not found for client ${client.clientId} and site ${siteId}, skipping removal`
                        );
                    } else {
                        throw error;
--- a/server/private/routers/ssh/signSshKey.ts
+++ b/server/private/routers/ssh/signSshKey.ts
@@ -21,7 +21,7 @@ import {
    roles,
    roundTripMessageTracker,
    siteResources,
-    sites,
+    siteNetworks,
    userOrgs
 } from "@server/db";
 import { isLicensedOrSubscribed } from "#private/lib/isLicencedOrSubscribed";
@@ -62,10 +62,12 @@ const bodySchema = z

 export type SignSshKeyResponse = {
    certificate: string;
+    messageIds: number[];
    messageId: number;
    sshUsername: string;
    sshHost: string;
    resourceId: number;
+    siteIds: number[];
    siteId: number;
    keyId: string;
    validPrincipals: string[];
@@ -250,10 +252,7 @@ export async function signSshKey(
                .update(userOrgs)
                .set({ pamUsername: usernameToUse })
                .where(
-                    and(
-                        eq(userOrgs.orgId, orgId),
-                        eq(userOrgs.userId, userId)
-                    )
+                    and(eq(userOrgs.orgId, orgId), eq(userOrgs.userId, userId))
                );
        } else {
            usernameToUse = userOrg.pamUsername;
@@ -374,21 +373,12 @@ export async function signSshKey(
        const homedir = roleRow?.sshCreateHomeDir ?? null;
        const sudoMode = roleRow?.sshSudoMode ?? "none";

-        // get the site
-        const [newt] = await db
-            .select()
-            .from(newts)
-            .where(eq(newts.siteId, resource.siteId))
-            .limit(1);
+        const sites = await db
+            .select({ siteId: siteNetworks.siteId })
+            .from(siteNetworks)
+            .where(eq(siteNetworks.networkId, resource.networkId!));

-        if (!newt) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Site associated with resource not found"
-                )
-            );
-        }
+        const siteIds = sites.map((site) => site.siteId);

        // Sign the public key
        const now = BigInt(Math.floor(Date.now() / 1000));
@@ -402,6 +392,24 @@ export async function signSshKey(
            validBefore: now + validFor
        });

+        const messageIds: number[] = [];
+        for (const siteId of siteIds) {
+            // get the site
+            const [newt] = await db
+                .select()
+                .from(newts)
+                .where(eq(newts.siteId, siteId))
+                .limit(1);
+
+            if (!newt) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Site associated with resource not found"
+                    )
+                );
+            }
+
            const [message] = await db
                .insert(roundTripMessageTracker)
                .values({
@@ -420,6 +428,8 @@ export async function signSshKey(
                );
            }

+            messageIds.push(message.messageId);
+
            await sendToClient(newt.newtId, {
                type: `newt/pam/connection`,
                data: {
@@ -439,6 +449,7 @@ export async function signSshKey(
                    }
                }
            });
+        }

        const expiresIn = Number(validFor); // seconds

@@ -459,18 +470,20 @@ export async function signSshKey(
            metadata: JSON.stringify({
                resourceId: resource.siteResourceId,
                resource: resource.name,
-                siteId: resource.siteId,
+                siteIds: siteIds
            })
        });

        return response<SignSshKeyResponse>(res, {
            data: {
                certificate: cert.certificate,
-                messageId: message.messageId,
+                messageIds: messageIds,
+                messageId: messageIds[0], // just pick the first one for backward compatibility
                sshUsername: usernameToUse,
                sshHost: sshHost,
                resourceId: resource.siteResourceId,
-                siteId: resource.siteId,
+                siteIds: siteIds,
+                siteId: siteIds[0], // just pick the first one for backward compatibility
                keyId: cert.keyId,
                validPrincipals: cert.validPrincipals,
                validAfter: cert.validAfter.toISOString(),
--- a/server/routers/badger/logRequestAudit.ts
+++ b/server/routers/badger/logRequestAudit.ts
@@ -5,26 +5,6 @@ import cache from "#dynamic/lib/cache";
 import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
 import { stripPortFromHost } from "@server/lib/ip";

-/**
- * Sanitize a string field by replacing lone UTF-16 surrogates (which cannot
- * be encoded as valid UTF-8) with the Unicode replacement character, and
- * stripping ASCII control characters that are invalid in most text columns.
- */
-function sanitizeString(value: string | undefined | null): string | undefined {
-    if (value == null) return undefined;
-    return (
-        value
-            // Replace lone high surrogates (not followed by a low surrogate)
-            // and lone low surrogates (not preceded by a high surrogate)
-            .replace(
-                /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g,
-                "\uFFFD"
-            )
-            // Strip C0 control characters except HT (\x09), LF (\x0A), CR (\x0D)
-            .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "")
-    );
-}
-
 /**

 Reasons:
@@ -273,23 +253,24 @@ export async function logRequestAudit(
        // Add to buffer instead of writing directly to DB
        auditLogBuffer.push({
            timestamp,
-            orgId: sanitizeString(data.orgId),
-            actorType: sanitizeString(actorType),
-            actor: sanitizeString(actor),
-            actorId: sanitizeString(actorId),
-            metadata: sanitizeString(metadata),
+            orgId: data.orgId,
+            actorType,
+            actor,
+            actorId,
+            metadata,
            action: data.action,
            resourceId: data.resourceId,
            reason: data.reason,
-            location: sanitizeString(data.location),
-            originalRequestURL: sanitizeString(body.originalRequestURL) ?? "",
-            scheme: sanitizeString(body.scheme) ?? "",
-            host: sanitizeString(body.host) ?? "",
-            path: sanitizeString(body.path) ?? "",
-            method: sanitizeString(body.method) ?? "",
-            ip: sanitizeString(clientIp),
+            location: data.location,
+            originalRequestURL: body.originalRequestURL,
+            scheme: body.scheme,
+            host: body.host,
+            path: body.path,
+            method: body.method,
+            ip: clientIp,
            tls: body.tls
        });
+
        // Flush immediately if buffer is full, otherwise schedule a flush
        if (auditLogBuffer.length >= BATCH_SIZE) {
            // Fire and forget - don't block the caller
--- a/server/routers/integration.ts
+++ b/server/routers/integration.ts
@@ -135,13 +135,6 @@ authenticated.post(
    logActionAudit(ActionsEnum.updateSite),
    site.updateSite
 );
-authenticated.post(
-    "/org/:orgId/reset-bandwidth",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.resetSiteBandwidth),
-    logActionAudit(ActionsEnum.resetSiteBandwidth),
-    org.resetOrgBandwidth
-);

