feat(agentnetwork): store the endpoint as domain + proxy address

Replace the settings row's (cluster, subdomain) identity columns with
(domain, proxy_address): domain is the endpoint hostname agents call,
proxy_address the declared cluster address of the proxy serving it. The
serving shape is the shape of the pin -- self-addressed (domain ==
proxy_address, a proxy dedicated to the account) or labeled (domain one
label beneath a shared cluster's address) -- so no mode flag or config
exists anywhere, and any mix of shapes coexists per account on one
deployment.

Bootstrap becomes an explicit POST /api/agent-network/settings taking
exactly one of proxy_address (the server allocates an adjective-noun
label beneath it) or endpoint (claimed verbatim, address-first). The
identity fields leave the PUT schema entirely -- immutability by shape
rather than by runtime rejection -- and provider create loses
bootstrap_cluster and all settings side effects, which also retires two
latent bugs: the dashboard's unsorted [0] free-domain pick making a
permanent decision, and bootstrap failures swallowed at debug level
inside a 200 provider create.

The global unique index moves from the label to the full hostname --
the actual invariant. Labels may repeat across clusters again, and
self-addressed rows (no label) cannot collide on an empty string. The
reverse lookup becomes a point query on that index, deleting the
clusterFromDomain suffix heuristic, and the synthesizer stamps
ProxyCluster from the settings row as a field read. A pre-AutoMigrate
migration backfills existing rows (domain = subdomain.cluster,
proxy_address = cluster) and drops the legacy columns, failing loudly
on rows with no identity to derive.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

management/server/agentnetwork_budgetrule_realstack_test.go

@@ -68,7 +68,8 @@ func TestAgentNetwork_BudgetRuleCRUD_RealManager(t *testing.T) {
 
 // TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection is the
 // GC-1 guard for UpdateSettings: it must apply the collection toggles while
-// preserving the immutable Cluster/Subdomain pinned at bootstrap.
+// preserving the immutable Domain/ProxyAddress assigned at bootstrap — the
+// identity fields are not part of the update surface at all.
 func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err, "createManager must succeed")
@@ -84,7 +85,14 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 
 	mgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
-	// Creating a provider bootstraps the settings row (cluster + subdomain).
+	// Bootstrap is an explicit settings create; providers have no settings
+	// side effects anymore.
+	before, err := mgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
+	require.NoError(t, err, "CreateSettings must bootstrap the row")
+	require.Equal(t, clusterAddr, before.ProxyAddress, "proxy address pinned at bootstrap")
+	require.NotEmpty(t, before.Domain, "endpoint allocated at bootstrap")
+	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
+
 	_, err = mgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
 		AccountID:   accountID,
 		ProviderID:  "openai_api",
@@ -93,43 +101,30 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 		APIKey:      "sk-test",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	}, clusterAddr)
-	require.NoError(t, err, "CreateProvider must bootstrap settings")
-
-	before, err := mgr.GetSettings(ctx, accountID, adminUserID)
-	require.NoError(t, err, "GetSettings must succeed after bootstrap")
-	require.Equal(t, clusterAddr, before.Cluster, "cluster pinned at bootstrap")
-	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
-	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
-
-	// A cluster different from the one pinned at bootstrap must be rejected
-	// outright — never silently swapped or ignored.
-	_, err = mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
-		AccountID:           accountID,
-		Cluster:             "attacker.cluster",
-		EnableLogCollection: true,
 	})
-	require.Error(t, err, "UpdateSettings with a mismatched cluster must fail")
+	require.NoError(t, err, "CreateProvider must succeed")
 
