Merge pull request #2996 from fosrl/crowdin_dev

New Crowdin updates
New translations en-us.json (Spanish)
2026-05-06 16:38:48 +00:00 · 2026-05-04 11:48:58 -07:00 · 2026-05-04 11:48:00 -07:00 · 2026-05-04 11:47:58 -07:00 · 2026-05-04 11:47:56 -07:00 · 2026-05-04 11:47:55 -07:00
35 changed files with 1047 additions and 100 deletions
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Превишихте ограничението на текущия си план. Коригирайте проблема, като премахнете сайтове, потребители или други ресурси, за да оставате в рамките на плана си.",
    "trialBannerMessage": "Пробният Ви период изтича след {countdown}. Актуализирайте за запазване на достъпа.",
    "trialBannerExpired": "Пробният Ви период е изтекъл. Актуализирайте сега, за да възстановите достъпа.",
+    "billingTrialBannerTitle": "Пробният период е активен",
+    "billingTrialBannerDescription": "В момента сте в пробен период на бизнес ниво. След края на пробния период, вашият акаунт автоматично ще бъде върнат към функциите и ограниченията на основното ниво. Надградете по всяко време, за да запазите достъпа до текущите функции на плана.",
+    "billingTrialBannerUpgrade": "Надградете сега",
+    "billingTrialBadge": "Пробен период",
    "trialActive": "Активен пробен период",
    "trialExpired": "Пробният период е изтекъл",
    "trialHasEnded": "Пробният Ви период е приключил.",
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Jste za hranicemi vašeho aktuálního plánu. Opravte problém odstraněním webů, uživatelů nebo jiných zdrojů, abyste zůstali ve vašem tarifu.",
    "trialBannerMessage": "Vaše zkušební verze vyprší za {countdown}. Pro udržení přístupu upgraduje.",
    "trialBannerExpired": "Vaše zkušební verze vypršela. Upgradujte nyní pro obnovu přístupu.",
+    "billingTrialBannerTitle": "Aktivní zkušební verze",
+    "billingTrialBannerDescription": "Právě používáte zkušební verzi na úrovni business. Po skončení zkušební verze se váš účet automaticky vrátí k funkcím a limitům úrovně Basic. Upgradujte kdykoli pro zachování přístupu k funkcím vašeho aktuálního plánu.",
+    "billingTrialBannerUpgrade": "Upgradovat nyní",
+    "billingTrialBadge": "Zkušební verze",
    "trialActive": "Zkušební verze je aktivní",
    "trialExpired": "Zkušební verze vypršela",
    "trialHasEnded": "Vaše zkušební verze skončila.",
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Sie überschreiten Ihre Grenzen für Ihr aktuelles Paket. Korrigieren Sie das Problem, indem Sie Webseiten, Benutzer oder andere Ressourcen entfernen, um in Ihrem Paket zu bleiben.",
    "trialBannerMessage": "Ihre Testversion läuft in {countdown} ab. Upgraden, um den Zugriff zu behalten.",
    "trialBannerExpired": "Ihre Testversion ist abgelaufen. Jetzt upgraden, um den Zugriff wiederherzustellen.",
+    "billingTrialBannerTitle": "Kostenlose Testversion aktiv",
+    "billingTrialBannerDescription": "Sie nutzen derzeit eine kostenlose Testversion auf der Geschäftsstufe. Wenn die Testversion endet, wird Ihr Konto automatisch auf die Funktionen und Beschränkungen der Basisstufe zurückgesetzt. Upgraden Sie jederzeit, um weiterhin Zugriff auf die Funktionen Ihres aktuellen Plans zu behalten.",
+    "billingTrialBannerUpgrade": "Jetzt upgraden",
+    "billingTrialBadge": "Kostenlose Testversion",
    "trialActive": "Kostenlose Testversion aktiv",
    "trialExpired": "Testversion abgelaufen",
    "trialHasEnded": "Ihre Testversion ist beendet.",
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "You're beyond your limits for your current plan. Correct the problem by removing sites, users, or other resources to stay within your plan.",
    "trialBannerMessage": "Your trial expires in {countdown}. Upgrade to keep access.",
    "trialBannerExpired": "Your trial has expired. Upgrade now to restore access.",
+    "billingTrialBannerTitle": "Free Trial Active",
+    "billingTrialBannerDescription": "You're currently on a free trial on the business tier. When the trial ends, your account will automatically revert to the Basic tier features and limits. Upgrade anytime to keep access to your current plan's features.",
+    "billingTrialBannerUpgrade": "Upgrade Now",
+    "billingTrialBadge": "Free Trial",
    "trialActive": "Free Trial Active",
    "trialExpired": "Trial Expired",
    "trialHasEnded": "Your trial has ended.",
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Estás más allá de tus límites para tu plan actual. Corrija el problema eliminando sitios, usuarios u otros recursos para permanecer dentro de tu plan.",
    "trialBannerMessage": "Su prueba expira en {countdown}. Actualice para mantener el acceso.",
    "trialBannerExpired": "Su prueba ha expirado. Actualice ahora para restaurar el acceso.",
+    "billingTrialBannerTitle": "Prueba gratuita activada",
+    "billingTrialBannerDescription": "Actualmente estás en una prueba gratuita en el nivel empresarial. Cuando finalice la prueba, tu cuenta volverá automáticamente a las características y límites del nivel Básico. Mejora en cualquier momento para mantener el acceso a las características de tu plan actual.",
+    "billingTrialBannerUpgrade": "Actualizar ahora",
+    "billingTrialBadge": "Prueba Gratuita",
    "trialActive": "Prueba gratuita activa",
    "trialExpired": "Prueba expirada",
    "trialHasEnded": "Su prueba ha terminado.",
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Vous dépassez vos limites pour votre forfait actuel. Corrigez le problème en supprimant des sites, des utilisateurs ou d'autres ressources pour rester dans votre forfait.",
    "trialBannerMessage": "Votre essai expire dans {countdown}. Passez à l'abonnement pour garder l'accès.",
    "trialBannerExpired": "Votre essai a expiré. Passez à l'abonnement maintenant pour restaurer l'accès.",
+    "billingTrialBannerTitle": "Essai gratuit actif",
+    "billingTrialBannerDescription": "Vous êtes actuellement en essai gratuit sur le niveau business. À la fin de l'essai, votre compte basculera automatiquement aux fonctionnalités et limites du niveau Basique. Mettez à jour à tout moment pour conserver l'accès aux fonctionnalités de votre plan actuel.",
+    "billingTrialBannerUpgrade": "Passer à la version supérieure maintenant",
+    "billingTrialBadge": "Essai gratuit",
    "trialActive": "Essai gratuit actif",
    "trialExpired": "Essai expiré",
    "trialHasEnded": "Votre essai est terminé.",
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Hai superato i tuoi limiti per il tuo piano attuale. Correggi il problema rimuovendo siti, utenti o altre risorse per rimanere all'interno del tuo piano.",
    "trialBannerMessage": "Il tuo periodo di prova scade tra {countdown}. Aggiorna per mantenere l'accesso.",
    "trialBannerExpired": "Il tuo periodo di prova è scaduto. Aggiorna ora per ripristinare l'accesso.",
+    "billingTrialBannerTitle": "Prova Gratuita Attiva",
+    "billingTrialBannerDescription": "Attualmente sei in una prova gratuita sul livello business. Quando la prova terminerà, il tuo account tornerà automaticamente alle funzionalità e ai limiti del piano Basic. Effettua l'upgrade in qualsiasi momento per mantenere l'accesso alle funzionalità del tuo piano attuale.",
+    "billingTrialBannerUpgrade": "Effettua l'Upgrade Ora",
+    "billingTrialBadge": "Prova Gratuita",
    "trialActive": "Prova Gratuita Attiva",
    "trialExpired": "Prova scaduta",
    "trialHasEnded": "La tua prova è terminata.",
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "현재 계획의 한계를 초과했습니다. 사이트, 사용자 또는 기타 리소스를 제거하여 계획 내에 머물도록 해결하세요.",
    "trialBannerMessage": "시험 사용 기간이 {countdown} 안에 만료됩니다. 업그레이드하여 액세스를 유지하세요.",
    "trialBannerExpired": "시험 사용 기간이 만료되었습니다. 지금 업그레이드하여 액세스를 복구하세요.",
+    "billingTrialBannerTitle": "무료 평가판 활성화",
+    "billingTrialBannerDescription": "현재 비즈니스 티어의 무료 평가판을 사용 중입니다. 평가판이 종료되면 계정은 자동으로 기본 티어 기능 및 제한으로 돌아갑니다. 현재 계획의 기능을 유지하려면 언제든지 업그레이드 하세요.",
+    "billingTrialBannerUpgrade": "지금 업그레이드",
+    "billingTrialBadge": "무료 평가판",
    "trialActive": "무료 체험 활성화됨",
    "trialExpired": "체험 만료됨",
    "trialHasEnded": "시험 사용 기간이 종료되었습니다.",
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Du er utenfor grensen for gjeldende plan. Rett problemet ved å fjerne nettsteder, brukere eller andre ressurser for å bli innenfor planen din.",
    "trialBannerMessage": "Din prøveperiode utløper om {countdown}. Oppgrader for å beholde tilgangen.",
    "trialBannerExpired": "Prøveperioden din har utløpt. Oppgrader nå for å gjenopprette tilgangen.",
+    "billingTrialBannerTitle": "Prøveversjon Aktiv",
+    "billingTrialBannerDescription": "Du har for øyeblikket en gratis prøveversjon på forretningsnivået. Når prøven avsluttes, vil kontoen din automatisk gå tilbake til funksjoner og begrensninger på Basis-nivået. Oppgrader når som helst for å beholde tilgang til de nåværende planens funksjoner.",
+    "billingTrialBannerUpgrade": "Oppgrader nå",
+    "billingTrialBadge": "Prøveversjon",
    "trialActive": "Gratis prøveversjon aktiv",
    "trialExpired": "Prøveperioden er utløpt",
    "trialHasEnded": "Din prøveperiode har avsluttet.",
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "U overschrijdt uw huidige abonnement. Corrigeer het probleem door sites, gebruikers of andere bronnen te verwijderen om binnen uw plan te blijven.",
    "trialBannerMessage": "Uw proefversie verloopt over {countdown}. Upgrade om toegang te behouden.",
    "trialBannerExpired": "Uw proefperiode is verlopen. Upgrade nu om toegang te herstellen.",
+    "billingTrialBannerTitle": "Proefperiode Actief",
+    "billingTrialBannerDescription": "Je bent momenteel bezig met een gratis proefperiode op het zakelijke niveau. Wanneer de proefperiode eindigt, wordt je account automatisch teruggezet naar de functies en limieten van het Basic-niveau. Upgrade op elk moment om toegang te houden tot de functies van je huidige plan.",
+    "billingTrialBannerUpgrade": "Nu Upgraden",
+    "billingTrialBadge": "Gratis Proefversie",
    "trialActive": "Gratis proefversie actief",
    "trialExpired": "Proefversie verlopen",
    "trialHasEnded": "Uw proefperiode is geëindigd.",
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Nie masz ograniczeń dla aktualnego planu. Popraw problem poprzez usunięcie stron, użytkowników lub innych zasobów, aby pozostać w swoim planie.",
    "trialBannerMessage": "Twój okres próbny wygasa za {countdown}. Uaktualnij, aby zachować dostęp.",
    "trialBannerExpired": "Twój okres próbny wygasł. Uaktualnij teraz, aby przywrócić dostęp.",
+    "billingTrialBannerTitle": "Bezpłatna wersja próbna aktywna",
+    "billingTrialBannerDescription": "Obecnie korzystasz z bezpłatnej wersji próbnej na poziomie biznesowym. Po zakończeniu wersji próbnej, Twoje konto automatycznie powróci do funkcji i limitów poziomu Podstawowego. Możesz dokonać uaktualnienia w każdej chwili, aby zachować dostęp do funkcji obecnego planu.",
+    "billingTrialBannerUpgrade": "Uaktualnij teraz",
+    "billingTrialBadge": "Bezpłatna wersja próbna",
    "trialActive": "Okres próbny aktywny",
    "trialExpired": "Okres próbny wygasł",
    "trialHasEnded": "Twój okres próbny dobiegł końca.",
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Você está além dos seus limites para o seu plano atual. Corrija o problema removendo sites, usuários, ou outros recursos para ficar em seu plano.",
    "trialBannerMessage": "Sua avaliação termina em {countdown}. Faça o upgrade para manter o acesso.",
    "trialBannerExpired": "Sua avaliação expirou. Faça o upgrade agora para restaurar o acesso.",
+    "billingTrialBannerTitle": "Teste Gratuito Ativo",
+    "billingTrialBannerDescription": "Atualmente, você está em um teste gratuito no nível empresarial. Quando o teste terminar, sua conta reverterá automaticamente para os recursos e limites do nível Básico. Atualize a qualquer momento para manter o acesso aos recursos do seu plano atual.",
+    "billingTrialBannerUpgrade": "Atualize Agora",
+    "billingTrialBadge": "Teste Gratuito",
    "trialActive": "Avaliação Gratuita Ativa",
    "trialExpired": "Avaliação Expirada",
    "trialHasEnded": "Sua avaliação terminou.",
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Вы превысили лимиты для вашего текущего плана. Исправьте проблему, удалив сайты, пользователей или другие ресурсы, чтобы остаться в пределах вашего плана.",
    "trialBannerMessage": "Ваш пробный период истекает через {countdown}. Обновите, чтобы сохранить доступ.",
    "trialBannerExpired": "Ваш пробный период истек. Обновите сейчас, чтобы восстановить доступ.",
+    "billingTrialBannerTitle": "Бесплатная версия активна",
+    "billingTrialBannerDescription": "Вы в настоящее время находитесь на бесплатном пробном периоде бизнес-уровня. Когда пробный период закончится, ваш аккаунт автоматически вернётся к функциям и лимитам базового уровня. Обновите в любое время, чтобы сохранить доступ к функциям текущего плана.",
+    "billingTrialBannerUpgrade": "Обновить сейчас",
+    "billingTrialBadge": "Бесплатная версия",
    "trialActive": "Бесплатный пробный период активен",
    "trialExpired": "Пробный период истек",
    "trialHasEnded": "Ваш пробный период окончен.",
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "Geçerli planınız için limitlerinizi aştınız. Planınız dahilinde kalmak için siteleri, kullanıcıları veya diğer kaynakları kaldırarak sorunu düzeltin.",
    "trialBannerMessage": "Deneme süreniz {countdown} içinde sona eriyor. Erişimi sürdürmek için yükseltin.",
    "trialBannerExpired": "Deneme süreniz sona erdi. Erişimi geri yüklemek için şimdi yükseltin.",
+    "billingTrialBannerTitle": "Ücretsiz Deneme Aktif",
+    "billingTrialBannerDescription": "Şu anda iş seviyesi için ücretsiz deneme sürümündesiniz. Deneme süresi sona erdiğinde, hesabınız otomatik olarak Temel seviye özelliklerine ve limitlerine geri dönecektir. Mevcut planınızın özelliklerine erişimi sürdürmek için istediğiniz zaman yükseltin.",
+    "billingTrialBannerUpgrade": "Şimdi Yükselt",
+    "billingTrialBadge": "Ücretsiz Deneme",
    "trialActive": "Ücretsiz Deneme Aktif",
    "trialExpired": "Deneme Süresi Doldu",
    "trialHasEnded": "Deneme süreniz sona erdi.",
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -25,6 +25,10 @@
    "subscriptionViolationMessage": "您的当前计划超出了您的限制。通过移除站点、用户或其他资源以保持在您的计划范围内来纠正问题。",
    "trialBannerMessage": "您的试用将在 {countdown} 到期。升级以保持访问。",
    "trialBannerExpired": "您的试用已到期。立即升级以恢复访问。",
+    "billingTrialBannerTitle": "免费试用激活中",
+    "billingTrialBannerDescription": "您目前正在商用层进行免费试用。试用结束后，您的账户将自动回到基础层功能和限制。可随时升级以保持当前计划的功能访问。",
+    "billingTrialBannerUpgrade": "立即升级",
+    "billingTrialBadge": "免费试用",
    "trialActive": "免费试用中",
    "trialExpired": "试用到期",
    "trialHasEnded": "您的试用已结束。",
--- a/server/private/routers/billing/hooks/handleCustomerCreated.ts
+++ b/server/private/routers/billing/hooks/handleCustomerCreated.ts
@@ -16,6 +16,7 @@ import { customers, db, subscriptions } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";
 import { generateId } from "@server/auth/sessions/app";
+import { handleSubscriptionLifesycle } from "../subscriptionLifecycle";