 authenticated.delete(
    "/site/:siteId",
--- a/server/routers/newt/buildConfiguration.ts
+++ b/server/routers/newt/buildConfiguration.ts
@@ -4,8 +4,10 @@ import {
    clientSitesAssociationsCache,
    db,
    ExitNode,
+    networks,
    resources,
    Site,
+    siteNetworks,
    siteResources,
    targetHealthCheck,
    targets
@@ -137,11 +139,14 @@ export async function buildClientConfigurationForNewtClient(
    // Filter out any null values from peers that didn't have an olm
    const validPeers = peers.filter((peer) => peer !== null);

-    // Get all enabled site resources for this site
+    // Get all enabled site resources for this site by joining through siteNetworks and networks
    const allSiteResources = await db
        .select()
        .from(siteResources)
-        .where(eq(siteResources.siteId, siteId));
+        .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
+        .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
+        .where(eq(siteNetworks.siteId, siteId))
+        .then((rows) => rows.map((r) => r.siteResources));

    const targetsToSend: SubnetProxyTarget[] = [];

--- a/server/routers/olm/buildConfiguration.ts
+++ b/server/routers/olm/buildConfiguration.ts
@@ -4,6 +4,8 @@ import {
    clientSitesAssociationsCache,
    db,
    exitNodes,
+    networks,
+    siteNetworks,
    siteResources,
    sites
 } from "@server/db";
@@ -59,9 +61,17 @@ export async function buildSiteConfigurationForOlmClient(
                    clientSiteResourcesAssociationsCache.siteResourceId
                )
            )
+            .innerJoin(
+                networks,
+                eq(siteResources.networkId, networks.networkId)
+            )
+            .innerJoin(
+                siteNetworks,
+                eq(networks.networkId, siteNetworks.networkId)
+            )
            .where(
                and(
-                    eq(siteResources.siteId, site.siteId),
+                    eq(siteNetworks.siteId, site.siteId),
                    eq(
                        clientSiteResourcesAssociationsCache.clientId,
                        client.clientId
@@ -69,6 +79,7 @@ export async function buildSiteConfigurationForOlmClient(
                )
            );

+
        if (jitMode) {
            // Add site configuration to the array
            siteConfigurations.push({
--- a/server/routers/olm/handleOlmServerInitAddPeerHandshake.ts
+++ b/server/routers/olm/handleOlmServerInitAddPeerHandshake.ts
@@ -4,10 +4,12 @@ import {
    db,
    exitNodes,
    Site,
-    siteResources
+    siteNetworks,
+    siteResources,
+    sites
 } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
-import { clients, Olm, sites } from "@server/db";
+import { clients, Olm } from "@server/db";
 import { and, eq, or } from "drizzle-orm";
 import logger from "@server/logger";
 import { initPeerAddHandshake } from "./peers";
@@ -44,20 +46,31 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (

    const { siteId, resourceId, chainId } = message.data;

-    let site: Site | null = null;
+    const sendCancel = async () => {
+        await sendToClient(
+            olm.olmId,
+            {
+                type: "olm/wg/peer/chain/cancel",
+                data: { chainId }
+            },
+            { incrementConfigVersion: false }
+        ).catch((error) => {
+            logger.warn(`Error sending message:`, error);
+        });
+    };
+
+    let sitesToProcess: Site[] = [];
+
    if (siteId) {
-        // get the site
        const [siteRes] = await db
            .select()
            .from(sites)
            .where(eq(sites.siteId, siteId))
            .limit(1);
        if (siteRes) {
-            site = siteRes;
+            sitesToProcess = [siteRes];
        }
-    }
-
-    if (resourceId && !site) {
+    } else if (resourceId) {
        const resources = await db
            .select()
            .from(siteResources)
@@ -72,27 +85,17 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
            );

        if (!resources || resources.length === 0) {
-            logger.error(`handleOlmServerPeerAddMessage: Resource not found`);
-            // cancel the request from the olm side to not keep doing this
-            await sendToClient(
-                olm.olmId,
-                {
-                    type: "olm/wg/peer/chain/cancel",
-                    data: {
-                        chainId
-                    }
-                },
-                { incrementConfigVersion: false }
-            ).catch((error) => {
-                logger.warn(`Error sending message:`, error);
-            });
+            logger.error(
+                `handleOlmServerInitAddPeerHandshake: Resource not found`
+            );
+            await sendCancel();
            return;
        }

        if (resources.length > 1) {
            // error but this should not happen because the nice id cant contain a dot and the alias has to have a dot and both have to be unique within the org so there should never be multiple matches
            logger.error(
-                `handleOlmServerPeerAddMessage: Multiple resources found matching the criteria`
+                `handleOlmServerInitAddPeerHandshake: Multiple resources found matching the criteria`
            );
            return;
        }
@@ -117,47 +120,61 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (

        if (currentResourceAssociationCaches.length === 0) {
            logger.error(
-                `handleOlmServerPeerAddMessage: Client ${client.clientId} does not have access to resource ${resource.siteResourceId}`
+                `handleOlmServerInitAddPeerHandshake: Client ${client.clientId} does not have access to resource ${resource.siteResourceId}`
            );
-            // cancel the request from the olm side to not keep doing this
-            await sendToClient(
-                olm.olmId,
-                {
-                    type: "olm/wg/peer/chain/cancel",
-                    data: {
-                        chainId
-                    }
-                },
-                { incrementConfigVersion: false }
-            ).catch((error) => {
-                logger.warn(`Error sending message:`, error);
-            });
+            await sendCancel();
            return;
        }

-        const siteIdFromResource = resource.siteId;
+        if (!resource.networkId) {
+            logger.error(
+                `handleOlmServerInitAddPeerHandshake: Resource ${resource.siteResourceId} has no network`
+            );
+            await sendCancel();
+            return;
+        }