-	// Flipping the toggles works with the pinned cluster echoed back (and
-	// with it omitted); the subdomain is never taken from the request.
+	// Flipping the toggles works; identity fields set on the request value
+	// are ignored by FromAPIRequest/UpdateSettings by construction, but even
+	// a hand-rolled Settings value cannot smuggle them into the row.
 	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
 		AccountID:              accountID,
-		Cluster:                clusterAddr,
-		Subdomain:              "evil",
+		Domain:                 "evil.example.com",
+		ProxyAddress:           "attacker.cluster",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,
 		RedactPii:              true,
 	})
 	require.NoError(t, err, "UpdateSettings must succeed")
-	assert.Equal(t, before.Cluster, updated.Cluster, "cluster is immutable and must be preserved")
-	assert.Equal(t, before.Subdomain, updated.Subdomain, "subdomain is immutable and must be preserved")
+	assert.Equal(t, before.Domain, updated.Domain, "domain is immutable and must be preserved")
+	assert.Equal(t, before.ProxyAddress, updated.ProxyAddress, "proxy address is immutable and must be preserved")
 	assert.True(t, updated.EnableLogCollection, "log collection toggle must apply")
 	assert.True(t, updated.EnablePromptCollection, "prompt collection toggle must apply")
 	assert.True(t, updated.RedactPii, "redact toggle must apply")
 
 	reloaded, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 	require.NoError(t, err)
-	assert.Equal(t, before.Cluster, reloaded.Cluster, "persisted cluster unchanged")
+	assert.Equal(t, before.Domain, reloaded.Domain, "persisted domain unchanged")
+	assert.Equal(t, before.ProxyAddress, reloaded.ProxyAddress, "persisted proxy address unchanged")
 	assert.True(t, reloaded.EnablePromptCollection, "persisted prompt collection toggled on")
 }

management/server/agentnetwork_realstack_test.go

@@ -92,6 +92,9 @@ func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
 	// UpdateAccountPeers, which is the path under test.
 	agentMgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
+	_, err = agentMgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
+	require.NoError(t, err, "CreateSettings must bootstrap the endpoint")
+
 	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
 		AccountID:   accountID,
 		ProviderID:  "openai_api",
@@ -100,7 +103,7 @@ func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
 		APIKey:      "sk-test-key",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	}, clusterAddr)
+	})
 	require.NoError(t, err, "CreateProvider must succeed")
 
 	policy, err := agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{

management/server/migration/migration_agentnetwork.go

@@ -0,0 +1,97 @@
+package migration
+
+import (
+	"context"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+)
+
+// agentNetworkSettingsMigration is a local view of the agent_network_settings
+// table spanning both the legacy identity columns (cluster, subdomain) and
+// their replacement (domain, proxy_address), so the migrator can address all
+// four during the reshape without importing the current model.
+type agentNetworkSettingsMigration struct {
+	AccountID    string `gorm:"primaryKey"`
+	Cluster      string
+	Subdomain    string
+	Domain       string `gorm:"type:varchar(255)"`
+	ProxyAddress string `gorm:"type:varchar(255)"`
+}
+
+func (agentNetworkSettingsMigration) TableName() string { return "agent_network_settings" }
+
+// MigrateAgentNetworkSettingsToDomain reshapes agent_network_settings from the
+// legacy (cluster, subdomain) identity columns to (domain, proxy_address):
+// domain becomes `<subdomain>.<cluster>` — the endpoint hostname the old
+// columns derived — and proxy_address becomes the cluster address, preserving
+// which proxy serves the account. Runs before AutoMigrate, which then creates
+// the unique index on the freshly backfilled domain column.
+//
+// A legacy row missing either half cannot be given an endpoint; the old
+// bootstrap always wrote both, so such a row indicates corruption and the
+// migration fails loudly rather than leaving an empty domain to collide with
+// the unique index confusingly.
+func MigrateAgentNetworkSettingsToDomain(ctx context.Context, db *gorm.DB) error {
+	model := &agentNetworkSettingsMigration{}
+	migrator := db.Migrator()
+
+	if !migrator.HasTable(model) {
+		return nil
+	}
+	if !migrator.HasColumn(model, "cluster") {
+		// Fresh schema or already migrated — nothing to reshape.
+		return nil
+	}
+
+	return db.Transaction(func(tx *gorm.DB) error {
+		txMigrator := tx.Migrator()
+		for _, field := range []string{"Domain", "ProxyAddress"} {
+			if !txMigrator.HasColumn(model, field) {
+				if err := txMigrator.AddColumn(model, field); err != nil {
+					return fmt.Errorf("add %s column to agent_network_settings: %w", field, err)
+				}
+			}
+		}
+
+		concat := "subdomain || '.' || cluster"
+		if tx.Name() == "mysql" {
+			concat = "CONCAT(subdomain, '.', cluster)"
+		}
+		res := tx.Exec(fmt.Sprintf(
+			"UPDATE agent_network_settings SET domain = %s, proxy_address = cluster WHERE (domain IS NULL OR domain = '') AND cluster <> '' AND subdomain <> ''",
+			concat,
+		))
+		if res.Error != nil {
+			return fmt.Errorf("backfill agent_network_settings domain: %w", res.Error)
+		}
+
+		var unmigratable int64
+		if err := tx.Model(model).Where("domain IS NULL OR domain = ''").Count(&unmigratable).Error; err != nil {
+			return fmt.Errorf("count unmigratable agent_network_settings rows: %w", err)
+		}
+		if unmigratable > 0 {
+			return fmt.Errorf(
+				"%d agent_network_settings row(s) have no cluster/subdomain to derive an endpoint from; resolve them manually before upgrading",
+				unmigratable,
+			)
+		}
+
+		if txMigrator.HasIndex(model, "idx_agent_network_settings_cluster_subdomain") {
+			if err := txMigrator.DropIndex(model, "idx_agent_network_settings_cluster_subdomain"); err != nil {
+				return fmt.Errorf("drop legacy agent_network_settings index: %w", err)
+			}
+		}
+		for _, field := range []string{"Cluster", "Subdomain"} {
+			if err := txMigrator.DropColumn(model, field); err != nil {
+				return fmt.Errorf("drop legacy agent_network_settings column %s: %w", field, err)
+			}
+		}
+
+		if res.RowsAffected > 0 {
+			log.WithContext(ctx).Infof("migrated %d agent_network_settings row(s) to domain/proxy_address", res.RowsAffected)
+		}
+		return nil
+	})
+}