 export async function handleCustomerCreated(
    customer: Stripe.Customer
@@ -62,6 +63,13 @@ export async function handleCustomerCreated(
                expiresAt: trialExpiresAt,
                trial: true
            });
+
+            // update to the business limits for the trial
+            await handleSubscriptionLifesycle(
+                customer.metadata.orgId,
+                "active",
+                "tier3"
+            );
        });

        logger.info(`Customer with ID ${customer.id} created successfully.`);
--- a/server/private/routers/billing/subscriptionLifecycle.ts
+++ b/server/private/routers/billing/subscriptionLifecycle.ts
@@ -44,7 +44,7 @@ function getLimitSetForSubscriptionType(
 export async function handleSubscriptionLifesycle(
    orgId: string,
    status: string,
-    subType: SubscriptionType | null
+    subType: SubscriptionType | null = null
 ) {
    switch (status) {
        case "active":
--- a/server/private/routers/certificates/createCertificate.ts
+++ b/server/private/routers/certificates/createCertificate.ts
@@ -90,14 +90,13 @@ export async function createCertificate(
            domainToWrite = `*.${domainToWrite}`;
        }
    } else if (domainRecord.type == "ns") {
-        // first if we have a * in the domain for this case we dont want to include it because it will mess with the cert generator so remove it
-        if (domain.startsWith("*.")) {
-            domain = domain.slice(2);
-        }
-
-        const parts = domain.split(".");
-        if (parts.length > 2) {
-            domainToWrite = parts.slice(1).join(".");
+        if (domain == domainRecord.baseDomain) {
+            domainToWrite = domainRecord.baseDomain;
+        } else {
+            const parts = domain.split(".");
+            if (parts.length > 2) {
+                domainToWrite = parts.slice(1).join(".");
+            }
        }
    }

