Add regional redis cache

2026-06-04 14:39:51 +00:00 · 2026-05-12 21:36:06 -07:00
495 changed files with 15552 additions and 41195 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -34,4 +34,3 @@ build.ts
 tsconfig.json
 Dockerfile*
 drizzle.config.ts
-allowedDevOrigins.json
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: [fosrl]
--- a/.github/ISSUE_TEMPLATE/1.bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/1.bug_report.yml
@@ -14,13 +14,12 @@ body:
          label: Environment
          description: Please fill out the relevant details below for your environment.
          value: |
-              - OS Type & Version:
+              - OS Type & Version: (e.g., Ubuntu 22.04)
              - Pangolin Version:
-              - Edition (Community or Enterprise):
              - Gerbil Version:
              - Traefik Version:
              - Newt Version:
-              - Client Version:
+              - Olm Version: (if applicable)
      validations:
          required: true

--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -77,7 +77,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

            - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -407,7 +407,7 @@ jobs:
              shell: bash

            - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
              with:
                registry: ghcr.io
                username: ${{ github.actor }}
@@ -415,9 +415,7 @@ jobs:

            - name: Install cosign
              # cosign is used to sign container images using keyless (OIDC) signing
-              uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-              with:
-                cosign-release: v3.0.6
+              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

            - name: Sign (GHCR, keyless)
              # Sign each GHCR image by digest using keyless (OIDC) signing via Sigstore/Rekor.
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -24,7 +24,7 @@ jobs:
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

            - name: Set up Node.js
-              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
              with:
                node-version: '24'

--- a/.github/workflows/mirror.yaml
+++ b/.github/workflows/mirror.yaml
@@ -23,7 +23,7 @@ jobs:
          skopeo --version

      - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

      - name: Input check
        run: |
--- a/.github/workflows/restart-runners.yml
+++ b/.github/workflows/restart-runners.yml
@@ -0,0 +1,39 @@
+name: Restart Runners
+
+on:
+  schedule:
+    - cron: '0 0 */7 * *'
+
+permissions:
+    id-token: write
+    contents: read
+
+jobs:
+  ec2-maintenance-prod:
+    runs-on: ubuntu-latest
+    permissions: write-all
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
+          role-duration-seconds: 3600
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Verify AWS identity
+        run: aws sts get-caller-identity
+
+      - name: Start EC2 instance
+        run: |
+          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
+          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
+          echo "EC2 instances started"
+
+      - name: Wait
+        run: sleep 600
+
+      - name: Stop EC2 instance
+        run: |
+          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
+          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
+          echo "EC2 instances stopped"
--- a/.github/workflows/saas.yml
+++ b/.github/workflows/saas.yml
@@ -0,0 +1,160 @@
+name: SAAS Pipeline
+
+# CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
+# Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.
+
+permissions:
+  contents: read
+  packages: write      # for GHCR push
+  id-token: write      # for Cosign Keyless (OIDC) Signing
+
+on:
+    push:
+        tags:
+            - "[0-9]+.[0-9]+.[0-9]+-s.[0-9]+"
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+    pre-run:
+        runs-on: ubuntu-latest
+        permissions: write-all
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@v6
+              with:
+                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
+                  role-duration-seconds: 3600
+                  aws-region: ${{ secrets.AWS_REGION }}
+
+            - name: Verify AWS identity
+              run: aws sts get-caller-identity
+
+            - name: Start EC2 instances
+              run: |
+                  aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
+                  echo "EC2 instances started"
+
+
+    release-arm:
+        name: Build and Release (ARM64)
+        runs-on: [self-hosted, linux, arm64, us-east-1]
+        needs: [pre-run]
+        if: >-
+            ${{
+                needs.pre-run.result == 'success'
+            }}
+        # Job-level timeout to avoid runaway or stuck runs
+        timeout-minutes: 120
+        env:
+          # Target images
+          AWS_IMAGE: ${{ secrets.aws_account_id }}.dkr.ecr.us-east-1.amazonaws.com/${{ github.event.repository.name }}
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+            - name: Download MaxMind GeoLite2 databases
+              env:
+                MAXMIND_LICENSE_KEY: ${{ secrets.MAXMIND_LICENSE_KEY }}
+              run: |
+                echo "Downloading MaxMind GeoLite2 databases..."
+
+                # Download GeoLite2-Country
+                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
+                  -o GeoLite2-Country.tar.gz
+
+                # Download GeoLite2-ASN
+                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-ASN&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
+                  -o GeoLite2-ASN.tar.gz
+
+                # Extract the .mmdb files
+                tar -xzf GeoLite2-Country.tar.gz --strip-components=1 --wildcards '*.mmdb'
+                tar -xzf GeoLite2-ASN.tar.gz --strip-components=1 --wildcards '*.mmdb'
+
+                # Verify files exist
+                if [ ! -f "GeoLite2-Country.mmdb" ]; then
+                  echo "ERROR: Failed to download GeoLite2-Country.mmdb"
+                  exit 1
+                fi
+
+                if [ ! -f "GeoLite2-ASN.mmdb" ]; then
+                  echo "ERROR: Failed to download GeoLite2-ASN.mmdb"
+                  exit 1
+                fi
+
+                # Clean up tar files
+                rm -f GeoLite2-Country.tar.gz GeoLite2-ASN.tar.gz
+
+                echo "MaxMind databases downloaded successfully"
+                ls -lh GeoLite2-*.mmdb
+
+            - name: Monitor storage space
+              run: |
+                  THRESHOLD=75
+                  USED_SPACE=$(df / | grep / | awk '{ print $5 }' | sed 's/%//g')
+                  echo "Used space: $USED_SPACE%"
+                  if [ "$USED_SPACE" -ge "$THRESHOLD" ]; then
+                      echo "Used space is below the threshold of 75% free. Running Docker system prune."
+                      echo y | docker system prune -a
+                  else
+                      echo "Storage space is above the threshold. No action needed."
+                  fi
+
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@v6
+              with:
+                  role-to-assume: arn:aws:iam::${{ secrets.aws_account_id }}:role/${{ secrets.AWS_ROLE_NAME }}
+                  role-duration-seconds: 3600
+                  aws-region: ${{ secrets.AWS_REGION }}
+
+            - name: Login to Amazon ECR
+              id: login-ecr
+              uses: aws-actions/amazon-ecr-login@v2
+
+            - name: Extract tag name
+              id: get-tag
+              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+              shell: bash
+
+            - name: Update version in package.json
+              run: |
+                  TAG=${{ env.TAG }}
+                  sed -i "s/export const APP_VERSION = \".*\";/export const APP_VERSION = \"$TAG\";/" server/lib/consts.ts
+                  cat server/lib/consts.ts
+              shell: bash
+
+            - name: Build and push Docker images (Docker Hub - ARM64)
+              run: |
+                  TAG=${{ env.TAG }}
+                  make build-saas tag=$TAG
+                  echo "Built & pushed ARM64 images to: ${{ env.AWS_IMAGE }}:${TAG}"
+              shell: bash
+
+    post-run:
+        needs: [pre-run, release-arm]
+        if: >-
+            ${{
+                always() &&
+                needs.pre-run.result == 'success' &&
+                (needs.release-arm.result == 'success' || needs.release-arm.result == 'skipped' || needs.release-arm.result == 'failure')
+            }}
+        runs-on: ubuntu-latest
+        permissions: write-all
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@v6
+              with:
+                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
+                  role-duration-seconds: 3600
+                  aws-region: ${{ secrets.AWS_REGION }}
+
+            - name: Verify AWS identity
+              run: aws sts get-caller-identity
+
+            - name: Stop EC2 instances
+              run: |
+                  aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
+                  echo "EC2 instances stopped"
--- a/.github/workflows/stale-bot.yml
+++ b/.github/workflows/stale-bot.yml
@@ -14,7 +14,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          days-before-stale: 14
          days-before-close: 14
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,7 +17,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '24'

--- a/.gitignore
+++ b/.gitignore
@@ -17,9 +17,9 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 *.db
-*.sqlite*
+*.sqlite
 !Dockerfile.sqlite
-*.sqlite3*
+*.sqlite3
 *.log
 .machinelogs*.json
 *-audit.json
@@ -54,5 +54,3 @@ hydrateSaas.ts
 CLAUDE.md
 drizzle.config.ts
 server/setup/migrations.ts
-solo.yml
-allowedDevOrigins.json
--- a/README.md
+++ b/README.md
@@ -107,7 +107,7 @@ the docs to illustrate some basic ideas.

 ## Licensing

-Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License](https://pangolin.net/fcl). For inquiries about commercial licensing, please contact us at [contact@pangolin.net](mailto:contact@pangolin.net).
+Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License](https://pangolin.net/fcl.html). For inquiries about commercial licensing, please contact us at [contact@pangolin.net](mailto:contact@pangolin.net).

 ## Contributions

--- a/cli/commands/setServerAdmin.ts
+++ b/cli/commands/setServerAdmin.ts
@@ -1,51 +0,0 @@
-import { CommandModule } from "yargs";
-import { db, users } from "@server/db";
-import { eq } from "drizzle-orm";
-
-type SetServerAdminArgs = {
-    email: string;
-};
-
-export const setServerAdmin: CommandModule<{}, SetServerAdminArgs> = {
-    command: "set-server-admin",
-    describe: "Mark any user as a server admin by email address",
-    builder: (yargs) => {
-        return yargs.option("email", {
-            type: "string",
-            demandOption: true,
-            describe: "User email address"
-        });
-    },
-    handler: async (argv: { email: string }) => {
-        try {
-            const email = argv.email.trim().toLowerCase();
-
-            const [user] = await db
-                .select()
-                .from(users)
-                .where(eq(users.email, email))
-                .limit(1);
-
-            if (!user) {
-                console.error(`User with email '${email}' not found`);
-                process.exit(1);
-            }
-
-            if (user.serverAdmin) {
-                console.log(`User '${email}' is already a server admin`);
-                process.exit(0);
-            }
-
-            await db
-                .update(users)
-                .set({ serverAdmin: true })
-                .where(eq(users.userId, user.userId));
-
-            console.log(`User '${email}' has been marked as a server admin`);
-            process.exit(0);
-        } catch (error) {
-            console.error("Error:", error);
-            process.exit(1);
-        }
-    }
-};
--- a/cli/index.ts
+++ b/cli/index.ts
@@ -11,7 +11,6 @@ import { deleteClient } from "./commands/deleteClient";
 import { generateOrgCaKeys } from "./commands/generateOrgCaKeys";
 import { clearCertificates } from "./commands/clearCertificates";
 import { disableUser2fa } from "./commands/disableUser2fa";
-import { setServerAdmin } from "./commands/setServerAdmin";

 yargs(hideBin(process.argv))
    .scriptName("pangctl")
@@ -24,6 +23,5 @@ yargs(hideBin(process.argv))
    .command(generateOrgCaKeys)
    .command(clearCertificates)
    .command(disableUser2fa)
-    .command(setServerAdmin)
    .demandCommand()
    .help().argv;
--- a/config/traefik/traefik_config.yml
+++ b/config/traefik/traefik_config.yml
@@ -1,47 +1,54 @@
 api:
  insecure: true
  dashboard: true
+
 providers:
  http:
-    endpoint: http://pangolin:3001/api/v1/traefik-config
-    pollInterval: 5s
+    endpoint: "http://pangolin:3001/api/v1/traefik-config"
+    pollInterval: "5s"
  file:
-    filename: /etc/traefik/dynamic_config.yml
+    filename: "/etc/traefik/dynamic_config.yml"
+
 experimental:
  plugins:
    badger:
-      moduleName: github.com/fosrl/badger
-      version: v1.4.1
+      moduleName: "github.com/fosrl/badger"
+      version: "{{.BadgerVersion}}"
+
 log:
-  level: INFO
-  format: common
+  level: "INFO"
+  format: "common"
  maxSize: 100
  maxBackups: 3
  maxAge: 3
  compress: true
+
 certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
-      email: '{{.LetsEncryptEmail}}'
-      storage: /letsencrypt/acme.json
-      caServer: https://acme-v02.api.letsencrypt.org/directory
+      email: "{{.LetsEncryptEmail}}"
+      storage: "/letsencrypt/acme.json"
+      caServer: "https://acme-v02.api.letsencrypt.org/directory"
+
 entryPoints:
  web:
-    address: ':80'
+    address: ":80"
  websecure:
-    address: ':443'
+    address: ":443"
    transport:
      respondingTimeouts:
-        readTimeout: 30m
+        readTimeout: "30m"
    http:
      tls:
-        certResolver: letsencrypt
+        certResolver: "letsencrypt"
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedQuestionMark: true
+
 serversTransport:
  insecureSkipVerify: true
+
 ping:
-  entryPoint: web
+  entryPoint: "web"
--- a/drizzle.sqlite.config.ts
+++ b/drizzle.sqlite.config.ts
@@ -1,4 +1,4 @@
-import { APP_PATH } from "./server/lib/consts";
+import { APP_PATH } from "@server/lib/consts";
 import { defineConfig } from "drizzle-kit";
 import path from "path";

--- a/install/config/config.yml
+++ b/install/config/config.yml
@@ -22,8 +22,7 @@ server:
        methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
        allowed_headers: ["X-CSRF-Token", "Content-Type"]
        credentials: false
-    {{if .EnableMaxMind}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
-    {{if .EnableMaxMind}}maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"{{end}}
+    {{if .EnableGeoblocking}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
 {{if .EnableEmail}}
 email:
    smtp_host: "{{.EmailSMTPHost}}"
@@ -37,8 +36,3 @@ flags:
    disable_signup_without_invite: true
    disable_user_create_org: false
    allow_raw_resources: true
-
-{{if .IsPostgreSQL}}
-postgres:
-  connection_string: postgresql://pangolin:{{.IsPostgreSQLPass}}@postgres:5432/pangolin
-{{end}}
--- a/install/config/docker-compose.yml
+++ b/install/config/docker-compose.yml
@@ -1,7 +1,7 @@
 name: pangolin
 services:
  pangolin:
-    image: docker.io/fosrl/pangolin:{{if .IsEnterprise}}ee-{{end}}{{if .IsPostgreSQL}}postgresql-{{end}}{{.PangolinVersion}}
+    image: docker.io/fosrl/pangolin:{{if .IsEnterprise}}ee-{{end}}{{.PangolinVersion}}
    container_name: pangolin
    restart: unless-stopped
    deploy:
@@ -10,20 +10,6 @@ services:
          memory: 1g
        reservations:
          memory: 256m
-{{if or .IsPostgreSQL .IsRedis}}
-    depends_on:
-    {{if .IsPostgreSQL}}
-      postgres:
-        condition: service_healthy
-    {{end}}
-    {{if .IsRedis}}
-      redis:
-        condition: service_healthy
-    {{end}}
-    networks:
-      - default
-      - backend
-{{end}}
    volumes:
      - ./config:/app/config
    healthcheck:
@@ -74,56 +60,8 @@ services:
      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs

-{{if .IsPostgreSQL}}
-  postgres:
-    image: postgres:18
-    container_name: postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: pangolin
-      POSTGRES_PASSWORD: {{.IsPostgreSQLPass}}
-      POSTGRES_DB: pangolin
-    volumes:
-      - ./postgres18:/var/lib/postgresql
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U pangolin"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - backend
-{{end}}
-
-{{if .IsRedis}}
-  redis:
-    image: redis:8-trixie
-    container_name: redis
-    restart: unless-stopped
-    command: >
-      redis-server
-      --save 3600 1000
-      --appendonly yes
-      --requirepass {{.IsRedisPass}}
-    volumes:
-      - ./redis8:/data
-    healthcheck:
-      test: ["CMD", "redis-cli", "-a", "{{.IsRedisPass}}", "ping"]
-      interval: 10s
-      timeout: 3s
-      retries: 3
-      start_period: 10s
-    networks:
-      - backend
-{{end}}
-
 networks:
  default:
    driver: bridge
-    name: pangolin_frontend
+    name: pangolin
 {{if .EnableIPv6}}    enable_ipv6: true{{end}}
-{{if or .IsPostgreSQL .IsRedis}}
-  backend:
-    driver: bridge
-    name: pangolin_backend
-    internal: true
-{{end}}
--- a/install/config/privateConfig.yml
+++ b/install/config/privateConfig.yml
@@ -1,6 +0,0 @@
-{{if .IsRedis}}
-redis:
-  host: "redis"
-  port: 6379
-  password: "{{.IsRedisPass}}"
-{{end}}
--- a/install/go.mod
+++ b/install/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.43.0
+	golang.org/x/term v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )
--- a/install/go.sum
+++ b/install/go.sum
@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
--- a/install/main.go
+++ b/install/main.go
@@ -4,7 +4,6 @@ import (
 	"crypto/rand"
 	"embed"
 	"encoding/base64"
-	"flag"
 	"fmt"
 	"io"
 	"io/fs"
@@ -54,13 +53,9 @@ type Config struct {
 	InstallGerbil             bool
 	TraefikBouncerKey         string
 	DoCrowdsecInstall         bool
-	EnableMaxMind             bool
+	EnableGeoblocking         bool
 	Secret                    string
 	IsEnterprise              bool
-    IsPostgreSQL              bool
-	IsPostgreSQLPass          string
-    IsRedis                   bool
-	IsRedisPass               string
 }

 type SupportedContainer string
@@ -73,9 +68,6 @@ const (

 func main() {

-	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
-	flag.Parse()
-
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking

 	fmt.Println("Welcome to the Pangolin installer!")
@@ -127,11 +119,11 @@ func main() {

 		fmt.Println("\nConfiguration files created successfully!")

-		// Download MaxMind Country / ASN database if requested
-		if config.EnableMaxMind {
-			fmt.Println("\n=== Downloading MaxMind Country and ASN Databases ===")
+		// Download MaxMind database if requested
+		if config.EnableGeoblocking {
+			fmt.Println("\n=== Downloading MaxMind Database ===")
 			if err := downloadMaxMindDatabase(); err != nil {
-				fmt.Printf("Error downloading MaxMind databases: %v\n", err)
+				fmt.Printf("Error downloading MaxMind database: %v\n", err)
 				fmt.Println("You can download it manually later if needed.")
 			}
 		}
@@ -192,15 +184,15 @@ func main() {
 		fmt.Println("\n=== MaxMind Database Update ===")
 		if _, err := os.Stat("config/GeoLite2-Country.mmdb"); err == nil {
 			fmt.Println("MaxMind GeoLite2 Country database found.")
-			if readBool("Would you like to update the MaxMind databases (Country and ASN) to the latest version?", false) {
+			if readBool("Would you like to update the MaxMind database to the latest version?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error updating MaxMind database: %v\n", err)
 					fmt.Println("You can try updating it manually later if needed.")
 				}
 			}
 		} else {
-			fmt.Println("MaxMind GeoLite2 Country and ASN databases not found.")
-			if readBool("Would you like to download the MaxMind GeoLite2 databases for blocking functionality?", false) {
+			fmt.Println("MaxMind GeoLite2 Country database not found.")
+			if readBool("Would you like to download the MaxMind GeoLite2 database for geoblocking functionality?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error downloading MaxMind database: %v\n", err)
 					fmt.Println("You can try downloading it manually later if needed.")
@@ -208,15 +200,13 @@ func main() {
 				// Now you need to update your config file accordingly to enable geoblocking
 				fmt.Print("Please remember to update your config/config.yml file to enable geoblocking! \n\n")
 				// add   maxmind_db_path: "./config/GeoLite2-Country.mmdb" under server
-				// add   maxmind_asn_path: "./config/GeoLite2-ASN.mmdb" under server
-				fmt.Println("Add the following lines under the 'server' section:")
+				fmt.Println("Add the following line under the 'server' section:")
 				fmt.Println("  maxmind_db_path: \"./config/GeoLite2-Country.mmdb\"")
-				fmt.Println("  maxmind_asn_path: \"./config/GeoLite2-ASN.mmdb\"")
 			}
 		}
 	}

-	if *crowdsecFlag && !checkIsCrowdsecInstalledInCompose() {
+	if !checkIsCrowdsecInstalledInCompose() {
 		fmt.Println("\n=== CrowdSec Install ===")
 		// check if crowdsec is installed
 		if readBool("Would you like to install CrowdSec?", false) {
@@ -490,17 +480,6 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Basic Configuration ===")

 	config.IsEnterprise = readBoolNoDefault("Do you want to install the Enterprise version of Pangolin? The EE is free for personal use or for businesses making less than 100k USD annually.")
-    if config.IsEnterprise {
-        config.IsRedis = readBool("Do you want to run the Redis containers locally? Required for HA.")
-        if config.IsRedis {
-            config.IsRedisPass = readPassword("Enter a unique password for the Redis service.")
-        }
-    }
-
-    config.IsPostgreSQL = readBool("Do you want to run the PostgreSQL containers locally? Otherwise, default to the local SQLite database only.", false)
-	if config.IsPostgreSQL {
-		config.IsPostgreSQLPass = readPassword("Enter a unique password for the PostgreSQL pangolin user.")
-	}

 	config.BaseDomain = readString("Enter your base domain (no subdomain e.g. example.com)", "")

@@ -544,7 +523,7 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Advanced Configuration ===")

 	config.EnableIPv6 = readBool("Is your server IPv6 capable?", true)
-	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ADN databases for blocking functionality?", true)
+	config.EnableGeoblocking = readBool("Do you want to download the MaxMind GeoLite2 database for geoblocking functionality?", true)

 	if config.DashboardDomain == "" {
 		fmt.Println("Error: Dashboard Domain name is required")
@@ -797,42 +776,29 @@ func checkPortsAvailable(port int) error {
 }

 func downloadMaxMindDatabase() error {
-	fmt.Println("Downloading MaxMind GeoLite2 Country and ASN databases...")
+	fmt.Println("Downloading MaxMind GeoLite2 Country database...")

-	// Download the GeoLite2 Country databases
+	// Download the GeoLite2 Country database
 	if err := run("curl", "-L", "-o", "GeoLite2-Country.tar.gz",
 		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to download GeoLite2 Country database: %v", err)
-	}
-	if err := run("curl", "-L", "-o", "GeoLite2-ASN.tar.gz",
-		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-ASN.tar.gz"); err != nil {
-		return fmt.Errorf("failed to download GeoLite2 ASN database: %v", err)
+		return fmt.Errorf("failed to download GeoLite2 database: %v", err)
 	}

-	// Extract the Country database
+	// Extract the database
 	if err := run("tar", "-xzf", "GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to extract GeoLite2 Country database: %v", err)
-	}
-	if err := run("tar", "-xzf", "GeoLite2-ASN.tar.gz"); err != nil {
-		return fmt.Errorf("failed to extract GeoLite2 ASN database: %v", err)
+		return fmt.Errorf("failed to extract GeoLite2 database: %v", err)
 	}

 	// Find the .mmdb file and move it to the config directory
 	if err := run("bash", "-c", "mv GeoLite2-Country_*/GeoLite2-Country.mmdb config/"); err != nil {
-		return fmt.Errorf("failed to move GeoLite2 Country database to config directory: %v", err)
-	}
-	if err := run("bash", "-c", "mv GeoLite2-ASN_*/GeoLite2-ASN.mmdb config/"); err != nil {
-		return fmt.Errorf("failed to move GeoLite2 ASN database to config directory: %v", err)
+		return fmt.Errorf("failed to move GeoLite2 database to config directory: %v", err)
 	}

 	// Clean up the downloaded files
-	if err := run("sh", "-c", "rm -rf GeoLite2-Country.tar.gz GeoLite2-Country_*"); err != nil {
-		fmt.Printf("Warning: failed to clean up temporary country files: %v\n", err)
-	}
-	if err := run("sh", "-c", "rm -rf GeoLite2-ASN.tar.gz GeoLite2-ASN_*"); err != nil {
-		fmt.Printf("Warning: failed to clean up temporary ASN files: %v\n", err)
+	if err := run("rm", "-rf", "GeoLite2-Country.tar.gz", "GeoLite2-Country_*"); err != nil {
+		fmt.Printf("Warning: failed to clean up temporary files: %v\n", err)
 	}