-        // get the site
-        const [siteRes] = await db
+        // Get all sites associated with this resource's network via siteNetworks
+        const siteRows = await db
+            .select({ siteId: siteNetworks.siteId })
+            .from(siteNetworks)
+            .where(eq(siteNetworks.networkId, resource.networkId));
+
+        if (!siteRows || siteRows.length === 0) {
+            logger.error(
+                `handleOlmServerInitAddPeerHandshake: No sites found for resource ${resource.siteResourceId}`
+            );
+            await sendCancel();
+            return;
+        }
+
+        // Fetch full site objects for all network members
+        const foundSites = await Promise.all(
+            siteRows.map(async ({ siteId: sid }) => {
+                const [s] = await db
                    .select()
                    .from(sites)
-            .where(eq(sites.siteId, siteIdFromResource));
-        if (!siteRes) {
-            logger.error(
-                `handleOlmServerPeerAddMessage: Site with ID ${site} not found`
+                    .where(eq(sites.siteId, sid))
+                    .limit(1);
+                return s ?? null;
+            })
        );
+
+        sitesToProcess = foundSites.filter((s): s is Site => s !== null);
+    }
+
+    if (sitesToProcess.length === 0) {
+        logger.error(
+            `handleOlmServerInitAddPeerHandshake: No sites to process`
+        );
+        await sendCancel();
        return;
    }

-        site = siteRes;
-    }
+    let handshakeInitiated = false;

-    if (!site) {
-        logger.error(`handleOlmServerPeerAddMessage: Site not found`);
-        return;
-    }
-
-    // check if the client can access this site using the cache
+    for (const site of sitesToProcess) {
+        // Check if the client can access this site using the cache
        const currentSiteAssociationCaches = await db
            .select()
            .from(clientSitesAssociationsCache)
@@ -169,46 +186,19 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
            );

        if (currentSiteAssociationCaches.length === 0) {
-        logger.error(
-            `handleOlmServerPeerAddMessage: Client ${client.clientId} does not have access to site ${site.siteId}`
+            logger.warn(
+                `handleOlmServerInitAddPeerHandshake: Client ${client.clientId} does not have access to site ${site.siteId}, skipping`
            );
-        // cancel the request from the olm side to not keep doing this
-        await sendToClient(
-            olm.olmId,
-            {
-                type: "olm/wg/peer/chain/cancel",
-                data: {
-                    chainId
-                }
-            },
-            { incrementConfigVersion: false }
-        ).catch((error) => {
-            logger.warn(`Error sending message:`, error);
-        });
-        return;
+            continue;
        }

        if (!site.exitNodeId) {
            logger.error(
-            `handleOlmServerPeerAddMessage: Site with ID ${site.siteId} has no exit node`
+                `handleOlmServerInitAddPeerHandshake: Site ${site.siteId} has no exit node, skipping`
            );
-        // cancel the request from the olm side to not keep doing this
-        await sendToClient(
-            olm.olmId,
-            {
-                type: "olm/wg/peer/chain/cancel",
-                data: {
-                    chainId
-                }
-            },
-            { incrementConfigVersion: false }
-        ).catch((error) => {
-            logger.warn(`Error sending message:`, error);
-        });
-        return;
+            continue;
        }

-    // get the exit node from the side
        const [exitNode] = await db
            .select()
            .from(exitNodes)
@@ -216,15 +206,13 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (

        if (!exitNode) {
            logger.error(
-            `handleOlmServerPeerAddMessage: Site with ID ${site.siteId} has no exit node`
+                `handleOlmServerInitAddPeerHandshake: Exit node not found for site ${site.siteId}, skipping`
            );
-        return;
+            continue;
        }

-    // also trigger the peer add handshake in case the peer was not already added to the olm and we need to hole punch
-    // if it has already been added this will be a no-op
+        // Trigger the peer add handshake — if the peer was already added this will be a no-op
        await initPeerAddHandshake(
-        // this will kick off the add peer process for the client
            client.clientId,
            {
                siteId: site.siteId,
@@ -237,5 +225,15 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
            chainId
        );

+        handshakeInitiated = true;
+    }
+
+    if (!handshakeInitiated) {
+        logger.error(
+            `handleOlmServerInitAddPeerHandshake: No accessible sites with valid exit nodes found, cancelling chain`
+        );
+        await sendCancel();
+    }
+
    return;
 };
--- a/server/routers/olm/handleOlmServerPeerAddMessage.ts
+++ b/server/routers/olm/handleOlmServerPeerAddMessage.ts
@@ -1,43 +1,25 @@
 import {
-    Client,
    clientSiteResourcesAssociationsCache,
    db,
-    ExitNode,
-    Org,
-    orgs,
-    roleClients,
-    roles,
+    networks,
+    siteNetworks,
    siteResources,
-    Transaction,
-    userClients,
-    userOrgs,
-    users
 } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import {
    clients,
    clientSitesAssociationsCache,
-    exitNodes,
    Olm,
-    olms,
    sites
 } from "@server/db";
 import { and, eq, inArray, isNotNull, isNull } from "drizzle-orm";
-import { addPeer, deletePeer } from "../newt/peers";
 import logger from "@server/logger";
-import { listExitNodes } from "#dynamic/lib/exitNodes";
 import {
    generateAliasConfig,
-    getNextAvailableClientSubnet
 } from "@server/lib/ip";
 import { generateRemoteSubnets } from "@server/lib/ip";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
-import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
-import { validateSessionToken } from "@server/auth/sessions/app";
-import config from "@server/lib/config";
 import {
    addPeer as newtAddPeer,
-    deletePeer as newtDeletePeer
 } from "@server/routers/newt/peers";

 export const handleOlmServerPeerAddMessage: MessageHandler = async (
@@ -153,14 +135,22 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                clientSiteResourcesAssociationsCache.siteResourceId
            )
        )
-        .where(
+        .innerJoin(
+            networks,
+            eq(siteResources.networkId, networks.networkId)
+        )
+        .innerJoin(
+            siteNetworks,
            and(
-                eq(siteResources.siteId, site.siteId),
+                eq(networks.networkId, siteNetworks.networkId),
+                eq(siteNetworks.siteId, site.siteId)
+            )
+        )
+        .where(
            eq(
                clientSiteResourcesAssociationsCache.clientId,
                client.clientId
            )
-            )
        );