--- a/server/private/routers/org/sendTrialNotification.ts
+++ b/server/private/routers/org/sendTrialNotification.ts
@@ -24,13 +24,18 @@ import { fromError } from "zod-validation-error";
 import { sendEmail } from "@server/emails";
 import NotifyTrialExpiring from "@server/emails/templates/NotifyTrialExpiring";
 import config from "@server/lib/config";
+import { handleSubscriptionLifesycle } from "../billing/subscriptionLifecycle";

 const sendTrialNotificationParamsSchema = z.object({
    orgId: z.string()
 });

 const sendTrialNotificationBodySchema = z.object({
-    notificationType: z.enum(["trial_ending_5d", "trial_ending_24h", "trial_ended"]),
+    notificationType: z.enum([
+        "trial_ending_5d",
+        "trial_ending_24h",
+        "trial_ended"
+    ]),
    orgName: z.string(),
    trialEndsAt: z.number(),
    billingLink: z.string().optional()
@@ -69,9 +74,7 @@ async function getOrgAdmins(orgId: string) {
            )
        );

-    const byUserId = new Map(
-        admins.map((a) => [a.userId, a])
-    );
+    const byUserId = new Map(admins.map((a) => [a.userId, a]));
    const orgAdmins = Array.from(byUserId.values()).filter(
        (admin) => admin.email && admin.email.length > 0
    );
@@ -108,8 +111,12 @@ export async function sendTrialNotification(
        }

        const { orgId } = parsedParams.data;
-        const { notificationType, orgName, trialEndsAt, billingLink: bodyBillingLink } =
-            parsedBody.data;
+        const {
+            notificationType,
+            orgName,
+            trialEndsAt,
+            billingLink: bodyBillingLink
+        } = parsedBody.data;

        // Verify organization exists
        const org = await db
@@ -146,13 +153,17 @@ export async function sendTrialNotification(
            bodyBillingLink ??
            `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/billing`;

-        const trialEndsAtFormatted = new Date(trialEndsAt * 1000).toLocaleDateString(
-            "en-US",
-            { year: "numeric", month: "long", day: "numeric" }
-        );
+        const trialEndsAtFormatted = new Date(
+            trialEndsAt * 1000
+        ).toLocaleDateString("en-US", {
+            year: "numeric",
+            month: "long",
+            day: "numeric"
+        });

        let daysRemaining: number | null;
        let subject: string;
+        let resetLimits = false;

        if (notificationType === "trial_ending_5d") {
            daysRemaining = 5;
@@ -163,6 +174,7 @@ export async function sendTrialNotification(
        } else {
            daysRemaining = null;
            subject = "Your trial has ended";
+            resetLimits = true;
        }

        let emailsSent = 0;
@@ -201,6 +213,14 @@ export async function sendTrialNotification(
            }
        }

+        if (resetLimits) {
+            // this will only fire if they have not upgraded yet because when upgrading we delete the trial
+            await handleSubscriptionLifesycle(orgId, "cancled");
+            logger.debug(
+                `Trial ended for org ${orgId}, limits reset to free tier`
+            );
+        }
+
        return response<SendTrialNotificationResponse>(res, {
            data: {
                success: true,
@@ -221,4 +241,4 @@ export async function sendTrialNotification(
            )
        );
    }
-}
+}
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -1003,7 +1003,11 @@ async function checkRules(
            isIpInCidr(clientIp, rule.value)
        ) {
            return rule.action as any;
-        } else if (clientIp && rule.match == "IP" && clientIp == rule.value) {
+        } else if (
+            clientIp &&
+            rule.match == "IP" &&
+            clientIp == rule.value
+        ) {
            return rule.action as any;
        } else if (
            path &&
@@ -1013,16 +1017,35 @@ async function checkRules(
            return rule.action as any;
        } else if (
            clientIp &&
-            rule.match == "COUNTRY" &&
-            (await isIpInGeoIP(ipCC, rule.value))
+            rule.match == "COUNTRY"
        ) {
-            return rule.action as any;
+            // COUNTRY=ALL should not affect local/private/CGNAT addresses.
+            if (
+                rule.value.toUpperCase() === "ALL" &&
+                isLocalOrCarrierGradeNatIp(clientIp)
+            ) {
+                continue;
+            }
+
+            if (await isIpInGeoIP(ipCC, rule.value)) {
+                return rule.action as any;
+            }
        } else if (
            clientIp &&
-            rule.match == "ASN" &&
-            (await isIpInAsn(ipAsn, rule.value))
+            rule.match == "ASN"
        ) {
-            return rule.action as any;
+            // ASN=ALL/AS0 should not affect local/private/CGNAT addresses.
+            if (
+                (rule.value.toUpperCase() === "ALL" ||
+                    rule.value.toUpperCase() === "AS0") &&
+                isLocalOrCarrierGradeNatIp(clientIp)
+            ) {
+                continue;
+            }
+
+            if (await isIpInAsn(ipAsn, rule.value)) {
+                return rule.action as any;
+            }
        } else if (
            clientIp &&
            rule.match == "REGION" &&
@@ -1184,6 +1207,26 @@ async function isIpInGeoIP(
    return ipCountryCode?.toUpperCase() === checkCountryCode.toUpperCase();
 }

+function isLocalOrCarrierGradeNatIp(ip: string): boolean {
+    const localAndCgnatCidrs = [
+        "10.0.0.0/8",
+        "172.16.0.0/12",
+        "192.168.0.0/16",
+        "100.64.0.0/10",
+        "127.0.0.0/8",
+        "169.254.0.0/16",
+        "::1/128",
+        "fc00::/7",
+        "fe80::/10"
+    ];
+
+    try {
+        return localAndCgnatCidrs.some((cidr) => isIpInCidr(ip, cidr));
+    } catch {
+        return false;
+    }
+}
+
 async function isIpInAsn(
    ipAsn: number | undefined,
    checkAsn: string
--- a/server/routers/idp/validateOidcCallback.ts
+++ b/server/routers/idp/validateOidcCallback.ts
@@ -38,10 +38,7 @@ import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsFor
 import { isSubscribed } from "#dynamic/lib/isSubscribed";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import {
-    assignUserToOrg,
-    removeUserFromOrg
-} from "@server/lib/userOrg";
+import { assignUserToOrg, removeUserFromOrg } from "@server/lib/userOrg";
 import { unwrapRoleMapping } from "@app/lib/idpRoleMapping";

 const ensureTrailingSlash = (url: string): string => {
@@ -336,23 +333,23 @@ export async function validateOidcCallback(
                    .innerJoin(orgs, eq(orgs.orgId, idpOrg.orgId));
                allOrgs = idpOrgs.map((o) => o.orgs);

-                for (const org of allOrgs) {
-                    const subscribed = await isSubscribed(
-                        org.orgId,
-                        tierMatrix.autoProvisioning
-                    );
-                    if (!subscribed) {
-                        // filter out the org
-                        allOrgs = allOrgs.filter((o) => o.orgId !== org.orgId);
+                // for (const org of allOrgs) {
+                //     const subscribed = await isSubscribed(
+                //         org.orgId,
+                //         tierMatrix.autoProvisioning
+                //     );
+                //     if (!subscribed) {
+                //         // filter out the org
+                //         allOrgs = allOrgs.filter((o) => o.orgId !== org.orgId);

-                        // return next(
-                        //     createHttpError(
-                        //         HttpCode.FORBIDDEN,
-                        //         "This organization's current plan does not support this feature."
-                        //     )
-                        // );
-                    }
-                }
+                //         // return next(
+                //         //     createHttpError(
+                //         //         HttpCode.FORBIDDEN,
+                //         //         "This organization's current plan does not support this feature."
+                //         //     )
+                //         // );
+                //     }
+                // }
            } else {
                allOrgs = await db.select().from(orgs);
            }
@@ -396,16 +393,14 @@ export async function validateOidcCallback(
                    idpOrgRes?.roleMapping || defaultRoleMapping;
                if (roleMapping) {
                    logger.debug("Role Mapping", { roleMapping });
-                    const roleMappingJmes = unwrapRoleMapping(
-                        roleMapping
-                    ).evaluationExpression;
+                    const roleMappingJmes =
+                        unwrapRoleMapping(roleMapping).evaluationExpression;
                    const roleMappingResult = jmespath.search(
                        claims,
                        roleMappingJmes
                    );
-                    const roleNames = normalizeRoleMappingResult(
-                        roleMappingResult
-                    );
+                    const roleNames =
+                        normalizeRoleMappingResult(roleMappingResult);

                    const supportsMultiRole = await isLicensedOrSubscribed(
                        org.orgId,
@@ -515,7 +510,7 @@ export async function validateOidcCallback(
                }
            }

-                const orgUserCounts: { orgId: string; userCount: number }[] = [];
+            const orgUserCounts: { orgId: string; userCount: number }[] = [];