-	fmt.Println("MaxMind GeoLite2 Country and ASN database downloaded successfully!")
+	fmt.Println("MaxMind GeoLite2 Country database downloaded successfully!")
 	return nil
 }
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -630,7 +630,7 @@
    "createdAt": "Създаден на",
    "proxyErrorInvalidHeader": "Невалидна стойност за заглавие на хоста. Използвайте формат на име на домейн, или оставете празно поле за да премахнете персонализирано заглавие на хост.",
    "proxyErrorTls": "Невалидно име на TLS сървър. Използвайте формат на име на домейн, или оставете празно за да премахнете името на TLS сървъра.",
-    "proxyEnableSSL": "Активиране на TLS",
+    "proxyEnableSSL": "Активиране на SSL",
    "proxyEnableSSLDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целите.",
    "target": "Цел",
    "configureTarget": "Конфигуриране на цели",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Метод",
-    "editInternalResourceDialogEnableSsl": "Активирайте TLS",
+    "editInternalResourceDialogEnableSsl": "Активирайте SSL",
    "editInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
    "editInternalResourceDialogDestination": "Дестинация",
    "editInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Метод",
    "createInternalResourceDialogScheme": "Метод",
-    "createInternalResourceDialogEnableSsl": "Активирайте TLS",
+    "createInternalResourceDialogEnableSsl": "Активирайте SSL",
    "createInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
    "createInternalResourceDialogDestination": "Дестинация",
    "createInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2235,7 +2233,7 @@
        "description": "По-надежден и по-нисък поддръжка на Самостоятелно-хостван Панголиин сървър с допълнителни екстри",
        "introTitle": "Управлявано Самостоятелно-хостван Панголиин",
        "introDescription": "е опция за внедряване, предназначена за хора, които искат простота и допълнителна надеждност, като същевременно запазят данните си частни и самостоятелно-хоствани.",
-        "introDetail": "С тази опция все още управлявате свой собствен Панголиин възел - вашите тунели, TLS терминатора и трафик остават на вашия сървър. Разликата е, че управлението и мониторингът се обработват чрез нашия облачен панел за контрол, който отключва редица предимства:",
+        "introDetail": "С тази опция все още управлявате свой собствен Панголиин възел - вашите тунели, SSL терминатора и трафик остават на вашия сървър. Разликата е, че управлението и мониторингът се обработват чрез нашия облачен панел за контрол, който отключва редица предимства:",
        "benefitSimplerOperations": {
            "title": "По-прости операции",
            "description": "Няма нужда да управлявате свой собствен имейл сървър или да настройвате сложни аларми. Ще получите проверки и предупреждения при прекъсване от самото начало."
@@ -3138,7 +3136,7 @@
    "httpDestNamePlaceholder": "Моята HTTP дестинация",
    "httpDestUrlLabel": "Дестинация URL",
    "httpDestUrlErrorHttpRequired": "URL адресът трябва да използва http или https",
-    "httpDestUrlErrorHttpsRequired": "HTTPS е необходимо за облачни инсталации",
+    "httpDestUrlErrorHttpsRequired": "SSL е необходимо за облачни инсталации",
    "httpDestUrlErrorInvalid": "Въведете валиден URL (напр. https://example.com/webhook)",
    "httpDestAuthTitle": "Удостоверяване",
    "httpDestAuthDescription": "Изберете как заявленията ви се удостоверяват.",
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -630,7 +630,7 @@
    "createdAt": "Vytvořeno v",
    "proxyErrorInvalidHeader": "Neplatná hodnota hlavičky hostitele. Použijte formát názvu domény, nebo uložte prázdné pro zrušení vlastního hlavičky hostitele.",
    "proxyErrorTls": "Neplatné jméno TLS serveru. Použijte formát doménového jména nebo uložte prázdné pro odstranění názvu TLS serveru.",
-    "proxyEnableSSL": "Povolit TLS",
+    "proxyEnableSSL": "Povolit SSL",
    "proxyEnableSSLDescription": "Povolit šifrování SSL/TLS pro zabezpečená připojení HTTPS k cílům.",
    "target": "Target",
    "configureTarget": "Konfigurace cílů",
@@ -2049,7 +2049,6 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schéma",
    "editInternalResourceDialogEnableSsl": "Povolit SSL",
    "editInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
@@ -2099,7 +2098,6 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schéma",
    "createInternalResourceDialogScheme": "Schéma",
    "createInternalResourceDialogEnableSsl": "Povolit SSL",
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -22,11 +22,11 @@
    "componentsMember": "Du bist Mitglied von {count, plural, =0 {keiner Organisation} one {einer Organisation} other {# Organisationen}}.",
    "componentsInvalidKey": "Ungültige oder abgelaufene Lizenzschlüssel erkannt. Beachte die Lizenzbedingungen, um alle Funktionen weiterhin zu nutzen.",
    "dismiss": "Verwerfen",
-    "subscriptionViolationMessage": "Sie überschreiten Ihre Grenzen für Ihr aktuelles Paket. Korrigieren Sie das Problem, indem Sie Standorte, Benutzer oder andere Ressourcen entfernen, um in Ihrem Paket zu bleiben.",
+    "subscriptionViolationMessage": "Sie überschreiten Ihre Grenzen für Ihr aktuelles Paket. Korrigieren Sie das Problem, indem Sie Webseiten, Benutzer oder andere Ressourcen entfernen, um in Ihrem Paket zu bleiben.",
    "trialBannerMessage": "Ihre Testversion läuft in {countdown} ab. Upgraden, um den Zugriff zu behalten.",
    "trialBannerExpired": "Ihre Testversion ist abgelaufen. Jetzt upgraden, um den Zugriff wiederherzustellen.",
    "billingTrialBannerTitle": "Kostenlose Testversion aktiv",
-    "billingTrialBannerDescription": "Sie nutzen derzeit eine kostenlose Testversion auf der Business-Tarif. Wenn die Testversion endet, wird Ihr Konto automatisch auf die Funktionen und Beschränkungen der Basis-Tarif zurückgesetzt. Upgraden Sie jederzeit, um weiterhin Zugriff auf die Funktionen Ihres aktuellen Plans zu behalten.",
+    "billingTrialBannerDescription": "Sie nutzen derzeit eine kostenlose Testversion auf der Geschäftsstufe. Wenn die Testversion endet, wird Ihr Konto automatisch auf die Funktionen und Beschränkungen der Basisstufe zurückgesetzt. Upgraden Sie jederzeit, um weiterhin Zugriff auf die Funktionen Ihres aktuellen Plans zu behalten.",
    "billingTrialBannerUpgrade": "Jetzt upgraden",
    "billingTrialBadge": "Kostenlose Testversion",
    "trialActive": "Kostenlose Testversion aktiv",
@@ -34,8 +34,8 @@
    "trialHasEnded": "Ihre Testversion ist beendet.",
    "trialDaysRemaining": "{count, plural, one {# Tag übrig} other {# Tage übrig}}",
    "trialDaysLeftShort": "Noch {days}d in der Testversion",
-    "trialGoToBilling": "Zur Abrechnung gehen",
-    "subscriptionViolationViewBilling": "Abrechnung anzeigen",
+    "trialGoToBilling": "Zur Rechnungsseite gehen",
+    "subscriptionViolationViewBilling": "Rechnung anzeigen",
    "componentsLicenseViolation": "Lizenzverstoß: Dieser Server benutzt {usedSites} Standorte, was das Lizenzlimit von {maxSites} Standorten überschreitet. Beachte die Lizenzbedingungen, um alle Funktionen weiterhin zu nutzen.",
    "componentsSupporterMessage": "Vielen Dank für die Unterstützung von Pangolin als {tier}!",
    "inviteErrorNotValid": "Es tut uns leid, aber es sieht so aus, als wäre die Einladung, auf die du zugreifen möchtest, entweder nicht angenommen worden oder nicht mehr gültig.",
@@ -67,7 +67,7 @@
    "edit": "Bearbeiten",
    "siteConfirmDelete": "Löschen des Standorts bestätigen",
    "siteDelete": "Standort löschen",
-    "siteMessageRemove": "Sobald der Standort entfernt ist, wird er nicht mehr zugänglich sein. Alle mit dem Standort verbundenen Ziele werden ebenfalls entfernt.",
+    "siteMessageRemove": "Sobald der Standort entfernt ist, wird sie nicht mehr zugänglich sein. Alle mit dem Standort verbundenen Ziele werden ebenfalls entfernt.",
    "siteQuestionRemove": "Sind Sie sicher, dass Sie den Standort aus der Organisation entfernen möchten?",
    "siteManageSites": "Standorte verwalten",
    "siteDescription": "Erstellen und Verwalten von Standorten, um die Verbindung zu privaten Netzwerken zu ermöglichen",
@@ -117,20 +117,20 @@
    "siteGeneralDescription": "Allgemeine Einstellungen für diesen Standort konfigurieren",
    "siteSettingDescription": "Standorteinstellungen konfigurieren",
    "siteResourcesTab": "Ressourcen",
-    "siteResourcesNoneOnSite": "Dieser Standort hat noch keine öffentlichen oder privaten Ressourcen",
+    "siteResourcesNoneOnSite": "Diese Seite hat noch keine öffentlichen oder privaten Ressourcen.",
    "siteResourcesSectionPublic": "Öffentliche Ressourcen",
    "siteResourcesSectionPrivate": "Private Ressourcen",
    "siteResourcesSectionPublicDescription": "Ressourcen, die extern über Domains oder Ports bereitgestellt werden.",
-    "siteResourcesSectionPrivateDescription": "Ressourcen, die in Ihrem privaten Netzwerk über den Standort verfügbar sind.",
+    "siteResourcesSectionPrivateDescription": "Ressourcen, die in Ihrem privaten Netzwerk über die Seite verfügbar sind.",
    "siteResourcesViewAllPublic": "Alle Ressourcen anzeigen",
    "siteResourcesViewAllPrivate": "Alle Ressourcen anzeigen",
-    "siteResourcesDialogDescription": "Überblick über öffentliche und private Ressourcen, die mit diesem Standort verbunden sind.",
+    "siteResourcesDialogDescription": "Überblick über öffentliche und private Ressourcen, die mit dieser Seite verbunden sind.",
    "siteResourcesShowMore": "Mehr anzeigen",
    "siteResourcesPermissionDenied": "Sie haben keine Berechtigung, diese Ressourcen aufzulisten.",
-    "siteResourcesEmptyPublic": "Noch sind keine öffentlichen Ressourcen für diesen Standort vorhanden.",
-    "siteResourcesEmptyPrivate": "Noch sind keine privaten Ressourcen mit diesem Standort verbunden.",
+    "siteResourcesEmptyPublic": "Noch sind keine öffentlichen Ressourcen für diese Seite vorhanden.",
+    "siteResourcesEmptyPrivate": "Noch sind keine privaten Ressourcen mit dieser Seite verbunden.",
    "siteResourcesHowToAccess": "Zugriffsmöglichkeiten",
-    "siteResourcesTargetsOnSite": "Ziele an diesem Standort",
+    "siteResourcesTargetsOnSite": "Ziele auf dieser Seite",
    "siteSetting": "{siteName} Einstellungen",
    "siteNewtTunnel": "Newt Standort (empfohlen)",
    "siteNewtTunnelDescription": "Einfachster Weg, einen Einstiegspunkt in jedes Netzwerk zu erstellen. Keine zusätzliche Einrichtung.",
@@ -148,10 +148,10 @@
    "siteCredentialsSaveDescription": "Du kannst das nur einmal sehen. Stelle sicher, dass du es an einen sicheren Ort kopierst.",
    "siteInfo": "Standortinformationen",
    "status": "Status",
-    "shareTitle": "Freigabelinks verwalten",
+    "shareTitle": "Links zum Teilen verwalten",
    "shareDescription": "Erstelle teilbare Links, um temporären oder permanenten Zugriff auf Proxy-Ressourcen zu gewähren",
-    "shareSearch": "Freigabelinks suchen...",
-    "shareCreate": "Freigabelink erstellen",
+    "shareSearch": "Freigabe-Links suchen...",
+    "shareCreate": "Link erstellen",
    "shareErrorDelete": "Link konnte nicht gelöscht werden",
    "shareErrorDeleteMessage": "Fehler beim Löschen des Links",
    "shareDeleted": "Link gelöscht",
@@ -161,7 +161,7 @@
    "shareQuestionRemove": "Sind Sie sicher, dass Sie diesen Freigabelink löschen möchten?",
    "shareMessageRemove": "Nach dem Löschen funktioniert der Link nicht mehr, und jeder, der ihn nutzt, verliert den Zugriff auf die Ressource.",
    "shareTokenDescription": "Das Zugriffstoken kann auf zwei Arten übergeben werden: als Abfrageparameter oder in den Request-Headern. Diese müssen vom Client auf jeder Anfrage für authentifizierten Zugriff weitergegeben werden.",
-    "accessToken": "Zugriffstoken",
+    "accessToken": "Zugangs-Token",
    "usageExamples": "Nutzungsbeispiele",
    "tokenId": "Token-ID",
    "requestHeades": "Anfrage-Header",
@@ -172,12 +172,12 @@
    "shareTokenSecurety": "Bewahren Sie das Zugriffstoken sicher. Teilen Sie es nicht in öffentlich zugänglichen Bereichen oder Client-seitigem Code.",
    "shareErrorFetchResource": "Fehler beim Abrufen der Ressourcen",
    "shareErrorFetchResourceDescription": "Beim Abrufen der Ressourcen ist ein Fehler aufgetreten",
-    "shareErrorCreate": "Fehler beim Erstellen des Freigabelinks",
-    "shareErrorCreateDescription": "Beim Erstellen des Freigabelinks ist ein Fehler aufgetreten",
+    "shareErrorCreate": "Fehler beim Erstellen des Teilen-Links",
+    "shareErrorCreateDescription": "Beim Erstellen des Teilen-Links ist ein Fehler aufgetreten",
    "shareCreateDescription": "Jeder mit diesem Link kann auf die Ressource zugreifen",
    "shareTitleOptional": "Titel (optional)",
-    "expireIn": "Läuft ab in",
-    "neverExpire": "Läuft nie ab",
+    "expireIn": "Verfällt in",
+    "neverExpire": "Nie ablaufen",
    "shareExpireDescription": "Ablaufzeit ist, wie lange der Link verwendet werden kann und bietet Zugriff auf die Ressource. Nach dieser Zeit wird der Link nicht mehr funktionieren und Benutzer, die diesen Link benutzt haben, verlieren den Zugriff auf die Ressource.",
    "shareSeeOnce": "Sie können diesen Link nur einmal sehen. Bitte kopieren Sie ihn.",
    "shareAccessHint": "Jeder mit diesem Link kann auf die Ressource zugreifen. Teilen Sie sie mit Vorsicht.",
@@ -186,7 +186,7 @@
    "resourcesNotFound": "Keine Ressourcen gefunden",
    "resourceSearch": "Suche Ressourcen",
    "machineSearch": "Maschinen suchen",
-    "machinesSearch": "Maschinen-Clients suchen",
+    "machinesSearch": "Suche Maschinen-Klienten...",
    "machineNotFound": "Keine Maschinen gefunden",
    "userDeviceSearch": "Benutzergeräte durchsuchen",
    "userDevicesSearch": "Benutzergeräte durchsuchen...",
@@ -203,7 +203,7 @@
    "proxyResourcesBannerDescription": "Öffentliche Ressourcen sind HTTPS oder TCP/UDP-Proxys, die über einen Webbrowser für jeden zugänglich sind. Im Gegensatz zu privaten Ressourcen benötigen sie keine Client-seitige Software und können Identitäts- und kontextbezogene Zugriffsrichtlinien beinhalten.",
    "clientResourceTitle": "Private Ressourcen verwalten",
    "clientResourceDescription": "Erstelle und verwalte Ressourcen, die nur über einen verbundenen Client zugänglich sind",
-    "privateResourcesBannerTitle": "Zero-Trust-Zugriff auf private Ressourcen",
+    "privateResourcesBannerTitle": "Zero-Trust Privater Zugang",
    "privateResourcesBannerDescription": "Private Ressourcen nutzen Zero-Trust und stellen sicher, dass Benutzer und Maschinen nur auf Ressourcen zugreifen können, die Sie explizit gewähren. Verbinden Sie Benutzergeräte oder Maschinen-Clients, um auf diese Ressourcen über ein sicheres virtuelles privates Netzwerk zuzugreifen.",
    "resourcesSearch": "Suche Ressourcen...",
    "resourceAdd": "Ressource hinzufügen",
@@ -265,7 +265,7 @@
    "rules": "Regeln",
    "resourceSettingDescription": "Einstellungen für die Ressource konfigurieren",
    "resourceSetting": "{resourceName} Einstellungen",
-    "alwaysAllow": "Authentifizierung umgehen",
+    "alwaysAllow": "Auth umgehen",
    "alwaysDeny": "Zugriff blockieren",
    "passToAuth": "Weiterleiten zur Authentifizierung",
    "orgSettingsDescription": "Organisationseinstellungen konfigurieren",
@@ -274,7 +274,7 @@
    "saveGeneralSettings": "Allgemeine Einstellungen speichern",
    "saveSettings": "Einstellungen speichern",
    "orgDangerZone": "Gefahrenzone",
-    "orgDangerZoneDescription": "Sobald Sie diese Organisation löschen, gibt es kein Zurück mehr. Bitte seien Sie vorsichtig.",
+    "orgDangerZoneDescription": "Sobald Sie diesen Org löschen, gibt es kein Zurück mehr. Bitte seien Sie vorsichtig.",
    "orgDelete": "Organisation löschen",
    "orgDeleteConfirm": "Organisation löschen bestätigen",
    "orgMessageRemove": "Diese Aktion ist unwiderruflich und löscht alle zugehörigen Daten.",
@@ -323,7 +323,7 @@
    "accessApprovalsManage": "Genehmigungen verwalten",
    "accessApprovalsDescription": "Zeige und verwalte ausstehende Genehmigungen für den Zugriff auf diese Organisation",
    "description": "Beschreibung",
-    "inviteTitle": "Offene Einladungen",
+    "inviteTitle": "Einladungen öffnen",
    "inviteDescription": "Einladungen für andere Benutzer verwalten, der Organisation beizutreten",
    "inviteSearch": "Einladungen suchen...",
    "minutes": "Minuten",
@@ -370,12 +370,12 @@
    "apiKeysDescription": "API-Schlüssel werden zur Authentifizierung mit der Integrations-API verwendet",
    "provisioningKeysTitle": "Bereitstellungsschlüssel",
    "provisioningKeysManage": "Bereitstellungsschlüssel verwalten",
-    "provisioningKeysDescription": "Bereitstellungsschlüssel werden verwendet, um die automatisierte Bereitstellung von Standorten für Ihr Unternehmen zu authentifizieren.",
+    "provisioningKeysDescription": "Bereitstellungsschlüssel werden verwendet, um die automatisierte Bereitstellung von Seiten für Ihr Unternehmen zu authentifizieren.",
    "provisioningManage": "Bereitstellung",
-    "provisioningDescription": "Bereitstellungsschlüssel verwalten und ausstehende Standorte prüfen, die noch auf Genehmigung warten.",
-    "pendingSites": "Ausstehende Standorte",
-    "siteApproveSuccess": "Standort erfolgreich freigegeben",
-    "siteApproveError": "Fehler beim Genehmigen des Standorts",
+    "provisioningDescription": "Bereitstellungsschlüssel verwalten und ausstehende Seiten prüfen, die noch auf Genehmigung warten.",
+    "pendingSites": "Ausstehende Seiten",
+    "siteApproveSuccess": "Site erfolgreich freigegeben",
+    "siteApproveError": "Fehler beim Bestätigen der Seite",
    "provisioningKeys": "Bereitstellungsschlüssel",
    "searchProvisioningKeys": "Bereitstellungsschlüssel suchen...",
    "provisioningKeysAdd": "Bereitstellungsschlüssel generieren",
@@ -405,7 +405,7 @@
    "provisioningKeysNeverUsed": "Nie",
    "provisioningKeysEdit": "Bereitstellungsschlüssel bearbeiten",
    "provisioningKeysEditDescription": "Aktualisieren Sie die maximale Batch-Größe und Ablaufzeit für diesen Schlüssel.",
-    "provisioningKeysApproveNewSites": "Neuen Standort genehmigen",
+    "provisioningKeysApproveNewSites": "Neue Seiten genehmigen",
    "provisioningKeysApproveNewSitesDescription": "Sites, die sich mit diesem Schlüssel registrieren, automatisch freigeben.",
    "provisioningKeysUpdateError": "Fehler beim Aktualisieren des Bereitstellungsschlüssels",
    "provisioningKeysUpdated": "Bereitstellungsschlüssel aktualisiert",
@@ -413,8 +413,8 @@
    "provisioningKeysBannerTitle": "Website-Bereitstellungsschlüssel",
    "provisioningKeysBannerDescription": "Generieren Sie einen Bereitstellungsschlüssel und verwenden Sie ihn mit dem Newt-Connector, um Standorte beim ersten Start automatisch zu erstellen - keine Notwendigkeit, separate Anmeldedaten für jede Seite einzurichten.",
    "provisioningKeysBannerButtonText": "Mehr erfahren",
-    "pendingSitesBannerTitle": "Ausstehende Standorte",
-    "pendingSitesBannerDescription": "Standorte, die mit einem Bereitstellungsschlüssel verbunden sind, erscheinen hier zur Überprüfung.",
+    "pendingSitesBannerTitle": "Ausstehende Seiten",
+    "pendingSitesBannerDescription": "Websites, die mit einem Bereitstellungsschlüssel verbunden sind, erscheinen hier zur Überprüfung.",
    "pendingSitesBannerButtonText": "Mehr erfahren",
    "apiKeysSettings": "{apiKeyName} Einstellungen",
    "userTitle": "Alle Benutzer verwalten",
@@ -461,7 +461,7 @@
    "licenseActivateKeyDescription": "Geben Sie einen Lizenzschlüssel ein, um ihn zu aktivieren.",
    "licenseActivate": "Lizenz aktivieren",
    "licenseAgreement": "Durch Ankreuzung dieses Kästchens bestätigen Sie, dass Sie die Lizenzbedingungen gelesen und akzeptiert haben, die mit dem Lizenzschlüssel in Verbindung stehen.",
-    "fossorialLicense": "Kommerzielle Fossorial-Lizenz und Abonnementbedingungen anzeigen",
+    "fossorialLicense": "Fossorial Gewerbelizenz & Abonnementbedingungen anzeigen",
    "licenseMessageRemove": "Dadurch werden der Lizenzschlüssel und alle zugehörigen Berechtigungen entfernt.",
    "licenseMessageConfirm": "Um zu bestätigen, geben Sie bitte den Lizenzschlüssel unten ein.",
    "licenseQuestionRemove": "Sind Sie sicher, dass Sie den Lizenzschlüssel löschen möchten?",
@@ -481,7 +481,7 @@
    "licensePurchaseSites": "Zusätzliche Standorte kaufen\n",
    "licenseSitesUsedMax": "{usedSites} von {maxSites} Standorten verwendet",
    "licenseSitesUsed": "{count, plural, =0 {# Standorte} one {# Standort} other {# Standorte}} im System.",
-    "licensePurchaseDescription": "Wähle aus, für wie viele Standorte du möchtest {selectedMode, select, license {kaufe eine Lizenz. Du kannst später immer weitere Standorte hinzufügen.} other {Füge zu deiner bestehenden Lizenz hinzu.}}",
+    "licensePurchaseDescription": "Wähle aus, für wieviele Seiten du möchtest {selectedMode, select, license {kaufe eine Lizenz. Du kannst später immer weitere Seiten hinzufügen.} other {Füge zu deiner bestehenden Lizenz hinzu.}}",
    "licenseFee": "Lizenzgebühr",
    "licensePriceSite": "Preis pro Standort",
    "total": "Gesamt",
@@ -532,7 +532,7 @@
    "userRemoveOrgConfirmSelf": "Entfernung bestätigen",
    "userRemoveOrgSelf": "Sich selbst aus der Organisation entfernen",
    "userRemoveOrgSelfWarning": "Sie verlieren sofort den Zugriff auf diese Organisation.",
-    "userRemoveOrgConfirmPhraseSelf": "MICH SELBST AUS DER ORGANISATION ENTFERNEN",
+    "userRemoveOrgConfirmPhraseSelf": "ENTFERNUNG MICH SELBST AUS DER ORGANISATION",
    "users": "Benutzer",
    "accessRoleMember": "Mitglied",
    "accessRoleOwner": "Eigentümer",
@@ -630,7 +630,7 @@
    "createdAt": "Erstellt am",
    "proxyErrorInvalidHeader": "Ungültiger benutzerdefinierter Host-Header-Wert. Verwenden Sie das Domain-Namensformat oder speichern Sie leer, um den benutzerdefinierten Host-Header zu deaktivieren.",
    "proxyErrorTls": "Ungültiger TLS-Servername. Verwenden Sie das Domain-Namensformat oder speichern Sie leer, um den TLS-Servernamen zu entfernen.",
-    "proxyEnableSSL": "TLS aktivieren",
+    "proxyEnableSSL": "SSL aktivieren",
    "proxyEnableSSLDescription": "Aktiviere SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zu den Zielen.",
    "target": "Ziel",
    "configureTarget": "Ziele konfigurieren",
@@ -1711,11 +1711,11 @@
    "regionSelectorComingSoon": "Kommt bald",
    "billingLoadingSubscription": "Abonnement wird geladen...",
    "billingFreeTier": "Kostenlose Stufe",
-    "billingWarningOverLimit": "Warnung: Sie haben ein oder mehrere Nutzungslimits überschritten. Ihre Standorte werden nicht verbunden, bis Sie Ihr Abonnement ändern oder Ihren Verbrauch anpassen.",
+    "billingWarningOverLimit": "Warnung: Sie haben ein oder mehrere Nutzungslimits überschritten. Ihre Webseiten werden nicht verbunden, bis Sie Ihr Abonnement ändern oder Ihren Verbrauch anpassen.",
    "billingUsageLimitsOverview": "Übersicht über Nutzungsgrenzen",
    "billingMonitorUsage": "Überwachen Sie Ihren Verbrauch im Vergleich zu konfigurierten Grenzwerten. Wenn Sie eine Erhöhung der Limits benötigen, kontaktieren Sie uns bitte support@pangolin.net.",
    "billingDataUsage": "Datenverbrauch",
-    "billingSites": "Standorte",
+    "billingSites": "Seiten",
    "billingUsers": "Benutzergeräte",
    "billingDomains": "Domänen",
    "billingOrganizations": "Orden",
@@ -1743,7 +1743,7 @@
    "billingCheckoutError": "Checkout-Fehler",
    "billingFailedToGetPortalUrl": "Fehler beim Abrufen der Portal-URL",
    "billingPortalError": "Portalfehler",
-    "billingDataUsageInfo": "Wenn Sie mit der Cloud verbunden sind, werden alle Daten über Ihre sicheren Tunnel belastet. Dies schließt eingehenden und ausgehenden Datenverkehr über alle Ihre Standorte ein. Wenn Sie Ihr Limit erreichen, werden Ihre Standorte die Verbindung trennen, bis Sie Ihr Paket upgraden oder die Nutzung verringern. Daten werden nicht belastet, wenn Sie Knoten verwenden.",
+    "billingDataUsageInfo": "Wenn Sie mit der Cloud verbunden sind, werden alle Daten über Ihre sicheren Tunnel belastet. Dies schließt eingehenden und ausgehenden Datenverkehr über alle Ihre Websites ein. Wenn Sie Ihr Limit erreichen, werden Ihre Seiten die Verbindung trennen, bis Sie Ihr Paket upgraden oder die Nutzung verringern. Daten werden nicht belastet, wenn Sie Knoten verwenden.",
    "billingSInfo": "Anzahl der Sites die Sie verwenden können",
    "billingUsersInfo": "Wie viele Benutzer Sie verwenden können",
    "billingDomainInfo": "Wie viele Domains Sie verwenden können",
@@ -1927,7 +1927,7 @@
    "configureHealthCheck": "Gesundheits-Check konfigurieren",
    "configureHealthCheckDescription": "Richten Sie die Gesundheitsüberwachung für {target} ein",
    "enableHealthChecks": "Gesundheits-Checks aktivieren",
-    "healthCheckDisabledStateDescription": "Wenn deaktiviert, führt der Standort keine Gesundheitsprüfungen durch und der Zustand wird als unbekannt betrachtet.",
+    "healthCheckDisabledStateDescription": "Wenn deaktiviert, führt die Seite keine Gesundheitsprüfungen durch und der Zustand wird als unbekannt betrachtet.",
    "enableHealthChecksDescription": "Überwachen Sie die Gesundheit dieses Ziels. Bei Bedarf können Sie einen anderen Endpunkt als das Ziel überwachen.",
    "healthScheme": "Methode",
    "healthSelectScheme": "Methode auswählen",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schema",
-    "editInternalResourceDialogEnableSsl": "TLS aktivieren",
+    "editInternalResourceDialogEnableSsl": "SSL aktivieren",
    "editInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
    "editInternalResourceDialogDestination": "Ziel",
    "editInternalResourceDialogDestinationHostDescription": "Die IP-Adresse oder der Hostname der Ressource im Netzwerk der Website.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schema",
    "createInternalResourceDialogScheme": "Schema",
-    "createInternalResourceDialogEnableSsl": "TLS aktivieren",
+    "createInternalResourceDialogEnableSsl": "SSL aktivieren",
    "createInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
    "createInternalResourceDialogDestination": "Ziel",
    "createInternalResourceDialogDestinationHostDescription": "Die IP-Adresse oder der Hostname der Ressource im Netzwerk der Website.",
@@ -2189,8 +2187,8 @@
        }
    },
    "remoteExitNodeSelection": "Knotenauswahl",
-    "remoteExitNodeSelectionDescription": "Wählen Sie einen Knoten aus, durch den Traffic für diesen lokalen Standort geleitet werden soll",
-    "remoteExitNodeRequired": "Ein Knoten muss für lokale Standorte ausgewählt sein",
+    "remoteExitNodeSelectionDescription": "Wählen Sie einen Knoten aus, durch den Traffic für diese lokale Seite geleitet werden soll",
+    "remoteExitNodeRequired": "Ein Knoten muss für lokale Seiten ausgewählt sein",
    "noRemoteExitNodesAvailable": "Keine Knoten verfügbar",
    "noRemoteExitNodesAvailableDescription": "Für diese Organisation sind keine Knoten verfügbar. Erstellen Sie zuerst einen Knoten, um lokale Standorte zu verwenden.",
    "exitNode": "Exit-Node",
@@ -2235,7 +2233,7 @@
        "description": "Zuverlässiger und wartungsarmer Pangolin Server mit zusätzlichen Glocken und Pfeifen",
        "introTitle": "Verwalteter selbstgehosteter Pangolin",
        "introDescription": "ist eine Deployment-Option, die für Personen konzipiert wurde, die Einfachheit und zusätzliche Zuverlässigkeit wünschen, während sie ihre Daten privat und selbstgehostet halten.",
-        "introDetail": "Mit dieser Option haben Sie immer noch Ihren eigenen Pangolin-Knoten – Ihre Tunnel, TLS-Terminierung und Traffic bleiben auf Ihrem Server. Der Unterschied besteht darin, dass Verwaltung und Überwachung über unser Cloud-Dashboard abgewickelt werden, das eine Reihe von Vorteilen freischaltet:",
+        "introDetail": "Mit dieser Option haben Sie immer noch Ihren eigenen Pangolin-Knoten – Ihre Tunnel, SSL-Terminierung und Traffic bleiben auf Ihrem Server. Der Unterschied besteht darin, dass Verwaltung und Überwachung über unser Cloud-Dashboard abgewickelt werden, das eine Reihe von Vorteilen freischaltet:",
        "benefitSimplerOperations": {
            "title": "Einfachere Operationen",
            "description": "Sie brauchen keinen eigenen Mail-Server auszuführen oder komplexe Warnungen einzurichten. Sie erhalten Gesundheitschecks und Ausfallwarnungen aus dem Box."
@@ -3237,7 +3235,7 @@
    "uptimeAddAlert": "Warnmeldung hinzufügen",
    "uptimeViewAlerts": "Warnungen anzeigen",
    "uptimeCreateEmailAlert": "E-Mail Alarm erstellen",
-    "uptimeAlertDescriptionSite": "Werde per E-Mail benachrichtigt, wenn dieser Standort offline oder wieder online ist.",
+    "uptimeAlertDescriptionSite": "Werde per E-Mail benachrichtigt, wenn diese Seite offline oder wieder online ist.",
    "uptimeAlertDescriptionResource": "Werde per E-Mail benachrichtigt, wenn diese Ressource offline oder wieder online ist.",
    "uptimeAlertNamePlaceholder": "Alarmname",
    "uptimeAdditionalEmails": "Zusätzliche E-Mails",
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -176,7 +176,6 @@
    "shareErrorCreateDescription": "An error occurred while creating the share link",
    "shareCreateDescription": "Anyone with this link can access the resource",
    "shareTitleOptional": "Title (optional)",
-    "sharePathOptional": "Path (optional)",
    "expireIn": "Expire In",
    "neverExpire": "Never expire",
    "shareExpireDescription": "Expiration time is how long the link will be usable and provide access to the resource. After this time, the link will no longer work, and users who used this link will lose access to the resource.",
@@ -209,33 +208,11 @@
    "resourcesSearch": "Search resources...",
    "resourceAdd": "Add Resource",
    "resourceErrorDelte": "Error deleting resource",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
    "authentication": "Authentication",
    "protected": "Protected",
    "notProtected": "Not Protected",
    "resourceMessageRemove": "Once removed, the resource will no longer be accessible. All targets associated with the resource will also be removed.",
    "resourceQuestionRemove": "Are you sure you want to remove the resource from the organization?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
    "resourceHTTP": "HTTPS Resource",
    "resourceHTTPDescription": "Proxy requests over HTTPS using a fully qualified domain name.",
    "resourceRaw": "Raw TCP/UDP Resource",
@@ -243,9 +220,8 @@
    "resourceRawDescriptionCloud": "Proxy requests over raw TCP/UDP using a port number. Requires sites to connect to a remote node.",
    "resourceCreate": "Create Resource",
    "resourceCreateDescription": "Follow the steps below to create a new resource",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
    "resourceSeeAll": "See All Resources",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Resource Information",
    "resourceNameDescription": "This is the display name for the resource.",
    "siteSelect": "Select site",
    "siteSearch": "Search site",
@@ -255,15 +231,12 @@
    "noCountryFound": "No country found.",
    "siteSelectionDescription": "This site will provide connectivity to the target.",
    "resourceType": "Resource Type",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Determine how to access the resource",
    "resourceHTTPSSettings": "HTTPS Settings",
    "resourceHTTPSSettingsDescription": "Configure how the resource will be accessed over HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
    "domainType": "Domain Type",
    "subdomain": "Subdomain",
    "baseDomain": "Base Domain",
-    "configure": "Configure",
    "subdomnainDescription": "The subdomain where the resource will be accessible.",
    "resourceRawSettings": "TCP/UDP Settings",
    "resourceRawSettingsDescription": "Configure how the resource will be accessed over TCP/UDP",
@@ -280,27 +253,8 @@
    "resourceLearnRaw": "Learn how to configure TCP/UDP resources",
    "resourceBack": "Back to Resources",
    "resourceGoTo": "Go to Resource",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
    "resourceDelete": "Delete Resource",
    "resourceDeleteConfirm": "Confirm Delete Resource",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
    "visibility": "Visibility",
    "enabled": "Enabled",
    "disabled": "Disabled",
@@ -311,8 +265,6 @@
    "rules": "Rules",
    "resourceSettingDescription": "Configure the settings on the resource",
    "resourceSetting": "{resourceName} Settings",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
    "alwaysAllow": "Bypass Auth",
    "alwaysDeny": "Block Access",
    "passToAuth": "Pass to Auth",
@@ -678,7 +630,7 @@
    "createdAt": "Created At",
    "proxyErrorInvalidHeader": "Invalid custom Host Header value. Use domain name format, or save empty to unset custom Host Header.",
    "proxyErrorTls": "Invalid TLS Server Name. Use domain name format, or save empty to remove the TLS Server Name.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Enable SSL",
    "proxyEnableSSLDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the targets.",
    "target": "Target",
    "configureTarget": "Configure Targets",
@@ -795,16 +747,6 @@
    "rulesNoOne": "No rules. Add a rule using the form.",
    "rulesOrder": "Rules are evaluated by priority in ascending order.",
    "rulesSubmit": "Save Rules",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
    "resourceErrorCreate": "Error creating resource",
    "resourceErrorCreateDescription": "An error occurred when creating the resource",
    "resourceErrorCreateMessage": "Error creating resource:",
@@ -868,17 +810,6 @@
    "pincodeAdd": "Add PIN Code",
    "pincodeRemove": "Remove PIN Code",
    "resourceAuthMethods": "Authentication Methods",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "editSharedPolicy": "Edit Shared Policy",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
    "resourceAuthMethodsDescriptions": "Allow access to the resource via additional auth methods",
    "resourceAuthSettingsSave": "Saved successfully",
    "resourceAuthSettingsSaveDescription": "Authentication settings have been saved",
@@ -914,12 +845,6 @@
    "resourcePincodeSetupTitle": "Set Pincode",
    "resourcePincodeSetupTitleDescription": "Set a pincode to protect this resource",
    "resourceRoleDescription": "Admins can always access this resource.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "This resource uses a shared policy. Policy-level settings (auth methods, email whitelist) are locked. You can add resource-specific rules, roles, and users below.",
    "resourceUsersRoles": "Access Controls",
    "resourceUsersRolesDescription": "Configure which users and roles can visit this resource",
    "resourceUsersRolesSubmit": "Save Access Controls",
@@ -1215,18 +1140,6 @@
    "idpErrorConnectingTo": "There was a problem connecting to {name}. Please contact your administrator.",
    "idpErrorNotFound": "IdP not found",
    "inviteInvalid": "Invalid Invite",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
    "inviteInvalidDescription": "The invite link is invalid.",
    "inviteErrorWrongUser": "Invite is not for this user",
    "inviteErrorUserNotExists": "User does not exist. Please create an account first.",
@@ -1461,8 +1374,6 @@
    "sidebarResources": "Resources",
    "sidebarProxyResources": "Public",
    "sidebarClientResources": "Private",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
    "sidebarAccessControl": "Access Control",
    "sidebarLogsAndAnalytics": "Logs & Analytics",
    "sidebarTeam": "Team",
@@ -1646,8 +1557,7 @@
    "standaloneHcFilterSiteIdFallback": "Site {id}",
    "standaloneHcFilterResourceIdFallback": "Resource {id}",
    "blueprints": "Blueprints",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Apply declarative configurations and view previous runs",
    "blueprintAdd": "Add Blueprint",
    "blueprintGoBack": "See all Blueprints",
    "blueprintCreate": "Create Blueprint",
@@ -1665,17 +1575,7 @@
    "contents": "Contents",
    "parsedContents": "Parsed Contents (Read Only)",
    "enableDockerSocket": "Enable Docker Blueprint",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to Newt. Read about how this works in <docsLink>the documentation</docsLink>.",