    // Return connect message with all site configurations
--- a/server/routers/org/index.ts
+++ b/server/routers/org/index.ts
@@ -8,4 +8,3 @@ export * from "./getOrgOverview";
 export * from "./listOrgs";
 export * from "./pickOrgDefaults";
 export * from "./checkOrgUserAccess";
-export * from "./resetOrgBandwidth";
--- a/server/routers/org/resetOrgBandwidth.ts
+++ b/server/routers/org/resetOrgBandwidth.ts
@@ -1,83 +0,0 @@
-import { NextFunction, Request, Response } from "express";
-import { z } from "zod";
-import { db, sites } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const resetOrgBandwidthParamsSchema = z.strictObject({
-    orgId: z.string()
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/org/{orgId}/reset-bandwidth",
-    description: "Reset all sites in selected organization bandwidth counters.",
-    tags: [OpenAPITags.Org, OpenAPITags.Site],
-    request: {
-        params: resetOrgBandwidthParamsSchema
-    },
-    responses: {}
-});
-
-export async function resetOrgBandwidth(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = resetOrgBandwidthParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId } = parsedParams.data;
-
-        const [site] = await db
-            .select({ siteId: sites.siteId })
-            .from(sites)
-            .where(eq(sites.orgId, orgId))
-            .limit(1);
-
-        if (!site) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `No sites found in org ${orgId}`
-                )
-            );
-        }
-
-        await db
-            .update(sites)
-            .set({
-                megabytesIn: 0,
-                megabytesOut: 0
-            })
-            .where(eq(sites.orgId, orgId));
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Sites bandwidth reset successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/site/deleteSite.ts
+++ b/server/routers/site/deleteSite.ts
@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, Site, siteResources } from "@server/db";
+import { db, Site, siteNetworks, siteResources } from "@server/db";
 import { newts, newtSessions, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -71,19 +71,24 @@ export async function deleteSite(
                    await deletePeer(site.exitNodeId!, site.pubKey);
                }
            } else if (site.type == "newt") {
-                // delete all of the site resources on this site
-                const siteResourcesOnSite = trx
-                    .delete(siteResources)
-                    .where(eq(siteResources.siteId, siteId))
-                    .returning();
+                const networks = await trx
+                    .select({ networkId: siteNetworks.networkId })
+                    .from(siteNetworks)
+                    .where(eq(siteNetworks.siteId, siteId));

                // loop through them
-                for (const removedSiteResource of await siteResourcesOnSite) {
+                for (const network of await networks) {
+                    const [siteResource] = await trx
+                        .select()
+                        .from(siteResources)
+                        .where(eq(siteResources.networkId, network.networkId));
+                    if (siteResource) {
                        await rebuildClientAssociationsFromSiteResource(
-                        removedSiteResource,
+                            siteResource,
                            trx
                        );
                    }
+                }

                // get the newt on the site by querying the newt table for siteId
                const [deletedNewt] = await trx
--- a/server/routers/siteResource/createSiteResource.ts
+++ b/server/routers/siteResource/createSiteResource.ts
@@ -5,6 +5,8 @@ import {
    orgs,
    roles,
    roleSiteResources,
+    siteNetworks,
+    networks,
    SiteResource,
    siteResources,
    sites,
@@ -23,7 +25,7 @@ import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -37,7 +39,7 @@ const createSiteResourceSchema = z
    .strictObject({
        name: z.string().min(1).max(255),
        mode: z.enum(["host", "cidr", "port"]),
-        siteId: z.int(),
+        siteIds: z.array(z.int()),
        // protocol: z.enum(["tcp", "udp"]).optional(),
        // proxyPort: z.int().positive().optional(),
        // destinationPort: z.int().positive().optional(),
@@ -159,7 +161,7 @@ export async function createSiteResource(
        const { orgId } = parsedParams.data;
        const {
            name,
-            siteId,
+            siteIds,
            mode,
            // protocol,
            // proxyPort,
@@ -178,14 +180,16 @@ export async function createSiteResource(
        } = parsedBody.data;

        // Verify the site exists and belongs to the org
-        const [site] = await db
+        const sitesToAssign = await db
            .select()
            .from(sites)
-            .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
+            .where(and(inArray(sites.siteId, siteIds), eq(sites.orgId, orgId)))
            .limit(1);

-        if (!site) {
-            return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
+        if (sitesToAssign.length !== siteIds.length) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Some site not found")
+            );
        }

        const [org] = await db
@@ -287,12 +291,29 @@ export async function createSiteResource(

        let newSiteResource: SiteResource | undefined;
        await db.transaction(async (trx) => {
+            const [network] = await trx
+                .insert(networks)
+                .values({
+                    scope: "resource",
+                    orgId: orgId
+                })
+                .returning();
+
+            if (!network) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        `Failed to create network`
+                    )
+                );
+            }
+
            // Create the site resource
            const insertValues: typeof siteResources.$inferInsert = {
-                siteId,
                niceId,
                orgId,
                name,
+                networkId: network.networkId,
                mode: mode as "host" | "cidr",
                destination,
                enabled,
@@ -317,6 +338,13 @@ export async function createSiteResource(

            //////////////////// update the associations ////////////////////

+            for (const siteId of siteIds) {
+                await trx.insert(siteNetworks).values({
+                    siteId: siteId,
+                    networkId: network.networkId
+                });
+            }
+
            const [adminRole] = await trx
                .select()
                .from(roles)
@@ -359,17 +387,22 @@ export async function createSiteResource(
                );
            }

+            for (const siteToAssign of sitesToAssign) {
                const [newt] = await trx
                    .select()
                    .from(newts)
-                .where(eq(newts.siteId, site.siteId))
+                    .where(eq(newts.siteId, siteToAssign.siteId))
                    .limit(1);

                if (!newt) {
                    return next(
-                    createHttpError(HttpCode.NOT_FOUND, "Newt not found")
+                        createHttpError(
+                            HttpCode.NOT_FOUND,
+                            `Newt not found for site ${siteToAssign.siteId}`
+                        )
                    );
                }
+            }

            await rebuildClientAssociationsFromSiteResource(
                newSiteResource,
@@ -387,7 +420,7 @@ export async function createSiteResource(
        }

        logger.info(
-            `Created site resource ${newSiteResource.siteResourceId} for site ${siteId}`
+            `Created site resource ${newSiteResource.siteResourceId} for org ${orgId}`
        );

        return response(res, {
--- a/server/routers/siteResource/deleteSiteResource.ts
+++ b/server/routers/siteResource/deleteSiteResource.ts
@@ -70,17 +70,18 @@ export async function deleteSiteResource(
                .where(and(eq(siteResources.siteResourceId, siteResourceId)))
                .returning();