            // sync the user with the orgs and roles
            await db.transaction(async (trx) => {
@@ -628,7 +623,7 @@ export async function validateOidcCallback(
                                {
                                    orgId: org.orgId,
                                    userId: userId!,
-                                    autoProvisioned: true,
+                                    autoProvisioned: true
                                },
                                org.roleIds,
                                trx
@@ -758,9 +753,7 @@ function hydrateOrgMapping(
    return orgMapping.split("{{orgId}}").join(orgId);
 }

-function normalizeRoleMappingResult(
-    result: unknown
-): string[] {
+function normalizeRoleMappingResult(result: unknown): string[] {
    if (typeof result === "string") {
        const role = result.trim();
        return role ? [role] : [];
@@ -770,7 +763,9 @@ function normalizeRoleMappingResult(
        return [
            ...new Set(
                result
-                    .filter((value): value is string => typeof value === "string")
+                    .filter(
+                        (value): value is string => typeof value === "string"
+                    )
                    .map((value) => value.trim())
                    .filter(Boolean)
            )
--- a/server/routers/target/listTargets.ts
+++ b/server/routers/target/listTargets.ts
@@ -56,6 +56,8 @@ function queryTargets(resourceId: number) {
            hcStatus: targetHealthCheck.hcStatus,
            hcHealth: targetHealthCheck.hcHealth,
            hcTlsServerName: targetHealthCheck.hcTlsServerName,
+            hcHealthyThreshold: targetHealthCheck.hcHealthyThreshold,
+            hcUnhealthyThreshold: targetHealthCheck.hcUnhealthyThreshold,
            path: targets.path,
            pathMatchType: targets.pathMatchType,
            rewritePath: targets.rewritePath,
--- a/server/setup/migrationsPg.ts
+++ b/server/setup/migrationsPg.ts
@@ -23,6 +23,7 @@ import m14 from "./scriptsPg/1.15.4";
 import m15 from "./scriptsPg/1.16.0";
 import m16 from "./scriptsPg/1.17.0";
 import m17 from "./scriptsPg/1.18.0";
+import m18 from "./scriptsPg/1.18.3";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -45,7 +46,8 @@ const migrations = [
    { version: "1.15.4", run: m14 },
    { version: "1.16.0", run: m15 },
    { version: "1.17.0", run: m16 },
-    { version: "1.18.0", run: m17 }
+    { version: "1.18.0", run: m17 },
+    { version: "1.18.3", run: m18 }
    // Add new migrations here as they are created
 ] as {
    version: string;
--- a/server/setup/migrationsSqlite.ts
+++ b/server/setup/migrationsSqlite.ts
@@ -41,6 +41,7 @@ import m35 from "./scriptsSqlite/1.15.4";
 import m36 from "./scriptsSqlite/1.16.0";
 import m37 from "./scriptsSqlite/1.17.0";
 import m38 from "./scriptsSqlite/1.18.0";
+import m39 from "./scriptsSqlite/1.18.3";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -79,7 +80,8 @@ const migrations = [
    { version: "1.15.4", run: m35 },
    { version: "1.16.0", run: m36 },
    { version: "1.17.0", run: m37 },
-    { version: "1.18.0", run: m38 }
+    { version: "1.18.0", run: m38 },
+    { version: "1.18.3", run: m39 }
    // Add new migrations here as they are created
 ] as const;