    "viewDockerContainers": "View Docker Containers",
    "containersIn": "Containers in {siteName}",
    "selectContainerDescription": "Select any container to use as a hostname for this target. Click a port to use a port.",
@@ -1720,7 +1620,6 @@
    "certificateStatus": "Certificate",
    "certificateStatusAutoRefreshHint": "Status refreshes automatically.",
    "loading": "Loading",
-    "loadingEllipsis": "Loading...",
    "loadingAnalytics": "Loading Analytics",
    "restart": "Restart",
    "domains": "Domains",
@@ -1947,7 +1846,6 @@
    "billingManageLicenseSubscription": "Manage your subscription for paid self-hosted license keys",
    "billingCurrentKeys": "Current Keys",
    "billingModifyCurrentPlan": "Modify Current Plan",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
    "billingConfirmUpgrade": "Confirm Upgrade",
    "billingConfirmDowngrade": "Confirm Downgrade",
    "billingConfirmUpgradeDescription": "You are about to upgrade your plan. Review the new limits and pricing below.",
@@ -2045,36 +1943,7 @@
    "timeIsInSeconds": "Time is in seconds",
    "requireDeviceApproval": "Require Device Approvals",
    "requireDeviceApprovalDescription": "Users with this role need new devices approved by an admin before they can connect and access resources.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH Access",
    "roleAllowSsh": "Allow SSH",
    "roleAllowSshAllow": "Allow",
    "roleAllowSshDisallow": "Disallow",
@@ -2088,7 +1957,7 @@
    "sshSudoModeCommandsDescription": "User can run only the specified commands with sudo.",
    "sshSudo": "Allow sudo",
    "sshSudoCommands": "Sudo Commands",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo.",
    "sshCreateHomeDir": "Create Home Directory",
    "sshUnixGroups": "Unix Groups",
    "sshUnixGroupsDescription": "Comma separated Unix groups to add the user to on the target host.",
@@ -2180,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Scheme",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Enable SSL",
    "editInternalResourceDialogEnableSslDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the destination.",
    "editInternalResourceDialogDestination": "Destination",
    "editInternalResourceDialogDestinationHostDescription": "The IP address or hostname of the resource on the site's network.",
@@ -2230,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Scheme",
    "createInternalResourceDialogScheme": "Scheme",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Enable SSL",
    "createInternalResourceDialogEnableSslDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the destination.",
    "createInternalResourceDialogDestination": "Destination",
    "createInternalResourceDialogDestinationHostDescription": "The IP address or hostname of the resource on the site's network.",
@@ -2366,7 +2233,7 @@
        "description": "More reliable and low-maintenance self-hosted Pangolin server with extra bells and whistles",
        "introTitle": "Managed Self-Hosted Pangolin",
        "introDescription": "is a deployment option designed for people who want simplicity and extra reliability while still keeping their data private and self-hosted.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, SSL termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
        "benefitSimplerOperations": {
            "title": "Simpler operations",
            "description": "No need to run your own mail server or set up complex alerting. You'll get health checks and downtime alerts out of the box."
@@ -3070,7 +2937,7 @@
    "learnMore": "Learn more",
    "backToHome": "Go back to home",
    "needToSignInToOrg": "Need to use your organization's identity provider?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Maintenance Mode",
    "maintenanceModeDescription": "Display a maintenance page to visitors",
    "maintenanceModeType": "Maintenance Mode Type",
    "showMaintenancePage": "Show a maintenance page to visitors",
@@ -3100,7 +2967,6 @@
    "maintenanceScreenEstimatedCompletion": "Estimated Completion:",
    "createInternalResourceDialogDestinationRequired": "Destination is required",
    "available": "Available",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
    "archived": "Archived",
    "noArchivedDevices": "No archived devices found",
    "deviceArchived": "Device archived",
@@ -3430,27 +3296,5 @@
    "memberPortalResourceDisabled": "Resource Disabled",
    "memberPortalShowingResources": "Showing {start}-{end} of {total} resources",
    "memberPortalPrevious": "Previous",
-    "memberPortalNext": "Next",
-    "httpSettings": "HTTP Settings",
-    "tcpSettings": "TCP Settings",
-    "udpSettings": "UDP Settings",
-    "sshTitle": "SSH",
-    "sshConnectingDescription": "Establishing a secure connection…",
-    "sshConnecting": "Connecting…",
-    "sshInitializing": "Initializing…",
-    "sshSignInTitle": "Sign in to SSH",
-    "sshSignInDescription": "Enter your SSH credentials",
-    "sshPasswordTab": "Password",
-    "sshPrivateKeyTab": "Private Key",
-    "sshPrivateKeyField": "Private Key",
-    "sshPrivateKeyDisclaimer": "Your private key is not stored or visible to Pangolin. Alternatively, you can use short-lived certificates for seamless authentication using your existing Pangolin identity.",
-    "sshLearnMore": "Learn more",
-    "sshPrivateKeyFile": "Private Key File",
-    "sshAuthenticate": "Authenticate",
-    "sshTerminate": "Terminate",
-    "sshPoweredBy": "Powered by",
-    "sshErrorNoTarget": "No target specified",
-    "sshErrorWebSocket": "WebSocket connection failed",
-    "sshErrorAuthFailed": "Authentication failed",
-    "sshErrorConnectionClosed": "Connection closed before authentication completed"
+    "memberPortalNext": "Next"
 }
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -630,7 +630,7 @@
    "createdAt": "Creado el",
    "proxyErrorInvalidHeader": "Valor de cabecera de host personalizado no válido. Utilice el formato de nombre de dominio, o guarde en blanco para desestablecer cabecera de host personalizada.",
    "proxyErrorTls": "Nombre de servidor TLS inválido. Utilice el formato de nombre de dominio o guarde en blanco para eliminar el nombre de servidor TLS.",
-    "proxyEnableSSL": "Activar TLS",
+    "proxyEnableSSL": "Activar SSL",
    "proxyEnableSSLDescription": "Habilita el cifrado SSL/TLS para conexiones seguras HTTPS a los objetivos.",
    "target": "Target",
    "configureTarget": "Configurar objetivos",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Esquema",
-    "editInternalResourceDialogEnableSsl": "Activar TLS",
+    "editInternalResourceDialogEnableSsl": "Activar SSL",
    "editInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
    "editInternalResourceDialogDestination": "Destino",
    "editInternalResourceDialogDestinationHostDescription": "La dirección IP o nombre de host del recurso en la red del sitio.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Esquema",
    "createInternalResourceDialogScheme": "Esquema",
-    "createInternalResourceDialogEnableSsl": "Activar TLS",
+    "createInternalResourceDialogEnableSsl": "Activar SSL",
    "createInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
    "createInternalResourceDialogDestination": "Destino",
    "createInternalResourceDialogDestinationHostDescription": "La dirección IP o nombre de host del recurso en la red del sitio.",
@@ -2235,7 +2233,7 @@
        "description": "Servidor Pangolin autoalojado más fiable y de bajo mantenimiento con campanas y silbidos extra",
        "introTitle": "Pangolin autogestionado",
        "introDescription": "es una opción de despliegue diseñada para personas que quieren simplicidad y fiabilidad extra mientras mantienen sus datos privados y autoalojados.",
-        "introDetail": "Con esta opción, todavía ejecuta su propio nodo Pangolin, sus túneles, terminación TLS y tráfico permanecen en su servidor. La diferencia es que la gestión y el control se gestionan a través de nuestro panel de control en la nube, que desbloquea una serie de ventajas:",
+        "introDetail": "Con esta opción, todavía ejecuta su propio nodo Pangolin, sus túneles, terminación SSL y tráfico permanecen en su servidor. La diferencia es que la gestión y el control se gestionan a través de nuestro panel de control en la nube, que desbloquea una serie de ventajas:",
        "benefitSimplerOperations": {
            "title": "Operaciones simples",
            "description": "No necesitas ejecutar tu propio servidor de correo o configurar alertas complejas. Recibirás cheques de salud y alertas de tiempo de inactividad."
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -630,7 +630,7 @@
    "createdAt": "Créé le",
    "proxyErrorInvalidHeader": "Valeur d'en-tête Host personnalisée invalide. Utilisez le format de nom de domaine, ou laissez vide pour désactiver l'en-tête Host personnalisé.",
    "proxyErrorTls": "Nom de serveur TLS invalide. Utilisez le format de nom de domaine, ou laissez vide pour supprimer le nom de serveur TLS.",
-    "proxyEnableSSL": "Activer TLS",
+    "proxyEnableSSL": "Activer SSL",
    "proxyEnableSSLDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers les cibles.",
    "target": "Cible",
    "configureTarget": "Configurer les cibles",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Méthode HTTP",
-    "editInternalResourceDialogEnableSsl": "Activer TLS",
+    "editInternalResourceDialogEnableSsl": "Activer SSL",
    "editInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
    "editInternalResourceDialogDestination": "Destination",
    "editInternalResourceDialogDestinationHostDescription": "L'adresse IP ou le nom d'hôte de la ressource sur le réseau du site.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Méthode HTTP",
    "createInternalResourceDialogScheme": "Méthode HTTP",
-    "createInternalResourceDialogEnableSsl": "Activer TLS",
+    "createInternalResourceDialogEnableSsl": "Activer SSL",
    "createInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
    "createInternalResourceDialogDestination": "Destination",
    "createInternalResourceDialogDestinationHostDescription": "L'adresse IP ou le nom d'hôte de la ressource sur le réseau du site.",
@@ -2235,7 +2233,7 @@
        "description": "Serveur Pangolin auto-hébergé avec des cloches et des sifflets supplémentaires",
        "introTitle": "Pangolin auto-hébergé géré",
        "introDescription": "est une option de déploiement conçue pour les personnes qui veulent de la simplicité et de la fiabilité tout en gardant leurs données privées et auto-hébergées.",
-        "introDetail": "Avec cette option, vous exécutez toujours votre propre nœud Pangolin - vos tunnels, la terminaison TLS et le trafic restent sur votre serveur. La différence est que la gestion et la surveillance sont gérées via notre tableau de bord du cloud, qui déverrouille un certain nombre d'avantages :",
+        "introDetail": "Avec cette option, vous exécutez toujours votre propre nœud Pangolin - vos tunnels, la terminaison SSL et le trafic restent sur votre serveur. La différence est que la gestion et la surveillance sont gérées via notre tableau de bord du cloud, qui déverrouille un certain nombre d'avantages :",
        "benefitSimplerOperations": {
            "title": "Opérations plus simples",
            "description": "Pas besoin de faire tourner votre propre serveur de messagerie ou de configurer des alertes complexes. Vous obtiendrez des contrôles de santé et des alertes de temps d'arrêt par la suite."
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -630,7 +630,7 @@
    "createdAt": "Creato Il",
    "proxyErrorInvalidHeader": "Valore dell'intestazione Host personalizzata non valido. Usa il formato nome dominio o salva vuoto per rimuovere l'intestazione Host personalizzata.",
    "proxyErrorTls": "Nome Server TLS non valido. Usa il formato nome dominio o salva vuoto per rimuovere il Nome Server TLS.",
-    "proxyEnableSSL": "Abilita TLS",
+    "proxyEnableSSL": "Abilita SSL",
    "proxyEnableSSLDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alle risorse interne target.",
    "target": "Target",
    "configureTarget": "Configura Risorse Interne",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Metodo HTTP",
-    "editInternalResourceDialogEnableSsl": "Abilitare TLS",
+    "editInternalResourceDialogEnableSsl": "Abilitare SSL",
    "editInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
    "editInternalResourceDialogDestination": "Destinazione",
    "editInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Metodo HTTP",
    "createInternalResourceDialogScheme": "Metodo HTTP",
-    "createInternalResourceDialogEnableSsl": "Abilitare TLS",
+    "createInternalResourceDialogEnableSsl": "Abilitare SSL",
    "createInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
    "createInternalResourceDialogDestination": "Destinazione",
    "createInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2235,7 +2233,7 @@
        "description": "Server Pangolin self-hosted più affidabile e a bassa manutenzione con campanelli e fischietti extra",
        "introTitle": "Managed Self-Hosted Pangolin",
        "introDescription": "è un'opzione di distribuzione progettata per le persone che vogliono la semplicità e l'affidabilità extra mantenendo i loro dati privati e self-hosted.",
-        "introDetail": "Con questa opzione, esegui ancora il tuo nodo Pangolin - i tunnel, la terminazione TLS e il traffico rimangono tutti sul tuo server. La differenza è che la gestione e il monitoraggio sono gestiti attraverso il nostro cruscotto cloud, che sblocca una serie di vantaggi:",
+        "introDetail": "Con questa opzione, esegui ancora il tuo nodo Pangolin - i tunnel, la terminazione SSL e il traffico rimangono tutti sul tuo server. La differenza è che la gestione e il monitoraggio sono gestiti attraverso il nostro cruscotto cloud, che sblocca una serie di vantaggi:",
        "benefitSimplerOperations": {
            "title": "Operazioni più semplici",
            "description": "Non è necessario eseguire il proprio server di posta o impostare un avviso complesso. Otterrai controlli di salute e avvisi di inattività fuori dalla casella."
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -630,7 +630,7 @@
    "createdAt": "생성일",
    "proxyErrorInvalidHeader": "잘못된 사용자 정의 호스트 헤더 값입니다. 도메인 이름 형식을 사용하거나 사용자 정의 호스트 헤더를 해제하려면 비워 두십시오.",
    "proxyErrorTls": "유효하지 않은 TLS 서버 이름입니다. 도메인 이름 형식을 사용하거나 비워 두어 TLS 서버 이름을 제거하십시오.",
-    "proxyEnableSSL": "TLS 활성화",
+    "proxyEnableSSL": "SSL 활성화",
    "proxyEnableSSLDescription": "타겟과의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화를 활성화하세요.",
    "target": "대상",
    "configureTarget": "대상 구성",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "스킴",
-    "editInternalResourceDialogEnableSsl": "TLS 활성화",
+    "editInternalResourceDialogEnableSsl": "SSL 활성화",
    "editInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
    "editInternalResourceDialogDestination": "대상지",
    "editInternalResourceDialogDestinationHostDescription": "사이트 네트워크의 자원 IP 주소입니다.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "스킴",
    "createInternalResourceDialogScheme": "스킴",
-    "createInternalResourceDialogEnableSsl": "TLS 활성화",
+    "createInternalResourceDialogEnableSsl": "SSL 활성화",
    "createInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
    "createInternalResourceDialogDestination": "대상지",
    "createInternalResourceDialogDestinationHostDescription": "사이트 네트워크의 자원 IP 주소입니다.",
@@ -2235,7 +2233,7 @@
        "description": "더 신뢰할 수 있고 낮은 유지보수의 자체 호스팅 팡골린 서버, 추가 기능 포함",
        "introTitle": "관리 자체 호스팅 팡골린",
        "introDescription": "는 자신의 데이터를 프라이빗하고 자체 호스팅을 유지하면서 더 간단하고 추가적인 신뢰성을 원하는 사람들을 위한 배포 옵션입니다.",
-        "introDetail": "이 옵션을 사용하면 여전히 자신의 팡골린 노드를 운영하고 - 터널, TLS 종료 및 트래픽 모두 서버에 유지됩니다. 차이점은 관리 및 모니터링이 클라우드 대시보드를 통해 처리되어 여러 혜택을 제공합니다.",
+        "introDetail": "이 옵션을 사용하면 여전히 자신의 팡골린 노드를 운영하고 - 터널, SSL 종료 및 트래픽 모두 서버에 유지됩니다. 차이점은 관리 및 모니터링이 클라우드 대시보드를 통해 처리되어 여러 혜택을 제공합니다.",
        "benefitSimplerOperations": {
            "title": "더 간단한 운영",
            "description": "자체 메일 서버를 운영하거나 복잡한 경고를 설정할 필요가 없습니다. 기본적으로 상태 점검 및 다운타임 경고를 받을 수 있습니다."
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -630,7 +630,7 @@
    "createdAt": "Opprettet",
    "proxyErrorInvalidHeader": "Ugyldig verdi for egendefinert vertsoverskrift. Bruk domenenavnformat, eller lagre tomt for å fjerne den egendefinerte vertsoverskriften.",
    "proxyErrorTls": "Ugyldig TLS-servernavn. Bruk domenenavnformat, eller la stå tomt for å fjerne TLS-servernavnet.",
-    "proxyEnableSSL": "Aktiver TLS",
+    "proxyEnableSSL": "Aktiver SSL",
    "proxyEnableSSLDescription": "Aktivere SSL/TLS-kryptering for sikker HTTPS tilkobling til målene.",
    "target": "Target",
    "configureTarget": "Konfigurer mål",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Skjema",
-    "editInternalResourceDialogEnableSsl": "Aktiver TLS",
+    "editInternalResourceDialogEnableSsl": "Aktiver SSL",
    "editInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
    "editInternalResourceDialogDestination": "Destinasjon",
    "editInternalResourceDialogDestinationHostDescription": "IP-adressen eller vertsnavnet til ressursen på nettstedets nettverk.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Skjema",
    "createInternalResourceDialogScheme": "Skjema",
-    "createInternalResourceDialogEnableSsl": "Aktiver TLS",
+    "createInternalResourceDialogEnableSsl": "Aktiver SSL",
    "createInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
    "createInternalResourceDialogDestination": "Destinasjon",
    "createInternalResourceDialogDestinationHostDescription": "IP-adressen eller vertsnavnet til ressursen på nettstedets nettverk.",
@@ -2235,7 +2233,7 @@
        "description": "Sikre og lavvedlikeholdsservere, selvbetjente Pangolin med ekstra klokker, og understell",
        "introTitle": "Administrert Self-Hosted Pangolin",
        "introDescription": "er et alternativ for bruk utviklet for personer som ønsker enkel og ekstra pålitelighet mens de fortsatt holder sine data privat og selvdrevne.",
-        "introDetail": "Med dette valget kjører du fortsatt din egen Pangolin-node - tunneler, TLS-terminering og trafikken ligger på serveren din. Forskjellen er at behandling og overvåking håndteres gjennom vårt skydashbord, som låser opp en rekke fordeler:",
+        "introDetail": "Med dette valget kjører du fortsatt din egen Pangolin-node - tunneler, SSL-terminering og trafikken ligger på serveren din. Forskjellen er at behandling og overvåking håndteres gjennom vårt skydashbord, som låser opp en rekke fordeler:",
        "benefitSimplerOperations": {
            "title": "Enklere operasjoner",
            "description": "Ingen grunn til å kjøre din egen e-postserver eller sette opp kompleks varsling. Du vil få helsesjekk og nedetid varsler ut av boksen."
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -630,7 +630,7 @@
    "createdAt": "Aangemaakt op",
    "proxyErrorInvalidHeader": "Ongeldige aangepaste Header waarde. Gebruik het domeinnaam formaat, of sla leeg op om de aangepaste Host header ongedaan te maken.",
    "proxyErrorTls": "Ongeldige TLS servernaam. Gebruik de domeinnaam of sla leeg op om de TLS servernaam te verwijderen.",
-    "proxyEnableSSL": "TLS inschakelen",
+    "proxyEnableSSL": "SSL inschakelen",
    "proxyEnableSSLDescription": "SSL/TLS-versleuteling inschakelen voor beveiligde HTTPS-verbindingen naar de doelen.",
    "target": "Target",
    "configureTarget": "Doelstellingen configureren",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schema",
-    "editInternalResourceDialogEnableSsl": "TLS inschakelen",
+    "editInternalResourceDialogEnableSsl": "SSL inschakelen",
    "editInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
    "editInternalResourceDialogDestination": "Bestemming",
    "editInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schema",
    "createInternalResourceDialogScheme": "Schema",
-    "createInternalResourceDialogEnableSsl": "TLS inschakelen",
+    "createInternalResourceDialogEnableSsl": "SSL inschakelen",
    "createInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
    "createInternalResourceDialogDestination": "Bestemming",
    "createInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2235,7 +2233,7 @@
        "description": "betrouwbaardere en slecht onderhouden Pangolin server met extra klokken en klokkenluiders",
        "introTitle": "Beheerde zelfgehoste pangolin",
        "introDescription": "is een implementatieoptie ontworpen voor mensen die eenvoud en extra betrouwbaarheid willen, terwijl hun gegevens privé en zelf georganiseerd blijven.",
-        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin node - uw tunnels, TLS-verbinding en verkeer alles op uw server. Het verschil is dat beheer en monitoring worden behandeld via onze cloud dashboard, wat een aantal voordelen oplevert:",
+        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin node - uw tunnels, SSL-verbinding en verkeer alles op uw server. Het verschil is dat beheer en monitoring worden behandeld via onze cloud dashboard, wat een aantal voordelen oplevert:",
        "benefitSimplerOperations": {
            "title": "Simpler operaties",
            "description": "Je hoeft geen eigen mailserver te draaien of complexe waarschuwingen in te stellen. Je krijgt gezondheidscontroles en downtime meldingen uit de box."
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -630,7 +630,7 @@
    "createdAt": "Utworzono",
    "proxyErrorInvalidHeader": "Nieprawidłowa wartość niestandardowego nagłówka hosta. Użyj formatu nazwy domeny lub zapisz pusty, aby usunąć niestandardowy nagłówek hosta.",
    "proxyErrorTls": "Nieprawidłowa nazwa serwera TLS. Użyj formatu nazwy domeny lub zapisz pusty, aby usunąć nazwę serwera TLS.",
-    "proxyEnableSSL": "Włącz TLS",
+    "proxyEnableSSL": "Włącz SSL",
    "proxyEnableSSLDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z celami.",
    "target": "Target",
    "configureTarget": "Konfiguruj Targety",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schemat",
-    "editInternalResourceDialogEnableSsl": "Włącz TLS",
+    "editInternalResourceDialogEnableSsl": "Włącz SSL",
    "editInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
    "editInternalResourceDialogDestination": "Miejsce docelowe",
    "editInternalResourceDialogDestinationHostDescription": "Adres IP lub nazwa hosta zasobu w sieci witryny.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schemat",
    "createInternalResourceDialogScheme": "Schemat",
-    "createInternalResourceDialogEnableSsl": "Włącz TLS",
+    "createInternalResourceDialogEnableSsl": "Włącz SSL",
    "createInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
    "createInternalResourceDialogDestination": "Miejsce docelowe",
    "createInternalResourceDialogDestinationHostDescription": "Adres IP lub nazwa hosta zasobu w sieci witryny.",
@@ -2235,7 +2233,7 @@
        "description": "Większa niezawodność i niska konserwacja serwera Pangolin z dodatkowymi dzwonkami i sygnałami",
        "introTitle": "Zarządzany samowystarczalny Pangolin",
        "introDescription": "jest opcją wdrażania zaprojektowaną dla osób, które chcą prostoty i dodatkowej niezawodności, przy jednoczesnym utrzymaniu swoich danych prywatnych i samodzielnych.",
-        "introDetail": "Z tą opcją nadal obsługujesz swój własny węzeł Pangolin - tunele, zakończenie TLS i ruch na Twoim serwerze. Różnica polega na tym, że zarządzanie i monitorowanie odbywa się za pomocą naszej tablicy rozdzielczej, która odblokowuje szereg korzyści:",
+        "introDetail": "Z tą opcją nadal obsługujesz swój własny węzeł Pangolin - tunele, zakończenie SSL i ruch na Twoim serwerze. Różnica polega na tym, że zarządzanie i monitorowanie odbywa się za pomocą naszej tablicy rozdzielczej, która odblokowuje szereg korzyści:",
        "benefitSimplerOperations": {
            "title": "Uproszczone operacje",
            "description": "Nie ma potrzeby uruchamiania własnego serwera pocztowego lub ustawiania skomplikowanych powiadomień. Będziesz mieć kontrolę zdrowia i powiadomienia o przestoju."
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -630,7 +630,7 @@
    "createdAt": "Criado Em",
    "proxyErrorInvalidHeader": "Valor do cabeçalho Host personalizado inválido. Use o formato de nome de domínio ou salve vazio para remover o cabeçalho Host personalizado.",
    "proxyErrorTls": "Nome do Servidor TLS inválido. Use o formato de nome de domínio ou salve vazio para remover o Nome do Servidor TLS.",
-    "proxyEnableSSL": "Habilitar TLS",
+    "proxyEnableSSL": "Habilitar SSL",
    "proxyEnableSSLDescription": "Habilitar criptografia SSL/TLS para conexões HTTPS seguras aos alvos.",
    "target": "Target",
    "configureTarget": "Configurar Alvos",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Esquema",
-    "editInternalResourceDialogEnableSsl": "Ativar TLS",
+    "editInternalResourceDialogEnableSsl": "Ativar SSL",
    "editInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
    "editInternalResourceDialogDestination": "Destino",
    "editInternalResourceDialogDestinationHostDescription": "O endereço IP ou o nome do host do recurso na rede do site.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Esquema",
    "createInternalResourceDialogScheme": "Esquema",
-    "createInternalResourceDialogEnableSsl": "Ativar TLS",
+    "createInternalResourceDialogEnableSsl": "Ativar SSL",
    "createInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
    "createInternalResourceDialogDestination": "Destino",
    "createInternalResourceDialogDestinationHostDescription": "O endereço IP ou o nome do host do recurso na rede do site.",
@@ -2235,7 +2233,7 @@
        "description": "Servidor Pangolin auto-hospedado mais confiável e com baixa manutenção com sinos extras e assobiamentos",
        "introTitle": "Pangolin Auto-Hospedado Gerenciado",
        "introDescription": "é uma opção de implantação projetada para pessoas que querem simplicidade e confiança adicional, mantendo os seus dados privados e auto-hospedados.",
-        "introDetail": "Com esta opção, você ainda roda seu próprio nó Pangolin - seus túneis, terminação TLS e tráfego todos permanecem no seu servidor. A diferença é que a gestão e a monitorização são geridos através do nosso painel de nuvem, que desbloqueia vários benefícios:",
+        "introDetail": "Com esta opção, você ainda roda seu próprio nó Pangolin - seus túneis, terminação SSL e tráfego todos permanecem no seu servidor. A diferença é que a gestão e a monitorização são geridos através do nosso painel de nuvem, que desbloqueia vários benefícios:",
        "benefitSimplerOperations": {
            "title": "Operações simples",
            "description": "Não é necessário executar o seu próprio servidor de e-mail ou configurar um alerta complexo. Você receberá fora de caixa verificações de saúde e alertas de tempo de inatividade."
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -630,7 +630,7 @@
    "createdAt": "Создано в",
    "proxyErrorInvalidHeader": "Неверное значение пользовательского заголовка Host. Используйте формат доменного имени или оставьте пустым для сброса пользовательского заголовка Host.",
    "proxyErrorTls": "Неверное имя TLS сервера. Используйте формат доменного имени или оставьте пустым для удаления имени TLS сервера.",
-    "proxyEnableSSL": "Включить TLS",
+    "proxyEnableSSL": "Включить SSL",
    "proxyEnableSSLDescription": "Включить шифрование SSL/TLS для безопасных HTTPS соединений с целями.",
    "target": "Target",
    "configureTarget": "Настроить адресаты",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "СИДР",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Схема",
-    "editInternalResourceDialogEnableSsl": "Включить TLS",
+    "editInternalResourceDialogEnableSsl": "Включить SSL",
    "editInternalResourceDialogEnableSslDescription": "Включите шифрование SSL/TLS для защищенных HTTPS соединений с конечной точкой.",
    "editInternalResourceDialogDestination": "Пункт назначения",
    "editInternalResourceDialogDestinationHostDescription": "IP адрес или имя хоста ресурса в сети сайта.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "СИДР",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Схема",
    "createInternalResourceDialogScheme": "Схема",
-    "createInternalResourceDialogEnableSsl": "Включить TLS",
+    "createInternalResourceDialogEnableSsl": "Включить SSL",
    "createInternalResourceDialogEnableSslDescription": "Включите SSL/TLS шифрование для защищенных HTTPS соединений с конечной точкой.",
    "createInternalResourceDialogDestination": "Пункт назначения",
    "createInternalResourceDialogDestinationHostDescription": "IP адрес или имя хоста ресурса в сети сайта.",
@@ -2235,7 +2233,7 @@
        "description": "Более надежный и низко обслуживаемый сервер Pangolin с дополнительными колокольнями и свистками",
        "introTitle": "Управляемый Само-Хост Панголина",
        "introDescription": "- это вариант развертывания, предназначенный для людей, которые хотят простоты и надёжности, сохраняя при этом свои данные конфиденциальными и самостоятельными.",
-        "introDetail": "С помощью этой опции вы по-прежнему используете узел Pangolin - туннели, TLS, и весь остающийся на вашем сервере. Разница заключается в том, что управление и мониторинг осуществляются через нашу панель инструментов из облака, которая открывает ряд преимуществ:",
+        "introDetail": "С помощью этой опции вы по-прежнему используете узел Pangolin - туннели, SSL, и весь остающийся на вашем сервере. Разница заключается в том, что управление и мониторинг осуществляются через нашу панель инструментов из облака, которая открывает ряд преимуществ:",
        "benefitSimplerOperations": {
            "title": "Более простые операции",
            "description": "Не нужно запускать свой собственный почтовый сервер или настроить комплексное оповещение. Вы будете получать проверки состояния здоровья и оповещения о неисправностях из коробки."
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -630,7 +630,7 @@
    "createdAt": "Oluşturulma Tarihi",
    "proxyErrorInvalidHeader": "Geçersiz özel Ana Bilgisayar Başlığı değeri. Alan adı formatını kullanın veya özel Ana Bilgisayar Başlığını ayarlamak için boş bırakın.",
    "proxyErrorTls": "Geçersiz TLS Sunucu Adı. Alan adı formatını kullanın veya TLS Sunucu Adını kaldırmak için boş bırakılsın.",
-    "proxyEnableSSL": "TLS Etkinleştir",
+    "proxyEnableSSL": "SSL Etkinleştir",
    "proxyEnableSSLDescription": "Hedeflere güvenli HTTPS bağlantıları için SSL/TLS şifrelemesini etkinleştirin.",
    "target": "Hedef",
    "configureTarget": "Hedefleri Yapılandır",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Şema",
-    "editInternalResourceDialogEnableSsl": "TLS Etkinleştir",
+    "editInternalResourceDialogEnableSsl": "SSL'i Etkinleştir",
    "editInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
    "editInternalResourceDialogDestination": "Hedef",
    "editInternalResourceDialogDestinationHostDescription": "Site ağındaki kaynağın IP adresi veya ana bilgisayar adı.",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Şema",
    "createInternalResourceDialogScheme": "Şema",
-    "createInternalResourceDialogEnableSsl": "TLS'yi Etkinleştir",
+    "createInternalResourceDialogEnableSsl": "SSL'i Etkinleştir",
    "createInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
    "createInternalResourceDialogDestination": "Hedef",
    "createInternalResourceDialogDestinationHostDescription": "Site ağındaki kaynağın IP adresi veya ana bilgisayar adı.",
@@ -2235,7 +2233,7 @@
        "description": "Daha güvenilir ve düşük bakım gerektiren, ekstra özelliklere sahip kendi kendine barındırabileceğiniz Pangolin sunucusu",
        "introTitle": "Yönetilen Kendi Kendine Barındırılan Pangolin",
        "introDescription": "Bu, basitlik ve ekstra güvenilirlik arayan, ancak verilerini gizli tutmak ve kendi sunucularında barındırmak isteyen kişiler için tasarlanmış bir dağıtım seçeneğidir.",
-        "introDetail": "Bu seçenekle, kendi Pangolin düğümünüzü çalıştırmaya devam edersiniz - tünelleriniz, TLS bitişiniz ve trafiğiniz tamamen sunucunuzda kalır. Fark, yönetim ve izlemeyi bulut panomuz üzerinden gerçekleştiririz, bu da bir dizi avantaj sağlar:",
+        "introDetail": "Bu seçenekle, kendi Pangolin düğümünüzü çalıştırmaya devam edersiniz - tünelleriniz, SSL bitişiniz ve trafiğiniz tamamen sunucunuzda kalır. Fark, yönetim ve izlemeyi bulut panomuz üzerinden gerçekleştiririz, bu da bir dizi avantaj sağlar:",
        "benefitSimplerOperations": {
            "title": "Daha basit işlemler",
            "description": "Kendi e-posta sunucunuzu çalıştırmanıza veya karmaşık uyarılar kurmanıza gerek yok. Sağlık kontrolleri ve kesinti uyarılarını kutudan çıktığı gibi alırsınız."
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -630,7 +630,7 @@
    "createdAt": "创建于",
    "proxyErrorInvalidHeader": "无效的自定义主机头值。使用域名格式，或将空保存为取消自定义主机头。",
    "proxyErrorTls": "无效的 TLS 服务器名称。使用域名格式，或保存空以删除 TLS 服务器名称。",
-    "proxyEnableSSL": "启用 TLS",
+    "proxyEnableSSL": "启用 SSL",
    "proxyEnableSSLDescription": "启用 SSL/TLS 加密以确保目标的 HTTPS 连接。",
    "target": "Target",
    "configureTarget": "配置目标",
@@ -2049,9 +2049,8 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "方案",
-    "editInternalResourceDialogEnableSsl": "启用 TLS",
+    "editInternalResourceDialogEnableSsl": "启用 SSL",
    "editInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
    "editInternalResourceDialogDestination": "目标",
    "editInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
@@ -2099,10 +2098,9 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "方案",
    "createInternalResourceDialogScheme": "方案",
-    "createInternalResourceDialogEnableSsl": "启用 TLS",
+    "createInternalResourceDialogEnableSsl": "启用 SSL",
    "createInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
    "createInternalResourceDialogDestination": "目标",
    "createInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
@@ -2235,7 +2233,7 @@
        "description": "更可靠和低维护自我托管的 Pangolin 服务器，带有额外的铃声和告密器",
        "introTitle": "托管自托管的潘戈林公司",
        "introDescription": "这是一种部署选择，为那些希望简洁和额外可靠的人设计，同时仍然保持他们的数据的私密性和自我托管性。",
-        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 - - 您的隧道、TLS 终止，并且流量在您的服务器上保持所有状态。 不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
+        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 - - 您的隧道、SSL 终止，并且流量在您的服务器上保持所有状态。 不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
        "benefitSimplerOperations": {
            "title": "简单的操作",
            "description": "无需运行您自己的邮件服务器或设置复杂的警报。您将从方框中获得健康检查和下限提醒。"
--- a/messages/zh-TW.json
+++ b/messages/zh-TW.json
@@ -489,7 +489,7 @@
    "createdAt": "創建於",
    "proxyErrorInvalidHeader": "無效的自訂主機 Header。使用域名格式，或將空保存為取消自訂 Header。",
    "proxyErrorTls": "無效的 TLS 伺服器名稱。使用域名格式，或保存空以刪除 TLS 伺服器名稱。",
-    "proxyEnableSSL": "啟用 TLS",
+    "proxyEnableSSL": "啟用 SSL",
    "proxyEnableSSLDescription": "啟用 SSL/TLS 加密以確保您目標的 HTTPS 連接。",
    "target": "目標",
    "configureTarget": "配置目標",
@@ -1763,7 +1763,7 @@
        "description": "更可靠、維護成本更低的自架 Pangolin 伺服器，並附帶額外的附加功能",
        "introTitle": "託管式自架 Pangolin",
        "introDescription": "這是一種部署選擇，為那些希望簡潔和額外可靠的人設計，同時仍然保持他們的數據的私密性和自我託管性。",
-        "introDetail": "通過此選項，您仍然運行您自己的 Pangolin 節點 - - 您的隧道、TLS 終止，並且流量在您的伺服器上保持所有狀態。 不同之處在於，管理和監測是通過我們的雲層儀錶板進行的，該儀錶板開啟了一些好處：",
+        "introDetail": "通過此選項，您仍然運行您自己的 Pangolin 節點 - - 您的隧道、SSL 終止，並且流量在您的伺服器上保持所有狀態。 不同之處在於，管理和監測是通過我們的雲層儀錶板進行的，該儀錶板開啟了一些好處：",
        "benefitSimplerOperations": {
            "title": "簡單的操作",
            "description": "無需運行您自己的郵件伺服器或設置複雜的警報。您將從方框中獲得健康檢查和下限提醒。"
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,42 +1,17 @@
 import type { NextConfig } from "next";
 import createNextIntlPlugin from "next-intl/plugin";
-import fs from "fs";
-import path from "path";