management/server/migration/migration_test.go

@@ -736,3 +736,85 @@ func TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated(t *testing.T) {
 	assert.InDelta(t, 0.004, row.OutputCostUSD, 1e-9)
 	assert.InDelta(t, 0.01, row.TotalCostUSD(), 1e-9, "derived total sums the four buckets")
 }
+
+// legacyAgentNetworkSettings is the pre-reshape schema: identity carried as
+// (cluster, subdomain) instead of (domain, proxy_address).
+type legacyAgentNetworkSettings struct {
+	AccountID           string `gorm:"primaryKey"`
+	Cluster             string
+	Subdomain           string
+	EnableLogCollection bool
+}
+
+func (legacyAgentNetworkSettings) TableName() string { return "agent_network_settings" }
+
+// TestMigrateAgentNetworkSettingsToDomain_BackfillsAndDropsLegacyColumns pins
+// the reshape: domain becomes `<subdomain>.<cluster>`, proxy_address becomes
+// the cluster, the legacy columns are dropped, and non-identity fields ride
+// through untouched.
+func TestMigrateAgentNetworkSettingsToDomain_BackfillsAndDropsLegacyColumns(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.AutoMigrate(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
+		AccountID: "acct-1", Cluster: "eu.proxy.netbird.io", Subdomain: "violet", EnableLogCollection: true,
+	}).Error)
+	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
+		AccountID: "acct-2", Cluster: "us.proxy.netbird.io", Subdomain: "violet",
+	}).Error)
+
+	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db))
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.Settings{}),
+		"AutoMigrate must create the domain unique index over the backfilled values")
+
+	var one, two agentNetworkTypes.Settings
+	require.NoError(t, db.First(&one, "account_id = ?", "acct-1").Error)
+	assert.Equal(t, "violet.eu.proxy.netbird.io", one.Domain, "domain must combine subdomain and cluster")
+	assert.Equal(t, "eu.proxy.netbird.io", one.ProxyAddress, "proxy address must carry the cluster")
+	assert.True(t, one.EnableLogCollection, "non-identity fields must ride through")
+	require.NoError(t, db.First(&two, "account_id = ?", "acct-2").Error)
+	assert.Equal(t, "violet.us.proxy.netbird.io", two.Domain,
+		"duplicate labels on different clusters are distinct hostnames and must both survive")
+
+	migrator := db.Migrator()
+	assert.False(t, migrator.HasColumn(&legacyAgentNetworkSettings{}, "cluster"), "legacy cluster column must be dropped")
+	assert.False(t, migrator.HasColumn(&legacyAgentNetworkSettings{}, "subdomain"), "legacy subdomain column must be dropped")
+}
+
+// TestMigrateAgentNetworkSettingsToDomain_SkipsAlreadyMigrated proves the
+// migration is safe to re-run: with no legacy column present it is a no-op.
+func TestMigrateAgentNetworkSettingsToDomain_SkipsAlreadyMigrated(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.Settings{}))
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.Settings{}))
+	require.NoError(t, db.Create(&agentNetworkTypes.Settings{
+		AccountID: "acct-1", Domain: "gw.example.com", ProxyAddress: "gw.example.com",
+	}).Error)
+
+	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db),
+		"running against an already-migrated table must be a no-op, not an error")
+
+	var row agentNetworkTypes.Settings
+	require.NoError(t, db.First(&row, "account_id = ?", "acct-1").Error)
+	assert.Equal(t, "gw.example.com", row.Domain, "migrated rows must be untouched")
+}
+
+// TestMigrateAgentNetworkSettingsToDomain_FailsOnUnmigratableRow pins the
+// loud-failure contract: a legacy row missing its identity halves cannot be
+// given an endpoint, and silently leaving an empty domain would collide with
+// the unique index confusingly later.
+func TestMigrateAgentNetworkSettingsToDomain_FailsOnUnmigratableRow(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.AutoMigrate(&legacyAgentNetworkSettings{}))
+	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
+		AccountID: "acct-broken", Cluster: "", Subdomain: "",
+	}).Error)
+
+	err := migration.MigrateAgentNetworkSettingsToDomain(ctx, db)
+	require.Error(t, err, "a row with no identity to derive an endpoint from must fail the migration")
+	assert.Contains(t, err.Error(), "resolve them manually", "the error must tell the operator what to do")
+}