--- a/server/setup/scriptsPg/1.18.3.ts
+++ b/server/setup/scriptsPg/1.18.3.ts
@@ -0,0 +1,173 @@
+import { db } from "@server/db/pg/driver";
+import { sql } from "drizzle-orm";
+
+const version = "1.18.3";
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    // Query existing targetHealthCheck data with joined siteId and orgId before
+    // the transaction adds the new columns (which start NULL for existing rows).
+    // We will delete all rows and reinsert them with targetHealthCheckId = targetId
+    // so the two IDs form a stable 1:1 mapping.
+    const healthChecksQuery = await db.execute(
+        sql`SELECT
+                thc."targetHealthCheckId",
+                thc."targetId",
+                t."siteId",
+                s."orgId",
+                r."name" AS "resourceName",
+                t."ip",
+                t."port"
+            FROM "targetHealthCheck" thc
+            JOIN "targets" t ON thc."targetId" = t."targetId"
+            JOIN "sites" s ON t."siteId" = s."siteId"
+            JOIN "resources" r ON t."resourceId" = r."resourceId"
+            WHERE thc."name" IS NULL OR thc."name" = ''`
+    );
+
+    const existingHealthChecks = healthChecksQuery.rows as {
+        targetHealthCheckId: number;
+        targetId: number;
+        siteId: number;
+        orgId: string;
+        resourceName: string;
+        ip: string;
+        port: number;
+    }[];
+
+    console.log(
+        `Found ${existingHealthChecks.length} existing targetHealthCheck row(s) to migrate`
+    );
+
+    try {
+        await db.execute(sql`BEGIN`);
+
+        await db.execute(sql`
+            CREATE TABLE "trialNotifications" (
+               	"notificationId" serial PRIMARY KEY NOT NULL,
+               	"subscriptionId" varchar(255) NOT NULL,
+               	"notificationType" varchar(50) NOT NULL,
+               	"sentAt" bigint NOT NULL
+            );
+        `);
+
+        await db.execute(sql`
+            ALTER TABLE "trialNotifications" ADD CONSTRAINT "trialNotifications_subscriptionId_subscriptions_subscriptionId_fk" FOREIGN KEY ("subscriptionId") REFERENCES "public"."subscriptions"("subscriptionId") ON DELETE cascade ON UPDATE no action;
+        `);
+
+        await db.execute(sql`COMMIT`);
+        console.log("Migrated database");
+    } catch (e) {
+        await db.execute(sql`ROLLBACK`);
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    }
+
+    if (existingHealthChecks.length > 0) {
+        // fix the name column
+        try {
+            for (const hc of existingHealthChecks) {
+                await db.execute(sql`
+                    UPDATE "targetHealthCheck"
+                    SET "name" = ${`Resource ${hc.resourceName} - ${hc.ip}:${hc.port}`}
+                    WHERE "targetHealthCheckId" = ${hc.targetHealthCheckId}
+                `);
+            }
+
+            console.log(
+                `Migrated ${existingHealthChecks.length} targetHealthCheck row(s) with corrected IDs`
+            );
+        } catch (e) {
+            console.error("Error while migrating targetHealthCheck rows:", e);
+            throw e;
+        }
+    }
+
+    // Recompute resource health by aggregating across the resource's targets'
+    // target health checks, then update the resources.health column to match.
+    try {
+        const resourceTargetHealthQuery = await db.execute(
+            sql`SELECT
+                    r."resourceId" AS "resourceId",
+                    r."orgId" AS "orgId",
+                    r."health" AS "currentHealth",
+                    thc."hcHealth" AS "hcHealth"
+                FROM "resources" r
+                LEFT JOIN "targets" t ON t."resourceId" = r."resourceId"
+                LEFT JOIN "targetHealthCheck" thc ON thc."targetId" = t."targetId"`
+        );
+        const resourceTargetHealthRows = resourceTargetHealthQuery.rows as {
+            resourceId: number;
+            orgId: string;
+            currentHealth: string | null;
+            hcHealth: string | null;
+        }[];
+
+        const resourceHealthMap = new Map<
+            number,
+            {
+                hasHealthy: boolean;
+                hasUnhealthy: boolean;
+                hasUnknown: boolean;
+                orgId: string;
+                currentHealth: string | null;
+            }
+        >();
+        for (const row of resourceTargetHealthRows) {
+            const entry = resourceHealthMap.get(row.resourceId) ?? {
+                hasHealthy: false,
+                hasUnhealthy: false,
+                hasUnknown: false,
+                orgId: row.orgId,
+                currentHealth: row.currentHealth
+            };
+            const status = row.hcHealth ?? "unknown";
+            if (status === "healthy") entry.hasHealthy = true;
+            else if (status === "unhealthy") entry.hasUnhealthy = true;
+            else entry.hasUnknown = true;
+            resourceHealthMap.set(row.resourceId, entry);
+        }
+
+        const now = Math.floor(Date.now() / 1000);
+        let updatedResourceCount = 0;
+        for (const [resourceId, entry] of resourceHealthMap.entries()) {
+            let aggregated: "healthy" | "unhealthy" | "degraded" | "unknown";
+            if (entry.hasHealthy && entry.hasUnhealthy) {
+                aggregated = "degraded";
+            } else if (entry.hasHealthy) {
+                aggregated = "healthy";
+            } else if (entry.hasUnhealthy) {
+                aggregated = "unhealthy";
+            } else {
+                aggregated = "unknown";
+            }
+
+            if (entry.currentHealth !== aggregated) {
+                await db.execute(sql`
+                    UPDATE "resources"
+                    SET "health" = ${aggregated}
+                    WHERE "resourceId" = ${resourceId}
+                `);
+                await db.execute(sql`
+                    INSERT INTO "statusHistory" ("entityType", "entityId", "orgId", "status", "timestamp")
+                    VALUES ('resource', ${resourceId}, ${entry.orgId}, ${aggregated}, ${now})
+                `);
+                updatedResourceCount++;
+            }
+        }
+
+        console.log(
+            `Recomputed health for ${updatedResourceCount} resource(s) based on target health checks`
+        );
+    } catch (e) {
+        console.error(
+            "Error while recomputing resource health from target health checks:",
+            e
+        );
+        throw e;
+    }
+
+    console.log(`${version} migration complete`);
+}
--- a/server/setup/scriptsSqlite/1.18.3.ts
+++ b/server/setup/scriptsSqlite/1.18.3.ts
@@ -0,0 +1,172 @@
+import { APP_PATH } from "@server/lib/consts";
+import Database from "better-sqlite3";
+import path from "path";
+
+const version = "1.18.3";
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    const location = path.join(APP_PATH, "db", "db.sqlite");
+    const db = new Database(location);
+
+    try {
+        db.pragma("foreign_keys = OFF");
+
+        db.transaction(() => {
+            db.prepare(
+                `
+                    CREATE TABLE 'trialNotifications' (
+                       	'notificationId' integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+                       	'subscriptionId' text NOT NULL,
+                       	'notificationType' text NOT NULL,
+                       	'sentAt' integer NOT NULL,
+                       	FOREIGN KEY ('subscriptionId') REFERENCES 'subscriptions'('subscriptionId') ON UPDATE no action ON DELETE cascade
+                    );
+            `
+            ).run();
+        })();
+
+        db.pragma("foreign_keys = ON");
+
+        console.log("Migrated database");
+
+        // Fix names for health checks that don't have one
+        const healthChecksWithoutName = db
+            .prepare(
+                `SELECT
+                    thc."targetHealthCheckId",
+                    r."name" AS "resourceName",
+                    t."ip",
+                    t."port"
+                FROM 'targetHealthCheck' thc
+                JOIN 'targets' t ON thc."targetId" = t."targetId"
+                JOIN 'resources' r ON t."resourceId" = r."resourceId"
+                WHERE thc."name" IS NULL OR thc."name" = ''`
+            )
+            .all() as {
+            targetHealthCheckId: number;
+            resourceName: string;
+            ip: string;
+            port: number;
+        }[];
+
+        console.log(
+            `Found ${healthChecksWithoutName.length} targetHealthCheck row(s) with missing names`
+        );
+
+        if (healthChecksWithoutName.length > 0) {
+            const updateName = db.prepare(
+                `UPDATE 'targetHealthCheck' SET "name" = ? WHERE "targetHealthCheckId" = ?`
+            );
+            const updateAllNames = db.transaction(() => {
+                for (const hc of healthChecksWithoutName) {
+                    updateName.run(
+                        `Resource ${hc.resourceName} - ${hc.ip}:${hc.port}`,
+                        hc.targetHealthCheckId
+                    );
+                }
+            });
+            updateAllNames();
+            console.log(
+                `Updated names for ${healthChecksWithoutName.length} targetHealthCheck row(s)`
+            );
+        }
+
+        // Recompute resource health by aggregating across the resource's
+        // targets' target health checks, then update resources.health and
+        // insert a statusHistory entry for any resource whose health changed.
+        const resourceTargetHealthRows = db
+            .prepare(
+                `SELECT
+                    r."resourceId" AS "resourceId",
+                    r."orgId" AS "orgId",
+                    r."health" AS "currentHealth",
+                    thc."hcHealth" AS "hcHealth"
+                 FROM 'resources' r
+                 LEFT JOIN 'targets' t ON t."resourceId" = r."resourceId"
+                 LEFT JOIN 'targetHealthCheck' thc ON thc."targetId" = t."targetId"`
+            )
+            .all() as {
+            resourceId: number;
+            orgId: string;
+            currentHealth: string | null;
+            hcHealth: string | null;
+        }[];
+
+        const resourceHealthMap = new Map<
+            number,
+            {
+                hasHealthy: boolean;
+                hasUnhealthy: boolean;
+                hasUnknown: boolean;
+                orgId: string;
+                currentHealth: string | null;
+            }
+        >();
+        for (const row of resourceTargetHealthRows) {
+            const entry = resourceHealthMap.get(row.resourceId) ?? {
+                hasHealthy: false,
+                hasUnhealthy: false,
+                hasUnknown: false,
+                orgId: row.orgId,
+                currentHealth: row.currentHealth
+            };
+            const status = row.hcHealth ?? "unknown";
+            if (status === "healthy") entry.hasHealthy = true;
+            else if (status === "unhealthy") entry.hasUnhealthy = true;
+            else entry.hasUnknown = true;
+            resourceHealthMap.set(row.resourceId, entry);
+        }
+
+        const updateResourceHealth = db.prepare(
+            `UPDATE 'resources' SET "health" = ? WHERE "resourceId" = ?`
+        );
+        const insertResourceHistory = db.prepare(
+            `INSERT INTO 'statusHistory' ("entityType", "entityId", "orgId", "status", "timestamp") VALUES (?, ?, ?, ?, ?)`
+        );
+
+        const now = Math.floor(Date.now() / 1000);
+        let updatedResourceCount = 0;
+
+        const recomputeAll = db.transaction(() => {
+            for (const [resourceId, entry] of resourceHealthMap.entries()) {
+                let aggregated:
+                    | "healthy"
+                    | "unhealthy"
+                    | "degraded"
+                    | "unknown";
+                if (entry.hasHealthy && entry.hasUnhealthy) {
+                    aggregated = "degraded";
+                } else if (entry.hasHealthy) {
+                    aggregated = "healthy";
+                } else if (entry.hasUnhealthy) {
+                    aggregated = "unhealthy";
+                } else {
+                    aggregated = "unknown";
+                }
+
+                if (entry.currentHealth !== aggregated) {
+                    updateResourceHealth.run(aggregated, resourceId);
+                    insertResourceHistory.run(
+                        "resource",
+                        resourceId,
+                        entry.orgId,
+                        aggregated,
+                        now
+                    );
+                    updatedResourceCount++;
+                }
+            }
+        });
+        recomputeAll();
+        console.log(
+            `Recomputed health for ${updatedResourceCount} resource(s) based on target health checks`
+        );
+    } catch (e) {
+        console.log("Failed to migrate db:", e);
+        throw e;
+    }
+
+    console.log(`${version} migration complete`);
+}
--- a/src/app/[orgId]/settings/(private)/billing/page.tsx
+++ b/src/app/[orgId]/settings/(private)/billing/page.tsx
@@ -35,6 +35,7 @@ import {
 } from "@app/components/Credenza";
 import { cn } from "@app/lib/cn";
 import { CreditCard, ExternalLink, Check, AlertTriangle } from "lucide-react";
+import { Badge } from "@app/components/ui/badge";
 import { Alert, AlertTitle, AlertDescription } from "@app/components/ui/alert";
 import {
    Tooltip,
@@ -55,6 +56,7 @@ import {
    tier3LimitSet
 } from "@server/lib/billing/limitSet";
 import { FeatureId } from "@server/lib/billing/features";
+import TrialBillingBanner from "@app/components/TrialBillingBanner";

 // Plan tier definitions matching the mockup
 type PlanId = "basic" | "home" | "team" | "business" | "enterprise";
@@ -805,6 +807,20 @@ export default function BillingPage() {

    return (
        <SettingsContainer>
+            {/* Trial Banner */}
+            {isTrial && (
+                <TrialBillingBanner
+                    onUpgrade={() => {
+                        const currentPlan = planOptions.find(
+                            (p) => p.id === currentPlanId
+                        );
+                        if (currentPlan?.tierType) {
+                            handleStartSubscription(currentPlan.tierType);
+                        }
+                    }}
+                />
+            )}
+
            {/* Subscription Status Alert */}
            {isProblematicState && statusMessage && (
                <Alert variant="destructive" className="mb-6">
@@ -859,8 +875,19 @@ export default function BillingPage() {
                                    )}
                                >
                                    <div className="flex-1">
-                                        <div className="text-2xl">
-                                            {plan.name}
+                                        <div className="flex items-center gap-2 flex-wrap">
+                                            <span className="text-2xl">
+                                                {plan.name}
+                                            </span>
+                                            {isCurrentPlan && isTrial && (
+                                                <Badge
+                                                    variant="outlinePrimary"
+                                                    className="text-xs"
+                                                >
+                                                    {t("billingTrialBadge") ||
+                                                        "Free Trial"}
+                                                </Badge>
+                                            )}
                                        </div>
                                        <div className="mt-1">
                                            <span className="text-xl">
--- a/src/app/[orgId]/settings/resources/proxy/[niceId]/proxy/page.tsx
+++ b/src/app/[orgId]/settings/resources/proxy/[niceId]/proxy/page.tsx
@@ -652,6 +652,8 @@ function ProxyResourceTargetsForm({
            hcMode: null,
            hcUnhealthyInterval: null,
            hcTlsServerName: null,
+            hcHealthyThreshold: null,
+            hcUnhealthyThreshold: null,
            siteType: sites.length > 0 ? sites[0].type : null,
            new: true,
            updated: false
@@ -761,7 +763,9 @@ function ProxyResourceTargetsForm({
                    hcStatus: target.hcStatus || null,
                    hcUnhealthyInterval: target.hcUnhealthyInterval || null,
                    hcMode: target.hcMode || null,
-                    hcTlsServerName: target.hcTlsServerName
+                    hcTlsServerName: target.hcTlsServerName,
+                    hcHealthyThreshold: target.hcHealthyThreshold || null,
+                    hcUnhealthyThreshold: target.hcUnhealthyThreshold || null
                };