 const withNextIntl = createNextIntlPlugin();
-// read allowedDevOrigins.json if it exists
-let allowedDevOrigins: string[] = [];
-const allowedDevOriginsPath = path.join(
-    process.cwd(),
-    "allowedDevOrigins.json"
-);
-if (fs.existsSync(allowedDevOriginsPath)) {
-    try {
-        const data = fs.readFileSync(allowedDevOriginsPath, "utf-8");
-        allowedDevOrigins = JSON.parse(data);
-    } catch {}
-}

 const nextConfig: NextConfig = {
    reactStrictMode: false,
-    reactCompiler: true,
-    transpilePackages: ["@novnc/novnc"],
-    output: "standalone",
-    allowedDevOrigins,
-    async redirects() {
-        return [
-            {
-                source: "/:orgId/settings/resources/proxy/:path*",
-                destination: "/:orgId/settings/resources/public/:path*",
-                permanent: true
-            },
-            {
-                source: "/:orgId/settings/resources/client/:path*",
-                destination: "/:orgId/settings/resources/private/:path*",
-                permanent: true
-            }
-        ];
-    }
+    eslint: {
+        ignoreDuringBuilds: true
+    },
+    experimental: {
+        reactCompiler: true
+    },
+    output: "standalone"
 };

 export default withNextIntl(nextConfig);
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -32,15 +32,13 @@
        "format": "prettier --write ."
    },
    "dependencies": {
-        "@asteasolutions/zod-to-openapi": "8.5.0",
-        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
-        "@aws-sdk/client-s3": "3.1056.0",
-        "@headlessui/react": "2.2.10",
-        "@hookform/resolvers": "5.4.0",
+        "@asteasolutions/zod-to-openapi": "8.4.1",
+        "@aws-sdk/client-s3": "3.1011.0",
+        "@faker-js/faker": "10.3.0",
+        "@headlessui/react": "2.2.9",
+        "@hookform/resolvers": "5.2.2",
        "@monaco-editor/react": "4.7.0",
        "@node-rs/argon2": "2.0.2",
-        "@novnc/novnc": "^1.7.0",
        "@oslojs/crypto": "1.0.1",
        "@oslojs/encoding": "1.1.0",
        "@radix-ui/react-avatar": "1.1.11",
@@ -61,20 +59,16 @@
        "@radix-ui/react-tabs": "1.1.13",
        "@radix-ui/react-toast": "1.2.15",
        "@radix-ui/react-tooltip": "1.2.8",
-        "@react-email/body": "0.3.0",
-        "@react-email/components": "1.0.12",
-        "@react-email/render": "2.0.8",
-        "@react-email/tailwind": "2.0.7",
+        "@react-email/components": "1.0.8",
+        "@react-email/render": "2.0.4",
+        "@react-email/tailwind": "2.0.5",
        "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.1",
+        "@simplewebauthn/server": "13.3.0",
        "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.100.14",
+        "@tanstack/react-query": "5.90.21",
        "@tanstack/react-table": "8.21.3",
-        "@xterm/addon-fit": "^0.11.0",
-        "@xterm/addon-web-links": "^0.12.0",
-        "@xterm/xterm": "^6.0.0",
        "arctic": "3.7.0",
-        "axios": "1.16.1",
+        "axios": "1.15.0",
        "better-sqlite3": "11.9.1",
        "canvas-confetti": "1.9.4",
        "class-variance-authority": "0.7.1",
@@ -86,76 +80,77 @@
        "d3": "7.9.0",
        "drizzle-orm": "0.45.2",
        "express": "5.2.1",
-        "express-rate-limit": "8.5.2",
+        "express-rate-limit": "8.3.0",
        "glob": "13.0.6",
-        "helmet": "8.2.0",
+        "helmet": "8.1.0",
        "http-errors": "2.0.1",
        "input-otp": "1.4.2",
-        "ioredis": "5.11.0",
+        "ioredis": "5.10.0",
        "jmespath": "0.16.0",
        "js-yaml": "4.1.1",
        "jsonwebtoken": "9.0.3",
-        "lucide-react": "1.17.0",
-        "maxmind": "5.0.6",
+        "lucide-react": "0.577.0",
+        "maxmind": "5.0.5",
        "moment": "2.30.1",
-        "next": "16.2.6",
-        "next-intl": "4.13.0",
+        "next": "15.5.15",
+        "next-intl": "4.8.3",
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
        "node-cache": "5.1.2",
-        "nodemailer": "8.0.9",
+        "nodemailer": "8.0.5",
        "oslo": "1.2.1",
-        "pg": "8.21.0",
-        "posthog-node": "5.35.6",
+        "pg": "8.20.0",
+        "posthog-node": "5.28.0",
        "qrcode.react": "4.2.0",
-        "react": "19.2.6",
+        "react": "19.2.4",
        "react-day-picker": "9.14.0",
-        "react-dom": "19.2.6",
+        "react-dom": "19.2.4",
        "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.76.1",
+        "react-hook-form": "7.71.2",
        "react-icons": "5.6.0",
-        "recharts": "3.8.1",
+        "recharts": "2.15.4",
        "reodotdev": "1.1.0",
-        "semver": "7.8.1",
+        "resend": "6.9.2",
+        "semver": "7.7.4",
        "sshpk": "1.18.0",
-        "stripe": "22.2.0",
+        "stripe": "20.4.1",
        "swagger-ui-express": "5.0.1",
-        "tailwind-merge": "3.6.0",
+        "tailwind-merge": "3.5.0",
        "topojson-client": "3.1.0",
        "tw-animate-css": "1.4.0",
-        "use-debounce": "10.1.1",
-        "uuid": "14.0.0",
+        "use-debounce": "10.1.0",
+        "uuid": "13.0.0",
        "vaul": "1.1.2",
        "visionscarto-world-atlas": "1.0.0",
        "winston": "3.19.0",
        "winston-daily-rotate-file": "5.0.0",
-        "ws": "8.21.0",
-        "yaml": "2.9.0",
+        "ws": "8.19.0",
+        "yaml": "2.8.3",
        "yargs": "18.0.0",
-        "zod": "4.4.3",
+        "zod": "4.3.6",
        "zod-validation-error": "5.0.0"
    },
    "devDependencies": {
-        "@dotenvx/dotenvx": "1.69.1",
+        "@dotenvx/dotenvx": "1.54.1",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.5.0",
-        "@tailwindcss/postcss": "4.3.0",
-        "@tanstack/react-query-devtools": "5.100.14",
+        "@react-email/preview-server": "5.2.10",
+        "@tailwindcss/postcss": "4.2.2",
+        "@tanstack/react-query-devtools": "5.91.3",
        "@types/better-sqlite3": "7.6.13",
        "@types/cookie-parser": "1.4.10",
        "@types/cors": "2.8.19",
        "@types/crypto-js": "4.2.2",
        "@types/d3": "7.4.3",
        "@types/express": "5.0.6",
-        "@types/express-session": "1.19.0",
+        "@types/express-session": "1.18.2",
        "@types/jmespath": "0.15.2",
        "@types/js-yaml": "4.0.9",
        "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "25.9.1",
-        "@types/nodemailer": "8.0.0",
+        "@types/node": "25.3.5",
+        "@types/nodemailer": "7.0.11",
        "@types/nprogress": "0.2.3",
-        "@types/pg": "8.20.0",
-        "@types/react": "19.2.15",
+        "@types/pg": "8.18.0",
+        "@types/react": "19.2.14",
        "@types/react-dom": "19.2.3",
        "@types/semver": "7.7.1",
        "@types/sshpk": "1.17.4",
@@ -165,22 +160,21 @@
        "@types/yargs": "17.0.35",
        "babel-plugin-react-compiler": "1.0.0",
        "drizzle-kit": "0.31.10",
-        "esbuild": "0.28.0",
-        "esbuild-node-externals": "1.22.0",
-        "eslint": "10.4.0",
-        "eslint-config-next": "16.2.6",
-        "postcss": "8.5.15",
-        "prettier": "3.8.3",
-        "react-email": "6.5.0",
-        "tailwindcss": "4.3.0",
-        "tsc-alias": "1.8.17",
-        "tsx": "4.22.3",
-        "typescript": "6.0.3",
-        "typescript-eslint": "8.60.0"
+        "esbuild": "0.27.4",
+        "esbuild-node-externals": "1.20.1",
+        "eslint": "10.0.3",
+        "eslint-config-next": "16.1.7",
+        "postcss": "8.5.8",
+        "prettier": "3.8.1",
+        "react-email": "5.2.10",
+        "tailwindcss": "4.2.2",
+        "tsc-alias": "1.8.16",
+        "tsx": "4.21.0",
+        "typescript": "5.9.3",
+        "typescript-eslint": "8.56.1"
    },
    "overrides": {
-        "esbuild": "0.28.0",
-        "dompurify": "3.4.0",
-        "postcss": "8.5.15"
+        "esbuild": "0.27.4",
+        "dompurify": "3.3.2"
    }
 }
--- a/server/auth/actions.ts
+++ b/server/auth/actions.ts
@@ -5,7 +5,6 @@ import { and, eq, inArray } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import logger from "@server/logger";

 export enum ActionsEnum {
    createOrgUser = "createOrgUser",
@@ -149,36 +148,11 @@ export enum ActionsEnum {
    updateAlertRule = "updateAlertRule",
    deleteAlertRule = "deleteAlertRule",
    listAlertRules = "listAlertRules",
-    listOrgLabels = "listOrgLabels",
-    createOrgLabel = "createOrgLabel",
-    updateOrgLabel = "updateOrgLabel",
-    deleteOrgLabel = "deleteOrgLabel",
-    attachLabelToItem = "attachLabelToItem",
-    detachLabelFromItem = "detachLabelFromItem",
    getAlertRule = "getAlertRule",
    createHealthCheck = "createHealthCheck",
    updateHealthCheck = "updateHealthCheck",
    deleteHealthCheck = "deleteHealthCheck",
-    listHealthChecks = "listHealthChecks",
-    createBrowserGatewayTarget = "createBrowserGatewayTarget",
-    updateBrowserGatewayTarget = "updateBrowserGatewayTarget",
-    deleteBrowserGatewayTarget = "deleteBrowserGatewayTarget",
-    getBrowserGatewayTarget = "getBrowserGatewayTarget",
-    listBrowserGatewayTargets = "listBrowserGatewayTargets",
-    listResourcePolicies = "listResourcePolicies",
-    getResourcePolicy = "getResourcePolicy",
-    createResourcePolicy = "createResourcePolicy",
-    updateResourcePolicy = "updateResourcePolicy",
-    deleteResourcePolicy = "deleteResourcePolicy",
-    listResourcePolicyRoles = "listResourcePolicyRoles",
-    setResourcePolicyRoles = "setResourcePolicyRoles",
-    listResourcePolicyUsers = "listResourcePolicyUsers",
-    setResourcePolicyUsers = "setResourcePolicyUsers",
-    setResourcePolicyPassword = "setResourcePolicyPassword",
-    setResourcePolicyPincode = "setResourcePolicyPincode",
-    setResourcePolicyHeaderAuth = "setResourcePolicyHeaderAuth",
-    setResourcePolicyWhitelist = "setResourcePolicyWhitelist",
-    setResourcePolicyRules = "setResourcePolicyRules"
+    listHealthChecks = "listHealthChecks"
 }

 export async function checkUserActionPermission(
@@ -211,23 +185,6 @@ export async function checkUserActionPermission(
            }
        }

-        // If no direct permission, check role-based permission (any of user's roles)
-        const roleActionPermission = await db
-            .select()
-            .from(roleActions)
-            .where(
-                and(
-                    eq(roleActions.actionId, actionId),
-                    inArray(roleActions.roleId, userOrgRoleIds),
-                    eq(roleActions.orgId, req.userOrgId!)
-                )
-            )
-            .limit(1);
-
-        if (roleActionPermission.length > 0) {
-            return true;
-        }
-
        // Check if the user has direct permission for the action in the current org
        const userActionPermission = await db
            .select()
@@ -245,7 +202,20 @@ export async function checkUserActionPermission(
            return true;
        }

-        return false;
+        // If no direct permission, check role-based permission (any of user's roles)
+        const roleActionPermission = await db
+            .select()
+            .from(roleActions)
+            .where(
+                and(
+                    eq(roleActions.actionId, actionId),
+                    inArray(roleActions.roleId, userOrgRoleIds),
+                    eq(roleActions.orgId, req.userOrgId!)
+                )
+            )
+            .limit(1);
+
+        return roleActionPermission.length > 0;
    } catch (error) {
        console.error("Error checking user action permission:", error);
        throw createHttpError(
--- a/server/auth/sessions/resource.ts
+++ b/server/auth/sessions/resource.ts
@@ -19,9 +19,6 @@ export async function createResourceSession(opts: {
    userSessionId?: string | null;
    whitelistId?: number | null;
    accessTokenId?: string | null;
-    policyPasswordId?: number | null;
-    policyPincodeId?: number | null;
-    policyWhitelistId?: number | null;
    doNotExtend?: boolean;
    expiresAt?: number | null;
    sessionLength?: number | null;
@@ -31,10 +28,7 @@ export async function createResourceSession(opts: {
        !opts.pincodeId &&
        !opts.whitelistId &&
        !opts.accessTokenId &&
-        !opts.userSessionId &&
-        !opts.policyPasswordId &&
-        !opts.policyPincodeId &&
-        !opts.policyWhitelistId
+        !opts.userSessionId
    ) {
        throw new Error("Auth method must be provided");
    }
@@ -55,9 +49,6 @@ export async function createResourceSession(opts: {
        whitelistId: opts.whitelistId || null,
        doNotExtend: opts.doNotExtend || false,
        accessTokenId: opts.accessTokenId || null,
-        policyPasswordId: opts.policyPasswordId || null,
-        policyPincodeId: opts.policyPincodeId || null,
-        policyWhitelistId: opts.policyWhitelistId || null,
        isRequestToken: opts.isRequestToken || false,
        userSessionId: opts.userSessionId || null,
        issuedAt: new Date().getTime()
--- a/server/db/names.ts
+++ b/server/db/names.ts
@@ -1,12 +1,6 @@
 import { join } from "path";
 import { readFileSync } from "fs";
-import {
-    clients,
-    db,
-    resourcePolicies,
-    resources,
-    siteResources
-} from "@server/db";
+import { clients, db, resources, siteResources } from "@server/db";
 import { randomInt } from "crypto";
 import { exitNodes, sites } from "@server/db";
 import { eq, and } from "drizzle-orm";
@@ -113,35 +107,6 @@ export async function getUniqueResourceName(orgId: string): Promise<string> {
    }
 }

-export async function getUniqueResourcePolicyName(
-    orgId: string
-): Promise<string> {
-    let loops = 0;
-    while (true) {
-        if (loops > 100) {
-            throw new Error("Could not generate a unique name");
-        }
-
-        const name = generateName();
-        const policyCount = await db
-            .select({
-                niceId: resourcePolicies.niceId,
-                orgId: resourcePolicies.orgId
-            })
-            .from(resourcePolicies)
-            .where(
-                and(
-                    eq(resourcePolicies.niceId, name),
-                    eq(resourcePolicies.orgId, orgId)
-                )
-            );
-        if (policyCount.length === 0) {
-            return name;
-        }
-        loops++;
-    }
-}
-
 export async function getUniqueSiteResourceName(
    orgId: string
 ): Promise<string> {
--- a/server/db/pg/index.ts
+++ b/server/db/pg/index.ts
@@ -4,4 +4,3 @@ export * from "./safeRead";
 export * from "./schema/schema";
 export * from "./schema/privateSchema";
 export * from "./migrate";
-export { alias } from "drizzle-orm/pg-core";
--- a/server/db/pg/schema/privateSchema.ts
+++ b/server/db/pg/schema/privateSchema.ts
@@ -2,7 +2,6 @@ import {
    pgTable,
    serial,
    varchar,
-    unique,
    boolean,
    integer,
    bigint,
@@ -20,13 +19,12 @@ import {
    roles,
    users,
    exitNodes,
+    sessions,
+    clients,
    resources,
    siteResources,
    targetHealthCheck,
-    sites,
-    clients,
-    sessions,
-    labels
+    sites
 } from "./schema";

 export const certificates = pgTable("certificates", {
@@ -199,42 +197,6 @@ export const remoteExitNodes = pgTable("remoteExitNode", {
    })
 });

-export const remoteExitNodeResources = pgTable("remoteExitNodeResources", {
-    remoteExitNodeResourceId: serial("remoteExitNodeResourceId").primaryKey(),
-    remoteExitNodeId: varchar("remoteExitNodeId")
-        .notNull()
-        .references(() => remoteExitNodes.remoteExitNodeId, {
-            onDelete: "cascade"
-        }),
-    destination: varchar("destination").notNull() // a cidr range
-});
-
-export const remoteExitNodePreferenceLabels = pgTable(
-    // this controls what sites are enforced to connect to this node
-    "remoteExitNodePreferenceLabels",
-    {
-        remoteExitNodePreferenceLabelId: serial(
-            "remoteExitNodePreferenceLabelId"
-        ).primaryKey(),
-        remoteExitNode: integer("remoteExitNode")
-            .references(() => remoteExitNodes.remoteExitNodeId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [
-        unique("remote_exit_node_preference_label_uniq").on(
-            t.remoteExitNode,
-            t.labelId
-        )
-    ]
-);
-
 export const remoteExitNodeSessions = pgTable("remoteExitNodeSession", {
    sessionId: varchar("id").primaryKey(),
    remoteExitNodeId: varchar("remoteExitNodeId")
@@ -618,24 +580,6 @@ export const trialNotifications = pgTable("trialNotifications", {
    sentAt: bigint("sentAt", { mode: "number" }).notNull()
 });

-export const browserGatewayTarget = pgTable("browserGatewayTarget", {
-    browserGatewayTargetId: serial("browserGatewayTargetId").primaryKey(),
-    resourceId: integer("resourceId")
-        .references(() => resources.resourceId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    authToken: varchar("authToken").notNull(),
-    type: varchar("type").notNull(), // "ssh", "rdp", "vnc"
-    destination: varchar("destination").notNull(),
-    destinationPort: integer("destinationPort").notNull()
-});
-
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -683,6 +627,3 @@ export type AlertEmailRecipients = InferSelectModel<
 >;
 export type AlertWebhookActions = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
-export type BrowserGatewayTarget = InferSelectModel<
-    typeof browserGatewayTarget
->;
--- a/server/db/pg/schema/schema.ts
+++ b/server/db/pg/schema/schema.ts
@@ -65,12 +65,7 @@ export const orgs = pgTable("orgs", {
    sshCaPrivateKey: text("sshCaPrivateKey"), // Encrypted SSH CA private key (PEM format)
    sshCaPublicKey: text("sshCaPublicKey"), // SSH CA public key (OpenSSH format)
    isBillingOrg: boolean("isBillingOrg"),
-    billingOrgId: varchar("billingOrgId"),
-    settingsEnableGlobalNewtAutoUpdate: boolean(
-        "settingsEnableGlobalNewtAutoUpdate"
-    )
-        .notNull()
-        .default(false)
+    billingOrgId: varchar("billingOrgId")
 });

 export const orgDomains = pgTable("orgDomains", {
@@ -108,10 +103,6 @@ export const sites = pgTable("sites", {
    lastHolePunch: bigint("lastHolePunch", { mode: "number" }),
    listenPort: integer("listenPort"),
    dockerSocketEnabled: boolean("dockerSocketEnabled").notNull().default(true),
-    autoUpdateEnabled: boolean("autoUpdateEnabled").notNull().default(false),
-    autoUpdateOverrideOrg: boolean("autoUpdateOverrideOrg")
-        .notNull()
-        .default(false),
    status: varchar("status")
        .$type<"pending" | "approved">()
        .default("approved")
@@ -119,16 +110,6 @@ export const sites = pgTable("sites", {

 export const resources = pgTable("resources", {
    resourceId: serial("resourceId").primaryKey(),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
    resourceGuid: varchar("resourceGuid", { length: 36 })
        .unique()
        .notNull()
@@ -148,6 +129,8 @@ export const resources = pgTable("resources", {
    ssl: boolean("ssl").notNull().default(false),
    blockAccess: boolean("blockAccess").notNull().default(false),
    sso: boolean("sso").notNull().default(true),
+    http: boolean("http").notNull().default(true),
+    protocol: varchar("protocol").notNull(),
    proxyPort: integer("proxyPort"),
    emailWhitelistEnabled: boolean("emailWhitelistEnabled")
        .notNull()
@@ -164,6 +147,7 @@ export const resources = pgTable("resources", {
    headers: text("headers"), // comma-separated list of headers to add to the request
    proxyProtocol: boolean("proxyProtocol").notNull().default(false),
    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+
    maintenanceModeEnabled: boolean("maintenanceModeEnabled")
        .notNull()
        .default(false),
@@ -175,100 +159,9 @@ export const resources = pgTable("resources", {
    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
    postAuthPath: text("postAuthPath"),
    health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    wildcard: boolean("wildcard").notNull().default(false),
-    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
-    pamMode: varchar("pamMode", { length: 32 })
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
-    authDaemonMode: varchar("authDaemonMode", { length: 32 })
-        .$type<"site" | "remote" | "native">()
-        .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    wildcard: boolean("wildcard").notNull().default(false)
 });

-export const labels = pgTable("labels", {
-    labelId: serial("labelId").primaryKey(),
-    name: varchar("name").notNull(),
-    color: varchar("color").notNull(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
-export const siteLabels = pgTable(
-    "siteLabels",
-    {
-        siteLabelId: serial("siteLabelId").primaryKey(),
-        siteId: integer("siteId")
-            .references(() => sites.siteId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_label_uniq").on(t.siteId, t.labelId)]
-);
-
-export const resourceLabels = pgTable(
-    "resourceLabels",
-    {
-        resourceLabelId: serial("resourceLabelId").primaryKey(),
-        resourceId: integer("resourceId")
-            .references(() => resources.resourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("resource_label_uniq").on(t.resourceId, t.labelId)]
-);
-
-export const siteResourceLabels = pgTable(
-    "siteResourceLabels",
-    {
-        siteResourceLabelId: serial("siteResourceLabelId").primaryKey(),
-        siteResourceId: integer("siteResourceId")
-            .references(() => siteResources.siteResourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_resource_label_uniq").on(t.siteResourceId, t.labelId)]
-);
-
-export const clientLabels = pgTable(
-    "clientLabels",
-    {
-        clientLabelId: serial("clientLabelId").primaryKey(),
-        clientId: integer("clientId")
-            .references(() => clients.clientId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
-);
-
 export const targets = pgTable("targets", {
    targetId: serial("targetId").primaryKey(),
    resourceId: integer("resourceId")
@@ -303,11 +196,9 @@ export const targetHealthCheck = pgTable("targetHealthCheck", {
            onDelete: "cascade"
        })
        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
+    siteId: integer("siteId").references(() => sites.siteId, {
+        onDelete: "cascade"
+    }).notNull(),
    name: varchar("name"),
    hcEnabled: boolean("hcEnabled").notNull().default(false),
    hcPath: varchar("hcPath"),
@@ -363,11 +254,11 @@ export const siteResources = pgTable("siteResources", {
    niceId: varchar("niceId").notNull(),
    name: varchar("name").notNull(),
    ssl: boolean("ssl").notNull().default(false),
-    mode: varchar("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
+    mode: varchar("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
    scheme: varchar("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
    proxyPort: integer("proxyPort"), // only for port mode
    destinationPort: integer("destinationPort"), // only for port mode
-    destination: varchar("destination"), // ip, cidr, hostname; validate against the mode
+    destination: varchar("destination").notNull(), // ip, cidr, hostname; validate against the mode
    enabled: boolean("enabled").notNull().default(true),
    alias: varchar("alias"),
    aliasAddress: varchar("aliasAddress"),
@@ -375,11 +266,8 @@ export const siteResources = pgTable("siteResources", {
    udpPortRangeString: varchar("udpPortRangeString").notNull().default("*"),
    disableIcmp: boolean("disableIcmp").notNull().default(false),
    authDaemonPort: integer("authDaemonPort").default(22123),
-    pamMode: varchar("pamMode", { length: 32 })
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
    authDaemonMode: varchar("authDaemonMode", { length: 32 })
-        .$type<"site" | "remote" | "native">()
+        .$type<"site" | "remote">()
        .default("site"),
    domainId: varchar("domainId").references(() => domains.domainId, {
        onDelete: "set null"
@@ -633,38 +521,6 @@ export const userResources = pgTable("userResources", {
        .references(() => resources.resourceId, { onDelete: "cascade" })
 });

-export const rolePolicies = pgTable("rolePolicies", {
-    roleId: integer("roleId")
-        .notNull()
-        .references(() => roles.roleId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const userPolicies = pgTable("userPolicies", {
-    userId: varchar("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyWhiteList = pgTable("resourcePolicyWhitelist", {
-    whitelistId: serial("id").primaryKey(),
-    email: varchar("email").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
 export const userInvites = pgTable("userInvites", {
    inviteId: varchar("inviteId").primaryKey(),
    orgId: varchar("orgId")
@@ -730,40 +586,6 @@ export const resourceHeaderAuthExtendedCompatibility = pgTable(
    }
 );

-export const resourcePolicyPincode = pgTable("resourcePolicyPincode", {
-    pincodeId: serial("pincodeId").primaryKey(),
-    pincodeHash: varchar("pincodeHash").notNull(),
-    digitLength: integer("digitLength").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyPassword = pgTable("resourcePolicyPassword", {
-    passwordId: serial("passwordId").primaryKey(),
-    passwordHash: varchar("passwordHash").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyHeaderAuth = pgTable("resourcePolicyHeaderAuth", {
-    headerAuthId: serial("headerAuthId").primaryKey(),
-    headerAuthHash: varchar("headerAuthHash").notNull(),
-    extendedCompatibility: boolean("extendedCompatibility")
-        .notNull()
-        .default(true),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
 export const resourceAccessToken = pgTable("resourceAccessToken", {
    accessTokenId: varchar("accessTokenId").primaryKey(),
    orgId: varchar("orgId")
@@ -772,7 +594,6 @@ export const resourceAccessToken = pgTable("resourceAccessToken", {
    resourceId: integer("resourceId")
        .notNull()
        .references(() => resources.resourceId, { onDelete: "cascade" }),
-    path: varchar("path"),
    tokenHash: varchar("tokenHash").notNull(),
    sessionLength: bigint("sessionLength", { mode: "number" }).notNull(),
    expiresAt: bigint("expiresAt", { mode: "number" }),
@@ -820,24 +641,6 @@ export const resourceSessions = pgTable("resourceSessions", {
            onDelete: "cascade"
        }
    ),
-    policyPasswordId: integer("policyPasswordId").references(
-        () => resourcePolicyPassword.passwordId,
-        {
-            onDelete: "cascade"
-        }
-    ),
-    policyPincodeId: integer("policyPincodeId").references(
-        () => resourcePolicyPincode.pincodeId,
-        {
-            onDelete: "cascade"
-        }
-    ),
-    policyWhitelistId: integer("policyWhitelistId").references(
-        () => resourcePolicyWhiteList.whitelistId,
-        {
-            onDelete: "cascade"
-        }
-    ),
    issuedAt: bigint("issuedAt", { mode: "number" })
 });

@@ -876,43 +679,6 @@ export const resourceRules = pgTable("resourceRules", {
    value: varchar("value").notNull()
 });

-export const resourcePolicyRules = pgTable("resourcePolicyRules", {
-    ruleId: serial("ruleId").primaryKey(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        }),
-    enabled: boolean("enabled").notNull().default(true),
-    priority: integer("priority").notNull(),
-    action: varchar("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
-    match: varchar("match").$type<"CIDR" | "PATH" | "IP">().notNull(),
-    value: varchar("value").notNull()
-});
-
-export const resourcePolicies = pgTable("resourcePolicies", {
-    resourcePolicyId: serial("resourcePolicyId").primaryKey(),
-    sso: boolean("sso").notNull().default(true),
-    applyRules: boolean("applyRules").notNull().default(false),
-    scope: varchar("scope")
-        .$type<"global" | "resource">()
-        .notNull()
-        .default("global"),
-    emailWhitelistEnabled: boolean("emailWhitelistEnabled")
-        .notNull()
-        .default(false),
-    idpId: integer("idpId").references(() => idp.idpId, {
-        onDelete: "set null"
-    }),
-    niceId: text("niceId").notNull(),
-    name: varchar("name").notNull(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
 export const supporterKey = pgTable("supporterKey", {
    keyId: serial("keyId").primaryKey(),
    key: varchar("key").notNull(),
@@ -1331,30 +1097,19 @@ export const roundTripMessageTracker = pgTable("roundTripMessageTracker", {
    complete: boolean("complete").notNull().default(false)
 });

-export const statusHistory = pgTable(
-    "statusHistory",
-    {
-        id: serial("id").primaryKey(),
-        entityType: varchar("entityType").notNull(),
-        entityId: integer("entityId").notNull(),
-        orgId: varchar("orgId")
-            .notNull()
-            .references(() => orgs.orgId, { onDelete: "cascade" }),
-        status: varchar("status").notNull(),
-        timestamp: integer("timestamp").notNull()
-    },
-    (table) => [
-        index("idx_statusHistory_entity").on(
-            table.entityType,
-            table.entityId,
-            table.timestamp
-        ),
-        index("idx_statusHistory_org_timestamp").on(
-            table.orgId,
-            table.timestamp
-        )
-    ]
-);
+export const statusHistory = pgTable("statusHistory", {
+    id: serial("id").primaryKey(),
+    entityType: varchar("entityType").notNull(),
+    entityId: integer("entityId").notNull(),
+    orgId: varchar("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    status: varchar("status").notNull(),
+    timestamp: integer("timestamp").notNull(),
+}, (table) => [
+    index("idx_statusHistory_entity").on(table.entityType, table.entityId, table.timestamp),
+    index("idx_statusHistory_org_timestamp").on(table.orgId, table.timestamp),
+]);

 export type Org = InferSelectModel<typeof orgs>;
 export type User = InferSelectModel<typeof users>;
@@ -1392,16 +1147,6 @@ export type ResourceHeaderAuthExtendedCompatibility = InferSelectModel<
 export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
 export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
 export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
-export type ResourcePolicyPincode = InferSelectModel<
-    typeof resourcePolicyPincode
->;
-export type ResourcePolicyPassword = InferSelectModel<
-    typeof resourcePolicyPassword
->;
-export type ResourcePolicyHeaderAuth = InferSelectModel<
-    typeof resourcePolicyHeaderAuth
->;
-
 export type VersionMigration = InferSelectModel<typeof versionMigrations>;
 export type ResourceRule = InferSelectModel<typeof resourceRules>;
 export type Domain = InferSelectModel<typeof domains>;
@@ -1434,7 +1179,3 @@ export type RoundTripMessageTracker = InferSelectModel<
 >;
 export type Network = InferSelectModel<typeof networks>;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
-export type Label = InferSelectModel<typeof labels>;
-export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
-export type RolePolicy = InferSelectModel<typeof rolePolicies>;
-export type UserPolicy = InferSelectModel<typeof userPolicies>;
--- a/server/db/queries/verifySessionQueries.ts
+++ b/server/db/queries/verifySessionQueries.ts
@@ -17,37 +17,22 @@ import {
    resourceHeaderAuth,
    ResourceHeaderAuth,
    resourceRules,
-    resourcePolicyRules,
    resources,
    roleResources,
-    rolePolicies,
    sessions,
    userResources,
-    userPolicies,
    users,
    ResourceHeaderAuthExtendedCompatibility,
-    resourceHeaderAuthExtendedCompatibility,
-    resourcePolicies,
-    resourcePolicyPincode,
-    ResourcePolicyPincode,
-    resourcePolicyPassword,
-    ResourcePolicyPassword,
-    resourcePolicyHeaderAuth,
-    ResourcePolicyHeaderAuth
+    resourceHeaderAuthExtendedCompatibility
 } from "@server/db";
-import { alias } from "@server/db";
-import { and, eq, inArray, isNull, or, sql } from "drizzle-orm";
-import logger from "@server/logger";
+import { and, eq, inArray, or, sql } from "drizzle-orm";

 export type ResourceWithAuth = {
    resource: Resource | null;
-    pincode: ResourcePincode | ResourcePolicyPincode | null;
-    password: ResourcePassword | ResourcePolicyPassword | null;
-    headerAuth: ResourceHeaderAuth | ResourcePolicyHeaderAuth | null;
+    pincode: ResourcePincode | null;
+    password: ResourcePassword | null;
+    headerAuth: ResourceHeaderAuth | null;
    headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
-    applyRules: boolean;
-    sso: boolean;
-    emailWhitelistEnabled: boolean;
    org: Org;
 };

@@ -72,33 +57,6 @@ export async function getResourceByDomain(
        wildcardCandidates.push(`*.${parts.slice(i).join(".")}`);
    }

-    const sharedPolicy = alias(resourcePolicies, "sharedPolicy");
-    const defaultPolicy = alias(resourcePolicies, "defaultPolicy");
-    const sharedPolicyPincode = alias(
-        resourcePolicyPincode,
-        "sharedPolicyPincode"
-    );
-    const defaultPolicyPincode = alias(
-        resourcePolicyPincode,
-        "defaultPolicyPincode"
-    );
-    const sharedPolicyPassword = alias(
-        resourcePolicyPassword,
-        "sharedPolicyPassword"
-    );
-    const defaultPolicyPassword = alias(
-        resourcePolicyPassword,
-        "defaultPolicyPassword"
-    );
-    const sharedPolicyHeaderAuth = alias(
-        resourcePolicyHeaderAuth,
-        "sharedPolicyHeaderAuth"
-    );
-    const defaultPolicyHeaderAuth = alias(
-        resourcePolicyHeaderAuth,
-        "defaultPolicyHeaderAuth"
-    );
-
    const potentialResults = await db
        .select()
        .from(resources)
@@ -121,59 +79,6 @@ export async function getResourceByDomain(
                resources.resourceId
            )
        )
-        .leftJoin(
-            sharedPolicy,
-            eq(sharedPolicy.resourcePolicyId, resources.resourcePolicyId)
-        )
-        .leftJoin(
-            sharedPolicyPincode,
-            eq(
-                sharedPolicyPincode.resourcePolicyId,
-                sharedPolicy.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            sharedPolicyPassword,
-            eq(
-                sharedPolicyPassword.resourcePolicyId,
-                sharedPolicy.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            sharedPolicyHeaderAuth,
-            eq(
-                sharedPolicyHeaderAuth.resourcePolicyId,
-                sharedPolicy.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            defaultPolicy,
-            eq(
-                defaultPolicy.resourcePolicyId,
-                resources.defaultResourcePolicyId
-            )
-        )
-        .leftJoin(
-            defaultPolicyPincode,
-            eq(
-                defaultPolicyPincode.resourcePolicyId,
-                defaultPolicy.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            defaultPolicyPassword,
-            eq(
-                defaultPolicyPassword.resourcePolicyId,
-                defaultPolicy.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            defaultPolicyHeaderAuth,
-            eq(
-                defaultPolicyHeaderAuth.resourcePolicyId,
-                defaultPolicy.resourcePolicyId
-            )
-        )
        .innerJoin(orgs, eq(orgs.orgId, resources.orgId))
        .where(
            or(
@@ -203,51 +108,13 @@ export async function getResourceByDomain(
        return null;
    }