management/server/store/sql_store_agentnetwork.go

@@ -315,25 +315,65 @@ func (s *SqlStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength
 	return settings, nil
 }
 
-// GetAgentNetworkSettingsByCluster returns every Settings row pinned to
-// the given proxy cluster. Used by the bootstrap label generator to
-// build the set of subdomains already taken on a cluster.
-func (s *SqlStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
+// GetAgentNetworkSettingsByProxyAddress returns every Settings row whose
+// gateway is served by the proxy declaring the given cluster address. Used by
+// cluster-scoped synthesis to find the accounts a shared proxy serves.
+func (s *SqlStore) GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*agentNetworkTypes.Settings, error) {
 	tx := s.db
 	if lockStrength != LockingStrengthNone {
 		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
 	}
 
 	var settings []*agentNetworkTypes.Settings
-	result := tx.Find(&settings, "cluster = ?", cluster)
+	result := tx.Find(&settings, "proxy_address = ?", proxyAddress)
 	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get agent network settings by cluster from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get agent network settings by cluster from store")
+		log.WithContext(ctx).Errorf("failed to get agent network settings by proxy address from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings by proxy address from store")
 	}
 
 	return settings, nil
 }
 
+// GetAgentNetworkSettingsByDomain resolves the single Settings row holding the
+// given endpoint hostname — a point query on the domain unique index. Returns
+// status.NotFound when no account owns the domain.
+func (s *SqlStore) GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*agentNetworkTypes.Settings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var settings agentNetworkTypes.Settings
+	result := tx.Take(&settings, "domain = ?", domain)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "agent network settings for domain %s not found", domain)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network settings by domain from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings by domain from store")
+	}
+
+	return &settings, nil
+}
+
+// CreateAgentNetworkSettings inserts a new settings row.
+//
+// Unlike SaveAgentNetworkSettings (an upsert) this is a plain INSERT, and it
+// returns the driver error unwrapped. Both properties are required by the
+// bootstrap allocator: an upsert would overwrite whichever row it collided
+// with, and the allocator classifies the rejection by matching the driver's
+// message — a unique violation on the account primary key means a concurrent
+// bootstrap for the same account won, and one on the domain index means the
+// hostname is taken.
+func (s *SqlStore) CreateAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
+	if err := s.db.Create(settings).Error; err != nil {
+		log.WithContext(ctx).Debugf("failed to create agent network settings: %v", err)
+		return err
+	}
+	return nil
+}
+
 // SaveAgentNetworkSettings upserts the per-account Agent Network
 // settings row.
 func (s *SqlStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {

management/server/store/sql_store_agentnetwork_budgetrule_test.go

@@ -88,9 +88,9 @@ func TestAgentNetworkSettings_RealStore_CollectionTogglesRoundTrip(t *testing.T)
 
 	const accountID = "acc-settings-toggles"
 	require.NoError(t, s.SaveAgentNetworkSettings(ctx, &agentNetworkTypes.Settings{
-		AccountID: accountID,
-		Cluster:   "eu.proxy.netbird.io",
-		Subdomain: "violet",
+		AccountID:    accountID,
+		Domain:       "violet.eu.proxy.netbird.io",
+		ProxyAddress: "eu.proxy.netbird.io",
 	}))
 
 	got, err := s.GetAgentNetworkSettings(ctx, LockingStrengthNone, accountID)

management/server/store/store.go

@@ -360,7 +360,9 @@ type Store interface {
 	DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error
 	GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error)
 	GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error)
-	GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error)
+	GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*agentNetworkTypes.Settings, error)
+	GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*agentNetworkTypes.Settings, error)
+	CreateAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
 	SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
 	IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error
 	IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error
@@ -608,6 +610,9 @@ func getMigrationsPreAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.BackfillPublicIDs[posture.Checks](ctx, db)
 		},
+		func(db *gorm.DB) error {
+			return migration.MigrateAgentNetworkSettingsToDomain(ctx, db)
+		},
 	}
 }
 

management/server/store/store_mock.go

@@ -268,6 +268,20 @@ func (mr *MockStoreMockRecorder) CreateAgentNetworkAccessLog(ctx, entry, groups
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkAccessLog), ctx, entry, groups)
 }
 
+// CreateAgentNetworkSettings mocks base method.
+func (m *MockStore) CreateAgentNetworkSettings(ctx context.Context, settings *types.Settings) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateAgentNetworkSettings", ctx, settings)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateAgentNetworkSettings indicates an expected call of CreateAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkSettings(ctx, settings interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkSettings), ctx, settings)
+}
+
 // CreateAgentNetworkUsage mocks base method.
 func (m *MockStore) CreateAgentNetworkUsage(ctx context.Context, usage *types.AgentNetworkUsage, groups []types.AgentNetworkUsageGroup) error {
 	m.ctrl.T.Helper()
@@ -1687,19 +1701,34 @@ func (mr *MockStoreMockRecorder) GetAgentNetworkSettings(ctx, lockStrength, acco
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettings), ctx, lockStrength, accountID)
 }
 
-// GetAgentNetworkSettingsByCluster mocks base method.
-func (m *MockStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*types.Settings, error) {
+// GetAgentNetworkSettingsByDomain mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*types.Settings, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByCluster", ctx, lockStrength, cluster)
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByDomain", ctx, lockStrength, domain)
+	ret0, _ := ret[0].(*types.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettingsByDomain indicates an expected call of GetAgentNetworkSettingsByDomain.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByDomain(ctx, lockStrength, domain interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByDomain", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByDomain), ctx, lockStrength, domain)
+}
+
+// GetAgentNetworkSettingsByProxyAddress mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*types.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByProxyAddress", ctx, lockStrength, proxyAddress)
 	ret0, _ := ret[0].([]*types.Settings)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
-// GetAgentNetworkSettingsByCluster indicates an expected call of GetAgentNetworkSettingsByCluster.
-func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByCluster(ctx, lockStrength, cluster interface{}) *gomock.Call {
+// GetAgentNetworkSettingsByProxyAddress indicates an expected call of GetAgentNetworkSettingsByProxyAddress.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByProxyAddress(ctx, lockStrength, proxyAddress interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByCluster", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByCluster), ctx, lockStrength, cluster)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByProxyAddress", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByProxyAddress), ctx, lockStrength, proxyAddress)
 }
 
 // GetAgentNetworkUsageRows mocks base method.