-            const [newt] = await trx
-                .select()
-                .from(newts)
-                .where(eq(newts.siteId, removedSiteResource.siteId))
-                .limit(1);
+            // not sure why this is here...
+            // const [newt] = await trx
+            //     .select()
+            //     .from(newts)
+            //     .where(eq(newts.siteId, removedSiteResource.siteId))
+            //     .limit(1);

-            if (!newt) {
-                return next(
-                    createHttpError(HttpCode.NOT_FOUND, "Newt not found")
-                );
-            }
+            // if (!newt) {
+            //     return next(
+            //         createHttpError(HttpCode.NOT_FOUND, "Newt not found")
+            //     );
+            // }

            await rebuildClientAssociationsFromSiteResource(
                removedSiteResource,
--- a/server/routers/siteResource/getSiteResource.ts
+++ b/server/routers/siteResource/getSiteResource.ts
@@ -17,38 +17,34 @@ const getSiteResourceParamsSchema = z.strictObject({
        .transform((val) => (val ? Number(val) : undefined))
        .pipe(z.int().positive().optional())
        .optional(),
-    siteId: z.string().transform(Number).pipe(z.int().positive()),
    niceId: z.string().optional(),
    orgId: z.string()
 });

 async function query(
    siteResourceId?: number,
-    siteId?: number,
    niceId?: string,
    orgId?: string
 ) {
-    if (siteResourceId && siteId && orgId) {
+    if (siteResourceId && orgId) {
        const [siteResource] = await db
            .select()
            .from(siteResources)
            .where(
                and(
                    eq(siteResources.siteResourceId, siteResourceId),
-                    eq(siteResources.siteId, siteId),
                    eq(siteResources.orgId, orgId)
                )
            )
            .limit(1);
        return siteResource;
-    } else if (niceId && siteId && orgId) {
+    } else if (niceId && orgId) {
        const [siteResource] = await db
            .select()
            .from(siteResources)
            .where(
                and(
                    eq(siteResources.niceId, niceId),
-                    eq(siteResources.siteId, siteId),
                    eq(siteResources.orgId, orgId)
                )
            )
@@ -84,7 +80,6 @@ registry.registerPath({
    request: {
        params: z.object({
            niceId: z.string(),
-            siteId: z.number(),
            orgId: z.string()
        })
    },
@@ -107,10 +102,10 @@ export async function getSiteResource(
            );
        }

-        const { siteResourceId, siteId, niceId, orgId } = parsedParams.data;
+        const { siteResourceId, niceId, orgId } = parsedParams.data;

        // Get the site resource
-        const siteResource = await query(siteResourceId, siteId, niceId, orgId);
+        const siteResource = await query(siteResourceId, niceId, orgId);

        if (!siteResource) {
            return next(
--- a/server/routers/siteResource/listAllSiteResourcesByOrg.ts
+++ b/server/routers/siteResource/listAllSiteResourcesByOrg.ts
@@ -1,4 +1,4 @@
-import { db, SiteResource, siteResources, sites } from "@server/db";
+import { db, SiteResource, siteNetworks, siteResources, sites } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -73,9 +73,10 @@ const listAllSiteResourcesByOrgQuerySchema = z.object({

 export type ListAllSiteResourcesByOrgResponse = PaginatedResponse<{
    siteResources: (SiteResource & {
-        siteName: string;
-        siteNiceId: string;
-        siteAddress: string | null;
+        siteIds: number[];
+        siteNames: string[];
+        siteNiceIds: string[];
+        siteAddresses: (string | null)[];
    })[];
 }>;

@@ -83,7 +84,6 @@ function querySiteResourcesBase() {
    return db
        .select({
            siteResourceId: siteResources.siteResourceId,
-            siteId: siteResources.siteId,
            orgId: siteResources.orgId,
            niceId: siteResources.niceId,
            name: siteResources.name,
@@ -100,14 +100,20 @@ function querySiteResourcesBase() {
            disableIcmp: siteResources.disableIcmp,
            authDaemonMode: siteResources.authDaemonMode,
            authDaemonPort: siteResources.authDaemonPort,
-            siteName: sites.name,
-            siteNiceId: sites.niceId,
-            siteAddress: sites.address
+            networkId: siteResources.networkId,
+            defaultNetworkId: siteResources.defaultNetworkId,
+            siteNames: sql<string[]>`array_agg(${sites.name})`,
+            siteNiceIds: sql<string[]>`array_agg(${sites.niceId})`,
+            siteIds: sql<number[]>`array_agg(${sites.siteId})`,
+            siteAddresses: sql<(string | null)[]>`array_agg(${sites.address})`
        })
        .from(siteResources)
-        .innerJoin(sites, eq(siteResources.siteId, sites.siteId));
+        .innerJoin(siteNetworks, eq(siteResources.networkId, siteNetworks.networkId))
+        .innerJoin(sites, eq(siteNetworks.siteId, sites.siteId))
+        .groupBy(siteResources.siteResourceId);
 }

+
 registry.registerPath({
    method: "get",
    path: "/org/{orgId}/site-resources",
--- a/server/routers/siteResource/listSiteResources.ts
+++ b/server/routers/siteResource/listSiteResources.ts
@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db } from "@server/db";
+import { db, networks, siteNetworks } from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -108,13 +108,21 @@ export async function listSiteResources(
            return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
        }

-        // Get site resources
+        // Get site resources by joining networks to siteResources via siteNetworks
        const siteResourcesList = await db
            .select()
-            .from(siteResources)
+            .from(siteNetworks)
+            .innerJoin(
+                networks,
+                eq(siteNetworks.networkId, networks.networkId)
+            )
+            .innerJoin(
+                siteResources,
+                eq(siteResources.networkId, networks.networkId)
+            )
            .where(
                and(
-                    eq(siteResources.siteId, siteId),
+                    eq(siteNetworks.siteId, siteId),
                    eq(siteResources.orgId, orgId)
                )
            )
@@ -128,6 +136,7 @@ export async function listSiteResources(
            .limit(limit)
            .offset(offset);