-    // If a shared (custom) policy is assigned to the resource, use ONLY
-    // its values — do not fall back to the default policy. The default
-    // policy is only consulted when no shared policy is assigned at all.
-    const hasSharedPolicy = result.sharedPolicy !== null;
-
-    const effectivePolicyPincode = hasSharedPolicy
-        ? result.sharedPolicyPincode
-        : (result.defaultPolicyPincode ?? null);
-    const effectivePolicyPassword = hasSharedPolicy
-        ? result.sharedPolicyPassword
-        : (result.defaultPolicyPassword ?? null);
-    const effectivePolicyHeaderAuth = hasSharedPolicy
-        ? result.sharedPolicyHeaderAuth
-        : (result.defaultPolicyHeaderAuth ?? null);
-    const selectedPolicy = hasSharedPolicy
-        ? result.sharedPolicy
-        : result.defaultPolicy;
-    const effectiveApplyRules =
-        selectedPolicy?.applyRules ?? result.resources.applyRules;
-    const effectiveSSO = selectedPolicy?.sso ?? result.resources.sso;
-    const effectiveEmailWhitelistEnabled =
-        selectedPolicy?.emailWhitelistEnabled ??
-        result.resources.emailWhitelistEnabled;
-
    return {
-        resource: {
-            ...result.resources,
-            applyRules: effectiveApplyRules,
-            sso: effectiveSSO,
-            emailWhitelistEnabled: effectiveEmailWhitelistEnabled
-        }, // doing this for backward compatability so the remote nodes get the value as part of the resource struct
-        pincode: effectivePolicyPincode ?? result.resourcePincode,
-        password: effectivePolicyPassword ?? result.resourcePassword,
-        headerAuth: effectivePolicyHeaderAuth ?? result.resourceHeaderAuth,
-        headerAuthExtendedCompatibility: effectivePolicyHeaderAuth
-            ? ({
-                  headerAuthExtendedCompatibilityId: 0,
-                  resourceId: result.resources.resourceId,
-                  extendedCompatibilityIsActivated:
-                      effectivePolicyHeaderAuth.extendedCompatibility
-              } as ResourceHeaderAuthExtendedCompatibility)
-            : result.resourceHeaderAuthExtendedCompatibility,
-        applyRules: effectiveApplyRules,
-        sso: effectiveSSO,
-        emailWhitelistEnabled: effectiveEmailWhitelistEnabled,
+        resource: result.resources,
+        pincode: result.resourcePincode,
+        password: result.resourcePassword,
+        headerAuth: result.resourceHeaderAuth,
+        headerAuthExtendedCompatibility:
+            result.resourceHeaderAuthExtendedCompatibility,
        org: result.orgs
    };
 }
@@ -287,165 +154,58 @@ export async function getRoleName(roleId: number): Promise<string | null> {
 }

 /**
- * Check if role has access to resource (direct or via resource policy)
+ * Check if role has access to resource
 */
 export async function getRoleResourceAccess(
    resourceId: number,
    roleIds: number[]
 ) {
-    const [direct, viaPolicies] = await Promise.all([
-        db
-            .select()
-            .from(roleResources)
-            .where(
-                and(
-                    eq(roleResources.resourceId, resourceId),
-                    inArray(roleResources.roleId, roleIds)
-                )
-            ),
-        db
-            .select({
-                roleId: rolePolicies.roleId,
-                resourcePolicyId: rolePolicies.resourcePolicyId
-            })
-            .from(rolePolicies)
-            .innerJoin(
-                resources,
-                // Shared policy wins; only use default policy when no shared
-                // policy is assigned to the resource.
-                or(
-                    eq(
-                        resources.resourcePolicyId,
-                        rolePolicies.resourcePolicyId
-                    ),
-                    and(
-                        isNull(resources.resourcePolicyId),
-                        eq(
-                            resources.defaultResourcePolicyId,
-                            rolePolicies.resourcePolicyId
-                        )
-                    )
-                )
+    const roleResourceAccess = await db
+        .select()
+        .from(roleResources)
+        .where(
+            and(
+                eq(roleResources.resourceId, resourceId),
+                inArray(roleResources.roleId, roleIds)
            )
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    inArray(rolePolicies.roleId, roleIds)
-                )
-            )
-    ]);
+        );

-    const combined = [...direct, ...viaPolicies];
-    return combined.length > 0 ? combined : null;
+    return roleResourceAccess.length > 0 ? roleResourceAccess : null;
 }

 /**
- * Check if user has access to resource (direct or via resource policy)
+ * Check if user has direct access to resource
 */
 export async function getUserResourceAccess(
    userId: string,
    resourceId: number
 ) {
-    const [direct, viaPolicies] = await Promise.all([
-        db
-            .select()
-            .from(userResources)
-            .where(
-                and(
-                    eq(userResources.userId, userId),
-                    eq(userResources.resourceId, resourceId)
-                )
+    const userResourceAccess = await db
+        .select()
+        .from(userResources)
+        .where(
+            and(
+                eq(userResources.userId, userId),
+                eq(userResources.resourceId, resourceId)
            )
-            .limit(1),
-        db
-            .select({
-                userId: userPolicies.userId,
-                resourcePolicyId: userPolicies.resourcePolicyId
-            })
-            .from(userPolicies)
-            .innerJoin(
-                resources,
-                // Shared policy wins; only use default policy when no shared
-                // policy is assigned to the resource.
-                or(
-                    eq(
-                        resources.resourcePolicyId,
-                        userPolicies.resourcePolicyId
-                    ),
-                    and(
-                        isNull(resources.resourcePolicyId),
-                        eq(
-                            resources.defaultResourcePolicyId,
-                            userPolicies.resourcePolicyId
-                        )
-                    )
-                )
-            )
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(userPolicies.userId, userId)
-                )
-            )
-            .limit(1)
-    ]);
+        )
+        .limit(1);

-    return direct[0] ?? viaPolicies[0] ?? null;
+    return userResourceAccess.length > 0 ? userResourceAccess[0] : null;
 }

 /**
- * Get resource rules for a given resource (direct and via resource policy)
+ * Get resource rules for a given resource
 */
 export async function getResourceRules(
    resourceId: number
 ): Promise<ResourceRule[]> {
-    const [directRules, policyRules] = await Promise.all([
-        db
-            .select()
-            .from(resourceRules)
-            .where(eq(resourceRules.resourceId, resourceId)),
-        db
-            .select({
-                ruleId: resourcePolicyRules.ruleId,
-                resourceId: sql<number>`${resourceId}`,
-                enabled: resourcePolicyRules.enabled,
-                priority: resourcePolicyRules.priority,
-                action: resourcePolicyRules.action,
-                match: resourcePolicyRules.match,
-                value: resourcePolicyRules.value
-            })
-            .from(resourcePolicyRules)
-            .innerJoin(
-                resources,
-                // Shared policy wins; only use default policy when no shared
-                // policy is assigned to the resource.
-                or(
-                    eq(
-                        resources.resourcePolicyId,
-                        resourcePolicyRules.resourcePolicyId
-                    ),
-                    and(
-                        isNull(resources.resourcePolicyId),
-                        eq(
-                            resources.defaultResourcePolicyId,
-                            resourcePolicyRules.resourcePolicyId
-                        )
-                    )
-                )
-            )
-            .where(eq(resources.resourceId, resourceId))
-    ]);
+    const rules = await db
+        .select()
+        .from(resourceRules)
+        .where(eq(resourceRules.resourceId, resourceId));

-    const maxDirectPriority = directRules.reduce(
-        (max, r) => Math.max(max, r.priority),
-        0
-    );
-    const offsetPolicyRules = policyRules.map((r) => ({
-        ...r,
-        priority: maxDirectPriority + r.priority
-    }));
-
-    return [...directRules, ...offsetPolicyRules] as ResourceRule[];
+    return rules;
 }

 /**
--- a/server/db/sqlite/index.ts
+++ b/server/db/sqlite/index.ts
@@ -4,4 +4,3 @@ export * from "./safeRead";
 export * from "./schema/schema";
 export * from "./schema/privateSchema";
 export * from "./migrate";
-export { alias } from "drizzle-orm/sqlite-core";
--- a/server/db/sqlite/schema/privateSchema.ts
+++ b/server/db/sqlite/schema/privateSchema.ts
@@ -12,7 +12,6 @@ import {
    clients,
    domains,
    exitNodes,
-    labels,
    orgs,
    resources,
    roles,
@@ -22,6 +21,9 @@ import {
    targetHealthCheck,
    users
 } from "./schema";
+import { serial, varchar } from "drizzle-orm/mysql-core";
+import { pgTable } from "drizzle-orm/pg-core";
+import { bigint } from "zod";

 export const certificates = sqliteTable("certificates", {
    certId: integer("certId").primaryKey({ autoIncrement: true }),
@@ -193,44 +195,6 @@ export const remoteExitNodes = sqliteTable("remoteExitNode", {
    })
 });

-export const remoteExitNodeResources = sqliteTable("remoteExitNodeResources", {
-    remoteExitNodeResourceId: integer("remoteExitNodeResourceId").primaryKey({
-        autoIncrement: true
-    }),
-    remoteExitNodeId: text("remoteExitNodeId")
-        .notNull()
-        .references(() => remoteExitNodes.remoteExitNodeId, {
-            onDelete: "cascade"
-        }),
-    destination: text("destination").notNull() // a cidr range
-});
-
-export const remoteExitNodePreferenceLabels = sqliteTable(
-    // this controls what sites are enforced to connect to this node
-    "remoteExitNodePreferenceLabels",
-    {
-        remoteExitNodePreferenceLabelId: integer(
-            "remoteExitNodePreferenceLabelId"
-        ).primaryKey({ autoIncrement: true }),
-        remoteExitNodeId: text("remoteExitNodeId")
-            .references(() => remoteExitNodes.remoteExitNodeId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [
-        uniqueIndex("remote_exit_node_preference_label_uniq").on(
-            t.remoteExitNodeId,
-            t.labelId
-        )
-    ]
-);
-
 export const remoteExitNodeSessions = sqliteTable("remoteExitNodeSession", {
    sessionId: text("id").primaryKey(),
    remoteExitNodeId: text("remoteExitNodeId")
@@ -624,26 +588,6 @@ export const trialNotifications = sqliteTable("trialNotifications", {
    sentAt: integer("sentAt").notNull()
 });

-export const browserGatewayTarget = sqliteTable("browserGatewayTarget", {
-    browserGatewayTargetId: integer("browserGatewayTargetId").primaryKey({
-        autoIncrement: true
-    }),
-    resourceId: integer("resourceId")
-        .references(() => resources.resourceId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    authToken: text("authToken").notNull(),
-    type: text("type").notNull(), // "ssh", "rdp", "vnc"
-    destination: text("destination").notNull(),
-    destinationPort: integer("destinationPort").notNull()
-});
-
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -683,6 +627,3 @@ export type AlertEmailAction = InferSelectModel<typeof alertEmailActions>;
 export type AlertEmailRecipient = InferSelectModel<typeof alertEmailRecipients>;
 export type AlertWebhookAction = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
-export type BrowserGatewayTarget = InferSelectModel<
-    typeof browserGatewayTarget
->;
--- a/server/db/sqlite/schema/schema.ts
+++ b/server/db/sqlite/schema/schema.ts
@@ -62,13 +62,7 @@ export const orgs = sqliteTable("orgs", {
    sshCaPrivateKey: text("sshCaPrivateKey"), // Encrypted SSH CA private key (PEM format)
    sshCaPublicKey: text("sshCaPublicKey"), // SSH CA public key (OpenSSH format)
    isBillingOrg: integer("isBillingOrg", { mode: "boolean" }),
-    billingOrgId: text("billingOrgId"),
-    settingsEnableGlobalNewtAutoUpdate: integer(
-        "settingsEnableGlobalNewtAutoUpdate",
-        { mode: "boolean" }
-    )
-        .notNull()
-        .default(false)
+    billingOrgId: text("billingOrgId")
 });

 export const userDomains = sqliteTable("userDomains", {
@@ -122,29 +116,11 @@ export const sites = sqliteTable("sites", {
    dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
        .notNull()
        .default(true),
-    autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
    status: text("status").$type<"pending" | "approved">().default("approved")
 });

 export const resources = sqliteTable("resources", {
    resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
    resourceGuid: text("resourceGuid", { length: 36 })
        .unique()
        .notNull()
@@ -166,6 +142,8 @@ export const resources = sqliteTable("resources", {
        .notNull()
        .default(false),
    sso: integer("sso", { mode: "boolean" }).notNull().default(true),
+    http: integer("http", { mode: "boolean" }).notNull().default(true),
+    protocol: text("protocol").notNull(),
    proxyPort: integer("proxyPort"),
    emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
        .notNull()
@@ -188,6 +166,7 @@ export const resources = sqliteTable("resources", {
        .notNull()
        .default(false),
    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+
    maintenanceModeEnabled: integer("maintenanceModeEnabled", {
        mode: "boolean"
    })
@@ -201,106 +180,9 @@ export const resources = sqliteTable("resources", {
    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
    postAuthPath: text("postAuthPath"),
    health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
-    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
-    pamMode: text("pamMode")
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
-    authDaemonMode: text("authDaemonMode")
-        .$type<"site" | "remote" | "native">()
-        .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false)
 });

-export const labels = sqliteTable("labels", {
-    labelId: integer("labelId").primaryKey({ autoIncrement: true }),
-    name: text("name").notNull(),
-    color: text("color").notNull(),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
-export const siteLabels = sqliteTable(
-    "siteLabels",
-    {
-        siteLabelId: integer("siteLabelId").primaryKey({ autoIncrement: true }),
-        siteId: integer("siteId")
-            .references(() => sites.siteId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_label_uniq").on(t.siteId, t.labelId)]
-);
-
-export const resourceLabels = sqliteTable(
-    "resourceLabels",
-    {
-        resourceLabelId: integer("resourceLabelId").primaryKey({
-            autoIncrement: true
-        }),
-        resourceId: integer("resourceId")
-            .references(() => resources.resourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("resource_label_uniq").on(t.resourceId, t.labelId)]
-);
-
-export const siteResourceLabels = sqliteTable(
-    "siteResourceLabels",
-    {
-        siteResourceLabelId: integer("siteResourceLabelId").primaryKey({
-            autoIncrement: true
-        }),
-        siteResourceId: integer("siteResourceId")
-            .references(() => siteResources.siteResourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_resource_label_uniq").on(t.siteResourceId, t.labelId)]
-);
-
-export const clientLabels = sqliteTable(
-    "clientLabels",
-    {
-        clientLabelId: integer("clientLabelId").primaryKey({
-            autoIncrement: true
-        }),
-        clientId: integer("clientId")
-            .references(() => clients.clientId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
-);
-
 export const targets = sqliteTable("targets", {
    targetId: integer("targetId").primaryKey({ autoIncrement: true }),
    resourceId: integer("resourceId")
@@ -337,11 +219,9 @@ export const targetHealthCheck = sqliteTable("targetHealthCheck", {
            onDelete: "cascade"
        })
        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
+    siteId: integer("siteId").references(() => sites.siteId, {
+        onDelete: "cascade"
+    }).notNull(),
    name: text("name"),
    hcEnabled: integer("hcEnabled", { mode: "boolean" })
        .notNull()
@@ -401,11 +281,11 @@ export const siteResources = sqliteTable("siteResources", {
    niceId: text("niceId").notNull(),
    name: text("name").notNull(),
    ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-    mode: text("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
+    mode: text("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
    scheme: text("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
    proxyPort: integer("proxyPort"), // only for port mode
    destinationPort: integer("destinationPort"), // only for port mode
-    destination: text("destination"), // ip, cidr, hostname
+    destination: text("destination").notNull(), // ip, cidr, hostname
    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
    alias: text("alias"),
    aliasAddress: text("aliasAddress"),
@@ -415,11 +295,8 @@ export const siteResources = sqliteTable("siteResources", {
        .notNull()
        .default(false),
    authDaemonPort: integer("authDaemonPort").default(22123),
-    pamMode: text("pamMode")
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
    authDaemonMode: text("authDaemonMode")
-        .$type<"site" | "remote" | "native">()
+        .$type<"site" | "remote">()
        .default("site"),
    domainId: text("domainId").references(() => domains.domainId, {
        onDelete: "set null"
@@ -1032,47 +909,6 @@ export const resourceHeaderAuth = sqliteTable("resourceHeaderAuth", {
    headerAuthHash: text("headerAuthHash").notNull()
 });

-export const resourcePolicyPincode = sqliteTable("resourcePolicyPincode", {
-    pincodeId: integer("pincodeId").primaryKey({ autoIncrement: true }),
-    pincodeHash: text("pincodeHash").notNull(),
-    digitLength: integer("digitLength").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyPassword = sqliteTable("resourcePolicyPassword", {
-    passwordId: integer("passwordId").primaryKey({ autoIncrement: true }),
-    passwordHash: text("passwordHash").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyHeaderAuth = sqliteTable(
-    "resourcePolicyHeaderAuth",
-    {
-        headerAuthId: integer("headerAuthId").primaryKey({
-            autoIncrement: true
-        }),
-        headerAuthHash: text("headerAuthHash").notNull(),
-        extendedCompatibility: integer("extendedCompatibility", {
-            mode: "boolean"
-        })
-            .notNull()
-            .default(true),
-        resourcePolicyId: integer("resourcePolicyId")
-            .notNull()
-            .references(() => resourcePolicies.resourcePolicyId, {
-                onDelete: "cascade"
-            })
-    }
-);
-
 export const resourceHeaderAuthExtendedCompatibility = sqliteTable(
    "resourceHeaderAuthExtendedCompatibility",
    {
@@ -1101,7 +937,6 @@ export const resourceAccessToken = sqliteTable("resourceAccessToken", {
    resourceId: integer("resourceId")
        .notNull()
        .references(() => resources.resourceId, { onDelete: "cascade" }),
-    path: text("path"),
    tokenHash: text("tokenHash").notNull(),
    sessionLength: integer("sessionLength").notNull(),
    expiresAt: integer("expiresAt"),
@@ -1148,24 +983,6 @@ export const resourceSessions = sqliteTable("resourceSessions", {
            onDelete: "cascade"
        }
    ),
-    policyPasswordId: integer("policyPasswordId").references(
-        () => resourcePolicyPassword.passwordId,
-        {
-            onDelete: "cascade"
-        }
-    ),
-    policyPincodeId: integer("policyPincodeId").references(
-        () => resourcePolicyPincode.pincodeId,
-        {
-            onDelete: "cascade"
-        }
-    ),
-    policyWhitelistId: integer("policyWhitelistId").references(
-        () => resourcePolicyWhiteList.whitelistId,
-        {
-            onDelete: "cascade"
-        }
-    ),
    issuedAt: integer("issuedAt")
 });

@@ -1206,77 +1023,6 @@ export const resourceRules = sqliteTable("resourceRules", {
    value: text("value").notNull()
 });

-export const rolePolicies = sqliteTable("rolePolicies", {
-    roleId: integer("roleId")
-        .notNull()
-        .references(() => roles.roleId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const userPolicies = sqliteTable("userPolicies", {
-    userId: text("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyWhiteList = sqliteTable("resourcePolicyWhitelist", {
-    whitelistId: integer("id").primaryKey({ autoIncrement: true }),
-    email: text("email").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyRules = sqliteTable("resourcePolicyRules", {
-    ruleId: integer("ruleId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        }),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-    priority: integer("priority").notNull(),
-    action: text("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
-    match: text("match").$type<"CIDR" | "PATH" | "IP">().notNull(),
-    value: text("value").notNull()
-});
-
-export const resourcePolicies = sqliteTable("resourcePolicies", {
-    resourcePolicyId: integer("resourcePolicyId").primaryKey(),
-    sso: integer("sso", { mode: "boolean" }).notNull().default(true),
-    applyRules: integer("applyRules", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    scope: text("scope")
-        .$type<"global" | "resource">()
-        .notNull()
-        .default("global"),
-    emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    niceId: text("niceId").notNull(),
-    idpId: integer("idpId").references(() => idp.idpId, {
-        onDelete: "set null"
-    }),
-    name: text("name").notNull(),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
 export const supporterKey = sqliteTable("supporterKey", {
    keyId: integer("keyId").primaryKey({ autoIncrement: true }),
    key: text("key").notNull(),
@@ -1450,30 +1196,19 @@ export const roundTripMessageTracker = sqliteTable("roundTripMessageTracker", {
    complete: integer("complete", { mode: "boolean" }).notNull().default(false)
 });

-export const statusHistory = sqliteTable(
-    "statusHistory",
-    {
-        id: integer("id").primaryKey({ autoIncrement: true }),
-        entityType: text("entityType").notNull(), // "site" | "healthCheck"
-        entityId: integer("entityId").notNull(), // siteId or targetHealthCheckId
-        orgId: text("orgId")
-            .notNull()
-            .references(() => orgs.orgId, { onDelete: "cascade" }),
-        status: text("status").notNull(), // "online"/"offline" for sites; "healthy"/"unhealthy"/"unknown" for healthChecks
-        timestamp: integer("timestamp").notNull() // unix epoch seconds
-    },
-    (table) => [
-        index("idx_statusHistory_entity").on(
-            table.entityType,
-            table.entityId,
-            table.timestamp
-        ),
-        index("idx_statusHistory_org_timestamp").on(
-            table.orgId,
-            table.timestamp
-        )
-    ]
-);
+export const statusHistory = sqliteTable("statusHistory", {
+    id: integer("id").primaryKey({ autoIncrement: true }),
+    entityType: text("entityType").notNull(), // "site" | "healthCheck"
+    entityId: integer("entityId").notNull(),  // siteId or targetHealthCheckId
+    orgId: text("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    status: text("status").notNull(), // "online"/"offline" for sites; "healthy"/"unhealthy"/"unknown" for healthChecks
+    timestamp: integer("timestamp").notNull(), // unix epoch seconds
+}, (table) => [
+    index("idx_statusHistory_entity").on(table.entityType, table.entityId, table.timestamp),
+    index("idx_statusHistory_org_timestamp").on(table.orgId, table.timestamp),
+]);

 export type Org = InferSelectModel<typeof orgs>;
 export type User = InferSelectModel<typeof users>;
@@ -1543,16 +1278,3 @@ export type RoundTripMessageTracker = InferSelectModel<
    typeof roundTripMessageTracker
 >;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
-export type Label = InferSelectModel<typeof labels>;
-export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
-export type ResourcePolicyPincode = InferSelectModel<
-    typeof resourcePolicyPincode
->;
-export type ResourcePolicyPassword = InferSelectModel<
-    typeof resourcePolicyPassword
->;
-export type ResourcePolicyHeaderAuth = InferSelectModel<
-    typeof resourcePolicyHeaderAuth
->;
-export type RolePolicy = InferSelectModel<typeof rolePolicies>;
-export type UserPolicy = InferSelectModel<typeof userPolicies>;
--- a/server/index.ts
+++ b/server/index.ts
@@ -1,5 +1,5 @@
 #! /usr/bin/env node
-import "./extendZod";
+import "./extendZod.ts";

 import { runSetupFunctions } from "./setup";
 import { createApiServer } from "./apiServer";
--- a/server/integrationApiServer.ts
+++ b/server/integrationApiServer.ts
@@ -152,17 +152,11 @@ function getOpenApiDocumentation() {

            if (!hasExistingResponses) {
                def.route.responses = {
-                    "200": {
-                        description: "Successful response",
+                    "*": {
+                        description: "",
                        content: {
                            "application/json": {
-                                schema: z.object({
-                                    data: z.unknown().nullable(),
-                                    success: z.boolean(),
-                                    error: z.boolean(),
-                                    message: z.string(),
-                                    status: z.number()
-                                })
+                                schema: z.object({})
                            }
                        }
                    }
--- a/server/lib/alerts/events/healthCheckEvents.ts
+++ b/server/lib/alerts/events/healthCheckEvents.ts
@@ -221,18 +221,10 @@ async function handleResource(
        )
        .where(eq(targets.resourceId, resource.resourceId));

-    const monitoredTargets = otherTargets.filter(
-        (t) => t.hcHealth !== "unknown"
-    );
-
    let health = "healthy";
-    const allUnknown = monitoredTargets.length === 0;
-    const allHealthy = monitoredTargets.every(
-        (t) => t.hcHealth === "healthy"
-    );
-    const allUnhealthy = monitoredTargets.every(
-        (t) => t.hcHealth === "unhealthy"
-    );
+    const allUnknown = otherTargets.every((t) => t.hcHealth === "unknown");
+    const allHealthy = otherTargets.every((t) => t.hcHealth === "healthy");
+    const allUnhealthy = otherTargets.every((t) => t.hcHealth === "unhealthy");

    if (allUnknown) {
        logger.debug(
--- a/server/lib/billing/tierMatrix.ts
+++ b/server/lib/billing/tierMatrix.ts
@@ -16,22 +16,18 @@ export enum TierFeature {
    SessionDurationPolicies = "sessionDurationPolicies", // handle downgrade by setting to default duration
    PasswordExpirationPolicies = "passwordExpirationPolicies", // handle downgrade by setting to default duration
    AutoProvisioning = "autoProvisioning", // handle downgrade by disabling auto provisioning
+    SshPam = "sshPam",
    FullRbac = "fullRbac",
    SiteProvisioningKeys = "siteProvisioningKeys", // handle downgrade by revoking keys if needed
    SIEM = "siem", // handle downgrade by disabling SIEM integrations
+    HTTPPrivateResources = "httpPrivateResources", // handle downgrade by disabling HTTP private resources
    DomainNamespaces = "domainNamespaces", // handle downgrade by removing custom domain namespaces
    StandaloneHealthChecks = "standaloneHealthChecks",
    AlertingRules = "alertingRules",
-    WildcardSubdomain = "wildcardSubdomain",
-    Labels = "labels",
-    NewtAutoUpdate = "newtAutoUpdate",
-    ResourcePolicies = "resourcePolicies",
-    AdvancedPublicResources = "advancedPublicResources",
-    AdvancedPrivateResources = "advancedPrivateResources"
+    WildcardSubdomain = "wildcardSubdomain"
 }

 export const tierMatrix: Record<TierFeature, Tier[]> = {
-    [TierFeature.Labels]: ["tier2", "tier3", "enterprise"],
    [TierFeature.OrgOidc]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.LoginPageDomain]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.DeviceApprovals]: ["tier1", "tier3", "enterprise"],
@@ -62,25 +58,13 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
        "enterprise"
    ],
    [TierFeature.AutoProvisioning]: ["tier1", "tier3", "enterprise"],
+    [TierFeature.SshPam]: ["tier1", "tier3", "enterprise"],
    [TierFeature.FullRbac]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.SiteProvisioningKeys]: ["tier3", "enterprise"],
    [TierFeature.SIEM]: ["enterprise"],
+    [TierFeature.HTTPPrivateResources]: ["tier3", "enterprise"],
    [TierFeature.DomainNamespaces]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.StandaloneHealthChecks]: ["tier3", "enterprise"],
    [TierFeature.AlertingRules]: ["tier3", "enterprise"],
-    [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"],
-    [TierFeature.NewtAutoUpdate]: ["tier1", "tier2", "tier3", "enterprise"],
-    [TierFeature.ResourcePolicies]: ["tier3", "enterprise"],
-    [TierFeature.AdvancedPublicResources]: [
-        "tier1",
-        "tier2",
-        "tier3",
-        "enterprise"
-    ],
-    [TierFeature.AdvancedPrivateResources]: [
-        "tier1",
-        "tier2",
-        "tier3",
-        "enterprise"
-    ]
+    [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"]
 };
--- a/server/lib/billing/usageService.ts
+++ b/server/lib/billing/usageService.ts
@@ -22,6 +22,7 @@ export function noop() {
 }

 export class UsageService {
+
    constructor() {
        if (noop()) {
            return;
@@ -56,10 +57,7 @@ export class UsageService {
            try {
                let usage;
                if (transaction) {
-                    const orgIdToUse = await this.getBillingOrg(
-                        orgId,
-                        transaction
-                    );
+                    const orgIdToUse = await this.getBillingOrg(orgId, transaction);
                    usage = await this.internalAddUsage(
                        orgIdToUse,
                        featureId,
@@ -276,12 +274,11 @@ export class UsageService {
            return null;
        }

-        let orgIdToUse = orgId;
+        const orgIdToUse = await this.getBillingOrg(orgId, trx);
+
+        const usageId = `${orgIdToUse}-${featureId}`;
+
        try {
-            orgIdToUse = await this.getBillingOrg(orgId, trx);
-
-            const usageId = `${orgIdToUse}-${featureId}`;
-
            const [result] = await trx
                .select()
                .from(usage)
@@ -341,12 +338,8 @@ export class UsageService {
                `Failed to get usage for ${orgIdToUse}/${featureId}:`,
                error
            );
-            if (process.env.NODE_ENV !== "development") {
-                throw error;
-            }
+            throw error;
        }
-
-        return null;
    }

    public async getBillingOrg(
@@ -389,13 +382,13 @@ export class UsageService {
            return false;
        }

+        const orgIdToUse = await this.getBillingOrg(orgId, trx);
+
        // This method should check the current usage against the limits set for the organization
        // and kick out all of the sites on the org
        let hasExceededLimits = false;
-        let orgIdToUse = orgId;
-        try {
-            orgIdToUse = await this.getBillingOrg(orgId, trx);

+        try {
            let orgLimits: Limit[] = [];
            if (featureId) {
                // Get all limits set for this organization
--- a/server/lib/blueprints/applyBlueprint.ts
+++ b/server/lib/blueprints/applyBlueprint.ts
@@ -16,13 +16,14 @@ import logger from "@server/logger";
 import { sites } from "@server/db";
 import { eq, and, isNotNull } from "drizzle-orm";
 import { addTargets as addProxyTargets } from "@server/routers/newt/targets";
+import { addTargets as addClientTargets } from "@server/routers/client/targets";
 import {
    ClientResourcesResults,
    updateClientResources
 } from "./clientResources";
 import { BlueprintSource } from "@server/routers/blueprints/types";
 import { stringify as stringifyYaml } from "yaml";
-import { generateName } from "@server/db/names";
+import { faker } from "@faker-js/faker";
 import { handleMessagingForUpdatedSiteResource } from "@server/routers/siteResource";
 import { rebuildClientAssociationsFromSiteResource } from "../rebuildClientAssociations";

@@ -105,7 +106,7 @@ export async function applyBlueprint({
                            site.newt.newtId,
                            [target],
                            matchingHealthcheck ? [matchingHealthcheck] : [],
-                            result.proxyResource.mode === "udp" ? "udp" : "tcp",
+                            result.proxyResource.protocol,
                            site.newt.version
                        );
                    }
@@ -290,7 +291,9 @@ export async function applyBlueprint({
            .insert(blueprints)
            .values({
                orgId,
-                name: name ?? generateName(),
+                name:
+                    name ??
+                    `${faker.word.adjective()}-${faker.word.adjective()}-${faker.word.noun()}`,
                contents: stringifyYaml(configData),
                createdAt: Math.floor(Date.now() / 1000),
                succeeded: blueprintSucceeded,
--- a/server/lib/blueprints/applyNewtDockerBlueprint.ts
+++ b/server/lib/blueprints/applyNewtDockerBlueprint.ts
@@ -1,56 +1,10 @@
 import { sendToClient } from "#dynamic/routers/ws";
 import { processContainerLabels } from "./parseDockerContainers";
 import { applyBlueprint } from "./applyBlueprint";
-import { PrivateResourceSchema, PublicResourceSchema } from "./types";
 import { db, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";

-type BlueprintResult = ReturnType<typeof processContainerLabels>;
-
-function filterInvalidResources(blueprint: BlueprintResult): {
-    skippedCount: number;
-    skippedKeys: string[];
-} {
-    const skippedKeys: string[] = [];
-
-    for (const section of ["proxy-resources", "public-resources"] as const) {
-        const resources = blueprint[section];
-        for (const [key, value] of Object.entries(resources)) {
-            const result = PublicResourceSchema.safeParse(value);
-            if (!result.success) {
-                const errors = result.error.issues
-                    .map((i) => `${i.path.join(".")}: ${i.message}`)
-                    .join("; ");
-                logger.warn(
-                    `Skipping invalid Docker ${section} "${key}": ${errors}`
-                );
-                delete resources[key];
-                skippedKeys.push(`${section}.${key}`);
-            }
-        }
-    }
-
-    for (const section of ["client-resources", "private-resources"] as const) {
-        const resources = blueprint[section];
-        for (const [key, value] of Object.entries(resources)) {
-            const result = PrivateResourceSchema.safeParse(value);
-            if (!result.success) {
-                const errors = result.error.issues
-                    .map((i) => `${i.path.join(".")}: ${i.message}`)
-                    .join("; ");
-                logger.warn(
-                    `Skipping invalid Docker ${section} "${key}": ${errors}`
-                );
-                delete resources[key];
-                skippedKeys.push(`${section}.${key}`);
-            }
-        }
-    }
-
-    return { skippedCount: skippedKeys.length, skippedKeys };
-}
-
 export async function applyNewtDockerBlueprint(
    siteId: number,
    newtId: string,
@@ -67,24 +21,17 @@ export async function applyNewtDockerBlueprint(
        return;
    }