                // Only include path-related fields for HTTP resources
@@ -1018,7 +1022,13 @@ function ProxyResourceTargetsForm({
                            30,
                        hcTlsServerName:
                            selectedTargetForHealthCheck.hcTlsServerName ||
-                            undefined
+                            undefined,
+                        hcHealthyThreshold:
+                            selectedTargetForHealthCheck.hcHealthyThreshold ||
+                            1,
+                        hcUnhealthyThreshold:
+                            selectedTargetForHealthCheck.hcUnhealthyThreshold ||
+                            1
                    }}
                    onChanges={async (config) => {
                        if (selectedTargetForHealthCheck) {
--- a/src/app/[orgId]/settings/resources/proxy/create/page.tsx
+++ b/src/app/[orgId]/settings/resources/proxy/create/page.tsx
@@ -303,6 +303,8 @@ export default function Page() {
            hcMode: null,
            hcUnhealthyInterval: null,
            hcTlsServerName: null,
+            hcHealthyThreshold: null,
+            hcUnhealthyThreshold: null,
            siteType: sites.length > 0 ? sites[0].type : null,
            new: true,
            updated: false
@@ -552,7 +554,11 @@ export default function Page() {
                                hcUnhealthyInterval:
                                    target.hcUnhealthyInterval || null,
                                hcMode: target.hcMode || null,
-                                hcTlsServerName: target.hcTlsServerName
+                                hcTlsServerName: target.hcTlsServerName,
+                                hcHealthyThreshold:
+                                    target.hcHealthyThreshold || null,
+                                hcUnhealthyThreshold:
+                                    target.hcUnhealthyThreshold || null
                            };

                            // Only include path-related fields for HTTP resources
@@ -1520,7 +1526,13 @@ export default function Page() {
                                            30,
                                        hcTlsServerName:
                                            selectedTargetForHealthCheck.hcTlsServerName ||
-                                            undefined
+                                            undefined,
+                                        hcHealthyThreshold:
+                                            selectedTargetForHealthCheck.hcHealthyThreshold ||
+                                            1,
+                                        hcUnhealthyThreshold:
+                                            selectedTargetForHealthCheck.hcUnhealthyThreshold ||
+                                            1
                                    }}
                                    onChanges={async (config) => {
                                        if (selectedTargetForHealthCheck) {
--- a/src/components/DismissableBanner.tsx
+++ b/src/components/DismissableBanner.tsx
@@ -13,6 +13,7 @@ type DismissableBannerProps = {
    titleIcon: ReactNode;
    description: string;
    children?: ReactNode;
+    dismissable?: boolean;
 };

 export const DismissableBanner = ({
@@ -21,7 +22,8 @@ export const DismissableBanner = ({
    title,
    titleIcon,
    description,
-    children
+    children,
+    dismissable = true
 }: DismissableBannerProps) => {
    const [isDismissed, setIsDismissed] = useState(true);
    const t = useTranslations();
@@ -66,19 +68,21 @@ export const DismissableBanner = ({
        );
    };

-    if (isDismissed) {
+    if (dismissable && isDismissed) {
        return null;
    }

    return (
        <Card className="mb-6 relative border-primary/30 bg-linear-to-br from-primary/10 via-background to-background overflow-hidden">
-            <button
-                onClick={handleDismiss}
-                className="absolute top-3 right-3 z-10 p-1.5 rounded-md hover:bg-background/80 transition-colors cursor-pointer"
-                aria-label={t("dismiss")}
-            >
-                <X className="w-4 h-4 text-muted-foreground" />
-            </button>
+            {dismissable && (
+                <button
+                    onClick={handleDismiss}
+                    className="absolute top-3 right-3 z-10 p-1.5 rounded-md hover:bg-background/80 transition-colors cursor-pointer"
+                    aria-label={t("dismiss")}
+                >
+                    <X className="w-4 h-4 text-muted-foreground" />
+                </button>
+            )}
            <CardContent className="p-6">
                <div className="flex flex-col lg:flex-row lg:items-center gap-6">
                    <div className="flex-1 space-y-2 min-w-0">
--- a/src/components/OrgIdpTable.tsx
+++ b/src/components/OrgIdpTable.tsx
@@ -25,7 +25,6 @@ import {
 import {
    ArrowRight,
    ArrowUpDown,
-    KeyRound,
    MoreHorizontal
 } from "lucide-react";
 import { useMemo, useState } from "react";
@@ -50,6 +49,7 @@ import { useQuery } from "@tanstack/react-query";
 import { useDebounce } from "use-debounce";
 import type { ListUserAdminOrgIdpsResponse } from "@server/routers/orgIdp/types";
 import { cn } from "@app/lib/cn";
+import { Badge } from "@app/components/ui/badge";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { isIdpGlobalModeBannerVisible } from "@app/components/IdpGlobalModeBanner";
@@ -63,6 +63,61 @@ export type IdpRow = {

 type AdminIdpRow = ListUserAdminOrgIdpsResponse["idps"][number];

+type ImportSourceOrg = { orgId: string; orgName: string };
+
+type GroupedImportableIdp = {
+    idpId: number;
+    name: string;
+    type: string;
+    variant: string;
+    tags: string | null;
+    sources: ImportSourceOrg[];
+};
+
+function adminRowForImport(
+    group: GroupedImportableIdp,
+    source: ImportSourceOrg
+): AdminIdpRow {
+    return {
+        idpId: group.idpId,
+        orgId: source.orgId,
+        orgName: source.orgName,
+        name: group.name,
+        type: group.type,
+        variant: group.variant,
+        tags: group.tags
+    };
+}
+
+function groupImportableIdps(rows: AdminIdpRow[]): GroupedImportableIdp[] {
+    const map = new Map<number, GroupedImportableIdp>();
+    for (const row of rows) {
+        let g = map.get(row.idpId);
+        if (!g) {
+            g = {
+                idpId: row.idpId,
+                name: row.name,
+                type: row.type,
+                variant: row.variant,
+                tags: row.tags,
+                sources: []
+            };
+            map.set(row.idpId, g);
+        }
+        if (!g.sources.some((s) => s.orgId === row.orgId)) {
+            g.sources.push({ orgId: row.orgId, orgName: row.orgName });
+        }
+    }
+    return Array.from(map.values())
+        .map((item) => ({
+            ...item,
+            sources: [...item.sources].sort((a, b) =>
+                a.orgName.localeCompare(b.orgName)
+            )
+        }))
+        .sort((a, b) => b.name.localeCompare(a.name));
+}
+
 function IdpImportRowIcon({
    type,
    variant
@@ -114,16 +169,22 @@ export default function IdpTable({ idps, orgId }: Props) {
        );
    }, [adminIdpsRaw, orgId, idps]);

-    const shownImportIdps = useMemo(() => {
+    const importableGrouped = useMemo(
+        () => groupImportableIdps(importableIdps),
+        [importableIdps]
+    );
+
+    const shownImportGrouped = useMemo(() => {
        const q = debouncedImportSearch.trim().toLowerCase();
        if (!q) {
-            return importableIdps;
+            return importableGrouped;
        }
-        return importableIdps.filter((row) => {
-            const hay = `${row.orgName} ${row.name}`.toLowerCase();
+        return importableGrouped.filter((group) => {
+            const hay =
+                `${group.name} ${group.sources.map((s) => s.orgName).join(" ")}`.toLowerCase();
            return hay.includes(q);
        });
-    }, [importableIdps, debouncedImportSearch]);
+    }, [importableGrouped, debouncedImportSearch]);

