mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-17 11:09:04 +02:00
riccardom
54aa32788e
The iOS section was written while the policy stopped at the app: the network extension that runs the engine has its own preferences domain, and Apple's app-configuration channel does not deliver there. The app now mirrors the configuration into the shared App Group and tells the extension when it changes, so the keys the engine applies to the connection are enforced too. What replaces the old warning is a timing caveat, which is what an admin actually needs in order to plan a rollout. The hand-off happens only while the app is running: in the foreground a change reaches the tunnel within about 30 seconds or immediately on activation, but iOS suspends a backgrounded app, so a policy pushed — or withdrawn — in that window applies the next time the app is opened. A tunnel brought up by VPN On Demand or the widget therefore runs on the last policy the app saw. tvOS keeps the old behaviour and now says so: the hand-off needs a shared app group, which does not work between the tvOS app and its extension, so only the interface is enforced there. Also corrected: blockInbound, wireguardPort and lazyConnection are no longer listed as having no effect but as having no control to lock, and debugBundleUploadURL moves out of the ignored list, since the engine applies it when a remote job produces a bundle. The app-config template carries the same three keys and the same timing note.