-    let skippedCount = 0;
-    let skippedKeys: string[] = [];
+    // logger.debug(`Applying Docker blueprint to site: ${siteId}`);
+    // logger.debug(`Containers: ${JSON.stringify(containers, null, 2)}`);

    try {
        const blueprint = processContainerLabels(containers);

-        logger.debug(
-            `Received Docker blueprint with ${Object.keys(blueprint["proxy-resources"]).length} proxy, ${Object.keys(blueprint["client-resources"]).length} client resource(s)`
-        );
+        logger.debug(`Received Docker blueprint: ${JSON.stringify(blueprint)}`);

-        const filterResult = filterInvalidResources(blueprint);
-        skippedCount = filterResult.skippedCount;
-        skippedKeys = filterResult.skippedKeys;
-
-        if (skippedCount > 0) {
-            logger.warn(
-                `Filtered ${skippedCount} invalid resource(s) from Docker blueprint: ${skippedKeys.join(", ")}`
-            );
+        // make sure this is not an empty object
+        if (isEmptyObject(blueprint)) {
+            return;
        }

        if (
@@ -93,15 +40,6 @@ export async function applyNewtDockerBlueprint(
            isEmptyObject(blueprint["public-resources"]) &&
            isEmptyObject(blueprint["private-resources"])
        ) {
-            if (skippedCount > 0) {
-                await sendToClient(newtId, {
-                    type: "newt/blueprint/results",
-                    data: {
-                        success: false,
-                        message: `All resources were invalid and skipped: ${skippedKeys.join(", ")}`
-                    }
-                });
-            }
            return;
        }

@@ -128,10 +66,7 @@ export async function applyNewtDockerBlueprint(
        type: "newt/blueprint/results",
        data: {
            success: true,
-            message:
-                skippedCount > 0
-                    ? `Config updated successfully. Skipped ${skippedCount} invalid resource(s): ${skippedKeys.join(", ")}`
-                    : "Config updated successfully"
+            message: "Config updated successfully"
        }
    });
 }
--- a/server/lib/blueprints/clientResources.ts
+++ b/server/lib/blueprints/clientResources.ts
@@ -3,7 +3,6 @@ import {
    clientSiteResources,
    domains,
    orgDomains,
-    roleActions,
    roles,
    roleSiteResources,
    Site,
@@ -20,7 +19,6 @@ import { sites } from "@server/db";
 import { eq, and, ne, inArray, or, isNotNull } from "drizzle-orm";
 import { Config } from "./types";
 import logger from "@server/logger";
-import { defaultRoleAllowedActions } from "@server/routers/role/createRole";
 import { getNextAvailableAliasAddress } from "../ip";
 import { createCertificate } from "#dynamic/routers/certificates/createCertificate";

@@ -227,11 +225,7 @@ export async function updateClientResources(
                            : resourceData["udp-ports"],
                    fullDomain: resourceData["full-domain"] || null,
                    subdomain: domainInfo ? domainInfo.subdomain : null,
-                    domainId: domainInfo ? domainInfo.domainId : null,
-                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
-                    authDaemonMode:
-                        resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    domainId: domainInfo ? domainInfo.domainId : null
                })
                .where(
                    eq(
@@ -338,7 +332,8 @@ export async function updateClientResources(
            }

            if (resourceData.roles.length > 0) {
-                const existingRoles = await trx
+                // Re-add specified roles but we need to get the roleIds from the role name in the array
+                const rolesToUpdate = await trx
                    .select()
                    .from(roles)
                    .where(
@@ -348,28 +343,7 @@ export async function updateClientResources(
                        )
                    );

-                const foundNames = new Set(existingRoles.map((r) => r.name));
-                const missingNames = resourceData.roles.filter(
-                    (n) => !foundNames.has(n)
-                );
-
-                for (const name of missingNames) {
-                    const [created] = await trx
-                        .insert(roles)
-                        .values({ name, orgId })
-                        .returning();
-                    await trx.insert(roleActions).values(
-                        defaultRoleAllowedActions.map((action) => ({
-                            roleId: created.roleId,
-                            actionId: action,
-                            orgId
-                        }))
-                    );
-                    existingRoles.push(created);
-                    logger.info(`Auto-created role "${name}" in org ${orgId} from blueprint`);
-                }
-
-                const roleIds = existingRoles.map((role) => role.roleId);
+                const roleIds = rolesToUpdate.map((role) => role.roleId);

                await trx
                    .insert(roleSiteResources)
@@ -386,14 +360,8 @@ export async function updateClientResources(
            });
        } else {
            let aliasAddress: string | null = null;
-            let releaseAliasLock: (() => Promise<void>) | null = null;
            if (resourceData.mode === "host" || resourceData.mode === "http") {
-                const { value, release } = await getNextAvailableAliasAddress(
-                    orgId,
-                    trx
-                );
-                aliasAddress = value;
-                releaseAliasLock = release;
+                aliasAddress = await getNextAvailableAliasAddress(orgId, trx);
            }

            let domainInfo:
@@ -447,16 +415,10 @@ export async function updateClientResources(
                            : resourceData["udp-ports"],
                    fullDomain: resourceData["full-domain"] || null,
                    subdomain: domainInfo ? domainInfo.subdomain : null,
-                    domainId: domainInfo ? domainInfo.domainId : null,
-                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
-                    authDaemonMode:
-                        resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    domainId: domainInfo ? domainInfo.domainId : null
                })
                .returning();

-            await releaseAliasLock?.();
-
            const siteResourceId = newResource.siteResourceId;

            for (const site of allSites) {
@@ -482,7 +444,8 @@ export async function updateClientResources(
            });

            if (resourceData.roles.length > 0) {
-                const existingRoles = await trx
+                // get roleIds from role names
+                const rolesToUpdate = await trx
                    .select()
                    .from(roles)
                    .where(
@@ -492,28 +455,7 @@ export async function updateClientResources(
                        )
                    );

-                const foundNames = new Set(existingRoles.map((r) => r.name));
-                const missingNames = resourceData.roles.filter(
-                    (n) => !foundNames.has(n)
-                );
-
-                for (const name of missingNames) {
-                    const [created] = await trx
-                        .insert(roles)
-                        .values({ name, orgId })
-                        .returning();
-                    await trx.insert(roleActions).values(
-                        defaultRoleAllowedActions.map((action) => ({
-                            roleId: created.roleId,
-                            actionId: action,
-                            orgId
-                        }))
-                    );
-                    existingRoles.push(created);
-                    logger.info(`Auto-created role "${name}" in org ${orgId} from blueprint`);
-                }
-
-                const roleIds = existingRoles.map((role) => role.roleId);
+                const roleIds = rolesToUpdate.map((role) => role.roleId);

                await trx
                    .insert(roleSiteResources)
--- a/server/lib/blueprints/proxyResources.ts
+++ b/server/lib/blueprints/proxyResources.ts
--- a/server/lib/blueprints/types.ts
+++ b/server/lib/blueprints/types.ts
@@ -82,7 +82,7 @@ export const RuleSchema = z
    .object({
        action: z.enum(["allow", "deny", "pass"]),
        match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
-        value: z.coerce.string(),
+        value: z.string(),
        priority: z.int().optional()
    })
    .refine(
@@ -161,34 +161,11 @@ export const HeaderSchema = z.object({
    value: z.string().min(1)
 });

-export const AuthDaemonSchema = z
-    .object({
-        pam: z.enum(["passthrough", "push"]).optional().default("passthrough"),
-        mode: z.enum(["site", "remote", "native"]).optional().default("site"),
-        port: z.int().min(1).max(65535).optional()
-    })
-    .refine(
-        (data) => {
-            if (data.mode === "remote") {
-                return data.port !== undefined;
-            }
-            return true;
-        },
-        {
-            path: ["port"],
-            message: "port is required when auth-daemon mode is 'remote'"
-        }
-    );
-
 // Schema for individual resource
-export const PublicResourceSchema = z
+export const ResourceSchema = z
    .object({
        name: z.string().optional(),
-        protocol: z
-            .enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"])
-            .optional(), // this was the old one and is now DEPRECATED in favor of the mode
-        mode: z.enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"]).optional(),
-        policy: z.string().optional(),
+        protocol: z.enum(["http", "tcp", "udp"]).optional(),
        ssl: z.boolean().optional(),
        scheme: z.enum(["http", "https"]).optional(),
        "full-domain": z.string().optional(),
@@ -200,10 +177,7 @@ export const PublicResourceSchema = z
        "tls-server-name": z.string().optional(),
        headers: z.array(HeaderSchema).optional(),
        rules: z.array(RuleSchema).optional(),
-        maintenance: MaintenanceSchema.optional(),
-        "auth-daemon": AuthDaemonSchema.optional(),
-        "proxy-protocol": z.boolean().optional(),
-        "proxy-protocol-version": z.int().min(1).optional()
+        maintenance: MaintenanceSchema.optional()
    })
    .refine(
        (resource) => {
@@ -211,10 +185,9 @@ export const PublicResourceSchema = z
                return true;
            }

-            // Otherwise, require name and protocol/mode for full resource definition
+            // Otherwise, require name and protocol for full resource definition
            return (
-                resource.name !== undefined &&
-                (resource.mode !== undefined || resource.protocol !== undefined)
+                resource.name !== undefined && resource.protocol !== undefined
            );
        },
        {
@@ -228,8 +201,8 @@ export const PublicResourceSchema = z
                return true;
            }

-            // If protocol/mode is http, all targets must have method field
-            if ((resource.mode ?? resource.protocol) === "http") {
+            // If protocol is http, all targets must have method field
+            if (resource.protocol === "http") {
                return resource.targets.every(
                    (target) => target == null || target.method !== undefined
                );
@@ -247,9 +220,8 @@ export const PublicResourceSchema = z
                return true;
            }

-            // If protocol/mode is tcp or udp, no target should have method field
-            const effectiveProtocol1 = resource.mode ?? resource.protocol;
-            if (effectiveProtocol1 === "tcp" || effectiveProtocol1 === "udp") {
+            // If protocol is tcp or udp, no target should have method field
+            if (resource.protocol === "tcp" || resource.protocol === "udp") {
                return resource.targets.every(
                    (target) => target == null || target.method === undefined
                );
@@ -267,8 +239,8 @@ export const PublicResourceSchema = z
                return true;
            }

-            // If protocol/mode is http, it must have a full-domain
-            if ((resource.mode ?? resource.protocol) === "http") {
+            // If protocol is http, it must have a full-domain
+            if (resource.protocol === "http") {
                return (
                    resource["full-domain"] !== undefined &&
                    resource["full-domain"].length > 0
@@ -287,9 +259,8 @@ export const PublicResourceSchema = z
                return true;
            }

-            // If protocol/mode is tcp or udp, it must have both proxy-port
-            const effectiveProtocol2 = resource.mode ?? resource.protocol;
-            if (effectiveProtocol2 === "tcp" || effectiveProtocol2 === "udp") {
+            // If protocol is tcp or udp, it must have both proxy-port
+            if (resource.protocol === "tcp" || resource.protocol === "udp") {
                return resource["proxy-port"] !== undefined;
            }
            return true;
@@ -306,9 +277,8 @@ export const PublicResourceSchema = z
                return true;
            }

-            // If protocol/mode is tcp or udp, it must not have auth
-            const effectiveProtocol3 = resource.mode ?? resource.protocol;
-            if (effectiveProtocol3 === "tcp" || effectiveProtocol3 === "udp") {
+            // If protocol is tcp or udp, it must not have auth
+            if (resource.protocol === "tcp" || resource.protocol === "udp") {
                return resource.auth === undefined;
            }
            return true;
@@ -370,8 +340,7 @@ export const PublicResourceSchema = z
            if (parts.includes("*", 1)) return false; // no further wildcards
            if (parts.length < 3) return false; // need at least *.label.tld

-            const labelRegex =
-                /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
+            const labelRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
            return parts.slice(1).every((label) => labelRegex.test(label));
        },
        {
@@ -379,46 +348,22 @@ export const PublicResourceSchema = z
            message:
                'Wildcard full-domain must have "*" as the leftmost label only, followed by at least two valid hostname labels (e.g. "*.example.com" or "*.level1.example.com"). Patterns like "*example.com" or "level2.*.example.com" are not supported.'
        }
-    )
-    .refine(
-        (resource) => {
-            const effectiveMode = resource.mode ?? resource.protocol;
-            if (effectiveMode !== "tcp") {
-                return (
-                    resource["proxy-protocol"] === undefined &&
-                    resource["proxy-protocol-version"] === undefined
-                );
-            }
-            return true;
-        },
-        {
-            path: ["proxy-protocol"],
-            message:
-                "'proxy-protocol' and 'proxy-protocol-version' can only be set when mode is 'tcp'"
-        }
-    )
-    .transform((resource) => {
-        // Normalize: prefer mode, fall back to protocol for backwards compatibility
-        if (resource.mode === undefined && resource.protocol !== undefined) {
-            resource.mode = resource.protocol;
-        }
-        return resource;
-    });
+    );

 export function isTargetsOnlyResource(resource: any): boolean {
    return Object.keys(resource).length === 1 && resource.targets;
 }

-export const PrivateResourceSchema = z
+export const ClientResourceSchema = z
    .object({
        name: z.string().min(1).max(255),
-        mode: z.enum(["host", "cidr", "http", "ssh"]),
+        mode: z.enum(["host", "cidr", "http"]),
        site: z.string().optional(), // DEPRECATED IN FAVOR OF sites
        sites: z.array(z.string()).optional().default([]),
        // protocol: z.enum(["tcp", "udp"]).optional(),
        // proxyPort: z.int().positive().optional(),
        "destination-port": z.int().positive().optional(),
-        destination: z.string().min(1).optional(),
+        destination: z.string().min(1),
        // enabled: z.boolean().default(true),
        "tcp-ports": portRangeStringSchema.optional().default("*"),
        "udp-ports": portRangeStringSchema.optional().default("*"),
@@ -441,31 +386,11 @@ export const PrivateResourceSchema = z
                error: "Admin role cannot be included in roles"
            }),
        users: z.array(z.string()).optional().default([]),
-        machines: z.array(z.string()).optional().default([]),
-        "auth-daemon": AuthDaemonSchema.optional()
+        machines: z.array(z.string()).optional().default([])
    })
-    .refine(
-        (data) => {
-            // destination is optional only for ssh+native; required for everything else
-            const isNativeSSH =
-                data.mode === "ssh" &&
-                (data["auth-daemon"] === undefined ||
-                    data["auth-daemon"].mode === "native");
-            if (!isNativeSSH && !data.destination) {
-                return false;
-            }
-            return true;
-        },
-        {
-            path: ["destination"],
-            message:
-                "destination is required unless mode is 'ssh' with auth-daemon mode 'native'"
-        }
-    )
    .refine(
        (data) => {
            if (data.mode === "host") {
-                if (!data.destination) return true; // caught by the destination-required refine
                // Check if it's a valid IP address using zod (v4 or v6)
                const isValidIP = z
                    .union([z.ipv4(), z.ipv6()])
@@ -493,7 +418,6 @@ export const PrivateResourceSchema = z
    .refine(
        (data) => {
            if (data.mode === "cidr") {
-                if (!data.destination) return true; // caught by the destination-required refine
                // Check if it's a valid CIDR (v4 or v6)
                const isValidCIDR = z
                    .union([z.cidrv4(), z.cidrv6()])
@@ -511,19 +435,19 @@ export const PrivateResourceSchema = z
 export const ConfigSchema = z
    .object({
        "proxy-resources": z
-            .record(z.string(), PublicResourceSchema)
+            .record(z.string(), ResourceSchema)
            .optional()
            .prefault({}),
        "public-resources": z
-            .record(z.string(), PublicResourceSchema)
+            .record(z.string(), ResourceSchema)
            .optional()
            .prefault({}),
        "client-resources": z
-            .record(z.string(), PrivateResourceSchema)
+            .record(z.string(), ClientResourceSchema)
            .optional()
            .prefault({}),
        "private-resources": z
-            .record(z.string(), PrivateResourceSchema)
+            .record(z.string(), ClientResourceSchema)
            .optional()
            .prefault({}),
        sites: z.record(z.string(), SiteSchema).optional().prefault({})
@@ -548,13 +472,10 @@ export const ConfigSchema = z
        }

        return data as {
-            "proxy-resources": Record<
-                string,
-                z.infer<typeof PublicResourceSchema>
-            >;
+            "proxy-resources": Record<string, z.infer<typeof ResourceSchema>>;
            "client-resources": Record<
                string,
-                z.infer<typeof PrivateResourceSchema>
+                z.infer<typeof ClientResourceSchema>
            >;
            sites: Record<string, z.infer<typeof SiteSchema>>;
        };
@@ -693,5 +614,5 @@ export const ConfigSchema = z
 // Type inference from the schema
 export type Site = z.infer<typeof SiteSchema>;
 export type Target = z.infer<typeof TargetSchema>;
-export type Resource = z.infer<typeof PublicResourceSchema>;
+export type Resource = z.infer<typeof ResourceSchema>;
 export type Config = z.infer<typeof ConfigSchema>;
--- a/server/lib/cache.ts
+++ b/server/lib/cache.ts
@@ -154,19 +154,8 @@ class AdaptiveCache {
    keys(): string[] {
        return localCache.keys();
    }
-
-    /**
-     * Get keys with a specific prefix
-     * @param prefix - Key prefix to match
-     * @returns Array of matching keys
-     */
-    async keysWithPrefix(prefix: string): Promise<string[]> {
-        const allKeys = localCache.keys();
-        return allKeys.filter((key) => key.startsWith(prefix));
-    }
 }

 // Export singleton instance
 export const cache = new AdaptiveCache();
-export const regionalCache = cache; // Alias for compatability with the private version
 export default cache;
--- a/server/lib/calculateUserClientsForOrgs.ts
+++ b/server/lib/calculateUserClientsForOrgs.ts
@@ -331,8 +331,16 @@ export async function calculateUserClientsForOrgs(
                    ];

                // Get next available subnet
-                const { value: newSubnet, release: releaseSubnetLock } =
-                    await getNextAvailableClientSubnet(orgId, transaction);
+                const newSubnet = await getNextAvailableClientSubnet(
+                    orgId,
+                    transaction
+                );
+                if (!newSubnet) {
+                    logger.warn(
+                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no available subnet found`
+                    );
+                    continue;
+                }

                const subnet = newSubnet.split("/")[0];
                const updatedSubnet = `${subnet}/${org.subnet.split("/")[1]}`;
@@ -362,7 +370,6 @@ export async function calculateUserClientsForOrgs(
                    .insert(clients)
                    .values(newClientData)
                    .returning();
-                await releaseSubnetLock();
                existingClientCache.set(
                    getOrgOlmKey(orgId, olm.olmId),
                    newClient
--- a/server/lib/consts.ts
+++ b/server/lib/consts.ts
@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";

 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.19.0";
+export const APP_VERSION = "1.18.4";

 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);
--- a/server/lib/ip.ts
+++ b/server/lib/ip.ts
@@ -327,145 +327,127 @@ export function doCidrsOverlap(cidr1: string, cidr2: string): boolean {
 export async function getNextAvailableClientSubnet(
    orgId: string,
    transaction: Transaction | typeof db = db
-): Promise<{ value: string; release: () => Promise<void> }> {
-    const lockKey = `client-subnet-allocation:${orgId}`;
-    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
-    if (!acquired) {
-        throw new Error(`Failed to acquire lock: ${lockKey}`);
-    }
-    const release = () => lockManager.releaseLock(lockKey);
+): Promise<string> {
+    return await lockManager.withLock(
+        `client-subnet-allocation:${orgId}`,
+        async () => {
+            const [org] = await transaction
+                .select()
+                .from(orgs)
+                .where(eq(orgs.orgId, orgId));

-    try {
-        const [org] = await transaction
-            .select()
-            .from(orgs)
-            .where(eq(orgs.orgId, orgId));
+            if (!org) {
+                throw new Error(`Organization with ID ${orgId} not found`);
+            }

-        if (!org) {
-            throw new Error(`Organization with ID ${orgId} not found`);
+            if (!org.subnet) {
+                throw new Error(
+                    `Organization with ID ${orgId} has no subnet defined`
+                );
+            }
+
+            const existingAddressesSites = await transaction
+                .select({
+                    address: sites.address
+                })
+                .from(sites)
+                .where(and(isNotNull(sites.address), eq(sites.orgId, orgId)));
+
+            const existingAddressesClients = await transaction
+                .select({
+                    address: clients.subnet
+                })
+                .from(clients)
+                .where(
+                    and(isNotNull(clients.subnet), eq(clients.orgId, orgId))
+                );
+
+            const addresses = [
+                ...existingAddressesSites.map(
+                    (site) => `${site.address?.split("/")[0]}/32`
+                ), // we are overriding the 32 so that we pick individual addresses in the subnet of the org for the site and the client even though they are stored with the /block_size of the org
+                ...existingAddressesClients.map(
+                    (client) => `${client.address.split("/")}/32`
+                )
+            ].filter((address) => address !== null) as string[];
+
+            const subnet = findNextAvailableCidr(addresses, 32, org.subnet); // pick the sites address in the org
+            if (!subnet) {
+                throw new Error("No available subnets remaining in space");
+            }
+
+            return subnet;
        }
-
-        if (!org.subnet) {
-            throw new Error(
-                `Organization with ID ${orgId} has no subnet defined`
-            );
-        }
-
-        const existingAddressesSites = await transaction
-            .select({
-                address: sites.address
-            })
-            .from(sites)
-            .where(and(isNotNull(sites.address), eq(sites.orgId, orgId)));
-
-        const existingAddressesClients = await transaction
-            .select({
-                address: clients.subnet
-            })
-            .from(clients)
-            .where(and(isNotNull(clients.subnet), eq(clients.orgId, orgId)));
-
-        const addresses = [
-            ...existingAddressesSites.map(
-                (site) => `${site.address?.split("/")[0]}/32`
-            ), // we are overriding the 32 so that we pick individual addresses in the subnet of the org for the site and the client even though they are stored with the /block_size of the org
-            ...existingAddressesClients.map(
-                (client) => `${client.address.split("/")[0]}/32`
-            )
-        ].filter((address) => address !== null) as string[];
-
-        const subnet = findNextAvailableCidr(addresses, 32, org.subnet); // pick the sites address in the org
-        if (!subnet) {
-            throw new Error("No available subnets remaining in space");
-        }
-
-        return { value: subnet, release };
-    } catch (e) {
-        await release();
-        throw e;
-    }
+    );
 }

 export async function getNextAvailableAliasAddress(
    orgId: string,
    trx: Transaction | typeof db = db
-): Promise<{ value: string; release: () => Promise<void> }> {
-    const lockKey = `alias-address-allocation:${orgId}`;
-    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
-    if (!acquired) {
-        throw new Error(`Failed to acquire lock: ${lockKey}`);
-    }
-    const release = () => lockManager.releaseLock(lockKey);
+): Promise<string> {
+    return await lockManager.withLock(
+        `alias-address-allocation:${orgId}`,
+        async () => {
+            const [org] = await trx
+                .select()
+                .from(orgs)
+                .where(eq(orgs.orgId, orgId));

-    try {
-        const [org] = await trx
-            .select()
-            .from(orgs)
-            .where(eq(orgs.orgId, orgId));
+            if (!org) {
+                throw new Error(`Organization with ID ${orgId} not found`);
+            }

-        if (!org) {
-            throw new Error(`Organization with ID ${orgId} not found`);
-        }
+            if (!org.subnet) {
+                throw new Error(
+                    `Organization with ID ${orgId} has no subnet defined`
+                );
+            }

-        if (!org.subnet) {
-            throw new Error(
-                `Organization with ID ${orgId} has no subnet defined`
+            if (!org.utilitySubnet) {
+                throw new Error(
+                    `Organization with ID ${orgId} has no utility subnet defined`
+                );
+            }
+
+            const existingAddresses = await trx
+                .select({
+                    aliasAddress: siteResources.aliasAddress
+                })
+                .from(siteResources)
+                .where(
+                    and(
+                        isNotNull(siteResources.aliasAddress),
+                        eq(siteResources.orgId, orgId)
+                    )
+                );
+
+            const addresses = [
+                ...existingAddresses.map(
+                    (site) => `${site.aliasAddress?.split("/")[0]}/32`
+                ),
+                // reserve a /29 for the dns server and other stuff
+                `${org.utilitySubnet.split("/")[0]}/29`
+            ].filter((address) => address !== null) as string[];
+
+            let subnet = findNextAvailableCidr(
+                addresses,
+                32,
+                org.utilitySubnet
            );
+            if (!subnet) {
+                throw new Error("No available subnets remaining in space");
+            }
+
+            // remove the cidr
+            subnet = subnet.split("/")[0];
+
+            return subnet;
        }
-
-        if (!org.utilitySubnet) {
-            throw new Error(
-                `Organization with ID ${orgId} has no utility subnet defined`
-            );
-        }
-
-        const existingAddresses = await trx
-            .select({
-                aliasAddress: siteResources.aliasAddress
-            })
-            .from(siteResources)
-            .where(
-                and(
-                    isNotNull(siteResources.aliasAddress),
-                    eq(siteResources.orgId, orgId)
-                )
-            );
-
-        const addresses = [
-            ...existingAddresses.map(
-                (site) => `${site.aliasAddress?.split("/")[0]}/32`
-            ),
-            // reserve a /29 for the dns server and other stuff
-            `${org.utilitySubnet.split("/")[0]}/29`
-        ].filter((address) => address !== null) as string[];
-
-        let subnet = findNextAvailableCidr(addresses, 32, org.utilitySubnet);
-        if (!subnet) {
-            throw new Error("No available subnets remaining in space");
-        }
-
-        // remove the cidr
-        subnet = subnet.split("/")[0];
-
-        return { value: subnet, release };
-    } catch (e) {
-        await release();
-        throw e;
-    }
+    );
 }

-export async function getNextAvailableOrgSubnet(): Promise<{
-    value: string;
-    release: () => Promise<void>;
-}> {
-    const lockKey = "org-subnet-allocation";
-    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
-    if (!acquired) {
-        throw new Error(`Failed to acquire lock: ${lockKey}`);
-    }
-    const release = () => lockManager.releaseLock(lockKey);
-
-    try {
+export async function getNextAvailableOrgSubnet(): Promise<string> {
+    return await lockManager.withLock("org-subnet-allocation", async () => {
        const existingAddresses = await db
            .select({
                subnet: orgs.subnet
@@ -484,11 +466,8 @@ export async function getNextAvailableOrgSubnet(): Promise<{
            throw new Error("No available subnets remaining in space");
        }

-        return { value: subnet, release };
-    } catch (e) {
-        await release();
-        throw e;
-    }
+        return subnet;
+    });
 }

 export function generateRemoteSubnets(
@@ -496,8 +475,6 @@ export function generateRemoteSubnets(
 ): string[] {
    const remoteSubnets = allSiteResources
        .filter((sr) => {
-            if (!sr.destination) return false;
-
            if (sr.mode === "cidr") {
                // check if its a valid CIDR using zod
                const cidrSchema = z.union([z.cidrv4(), z.cidrv6()]);
@@ -519,7 +496,7 @@ export function generateRemoteSubnets(
            }
            return ""; // This should never be reached due to filtering, but satisfies TypeScript
        })
-        .filter((subnet): subnet is string => subnet !== "" && subnet !== null); // Remove invalid values just to be safe
+        .filter((subnet) => subnet !== ""); // Remove empty strings just to be safe
    // remove duplicates
    return Array.from(new Set(remoteSubnets));
 }
@@ -604,7 +581,7 @@ export function generateSubnetProxyTargets(
                targets.push({
                    sourcePrefix: clientPrefix,
                    destPrefix: `${siteResource.aliasAddress}/32`,
-                    rewriteTo: destination!,
+                    rewriteTo: destination,
                    portRange,
                    disableIcmp
                });
@@ -612,7 +589,7 @@ export function generateSubnetProxyTargets(
        } else if (siteResource.mode == "cidr") {
            targets.push({
                sourcePrefix: clientPrefix,
-                destPrefix: siteResource.destination!,
+                destPrefix: siteResource.destination,
                portRange,
                disableIcmp
            });
@@ -694,7 +671,7 @@ export async function generateSubnetProxyTargetV2(
            targets.push({
                sourcePrefixes: [],
                destPrefix: `${siteResource.aliasAddress}/32`,
-                rewriteTo: destination!,
+                rewriteTo: destination,
                portRange,
                disableIcmp,
                resourceId: siteResource.siteResourceId
@@ -703,7 +680,7 @@ export async function generateSubnetProxyTargetV2(
    } else if (siteResource.mode == "cidr") {
        targets.push({
            sourcePrefixes: [],
-            destPrefix: siteResource.destination!,
+            destPrefix: siteResource.destination,
            portRange,
            disableIcmp,
            resourceId: siteResource.siteResourceId
@@ -761,7 +738,7 @@ export async function generateSubnetProxyTargetV2(
            protocol: siteResource.ssl ? "https" : "http",
            httpTargets: [
                {
-                    destAddr: siteResource.destination!,
+                    destAddr: siteResource.destination,
                    destPort: siteResource.destinationPort,
                    scheme: siteResource.scheme
                }
@@ -896,13 +873,7 @@ export const portRangeStringSchema = z
            message:
                'Port range must be "*" for all ports, or a comma-separated list of ports and ranges (e.g., "80,443,8000-9000"). Ports must be between 1 and 65535, and ranges must have start <= end.'
        }
-    )
-    .openapi({
-        type: "string",
-        description:
-            'Port range string. Use "*" for all ports, a comma-separated list of ports, or ranges (e.g., "80,443,8000-9000"). Ports must be between 1 and 65535.',
-        example: "80,443,8000-9000"
-    });
+    );

 /**
 * Parses a port range string into an array of port range objects
--- a/server/lib/openapi/createApiResponseSchema.ts
+++ b/server/lib/openapi/createApiResponseSchema.ts
@@ -1,11 +0,0 @@
-import { z } from "zod";
-
-export function createApiResponseSchema<T extends z.ZodTypeAny>(dataSchema: T) {
-    return z.object({
-        data: dataSchema.nullable(),
-        success: z.boolean(),
-        error: z.boolean(),
-        message: z.string(),
-        status: z.number()
-    });
-}
--- a/server/lib/rebuildClientAssociations.ts
+++ b/server/lib/rebuildClientAssociations.ts
@@ -18,9 +18,11 @@ import {
    userOrgRoles,
    userSiteResources
 } from "@server/db";
-import { and, count, eq, inArray, ne } from "drizzle-orm";
+import { and, eq, inArray, ne } from "drizzle-orm";

-import { deletePeer as newtDeletePeer } from "@server/routers/newt/peers";
+import {
+    deletePeer as newtDeletePeer
+} from "@server/routers/newt/peers";
 import {
    initPeerAddHandshake,
    deletePeer as olmDeletePeer
@@ -31,7 +33,7 @@ import {
    generateAliasConfig,
    generateRemoteSubnets,
    generateSubnetProxyTargetV2,
-    parseEndpoint
+    parseEndpoint,
 } from "@server/lib/ip";
 import {
    addPeerData,
@@ -39,11 +41,6 @@ import {
    removePeerData,
    removeTargets as removeSubnetProxyTargets
 } from "@server/routers/client/targets";
-import { lockManager } from "#dynamic/lib/lock";
-
-// TTL for rebuild-association locks. These functions can fan out into many
-// peer/proxy updates, so give them a generous window.
-const REBUILD_ASSOCIATIONS_LOCK_TTL_MS = 120000;

 export async function getClientSiteResourceAccess(
    siteResource: SiteResource,
@@ -54,7 +51,10 @@ export async function getClientSiteResourceAccess(
        ? await trx
              .select()
              .from(sites)
-              .innerJoin(siteNetworks, eq(siteNetworks.siteId, sites.siteId))
+              .innerJoin(
+                  siteNetworks,
+                  eq(siteNetworks.siteId, sites.siteId)
+              )
              .where(eq(siteNetworks.networkId, siteResource.networkId))
              .then((rows) => rows.map((row) => row.sites))
        : [];
@@ -166,23 +166,6 @@ export async function rebuildClientAssociationsFromSiteResource(
        pubKey: string | null;
        subnet: string | null;
    }[];
-}> {
-    return await lockManager.withLock(
-        `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
-        () => rebuildClientAssociationsFromSiteResourceImpl(siteResource, trx),
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
-    );
-}
-
-async function rebuildClientAssociationsFromSiteResourceImpl(
-    siteResource: SiteResource,
-    trx: Transaction | typeof db = db
-): Promise<{
-    mergedAllClients: {
-        clientId: number;
-        pubKey: string | null;
-        subnet: string | null;
-    }[];
 }> {
    logger.debug(
        `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] START siteResourceId=${siteResource.siteResourceId} networkId=${siteResource.networkId} orgId=${siteResource.orgId}`
@@ -379,8 +362,7 @@ async function rebuildClientAssociationsFromSiteResourceImpl(
                      .where(inArray(clients.clientId, existingClientSiteIds))
                : [];