    const deleteIdp = async (idpId: number) => {
        try {
@@ -364,31 +425,44 @@ export default function IdpTable({ idps, orgId }: Props) {
                                    {t("idpImportEmpty")}
                                </CommandEmpty>
                                <CommandGroup>
-                                    {shownImportIdps.map((row) => (
+                                    {shownImportGrouped.map((group) => (
                                        <CommandItem
-                                            key={`${row.idpId}:${row.orgId}`}
+                                            key={group.idpId}
                                            className="items-start gap-3 py-2.5"
-                                            value={`${row.idpId}:${row.orgId}:${row.orgName}:${row.name}`}
+                                            value={`${group.idpId}:${group.name}:${group.sources.map((s) => s.orgName).join(" ")}`}
                                            disabled={!canImportOrgOidcIdp}
                                            onSelect={() => {
                                                if (!canImportOrgOidcIdp) {
                                                    return;
                                                }
-                                                void importIdp(row);
+                                                void importIdp(
+                                                    adminRowForImport(
+                                                        group,
+                                                        group.sources[0]
+                                                    )
+                                                );
                                            }}
                                        >
                                            <div className="mt-0.5 shrink-0">
                                                <IdpImportRowIcon
-                                                    type={row.type}
-                                                    variant={row.variant}
+                                                    type={group.type}
+                                                    variant={group.variant}
                                                />
                                            </div>
                                            <div className="min-w-0 flex-1 text-left">
                                                <div className="truncate font-medium leading-tight">
-                                                    {row.orgName}
+                                                    {group.name}
                                                </div>
-                                                <div className="truncate text-sm leading-tight text-muted-foreground">
-                                                    {row.name}
+                                                <div className="mt-1 flex flex-wrap gap-1">
+                                                    {group.sources.map((src) => (
+                                                        <Badge
+                                                            key={src.orgId}
+                                                            variant="secondary"
+                                                            className="max-w-full truncate font-normal"
+                                                        >
+                                                            {src.orgName}
+                                                        </Badge>
+                                                    ))}
                                                </div>
                                            </div>
                                        </CommandItem>
--- a/src/components/SmartLoginForm.tsx
+++ b/src/components/SmartLoginForm.tsx
@@ -22,7 +22,7 @@ import { useEnvContext } from "@app/hooks/useEnvContext";
 import { LookupUserResponse } from "@server/routers/auth/lookupUser";
 import { useTranslations } from "next-intl";
 import LoginPasswordForm from "@app/components/LoginPasswordForm";
-import LoginOrgSelector from "@app/components/LoginOrgSelector";
+import SmartLoginOrgSelector from "@app/components/SmartLoginOrgSelector";
 import UserProfileCard from "@app/components/UserProfileCard";
 import SecurityKeyAuthButton from "@app/components/SecurityKeyAuthButton";
 import { Separator } from "@app/components/ui/separator";
@@ -206,7 +206,7 @@ export default function SmartLoginForm({
    if (viewState.type === "orgSelector") {
        return (
            <div className="space-y-4">
-                <LoginOrgSelector
+                <SmartLoginOrgSelector
                    identifier={viewState.identifier}
                    lookupResult={viewState.lookupResult}
                    redirect={redirect}
--- a/src/components/SmartLoginOrgSelector.tsx
+++ b/src/components/SmartLoginOrgSelector.tsx
@@ -0,0 +1,297 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { Button } from "@app/components/ui/button";
+import { Badge } from "@app/components/ui/badge";
+import { Alert, AlertDescription } from "@app/components/ui/alert";
+import { useTranslations } from "next-intl";
+import LoginPasswordForm from "@app/components/LoginPasswordForm";
+import { LookupUserResponse } from "@server/routers/auth/lookupUser";
+import UserProfileCard from "@app/components/UserProfileCard";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
+import { generateOidcUrlProxy } from "@app/actions/server";
+import {
+    redirect as redirectTo,
+    useRouter,
+    useSearchParams
+} from "next/navigation";
+import { cleanRedirect } from "@app/lib/cleanRedirect";
+import { Separator } from "@app/components/ui/separator";
+
+type SmartLoginOrgSelectorProps = {
+    identifier: string;
+    lookupResult: LookupUserResponse;
+    redirect?: string;
+    forceLogin?: boolean;
+    onUseDifferentAccount?: () => void;
+};
+
+type OrgBucket = {
+    orgId: string;
+    orgName: string;
+    idps: Array<{
+        idpId: number;
+        name: string;
+        variant: string | null;
+    }>;
+    hasInternalAuth: boolean;
+};
+
+type GroupedLoginIdp = {
+    idpId: number;
+    name: string;
+    variant: string | null;
+    orgs: { orgId: string; orgName: string }[];
+};
+
+function buildOrgMap(lookupResult: LookupUserResponse) {
+    const orgMap = new Map<string, OrgBucket>();
+
+    for (const account of lookupResult.accounts) {
+        for (const org of account.orgs) {
+            if (!orgMap.has(org.orgId)) {
+                orgMap.set(org.orgId, {
+                    orgId: org.orgId,
+                    orgName: org.orgName,
+                    idps: org.idps,
+                    hasInternalAuth: org.hasInternalAuth
+                });
+            } else {
+                const existing = orgMap.get(org.orgId)!;
+                const existingIdpIds = new Set(
+                    existing.idps.map((i) => i.idpId)
+                );
+                for (const idp of org.idps) {
+                    if (!existingIdpIds.has(idp.idpId)) {
+                        existing.idps.push(idp);
+                    }
+                }
+                if (org.hasInternalAuth) {
+                    existing.hasInternalAuth = true;
+                }
+            }
+        }
+    }
+
+    return Array.from(orgMap.values());
+}
+
+function groupIdpsAcrossOrgs(orgs: OrgBucket[]): GroupedLoginIdp[] {
+    const map = new Map<number, GroupedLoginIdp>();
+
+    for (const org of orgs) {
+        for (const idp of org.idps) {
+            let g = map.get(idp.idpId);
+            if (!g) {
+                g = {
+                    idpId: idp.idpId,
+                    name: idp.name,
+                    variant: idp.variant,
+                    orgs: []
+                };
+                map.set(idp.idpId, g);
+            }
+            if (!g.orgs.some((o) => o.orgId === org.orgId)) {
+                g.orgs.push({ orgId: org.orgId, orgName: org.orgName });
+            }
+        }
+    }
+
+    return Array.from(map.values())
+        .map((g) => ({
+            ...g,
+            orgs: [...g.orgs].sort((a, b) => a.orgName.localeCompare(b.orgName))
+        }))
+        .sort((a, b) => b.name.localeCompare(a.name));
+}
+
+export default function SmartLoginOrgSelector({
+    identifier,
+    lookupResult,
+    redirect,
+    forceLogin,
+    onUseDifferentAccount
+}: SmartLoginOrgSelectorProps) {
+    const t = useTranslations();
+    const [showPasswordForm, setShowPasswordForm] = useState(false);
+    const [error, setError] = useState<string | null>(null);
+    const [pendingIdpId, setPendingIdpId] = useState<number | null>(null);
+    const params = useSearchParams();
+    const router = useRouter();
+
+    const orgs = buildOrgMap(lookupResult);
+    const groupedIdps = groupIdpsAcrossOrgs(orgs);
+
+    const hasInternalAccount = lookupResult.accounts.some(
+        (acc) => acc.hasInternalAuth
+    );
+
+    function goToApp() {
+        const url = window.location.href.split("?")[0];
+        router.push(url);
+    }
+
+    useEffect(() => {
+        if (params.get("gotoapp")) {
+            goToApp();
+        }
+    }, []);
+
+    async function loginWithIdp(idpId: number, orgId: string) {
+        setPendingIdpId(idpId);
+        setError(null);
+
+        let redirectToUrl: string | undefined;
+        try {
+            const safeRedirect = cleanRedirect(redirect || "/");
+            const response = await generateOidcUrlProxy(
+                idpId,
+                safeRedirect,
+                orgId,
+                forceLogin
+            );
+
+            if (response.error) {
+                setError(response.message);
+                setPendingIdpId(null);
+                return;
+            }
+
+            const data = response.data;
+            if (data?.redirectUrl) {
+                redirectToUrl = data.redirectUrl;
+            }
+        } catch {
+            setError(
+                t("loginError", {
+                    defaultValue:
+                        "An unexpected error occurred. Please try again."
+                })
+            );
+        }
+
+        if (redirectToUrl) {
+            redirectTo(redirectToUrl);
+        } else {
+            setPendingIdpId(null);
+        }
+    }
+
+    if (showPasswordForm) {
+        return (
+            <div className="space-y-4">
+                <UserProfileCard
+                    identifier={identifier}
+                    description={t("loginSelectAuthenticationMethod")}
+                    onUseDifferentAccount={onUseDifferentAccount}
+                    useDifferentAccountText={t(
+                        "deviceLoginUseDifferentAccount"
+                    )}
+                />
+                <LoginPasswordForm
+                    identifier={identifier}
+                    redirect={redirect}
+                    forceLogin={forceLogin}
+                />
+            </div>
+        );
+    }
+
+    return (
+        <div>
+            <UserProfileCard
+                identifier={identifier}
+                description={t("loginSelectAuthenticationMethod")}
+                onUseDifferentAccount={onUseDifferentAccount}
+                useDifferentAccountText={t("deviceLoginUseDifferentAccount")}
+            />
+
+            {hasInternalAccount && (
+                <div className="mt-3">
+                    <Button
+                        type="button"
+                        className="w-full"
+                        onClick={() => setShowPasswordForm(true)}
+                    >
+                        {t("signInWithPassword")}
+                    </Button>
+                </div>
+            )}
+
+            {groupedIdps.length > 0 ? (
+                <div className="mt-3 space-y-4">
+                    {error && (
+                        <Alert variant="destructive">
+                            <AlertDescription>{error}</AlertDescription>
+                        </Alert>
+                    )}
+
+                    <div className="relative my-4">
+                        <div className="absolute inset-0 flex items-center">
+                            <Separator />
+                        </div>
+                        <div className="relative flex justify-center text-xs uppercase">
+                            <span className="px-2 bg-card text-muted-foreground">
+                                {t("idpContinue")}
+                            </span>
+                        </div>
+                    </div>
+
+                    <div className="space-y-2">
+                        {params.get("gotoapp") ? (
+                            <Button
+                                type="button"
+                                className="w-full"
+                                onClick={() => {
+                                    goToApp();
+                                }}
+                            >
+                                {t("continueToApplication")}
+                            </Button>
+                        ) : (
+                            groupedIdps.map((group) => {
+                                const effectiveType =
+                                    group.variant || group.name.toLowerCase();
+                                const sourceOrgId = group.orgs[0].orgId;
+
+                                return (
+                                    <Button
+                                        key={group.idpId}
+                                        type="button"
+                                        variant="outline"
+                                        className="h-auto w-full flex flex-wrap items-center justify-start gap-x-2 gap-y-1.5 py-3 text-left"
+                                        onClick={() => {
+                                            void loginWithIdp(
+                                                group.idpId,
+                                                sourceOrgId
+                                            );
+                                        }}
+                                        disabled={pendingIdpId !== null}
+                                    >
+                                        <IdpTypeIcon
+                                            type={effectiveType}
+                                            size={16}
+                                            className="shrink-0"
+                                        />
+                                        <span className="font-medium shrink-0">
+                                            {group.name}
+                                        </span>
+                                        {group.orgs.map((org) => (
+                                            <Badge
+                                                key={org.orgId}
+                                                variant="secondary"
+                                                className="max-w-full shrink-0 truncate font-normal"
+                                            >
+                                                {org.orgName}
+                                            </Badge>
+                                        ))}
+                                    </Button>
+                                );
+                            })
+                        )}
+                    </div>
+                </div>
+            ) : null}
+        </div>
+    );
+}
--- a/src/components/TrialBillingBanner.tsx
+++ b/src/components/TrialBillingBanner.tsx
@@ -0,0 +1,38 @@
+"use client";
+
+import React from "react";
+import { Button } from "@app/components/ui/button";
+import { ClockIcon, ArrowRight } from "lucide-react";
+import { useTranslations } from "next-intl";
+import DismissableBanner from "./DismissableBanner";
+
+type TrialBillingBannerProps = {
+    onUpgrade: () => void;
+};
+
+export const TrialBillingBanner = ({ onUpgrade }: TrialBillingBannerProps) => {
+    const t = useTranslations();
+
+    return (
+        <DismissableBanner
+            storageKey="trial-billing-banner-dismissed"
+            version={1}
+            title={t("billingTrialBannerTitle")}
+            titleIcon={<ClockIcon className="w-5 h-5 text-primary" />}
+            description={t("billingTrialBannerDescription")}
+            dismissable={false}
+        >
+            <Button
+                variant="outline"
+                size="sm"
+                className="gap-2 hover:bg-primary/10 hover:border-primary/50 transition-colors"
+                onClick={onUpgrade}
+            >
+                {t("billingTrialBannerUpgrade")}
+                <ArrowRight className="w-4 h-4" />
+            </Button>
+        </DismissableBanner>
+    );
+};
+
+export default TrialBillingBanner;
--- a/src/components/newt-install-commands.tsx
+++ b/src/components/newt-install-commands.tsx
@@ -52,6 +52,10 @@ export function NewtSiteInstallCommands({
    const acceptClientsEnv = !acceptClients
        ? "\n      - DISABLE_CLIENTS=true"
        : "";
+    const acceptClientsHelmValue = acceptClients
+        ? ` \\
+      --set newtInstances[0].acceptClients=true`
+        : "";