+
        return response(res, {
            data: { siteResources: siteResourcesList },
            success: true,
--- a/server/routers/siteResource/updateSiteResource.ts
+++ b/server/routers/siteResource/updateSiteResource.ts
@@ -8,7 +8,9 @@ import {
    orgs,
    roles,
    roleSiteResources,
+    siteNetworks,
    sites,
+    networks,
    Transaction,
    userSiteResources
 } from "@server/db";
@@ -16,7 +18,7 @@ import { siteResources, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { eq, and, ne } from "drizzle-orm";
+import { eq, and, ne, inArray } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -42,7 +44,7 @@ const updateSiteResourceParamsSchema = z.strictObject({
 const updateSiteResourceSchema = z
    .strictObject({
        name: z.string().min(1).max(255).optional(),
-        siteId: z.int(),
+        siteIds: z.array(z.int()),
        // niceId: z.string().min(1).max(255).regex(/^[a-zA-Z0-9-]+$/, "niceId can only contain letters, numbers, and dashes").optional(),
        // mode: z.enum(["host", "cidr", "port"]).optional(),
        mode: z.enum(["host", "cidr"]).optional(),
@@ -166,7 +168,7 @@ export async function updateSiteResource(
        const { siteResourceId } = parsedParams.data;
        const {
            name,
-            siteId, // because it can change
+            siteIds, // because it can change
            mode,
            destination,
            alias,
@@ -181,16 +183,6 @@ export async function updateSiteResource(
            authDaemonMode
        } = parsedBody.data;

-        const [site] = await db
-            .select()
-            .from(sites)
-            .where(eq(sites.siteId, siteId))
-            .limit(1);
-
-        if (!site) {
-            return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
-        }
-
        // Check if site resource exists
        const [existingSiteResource] = await db
            .select()
@@ -230,6 +222,24 @@ export async function updateSiteResource(
            );
        }

+        // Verify the site exists and belongs to the org
+        const sitesToAssign = await db
+            .select()
+            .from(sites)
+            .where(
+                and(
+                    inArray(sites.siteId, siteIds),
+                    eq(sites.orgId, existingSiteResource.orgId)
+                )
+            )
+            .limit(1);
+
+        if (sitesToAssign.length !== siteIds.length) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Some site not found")
+            );
+        }
+
        // Only check if destination is an IP address
        const isIp = z
            .union([z.ipv4(), z.ipv6()])
@@ -247,25 +257,24 @@ export async function updateSiteResource(
            );
        }

-        let existingSite = site;
-        let siteChanged = false;
-        if (existingSiteResource.siteId !== siteId) {
-            siteChanged = true;
-            // get the existing site
-            [existingSite] = await db
+        let sitesChanged = false;
+        const existingSiteIds = existingSiteResource.networkId
+            ? await db
                  .select()
-                .from(sites)
-                .where(eq(sites.siteId, existingSiteResource.siteId))
-                .limit(1);
-
-            if (!existingSite) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        "Existing site not found"
+                  .from(siteNetworks)
+                  .where(
+                      eq(siteNetworks.networkId, existingSiteResource.networkId)
                  )
-                );
-            }
+            : [];
+
+        const existingSiteIdSet = new Set(existingSiteIds.map((s) => s.siteId));
+        const newSiteIdSet = new Set(siteIds);
+
+        if (
+            existingSiteIdSet.size !== newSiteIdSet.size ||
+            ![...existingSiteIdSet].every((id) => newSiteIdSet.has(id))
+        ) {
+            sitesChanged = true;
        }

        // make sure the alias is unique within the org if provided
@@ -295,7 +304,7 @@ export async function updateSiteResource(
        let updatedSiteResource: SiteResource | undefined;
        await db.transaction(async (trx) => {
            // if the site is changed we need to delete and recreate the resource to avoid complications with the rebuild function otherwise we can just update in place
-            if (siteChanged) {
+            if (sitesChanged) {
                // delete the existing site resource
                await trx
                    .delete(siteResources)
@@ -321,7 +330,8 @@ export async function updateSiteResource(

                const sshPamSet =
                    isLicensedSshPam &&
-                    (authDaemonPort !== undefined || authDaemonMode !== undefined)
+                    (authDaemonPort !== undefined ||
+                        authDaemonMode !== undefined)
                        ? {
                              ...(authDaemonPort !== undefined && {
                                  authDaemonPort
@@ -335,7 +345,6 @@ export async function updateSiteResource(
                    .update(siteResources)
                    .set({
                        name: name,
-                        siteId: siteId,
                        mode: mode,
                        destination: destination,
                        enabled: enabled,
@@ -423,7 +432,8 @@ export async function updateSiteResource(
                // Update the site resource
                const sshPamSet =
                    isLicensedSshPam &&
-                    (authDaemonPort !== undefined || authDaemonMode !== undefined)
+                    (authDaemonPort !== undefined ||
+                        authDaemonMode !== undefined)
                        ? {
                              ...(authDaemonPort !== undefined && {
                                  authDaemonPort
@@ -437,7 +447,6 @@ export async function updateSiteResource(
                    .update(siteResources)
                    .set({
                        name: name,
-                        siteId: siteId,
                        mode: mode,
                        destination: destination,
                        enabled: enabled,
@@ -454,6 +463,20 @@ export async function updateSiteResource(