-        const otherResourceClientIds =
-            clientsFromOtherResourcesBySite.get(siteId) ?? new Set<number>();
+        const otherResourceClientIds = clientsFromOtherResourcesBySite.get(siteId) ?? new Set<number>();

        logger.debug(
            `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteId=${siteId} otherResourceClientIds=[${[...otherResourceClientIds].join(", ")}] mergedAllClientIds=[${mergedAllClientIds.join(", ")}]`
@@ -561,29 +543,6 @@ async function handleMessagesForSiteClients(
        }
    }

-    // get the number of sites on each of these clients so we can log it and make decisions about whether to send messages based on it
-    const clientSiteCounts: Record<number, number> = {};
-    if (clientsToProcess.size > 0) {
-        const clientIdsToProcess = Array.from(clientsToProcess.keys());
-        const siteCounts = await trx
-            .select({
-                clientId: clientSitesAssociationsCache.clientId,
-                siteCount: count(clientSitesAssociationsCache.siteId)
-            })
-            .from(clientSitesAssociationsCache)
-            .where(
-                inArray(
-                    clientSitesAssociationsCache.clientId,
-                    clientIdsToProcess
-                )
-            )
-            .groupBy(clientSitesAssociationsCache.clientId);
-
-        for (const row of siteCounts) {
-            clientSiteCounts[row.clientId] = Number(row.siteCount);
-        }
-    }
-
    for (const client of clientsToProcess.values()) {
        // UPDATE THE NEWT
        if (!client.subnet || !client.pubKey) {
@@ -627,14 +586,7 @@ async function handleMessagesForSiteClients(
        }

        if (isAdd) {
-            if (clientSiteCounts[client.clientId] > 250) {
-                // skip adding the peer if we have more than 250 sites because we are in jit mode anyway
-                logger.info(
-                    `rebuildClientAssociations: Client ${client.clientId} has ${clientSiteCounts[client.clientId]} sites so skipping adding peer to newt and olm because it is likely in jit mode`
-                );
-                continue;
-            }
-
+            // TODO: if we are in jit mode here should we really be sending this?
            await initPeerAddHandshake(
                // this will kick off the add peer process for the client
                client.clientId,
@@ -652,24 +604,9 @@ async function handleMessagesForSiteClients(
        exitNodeJobs.push(updateClientSiteDestinations(client, trx));
    }

-    Promise.all(exitNodeJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating client site destinations for site ${site.siteId}:`,
-            error
-        );
-    });
-    Promise.all(newtJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Newt peers for site ${site.siteId}:`,
-            error
-        );
-    });
-    Promise.all(olmJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Olm peers for site ${site.siteId}:`,
-            error
-        );
-    });
+    await Promise.all(exitNodeJobs);
+    await Promise.all(newtJobs); // do the servers first to make sure they are ready?
+    await Promise.all(olmJobs);
 }

 interface PeerDestination {
@@ -772,7 +709,7 @@ export async function updateClientSiteDestinations(
            sourcePort: destination.sourcePort,
            destinations: destination.destinations
        };
-        logger.debug(
+        logger.info(
            `Payload for update-destinations: ${JSON.stringify(payload, null, 2)}`
        );

@@ -890,9 +827,6 @@ async function handleSubnetProxyTargetUpdates(
                }

                for (const client of removedClients) {
-                    if (!siteResource.destination) {
-                        continue;
-                    }
                    // Check if this client still has access to another resource
                    // on this specific site with the same destination. We scope
                    // by siteId (via siteNetworks) rather than networkId because
@@ -955,17 +889,6 @@ async function handleSubnetProxyTargetUpdates(
 export async function rebuildClientAssociationsFromClient(
    client: Client,
    trx: Transaction | typeof db = db
-): Promise<void> {
-    return await lockManager.withLock(
-        `rebuild-client-associations:client:${client.clientId}`,
-        () => rebuildClientAssociationsFromClientImpl(client, trx),
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
-    );
-}
-
-async function rebuildClientAssociationsFromClientImpl(
-    client: Client,
-    trx: Transaction | typeof db = db
 ): Promise<void> {
    let newSiteResourceIds: number[] = [];

@@ -1238,12 +1161,6 @@ async function handleMessagesForClientSites(
    const olmJobs: Promise<any>[] = [];
    const exitNodeJobs: Promise<any>[] = [];

-    const totalSitesOnClient = await trx
-        .select({ count: count(clientSitesAssociationsCache.siteId) })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.clientId, client.clientId))
-        .then((rows) => Number(rows[0].count));
-
    for (const siteData of sitesData) {
        const site = siteData.sites;
        const exitNode = siteData.exitNodes;
@@ -1304,14 +1221,7 @@ async function handleMessagesForClientSites(
                continue;
            }

-            if (totalSitesOnClient > 250) {
-                // skip adding the site if we have more than 250 because we are in jit mode anyway
-                logger.info(
-                    `rebuildClientAssociations: Client ${client.clientId} has ${totalSitesOnClient} sites so skipping adding peer to newt and olm because it is likely in jit mode`
-                );
-                continue;
-            }
-
+            // TODO: if we are in jit mode here should we really be sending this?
            await initPeerAddHandshake(
                // this will kick off the add peer process for the client
                client.clientId,
@@ -1339,24 +1249,9 @@ async function handleMessagesForClientSites(
        );
    }

-    Promise.all(exitNodeJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating client site destinations for client ${client.clientId}:`,
-            error
-        );
-    });
-    Promise.all(newtJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Newt peers for client ${client.clientId}:`,
-            error
-        );
-    });
-    Promise.all(olmJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Olm peers for client ${client.clientId}:`,
-            error
-        );
-    });
+    await Promise.all(exitNodeJobs);
+    await Promise.all(newtJobs);
+    await Promise.all(olmJobs);
 }

 async function handleMessagesForClientResources(
@@ -1566,9 +1461,6 @@ async function handleMessagesForClientResources(
                }

                try {
-                    if (!resource.destination) {
-                        continue;
-                    }
                    // Check if this client still has access to another resource
                    // on this specific site with the same destination. We scope
                    // by siteId (via siteNetworks) rather than networkId because
@@ -1640,269 +1532,3 @@ async function handleMessagesForClientResources(

    await Promise.all([...proxyJobs, ...olmJobs]);
 }
-
-export type ClientAssociationsCacheVerification = {
-    clientId: number;
-    consistent: boolean;
-    // What permissions say the cache should contain
-    expectedSiteResourceIds: number[];
-    expectedSiteIds: number[];
-    // What the cache currently contains
-    actualSiteResourceIds: number[];
-    actualSiteIds: number[];
-    // Diff
-    missingSiteResourceIds: number[]; // present in expected, missing from cache
-    extraSiteResourceIds: number[]; // present in cache, not in expected
-    missingSiteIds: number[];
-    extraSiteIds: number[];
-};
-
-// verifyClientAssociationsCache walks the same permission-derivation logic as
-// rebuildClientAssociationsFromClient but does NOT modify the database. It
-// returns the expected vs actual cache contents and a boolean indicating
-// whether the cache is in sync with what permissions imply.
-export async function verifyClientAssociationsCache(
-    client: Client,
-    trx: Transaction | typeof db = db
-): Promise<ClientAssociationsCacheVerification> {
-    let newSiteResourceIds: number[] = [];
-
-    // 1. Direct client associations
-    const directSiteResources = await trx
-        .select({ siteResourceId: clientSiteResources.siteResourceId })
-        .from(clientSiteResources)
-        .innerJoin(
-            siteResources,
-            eq(siteResources.siteResourceId, clientSiteResources.siteResourceId)
-        )
-        .where(
-            and(
-                eq(clientSiteResources.clientId, client.clientId),
-                eq(siteResources.orgId, client.orgId)
-            )
-        );
-
-    newSiteResourceIds.push(
-        ...directSiteResources.map((r) => r.siteResourceId)
-    );
-
-    // 2. User-based and role-based access (if client has a userId)
-    if (client.userId) {
-        const userSiteResourceIds = await trx
-            .select({ siteResourceId: userSiteResources.siteResourceId })
-            .from(userSiteResources)
-            .innerJoin(
-                siteResources,
-                eq(
-                    siteResources.siteResourceId,
-                    userSiteResources.siteResourceId
-                )
-            )
-            .where(
-                and(
-                    eq(userSiteResources.userId, client.userId),
-                    eq(siteResources.orgId, client.orgId)
-                )
-            );
-
-        newSiteResourceIds.push(
-            ...userSiteResourceIds.map((r) => r.siteResourceId)
-        );
-
-        const roleIds = await trx
-            .select({ roleId: userOrgRoles.roleId })
-            .from(userOrgRoles)
-            .where(
-                and(
-                    eq(userOrgRoles.userId, client.userId),
-                    eq(userOrgRoles.orgId, client.orgId)
-                )
-            )
-            .then((rows) => rows.map((row) => row.roleId));
-
-        if (roleIds.length > 0) {
-            const roleSiteResourceIds = await trx
-                .select({ siteResourceId: roleSiteResources.siteResourceId })
-                .from(roleSiteResources)
-                .innerJoin(
-                    siteResources,
-                    eq(
-                        siteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    and(
-                        inArray(roleSiteResources.roleId, roleIds),
-                        eq(siteResources.orgId, client.orgId)
-                    )
-                );
-
-            newSiteResourceIds.push(
-                ...roleSiteResourceIds.map((r) => r.siteResourceId)
-            );
-        }
-    }
-
-    newSiteResourceIds = Array.from(new Set(newSiteResourceIds));
-
-    const newSiteResources =
-        newSiteResourceIds.length > 0
-            ? await trx
-                  .select()
-                  .from(siteResources)
-                  .where(
-                      inArray(siteResources.siteResourceId, newSiteResourceIds)
-                  )
-            : [];
-
-    const networkIds = Array.from(
-        new Set(
-            newSiteResources
-                .map((sr) => sr.networkId)
-                .filter((id): id is number => id !== null)
-        )
-    );
-    const newSiteIds =
-        networkIds.length > 0
-            ? await trx
-                  .select({ siteId: siteNetworks.siteId })
-                  .from(siteNetworks)
-                  .where(inArray(siteNetworks.networkId, networkIds))
-                  .then((rows) =>
-                      Array.from(new Set(rows.map((r) => r.siteId)))
-                  )
-            : [];
-
-    // Read the existing cache state
-    const existingResourceAssociations = await trx
-        .select({
-            siteResourceId: clientSiteResourcesAssociationsCache.siteResourceId
-        })
-        .from(clientSiteResourcesAssociationsCache)
-        .where(
-            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
-        );
-    const existingSiteResourceIds = existingResourceAssociations.map(
-        (r) => r.siteResourceId
-    );
-
-    const existingSiteAssociations = await trx
-        .select({ siteId: clientSitesAssociationsCache.siteId })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.clientId, client.clientId));
-    const existingSiteIds = existingSiteAssociations.map((s) => s.siteId);
-
-    const expectedSiteResourceSet = new Set(newSiteResourceIds);
-    const actualSiteResourceSet = new Set(existingSiteResourceIds);
-    const expectedSiteSet = new Set(newSiteIds);
-    const actualSiteSet = new Set(existingSiteIds);
-
-    const missingSiteResourceIds = newSiteResourceIds.filter(
-        (id) => !actualSiteResourceSet.has(id)
-    );
-    const extraSiteResourceIds = existingSiteResourceIds.filter(
-        (id) => !expectedSiteResourceSet.has(id)
-    );
-    const missingSiteIds = newSiteIds.filter((id) => !actualSiteSet.has(id));
-    const extraSiteIds = existingSiteIds.filter(
-        (id) => !expectedSiteSet.has(id)
-    );
-
-    const consistent =
-        missingSiteResourceIds.length === 0 &&
-        extraSiteResourceIds.length === 0 &&
-        missingSiteIds.length === 0 &&
-        extraSiteIds.length === 0;
-
-    return {
-        clientId: client.clientId,
-        consistent,
-        expectedSiteResourceIds: Array.from(expectedSiteResourceSet).sort(
-            (a, b) => a - b
-        ),
-        expectedSiteIds: Array.from(expectedSiteSet).sort((a, b) => a - b),
-        actualSiteResourceIds: Array.from(actualSiteResourceSet).sort(
-            (a, b) => a - b
-        ),
-        actualSiteIds: Array.from(actualSiteSet).sort((a, b) => a - b),
-        missingSiteResourceIds: missingSiteResourceIds.sort((a, b) => a - b),
-        extraSiteResourceIds: extraSiteResourceIds.sort((a, b) => a - b),
-        missingSiteIds: missingSiteIds.sort((a, b) => a - b),
-        extraSiteIds: extraSiteIds.sort((a, b) => a - b)
-    };
-}
-
-// cleanupSiteAssociations efficiently removes all client associations for a
-// site that is being deleted. Instead of calling
-// rebuildClientAssociationsFromSiteResource once per site resource (which is
-// O(resources) in DB round-trips and message fan-out), this function performs
-// a single bulk lookup of affected clients and site resources, deletes all
-// cache rows at once, and fires all peer/proxy removal messages in parallel.
-//
-// The caller is responsible for deleting the site row itself (and for sending
-// the newt/wg/terminate signal to the newt process).
-export async function cleanupSiteAssociations(
-    site: Site,
-    trx: Transaction | typeof db = db
-): Promise<void> {
-    const siteId = site.siteId;
-
-    logger.debug(`cleanupSiteAssociations: START siteId=${siteId}`);
-
-    // 1. Find every client currently cached against this site.
-    const cachedSiteClientRows = await trx
-        .select({ clientId: clientSitesAssociationsCache.clientId })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.siteId, siteId));
-
-    const cachedClientIds = cachedSiteClientRows.map((r) => r.clientId);
-
-    // 2. Load full client details (needed for WireGuard public-key references).
-    const allClients =
-        cachedClientIds.length > 0
-            ? await trx
-                  .select({
-                      clientId: clients.clientId,
-                      pubKey: clients.pubKey,
-                      subnet: clients.subnet
-                  })
-                  .from(clients)
-                  .where(inArray(clients.clientId, cachedClientIds))
-            : [];
-
-    // 6. Bulk-delete all cache entries for this site.  Do this before sending
-    //    destination-update messages so updateClientSiteDestinations computes
-    //    the correct (post-deletion) set of destinations.
-    await trx
-        .delete(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.siteId, siteId));
-
-    logger.debug(
-        `cleanupSiteAssociations: siteId=${siteId} cache cleared. clients=${allClients.length}`
-    );
-
-    // 7. Fire all removal messages in parallel.
-    const jobs: Promise<any>[] = [];
-
-    for (const client of allClients) {
-        // Tell each olm to drop the site's WireGuard peer.
-        if (site.publicKey) {
-            jobs.push(olmDeletePeer(client.clientId, siteId, site.publicKey));
-        }
-
-        // Recompute and push updated relay destinations (now excluding this site).
-        if (client.pubKey && client.subnet) {
-            jobs.push(updateClientSiteDestinations(client, trx));
-        }
-    }
-
-    await Promise.all(jobs).catch((error) => {
-        logger.error(
-            `cleanupSiteAssociations: error sending cleanup messages for siteId=${siteId}:`,
-            error
-        );
-    });
-
-    logger.debug(`cleanupSiteAssociations: DONE siteId=${siteId}`);
-}
--- a/server/lib/requestParams.ts
+++ b/server/lib/requestParams.ts
@@ -1,11 +0,0 @@
-export function getFirstString(value: unknown): string | undefined {
-    if (typeof value === "string") {
-        return value;
-    }
-
-    if (Array.isArray(value) && typeof value[0] === "string") {
-        return value[0];
-    }
-
-    return undefined;
-}
--- a/server/lib/statusHistory.ts
+++ b/server/lib/statusHistory.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { db, logsDb, statusHistory } from "@server/db";
 import { and, eq, gte, asc } from "drizzle-orm";
-import { regionalCache as cache } from "#dynamic/lib/cache";
+import { regionalCache as cache } from "@server/private/lib/cache";

 const STATUS_HISTORY_CACHE_TTL = 60; // seconds

--- a/server/lib/telemetry.ts
+++ b/server/lib/telemetry.ts
@@ -2,14 +2,7 @@ import { PostHog } from "posthog-node";
 import config from "./config";
 import { getHostMeta } from "./hostMeta";
 import logger from "@server/logger";
-import {
-    alertRules,
-    apiKeys,
-    blueprints,
-    db,
-    roles,
-    siteResources
-} from "@server/db";
+import { alertRules, apiKeys, blueprints, db, roles, siteResources } from "@server/db";
 import { sites, users, orgs, resources, clients, idp } from "@server/db";
 import { eq, count, notInArray, and, isNotNull, isNull } from "drizzle-orm";
 import { APP_VERSION } from "./consts";
@@ -150,7 +143,8 @@ class TelemetryClient {
                .select({
                    name: resources.name,
                    sso: resources.sso,
-                    mode: resources.mode
+                    protocol: resources.protocol,
+                    http: resources.http
                })
                .from(resources);

@@ -317,7 +311,7 @@ class TelemetryClient {
                        (r) => r.sso
                    ).length,
                    num_resources_non_http: stats.resources.filter(
-                        (r) => r.mode !== "http"
+                        (r) => !r.http
                    ).length,
                    num_newt_sites: stats.sites.filter((s) => s.type === "newt")
                        .length,
--- a/server/lib/traefik/TraefikConfigManager.ts
+++ b/server/lib/traefik/TraefikConfigManager.ts
@@ -520,8 +520,7 @@ export class TraefikConfigManager {
                build != "oss", // generate the login pages on the cloud and hybrid,
                build == "saas"
                    ? false
-                    : config.getRawConfig().traefik.allow_raw_resources, // dont allow raw resources on saas otherwise use config
-                build != "oss" // generate browser gateway targets on cloud and enterprise
+                    : config.getRawConfig().traefik.allow_raw_resources // dont allow raw resources on saas otherwise use config
            );

            const domains = new Set<string>();
--- a/server/lib/traefik/getTraefikConfig.ts
+++ b/server/lib/traefik/getTraefikConfig.ts
@@ -55,7 +55,9 @@ export async function getTraefikConfig(
            resourceName: resources.name,
            fullDomain: resources.fullDomain,
            ssl: resources.ssl,
+            http: resources.http,
            proxyPort: resources.proxyPort,
+            protocol: resources.protocol,
            subdomain: resources.subdomain,
            domainId: resources.domainId,
            enabled: resources.enabled,
@@ -66,7 +68,6 @@ export async function getTraefikConfig(
            headers: resources.headers,
            proxyProtocol: resources.proxyProtocol,
            proxyProtocolVersion: resources.proxyProtocolVersion,
-            mode: resources.mode,

            // Target fields
            targetId: targets.targetId,
@@ -114,8 +115,8 @@ export async function getTraefikConfig(
                ),
                inArray(sites.type, siteTypes),
                allowRawResources
-                    ? inArray(resources.mode, ["http", "udp", "tcp"]) // allow all three
-                    : eq(resources.mode, "http")
+                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
+                    : eq(resources.http, true)
            )
        )
        .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -165,8 +166,9 @@ export async function getTraefikConfig(
                key: key,
                fullDomain: row.fullDomain,
                ssl: row.ssl,
-                mode: row.mode,
+                http: row.http,
                proxyPort: row.proxyPort,
+                protocol: row.protocol,
                subdomain: row.subdomain,
                domainId: row.domainId,
                enabled: row.enabled,
@@ -578,7 +580,7 @@ export async function getTraefikConfig(
                continue;
            }

-            const protocol = resource.mode === "udp" ? "udp" : "tcp"; // all of the other ones are tcp
+            const protocol = resource.protocol.toLowerCase();
            const port = resource.proxyPort;

            if (!port) {
--- a/server/lib/validators.test.ts
+++ b/server/lib/validators.test.ts
@@ -244,5 +244,4 @@ try {
    runTests();
 } catch (error) {
    console.error("Test failed:", error);
-    process.exit(1);
 }
--- a/server/middlewares/index.ts
+++ b/server/middlewares/index.ts
@@ -28,9 +28,7 @@ export * from "./verifyApiKeyAccess";
 export * from "./verifySiteProvisioningKeyAccess";
 export * from "./verifyDomainAccess";
 export * from "./verifyUserIsOrgOwner";
-export * from "./verifyUserFromResourceSession";
 export * from "./verifySiteResourceAccess";
 export * from "./logActionAudit";
 export * from "./verifyOlmAccess";
 export * from "./verifyLimits";
-export * from "./verifyResourcePolicyAccess";
--- a/server/middlewares/integration/index.ts
+++ b/server/middlewares/integration/index.ts
@@ -16,4 +16,3 @@ export * from "./verifyApiKeyClientAccess";
 export * from "./verifyApiKeySiteResourceAccess";
 export * from "./verifyApiKeyIdpAccess";
 export * from "./verifyApiKeyDomainAccess";
-export * from "./verifyApiKeyResourcePolicyAccess";
--- a/server/middlewares/integration/verifyAccessTokenAccess.ts
+++ b/server/middlewares/integration/verifyAccessTokenAccess.ts
@@ -4,7 +4,6 @@ import { resourceAccessToken, resources, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyAccessTokenAccess(
    req: Request,
@@ -13,7 +12,7 @@ export async function verifyApiKeyAccessTokenAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const accessTokenId = getFirstString(req.params.accessTokenId);
+        const accessTokenId = req.params.accessTokenId;

        if (!apiKey) {
            return next(
@@ -21,12 +20,6 @@ export async function verifyApiKeyAccessTokenAccess(
            );
        }

-        if (!accessTokenId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid access token ID")
-            );
-        }
-
        const [accessToken] = await db
            .select()
            .from(resourceAccessToken)
--- a/server/middlewares/integration/verifyApiKeyApiKeyAccess.ts
+++ b/server/middlewares/integration/verifyApiKeyApiKeyAccess.ts
@@ -4,7 +4,6 @@ import { apiKeys, apiKeyOrg } from "@server/db";
 import { and, eq, or } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyApiKeyAccess(
    req: Request,
@@ -15,10 +14,8 @@ export async function verifyApiKeyApiKeyAccess(
        const { apiKey: callerApiKey } = req;

        const apiKeyId =
-            getFirstString(req.params.apiKeyId) ||
-            getFirstString(req.body.apiKeyId) ||
-            getFirstString(req.query.apiKeyId);
-        const orgId = getFirstString(req.params.orgId);
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;

        if (!callerApiKey) {
            return next(
--- a/server/middlewares/integration/verifyApiKeyDomainAccess.ts
+++ b/server/middlewares/integration/verifyApiKeyDomainAccess.ts
@@ -3,7 +3,6 @@ import { db, domains, orgDomains, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyDomainAccess(
    req: Request,
@@ -13,10 +12,8 @@ export async function verifyApiKeyDomainAccess(
    try {
        const apiKey = req.apiKey;
        const domainId =
-            getFirstString(req.params.domainId) ||
-            getFirstString(req.body.domainId) ||
-            getFirstString(req.query.domainId);
-        const orgId = getFirstString(req.params.orgId);
+            req.params.domainId || req.body.domainId || req.query.domainId;
+        const orgId = req.params.orgId;

        if (!apiKey) {
            return next(
@@ -30,12 +27,6 @@ export async function verifyApiKeyDomainAccess(
            );
        }

-        if (!orgId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
-            );
-        }
-
        if (apiKey.isRoot) {
            // Root keys can access any domain in any org
            return next();
--- a/server/middlewares/integration/verifyApiKeyIdpAccess.ts
+++ b/server/middlewares/integration/verifyApiKeyIdpAccess.ts
@@ -4,7 +4,6 @@ import { idp, idpOrg, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyIdpAccess(
    req: Request,
@@ -13,12 +12,8 @@ export async function verifyApiKeyIdpAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const idpIdRaw =
-            getFirstString(req.params.idpId) ||
-            getFirstString(req.body.idpId) ||
-            getFirstString(req.query.idpId);
-        const idpId = Number.parseInt(idpIdRaw ?? "", 10);
-        const orgId = getFirstString(req.params.orgId);
+        const idpId = req.params.idpId || req.body.idpId || req.query.idpId;
+        const orgId = req.params.orgId;

        if (!apiKey) {
            return next(
@@ -32,7 +27,7 @@ export async function verifyApiKeyIdpAccess(
            );
        }

-        if (Number.isNaN(idpId)) {
+        if (!idpId) {
            return next(
                createHttpError(HttpCode.BAD_REQUEST, "Invalid IDP ID")
            );
--- a/server/middlewares/integration/verifyApiKeyOrgAccess.ts
+++ b/server/middlewares/integration/verifyApiKeyOrgAccess.ts
@@ -4,7 +4,6 @@ import { apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyOrgAccess(
    req: Request,
@@ -13,7 +12,7 @@ export async function verifyApiKeyOrgAccess(
 ) {
    try {
        const apiKeyId = req.apiKey?.apiKeyId;
-        const orgId = getFirstString(req.params.orgId);
+        const orgId = req.params.orgId;

        if (!apiKeyId) {
            return next(
@@ -46,7 +45,7 @@ export async function verifyApiKeyOrgAccess(
        }

        if (!req.apiKeyOrg) {
-            return next(
+            next(
                createHttpError(
                    HttpCode.FORBIDDEN,
                    "Key does not have access to this organization"
--- a/server/middlewares/integration/verifyApiKeyResourcePolicyAccess.ts
+++ b/server/middlewares/integration/verifyApiKeyResourcePolicyAccess.ts
@@ -1,92 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { resourcePolicies, apiKeyOrg } from "@server/db";
-import { eq, and } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-
-export async function verifyApiKeyResourcePolicyAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    const apiKey = req.apiKey;
-    const resourcePolicyId =
-        req.params.resourcePolicyId ||
-        req.body.resourcePolicyId ||
-        req.query.resourcePolicyId;
-
-    if (!apiKey) {
-        return next(
-            createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
-        );
-    }
-
-    try {
-        // Retrieve the resource policy
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .limit(1);
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource policy with ID ${resourcePolicyId} not found`
-                )
-            );
-        }
-
-        if (apiKey.isRoot) {
-            // Root keys can access any resource policy in any org
-            return next();
-        }
-
-        if (!policy.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    `Resource policy with ID ${resourcePolicyId} does not have an organization ID`
-                )
-            );
-        }
-
-        // Verify that the API key is linked to the resource policy's organization
-        if (!req.apiKeyOrg) {
-            const apiKeyOrgResult = await db
-                .select()
-                .from(apiKeyOrg)
-                .where(
-                    and(
-                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
-                        eq(apiKeyOrg.orgId, policy.orgId)
-                    )
-                )
-                .limit(1);
-
-            if (apiKeyOrgResult.length > 0) {
-                req.apiKeyOrg = apiKeyOrgResult[0];
-            }
-        }
-
-        if (!req.apiKeyOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Key does not have access to this organization"
-                )
-            );
-        }
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying resource policy access"
-            )
-        );
-    }
-}
--- a/server/middlewares/integration/verifyApiKeySiteResourceAccess.ts
+++ b/server/middlewares/integration/verifyApiKeySiteResourceAccess.ts
@@ -4,7 +4,6 @@ import { siteResources, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeySiteResourceAccess(
    req: Request,
@@ -13,8 +12,7 @@ export async function verifyApiKeySiteResourceAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const siteResourceIdRaw = getFirstString(req.params.siteResourceId);
-        const siteResourceId = Number.parseInt(siteResourceIdRaw ?? "", 10);
+        const siteResourceId = parseInt(req.params.siteResourceId);

        if (!apiKey) {
            return next(
@@ -22,7 +20,7 @@ export async function verifyApiKeySiteResourceAccess(
            );
        }

-        if (Number.isNaN(siteResourceId)) {
+        if (!siteResourceId) {
            return next(
                createHttpError(
                    HttpCode.BAD_REQUEST,
--- a/server/middlewares/integration/verifyApiKeyTargetAccess.ts
+++ b/server/middlewares/integration/verifyApiKeyTargetAccess.ts
@@ -4,7 +4,6 @@ import { resources, targets, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyTargetAccess(
    req: Request,
@@ -13,8 +12,7 @@ export async function verifyApiKeyTargetAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const targetIdRaw = getFirstString(req.params.targetId);
-        const targetId = Number.parseInt(targetIdRaw ?? "", 10);
+        const targetId = parseInt(req.params.targetId);

        if (!apiKey) {
            return next(
@@ -22,7 +20,7 @@ export async function verifyApiKeyTargetAccess(
            );
        }

-        if (Number.isNaN(targetId)) {
+        if (isNaN(targetId)) {
            return next(
                createHttpError(HttpCode.BAD_REQUEST, "Invalid target ID")
            );
--- a/server/middlewares/verifyAccessTokenAccess.ts
+++ b/server/middlewares/verifyAccessTokenAccess.ts
@@ -7,7 +7,6 @@ import HttpCode from "@server/types/HttpCode";
 import { canUserAccessResource } from "@server/auth/canUserAccessResource";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyAccessTokenAccess(
    req: Request,
@@ -15,7 +14,7 @@ export async function verifyAccessTokenAccess(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const accessTokenId = getFirstString(req.params.accessTokenId);
+    const accessTokenId = req.params.accessTokenId;

    if (!userId) {
        return next(
@@ -23,12 +22,6 @@ export async function verifyAccessTokenAccess(
        );
    }

-    if (!accessTokenId) {
-        return next(
-            createHttpError(HttpCode.BAD_REQUEST, "Invalid access token ID")
-        );
-    }
-
    const [accessToken] = await db
        .select()
        .from(resourceAccessToken)
@@ -94,7 +87,7 @@ export async function verifyAccessTokenAccess(
        }

        if (!req.userOrg) {
-            return next(
+            next(
                createHttpError(
                    HttpCode.FORBIDDEN,
                    "User does not have access to this organization"
--- a/server/middlewares/verifyApiKeyAccess.ts
+++ b/server/middlewares/verifyApiKeyAccess.ts
@@ -6,7 +6,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyAccess(
    req: Request,
@@ -15,24 +14,9 @@ export async function verifyApiKeyAccess(
 ) {
    try {
        const userId = req.user!.userId;
-        const apiKeyIdFromParams = getFirstString(req.params?.apiKeyId);
-        const apiKeyIdFromBody = getFirstString(req.body?.apiKeyId);
-
-        if (
-            apiKeyIdFromParams &&
-            apiKeyIdFromBody &&
-            apiKeyIdFromParams !== apiKeyIdFromBody
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "API key ID provided in both URL and body with different values"
-                )
-            );
-        }
-
-        const apiKeyId = apiKeyIdFromParams || apiKeyIdFromBody;
-        const orgId = getFirstString(req.params.orgId);
+        const apiKeyId =
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;

        if (!userId) {
            return next(
@@ -120,7 +104,10 @@ export async function verifyApiKeyAccess(
            }
        }

-        req.userOrgRoleIds = await getUserOrgRoleIds(req.userOrg.userId, orgId);
+        req.userOrgRoleIds = await getUserOrgRoleIds(
+            req.userOrg.userId,
+            orgId
+        );

        return next();
    } catch (error) {
--- a/server/middlewares/verifyDomainAccess.ts
+++ b/server/middlewares/verifyDomainAccess.ts
@@ -6,7 +6,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyDomainAccess(
    req: Request,
@@ -15,8 +14,9 @@ export async function verifyDomainAccess(
 ) {
    try {
        const userId = req.user!.userId;
-        const domainId = getFirstString(req.params.domainId);
-        const orgId = getFirstString(req.params.orgId);
+        const domainId =
+            req.params.domainId;
+        const orgId = req.params.orgId;

        if (!userId) {
            return next(
@@ -62,7 +62,10 @@ export async function verifyDomainAccess(
                .select()
                .from(userOrgs)
                .where(
-                    and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, orgId))
+                    and(
+                        eq(userOrgs.userId, userId),
+                        eq(userOrgs.orgId, orgId)
+                    )
                )
                .limit(1);
            req.userOrg = userOrgRole[0];
--- a/server/middlewares/verifyLimits.ts
+++ b/server/middlewares/verifyLimits.ts
@@ -3,7 +3,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { usageService } from "@server/lib/billing/usageService";
 import { build } from "@server/build";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyLimits(
    req: Request,
@@ -14,10 +13,7 @@ export async function verifyLimits(
        return next();
    }