    const commandList: Record<Platform, Record<string, CommandItem[]>> = {
        linux: {
@@ -162,13 +166,18 @@ sudo systemctl enable --now newt`
            "Helm Chart": [
                `helm repo add fossorial https://charts.fossorial.io`,
                `helm repo update fossorial`,
-                `helm install newt fossorial/newt \\
-    --create-namespace \\
-    --set newtInstances[0].name="main-tunnel" \\
-    --set newtInstances[0].enabled=true \\
-    --set-string newtInstances[0].auth.keys.endpointKey="${endpoint}" \\
-    --set-string newtInstances[0].auth.keys.idKey="${id}" \\
-    --set-string newtInstances[0].auth.keys.secretKey="${secret}"`
+                `kubectl create namespace newt --dry-run=client -o yaml | kubectl apply -f -`,
+                `kubectl create secret generic newt-main-tunnel-auth \\
+   -n newt \\
+  --from-literal=PANGOLIN_ENDPOINT="${endpoint}" \\
+  --from-literal=NEWT_ID="${id}" \\
+  --from-literal=NEWT_SECRET="${secret}" \\
+  --dry-run=client -o yaml | kubectl apply -f -`,
+                `helm upgrade --install newt fossorial/newt \\
+  -n newt \\
+  --set newtInstances[0].name="main-tunnel" \\
+  --set newtInstances[0].enabled=true \\
+  --set-string newtInstances[0].auth.existingSecretName="newt-main-tunnel-auth"${acceptClientsHelmValue}`
            ]
        },
        podman: {
Author	SHA1	Message	Date
Owen Schwartz	c1c387bdd8	Merge pull request #2996 from fosrl/crowdin_dev New Crowdin updates	2026-05-04 11:48:58 -07:00
Owen Schwartz	6e83d77a87	New translations en-us.json (Spanish) [ci skip]	2026-05-04 11:48:00 -07:00
Owen Schwartz	ba9a1efa4c	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-05-04 11:47:58 -07:00
Owen Schwartz	9e046b9608	New translations en-us.json (Chinese Simplified) [ci skip]	2026-05-04 11:47:56 -07:00
Owen Schwartz	37794eb299	New translations en-us.json (Turkish) [ci skip]	2026-05-04 11:47:55 -07:00
Owen Schwartz	4e66b0e74b	New translations en-us.json (Russian) [ci skip]	2026-05-04 11:47:53 -07:00
Owen Schwartz	44fa873977	New translations en-us.json (Portuguese) [ci skip]	2026-05-04 11:47:51 -07:00
Owen Schwartz	505461a533	New translations en-us.json (Polish) [ci skip]	2026-05-04 11:47:49 -07:00
Owen Schwartz	a88c5b1428	New translations en-us.json (Dutch) [ci skip]	2026-05-04 11:47:47 -07:00
Owen Schwartz	97ef1d605c	New translations en-us.json (Korean) [ci skip]	2026-05-04 11:47:45 -07:00
Owen Schwartz	3fc1c9d948	New translations en-us.json (Italian) [ci skip]	2026-05-04 11:47:44 -07:00
Owen Schwartz	68bd37ab6c	New translations en-us.json (German) [ci skip]	2026-05-04 11:47:42 -07:00
Owen Schwartz	5c317c535b	New translations en-us.json (Czech) [ci skip]	2026-05-04 11:47:40 -07:00
Owen Schwartz	37c6b11899	New translations en-us.json (Bulgarian) [ci skip]	2026-05-04 11:47:38 -07:00
Owen Schwartz	45c567ffa0	New translations en-us.json (French) [ci skip]	2026-05-04 11:47:36 -07:00
Owen Schwartz	775ea64b55	Merge pull request #2977 from fosrl/newt-install-commands fix(newt): update Helm install credentials and client flag handling	2026-05-04 11:40:19 -07:00
Owen	64ad7641af	Add migration Fixes #2968 Fixes #2990	2026-05-04 11:35:07 -07:00
Owen	d724f5bb5d	Add missing redirects and threshold to api Fixes #2987	2026-05-04 10:46:11 -07:00
Owen	d4f7c4a9c4	Merge branch 'dev' of github.com:fosrl/pangolin into dev	2026-05-03 14:46:59 -07:00
miloschwartz	1cc0e9b689	consolidate org idps in login form	2026-05-03 14:46:48 -07:00
Owen	584be4dbd2	Add badge	2026-05-03 14:45:42 -07:00
Owen	c33e295ce7	Add a banner showing that you are on a trial	2026-05-03 14:42:43 -07:00
Owen	1a926a7127	Handle trial limit lifecycle	2026-05-03 14:31:05 -07:00
miloschwartz	eb515a8f7f	consolidate orgidps in import list	2026-05-03 14:16:36 -07:00
Owen	81b8a8a9e3	Fix ns cert generation	2026-05-03 12:29:48 -07:00
Owen	bcd164219f	Try to speed up	2026-05-03 12:29:48 -07:00
Owen Schwartz	c90e405105	Merge pull request #2843 from Blacks-Army/dev Exclude local/private/CGNAT IPs from geo-block rules (fixes issue #2239)	2026-05-03 11:19:36 -07:00
Mustafa	b2c8311b26	Merge branch 'fosrl:dev' into dev	2026-05-03 18:53:48 +02:00
Marc Schäfer	1772ac220f	fix(newt): update Helm install credentials and client flag handling Use a Kubernetes Secret for Newt Helm chart credentials and configure the chart with auth.existingSecretName instead of passing credential values through auth.keys.*. Add Helm-specific acceptClients handling so the generated Kubernetes command sets newtInstances[0].acceptClients=true when client connections are enabled.	2026-05-03 15:07:42 +02:00
Mustafa	8e1905a695	Exclude local/private/CGNAT IPs from COUNTRY=ALL and ASN=ALL/AS0 geo-blocking rules	2026-04-12 20:19:32 +02:00