                //////////////////// update the associations ////////////////////

+                // delete the site - site resources associations
+                await trx
+                    .delete(siteNetworks)
+                    .where(
+                        eq(siteNetworks.networkId, updatedSiteResource.networkId!)
+                    );
+
+                for (const siteId of siteIds) {
+                    await trx.insert(siteNetworks).values({
+                        siteId: siteId,
+                        networkId: updatedSiteResource.networkId!
+                    });
+                }
+
                await trx
                    .delete(clientSiteResources)
                    .where(
@@ -524,13 +547,16 @@ export async function updateSiteResource(
                }

                logger.info(
-                    `Updated site resource ${siteResourceId} for site ${siteId}`
+                    `Updated site resource ${siteResourceId}`
                );

                await handleMessagingForUpdatedSiteResource(
                    existingSiteResource,
                    updatedSiteResource,
-                    { siteId: site.siteId, orgId: site.orgId },
+                    siteIds.map((siteId) => ({
+                        siteId,
+                        orgId: existingSiteResource.orgId
+                    })),
                    trx
                );
            }
@@ -557,7 +583,7 @@ export async function updateSiteResource(
 export async function handleMessagingForUpdatedSiteResource(
    existingSiteResource: SiteResource | undefined,
    updatedSiteResource: SiteResource,
-    site: { siteId: number; orgId: string },
+    sites: { siteId: number; orgId: string }[],
    trx: Transaction
 ) {
    logger.debug(
@@ -594,6 +620,7 @@ export async function handleMessagingForUpdatedSiteResource(
    // if the existingSiteResource is undefined (new resource) we don't need to do anything here, the rebuild above handled it all

    if (destinationChanged || aliasChanged || portRangesChanged) {
+        for (const site of sites) {
            const [newt] = await trx
                .select()
                .from(newts)
@@ -617,10 +644,14 @@ export async function handleMessagingForUpdatedSiteResource(
                    mergedAllClients
                );

-            await updateTargets(newt.newtId, {
+                await updateTargets(
+                    newt.newtId,
+                    {
                        oldTargets: oldTargets,
                        newTargets: newTargets
-            }, newt.version);
+                    },
+                    newt.version
+                );
            }

            const olmJobs: Promise<void>[] = [];
@@ -637,13 +668,20 @@ export async function handleMessagingForUpdatedSiteResource(
                            siteResources.siteResourceId
                        )
                    )
+                    .innerJoin(
+                        siteNetworks,
+                        eq(
+                            siteNetworks.networkId,
+                            siteResources.networkId
+                        )
+                    )
                    .where(
                        and(
                            eq(
                                clientSiteResourcesAssociationsCache.clientId,
                                client.clientId
                            ),
-                        eq(siteResources.siteId, site.siteId),
+                            eq(siteNetworks.siteId, site.siteId),
                            eq(
                                siteResources.destination,
                                existingSiteResource.destination
@@ -655,6 +693,7 @@ export async function handleMessagingForUpdatedSiteResource(
                        )
                    );

+
                const oldDestinationStillInUseByASite =
                    oldDestinationStillInUseSites.length > 0;

@@ -662,10 +701,11 @@ export async function handleMessagingForUpdatedSiteResource(
                olmJobs.push(
                    updatePeerData(
                        client.clientId,
-                    updatedSiteResource.siteId,
+                        site.siteId,
                        destinationChanged
                            ? {
-                              oldRemoteSubnets: !oldDestinationStillInUseByASite
+                                  oldRemoteSubnets:
+                                      !oldDestinationStillInUseByASite
                                          ? generateRemoteSubnets([
                                                existingSiteResource
                                            ])
@@ -691,4 +731,5 @@ export async function handleMessagingForUpdatedSiteResource(

            await Promise.all(olmJobs);
        }
+    }
 }
--- a/src/app/[orgId]/settings/resources/client/page.tsx
+++ b/src/app/[orgId]/settings/resources/client/page.tsx
@@ -60,17 +60,17 @@ export default async function ClientResourcesPage(
                id: siteResource.siteResourceId,
                name: siteResource.name,
                orgId: params.orgId,
-                siteName: siteResource.siteName,
-                siteAddress: siteResource.siteAddress || null,
+                siteNames: siteResource.siteNames,
+                siteAddresses: siteResource.siteAddresses || null,
                mode: siteResource.mode || ("port" as any),
                // protocol: siteResource.protocol,
                // proxyPort: siteResource.proxyPort,
-                siteId: siteResource.siteId,
+                siteIds: siteResource.siteIds,
                destination: siteResource.destination,
                // destinationPort: siteResource.destinationPort,
                alias: siteResource.alias || null,
                aliasAddress: siteResource.aliasAddress || null,
-                siteNiceId: siteResource.siteNiceId,
+                siteNiceIds: siteResource.siteNiceIds,
                niceId: siteResource.niceId,
                tcpPortRangeString: siteResource.tcpPortRangeString || null,
                udpPortRangeString: siteResource.udpPortRangeString || null,
--- a/src/app/[orgId]/settings/resources/proxy/create/page.tsx
+++ b/src/app/[orgId]/settings/resources/proxy/create/page.tsx
@@ -1109,9 +1109,6 @@ export default function Page() {
                                    <SettingsSectionBody>
                                        <DomainPicker
                                            orgId={orgId as string}
-                                            warnOnProvidedDomain={
-                                                remoteExitNodes.length >= 1
-                                            }
                                            onDomainChange={(res) => {
                                                if (!res) return;

--- a/src/components/ClientResourcesTable.tsx
+++ b/src/components/ClientResourcesTable.tsx
@@ -21,6 +21,7 @@ import {
    ArrowUp10Icon,
    ArrowUpDown,
    ArrowUpRight,
+    ChevronDown,
    ChevronsUpDownIcon,
    MoreHorizontal
 } from "lucide-react";
@@ -43,14 +44,14 @@ export type InternalResourceRow = {
    id: number;
    name: string;
    orgId: string;
-    siteName: string;
-    siteAddress: string | null;
+    siteNames: string[];
+    siteAddresses: (string | null)[];
+    siteIds: number[];
+    siteNiceIds: string[];
    // mode: "host" | "cidr" | "port";
    mode: "host" | "cidr";
    // protocol: string | null;
    // proxyPort: number | null;
-    siteId: number;
-    siteNiceId: string;
    destination: string;
    // destinationPort: number | null;
    alias: string | null;
@@ -136,6 +137,60 @@ export default function ClientResourcesTable({
        }
    };