-    const orgId =
-        req.userOrgId ||
-        req.apiKeyOrg?.orgId ||
-        getFirstString(req.params.orgId);
+    const orgId = req.userOrgId || req.apiKeyOrg?.orgId || req.params.orgId;

    if (!orgId) {
        return next(); // its fine if we silently fail here because this is not critical to operation or security and its better user experience if we dont fail
--- a/server/middlewares/verifyOrgAccess.ts
+++ b/server/middlewares/verifyOrgAccess.ts
@@ -6,7 +6,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyOrgAccess(
    req: Request,
@@ -14,7 +13,7 @@ export async function verifyOrgAccess(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const orgId = getFirstString(req.params.orgId);
+    const orgId = req.params.orgId;

    if (!userId) {
        return next(
--- a/server/middlewares/verifyResourcePolicyAccess.ts
+++ b/server/middlewares/verifyResourcePolicyAccess.ts
@@ -1,127 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { resourcePolicies, userOrgs } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
-import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-
-export async function verifyResourcePolicyAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    const userId = req.user!.userId;
-    const resourcePolicyIdStr =
-        req.params?.resourcePolicyId ||
-        req.body?.resourcePolicyId ||
-        req.query?.resourcePolicyId;
-    const niceId = req.params?.niceId || req.body?.niceId || req.query?.niceId;
-    const orgId = req.params?.orgId || req.body?.orgId || req.query?.orgId;
-
-    try {
-        if (!userId) {
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
-            );
-        }
-
-        let policy: typeof resourcePolicies.$inferSelect | null = null;
-
-        if (orgId && niceId) {
-            const [policyRes] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(
-                    and(
-                        eq(resourcePolicies.niceId, niceId),
-                        eq(resourcePolicies.orgId, orgId)
-                    )
-                )
-                .limit(1);
-            policy = policyRes ?? null;
-        } else {
-            const resourcePolicyId = parseInt(resourcePolicyIdStr);
-            if (isNaN(resourcePolicyId)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid resource policy ID"
-                    )
-                );
-            }
-            const [policyRes] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-                .limit(1);
-            policy = policyRes ?? null;
-        }
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource policy with ID ${resourcePolicyIdStr ?? niceId} not found`
-                )
-            );
-        }
-
-        if (!req.userOrg) {
-            const userOrgRes = await db
-                .select()
-                .from(userOrgs)
-                .where(
-                    and(
-                        eq(userOrgs.userId, userId),
-                        eq(userOrgs.orgId, policy.orgId)
-                    )
-                )
-                .limit(1);
-            req.userOrg = userOrgRes[0];
-        }
-
-        if (!req.userOrg || req.userOrg.orgId !== policy.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this organization"
-                )
-            );
-        }
-
-        if (req.orgPolicyAllowed === undefined && req.userOrg.orgId) {
-            const policyCheck = await checkOrgAccessPolicy({
-                orgId: req.userOrg.orgId,
-                userId,
-                session: req.session
-            });
-            req.orgPolicyAllowed = policyCheck.allowed;
-            if (!policyCheck.allowed || policyCheck.error) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
-                    )
-                );
-            }
-        }
-
-        req.userOrgRoleIds = await getUserOrgRoleIds(
-            req.userOrg.userId,
-            policy.orgId
-        );
-        req.userOrgId = policy.orgId;
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying resource policy access"
-            )
-        );
-    }
-}
--- a/server/middlewares/verifySiteProvisioningKeyAccess.ts
+++ b/server/middlewares/verifySiteProvisioningKeyAccess.ts
@@ -1,16 +1,10 @@
 import { Request, Response, NextFunction } from "express";
-import {
-    db,
-    userOrgs,
-    siteProvisioningKeys,
-    siteProvisioningKeyOrg
-} from "@server/db";
+import { db, userOrgs, siteProvisioningKeys, siteProvisioningKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifySiteProvisioningKeyAccess(
    req: Request,
@@ -19,10 +13,8 @@ export async function verifySiteProvisioningKeyAccess(
 ) {
    try {
        const userId = req.user!.userId;
-        const siteProvisioningKeyId = getFirstString(
-            req.params.siteProvisioningKeyId
-        );
-        const orgId = getFirstString(req.params.orgId);
+        const siteProvisioningKeyId = req.params.siteProvisioningKeyId;
+        const orgId = req.params.orgId;

        if (!userId) {
            return next(
@@ -88,7 +80,10 @@ export async function verifySiteProvisioningKeyAccess(
                .where(
                    and(
                        eq(userOrgs.userId, userId),
-                        eq(userOrgs.orgId, row.siteProvisioningKeyOrg.orgId)
+                        eq(
+                            userOrgs.orgId,
+                            row.siteProvisioningKeyOrg.orgId
+                        )
                    )
                )
                .limit(1);
--- a/server/middlewares/verifyTargetAccess.ts
+++ b/server/middlewares/verifyTargetAccess.ts
@@ -7,7 +7,6 @@ import HttpCode from "@server/types/HttpCode";
 import { canUserAccessResource } from "../auth/canUserAccessResource";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyTargetAccess(
    req: Request,
@@ -15,8 +14,7 @@ export async function verifyTargetAccess(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const targetIdRaw = getFirstString(req.params.targetId);
-    const targetId = Number.parseInt(targetIdRaw ?? "", 10);
+    const targetId = parseInt(req.params.targetId);

    if (!userId) {
        return next(
--- a/server/middlewares/verifyUserCanSetUserOrgRoles.ts
+++ b/server/middlewares/verifyUserCanSetUserOrgRoles.ts
@@ -38,7 +38,7 @@ export function verifyUserCanSetUserOrgRoles() {
            return next(
                createHttpError(
                    HttpCode.FORBIDDEN,
-                    "User does not have permission to set user organization roles"
+                    "User does not have permission perform this action"
                )
            );
        } catch (error) {
--- a/server/middlewares/verifyUserFromResourceSession.ts
+++ b/server/middlewares/verifyUserFromResourceSession.ts
@@ -1,102 +0,0 @@
-import { Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { resourceSessions, users } from "@server/db";
-import { eq } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getUserSessionWithUser } from "@server/db/queries/verifySessionQueries";
-import { encodeHexLowerCase } from "@oslojs/encoding";
-import { sha256 } from "@oslojs/crypto/sha2";
-import config from "@server/lib/config";
-import logger from "@server/logger";
-
-export const verifyUserFromResourceSessionMiddleware = async (
-    req: any,
-    res: Response,
-    next: NextFunction
-) => {
-    if (!req.user) {
-        const sessionCookieName =
-            config.getRawConfig().server.session_cookie_name;
-
-        // Collect all resource session cookies (format: {name}[_s].{timestamp}=token)
-        const cookieHeader: string | undefined = req.headers.cookie;
-        const candidates: { timestamp: number; token: string }[] = [];
-
-        if (cookieHeader) {
-            for (const part of cookieHeader.split(";")) {
-                const trimmed = part.trim();
-                const eqIdx = trimmed.indexOf("=");
-                if (eqIdx === -1) continue;
-
-                const cookieName = trimmed.slice(0, eqIdx).trim();
-                const cookieValue = trimmed.slice(eqIdx + 1).trim();
-
-                // Match both secure (_s.timestamp) and non-secure (.timestamp) variants
-                const securePrefix = `${sessionCookieName}_s.`;
-                const httpPrefix = `${sessionCookieName}.`;
-
-                let timestampStr: string | null = null;
-                if (cookieName.startsWith(securePrefix)) {
-                    timestampStr = cookieName.slice(securePrefix.length);
-                } else if (cookieName.startsWith(httpPrefix)) {
-                    timestampStr = cookieName.slice(httpPrefix.length);
-                }
-
-                if (timestampStr !== null && /^\d+$/.test(timestampStr)) {
-                    candidates.push({
-                        timestamp: parseInt(timestampStr, 10),
-                        token: cookieValue
-                    });
-                }
-            }
-        }
-
-        // Pick the most recently issued session (highest timestamp)
-        candidates.sort((a, b) => b.timestamp - a.timestamp);
-        const best = candidates[0];
-
-        if (best) {
-            try {
-                const sessionId = encodeHexLowerCase(
-                    sha256(new TextEncoder().encode(best.token))
-                );
-
-                const [resourceSession] = await db
-                    .select()
-                    .from(resourceSessions)
-                    .where(eq(resourceSessions.sessionId, sessionId))
-                    .limit(1);
-
-                if (resourceSession && Date.now() < resourceSession.expiresAt) {
-                    if (resourceSession.userSessionId) {
-                        const result = await getUserSessionWithUser(
-                            resourceSession.userSessionId
-                        );
-
-                        if (result?.user && result?.session) {
-                            req.user = result.user;
-                            req.session = result.session;
-                        }
-                    }
-                }
-            } catch (e) {
-                logger.error(
-                    "verifyUserFromResourceSessionMiddleware: failed to validate resource session",
-                    e
-                );
-            }
-        }
-    }
-
-    // Populate userOrgRoleIds if an orgId is available in route params
-    if (req.user && req.params?.orgId && !req.userOrgRoleIds) {
-        req.userOrgRoleIds = await getUserOrgRoleIds(
-            req.user.userId,
-            req.params.orgId
-        );
-    }
-
-    next();
-};
--- a/server/middlewares/verifyUserIsOrgOwner.ts
+++ b/server/middlewares/verifyUserIsOrgOwner.ts
@@ -4,7 +4,6 @@ import { userOrgs } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyUserIsOrgOwner(
    req: Request,
@@ -12,7 +11,7 @@ export async function verifyUserIsOrgOwner(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const orgId = getFirstString(req.params.orgId);
+    const orgId = req.params.orgId;

    if (!userId) {
        return next(
--- a/server/openApi.ts
+++ b/server/openApi.ts
@@ -7,7 +7,6 @@ export enum OpenAPITags {
    Org = "Organization",
    PublicResource = "Public Resource",
    PrivateResource = "Private Resource",
-    Policy = "Policy",
    Role = "Role",
    User = "User",
    Invitation = "User Invitation",
--- a/server/private/lib/acmeCertSync.ts
+++ b/server/private/lib/acmeCertSync.ts
@@ -780,9 +780,9 @@ async function syncAcmeCerts(acmeJsonPath: string): Promise<void> {
            }
        }

-        // logger.debug(
-        //     `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
-        // );
+        logger.debug(
+            `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
+        );

        for (const domain of allDomains) {
            try {
@@ -863,9 +863,9 @@ export function initAcmeCertSync(): void {
                    );
                    return;
                }
-                // logger.debug(
-                //     `acmeCertSync: found ${files.length} acme.json file(s) in directory "${acmeJsonPath}"`
-                // );
+                logger.debug(
+                    `acmeCertSync: found ${files.length} acme.json file(s) in directory "${acmeJsonPath}"`
+                );
                for (const file of files) {
                    syncAcmeCerts(file).catch((err) => {
                        logger.error(
--- a/server/private/lib/certificates.ts
+++ b/server/private/lib/certificates.ts
@@ -36,6 +36,8 @@ export async function getValidCertificatesForDomains(
    domains: Set<string>,
    useCache: boolean = true
 ): Promise<Array<CertificateResult>> {
+
+
    const finalResults: CertificateResult[] = [];
    const domainsToQuery = new Set<string>();

@@ -47,26 +49,7 @@ export async function getValidCertificatesForDomains(
            if (cachedCert) {
                finalResults.push(cachedCert); // Valid cache hit
            } else {
-                // Also check for a wildcard cache entry covering this domain's parent
-                const parts = domain.split(".");
-                let wildcardHit = false;
-                if (parts.length > 1) {
-                    const parentDomain = parts.slice(1).join(".");
-                    const wildcardCacheKey = `cert:*.${parentDomain}`;
-                    const cachedWildcard =
-                        await cache.get<CertificateResult>(wildcardCacheKey);
-                    if (cachedWildcard) {
-                        // Re-stamp queriedDomain so callers see the originally requested domain
-                        finalResults.push({
-                            ...cachedWildcard,
-                            queriedDomain: domain
-                        });
-                        wildcardHit = true;
-                    }
-                }
-                if (!wildcardHit) {
-                    domainsToQuery.add(domain); // Cache miss or expired
-                }
+                domainsToQuery.add(domain); // Cache miss or expired
            }
        }
    } else {
@@ -76,10 +59,7 @@ export async function getValidCertificatesForDomains(

    // 2. If all domains were resolved from the cache, return early
    if (domainsToQuery.size === 0) {
-        const decryptedResults = decryptFinalResults(
-            finalResults,
-            config.getRawConfig().server.secret!
-        );
+        const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
        return decryptedResults;
    }

@@ -98,8 +78,7 @@ export async function getValidCertificatesForDomains(
    const parentDomainsArray = Array.from(parentDomainsToQuery);

    // Build wildcard variants: for each parent domain "example.com", also query "*.example.com"
-    const wildcardPrefixedArray =
-        build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];
+    const wildcardPrefixedArray = build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];

    // 4. Build and execute a single, efficient Drizzle query
    // This query fetches all potential exact and wildcard matches in one database round-trip.
@@ -193,24 +172,11 @@ export async function getValidCertificatesForDomains(
            if (useCache) {
                const cacheKey = `cert:${domain}`;
                await cache.set(cacheKey, resultCert, 180);
-
-                // Also cache wildcard certs under a pattern key so other subdomains
-                // can find them without a DB round-trip
-                if (resultCert.wildcard) {
-                    const normalizedCertDomain = normalizeWildcardDomain(
-                        resultCert.domain
-                    );
-                    const wildcardCacheKey = `cert:*.${normalizedCertDomain}`;
-                    await cache.set(wildcardCacheKey, resultCert, 180);
-                }
            }
        }
    }

-    const decryptedResults = decryptFinalResults(
-        finalResults,
-        config.getRawConfig().server.secret!
-    );
+    const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
    return decryptedResults;
 }

--- a/server/private/lib/logStreaming/index.ts
+++ b/server/private/lib/logStreaming/index.ts
@@ -24,8 +24,7 @@ import { LogStreamingManager } from "./LogStreamingManager";
 */
 export const logStreamingManager = new LogStreamingManager();

-if (build !== "saas") {
-    // this is handled separately in the saas build, so we don't want to start it here
+if (build != "saas") { // this is handled separately in the saas build, so we don't want to start it here
    logStreamingManager.start();
 }

--- a/server/private/lib/traefik/getTraefikConfig.ts
+++ b/server/private/lib/traefik/getTraefikConfig.ts
@@ -12,7 +12,6 @@
 */

 import {
-    browserGatewayTarget,
    certificates,
    db,
    domainNamespaces,
@@ -85,8 +84,7 @@ export async function getTraefikConfig(
    filterOutNamespaceDomains = false,
    generateLoginPageRouters = false,
    allowRawResources = true,
-    allowMaintenancePage = true,
-    allowBrowserGatewayResources = true
+    allowMaintenancePage = true
 ): Promise<any> {
    // Get resources with their targets and sites in a single optimized query
    // Start from sites on this exit node, then join to targets and resources
@@ -97,7 +95,9 @@ export async function getTraefikConfig(
            resourceName: resources.name,
            fullDomain: resources.fullDomain,
            ssl: resources.ssl,
+            http: resources.http,
            proxyPort: resources.proxyPort,
+            protocol: resources.protocol,
            subdomain: resources.subdomain,
            domainId: resources.domainId,
            enabled: resources.enabled,
@@ -109,7 +109,6 @@ export async function getTraefikConfig(
            proxyProtocol: resources.proxyProtocol,
            proxyProtocolVersion: resources.proxyProtocolVersion,
            wildcard: resources.wildcard,
-            mode: resources.mode,

            maintenanceModeEnabled: resources.maintenanceModeEnabled,
            maintenanceModeType: resources.maintenanceModeType,
@@ -172,8 +171,8 @@ export async function getTraefikConfig(
                ),
                inArray(sites.type, siteTypes),
                allowRawResources
-                    ? inArray(resources.mode, ["http", "udp", "tcp"]) // allow all three
-                    : eq(resources.mode, "http")
+                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
+                    : eq(resources.http, true)
            )
        )
        .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -227,8 +226,9 @@ export async function getTraefikConfig(
                key: key,
                fullDomain: row.fullDomain,
                ssl: row.ssl,
+                http: row.http,
                proxyPort: row.proxyPort,
-                mode: row.mode,
+                protocol: row.protocol,
                subdomain: row.subdomain,
                domainId: row.domainId,
                enabled: row.enabled,
@@ -277,138 +277,10 @@ export async function getTraefikConfig(
        });
    });

-    // Group browser gateway targets by resource
-    type BrowserGatewayResourceEntry = {
-        resourceId: number;
-        name: string;
-        fullDomain: string | null;
-        ssl: boolean | null;
-        subdomain: string | null;
-        domainId: string | null;
-        enabled: boolean | null;
-        wildcard: boolean | null;
-        domainCertResolver: string | null;
-        preferWildcardCert: boolean | null;
-        maintenanceModeEnabled: boolean | null;
-        maintenanceModeType: string | null;
-        maintenanceTitle: string | null;
-        maintenanceMessage: string | null;
-        maintenanceEstimatedTime: string | null;
-        targets: {
-            browserGatewayTargetId: number;
-            bgType: string;
-            siteId: number;
-            siteType: string;
-            siteOnline: boolean | null;
-            subnet: string | null;
-            siteExitNodeId: number | null;
-        }[];
-    };
-    const browserGatewayResourcesMap = new Map<
-        number,
-        BrowserGatewayResourceEntry
-    >();
-
-    if (allowBrowserGatewayResources) {
-        // Query browser gateway targets for this exit node
-        const browserGatewayRows = await db
-            .select({
-                // Resource fields
-                resourceId: resources.resourceId,
-                resourceName: resources.name,
-                fullDomain: resources.fullDomain,
-                ssl: resources.ssl,
-                subdomain: resources.subdomain,
-                domainId: resources.domainId,
-                enabled: resources.enabled,
-                wildcard: resources.wildcard,
-                domainCertResolver: domains.certResolver,
-                preferWildcardCert: domains.preferWildcardCert,
-                domainNamespaceId: domainNamespaces.domainNamespaceId,
-                // Maintenance fields
-                maintenanceModeEnabled: resources.maintenanceModeEnabled,
-                maintenanceModeType: resources.maintenanceModeType,
-                maintenanceTitle: resources.maintenanceTitle,
-                maintenanceMessage: resources.maintenanceMessage,
-                maintenanceEstimatedTime: resources.maintenanceEstimatedTime,
-                // Browser gateway target fields
-                browserGatewayTargetId:
-                    browserGatewayTarget.browserGatewayTargetId,
-                bgType: browserGatewayTarget.type,
-                // Site fields
-                siteId: sites.siteId,
-                siteType: sites.type,
-                siteOnline: sites.online,
-                subnet: sites.subnet,
-                siteExitNodeId: sites.exitNodeId
-            })
-            .from(browserGatewayTarget)
-            .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
-            .innerJoin(
-                resources,
-                eq(resources.resourceId, browserGatewayTarget.resourceId)
-            )
-            .leftJoin(domains, eq(domains.domainId, resources.domainId))
-            .leftJoin(
-                domainNamespaces,
-                eq(domainNamespaces.domainId, resources.domainId)
-            )
-            .where(
-                and(
-                    eq(resources.enabled, true),
-                    or(
-                        eq(sites.exitNodeId, exitNodeId),
-                        and(
-                            isNull(sites.exitNodeId),
-                            sql`(${siteTypes.includes("local") ? 1 : 0} = 1)`,
-                            eq(sites.type, "local"),
-                            sql`(${build != "saas" ? 1 : 0} = 1)`
-                        )
-                    ),
-                    inArray(sites.type, siteTypes)
-                )
-            );
-
-        for (const row of browserGatewayRows) {
-            if (filterOutNamespaceDomains && row.domainNamespaceId) {
-                continue;
-            }
-            if (!browserGatewayResourcesMap.has(row.resourceId)) {
-                browserGatewayResourcesMap.set(row.resourceId, {
-                    resourceId: row.resourceId,
-                    name: sanitize(row.resourceName) || "",
-                    fullDomain: row.fullDomain,
-                    ssl: row.ssl,
-                    subdomain: row.subdomain,
-                    domainId: row.domainId,
-                    enabled: row.enabled,
-                    wildcard: row.wildcard,
-                    domainCertResolver: row.domainCertResolver,
-                    preferWildcardCert: row.preferWildcardCert,
-                    maintenanceModeEnabled: row.maintenanceModeEnabled,
-                    maintenanceModeType: row.maintenanceModeType,
-                    maintenanceTitle: row.maintenanceTitle,
-                    maintenanceMessage: row.maintenanceMessage,
-                    maintenanceEstimatedTime: row.maintenanceEstimatedTime,
-                    targets: []
-                });
-            }
-            browserGatewayResourcesMap.get(row.resourceId)!.targets.push({
-                browserGatewayTargetId: row.browserGatewayTargetId,
-                bgType: row.bgType,
-                siteId: row.siteId,
-                siteType: row.siteType,
-                siteOnline: row.siteOnline,
-                subnet: row.subnet,
-                siteExitNodeId: row.siteExitNodeId
-            });
-        }
-    }
-
    let siteResourcesWithFullDomain: {
        siteResourceId: number;
        fullDomain: string | null;
-        mode: "http" | "host" | "cidr" | "ssh";
+        mode: "http" | "host" | "cidr";
    }[] = [];
    if (build == "enterprise") {
        // we dont want to do this on the cloud
@@ -452,12 +324,6 @@ export async function getTraefikConfig(
                domains.add(sr.fullDomain);
            }
        }
-        // Include browser gateway resource domains
-        for (const bgResource of browserGatewayResourcesMap.values()) {
-            if (bgResource.enabled && bgResource.ssl && bgResource.fullDomain) {
-                domains.add(bgResource.fullDomain);
-            }
-        }
        // get the valid certs for these domains
        validCerts = await getValidCertificatesForDomains(domains, true); // we are caching here because this is called often
        // logger.debug(`Valid certs for domains: ${JSON.stringify(validCerts)}`);
@@ -723,7 +589,7 @@ export async function getTraefikConfig(
                            resource.ssl ? entrypointHttps : entrypointHttp
                        ],
                        service: maintenanceServiceName,
-                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`)) `,
+                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
                        priority: 2001,
                        ...(resource.ssl ? { tls } : {})
                    };
@@ -964,7 +830,7 @@ export async function getTraefikConfig(
                continue;
            }

-            const protocol = resource.mode == "udp" ? "udp" : "tcp";
+            const protocol = resource.protocol.toLowerCase();
            const port = resource.proxyPort;

            if (!port) {
@@ -1059,267 +925,6 @@ export async function getTraefikConfig(
        }
    }

-    if (allowBrowserGatewayResources) {
-        // Generate Traefik config for browser gateway resources
-        const browserGatewayPort = 39999;
-        for (const [, bgResource] of browserGatewayResourcesMap.entries()) {
-            if (!bgResource.enabled) continue;
-            if (!bgResource.domainId) continue;
-            if (!bgResource.fullDomain) continue;
-
-            if (!config_output.http.routers) config_output.http.routers = {};
-            if (!config_output.http.services) config_output.http.services = {};
-
-            const fullDomain = bgResource.fullDomain;
-            const additionalMiddlewares =
-                config.getRawConfig().traefik.additional_middlewares || [];
-            const routerMiddlewares = [
-                badgerMiddlewareName,
-                ...additionalMiddlewares
-            ];
-
-            const hostRule = `Host(\`${fullDomain}\`)`;
-
-            // Build TLS config
-            let tls = {};
-            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
-                const domainParts = fullDomain.split(".");
-                let wildCard: string;
-                if (domainParts.length <= 2) {
-                    wildCard = `*.${domainParts.join(".")}`;
-                } else {
-                    wildCard = `*.${domainParts.slice(1).join(".")}`;
-                }
-                if (!bgResource.subdomain) {
-                    wildCard = fullDomain;
-                }
-
-                const globalDefaultResolver =
-                    config.getRawConfig().traefik.cert_resolver;
-                const globalDefaultPreferWildcard =
-                    config.getRawConfig().traefik.prefer_wildcard_cert;
-                const resolverName = bgResource.domainCertResolver
-                    ? bgResource.domainCertResolver.trim()
-                    : globalDefaultResolver;
-                const preferWildcard =
-                    bgResource.preferWildcardCert !== undefined &&
-                    bgResource.preferWildcardCert !== null
-                        ? bgResource.preferWildcardCert
-                        : globalDefaultPreferWildcard;
-
-                tls = {
-                    certResolver: resolverName,
-                    ...(preferWildcard ? { domains: [{ main: wildCard }] } : {})
-                };
-            } else {
-                const matchingCert = validCerts.find(
-                    (cert) => cert.queriedDomain === fullDomain
-                );
-                if (!matchingCert) {
-                    logger.debug(
-                        `No matching certificate found for browser gateway domain: ${fullDomain}`
-                    );
-                    continue;
-                }
-            }
-
-            const bgUiServiceName = `bg-r${bgResource.resourceId}-ui-service`;
-
-            if (bgResource.ssl) {
-                const redirectRouterName = `bg-r${bgResource.resourceId}-redirect`;
-                config_output.http.routers![redirectRouterName] = {
-                    entryPoints: [
-                        config.getRawConfig().traefik.http_entrypoint
-                    ],
-                    middlewares: [redirectHttpsMiddlewareName],
-                    service: bgUiServiceName,
-                    rule: hostRule,
-                    priority: 100
-                };
-            }
-
-            // Collect online sites for this resource (for any type)
-            const anySiteOnline = bgResource.targets.some((t) => t.siteOnline);
-
-            // Maintenance page logic for browser gateway resources
-            let showBgMaintenancePage = false;
-            if (bgResource.maintenanceModeEnabled) {
-                if (bgResource.maintenanceModeType === "forced") {
-                    showBgMaintenancePage = true;
-                } else if (bgResource.maintenanceModeType === "automatic") {
-                    showBgMaintenancePage = !anySiteOnline;
-                }
-            }
-
-            if (showBgMaintenancePage && allowMaintenancePage) {
-                const bgMaintenanceServiceName = `bg-r${bgResource.resourceId}-maintenance-service`;
-                const bgMaintenanceRouterName = `bg-r${bgResource.resourceId}-maintenance-router`;
-                const bgRewriteMiddlewareName = `bg-r${bgResource.resourceId}-maintenance-rewrite`;
-
-                const entrypointHttp =
-                    config.getRawConfig().traefik.http_entrypoint;
-                const entrypointHttps =
-                    config.getRawConfig().traefik.https_entrypoint;
-
-                const maintenancePort = config.getRawConfig().server.next_port;
-                const maintenanceHost =
-                    config.getRawConfig().server.internal_hostname;
-
-                if (!config_output.http.services)
-                    config_output.http.services = {};
-                if (!config_output.http.middlewares)
-                    config_output.http.middlewares = {};
-                if (!config_output.http.routers)
-                    config_output.http.routers = {};
-
-                config_output.http.services![bgMaintenanceServiceName] = {
-                    loadBalancer: {
-                        servers: [
-                            {
-                                url: `http://${maintenanceHost}:${maintenancePort}`
-                            }
-                        ],
-                        passHostHeader: true
-                    }
-                };
-
-                config_output.http.middlewares![bgRewriteMiddlewareName] = {
-                    replacePathRegex: {
-                        regex: "^/(.*)",
-                        replacement: "/maintenance-screen"
-                    }
-                };
-
-                config_output.http.routers![bgMaintenanceRouterName] = {
-                    entryPoints: [
-                        bgResource.ssl ? entrypointHttps : entrypointHttp
-                    ],
-                    service: bgMaintenanceServiceName,
-                    middlewares: [bgRewriteMiddlewareName],
-                    rule: hostRule,
-                    priority: 2000,
-                    ...(bgResource.ssl ? { tls } : {})
-                };
-
-                config_output.http.routers![
-                    `${bgMaintenanceRouterName}-assets`
-                ] = {
-                    entryPoints: [
-                        bgResource.ssl ? entrypointHttps : entrypointHttp
-                    ],
-                    service: bgMaintenanceServiceName,
-                    rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
-                    priority: 2001,
-                    ...(bgResource.ssl ? { tls } : {})
-                };
-
-                continue;
-            }
-
-            // Group targets by type and generate per-type websocket routers and services
-            const typeMap = new Map<string, typeof bgResource.targets>();
-            for (const t of bgResource.targets) {
-                if (!typeMap.has(t.bgType)) typeMap.set(t.bgType, []);
-                typeMap.get(t.bgType)!.push(t);
-            }
-
-            for (const [bgType, typedTargets] of typeMap.entries()) {
-                const bgKey = `bg-r${bgResource.resourceId}-${bgType}`;
-                const bgRouterName = `${bgKey}-router`;
-                const bgServiceName = `${bgKey}-service`;
-                const bgRule = `${hostRule} && PathPrefix(\`/gateway/${bgType}\`)`;
-
-                const servers = typedTargets
-                    .filter((t) => {
-                        if (!t.siteOnline && anySiteOnline) return false;
-                        if (t.siteType === "newt") return !!t.subnet;
-                        return false; // browser gateway only supported on newt sites
-                    })
-                    .map((t) => ({
-                        url: `http://${t.subnet!.split("/")[0]}:${browserGatewayPort}`
-                    }))
-                    .filter(
-                        (v, i, a) => a.findIndex((u) => u.url === v.url) === i
-                    );
-
-                config_output.http.routers![bgRouterName] = {
-                    entryPoints: [
-                        bgResource.ssl
-                            ? config.getRawConfig().traefik.https_entrypoint
-                            : config.getRawConfig().traefik.http_entrypoint
-                    ],
-                    middlewares: routerMiddlewares,
-                    service: bgServiceName,
-                    rule: bgRule,
-                    priority: 110, // highest - websocket path takes precedence
-                    ...(bgResource.ssl ? { tls } : {})
-                };
-
-                config_output.http.services![bgServiceName] = {
-                    loadBalancer: {
-                        servers
-                    }
-                };
-            }
-
-            // UI: serve the browser gateway page from the internal pangolin instance.
-            // The primary type is used for the path rewrite (e.g. /rdp), mirroring
-            // how the maintenance page rewrites everything to /maintenance-screen.
-            const primaryType = typeMap.keys().next().value as string;
-            const internalHost = config.getRawConfig().server.internal_hostname;
-            const internalPort = config.getRawConfig().server.next_port;
-            const uiRewriteMiddlewareName = `bg-r${bgResource.resourceId}-ui-rewrite`;
-            const entrypoint = bgResource.ssl
-                ? config.getRawConfig().traefik.https_entrypoint
-                : config.getRawConfig().traefik.http_entrypoint;
-
-            if (!config_output.http.middlewares) {
-                config_output.http.middlewares = {};
-            }
-
-            config_output.http.middlewares![uiRewriteMiddlewareName] = {
-                replacePathRegex: {
-                    regex: "^/(.*)",
-                    replacement: `/${primaryType}`
-                }
-            };
-
-            config_output.http.services![bgUiServiceName] = {
-                loadBalancer: {
-                    servers: [
-                        {
-                            url: `http://${internalHost}:${internalPort}`
-                        }
-                    ]
-                }
-            };
-
-            // Assets router at higher priority so /_next files load without rewrite
-            config_output.http.routers![
-                `bg-r${bgResource.resourceId}-assets-router`
-            ] = {
-                entryPoints: [entrypoint],
-                middlewares: routerMiddlewares,
-                service: bgUiServiceName,
-                rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
-                priority: 101,
-                ...(bgResource.ssl ? { tls } : {})
-            };
-
-            // Catch-all router rewrites everything on the domain to /{primaryType}
-            config_output.http.routers![
-                `bg-r${bgResource.resourceId}-ui-router`
-            ] = {
-                entryPoints: [entrypoint],
-                middlewares: [...routerMiddlewares, uiRewriteMiddlewareName],
-                service: bgUiServiceName,
-                rule: hostRule,
-                priority: 100,
-                ...(bgResource.ssl ? { tls } : {})
-            };
-        }
-    }
-
    // Add Traefik routes for siteResource aliases (HTTP mode + SSL) so that
    // Traefik generates TLS certificates for those domains even when no
    // matching resource exists yet.
@@ -1435,7 +1040,7 @@ export async function getTraefikConfig(
            config_output.http.routers[`${siteResourceRouterName}-assets`] = {
                entryPoints: [config.getRawConfig().traefik.https_entrypoint],
                service: siteResourceServiceName,
-                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
+                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
                priority: 101,
                tls
            };
@@ -1538,7 +1143,7 @@ export async function getTraefikConfig(
                        config.getRawConfig().traefik.https_entrypoint
                    ],
                    service: "landing-service",
-                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
+                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`))`,
                    priority: 203,
                    tls: tls
                };
--- a/server/private/middlewares/verifyCertificateAccess.ts
+++ b/server/private/middlewares/verifyCertificateAccess.ts
@@ -19,7 +19,6 @@ import { eq, and } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import logger from "@server/logger";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyCertificateAccess(
    req: Request,
@@ -28,43 +27,11 @@ export async function verifyCertificateAccess(
 ) {
    try {
        // Assume user/org access is already verified
-        const orgId = getFirstString(req.params.orgId);
-
-        const certIdFromParams = getFirstString(req.params?.certId);
-        const certIdFromBody = getFirstString(req.body?.certId);
-
-        if (
-            certIdFromParams &&
-            certIdFromBody &&
-            certIdFromParams !== certIdFromBody
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Certificate ID provided in both URL and body with different values"
-                )
-            );
-        }
-
-        const certId = certIdFromParams || certIdFromBody;
-
-        const domainIdFromParams = getFirstString(req.params?.domainId);
-        const domainIdFromBody = getFirstString(req.body?.domainId);
-
-        if (
-            domainIdFromParams &&
-            domainIdFromBody &&
-            domainIdFromParams !== domainIdFromBody
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Domain ID provided in both URL and body with different values"
-                )
-            );
-        }
-
-        let domainId = domainIdFromParams || domainIdFromBody;
+        const orgId = req.params.orgId;
+        const certId =
+            req.params.certId || req.body?.certId || req.query?.certId;
+        let domainId =
+            req.params.domainId || req.body?.domainId || req.query?.domainId;

        if (!orgId) {
            return next(
@@ -98,7 +65,7 @@ export async function verifyCertificateAccess(
                );
            }

-            domainId = cert.domainId ?? undefined;
+            domainId = cert.domainId;
            if (!domainId) {
                return next(
                    createHttpError(
--- a/Show More
+++ b/Show More