+    function SiteCell({ resourceRow }: { resourceRow: InternalResourceRow }) {
+        const { siteNames, siteNiceIds, orgId } = resourceRow;
+
+        if (!siteNames || siteNames.length === 0) {
+            return <span>-</span>;
+        }
+
+        if (siteNames.length === 1) {
+            return (
+                <Link
+                    href={`/${orgId}/settings/sites/${siteNiceIds[0]}`}
+                >
+                    <Button variant="outline">
+                        {siteNames[0]}
+                        <ArrowUpRight className="ml-2 h-4 w-4" />
+                    </Button>
+                </Link>
+            );
+        }
+
+        return (
+            <DropdownMenu>
+                <DropdownMenuTrigger asChild>
+                    <Button
+                        variant="outline"
+                        size="sm"
+                        className="flex items-center gap-2"
+                    >
+                        <span>
+                            {siteNames.length} {t("sites")}
+                        </span>
+                        <ChevronDown className="h-3 w-3" />
+                    </Button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="start">
+                    {siteNames.map((siteName, idx) => (
+                        <DropdownMenuItem
+                            key={siteNiceIds[idx]}
+                            asChild
+                        >
+                            <Link
+                                href={`/${orgId}/settings/sites/${siteNiceIds[idx]}`}
+                                className="flex items-center gap-2 cursor-pointer"
+                            >
+                                {siteName}
+                                <ArrowUpRight className="h-3 w-3" />
+                            </Link>
+                        </DropdownMenuItem>
+                    ))}
+                </DropdownMenuContent>
+            </DropdownMenu>
+        );
+    }
+
    const internalColumns: ExtendedColumnDef<InternalResourceRow>[] = [
        {
            accessorKey: "name",
@@ -185,21 +240,11 @@ export default function ClientResourcesTable({
            }
        },
        {
-            accessorKey: "siteName",
+            accessorKey: "siteNames",
            friendlyName: t("site"),
            header: () => <span className="p-3">{t("site")}</span>,
            cell: ({ row }) => {
-                const resourceRow = row.original;
-                return (
-                    <Link
-                        href={`/${resourceRow.orgId}/settings/sites/${resourceRow.siteNiceId}`}
-                    >
-                        <Button variant="outline">
-                            {resourceRow.siteName}
-                            <ArrowUpRight className="ml-2 h-4 w-4" />
-                        </Button>
-                    </Link>
-                );
+                return <SiteCell resourceRow={row.original} />;
            }
        },
        {
@@ -399,7 +444,7 @@ export default function ClientResourcesTable({
                    onConfirm={async () =>
                        deleteInternalResource(
                            selectedInternalResource!.id,
-                            selectedInternalResource!.siteId
+                            selectedInternalResource!.siteIds[0]
                        )
                    }
                    string={selectedInternalResource.name}
@@ -433,7 +478,11 @@ export default function ClientResourcesTable({
                <EditInternalResourceDialog
                    open={isEditDialogOpen}
                    setOpen={setIsEditDialogOpen}
-                    resource={editingResource}
+                    resource={{
+                        ...editingResource,
+                        siteName: editingResource.siteNames[0] ?? "",
+                        siteId: editingResource.siteIds[0]
+                    }}
                    orgId={orgId}
                    sites={sites}
                    onSuccess={() => {
--- a/src/components/DomainPicker.tsx
+++ b/src/components/DomainPicker.tsx
@@ -79,7 +79,6 @@ interface DomainPickerProps {
    defaultFullDomain?: string | null;
    defaultSubdomain?: string | null;
    defaultDomainId?: string | null;
-    warnOnProvidedDomain?: boolean;
 }

 export default function DomainPicker({
@@ -89,8 +88,7 @@ export default function DomainPicker({
    hideFreeDomain = false,
    defaultSubdomain,
    defaultFullDomain,
-    defaultDomainId,
-    warnOnProvidedDomain = false
+    defaultDomainId
 }: DomainPickerProps) {
    const { env } = useEnvContext();
    const api = createApiClient({ env });
@@ -691,14 +689,6 @@ export default function DomainPicker({

            {showProvidedDomainSearch && (
                <div className="space-y-4">
-                    {warnOnProvidedDomain && (
-                        <Alert variant="warning">
-                            <AlertCircle className="h-4 w-4" />
-                            <AlertDescription>
-                                {t("domainPickerRemoteExitNodeWarning")}
-                            </AlertDescription>
-                        </Alert>
-                    )}
                    {isChecking && (
                        <div className="flex items-center justify-center p-8">
                            <div className="flex items-center space-x-2 text-sm text-muted-foreground">
--- a/src/components/PermissionsSelectBox.tsx
+++ b/src/components/PermissionsSelectBox.tsx
@@ -26,7 +26,6 @@ function getActionsCategories(root: boolean) {
            [t("actionGetOrg")]: "getOrg",
            [t("actionUpdateOrg")]: "updateOrg",
            [t("actionGetOrgUser")]: "getOrgUser",
-            [t("actionResetSiteBandwidth")]: "resetSiteBandwidth",
            [t("actionInviteUser")]: "inviteUser",
            [t("actionRemoveInvitation")]: "removeInvitation",
            [t("actionListInvitations")]: "listInvitations",
Author	SHA1	Message	Date
Owen	02033f611f	First pass at HA	2026-03-23 11:44:02 -07:00
Owen	1366901e24	Adjust build functions	2026-03-22 14:40:57 -07:00
Owen	c4f48f5748	WIP - more conversion	2026-03-22 14:29:47 -07:00
Owen	c48bc71443	Update crud endpoints and ui	2026-03-22 14:18:34 -07:00
Owen	d85496453f	Change SSH WIP	2026-03-21 10:40:12 -07:00
Owen	21b91374a3	Merge branch 'private-site-ha' of github.com:fosrl/pangolin into private-site-ha	2026-03-20 17:24:27 -07:00
Owen	a1ce7f54a0	Continue to rebase	2026-03-20 09:17:10 -07:00
Owen	87524fe8ae	Remove siteSiteResources	2026-03-19 21:53:52 -07:00
Owen	2093bb5357	Remove siteSiteResources	2026-03-19 21:44:59 -07:00
Owen	6f2e37948c	Its many to one now	2026-03-19 21:30:00 -07:00
Owen	b7421e47cc	Switch to using networks	2026-03-19 21:22:04 -07:00
Owen	7cbe3d42a1	Working on refactoring	2026-03-19 12:10:04 -07:00
Owen	d8b511b198	Adjust create and update to be many to one	2026-03-18 20:54:49 -07:00
Owen	102a235407	Adjust schema for many to one site resources	2026-03-18 20:54:38 -07:00